element-hq / element-hq/synapse

Additional C2S validation to prevent sending known invalid join rules

Open
#18,882 0 comments 0 reactions 0 assignees View on GitHub
A-Power-Levels
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

While this is [technically allowed by spec](https://github.com/matrix-org/matrix-spec/issues/657), it is a huge footgun, especially if a client doesn't properly validate the room's features. Synapse permits sending known join rules, such as `knock` / `restricted` / `knock_restricted` into room versions that do not support these join rules, resulting in nobody being able to join, likely without the room admins' knowledge (unless they knew about the specific aforementioned issue).

Ideally there would be an additional validation check when setting a join rule that ensures that the room version supports the provided join rule, assuming the join rule is known. For example, forbidding sending a `knock` room to a v6 room.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.