New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

`prune_event` strips keys needed for authentication from events. #1831

Open

matrixbot opened this issue Dec 16, 2023 · 0 comments

Labels

S-Minor T-Defect

Collaborator

matrixbot commented Dec 16, 2023 •

edited

Loading

This issue has been migrated from #1831.

It looks like we've been using keys in the event authentication checks without making sure they won't be removed when an event is redacted:

third_party_invite JSON keys in invite m.room.member event content.
~~redacts JSON keys in m.room.redaction events~~ (fixed by msc2716, Dummy issue #8984)
~~m.federate JSON keys in m.room.create events~~ (fixed by msc2716, Dummy issue #8984)

https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L41-L57
https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L69
https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L71

Unfortunately fixing this will break the event signature checks for those events.

The text was updated successfully, but these errors were encountered:

matrixbot closed this as completed

matrixbot changed the title ~~Dummy issue~~ prune_event strips keys needed for authentication from events.

matrixbot added S-Minor T-Defect labels

matrixbot reopened this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment