Olivier 'reivilibreandOlivier 'reivilibre e39303af40 Fix some paths being accessible at unintended locations with extra prefix components ...

Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-vh4c-pqh4-w3wq
Fixes: https://github.com/matrix-org/internal-config/issues/1703

The key thing to understand is that in `synapse/util/httpresourcetree.py`,
we create `UnrecognizedRequestResource` and then dangle children (with real resources) off them.

Since `UnrecognizedRequestResource` returns itself as a catch-all 'dynamic child',
this means any `UnrecognizedRequestResource`s with real children can have unlimited path components inserted between it and its child.

So `/_matrix/INSERTED/static/client/login/style.css` or `/_matrix/INSERTED/AS/MANY/AS/I/WANT/static/client/login/style.css` would unexpectedly resolve to the resource.

Client, Federation and Admin APIs wouldn't have been affected because you wouldn't get through the regex routing that they use.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/143

2026-07-28 13:58:06 +01:00

..

caches

Fix /sync caching transient errors for the sync_response_cache_duration. (#19845)

2026-06-16 11:12:29 +01:00

__init__.py

Correctly mention previous copyright (#16820)

2024-01-23 11:26:48 +00:00

test_async_helpers.py

Allow long lived syncs to be cancelled if client has gone away (#19499)

2026-02-26 21:41:06 +00:00

test_background_queue.py

Fixup logcontexts after replication PR. (#19146)

2025-11-05 15:38:14 +00:00

test_batching_queue.py

Use type hinting generics in standard collections (#19046)

2025-10-22 16:48:19 -05:00

test_check_dependencies.py

Fix a typo in check_dependencies.py which makes setuptools_rust a running dependency (#19417)

2026-02-03 15:40:20 +00:00

test_clock.py

Fix looping calls not getting GCed. (#19416)

2026-01-30 10:26:53 +00:00

test_dict_cache.py

Cleanly shutdown SynapseHomeServer object (#18828)

2025-10-01 02:42:09 +00:00

test_events.py

Add plain-text handling for rich-text topics as per MSC3765 (#18195)

2025-07-09 14:13:54 -05:00

test_expiring_cache.py

Use type hinting generics in standard collections (#19046)

2025-10-22 16:48:19 -05:00

test_file_consumer.py

Write union types as X | Y where possible (#19111)

2025-11-06 14:02:33 -06:00

test_httpresourcetree.py

Fix some paths being accessible at unintended locations with extra prefix components

2026-07-28 13:58:06 +01:00

test_itertools.py

Use type hinting generics in standard collections (#19046)

2025-10-22 16:48:19 -05:00

test_linearizer.py

Use type hinting generics in standard collections (#19046)

2025-10-22 16:48:19 -05:00

test_logcontext.py

Port Clock functions to use Duration class (#19229)

2025-12-01 13:55:06 +00:00

test_logformatter.py

Update license headers

2023-11-21 15:29:58 -05:00

test_lrucache.py

Use type hinting generics in standard collections (#19046)

2025-10-22 16:48:19 -05:00

test_macaroons.py

Correctly mention previous copyright (#16820)

2024-01-23 11:26:48 +00:00

test_mutable_overlay_mapping.py

Use type hinting generics in standard collections (#19046)

2025-10-22 16:48:19 -05:00

test_ratelimitutils.py

Force keyword-args for clear default_config(server_name="test") usage (#19849)

2026-06-12 09:45:22 -05:00

test_retryutils.py

Cleanly shutdown SynapseHomeServer object (#18828)

2025-10-01 02:42:09 +00:00

test_rwlock.py

Use type hinting generics in standard collections (#19046)

2025-10-22 16:48:19 -05:00

test_split_dict.py

Limit to-device EDU sizes (#19617)

2026-06-02 15:57:55 +00:00

test_stream_change_cache.py

Refactor cache metrics to be homeserver-scoped (#18604)

2025-07-16 16:04:57 -05:00

test_stringutils.py

Implement MSC4133 to support custom profile fields. (#17488)

2025-01-21 11:11:04 +00:00

test_task_scheduler.py

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

test_threepids.py

Correctly mention previous copyright (#16820)

2024-01-23 11:26:48 +00:00

test_treecache.py

Correctly mention previous copyright (#16820)

2024-01-23 11:26:48 +00:00

test_wheel_timer.py

Allow long lived syncs to be cancelled if client has gone away (#19499)

2026-02-26 21:41:06 +00:00