dandri/synapse
1
0
Fork 0
mirror of https://github.com/element-hq/synapse.git synced 2026-08-03 13:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity
25,925 Commits 1,168 Branches 842 Tags
e3715b24fbf2c9399df54cb9e4e5282b91a94597
Commit Graph
25925 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot]andGitHub e3715b24fb Bump the patches group with 2 updates (#20012) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-29 09:30:21 +00:00
dependabot[bot]andGitHub 41c41d2c12 Bump quinn-proto from 0.11.14 to 0.11.16 (#20010) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-29 09:30:01 +00:00
Eric EastwoodandGitHub 1a1af7b622 Link to changelog instead of duplicating content in the tag/release (#19984) 
This means we can point to a single source of truth instead of
duplicating the content to the tag and GitHub release. Less to manage
and worry about when you make some updates to the changelog (maintenance
burden). We also get to avoid the content sitting in the vendor lock-in
GitHub releases.

We point to
`https://github.com/element-hq/synapse/blob/{repo.active_branch.name}/CHANGES.md`
as it will have the relevant changelog entry at the top and won't change
as we archive releases on `develop`. Even for RC releases after the main
release goes out, the entry will still be towards the top. We could try
to get the heading anchor for the specific section but I thought that it
wasn't necessary (nice but more complex).
 2026-07-28 15:44:26 -05:00
dependabot[bot]andGitHub 5d55a05f8e Bump regex from 1.12.4 to 1.13.0 (#20013) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-28 14:02:43 +00:00
Olivier 'reivilibre 9761f9bc42 Merge branch 'master' into develop 2026-07-28 14:39:05 +01:00
Olivier 'reivilibre 0c709bbb78 1.157.2 v1.157.2 2026-07-28 14:02:12 +01:00
Olivier 'reivilibreandOlivier 'reivilibre 0a2456fef3 Validate room name, avatar and heroes' profile fields before sending down sliding sync as trusted fields 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-jhcg-5392-5mjw
Fixes: https://github.com/matrix-org/internal-config/issues/1751

I introduce some stricter JSON types that don't break down to `Any` — it seems these have become possible since our last attempt.
(I'm pretty sure mypy wouldn't let you do this a few years ago.)
Our `dict[str, Any]` type is such a footgun. I'd like to spread this out further, but will do so after the security release.

I then use these stricter JSON types on everything the sliding sync handler pulls out of `event.content` and therefore get forced into a bare minimum level of validation, by the type checker.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/151
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandOlivier 'reivilibre c3adee3509 Restrict what errors we forward to clients from federation and policy servers 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-95fh-hv8c-chvq
Fixes: https://github.com/matrix-org/internal-config/issues/1721

https://github.com/element-hq/synapse-private/pull/158 is the end goal, I think

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/159
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandOlivier 'reivilibre 44216bf2b6 Limit the size of push rules 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-fp53-rw9v-hcf9
Fixes: https://github.com/matrix-org/internal-config/issues/1071

Because this is an out-of-spec limit and could break someone's workflow on release day, I've opted to make it configurable.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/149
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandOlivier 'reivilibre 4f8037ab59 Anchor the ends of our path patterns to prevent path traversal vulnerabilities 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-hgcg-p9gx-fq5f
Fixes: https://github.com/element-hq/backend-internal/issues/217 -> https://github.com/matrix-org/internal-config/issues/1760

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/146
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreOlivier 'reivilibreEric Eastwood
 		cbc6934821 Prevent theft of room aliases via remote join to room with illegitimate predecessor 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-cjh7-rcpx-xpf8
Fixes: https://github.com/matrix-org/internal-config/issues/1729

---------

Co-authored-by: Eric Eastwood <erice@element.io>
Reviewed-on: https://github.com/element-hq/synapse-private/pull/136
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandOlivier 'reivilibre 68139e5234 Add missing 'event in expected room' check on /event_auth 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-qcjr-46gf-7f4r
Fixes: https://github.com/matrix-org/internal-config/issues/1714

The `/event_auth` endpoint could be tricked to give you the auth chain for an event in a foreign room,
because it trusted the requester to provide the correct `room_id` for the event.

Now we pass the `room_id` through all the way to `get_event`'s `check_room_id`, which (correctly IMO) treats mismatches as unknown events (seems correct as it prevents divulging what events we know about).

