Synapse accepts objects in place of device ids for /_matrix/client/r0/keys/query

[richvdh]

https://matrix.org/docs/spec/client_server/r0.6.1#post-matrix-client-r0-keys-query says that device_keys must be a map from string to a list of strings (the device IDs).

However, Synapse erroneously accepts other types in place of that list of strings (in particular, it accepts other maps).

In short: this is accepted as a valid request, where it should be rejected with a 400:

POST /_matrix/client/r0/keys/query HTTP/1.1

{
    "device_keys": {
        "@bob:hs1": {
            "device_id1": true,
        }
    }
}

[richvdh]

Note that Element iOS used to use the erroneous format: element-hq/element-ios#3539.

However, that was fixed in December 2020 so I think we should be fine to fix this in Synapse.

[richvdh]

(note that complement has a test for this, which is currently blacklisted for synapse)

[DMRobertson]

device_keys is also meant to be required, according to the spec, but I don't think that's enforced by Synapse.

More generally I think this falls under the umbrella of #8445.