Validate well known state events are state events.

changelog.d/5801.misc

@@ -0,0 +1 @@
+Don't allow clients to send tombstone events that reference the room its sent in.

changelog.d/5805.misc

@@ -0,0 +1 @@
+Deny sending well known state types as non-state events.

synapse/events/validator.py

@@ -95,20 +95,34 @@ def validate_builder(self, event):
 
  elif event.type == EventTypes.Topic:
  self._ensure_strings(event.content, ["topic"])
-
+ self._ensure_state_event(event)
  elif event.type == EventTypes.Name:
  self._ensure_strings(event.content, ["name"])
-
+ self._ensure_state_event(event)
  elif event.type == EventTypes.Member:
  if "membership" not in event.content:
  raise SynapseError(400, "Content has not membership key")
 
  if event.content["membership"] not in Membership.LIST:
  raise SynapseError(400, "Invalid membership key")
 
+ self._ensure_state_event(event)
+ elif event.type == EventTypes.Tombstone:
+ if "replacement_room" not in event.content:
+ raise SynapseError(400, "Content has no replacement_room key")
+
+ if event.content["replacement_room"] == event.room_id:
+ raise SynapseError(400, "Tombstone cannot reference itself")
+
+ self._ensure_state_event(event)
+
  def _ensure_strings(self, d, keys):
  for s in keys:
  if s not in d:
  raise SynapseError(400, "'%s' not in content" % (s,))
  if not isinstance(d[s], string_types):
  raise SynapseError(400, "'%s' not a string type" % (s,))
+
+ def _ensure_state_event(self, event):
+ if not event.is_state():
+ raise SynapseError(400, "'%s' must be state events" % (event.type,))