From 3f27be9bcb9c8feb8ef116d6fa93747a1b4ced00 Mon Sep 17 00:00:00 2001
From: iequidoo <dgreshilov@gmail.com>
Date: Sun, 7 Dec 2025 13:21:47 -0300
Subject: [PATCH] refactor: Add params when forwarding message instead of
 removing unneeded ones

We periodically forget to remove new params from forwarded messages as this can't be catched by
existing tests, some examples:
bfc08abe88d0d68eb75fb4ba3a45f5fd89a1e2ca
a1837aeb8c73a07fa5ee35d8a1cd265b5a2ff599
56b2361f01e9de9f3bfa262865a8fdd134e22f7a

This may leak confidential data. Instead, it's better to explicitly list params that we want to
forward, then if we forget to forward some param, a test on forwarding messages carrying the new
functionality will break, or the bug will be reported earlier, it's easier to notice that some info
is missing than some extra info is leaked.
---
 src/chat.rs  | 24 +++++++++++++-----------
 src/param.rs |  8 ++++++++
 2 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/src/chat.rs b/src/chat.rs
index b8d6c8c52..b08bd17af 100644
--- a/src/chat.rs
+++ b/src/chat.rs
@@ -4234,6 +4234,9 @@ pub async fn forward_msgs(context: &Context, msg_ids: &[MsgId], chat_id: ChatId)
             bail!("cannot forward drafts.");
         }
 
+        let mut param = msg.param;
+        msg.param = Params::new();
+
         if msg.get_viewtype() != Viewtype::Sticker {
             msg.param
                 .set_int(Param::Forwarded, src_msg_id.to_u32() as i32);
@@ -4243,17 +4246,16 @@ pub async fn forward_msgs(context: &Context, msg_ids: &[MsgId], chat_id: ChatId)
             msg.viewtype = Viewtype::Text;
         }
 
-        msg.param.remove(Param::GuaranteeE2ee);
-        msg.param.remove(Param::ForcePlaintext);
-        msg.param.remove(Param::Cmd);
-        msg.param.remove(Param::OverrideSenderDisplayname);
-        msg.param.remove(Param::WebxdcDocument);
-        msg.param.remove(Param::WebxdcDocumentTimestamp);
-        msg.param.remove(Param::WebxdcSummary);
-        msg.param.remove(Param::WebxdcSummaryTimestamp);
-        msg.param.remove(Param::IsEdited);
-        msg.param.remove(Param::WebrtcRoom);
-        msg.param.remove(Param::WebrtcAccepted);
+        let param = &mut param;
+        msg.param.steal(param, Param::File);
+        msg.param.steal(param, Param::Filename);
+        msg.param.steal(param, Param::Width);
+        msg.param.steal(param, Param::Height);
+        msg.param.steal(param, Param::Duration);
+        msg.param.steal(param, Param::MimeType);
+        msg.param.steal(param, Param::ProtectQuote);
+        msg.param.steal(param, Param::Quote);
+        msg.param.steal(param, Param::Summary1);
         msg.in_reply_to = None;
 
         // do not leak data as group names; a default subject is generated by mimefactory
diff --git a/src/param.rs b/src/param.rs
index 16c10b033..0640b551e 100644
--- a/src/param.rs
+++ b/src/param.rs
@@ -433,6 +433,14 @@ impl Params {
         self.set(key, format!("{value}"));
         self
     }
+
+    pub fn steal(&mut self, src: &mut Self, key: Param) -> &mut Self {
+        let val = src.inner.remove(&key);
+        if let Some(val) = val {
+            self.inner.insert(key, val);
+        }
+        self
+    }
 }
 
 #[cfg(test)]