matrix-org / matrix-org/matrix-spec
MXC sanitising spec is unclear/impossible to apply
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 330
- Forks
- 150
- Avg merge
- 2h 21m
- Merged PRs (30d)
- 3
Description
https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5 says:
As such, homeservers MUST sanitise
mxc://URIs by allowing only alphanumeric (A-Za-z0-9),_and-characters in the server-name and media-id values.
... but it's unclear about where this sanitisation should happen. Should it apply to event bodies? If so, which fields in event bodies? Does it matter what the event type is? What about event types we haven't invented yet? What should happen if we see an event that doesn't match?
In practice, it's pretty much impossible to apply such rules to event bodies (particularly for encrypted events), so I don't think that's what it means. But then, what does it mean?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Security considerations section in the Matrix client-server API specification and review the sanitisation requirement in context. Determine whether it applies to event bodies, which fields and event types it covers, and how non-matching events should be handled. Done means the specification clearly defines the scope and expected behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100