From 70e49fd579a71b50d44aa35ba32c3bb1a62ddef6 Mon Sep 17 00:00:00 2001 From: Nick Barrett Date: Tue, 6 Dec 2022 15:27:24 +0000 Subject: [PATCH 1/6] Reject receipt requests with empty room or event IDs --- synapse/rest/client/receipts.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/synapse/rest/client/receipts.py b/synapse/rest/client/receipts.py index 18a282b22cf9..927064ffc055 100644 --- a/synapse/rest/client/receipts.py +++ b/synapse/rest/client/receipts.py @@ -56,6 +56,9 @@ async def on_POST( ) -> Tuple[int, JsonDict]: requester = await self.auth.get_user_by_req(request) + if not room_id or not event_id: + raise SynapseError(400, "A room ID and event ID must be specified") + if receipt_type not in self._known_receipt_types: raise SynapseError( 400, From 97416c64c3782e0b6db0a8192bdb12a6fa7e2382 Mon Sep 17 00:00:00 2001 From: Nick Barrett Date: Tue, 6 Dec 2022 17:27:37 +0000 Subject: [PATCH 2/6] Add changelog file --- changelog.d/14632.misc | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelog.d/14632.misc diff --git a/changelog.d/14632.misc b/changelog.d/14632.misc new file mode 100644 index 000000000000..323d10f1b000 --- /dev/null +++ b/changelog.d/14632.misc @@ -0,0 +1 @@ +Reject invalid read receipt requests with empty room or event IDs. Contributed by Nick @ Beeper (@fizzadar). From b5235361a0e330d66c2bc38e8acbe091ccaead61 Mon Sep 17 00:00:00 2001 From: Nick Barrett Date: Wed, 7 Dec 2022 14:05:05 +0000 Subject: [PATCH 3/6] Validate room/event ID are valid --- synapse/rest/client/receipts.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/synapse/rest/client/receipts.py b/synapse/rest/client/receipts.py index 927064ffc055..28b7d30ea846 100644 --- a/synapse/rest/client/receipts.py +++ b/synapse/rest/client/receipts.py @@ -20,7 +20,7 @@ from synapse.http.server import HttpServer from synapse.http.servlet import RestServlet, parse_json_object_from_request from synapse.http.site import SynapseRequest -from synapse.types import JsonDict +from synapse.types import EventID, JsonDict, RoomID from ._base import client_patterns @@ -56,8 +56,8 @@ async def on_POST( ) -> Tuple[int, JsonDict]: requester = await self.auth.get_user_by_req(request) - if not room_id or not event_id: - raise SynapseError(400, "A room ID and event ID must be specified") + if not RoomID.is_valid(room_id) or not event_id.startswith(EventID.SIGIL): + raise SynapseError(400, "A valid room ID and event ID must be specified") if receipt_type not in self._known_receipt_types: raise SynapseError( From 9f46969b6bde46c6f28727f8ca7bfd1fca826841 Mon Sep 17 00:00:00 2001 From: Nick Barrett Date: Wed, 7 Dec 2022 14:05:17 +0000 Subject: [PATCH 4/6] Add quick receipts rest test --- tests/rest/client/test_receipts.py | 77 ++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 tests/rest/client/test_receipts.py diff --git a/tests/rest/client/test_receipts.py b/tests/rest/client/test_receipts.py new file mode 100644 index 000000000000..45d288e4fb9c --- /dev/null +++ b/tests/rest/client/test_receipts.py @@ -0,0 +1,77 @@ +# Copyright 2018-2019 New Vector Ltd +# Copyright 2019 The Matrix.org Foundation C.I.C. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +from twisted.test.proto_helpers import MemoryReactor + +import synapse.rest.admin +from synapse.rest.client import login, receipts, register +from synapse.server import HomeServer +from synapse.util import Clock + +from tests import unittest + + +class ReceiptsTestCase(unittest.HomeserverTestCase): + servlets = [ + login.register_servlets, + register.register_servlets, + receipts.register_servlets, + synapse.rest.admin.register_servlets, + ] + + def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None: + self.owner = self.register_user("owner", "pass") + self.owner_tok = self.login("owner", "pass") + + def test_send_receipt(self) -> None: + channel = self.make_request( + "POST", + "/rooms/!abc:beep/receipt/m.read/$def", + content={}, + access_token=self.owner_tok, + ) + self.assertEqual(channel.code, 200, channel.result) + + def test_send_receipt_invalid_room_id(self) -> None: + channel = self.make_request( + "POST", + "/rooms/not-a-room-id/receipt/m.read/$def", + content={}, + access_token=self.owner_tok, + ) + self.assertEqual(channel.code, 400, channel.result) + self.assertEqual( + channel.json_body["error"], "A valid room ID and event ID must be specified" + ) + + def test_send_receipt_invalid_event_id(self) -> None: + channel = self.make_request( + "POST", + "/rooms/!abc:beep/receipt/m.read/not-an-event-id", + content={}, + access_token=self.owner_tok, + ) + self.assertEqual(channel.code, 400, channel.result) + self.assertEqual( + channel.json_body["error"], "A valid room ID and event ID must be specified" + ) + + def test_send_receipt_invalid_receipt_type(self) -> None: + channel = self.make_request( + "POST", + "/rooms/!abc:beep/receipt/invalid-receipt-type/$def", + content={}, + access_token=self.owner_tok, + ) + self.assertEqual(channel.code, 400, channel.result) From 15ff27b5ab26d4d9c4f55297c30edb1d1120e2be Mon Sep 17 00:00:00 2001 From: Nick Mills-Barrett Date: Wed, 7 Dec 2022 15:33:51 +0000 Subject: [PATCH 5/6] Fix copyright notice Co-authored-by: Patrick Cloke --- tests/rest/client/test_receipts.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tests/rest/client/test_receipts.py b/tests/rest/client/test_receipts.py index 45d288e4fb9c..2a7fcea38607 100644 --- a/tests/rest/client/test_receipts.py +++ b/tests/rest/client/test_receipts.py @@ -1,5 +1,4 @@ -# Copyright 2018-2019 New Vector Ltd -# Copyright 2019 The Matrix.org Foundation C.I.C. +# Copyright 2022 The Matrix.org Foundation C.I.C. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. From fbb7b16148fcc56ac55b6ccd53bcc857987611cd Mon Sep 17 00:00:00 2001 From: Nick Barrett Date: Wed, 7 Dec 2022 15:35:43 +0000 Subject: [PATCH 6/6] Rename changelog file to bugfix --- changelog.d/{14632.misc => 14632.bugfix} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename changelog.d/{14632.misc => 14632.bugfix} (100%) diff --git a/changelog.d/14632.misc b/changelog.d/14632.bugfix similarity index 100% rename from changelog.d/14632.misc rename to changelog.d/14632.bugfix