dandri/synapse
1
0 Fork 0
mirror of https://github.com/element-hq/synapse.git synced 2026-10-23 06:32:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
25,922 Commits 1,241 Branches 857 Tags
5d55a05f8e2f782943b511d5edac0e8fd8fe7bcb
Commit Graph
25922 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 5d55a05f8e Bump regex from 1.12.4 to 1.13.0 (#20013) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-28 14:02:43 +00:00
Olivier 'reivilibre 9761f9bc42 Merge branch 'master' into develop 2026-07-28 14:39:05 +01:00
Olivier 'reivilibre 0c709bbb78 1.157.2 v1.157.2 2026-07-28 14:02:12 +01:00
Olivier 'reivilibre 0a2456fef3 Validate room name, avatar and heroes' profile fields before sending down sliding sync as trusted fields 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-jhcg-5392-5mjw
Fixes: https://github.com/matrix-org/internal-config/issues/1751

I introduce some stricter JSON types that don't break down to `Any` — it seems these have become possible since our last attempt.
(I'm pretty sure mypy wouldn't let you do this a few years ago.)
Our `dict[str, Any]` type is such a footgun. I'd like to spread this out further, but will do so after the security release.

I then use these stricter JSON types on everything the sliding sync handler pulls out of `event.content` and therefore get forced into a bare minimum level of validation, by the type checker.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/151
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibre c3adee3509 Restrict what errors we forward to clients from federation and policy servers 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-95fh-hv8c-chvq
Fixes: https://github.com/matrix-org/internal-config/issues/1721

https://github.com/element-hq/synapse-private/pull/158 is the end goal, I think

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/159
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibre 44216bf2b6 Limit the size of push rules 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-fp53-rw9v-hcf9
Fixes: https://github.com/matrix-org/internal-config/issues/1071

Because this is an out-of-spec limit and could break someone's workflow on release day, I've opted to make it configurable.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/149
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibre 4f8037ab59 Anchor the ends of our path patterns to prevent path traversal vulnerabilities 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-hgcg-p9gx-fq5f
Fixes: https://github.com/element-hq/backend-internal/issues/217 -> https://github.com/matrix-org/internal-config/issues/1760

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/146
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandEric Eastwood cbc6934821 Prevent theft of room aliases via remote join to room with illegitimate predecessor 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-cjh7-rcpx-xpf8
Fixes: https://github.com/matrix-org/internal-config/issues/1729

---------

Co-authored-by: Eric Eastwood <erice@element.io>
Reviewed-on: https://github.com/element-hq/synapse-private/pull/136
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibre 68139e5234 Add missing 'event in expected room' check on /event_auth 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-qcjr-46gf-7f4r
Fixes: https://github.com/matrix-org/internal-config/issues/1714

The `/event_auth` endpoint could be tricked to give you the auth chain for an event in a foreign room,
because it trusted the requester to provide the correct `room_id` for the event.

Now we pass the `room_id` through all the way to `get_event`'s `check_room_id`, which (correctly IMO) treats mismatches as unknown events (seems correct as it prevents divulging what events we know about).

The `test_event_auth_wrong_room_returns_404` test failed before the fix.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/147
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibre 3772859fbc Add missing same-room check on /get_missing_events handler 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-27p5-4f45-gx76
Fixes: https://github.com/matrix-org/internal-config/issues/1717

I've tried my best to make the tests a good narrative for the thought process here,
but essentially the rationale is to make `/get_missing_events` not distinguish
between 'event is in wrong room' and 'event is unknown to me'.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/141
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandEric Eastwood 83672faf9c Add missing 'host in room' check for /timestamp_to_event/{roomId} 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-r66v-qhwx-8rg4
Fixes: https://github.com/matrix-org/internal-config/issues/1718

---------

Co-authored-by: Eric Eastwood <erice@element.io>
Reviewed-on: https://github.com/element-hq/synapse-private/pull/144
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibre 51988c509f Fix spoofed to-device messages over federation not being dropped. 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-rgv2-84w7-5j9p
Fixes: https://github.com/matrix-org/internal-config/issues/1520
Introduced in: d4a35ada28

The code was obviously intended to drop them,
but the if block only logged without actually taking any action.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/145
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibre e39303af40 Fix some paths being accessible at unintended locations with extra prefix components 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-vh4c-pqh4-w3wq
Fixes: https://github.com/matrix-org/internal-config/issues/1703

The key thing to understand is that in `synapse/util/httpresourcetree.py`,
we create `UnrecognizedRequestResource` and then dangle children (with real resources) off them.

