element-hq / element-hq/synapse

Silently drop invites determined to be spam

Open
#17,492 0 comments 1 reaction 0 assignees View on GitHub
A-Abuse A-Invite A-Modules O-Occasional S-Minor T-Enhancement
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

Following on from https://github.com/matrix-org/mjolnir/issues/300, rejecting spam invites can just precipitate more abuse, as it can alert attackers that their names have been added to a ban list. This could be addressed by silently dropping spam invites, rather than rejecting them with an error. For example if the spam check here
https://github.com/element-hq/synapse/blob/568051c0f07393b786b9d813a1db53dd332c9fc2/synapse/handlers/room_member.py#L900-914 determines that the invite is spam, return early with a 200 rather than raising an 403 error.
This could either be implemented as-is or could be a config option to give people the ability to choose to silently ignore spam invites.

Contributor guide

Open the contributing guide

Research direction

Start in synapse/handlers/room_member.py around the spam check at lines 900-914 and trace how invite responses are produced. Confirm the desired behavior for spam invites, including whether it is unconditional or configurable; done means attackers receive a successful 200 response instead of a 403 rejection.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.