matrix-org/dendrite
Dendrite does not validate `senders` and `rooms` IDs in filters
開放
#2,067 建立於 2021年12月2日
C-Client-APIF-FiltersT-Defectgood first issue
倉庫指標
- 星標
- (5,632 顆星)
- PR 合併指標
- (PR 指標待抓取)
描述
Background information
- Dendrite version or git SHA: 83b9cb4d79123ec89e18a46d5202e74a9e9305b8
- Running in Docker?: yes
This was found while running Complement, so build information from this Dockerfile also applies.
Description
When working on matrix-org/complement@8021d43 (#259), dendrite failed the tests with the following logs;
client.go:392: POST hs1/_matrix/client/r0/user/@alice:hs1/filter => 200 OK (84.506966ms)
invalid_test.go:180: Expected 4XX status code, got 200 for testing filter map[room:map[timeline:map[rooms:[not_a_room_id]]]]
client.go:392: POST hs1/_matrix/client/r0/user/@alice:hs1/filter => 200 OK (57.808076ms)
invalid_test.go:180: Expected 4XX status code, got 200 for testing filter map[room:map[timeline:map[senders:[not_a_sender_id]]]]
This test comes from sytest, and i am pretty sure that dendrite should at least try to validate these strings to valid User IDs and Room IDs