fix(desktop): bind only mention pairs this community vouches for

Visibility was the paste's whole trust boundary: a record whose label
appeared in the inserted content was registered, and registration
outlives the paste. Clipboard HTML is attacker-authored, so any copied
page could carry `<span data-mention-pubkey="<their key>"
data-mention-label="John Smith">@john Smith</span>` — plausible, plainly
visible, and accepted. The chip lit, the send carried their key in its
`p` tag, and the name stayed bound for the rest of the session. Seeing a
label only proves the user saw a name, never that the name belongs to
the key beside it; a Buzz provenance marker proves less still, since an
attacker writes the same marker.

The pair itself is now checked against state the community supplied.
Local first — the mention candidates the composer would offer and the
profile lookup the surface renders from, both already in hand — then the
relay's own profile for the pubkey. Labels are compared against
`collectProfileAliases`, the same alias set that turned a `p` tag into
the label the copy carries, so a chip rendered off a kind-0 `name` or a
NIP-05 handle verifies on the alias it was rendered from. Anything
neither source names is dropped: the words paste as readable text and
tag nobody.

That relay lookup is what keeps the headline case working. A mention of
someone who is not a member of the destination channel is exactly what
no local directory can speak to, so it is the case the fetch exists for
— and it is bounded by the record cap the parser already applies, reads
the profile entries `useUsersBatchQuery` maintains before spending a
request, and treats an entry those hooks call stale as no answer.

Verification can need that round trip, so binding lands after the
insertion. The visibility gate therefore runs a second time against what
the composer holds when the answer arrives: an in-flight check whose
paste the user has since deleted or replaced must not bind a name
nothing on screen shows. A composer with no verifier binds nothing, and
a failed lookup binds nothing — the pasted words are already in place
and simply stay plain, so there is no partial state to retry.

`selectBindableMentionIdentities` filters the verifier's answer back
down to what it asked about, so the seam cannot widen into "the verifier
decides what gets bound". `canonicalMentionLabel` moves out of
`matchChipTextToLabel` and is shared, so the copy-side chip classifier
and this check agree on what one name spelled two ways means.

Tests: eleven cases over the hook the composers actually pass, driving
the real `get_users_batch` seam — the forged pair dropped whether the
key is unknown or known under another name, each local source and the
relay vouching on their own, a mixed paste separated, and the cache
freshness rule; four over the bindable selector; and a Playwright case
pasting the visible forged shape into a DM, asserting the lookup ran,
the chip stayed dark, and the sent event carried no impostor `p` tag.
Removing the check lights the chip and fails it; ignoring only its
verdict fails it the same way. The full clipboard spec passes.

Signed-off-by: Matt Toohey <contact@matttoohey.com>

Author: matt2e

desktop/src/features/forum/ui/ForumComposer.tsx

@@ -360,6 +360,10 @@ export function ForumComposer({
   uploadFileRef.current = media.uploadFile;
   const registerMentionPubkeyRef = React.useRef(mentions.registerMentionPubkey);
   registerMentionPubkeyRef.current = mentions.registerMentionPubkey;
+  const verifyMentionIdentitiesRef = React.useRef(
+    mentions.verifyMentionIdentities,
+  );
+  verifyMentionIdentitiesRef.current = mentions.verifyMentionIdentities;
 
   React.useEffect(() => {
     if (!richText.editor) return;
@@ -387,6 +391,7 @@ export function ForumComposer({
               clipboardData,
               preventDefault: () => event.preventDefault(),
               registerMentionPubkey: registerMentionPubkeyRef.current,
+              verifyMentionIdentities: verifyMentionIdentitiesRef.current,
               view: _view,
             });
           }

desktop/src/features/messages/lib/mentionClipboard.test.mjs

@@ -8,7 +8,7 @@ import {
   getBuzzCopyKind,
   matchChipTextToLabel,
   parseMentionClipboardRecords,
-  registerMentionClipboardIdentities,
+  selectBindableMentionIdentities,
   selectVisibleMentionIdentities,
 } from "./mentionClipboard.ts";
 
@@ -288,42 +288,102 @@ test("ignores a mention the extractor would mask as code", () => {
   );
 });
 
-// ── registerMentionClipboardIdentities ────────────────────────────────
+// ── selectBindableMentionIdentities ───────────────────────────────────
 
