element-hq / element-hq/synapse
Synapse allows invalid characters in the signature key id
Open
A-Spec-Compliance
A-Validation
S-Minor
S-Tolerable
T-Defect
Z-Cleanup
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#8307](https://github.com/matrix-org/synapse/issues/8307).
---
Synapse seems to accept more characters in the signature key id than the spec allows (for example `+`).
In Matrix HQ there's an event with signatures like this:
```
"signatures": {
"solver.nu": {
"ed25519:i+b2": "eodPQHXrns8Jk0XITTlaB61XdjxJW8uCi7paKqgrJmA5ok0NfsRw4Zhyx9RaIs/e7tZMJ29O46oh0IRx6jwZCQ"
}
}
```
But the spec says only [a-zA-Z0-9_] is allowed (https://matrix.org/docs/spec/server_server/r0.1.4#post-matrix-key-v2-query)
Contributor guide
Assessment
This issue has not been assessed yet.