fix: do not allow to set ConfiguredAddr to arbitrary values

Author: link2xt

deltachat-rpc-client/tests/test_multitransport.py

@@ -57,6 +57,7 @@ def test_change_address(acfactory) -> None:
     """Test Alice configuring a second transport and setting it as a primary one."""
     alice, bob = acfactory.get_online_accounts(2)
 
+    bob_addr = bob.get_config("configured_addr")
     bob.create_chat(alice)
 
     alice_chat_bob = alice.create_chat(bob)
@@ -70,6 +71,10 @@ def test_change_address(acfactory) -> None:
     qr = acfactory.get_account_qr()
     alice.add_transport_from_qr(qr)
     new_alice_addr = alice.list_transports()[1]["addr"]
+    with pytest.raises(JsonRpcError):
+        # Cannot use the address that is not
+        # configured for any transport.
+        alice.set_config("configured_addr", bob_addr)
     alice.set_config("configured_addr", new_alice_addr)
     with pytest.raises(JsonRpcError):
         alice.delete_transport(new_alice_addr)

src/config.rs

@@ -809,7 +809,26 @@ impl Context {
                         .await?;
                     }
                 }
-                self.sql.set_raw_config(key.as_ref(), value).await?;
+                self.sql
+                    .transaction(|transaction| {
+                        if transaction.query_row(
+                            "SELECT COUNT(*) FROM transports WHERE addr=?",
+                            (value,),
+                            |row| {
+                                let res: i64 = row.get(0)?;
+                                Ok(res)
+                            },
+                        )? == 0
+                        {
+                            bail!("Address does not belong to any transport.");
+                        }
+                        transaction.execute(
+                            "UPDATE config SET value=? WHERE keyname='configured_addr'",
+                            (value,),
+                        )?;
+                        Ok(())
+                    })
+                    .await?;
             }
             _ => {
                 self.sql.set_raw_config(key.as_ref(), value).await?;