synapse

mirror of https://github.com/element-hq/synapse.git synced 2026-07-29 14:10:27 +00:00

Files

T

Olivier 'reivilibreandOlivier 'reivilibre 0a2456fef3 Validate room name, avatar and heroes' profile fields before sending down sliding sync as trusted fields

Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-jhcg-5392-5mjw
Fixes: https://github.com/matrix-org/internal-config/issues/1751

I introduce some stricter JSON types that don't break down to `Any` — it seems these have become possible since our last attempt.
(I'm pretty sure mypy wouldn't let you do this a few years ago.)
Our `dict[str, Any]` type is such a footgun. I'd like to spread this out further, but will do so after the security release.

I then use these stricter JSON types on everything the sliding sync handler pulls out of `event.content` and therefore get forced into a bare minimum level of validation, by the type checker.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/151

2026-07-28 13:58:06 +01:00

admin

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871 )

2026-07-02 15:20:38 -05:00

client

Validate room name, avatar and heroes' profile fields before sending down sliding sync as trusted fields

2026-07-28 13:58:06 +01:00

key

Write union types as X | Y where possible (#19111 )

2025-11-06 14:02:33 -06:00

media

Write union types as X | Y where possible (#19111 )