[INTERNAL][CORE] Adds security check for received activities

core/src/saros/session/ISarosSession.java

@@ -235,7 +235,7 @@ void changePermission(User user, Permission permission)
   Set<Integer> getUnavailableColors();
 
   /** FOR INTERNAL USE ONLY ! */
-  void exec(List<IActivity> activities);
+  void exec(JID jid, List<IActivity> activities);
 
   /**
    * Adds an {@link IActivityProducer} so the production of its activities will be noticed.

core/src/saros/session/internal/ActivitySequencer.java

@@ -339,7 +339,7 @@ private void executeActivities(
       return;
     }
 
-    sarosSession.exec(activities);
+    sarosSession.exec(sender, activities);
   }
 
   /** Sends an activity to the given recipients. */
@@ -359,7 +359,7 @@ public void sendActivity(List<User> recipients, final IActivity activity) {
           new Runnable() {
             @Override
             public void run() {
-              sarosSession.exec(Collections.singletonList(activity));
+              sarosSession.exec(user.getJID(), Collections.singletonList(activity));
             }
           });
     }

core/src/saros/session/internal/SarosSession.java

@@ -638,23 +638,38 @@ public ConcurrentDocumentClient getConcurrentDocumentClient() {
   }
 
   @Override
-  public void exec(List<IActivity> activities) {
+  public void exec(JID jid, List<IActivity> activities) {
     /**
      * @JTourBusStop 7, Activity sending, Incoming activities:
      *
      * <p>Incoming activities will arrive here. The ActivitySequencer calls this method for
      * activities received over the Network Layer.
      */
-    final List<IActivity> valid = new ArrayList<IActivity>();
+    final List<IActivity> validActivities = new ArrayList<IActivity>();
 
     // Check every incoming activity for validity
     for (IActivity activity : activities) {
-      if (activity.isValid()) valid.add(activity);
-      else log.error("could not handle incoming activity: " + activity);
+
+      if (!activity.isValid()) {
+        log.error("could not handle incoming activity: " + activity);
+        continue;
+      }
+
+      final User source = activity.getSource();
+
+      assert jid != null && source != null;
+
+      if (isHost() && !source.getJID().strictlyEquals(jid)) {
+        log.warn("detected spoofed activity from: " + jid + " -> " + activity);
+        // TODO kick the user
+        continue;
+      }
+
+      validActivities.add(activity);
     }
 
-    List<IActivity> processed = activityQueuer.process(valid);
-    activityHandler.handleIncomingActivities(processed);
+    final List<IActivity> executableActivites = activityQueuer.process(validActivities);
+    activityHandler.handleIncomingActivities(executableActivites);
   }
 
   /*

core/test/junit/saros/session/internal/ActivitySequencerTest.java

@@ -289,7 +289,7 @@ private static ISarosSession createSessionMock(
 
     final Capture<List<IActivity>> capture = Capture.newInstance();
 
-    session.exec(EasyMock.capture(capture));
+    session.exec(EasyMock.anyObject(JID.class), EasyMock.capture(capture));
 
     EasyMock.expectLastCall()
         .andAnswer(() -> receivedActivitiesBuffer.addAll(capture.getValue()))