summary refs log tree commit diff
path: root/packages/overlays/matrix-synapse/patches/0034-Ensure-the-url-previewer-also-hashes-and-quarantines.patch
diff options
context:
space:
mode:
Diffstat (limited to 'packages/overlays/matrix-synapse/patches/0034-Ensure-the-url-previewer-also-hashes-and-quarantines.patch')
-rw-r--r--packages/overlays/matrix-synapse/patches/0034-Ensure-the-url-previewer-also-hashes-and-quarantines.patch87
1 files changed, 0 insertions, 87 deletions
diff --git a/packages/overlays/matrix-synapse/patches/0034-Ensure-the-url-previewer-also-hashes-and-quarantines.patch b/packages/overlays/matrix-synapse/patches/0034-Ensure-the-url-previewer-also-hashes-and-quarantines.patch
deleted file mode 100644

index 62f579f..0000000 --- a/packages/overlays/matrix-synapse/patches/0034-Ensure-the-url-previewer-also-hashes-and-quarantines.patch +++ /dev/null
@@ -1,87 +0,0 @@ -From d0873d549a8cce720a7842919126d78b4d9d030d Mon Sep 17 00:00:00 2001 -From: Will Hunt <will@half-shot.uk> -Date: Tue, 6 May 2025 11:04:31 +0100 -Subject: [PATCH 34/74] Ensure the url previewer also hashes and quarantines - media (#18297) - -Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> ---- - changelog.d/18297.misc | 1 + - synapse/media/media_repository.py | 1 - - synapse/media/url_previewer.py | 17 ++++++++++++++--- - 3 files changed, 15 insertions(+), 4 deletions(-) - create mode 100644 changelog.d/18297.misc - -diff --git a/changelog.d/18297.misc b/changelog.d/18297.misc -new file mode 100644 -index 0000000000..5032d48174 ---- /dev/null -+++ b/changelog.d/18297.misc -@@ -0,0 +1 @@ -+Apply file hashing and existing quarantines to media downloaded for URL previews. -diff --git a/synapse/media/media_repository.py b/synapse/media/media_repository.py -index 859b30e029..18c5a8ecec 100644 ---- a/synapse/media/media_repository.py -+++ b/synapse/media/media_repository.py -@@ -378,7 +378,6 @@ class MediaRepository: - media_length=content_length, - user_id=auth_user, - sha256=sha256, -- # TODO: Better name? - quarantined_by="system" if should_quarantine else None, - ) - -diff --git a/synapse/media/url_previewer.py b/synapse/media/url_previewer.py -index 2e65a04789..8ef2b3f0c0 100644 ---- a/synapse/media/url_previewer.py -+++ b/synapse/media/url_previewer.py -@@ -41,7 +41,7 @@ from synapse.api.errors import Codes, SynapseError - from synapse.http.client import SimpleHttpClient - from synapse.logging.context import make_deferred_yieldable, run_in_background - from synapse.media._base import FileInfo, get_filename_from_headers --from synapse.media.media_storage import MediaStorage -+from synapse.media.media_storage import MediaStorage, SHA256TransparentIOWriter - from synapse.media.oembed import OEmbedProvider - from synapse.media.preview_html import decode_body, parse_html_to_open_graph - from synapse.metrics.background_process_metrics import run_as_background_process -@@ -593,17 +593,26 @@ class UrlPreviewer: - file_info = FileInfo(server_name=None, file_id=file_id, url_cache=True) - - async with self.media_storage.store_into_file(file_info) as (f, fname): -+ sha256writer = SHA256TransparentIOWriter(f) - if url.startswith("data:"): - if not allow_data_urls: - raise SynapseError( - 500, "Previewing of data: URLs is forbidden", Codes.UNKNOWN - ) - -- download_result = await self._parse_data_url(url, f) -+ download_result = await self._parse_data_url(url, sha256writer.wrap()) - else: -- download_result = await self._download_url(url, f) -+ download_result = await self._download_url(url, sha256writer.wrap()) - - try: -+ sha256 = sha256writer.hexdigest() -+ should_quarantine = await self.store.get_is_hash_quarantined(sha256) -+ -+ if should_quarantine: -+ logger.warn( -+ "Media has been automatically quarantined as it matched existing quarantined media" -+ ) -+ - time_now_ms = self.clock.time_msec() - - await self.store.store_local_media( -@@ -614,6 +623,8 @@ class UrlPreviewer: - media_length=download_result.length, - user_id=user, - url_cache=url, -+ sha256=sha256, -+ quarantined_by="system" if should_quarantine else None, - ) - - except Exception as e: --- -2.49.0 -