The `test_event_auth_wrong_room_returns_404` test failed before the fix.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/147
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandOlivier 'reivilibre 3772859fbc Add missing same-room check on /get_missing_events handler 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-27p5-4f45-gx76
Fixes: https://github.com/matrix-org/internal-config/issues/1717

I've tried my best to make the tests a good narrative for the thought process here,
but essentially the rationale is to make `/get_missing_events` not distinguish
between 'event is in wrong room' and 'event is unknown to me'.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/141
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreOlivier 'reivilibreEric Eastwood
 		83672faf9c Add missing 'host in room' check for /timestamp_to_event/{roomId} 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-r66v-qhwx-8rg4
Fixes: https://github.com/matrix-org/internal-config/issues/1718

---------

Co-authored-by: Eric Eastwood <erice@element.io>
Reviewed-on: https://github.com/element-hq/synapse-private/pull/144
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandOlivier 'reivilibre 51988c509f Fix spoofed to-device messages over federation not being dropped. 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-rgv2-84w7-5j9p
Fixes: https://github.com/matrix-org/internal-config/issues/1520
Introduced in: d4a35ada28

The code was obviously intended to drop them,
but the if block only logged without actually taking any action.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/145
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandOlivier 'reivilibre e39303af40 Fix some paths being accessible at unintended locations with extra prefix components 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-vh4c-pqh4-w3wq
Fixes: https://github.com/matrix-org/internal-config/issues/1703

The key thing to understand is that in `synapse/util/httpresourcetree.py`,
we create `UnrecognizedRequestResource` and then dangle children (with real resources) off them.

Since `UnrecognizedRequestResource` returns itself as a catch-all 'dynamic child',
this means any `UnrecognizedRequestResource`s with real children can have unlimited path components inserted between it and its child.

So `/_matrix/INSERTED/static/client/login/style.css` or `/_matrix/INSERTED/AS/MANY/AS/I/WANT/static/client/login/style.css` would unexpectedly resolve to the resource.

Client, Federation and Admin APIs wouldn't have been affected because you wouldn't get through the regex routing that they use.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/143
 2026-07-28 13:58:06 +01:00
Olivier 'reivilibreandOlivier 'reivilibre e860184067 Fix multipart/form-data mitigation being case-sensitive. 
Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-6wjm-9p2x-gvpm
Fixes: https://github.com/matrix-org/internal-config/issues/1740

Relevant library code to check against:

 - CPython `EmailMessage.get_content_type()`  (https://github.com/python/cpython/blob/v3.13.3/Lib/email/message.py#L608-L630)
 - Twisted `_parseContentType()` (https://github.com/twisted/twisted/blob/twisted-25.5.0/src/twisted/web/http.py#L306-L313)
 - Twisted `Request.requestReceived()` (https://github.com/twisted/twisted/blob/twisted-25.5.0/src/twisted/web/http.py#L1079-L1097)

-----

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
Reviewed-on: https://github.com/element-hq/synapse-private/pull/133
 2026-07-28 13:58:06 +01:00
Eric EastwoodandGitHub c5e5abb822 Use weakref to Python DatabasePool to allow homeserver to cleanly shutdown (#20009) 
Use weakref to Python `DatabasePool` to allow homeserver to cleanly
shutdown

Spawning from
[upgrading](https://github.com/element-hq/synapse-small-hosts/pull/420#discussion_r3661700252)
the Synapse version in Synapse Pro for small hosts and seeing our tenant
deprovision tests failing (end-to-end Complement tests). Specifically,
it was failing with a test in
[`TestLogging`](https://github.com/element-hq/synapse-small-hosts/blob/f24ee731ff419890680d1d80ef6eafe44f87f2c2/complement/tests/multi_synapse/logging_test.go#L328-L385)
in CI but was equally reproducible with any test where we deprovision
(`deployment.StopServer(...)`) like
[`TestProvisionHomeserverTenant/deprovision_homeserver_tenant`](https://github.com/element-hq/synapse-small-hosts/blob/f24ee731ff419890680d1d80ef6eafe44f87f2c2/complement/tests/multi_synapse/provision_test.go#L48-L58).

Clean homeserver shutdown specifically regressed with the changes from
https://github.com/element-hq/synapse/pull/19878. The
`PythonDatabasePoolWrapper` in Rust holds onto a reference to the Python
`DatabasePool` which references the Python `HomeServer` and keeps the
`HomeServer` from being garbage collected on the Python side.

