Prevent injecting a forged encrypted message and using session_id/sender_key of another room.

Author: ariskotsomitopoulos

matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/crypto/DefaultCryptoService.kt

@@ -1392,6 +1392,9 @@ internal class DefaultCryptoService @Inject constructor(
                                 senderKey = sessionInfoPair.second,
                                 sharedHistory = true
                         )
+                    }?.filter { inboundGroupSession ->
+                        // Prevent injecting a forged encrypted message and using session_id/sender_key of another room.
+                        inboundGroupSession.roomId == roomId
                     }?.forEach { inboundGroupSession ->
                         // Share the sharable session to userId with deviceId
                         val exportedKeys = inboundGroupSession.exportKeys(sharedHistory = true)