Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Commit

Permalink
Validate the server name for the /publicRooms endpoint. (#9161)
Browse files Browse the repository at this point in the history
If a remote server name is provided, ensure it is something reasonable
before making remote connections to it.
  • Loading branch information
clokep authored Jan 19, 2021
1 parent 9454977 commit 47d48a5
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 2 deletions.
1 change: 1 addition & 0 deletions changelog.d/9161.bugfix
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fix a long-standing bug "ValueError: invalid literal for int() with base 10" when `/publicRooms` is requested with an invalid `server` parameter.
19 changes: 17 additions & 2 deletions synapse/rest/client/v1/room.py
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
)
from synapse.api.filtering import Filter
from synapse.events.utils import format_event_for_client_v2
from synapse.http.endpoint import parse_and_validate_server_name
from synapse.http.servlet import (
RestServlet,
assert_params_in_dict,
Expand Down Expand Up @@ -347,8 +348,6 @@ async def on_GET(self, request):
# provided.
if server:
raise e
else:
pass

limit = parse_integer(request, "limit", 0)
since_token = parse_string(request, "since", None)
Expand All @@ -359,6 +358,14 @@ async def on_GET(self, request):

handler = self.hs.get_room_list_handler()
if server and server != self.hs.config.server_name:
# Ensure the server is valid.
try:
parse_and_validate_server_name(server)
except ValueError:
raise SynapseError(
400, "Invalid server name: %s" % (server,), Codes.INVALID_PARAM,
)

try:
data = await handler.get_remote_public_room_list(
server, limit=limit, since_token=since_token
Expand Down Expand Up @@ -402,6 +409,14 @@ async def on_POST(self, request):

handler = self.hs.get_room_list_handler()
if server and server != self.hs.config.server_name:
# Ensure the server is valid.
try:
parse_and_validate_server_name(server)
except ValueError:
raise SynapseError(
400, "Invalid server name: %s" % (server,), Codes.INVALID_PARAM,
)

try:
data = await handler.get_remote_public_room_list(
server,
Expand Down

0 comments on commit 47d48a5

Please sign in to comment.