element-hq / element-hq/synapse

Disallow randos to spam room directory by default

Open
#15,722 0 comments 0 reactions 0 assignees View on GitHub
A-Room-Directory O-Occasional S-Minor T-Task
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#15722](https://github.com/matrix-org/synapse/issues/15722).

---

Someone has published a bunch of political spam to our room directory and we discovered that this is allowed by default. I suggest to disable it by default.

Looks like the "allow anyone to publish to room directory" behavior comes from here: https://github.com/matrix-org/synapse/blob/ca8906be2cb821a0fb49ad1adf8440e79e64a398/synapse/config/room_directory.py

[Config documentation](https://matrix-org.github.io/synapse/develop/usage/configuration/config_documentation.html#alias_creation_rules) for `alias_creation_rules` and `room_list_publication_rules` says:

> If no rules match the request is denied. An empty list means no one can create aliases.

This is good, but the above rule is ignored if `alias_creation_rules` and `room_list_publication_rules` are missing from Synapse config.

[Moderating the room directory](https://matrix.org/docs/guides/moderation/#moderating-the-room-directory) admits it is an abuse vector:

> Each Matrix server maintains a publicly viewable directory of rooms. By default, any user can publish rooms to the directory, which can be an abuse vector.

> By default, any user can create room aliases, which can be an abuse vector - particularly given the risk of alias squatting, or creating publishing abusive aliases to point at existing rooms.

So how about disable it by default before any abuse happens? Thanks.

Contributor guide

Open the contributing guide

Research direction

Start in synapse/config/room_directory.py and inspect how missing alias_creation_rules and room_list_publication_rules are handled. Read the linked configuration documentation and moderation guide to confirm the intended defaults and user-facing wording. Done means room-directory publication is denied by default unless explicitly allowed, with the relevant documentation consistent.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.