element-hq / element-hq/synapse
Consider making timeout configurable when reading a file body
Open
A-URL-Preview
O-Uncommon
T-Enhancement
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
In https://github.com/matrix-org/synapse/pull/11784, a timeout was introduced to the HTTP client when downloading a file body, to patch CVE-2022-41952. The timeout was hardcoded to 30s which could be overly long in some settings.
It could make sense to expose this as a setting so that the homeserver admin can configure it.
Contributor guide
Assessment
This issue has not been assessed yet.