`encryptAndSendKeysToDevices` assumes device IDs are globally unique

[ShadowJonathan]

encryptAndSendKeysToDevices uses two different mappings for devices and user+devices;

const contentMap: Record<string, Record<string, IEncryptedContent>> = {};
const deviceInfoByDeviceId = new Map<string, DeviceInfo>();

These two are filled independently, with the latter being queried in this spot at the end of the function;

 return this.baseApis.sendToDevice("m.room.encrypted", contentMap).then(() => {
    // store that we successfully uploaded the keys of the current slice
    for (const userId of Object.keys(contentMap)) {
        for (const deviceId of Object.keys(contentMap[userId])) {
            session.markSharedWithDevice(
                userId,
                deviceId,
                deviceInfoByDeviceId.get(deviceId).getIdentityKey(),
                chainIndex,
            );
        }
    }
});

This assumes that no two users share a device with the same deviceID, though that is possible given a large enough room and a large enough time for users to keep generating deviceIDs.

AFAIK, this does not expose a security vulnerability, worst this could do is junk up the message ratchet for either of the two users' specific devices in that particular room, making messages undecryptable.

[aaronraimist]

Device IDs are not necessarily even unique per user matrix-org/synapse#6616