Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Reject receipt requests with empty room or event IDs #14632

Merged
merged 6 commits into from
Dec 7, 2022
Merged

Reject receipt requests with empty room or event IDs #14632

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
70e49fd
Reject receipt requests with empty room or event IDs
Fizzadar Dec 6, 2022
97416c6
Add changelog file
Fizzadar Dec 6, 2022
b523536
Validate room/event ID are valid
Fizzadar Dec 7, 2022
9f46969
Add quick receipts rest test
Fizzadar Dec 7, 2022
15ff27b
Fix copyright notice
Fizzadar Dec 7, 2022
fbb7b16
Rename changelog file to bugfix
Fizzadar Dec 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/14632.misc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Reject invalid read receipt requests with empty room or event IDs. Contributed by Nick @ Beeper (@fizzadar).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm half tempted to say this is a bugfix, but 🤷

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah good spot, agreed! fbb7b16

5 changes: 4 additions & 1 deletion synapse/rest/client/receipts.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
from synapse.http.server import HttpServer
from synapse.http.servlet import RestServlet, parse_json_object_from_request
from synapse.http.site import SynapseRequest
from synapse.types import JsonDict
from synapse.types import EventID, JsonDict, RoomID

from ._base import client_patterns

Expand Down Expand Up @@ -56,6 +56,9 @@ async def on_POST(
) -> Tuple[int, JsonDict]:
requester = await self.auth.get_user_by_req(request)

if not RoomID.is_valid(room_id) or not event_id.startswith(EventID.SIGIL):
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not super happy with the startswith but EventID.is_valid is broken for non-V1/2 event IDs so unsure how to proceed.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Filed #14638.

raise SynapseError(400, "A valid room ID and event ID must be specified")

if receipt_type not in self._known_receipt_types:
raise SynapseError(
400,
Expand Down