From 384635216f4691942f7e26ec7eba015570eebe4b Mon Sep 17 00:00:00 2001
From: Caleb Roseland <caleb@calebroseland.com>
Date: Wed, 15 Apr 2026 23:02:45 -0500
Subject: [PATCH] Update msgpack fork dependency (#35988) (#36043)

(cherry picked from commit 17939826efa20a97f087b3d390ec5136df350bae)

Co-authored-by: Mattermost Build <build@mattermost.com>
---
 server/channels/app/platform/web_conn.go      |  6 +++
 server/channels/app/platform/web_conn_test.go | 46 +++++++++++++++++++
 server/go.mod                                 |  4 +-
 server/go.sum                                 |  4 +-
 4 files changed, 56 insertions(+), 4 deletions(-)

diff --git a/server/channels/app/platform/web_conn.go b/server/channels/app/platform/web_conn.go
index cfcca77cfc..965a5a578e 100644
--- a/server/channels/app/platform/web_conn.go
+++ b/server/channels/app/platform/web_conn.go
@@ -469,6 +469,12 @@ func (wc *WebConn) readPump() {
 			return
 		}
 
+		// Reject binary frames from unauthenticated connections. See MM-68222.
+		if msgType != websocket.TextMessage && !wc.IsAuthenticated() {
+			wc.logSocketErr("websocket.UnauthBinary", errors.New("binary frames require authentication"))
+			return
+		}
+
 		var decoder interface {
 			Decode(v any) error
 		}
diff --git a/server/channels/app/platform/web_conn_test.go b/server/channels/app/platform/web_conn_test.go
index d9e3ea13c6..24b893daa5 100644
--- a/server/channels/app/platform/web_conn_test.go
+++ b/server/channels/app/platform/web_conn_test.go
@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
 
 	"github.com/gorilla/websocket"
 	"github.com/stretchr/testify/assert"
@@ -241,3 +242,48 @@ func TestWebConnDrainDeadQueue(t *testing.T) {
 		t.Run("Overwritten First", func(t *testing.T) { run(int64(128), deadQueueSize+10) })
 	})
 }
+
+func TestWebConnRejectBinaryFrameUnauthenticated(t *testing.T) {
+	th := Setup(t)
+
+	readPumpDone := make(chan struct{})
+	upgradeErrCh := make(chan error, 1)
+
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		upgrader := &websocket.Upgrader{}
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			upgradeErrCh <- err
+			return
+		}
+		upgradeErrCh <- nil
+
+		wc := th.Service.NewWebConn(&WebConnConfig{
+			WebSocket: conn,
+		}, th.Suite, &hookRunner{})
+
+		require.False(t, wc.IsAuthenticated())
+
+		go func() {
+			wc.readPump()
+			close(readPumpDone)
+		}()
+	}))
+	defer s.Close()
+
+	d := websocket.Dialer{}
+	clientConn, _, err := d.Dial("ws://"+s.Listener.Addr().String()+"/ws", nil)
+	require.NoError(t, err)
+	defer clientConn.Close()
+
+	require.NoError(t, <-upgradeErrCh)
+
+	err = clientConn.WriteMessage(websocket.BinaryMessage, []byte{0x01, 0x02, 0x03})
+	require.NoError(t, err)
+
+	select {
+	case <-readPumpDone:
+	case <-time.After(5 * time.Second):
+		require.Fail(t, "readPump did not exit after receiving binary frame")
+	}
+}
diff --git a/server/go.mod b/server/go.mod
index f98b5f292e..212c1af912 100644
--- a/server/go.mod
+++ b/server/go.mod
@@ -257,5 +257,5 @@ replace github.com/ledongthuc/pdf => github.com/ledongthuc/pdf v0.0.0-2024020113
 // version always. Tablewriter has made breaking changes to its latest release.
 replace github.com/olekukonko/tablewriter => github.com/olekukonko/tablewriter v0.0.5
 
-// See MM-66167 for more details.
-replace github.com/vmihailenco/msgpack/v5 => github.com/mattermost/msgpack/v5 v5.0.0-20260120151306-2f9c67d7e57f
+// See MM-66167, MM-68222 for more details.
+replace github.com/vmihailenco/msgpack/v5 => github.com/mattermost/msgpack/v5 v5.0.0-20260408165622-cadfad56a815
diff --git a/server/go.sum b/server/go.sum
index 62fd452908..4c3cbd8729 100644
--- a/server/go.sum
+++ b/server/go.sum
@@ -423,8 +423,8 @@ github.com/mattermost/mattermost/server/public v0.1.12 h1:qlIU/llY0FWdHWQPtvncdd
 github.com/mattermost/mattermost/server/public v0.1.12/go.mod h1:3RJZfl7sMedX6ihX+JMFOIAzCHhd0WQnuez+UFQS80k=
 github.com/mattermost/morph v1.1.0 h1:Q9vrJbeM3s2jfweGheq12EFIzdNp9a/6IovcbvOQ6Cw=
 github.com/mattermost/morph v1.1.0/go.mod h1:gD+EaqX2UMyyuzmF4PFh4r33XneQ8Nzi+0E8nXjMa3A=
-github.com/mattermost/msgpack/v5 v5.0.0-20260120151306-2f9c67d7e57f h1:tAXeRJSWo6EK7wDq1TcxMHIxHRyjrE62ihvsigdg4Q0=
-github.com/mattermost/msgpack/v5 v5.0.0-20260120151306-2f9c67d7e57f/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
+github.com/mattermost/msgpack/v5 v5.0.0-20260408165622-cadfad56a815 h1:uOi89NvrFmDngqMKjlLDxi+MNzJQLA3TqcU2p8czv34=
+github.com/mattermost/msgpack/v5 v5.0.0-20260408165622-cadfad56a815/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/mattermost/rsc v0.0.0-20160330161541-bbaefb05eaa0 h1:G9tL6JXRBMzjuD1kkBtcnd42kUiT6QDwxfFYu7adM6o=
 github.com/mattermost/rsc v0.0.0-20160330161541-bbaefb05eaa0/go.mod h1:nV5bfVpT//+B1RPD2JvRnxbkLmJEYXmRaaVl15fsXjs=
 github.com/mattermost/squirrel v0.5.0 h1:81QPS0aA+inQbpA7Pzmv6O9sWwB6VaBh/VYw3oJf8ZY=