Since `UnrecognizedRequestResource` returns itself as a catch-all 'dynamic child',
this means any `UnrecognizedRequestResource`s with real children can have unlimited path components inserted between it and its child.

So `/_matrix/INSERTED/static/client/login/style.css` or `/_matrix/INSERTED/AS/MANY/AS/I/WANT/static/client/login/style.css` would unexpectedly resolve to the resource.

Client, Federation and Admin APIs wouldn't have been affected because you wouldn't get through the regex routing that they use.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/143
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibre e860184067 Fix multipart/form-data mitigation being case-sensitive. 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-6wjm-9p2x-gvpm
Fixes: https://github.com/matrix-org/internal-config/issues/1740

Relevant library code to check against:

 - CPython `EmailMessage.get_content_type()`  (https://github.com/python/cpython/blob/v3.13.3/Lib/email/message.py#L608-L630)
 - Twisted `_parseContentType()` (https://github.com/twisted/twisted/blob/twisted-25.5.0/src/twisted/web/http.py#L306-L313)
 - Twisted `Request.requestReceived()` (https://github.com/twisted/twisted/blob/twisted-25.5.0/src/twisted/web/http.py#L1079-L1097)

-----

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
Reviewed-on: https://github.com/element-hq/synapse-private/pull/133
 2026-07-28 13:58:06 +01:00
Eric Eastwood c5e5abb822 Use weakref to Python DatabasePool to allow homeserver to cleanly shutdown (#20009) 
Use weakref to Python `DatabasePool` to allow homeserver to cleanly
shutdown

Spawning from
[upgrading](https://github.com/element-hq/synapse-small-hosts/pull/420#discussion_r3661700252)
the Synapse version in Synapse Pro for small hosts and seeing our tenant
deprovision tests failing (end-to-end Complement tests). Specifically,
it was failing with a test in
[`TestLogging`](https://github.com/element-hq/synapse-small-hosts/blob/f24ee731ff419890680d1d80ef6eafe44f87f2c2/complement/tests/multi_synapse/logging_test.go#L328-L385)
in CI but was equally reproducible with any test where we deprovision
(`deployment.StopServer(...)`) like
[`TestProvisionHomeserverTenant/deprovision_homeserver_tenant`](https://github.com/element-hq/synapse-small-hosts/blob/f24ee731ff419890680d1d80ef6eafe44f87f2c2/complement/tests/multi_synapse/provision_test.go#L48-L58).

Clean homeserver shutdown specifically regressed with the changes from
https://github.com/element-hq/synapse/pull/19878. The
`PythonDatabasePoolWrapper` in Rust holds onto a reference to the Python
`DatabasePool` which references the Python `HomeServer` and keeps the
`HomeServer` from being garbage collected on the Python side.

This PR updates `PythonDatabasePoolWrapper` to use a weak reference.


### Dev notes

Previous PR where we had to deal with Rust <-> Python reference cycles,
https://github.com/element-hq/synapse/pull/19837#discussion_r3425358096

PyO3 garbage collector docs (`__traverse__`, `__clear__`):
https://pyo3.rs/v0.28.3/class/protocols#garbage-collector-integration


### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
 2026-07-28 10:04:48 +01:00
Eric Eastwood 408b0936ac Revert "Add changelog" 
This reverts commit befd2e2b7a.
 2026-07-27 18:56:17 -05:00
Eric Eastwood befd2e2b7a Add changelog 2026-07-27 18:53:37 -05:00
Erik Johnston 51672809c7 Fix _get_server_keys_json invalidations over replication as JSON (#19966) 
The cache key of `_get_server_keys_json` is a single argument which is
itself a `(server_name, key_id)` tuple, and `store_server_keys_response`
passed that nested tuple straight into the cache invalidation stream.
psycopg2 quietly serialises the inner tuple as a Postgres *record*, so
the `keys` column of `cache_invalidation_stream_by_instance` ended up
holding the record literal as a single string (e.g.
`{"(srv,ed25519:abc)"}`) — which never matches the real cache key on the
receiving side, i.e. the
invalidation has always been a silent no-op on workers. The native Rust
backend's stricter parameter conversion turns the same nested tuple into
a loud `TypeError: unsupported parameter type for postgres: tuple`.

Fix it the same way https://github.com/element-hq/synapse/pull/18899 did
for `_get_e2e_cross_signing_signatures_for_device`, which has the same
nested-tuple key shape: invalidate the local cache directly, JSON-encode
the key for the replication row, and decode it again in
`process_replication_rows`.

Found as part of the the effort to port the database pool to Rust.
 2026-07-27 09:29:58 +01:00
Hugh Nimmo-Smith 97fb38eca6 Return M_USER_LIMIT_EXCEEDED error code for media upload limits from MSC4335 (#18876) 
This PR uses the new `M_USER_LIMIT_EXCEEDED` common error code instead
of the malformed `M_RESOURCE_LIMIT_EXCEEDED` error code (as reported by
#18749) (spec: MSC4335).

The error code is also changed from `400` to `403` as this matches what
is in the spec for the endpoints:
https://spec.matrix.org/v1.18/client-server-api/#post_matrixmediav3upload
and
https://spec.matrix.org/v1.18/client-server-api/#put_matrixmediav3uploadservernamemediaid
(albeit the latter says that `M_FORBIDDEN` would be returned)

By default a new built-in `media_upload_limit_exceeded.html` template
will be served for the `info_uri`. Administrators can specify an
external URI in config instead.

Compatibility is retained for any existing modules making use the
`MediaUploadLimit` (e.g. via the `get_media_upload_limits_for_user`
callback).
 2026-07-24 16:39:04 -05:00
dependabot[bot] a58ad44eb0 Bump the minor-and-patches group with 5 updates (#19982) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:23:18 +00:00
dependabot[bot] eaba03b577 Bump pillow from 12.2.0 to 12.3.0 (#19983) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:21:30 +00:00
dependabot[bot] c39c92e9c9 Bump setuptools from 82.0.0 to 83.0.0 (#19988) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:20:15 +00:00
dependabot[bot] bdd53836ef Bump gitpython from 3.1.50 to 3.1.52 (#19990) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:19:25 +00:00
dependabot[bot] 444564f0be Bump pyasn1 from 0.6.3 to 0.6.4 (#19989) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:10:04 +00:00
FrenchGithubUserandAndrew Morgan 343581a1a0 fixes related to room v12 and sytest (#19898) 
Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
 2026-07-23 11:13:21 +00:00
Eric Eastwood 01ef46f95d Merge branch 'master' into develop 2026-07-22 13:57:25 -05:00
Eric Eastwood 2b5a0623ba 1.157.1 v1.157.1 2026-07-22 09:31:47 -05:00
Eric Eastwood 7cb94ab266 Fix config regression around falsy experimental_features (None) (#19987) 
Fix https://github.com/element-hq/synapse/issues/19986

Regressed in https://github.com/element-hq/synapse/pull/19539
 2026-07-22 09:07:29 -05:00
Eric Eastwood 3622579e7b Merge branch 'master' into develop 2026-07-21 10:52:42 -05:00
Eric Eastwood e0f251ce2c 1.157.0 v1.157.0 2026-07-21 10:21:37 -05:00
夜坂雅 5ed830b3b4 Change default room version to 11 (MSC4239) (#18680) 
Fix #18530

