element-hq / element-hq/synapse

`/createRoom` overly restricts appservices when creating an alias for the room

Open
#15,130 0 comments 0 reactions 0 assignees View on GitHub
A-Spec-Compliance O-Uncommon S-Minor T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#15130](https://github.com/matrix-org/synapse/issues/15130).

---

### Description

See logs below - an appservice on my local machine tried to create a room with `room_alias_name` specified, but the request failed because "This application service has not reserved this kind of alias".

When the very same appservice calls `PUT /directory/room/%23the_alias:localhost` though, it is not prevented from doing so.

### Steps to reproduce

See description.

### Homeserver

localhost

### Synapse Version

matrixdotorg/synapse:v1.76.0

### Installation Method

Docker (matrixdotorg/synapse)

### Database

postgresql, in a docker container

### Workers

Single process

### Platform

N/A

### Configuration

N/A

### Relevant log output

```shell
element-dev-stack-eledev-synapse-1 | 2023-02-21 22:12:23,673 - synapse.http.server - 108 - INFO - POST-22 - SynapseError: 400 - This application service has not reserved this kind of alias.
element-dev-stack-eledev-synapse-1 | 2023-02-21 22:12:23,673 - synapse.access.http.8008 - 460 - INFO - POST-22 - 172.26.0.5 - 8008 - {@example_user_1676066190192:localhost} Processed request: 0.026sec/0.000sec (0.001sec, 0.001sec) (0.001sec/0.018sec/4) 97B 400 "POST /_matrix/client/v3/createRoom?user_id=@example_user_1676066190192:localhost HTTP/1.0" "okhttp/4.10.0" [0 dbevts]
```

### Anything else that would be useful to know?

The spec does not enforce this restriction anywhere: the `/createRoom` request should not be failing.

Contributor guide

Open the contributing guide

Research direction

Start by comparing authorization for POST /_matrix/client/v3/createRoom with room_alias_name against PUT /directory/room/%23the_alias:localhost, using the reported appservice behavior as the reproduction. The work is done when the create-room request no longer rejects an unreserved alias where the specification permits it, while the existing directory behavior remains consistent.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.