element-hq / element-hq/synapse

A `m.room.power_levels` state event was accepted with newlines in user IDs

Open
#10,715 0 comments 0 reactions 0 assignees View on GitHub
A-Validation S-Minor T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#10715](https://github.com/matrix-org/synapse/issues/10715).

---

### Description

Synapse is accepting `m.room.power_levels` state events with the following content;

```json5
"content": {

"users": {
"@user:example.org": 50,
"@user:example.org\n": 50,
"@user:example.org\\n": 0,

// ...
},

// ...
}
```

Ruma trips on this content, because it expects [fully well-formed User IDs](https://github.com/ruma/ruma/blob/5a7e2cddcf257e367465cced51442c91e8f557c9/crates/ruma-events/src/room/power_levels.rs#L102), and so rejects parsing this kind of event.

[The spec](https://spec.matrix.org/unstable/client-server-api/#mroompower_levels) says not much of substance regarding validating these user IDs.

*Note: Event has been partially redacted to keep community privacy, i can provide more info and the corresponding room via DMs to synapse devs.*

### Version information

Own homeserver version (atm): 1.40.0
Their homeserver version (atm): 1.40.0

Contributor guide

Open the contributing guide

Research direction

Start by locating Synapse's validation and handling for m.room.power_levels state events, then reproduce the issue with the newline-containing user IDs shown in the report. Compare the accepted event with the well-formed User ID requirement and existing validation tests. Done means malformed user IDs are handled consistently with the Matrix specification and covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.