Olivier 'reivilibreandOlivier 'reivilibre 0a2456fef3 Validate room name, avatar and heroes' profile fields before sending down sliding sync as trusted fields ...

Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-jhcg-5392-5mjw
Fixes: https://github.com/matrix-org/internal-config/issues/1751

I introduce some stricter JSON types that don't break down to `Any` — it seems these have become possible since our last attempt.
(I'm pretty sure mypy wouldn't let you do this a few years ago.)
Our `dict[str, Any]` type is such a footgun. I'd like to spread this out further, but will do so after the security release.

I then use these stricter JSON types on everything the sliding sync handler pulls out of `event.content` and therefore get forced into a bare minimum level of validation, by the type checker.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/151

2026-07-28 13:58:06 +01:00

..

api

Port Requester class to Rust. (#19828)

2026-06-09 10:26:04 +01:00

app

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

appservice

Write union types as X | Y where possible (#19111)

2025-11-06 14:02:33 -06:00

config

Fix config regression around falsy experimental_features (None) (#19987)

2026-07-22 09:07:29 -05:00

crypto

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

events

Re-expose the standalone format_event_* transforms for backwards compat (#19922)

2026-07-07 13:47:03 +01:00

federation

Prevent theft of room aliases via remote join to room with illegitimate predecessor

2026-07-28 13:58:06 +01:00

handlers

Restrict what errors we forward to clients from federation and policy servers

2026-07-28 13:58:06 +01:00

http

Fix multipart/form-data mitigation being case-sensitive.

2026-07-28 13:58:06 +01:00

logging

Fix flakey test failing with "twisted.protocols.amp.TooLong" (#19832)

2026-06-10 17:33:21 +01:00

media

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

metrics

Add metric to count number of non-deactivated users. (#19848)

2026-06-25 11:57:36 -05:00

module_api

Port Event class to Rust (#19701)

2026-06-02 11:05:38 +01:00

push

Rust database access via Python database connection pool v2 (#19878)

2026-07-07 13:07:35 -05:00

replication

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

rest

Validate room name, avatar and heroes' profile fields before sending down sliding sync as trusted fields

2026-07-28 13:58:06 +01:00

scripts

Write union types as X | Y where possible (#19111)

2025-11-06 14:02:33 -06:00

server_notices

Force keyword-args for clear default_config(server_name="test") usage (#19849)

2026-06-12 09:45:22 -05:00

state

Port Event class to Rust (#19701)

2026-06-02 11:05:38 +01:00

storage

Fix storage type mismatches where values didn't match their column types (#19911)

2026-07-10 10:38:43 +01:00

synapse_rust

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

test_utils

Fix flakey test failing with "twisted.protocols.amp.TooLong" (#19832)

2026-06-10 17:33:21 +01:00

types

Replace usage of deprecated assertEquals with assertEqual (#19345)

2026-01-06 17:30:21 +00:00

util

Fix some paths being accessible at unintended locations with extra prefix components

2026-07-28 13:58:06 +01:00

__init__.py

Correctly mention previous copyright (#16820)

2024-01-23 11:26:48 +00:00

server.py

Revert "Fix flaky 3PID inhibit error unit tests" (#19916)

2026-07-14 09:46:28 +00:00

test_distributor.py

Cleanly shutdown SynapseHomeServer object (#18828)

2025-10-01 02:42:09 +00:00

test_event_auth.py

Port Event class to Rust (#19701)

2026-06-02 11:05:38 +01:00

test_mau.py

Force keyword-args for clear default_config(server_name="test") usage (#19849)

2026-06-12 09:45:22 -05:00

test_notifier.py

Update wait_for_stream_token(...) patterns and fix sync fetching with unbounded token (#19644)

2026-05-14 14:53:16 -05:00

test_phone_home.py

Move unique snowflake homeserver background tasks to start_background_tasks (#19037)

2025-10-13 10:19:09 -05:00

test_rust.py

Add missing type hints to tests. (#15027)

2023-02-08 19:52:37 +00:00

test_server.py

Rename the test_disconnect test helper so that pytest doesn't see it as a test. (#19486)

2026-02-20 15:37:34 +00:00

test_state.py

Force keyword-args for clear default_config(server_name="test") usage (#19849)

2026-06-12 09:45:22 -05:00

test_terms_auth.py

Introduce Clock.call_when_running(...) to include logcontext by default (#18944)

2025-09-22 10:27:59 -05:00

test_types.py

Expose MSC4354 Sticky Events over MSC4186 (Simplified) Sliding Sync. (#19591)

2026-06-23 13:04:36 +00:00

test_visibility.py

Add a FilteredEvent type to handle per-user data on events (#19640)

2026-04-16 09:47:08 +01:00

unittest.py

Revert "Fix flaky 3PID inhibit error unit tests" (#19916)

2026-07-14 09:46:28 +00:00

utils.py

Use a CPU-time budget for test_lock_contention to fix postgres flakiness (#19929)

2026-07-09 10:40:53 +01:00