Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

prune_event strips keys needed for authentication from events. #1831

Open
NegativeMjark opened this issue Jan 19, 2017 · 6 comments
Open

prune_event strips keys needed for authentication from events. #1831

NegativeMjark opened this issue Jan 19, 2017 · 6 comments
Labels
S-Minor Blocks non-critical functionality, workarounds exist. T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues.

Comments

@NegativeMjark
Copy link
Contributor

NegativeMjark commented Jan 19, 2017

It looks like we've been using keys in the event authentication checks without making sure they won't be removed when an event is redacted:

https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L41-L57
https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L69
https://github.com/matrix-org/synapse/blob/v0.18.7/synapse/events/utils.py#L71

Unfortunately fixing this will break the event signature checks for those events.

@NegativeMjark NegativeMjark changed the title prune_event strips third_party_invite keys from membership events. prune_event strips keys needed for authentication from events. Jan 20, 2017
@richvdh
Copy link
Member

richvdh commented May 19, 2022

I think this will be fixed by #8984, if/when it ever makes it into a production room version.

@babolivier
Copy link
Contributor

I think this will be fixed by #8984, if/when it ever makes it into a production room version.

It looks like that PR/MSC only fixes things for the redacts key, not third_party_invite or m.federate.

@babolivier babolivier added S-Minor Blocks non-critical functionality, workarounds exist. T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues. labels May 19, 2022
@richvdh
Copy link
Member

richvdh commented May 19, 2022

mmm, true

@turt2live
Copy link
Member

I've started an MSC2176 2.0 to handle third_party_invite and whatever else we notice: matrix-org/matrix-spec-proposals#3821

@clokep
Copy link
Member

clokep commented May 30, 2023

I've started an MSC2176 2.0 to handle third_party_invite and whatever else we notice: matrix-org/matrix-spec-proposals#3821

Note that #15563 implements MSC3821. So (assuming the MSC is accepted) we should be able to close this when that's released in a room version.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
S-Minor Blocks non-critical functionality, workarounds exist. T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues.
Projects
None yet
Development

No branches or pull requests

5 participants