element-hq / element-hq/synapse
Own knock or invite event in knock_state or invite_state in /sync is not stripped
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#14919](https://github.com/matrix-org/synapse/issues/14919).
---
### Description
https://github.com/matrix-org/synapse/blob/19c0e55ef7742d67cff1cb6fb7c3e862b86ea788/synapse/rest/client/sync.py#L345 does not strip the invite event it is pulling the invite_state from. The same thing happens for knocking.


This is then sent to clients via /sync. According to the spec all events in invite/knock_state should be stripped. There are benefits to the client having access to the timestamp of the invite however, so some might be relying on this, but strictly speaking this is a spec violation and looks like a bug.
Spec: https://spec.matrix.org/v1.5/client-server-api/#get_matrixclientv3sync
### Steps to reproduce
- get invited or knock a room
- look at the sync response
### Homeserver
neko.dev
### Synapse Version
1.74
### Installation Method
Other (please mention below)
### Database
postgres, single
### Workers
Multiple workers
### Platform
Gentoo
### Configuration
Can be reproduced on various configurations
### Relevant log output
```shell
Screenshots and link to the offending code above, no logs about it, since it is a spec compliance issue.
```
### Anything else that would be useful to know?
_No response_
Contributor guide
Research direction
Start at synapse/rest/client/sync.py around line 345 and reproduce the invite and knock responses through /sync. Compare the response contents with the Matrix client-server specification; done means the invite_state and knock_state no longer include the originating event while the rest of the response remains correct.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100