tileradotorg/synapse
1
0
Fork 0
forked from MirrorHub/synapse
Code Pull requests Activity

Validate the server name for the /publicRooms endpoint. (#9161)

Browse source 
If a remote server name is provided, ensure it is something reasonable
before making remote connections to it.
This commit is contained in:
Patrick Cloke 2021-01-19 14:21:59 -05:00 committed by GitHub
parent 94549771f7
commit 47d48a5853
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/9161.bugfix Normal file
View file

@ -0,0 +1 @@
Fix a long-standing bug "ValueError: invalid literal for int() with base 10" when `/publicRooms` is requested with an invalid `server` parameter.

19
synapse/rest/client/v1/room.py
View file

@ -32,6 +32,7 @@ from synapse.api.errors import (
) )
from synapse.api.filtering import Filter from synapse.api.filtering import Filter
from synapse.events.utils import format_event_for_client_v2 from synapse.events.utils import format_event_for_client_v2
from synapse.http.endpoint import parse_and_validate_server_name
from synapse.http.servlet import ( from synapse.http.servlet import (
RestServlet, RestServlet,
assert_params_in_dict, assert_params_in_dict,
@ -347,8 +348,6 @@ class PublicRoomListRestServlet(TransactionRestServlet):
# provided. # provided.
if server: if server:
raise e raise e
else:
pass
limit = parse_integer(request, "limit", 0) limit = parse_integer(request, "limit", 0)
since_token = parse_string(request, "since", None) since_token = parse_string(request, "since", None)
@ -359,6 +358,14 @@ class PublicRoomListRestServlet(TransactionRestServlet):
handler = self.hs.get_room_list_handler() handler = self.hs.get_room_list_handler()
if server and server != self.hs.config.server_name: if server and server != self.hs.config.server_name:
# Ensure the server is valid.
try:
parse_and_validate_server_name(server)
except ValueError:
raise SynapseError(
400, "Invalid server name: %s" % (server,), Codes.INVALID_PARAM,
)
try: try:
data = await handler.get_remote_public_room_list( data = await handler.get_remote_public_room_list(
server, limit=limit, since_token=since_token server, limit=limit, since_token=since_token
@ -402,6 +409,14 @@ class PublicRoomListRestServlet(TransactionRestServlet):
handler = self.hs.get_room_list_handler() handler = self.hs.get_room_list_handler()
if server and server != self.hs.config.server_name: if server and server != self.hs.config.server_name:
# Ensure the server is valid.
try:
parse_and_validate_server_name(server)
except ValueError:
raise SynapseError(
400, "Invalid server name: %s" % (server,), Codes.INVALID_PARAM,
)
try: try:
data = await handler.get_remote_public_room_list( data = await handler.get_remote_public_room_list(
server, server,