-test("registers each recovered pair with its agent flag", () => {
-  const registered = [];
-  registerMentionClipboardIdentities({
-    html: buildMentionClipboardHtml({
+/** A verifier that vouches for every pair — isolates the other two gates. */
+const vouchForAll = async (records) => records;
+
+test("keeps each recovered pair with its agent flag", async () => {
+  assert.deepEqual(
+    await selectBindableMentionIdentities({
+      html: buildMentionClipboardHtml({
+        text: "@John Smith and @Fizz",
+        identities: [john, fizz],
+      }),
       text: "@John Smith and @Fizz",
-      identities: [john, fizz],
+      verifyMentionIdentities: vouchForAll,
     }),
-    registerMentionPubkey: (displayName, pubkey, options) =>
-      registered.push([displayName, pubkey, options?.isAgent]),
-    text: "@John Smith and @Fizz",
-  });
-
-  assert.deepEqual(registered, [
-    ["John Smith", JOHN, false],
-    ["Fizz", FIZZ, true],
-  ]);
+    [john, fizz],
+  );
 });
 
-test("registers nothing for a record the paste does not show", () => {
-  const registered = [];
+test("keeps nothing for a record the paste does not show", async () => {
   // A crafted sidecar: an empty span rebinding a name the content never
   // carries, riding alongside one the user can actually see.
-  registerMentionClipboardIdentities({
-    html:
-      `<span data-mention="" data-mention-pubkey="${ALEX}" ` +
-      `data-mention-label="John Smith"></span>` +
-      `<span data-mention="" data-mention-pubkey="${FIZZ}" ` +
-      `data-mention-kind="agent" data-mention-label="Fizz">@Fizz</span>`,
-    registerMentionPubkey: (displayName, pubkey) =>
-      registered.push([displayName, pubkey]),
-    text: "@Fizz take a look",
-  });
+  assert.deepEqual(
+    await selectBindableMentionIdentities({
+      html:
+        `<span data-mention="" data-mention-pubkey="${ALEX}" ` +
+        `data-mention-label="John Smith"></span>` +
+        `<span data-mention="" data-mention-pubkey="${FIZZ}" ` +
+        `data-mention-kind="agent" data-mention-label="Fizz">@Fizz</span>`,
+      text: "@Fizz take a look",
+      verifyMentionIdentities: vouchForAll,
+    }),
+    [fizz],
+  );
+});
 
-  assert.deepEqual(registered, [["Fizz", FIZZ]]);
+test("keeps nothing for a visible pair trusted state will not vouch for", async () => {
+  // The shape a hostile page carries: a plausible name against a key of its
+  // choosing, written where the user *does* see it. Visibility is not the
+  // question here — the verifier declining it is.
+  const impostor = { label: "John Smith", pubkey: ALEX, isAgent: false };
+  const asked = [];
+  assert.deepEqual(
+    await selectBindableMentionIdentities({
+      html: buildMentionClipboardHtml({
+        text: "@John Smith fixed the bug",
+        identities: [impostor],
+      }),
+      text: "@John Smith fixed the bug",
+      verifyMentionIdentities: async (records) => {
+        asked.push(...records);
+        return [];
+      },
+    }),
+    [],
+  );
+  // The visible pair still reached the verifier: it is the trust answer that
+  // dropped it, not an earlier gate quietly doing the work.
+  assert.deepEqual(asked, [impostor]);
+});
+
+test("binds only what it asked about, whatever the verifier returns", async () => {
+  // The verifier is a seam, not an authority: a bug or a future implementation
+  // that answers with a pair nobody copied must not widen the paste.
+  assert.deepEqual(
+    await selectBindableMentionIdentities({
+      html: buildMentionClipboardHtml({
+        text: "@John Smith fixed the bug",
+        identities: [john],
+      }),
+      text: "@John Smith fixed the bug",
+      verifyMentionIdentities: async (records) => [
+        ...records,
+        { label: "John Smith", pubkey: ALEX, isAgent: false },
+      ],
+    }),
+    [john],
+  );
+});
+
+test("does not consult the verifier when nothing is visible", async () => {
+  let consulted = false;
+  assert.deepEqual(
+    await selectBindableMentionIdentities({
+      html:
+        `<span data-mention="" data-mention-pubkey="${ALEX}" ` +
+        `data-mention-label="John Smith"></span>`,
+      text: "look at this",
+      verifyMentionIdentities: async () => {
+        consulted = true;
+        return [];
+      },
+    }),
+    [],
+  );
+  assert.equal(consulted, false, "a hidden record must cost no lookup");
 });
 
 // ── matchChipTextToLabel ──────────────────────────────────────────────

desktop/src/features/messages/lib/mentionClipboard.ts

@@ -28,6 +28,22 @@ export const MENTION_LABEL_ATTRIBUTE = "data-mention-label";
 /** Full channel-reference label, same partial-selection role as above. */
 export const CHANNEL_LABEL_ATTRIBUTE = "data-channel-label";
 
