Olivier 'reivilibre 68139e5234 Add missing 'event in expected room' check on /event_auth ...

Fixes: https://github.com/element-hq/synapse/security/advisories/GHSA-qcjr-46gf-7f4r
Fixes: https://github.com/matrix-org/internal-config/issues/1714

The `/event_auth` endpoint could be tricked to give you the auth chain for an event in a foreign room,
because it trusted the requester to provide the correct `room_id` for the event.

Now we pass the `room_id` through all the way to `get_event`'s `check_room_id`, which (correctly IMO) treats mismatches as unknown events (seems correct as it prevents divulging what events we know about).

The `test_event_auth_wrong_room_returns_404` test failed before the fix.

-----

Reviewed-on: https://github.com/element-hq/synapse-private/pull/147

2026-07-28 13:58:06 +01:00

..

api

Port Requester class to Rust. (#19828)

2026-06-09 10:26:04 +01:00

app

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

appservice

Write union types as X | Y where possible (#19111)

2025-11-06 14:02:33 -06:00

config

Fix config regression around falsy experimental_features (None) (#19987)

2026-07-22 09:07:29 -05:00

crypto

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

events

Re-expose the standalone format_event_* transforms for backwards compat (#19922)

2026-07-07 13:47:03 +01:00

federation

Add missing 'event in expected room' check on /event_auth

2026-07-28 13:58:06 +01:00

handlers

Send offline presence for stale states when presence is disabled (#19948)

2026-07-13 10:08:57 +01:00

http

Fix multipart/form-data mitigation being case-sensitive.

2026-07-28 13:58:06 +01:00

logging

Fix flakey test failing with "twisted.protocols.amp.TooLong" (#19832)

2026-06-10 17:33:21 +01:00

media

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

metrics

Add metric to count number of non-deactivated users. (#19848)

2026-06-25 11:57:36 -05:00

module_api

Port Event class to Rust (#19701)

2026-06-02 11:05:38 +01:00

push

Rust database access via Python database connection pool v2 (#19878)

2026-07-07 13:07:35 -05:00

replication

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

rest

Fix spoofed to-device messages over federation not being dropped.

2026-07-28 13:58:06 +01:00

scripts

Write union types as X | Y where possible (#19111)

2025-11-06 14:02:33 -06:00

server_notices

Force keyword-args for clear default_config(server_name="test") usage (#19849)

2026-06-12 09:45:22 -05:00

state

Port Event class to Rust (#19701)

2026-06-02 11:05:38 +01:00

storage

Fix storage type mismatches where values didn't match their column types (#19911)

2026-07-10 10:38:43 +01:00

synapse_rust

Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool) (#19871)

2026-07-02 15:20:38 -05:00

test_utils

Fix flakey test failing with "twisted.protocols.amp.TooLong" (#19832)

2026-06-10 17:33:21 +01:00

types

Replace usage of deprecated assertEquals with assertEqual (#19345)

2026-01-06 17:30:21 +00:00

util

Fix some paths being accessible at unintended locations with extra prefix components

2026-07-28 13:58:06 +01:00

__init__.py

Correctly mention previous copyright (#16820)

2024-01-23 11:26:48 +00:00

server.py

Revert "Fix flaky 3PID inhibit error unit tests" (#19916)

2026-07-14 09:46:28 +00:00

test_distributor.py

Cleanly shutdown SynapseHomeServer object (#18828)

2025-10-01 02:42:09 +00:00

test_event_auth.py

Port Event class to Rust (#19701)

2026-06-02 11:05:38 +01:00

test_mau.py

Force keyword-args for clear default_config(server_name="test") usage (#19849)

2026-06-12 09:45:22 -05:00

test_notifier.py

Update wait_for_stream_token(...) patterns and fix sync fetching with unbounded token (#19644)

2026-05-14 14:53:16 -05:00

test_phone_home.py

Move unique snowflake homeserver background tasks to start_background_tasks (#19037)

2025-10-13 10:19:09 -05:00

test_rust.py

Add missing type hints to tests. (#15027)

2023-02-08 19:52:37 +00:00

test_server.py

Rename the test_disconnect test helper so that pytest doesn't see it as a test. (#19486)

2026-02-20 15:37:34 +00:00

test_state.py

Force keyword-args for clear default_config(server_name="test") usage (#19849)

2026-06-12 09:45:22 -05:00

test_terms_auth.py

Introduce Clock.call_when_running(...) to include logcontext by default (#18944)

2025-09-22 10:27:59 -05:00

test_types.py

Expose MSC4354 Sticky Events over MSC4186 (Simplified) Sliding Sync. (#19591)

2026-06-23 13:04:36 +00:00

test_visibility.py

Add a FilteredEvent type to handle per-user data on events (#19640)

2026-04-16 09:47:08 +01:00

unittest.py

Revert "Fix flaky 3PID inhibit error unit tests" (#19916)

2026-07-14 09:46:28 +00:00

utils.py

Use a CPU-time budget for test_lock_contention to fix postgres flakiness (#19929)

2026-07-09 10:40:53 +01:00