This PR updates `PythonDatabasePoolWrapper` to use a weak reference.


### Dev notes

Previous PR where we had to deal with Rust <-> Python reference cycles,
https://github.com/element-hq/synapse/pull/19837#discussion_r3425358096

PyO3 garbage collector docs (`__traverse__`, `__clear__`):
https://pyo3.rs/v0.28.3/class/protocols#garbage-collector-integration


### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
 2026-07-28 10:04:48 +01:00
Eric Eastwood 408b0936ac Revert "Add changelog" 
This reverts commit befd2e2b7a.
 2026-07-27 18:56:17 -05:00
Eric Eastwood befd2e2b7a Add changelog 2026-07-27 18:53:37 -05:00
Erik JohnstonandGitHub 51672809c7 Fix _get_server_keys_json invalidations over replication as JSON (#19966) 
The cache key of `_get_server_keys_json` is a single argument which is
itself a `(server_name, key_id)` tuple, and `store_server_keys_response`
passed that nested tuple straight into the cache invalidation stream.
psycopg2 quietly serialises the inner tuple as a Postgres *record*, so
the `keys` column of `cache_invalidation_stream_by_instance` ended up
holding the record literal as a single string (e.g.
`{"(srv,ed25519:abc)"}`) — which never matches the real cache key on the
receiving side, i.e. the
invalidation has always been a silent no-op on workers. The native Rust
backend's stricter parameter conversion turns the same nested tuple into
a loud `TypeError: unsupported parameter type for postgres: tuple`.

Fix it the same way https://github.com/element-hq/synapse/pull/18899 did
for `_get_e2e_cross_signing_signatures_for_device`, which has the same
nested-tuple key shape: invalidate the local cache directly, JSON-encode
the key for the replication row, and decode it again in
`process_replication_rows`.

Found as part of the the effort to port the database pool to Rust.
 2026-07-27 09:29:58 +01:00
Hugh Nimmo-SmithandGitHub 97fb38eca6 Return M_USER_LIMIT_EXCEEDED error code for media upload limits from MSC4335 (#18876) 
This PR uses the new `M_USER_LIMIT_EXCEEDED` common error code instead
of the malformed `M_RESOURCE_LIMIT_EXCEEDED` error code (as reported by
#18749) (spec: MSC4335).

The error code is also changed from `400` to `403` as this matches what
is in the spec for the endpoints:
https://spec.matrix.org/v1.18/client-server-api/#post_matrixmediav3upload
and
https://spec.matrix.org/v1.18/client-server-api/#put_matrixmediav3uploadservernamemediaid
(albeit the latter says that `M_FORBIDDEN` would be returned)

By default a new built-in `media_upload_limit_exceeded.html` template
will be served for the `info_uri`. Administrators can specify an
external URI in config instead.

Compatibility is retained for any existing modules making use the
`MediaUploadLimit` (e.g. via the `get_media_upload_limits_for_user`
callback).
 2026-07-24 16:39:04 -05:00
dependabot[bot]andGitHub a58ad44eb0 Bump the minor-and-patches group with 5 updates (#19982) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:23:18 +00:00
dependabot[bot]andGitHub eaba03b577 Bump pillow from 12.2.0 to 12.3.0 (#19983) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:21:30 +00:00
dependabot[bot]andGitHub c39c92e9c9 Bump setuptools from 82.0.0 to 83.0.0 (#19988) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:20:15 +00:00
dependabot[bot]andGitHub bdd53836ef Bump gitpython from 3.1.50 to 3.1.52 (#19990) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:19:25 +00:00
dependabot[bot]andGitHub 444564f0be Bump pyasn1 from 0.6.3 to 0.6.4 (#19989) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 09:10:04 +00:00
FrenchGithubUserGitHubAndrew Morgan
 		343581a1a0 fixes related to room v12 and sytest (#19898) 
Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
 2026-07-23 11:13:21 +00:00
Eric Eastwood 01ef46f95d Merge branch 'master' into develop 2026-07-22 13:57:25 -05:00
Eric Eastwood 2b5a0623ba 1.157.1 v1.157.1 2026-07-22 09:31:47 -05:00
Eric EastwoodandGitHub 7cb94ab266 Fix config regression around falsy experimental_features (None) (#19987) 
Fix https://github.com/element-hq/synapse/issues/19986

