element-hq / element-hq/synapse

`prune_event` strips keys needed for authentication from events.

Open
#1,831 0 comments 0 reactions 0 assignees View on GitHub
S-Minor T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#1831](https://github.com/matrix-org/synapse/issues/1831).

---

It looks like we've been using keys in the event authentication checks without making sure they won't be removed when an event is redacted:

- `third_party_invite` JSON keys in invite `m.room.member` event content.
- ~~`redacts` JSON keys in `m.room.redaction` events~~ (fixed by msc2716, #8984)
- ~~`m.federate` JSON keys in `m.room.create` events~~ (fixed by msc2716, #8984)

https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L41-L57
https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L69
https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L71

Unfortunately fixing this will break the event signature checks for those events.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.