element-hq / element-hq/synapse
Additional C2S validation to prevent sending known invalid join rules
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
While this is [technically allowed by spec](https://github.com/matrix-org/matrix-spec/issues/657), it is a huge footgun, especially if a client doesn't properly validate the room's features. Synapse permits sending known join rules, such as `knock` / `restricted` / `knock_restricted` into room versions that do not support these join rules, resulting in nobody being able to join, likely without the room admins' knowledge (unless they knew about the specific aforementioned issue).
Ideally there would be an additional validation check when setting a join rule that ensures that the room version supports the provided join rule, assuming the join rule is known. For example, forbidding sending a `knock` room to a v6 room.
Contributor guide
Assessment
This issue has not been assessed yet.