Regressed in https://github.com/element-hq/synapse/pull/19539
 2026-07-22 09:07:29 -05:00
Eric Eastwood 3622579e7b Merge branch 'master' into develop 2026-07-21 10:52:42 -05:00
Eric Eastwood e0f251ce2c 1.157.0 v1.157.0 2026-07-21 10:21:37 -05:00
夜坂雅andGitHub 5ed830b3b4 Change default room version to 11 (MSC4239) (#18680) 
Fix #18530

Complement test changes: https://github.com/matrix-org/complement/pull/858

SyTest changes: https://github.com/matrix-org/sytest/pull/1422
 2026-07-16 12:33:13 -05:00
Eric Eastwood 837d687977 Merge branch 'release-v1.157' into develop 
Conflicts:
	scripts-dev/release.py
 2026-07-15 12:02:47 -05:00
Eric EastwoodandGitHub d930ac615b Update release script JSON schema find/replace to be compatible with macOS (#19962) 
BSD vs GNU `sed` problems:
```shell
$ sed -i '0,/^\$id: .*/s||$id: https://element-hq.github.io/synapse/schema/synapse/v1.157/synapse-config.schema.json|' schema/synapse-config.schema.yaml
sed: 1: "schema/synapse-config.s ...": bad flag in substitute command: 'h'
```
 2026-07-15 12:01:09 -05:00
Eric EastwoodandGitHub 4679ed4b06 Silencing alerts is no longer necessary during a deploy (release script instructions) (#19968) 
As discussed in
[`#element-backend-internal:matrix.org`](https://matrix.to/#/!SGNQGPGUwtcPBUotTL:matrix.org/$29ZzRe7gg62UZmT0bgeseMs320Kb-Ub6DyaQE20-3ng?via=jki.re&via=element.io&via=matrix.org)

Our assumptions on why this was done previously: in the olden days you'd
get paged doing the redeploy even if everything was actually fine
(probably before we started doing rolling restarts?)
 2026-07-15 11:45:52 -05:00
catfromplan9andGitHub 30088f38c0 Implement support for generating animated thumbnails in the media thumbnailer (#18831) 
Signed-off-by: cat <cat@plan9.rocks>
 2026-07-15 15:37:09 +00:00
Eric Eastwood e1420becdd Linkify 'Redact events of a user' docs v1.157.0rc1 2026-07-15 09:56:19 -05:00
dependabot[bot]andGitHub 0512511f87 Bump anyhow from 1.0.102 to 1.0.103 in the patches group (#19952) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 11:25:46 +00:00
dependabot[bot]andGitHub ff4e9ec7a7 Bump the minor-and-patches group with 2 updates (#19953) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 11:24:15 +00:00
jakobrssandGitHub 243983e193 Clarified documentation for "List accounts" guests parameter (#19963) 2026-07-15 11:18:55 +00:00
Eric Eastwood 11b48cdbad Fix title case 2026-07-14 16:37:50 -05:00
Eric Eastwood f8c913c1c0 Call out upgrade notes 2026-07-14 16:32:17 -05:00
Eric Eastwood 72be9b5e17 1.157.0rc1 2026-07-14 16:20:56 -05:00
Eric Eastwood 651b44e0fc Update release script to be compatible with macOS 
BSD vs GNU `sed` problems:
```
sed -i '0,/^\$id: .*/s||$id: https://element-hq.github.io/synapse/schema/synapse/v1.157/synapse-config.schema.json|' schema/synapse-config.schema.yaml
sed: 1: "schema/synapse-config.s ...": bad flag in substitute command: 'h'
```
 2026-07-14 16:14:35 -05:00
dependabot[bot]andGitHub 1979fcca52 Bump actions/checkout from 6.0.3 to 7.0.0 (#19921) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 11:19:15 +00:00
Andrew MorganandGitHub 6bfec47c47 Revert "Fix flaky 3PID inhibit error unit tests" (#19916) 2026-07-14 09:46:28 +00:00
dependabot[bot]andGitHub ff7c3b9418 Bump actions/cache from 5.0.5 to 6.1.0 (#19920) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 09:25:28 +00:00
dependabot[bot]andGitHub 60aa4466c8 Bump the minor-and-patches group with 2 updates (#19919) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 09:25:07 +00:00