element-hq / element-hq/dendrite

Dendrite does not validate `senders` and `rooms` IDs in filters

Open
#2,067 0 comments 0 reactions 0 assignees View on GitHub
C-Client-API F-Filters good first issue T-Defect
Dominant language
Go
Stars
965
Forks
101
PR merge metrics
No merged PRs in 30d

Description

*This issue was originally created by [**@ShadowJonathan**](https://github.com/ShadowJonathan) at .*

### Background information

- **Dendrite version or git SHA**: 83b9cb4d79123ec89e18a46d5202e74a9e9305b8
- **Running in Docker?**: yes

This was found while running Complement, so build information from [this Dockerfile](https://github.com/matrix-org/complement/blob/277e25800c9b51f5dc0fb5d89430cf99d817267d/dockerfiles/Dendrite.Dockerfile) also applies.

### Description

When working on [matrix-org/complement@`8021d43` (#259)](https://github.com/matrix-org/complement/pull/259/commits/8021d43102845e7dcb71e2d58455034c33131393), dendrite failed the tests with the following logs;

```
client.go:392: POST hs1/_matrix/client/r0/user/@alice:hs1/filter => 200 OK (84.506966ms)
invalid_test.go:180: Expected 4XX status code, got 200 for testing filter map[room:map[timeline:map[rooms:[not_a_room_id]]]]
client.go:392: POST hs1/_matrix/client/r0/user/@alice:hs1/filter => 200 OK (57.808076ms)
invalid_test.go:180: Expected 4XX status code, got 200 for testing filter map[room:map[timeline:map[senders:[not_a_sender_id]]]]
```

This test comes from sytest, and i am pretty sure that dendrite should at least try to validate these strings to valid User IDs and Room IDs

Contributor guide

Open the contributing guide

Research direction

Start at Dendrite's POST /_matrix/client/r0/user/{userId}/filter endpoint and review the invalid filter cases from Complement or sytest described here. The work is done when invalid senders and rooms IDs are rejected with a 4XX response instead of accepting the filter.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.