element-hq / element-hq/synapse
`prune_event` strips keys needed for authentication from events.
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#1831](https://github.com/matrix-org/synapse/issues/1831).
---
It looks like we've been using keys in the event authentication checks without making sure they won't be removed when an event is redacted:
- `third_party_invite` JSON keys in invite `m.room.member` event content.
- ~~`redacts` JSON keys in `m.room.redaction` events~~ (fixed by msc2716, #8984)
- ~~`m.federate` JSON keys in `m.room.create` events~~ (fixed by msc2716, #8984)
https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L41-L57
https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L69
https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L71
Unfortunately fixing this will break the event signature checks for those events.
Contributor guide
Assessment
This issue has not been assessed yet.