From 053b564d752176d75ca9a0480e959e690d93f899 Mon Sep 17 00:00:00 2001
From: Michael Telatynski <7t3chguy@gmail.com>
Date: Mon, 31 Jul 2023 15:42:23 +0100
Subject: [PATCH] De-duplicate reactions by sender to account for
 faulty/malicious servers (#11340)

* De-duplicate reactions by sender to account for faulty/malicious servers

* Fix copyrights
---
 src/components/views/messages/ReactionsRow.tsx           | 9 +++++++--
 src/components/views/messages/ReactionsRowButton.tsx     | 4 ++--
 .../views/messages/ReactionsRowButtonTooltip.tsx         | 4 ++--
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/components/views/messages/ReactionsRow.tsx b/src/components/views/messages/ReactionsRow.tsx
index bde1cba43c..cb1f7ab0f4 100644
--- a/src/components/views/messages/ReactionsRow.tsx
+++ b/src/components/views/messages/ReactionsRow.tsx
@@ -18,6 +18,7 @@ import React, { SyntheticEvent } from "react";
 import classNames from "classnames";
 import { MatrixEvent, MatrixEventEvent } from "matrix-js-sdk/src/models/event";
 import { Relations, RelationsEvent } from "matrix-js-sdk/src/models/relations";
+import { uniqBy } from "lodash";
 
 import { _t } from "../../../languageHandler";
 import { isContentActionable } from "../../../utils/EventUtils";
@@ -177,6 +178,10 @@ export default class ReactionsRow extends React.PureComponent<IProps, IState> {
                 if (!count) {
                     return null;
                 }
+                // Deduplicate the events as per the spec https://spec.matrix.org/v1.7/client-server-api/#annotations-client-behaviour
+                // This isn't done by the underlying data model as applications may still need access to the whole list of events
+                // for moderation purposes.
+                const deduplicatedEvents = uniqBy([...events], (e) => e.getSender());
                 const myReactionEvent = myReactions?.find((mxEvent) => {
                     if (mxEvent.isRedacted()) {
                         return false;
@@ -187,9 +192,9 @@ export default class ReactionsRow extends React.PureComponent<IProps, IState> {
                     <ReactionsRowButton
                         key={content}
                         content={content}
-                        count={count}
+                        count={deduplicatedEvents.length}
                         mxEvent={mxEvent}
-                        reactionEvents={events}
+                        reactionEvents={deduplicatedEvents}
                         myReactionEvent={myReactionEvent}
                         disabled={
                             !this.context.canReact ||
diff --git a/src/components/views/messages/ReactionsRowButton.tsx b/src/components/views/messages/ReactionsRowButton.tsx
index 8dd144eff6..e89bcb4cda 100644
--- a/src/components/views/messages/ReactionsRowButton.tsx
+++ b/src/components/views/messages/ReactionsRowButton.tsx
@@ -31,8 +31,8 @@ interface IProps {
     content: string;
     // The count of votes for this key
     count: number;
-    // A Set of Matrix reaction events for this key
-    reactionEvents: Set<MatrixEvent>;
+    // A list of Matrix reaction events for this key
+    reactionEvents: MatrixEvent[];
     // A possible Matrix event if the current user has voted for this type
     myReactionEvent?: MatrixEvent;
     // Whether to prevent quick-reactions by clicking on this reaction
diff --git a/src/components/views/messages/ReactionsRowButtonTooltip.tsx b/src/components/views/messages/ReactionsRowButtonTooltip.tsx
index 62b5a6e95a..22dfaf08b8 100644
--- a/src/components/views/messages/ReactionsRowButtonTooltip.tsx
+++ b/src/components/views/messages/ReactionsRowButtonTooltip.tsx
@@ -27,8 +27,8 @@ interface IProps {
     mxEvent: MatrixEvent;
     // The reaction content / key / emoji
     content: string;
-    // A Set of Matrix reaction events for this key
-    reactionEvents: Set<MatrixEvent>;
+    // A list of Matrix reaction events for this key
+    reactionEvents: MatrixEvent[];
     visible: boolean;
 }