+/**
+ * Canonical form for comparing two spellings of one mention label.
+ *
+ * Tolerates what a label picks up in transit and nothing more: a pasteboard
+ * round trip swaps spaces for U+00A0, markup gains padding, and mention
+ * resolution is case-insensitive end to end. Every clipboard comparison of
+ * two labels goes through here, so "the same name" means one thing across the
+ * copy-side chip classifier and the paste-side trust check.
+ */
+export function canonicalMentionLabel(value: string): string {
+  return value
+    .replace(/\u00a0/g, " ")
+    .trim()
+    .toLowerCase();
+}
+
 /** How a chip's copied text relates to the full label it declares. */
 export type ChipTextMatch = "full" | "truncated" | "fragment";
 
@@ -62,18 +78,15 @@ export function matchChipTextToLabel(
   label: string,
   sigil: "@" | "#",
 ): ChipTextMatch {
-  const canonical = (value: string) =>
-    value
-      .replace(/\u00a0/g, " ")
-      .trim()
-      .toLowerCase();
-  const body = canonical(text);
+  const body = canonicalMentionLabel(text);
   const matches = (form: string) => body === form || body === `${sigil}${form}`;
-  if (matches(canonical(label))) return "full";
+  if (matches(canonicalMentionLabel(label))) return "full";
   // Derived from the helper the chips render with, so the tolerated form
   // cannot drift from what a fully selected capped chip actually carries.
   const truncated = truncateInlineChipLabel(label);
-  if (truncated !== label && matches(canonical(truncated))) return "truncated";
+  if (truncated !== label && matches(canonicalMentionLabel(truncated))) {
+    return "truncated";
+  }
   return "fragment";
 }
 
@@ -333,35 +346,54 @@ export function selectVisibleMentionIdentities(
 }
 
 /**
- * Teach a composer every identity a Buzz copy carried *and* showed.
+ * Narrow copied records to the pairs trusted Buzz state vouches for.
  *
- * Registration is what makes a pasted multi-word name known to the mention
- * decorations *and* to the send-time extractor, so the chip re-lights and the
- * original pubkey survives the round trip.
+ * Must resolve to a subset of what it was handed; callers enforce that rather
+ * than assume it, so the seam cannot widen into "the verifier decides what
+ * gets bound". See `useVerifyMentionIdentities` for the implementation and
+ * `mentionIdentityTrust` for why the check exists.
  */
-export function registerMentionClipboardIdentities({
+export type VerifyMentionIdentities = (
+  records: readonly MentionIdentity[],
+) => Promise<readonly MentionIdentity[]>;
+
+/** Case-insensitive identity of a `label → pubkey` pair. */
+function mentionIdentityKey(identity: MentionIdentity): string {
+  return `${canonicalMentionLabel(identity.label)} ${identity.pubkey.trim().toLowerCase()}`;
+}
+
+/**
+ * The identities a paste is allowed to bind.
+ *
+ * Three conditions, all necessary. The clipboard has to *carry* the record;
+ * the content the paste inserts has to *show* its label, so no binding
+ * outlives a paste the user could not see; and trusted Buzz state has to
+ * *vouch* for the pair, because a visible `@John Smith` beside an attacker's
+ * key is visible either way.
+ *
+ * Binding is what makes a pasted multi-word name known to the mention
+ * decorations *and* to the send-time extractor — so the chip re-lights and
+ * the original pubkey survives the round trip. Everything dropped here stays
+ * readable text that tags nobody.
+ */
+export async function selectBindableMentionIdentities({
   html,
-  registerMentionPubkey,
   text,
+  verifyMentionIdentities,
 }: {
   /** Clipboard HTML holding the identity records — untrusted. */
   html: string;
-  registerMentionPubkey: (
-    displayName: string,
-    pubkey: string,
-    options?: { isAgent?: boolean },
-  ) => void;
   /** The text the paste inserts; a record unmentioned there is discarded. */
   text: string;
-}): MentionIdentity[] {
-  const records = selectVisibleMentionIdentities(
+  verifyMentionIdentities: VerifyMentionIdentities;
+}): Promise<MentionIdentity[]> {
+  const visible = selectVisibleMentionIdentities(
     parseMentionClipboardRecords(html),
     text,
   );
-  for (const record of records) {
-    registerMentionPubkey(record.label, record.pubkey, {
-      isAgent: record.isAgent,
-    });
-  }
-  return records;
+  if (visible.length === 0) return [];
+  const vouched = new Set(
+    (await verifyMentionIdentities(visible)).map(mentionIdentityKey),
+  );
+  return visible.filter((record) => vouched.has(mentionIdentityKey(record)));
 }