DMs are always created as encrypted even when the other device doesn't support encryption

[turt2live]

Steps to reproduce

1. Send a DM to @enctest03302023:t2l.io (this user has no encryption-capable devices)
2. Note that the room is encrypted

Outcome

What did you expect?

An unencrypted DM, like Element Android and iOS do (and I thought we did up until this issue :p )

What happened instead?

The DM was encrypted

Operating system

Windows 10

Application version

Element version: 1.11.26 Olm version: 3.2.12

How did you install the app?

The Internet

Homeserver

t2l.io, matrix.org

Will you send logs?

Yes

[turt2live]

We've traced this back to here:
https://github.com/matrix-org/matrix-react-sdk/blob/567248d5c5b2a792df5f693d0ec01769f9a643e7/src/createRoom.ts#L398-L411

This code is calling Object.values() on a Map, which doesn't work as intended. Previously the returned object was, well, an object.

[MadLittleMods]

This code is calling Object.values() on a Map, which doesn't work as intended. Previously the returned object was, well, an object.

Anyway we can lint this footgun? 🤔

The only relevant thing I can find is https://stackoverflow.com/questions/72315392/how-to-prevent-the-mistake-of-calling-object-values-on-a-map which doesn't have a solution

[richvdh]

Just for historical reference: this was introduced by the fixes in matrix-js-sdk 24.0.0 to fix CVE-2023-28427. The js-sdk changed the interface of MatrixClient.downloadKeys, but the react-sdk was not updated accordingly.

[MadLittleMods]

Anyway we can lint this footgun? 🤔

Created typescript-eslint/typescript-eslint#6807 track making this possible