Conversation
817a3ba to
3f5de40
Compare
1e53667 to
6813ce7
Compare
6813ce7 to
4b376c1
Compare
4b376c1 to
2817cf6
Compare
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 1 potential issue.
1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)
| func (r *Room) dataTrackEncryptor() datatrack.Encryptor { | ||
| if r.engine.dataCryptor == nil { | ||
| return nil | ||
| } | ||
| return dataTrackCryptor{cryptor: r.engine.dataCryptor} |
There was a problem hiding this comment.
🟡 Encryption persists across join retries
After an encrypted Join fails, retrying without WithDataEncryption leaves dataTrackEncryptor enabled. The retry publishes GCM tracks, so peers without the old key cannot subscribe.
Learn more
A failed join leaves the connection manager in its initial state, allowing the same room to retry. JoinWithContextAndToken replaces engine.dataCryptor only when the new options contain a key provider. An earlier provider therefore survives a later retry that omits WithDataEncryption. The added getter exposes that stale cryptor to every data-track publication in the retry.
Example: A room first joins with key A, but signaling fails. The caller retries the same room without WithDataEncryption. PublishDataTrack still advertises GCM and encrypts with key A, while unconfigured peers reject the track.
Recommended fix: Assign engine.dataCryptor on every join configuration. Set it to a new cryptor when DataEncryptionKeyProvider is non-nil and explicitly set it to nil otherwise, before any publication can query the getters.
Was this helpful? React with 👍 or 👎 to provide feedback.
2 participants
Encrypts published frames and decrypts subscribed ones with the room's
DataCryptorwhenWithDataEncryptionis set.Closes BOT-541