3 Commits
Author SHA1 Message Date
Jason LittleandGitHub 415a869f1f fix RemoteJoinHelper to handle v12 rooms (#20021)
While preparing for the default room version change to "12", the new
tests for
[FederationJoinUpgradedRoomTestCase](https://github.com/element-hq/synapse/blob/36664cac4fdec38993c68078cd9a82452b56dca7/tests/federation/test_federation_join_upgraded_room.py#L44)
were unable to handle creation events inside of the manufactured
`auth_events` sections. All of these tests fail.

Related to https://github.com/element-hq/synapse/pull/20015 as another
recent fix to `RemoteJoinHelper`


### Testing strategy

To test, I recommend changing the `DEFAULT_ROOM_VERSION` in [the
`server.py` config
file](https://github.com/element-hq/synapse/blob/36664cac4fdec38993c68078cd9a82452b56dca7/synapse/config/server.py#L179)
to `"12"`, then running `poetry run trial
tests.federation.test_federation_join_upgraded_room.FederationJoinUpgradedRoomTestCase`
for these selective tests. Alternatively, creating the
`default_config()` for the `TestCase` in question to set the default
room version, but that is more work.
2026-08-03 13:47:26 -05:00
Eric EastwoodandGitHub fba14358a7 Fix RemoteJoinHelper signing events with the default room version (room version mismatch) (#20015)
Fix `RemoteJoinHelper` signing events with mismatched room version
compared to the `room_version` arg. The default room version on
`develop` is `11` but the `RemoteJoinHelper` `room_version` arg defaults
to `10` (room version mismatch). This mismatch wasn't present where this
fix was developed
(https://github.com/element-hq/synapse-private/pull/136) as the default
room version was only recently bumped to `11` via
https://github.com/element-hq/synapse/pull/18680 (not even in a release
yet).

Fixes the CI being broken on `develop` :x::

```
[ERROR]
Traceback (most recent call last):
  File "/home/runner/work/synapse/synapse/tests/federation/test_federation_join_upgraded_room.py", line 298, in test_no_transfer_when_tombstone_does_not_match
    join_helper.join(local_user_id, local_user_tok)
  File "/home/runner/work/synapse/synapse/tests/federation/_remote_join.py", line 350, in join
    self._test_case.helper.join(remote_room_id, local_user_id, tok=local_user_tok)
  File "/home/runner/work/synapse/synapse/tests/rest/client/utils.py", line 195, in join
    return self.change_membership(
  File "/home/runner/work/synapse/synapse/tests/rest/client/utils.py", line 333, in change_membership
    assert channel.code == expect_code, (
builtins.AssertionError: Expected: 200, got: 400, PUT /_matrix/client/r0/rooms/!remote-room:other.example.com/state/m.room.member/@user1:test?access_token=syt_dXNlcjE_JSEarRndiAGqtydnrdLn_33qlLD -> resp: b'{"errcode":"M_UNKNOWN","error":"No create event in state"}'

tests.federation.test_federation_join_upgraded_room.FederationJoinUpgradedRoomTestCase.test_no_transfer_when_tombstone_does_not_match
```

These tests were originally introduced
https://github.com/element-hq/synapse-private/pull/136 (developed
private as this was part of the Synapse security release) and introduced
into the public codebase via
https://github.com/element-hq/synapse/commit/cbc6934821aab314506c5957223c60c74eeda091
2026-07-29 10:32:41 -05:00
cbc6934821 Prevent theft of room aliases via remote join to room with illegitimate predecessor
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-cjh7-rcpx-xpf8
Fixes: https://github.com/matrix-org/internal-config/issues/1729

---------

Co-authored-by: Eric Eastwood <erice@element.io>
Reviewed-on: https://github.com/element-hq/synapse-private/pull/136
2026-07-28 13:58:06 +01:00