Complement test changes: https://github.com/matrix-org/complement/pull/858

SyTest changes: https://github.com/matrix-org/sytest/pull/1422
 2026-07-16 12:33:13 -05:00
Eric Eastwood 837d687977 Merge branch 'release-v1.157' into develop 
Conflicts:
	scripts-dev/release.py
 2026-07-15 12:02:47 -05:00
Eric Eastwood d930ac615b Update release script JSON schema find/replace to be compatible with macOS (#19962) 
BSD vs GNU `sed` problems:
```shell
$ sed -i '0,/^\$id: .*/s||$id: https://element-hq.github.io/synapse/schema/synapse/v1.157/synapse-config.schema.json|' schema/synapse-config.schema.yaml
sed: 1: "schema/synapse-config.s ...": bad flag in substitute command: 'h'
```
 2026-07-15 12:01:09 -05:00
Eric Eastwood 4679ed4b06 Silencing alerts is no longer necessary during a deploy (release script instructions) (#19968) 
As discussed in
[`#element-backend-internal:matrix.org`](https://matrix.to/#/!SGNQGPGUwtcPBUotTL:matrix.org/$29ZzRe7gg62UZmT0bgeseMs320Kb-Ub6DyaQE20-3ng?via=jki.re&via=element.io&via=matrix.org)

Our assumptions on why this was done previously: in the olden days you'd
get paged doing the redeploy even if everything was actually fine
(probably before we started doing rolling restarts?)
 2026-07-15 11:45:52 -05:00
catfromplan9 30088f38c0 Implement support for generating animated thumbnails in the media thumbnailer (#18831) 
Signed-off-by: cat <cat@plan9.rocks>
 2026-07-15 15:37:09 +00:00
Eric Eastwood e1420becdd Linkify 'Redact events of a user' docs v1.157.0rc1 2026-07-15 09:56:19 -05:00
dependabot[bot] 0512511f87 Bump anyhow from 1.0.102 to 1.0.103 in the patches group (#19952) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 11:25:46 +00:00
dependabot[bot] ff4e9ec7a7 Bump the minor-and-patches group with 2 updates (#19953) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 11:24:15 +00:00
jakobrss 243983e193 Clarified documentation for "List accounts" guests parameter (#19963) 2026-07-15 11:18:55 +00:00
Eric Eastwood 11b48cdbad Fix title case 2026-07-14 16:37:50 -05:00
Eric Eastwood f8c913c1c0 Call out upgrade notes 2026-07-14 16:32:17 -05:00
Eric Eastwood 72be9b5e17 1.157.0rc1 2026-07-14 16:20:56 -05:00
Eric Eastwood 651b44e0fc Update release script to be compatible with macOS 
BSD vs GNU `sed` problems:
```
sed -i '0,/^\$id: .*/s||$id: https://element-hq.github.io/synapse/schema/synapse/v1.157/synapse-config.schema.json|' schema/synapse-config.schema.yaml
sed: 1: "schema/synapse-config.s ...": bad flag in substitute command: 'h'
```
 2026-07-14 16:14:35 -05:00
dependabot[bot] 1979fcca52 Bump actions/checkout from 6.0.3 to 7.0.0 (#19921) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 11:19:15 +00:00
Andrew Morgan 6bfec47c47 Revert "Fix flaky 3PID inhibit error unit tests" (#19916) 2026-07-14 09:46:28 +00:00
dependabot[bot] ff7c3b9418 Bump actions/cache from 5.0.5 to 6.1.0 (#19920) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 09:25:28 +00:00
dependabot[bot] 60aa4466c8 Bump the minor-and-patches group with 2 updates (#19919) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 09:25:07 +00:00
dependabot[bot] 10f6370daf Bump bytes from 1.11.1 to 1.12.0 (#19918) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 09:24:39 +00:00
dependabot[bot] 1b181ee813 Bump log from 0.4.32 to 0.4.33 in the patches group (#19917) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 09:24:11 +00:00
dependabot[bot] aafb1fabcf Bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /complement (#19925) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 09:04:15 +00:00