matrix-org / matrix-org/matrix-spec

Federated invite endpoint is error-prone

Open
#2,166 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

A-S2S clarification
Dominant language
HTML
Stars
330
Forks
150
Avg merge
2h 21m
Merged PRs (30d)
3

Description

**Link to problem area**: https://spec.matrix.org/v1.14/server-server-api/#inviting-to-a-room

**Issue**
What is wrong? How can we improve?

The endpoint itself has the path:
```
PUT /_matrix/federation/v2/invite/{roomId}/{eventId}
```

This is error-prone which can result in security issues if care is not taken.

Servers MUST IGNORE the `roomId` contained in this path. Synapse [already does this](https://github.com/element-hq/synapse/blob/v1.132.0/synapse/federation/transport/server/federation.py#L501).

Servers MUST IGNORE the `eventId` contained in this path, even on v1/v2 rooms. Synapse already does this as well.

The reasons why is because it creates two sources of truth which can be confused when applying auth/moderation, as the room/event ID in the HTTP path may not match the event JSON itself. This causes problems
because a host of moderation tooling relies on the room ID. Server ACLs ban servers in rooms. If servers read the room ID in the path for this check they may pull out the wrong server ACL event, and then let the invite go through. Similarly, blocked/deactivated/purged rooms are keyed off the room ID.

In reality, we should simply have a `PUT /_matrix/federation/v3/invite` endpoint and remove the offending variables entirely.

Dendrite [falls into this trap](https://github.com/element-hq/dendrite/blob/11b48749bf96fb1f7761df6d7a21cf1cd8484e20/federationapi/routing/routing.go#L191) but saves itself later due to better validation in [GMSL](https://github.com/matrix-org/gomatrixserverlib/blob/904c8f04597e5dbec6365788c52a2e4eb7e2ddab/handleinvite.go#L134)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Matrix server-server API section linked in the issue, focusing on the invite endpoint and its roomId and eventId path parameters. Compare the stated requirements with the linked Synapse and Dendrite implementations. Done means the specification clearly resolves the duplicate identifier sources and defines the intended endpoint behavior.

Written by the indexing model from the issue text.

Assessment

Domain
api, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.