element-hq / element-hq/dendrite
Dendrite does not validate `senders` and `rooms` IDs in filters
- Dominant language
- Go
- Stars
- 965
- Forks
- 101
- PR merge metrics
- No merged PRs in 30d
Description
*This issue was originally created by [**@ShadowJonathan**](https://github.com/ShadowJonathan) at .*
### Background information
- **Dendrite version or git SHA**: 83b9cb4d79123ec89e18a46d5202e74a9e9305b8
- **Running in Docker?**: yes
This was found while running Complement, so build information from [this Dockerfile](https://github.com/matrix-org/complement/blob/277e25800c9b51f5dc0fb5d89430cf99d817267d/dockerfiles/Dendrite.Dockerfile) also applies.
### Description
When working on [matrix-org/complement@`8021d43` (#259)](https://github.com/matrix-org/complement/pull/259/commits/8021d43102845e7dcb71e2d58455034c33131393), dendrite failed the tests with the following logs;
```
client.go:392: POST hs1/_matrix/client/r0/user/@alice:hs1/filter => 200 OK (84.506966ms)
invalid_test.go:180: Expected 4XX status code, got 200 for testing filter map[room:map[timeline:map[rooms:[not_a_room_id]]]]
client.go:392: POST hs1/_matrix/client/r0/user/@alice:hs1/filter => 200 OK (57.808076ms)
invalid_test.go:180: Expected 4XX status code, got 200 for testing filter map[room:map[timeline:map[senders:[not_a_sender_id]]]]
```
This test comes from sytest, and i am pretty sure that dendrite should at least try to validate these strings to valid User IDs and Room IDs
Contributor guide
Research direction
Start at Dendrite's POST /_matrix/client/r0/user/{userId}/filter endpoint and review the invalid filter cases from Complement or sytest described here. The work is done when invalid senders and rooms IDs are rejected with a 4XX response instead of accepting the filter.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100