matrix-org / matrix-org/matrix-spec
Federated invite endpoint is error-prone
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 330
- Forks
- 150
- Avg merge
- 2h 21m
- Merged PRs (30d)
- 3
Description
**Link to problem area**: https://spec.matrix.org/v1.14/server-server-api/#inviting-to-a-room
**Issue**
What is wrong? How can we improve?
The endpoint itself has the path:
```
PUT /_matrix/federation/v2/invite/{roomId}/{eventId}
```
This is error-prone which can result in security issues if care is not taken.
Servers MUST IGNORE the `roomId` contained in this path. Synapse [already does this](https://github.com/element-hq/synapse/blob/v1.132.0/synapse/federation/transport/server/federation.py#L501).
Servers MUST IGNORE the `eventId` contained in this path, even on v1/v2 rooms. Synapse already does this as well.
The reasons why is because it creates two sources of truth which can be confused when applying auth/moderation, as the room/event ID in the HTTP path may not match the event JSON itself. This causes problems
because a host of moderation tooling relies on the room ID. Server ACLs ban servers in rooms. If servers read the room ID in the path for this check they may pull out the wrong server ACL event, and then let the invite go through. Similarly, blocked/deactivated/purged rooms are keyed off the room ID.
In reality, we should simply have a `PUT /_matrix/federation/v3/invite` endpoint and remove the offending variables entirely.
Dendrite [falls into this trap](https://github.com/element-hq/dendrite/blob/11b48749bf96fb1f7761df6d7a21cf1cd8484e20/federationapi/routing/routing.go#L191) but saves itself later due to better validation in [GMSL](https://github.com/matrix-org/gomatrixserverlib/blob/904c8f04597e5dbec6365788c52a2e4eb7e2ddab/handleinvite.go#L134)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Matrix server-server API section linked in the issue, focusing on the invite endpoint and its roomId and eventId path parameters. Compare the stated requirements with the linked Synapse and Dendrite implementations. Done means the specification clearly resolves the duplicate identifier sources and defines the intended endpoint behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100