Validate client_secret parameter (#6767)

* commit '9f7aaf90b':
  Validate client_secret parameter (#6767)

1 files changed, 5 insertions, 2 deletions

diff --git a/synapse/util/stringutils.py b/synapse/util/stringutils.py

index 6a2464cab3..2c0dcb5208 100644
--- a/synapse/util/stringutils.py
+++ b/synapse/util/stringutils.py
@@ -26,13 +26,16 @@ from synapse.api.errors import Codes, SynapseError
 
 _string_with_symbols = string.digits + string.ascii_letters + ".,;:^&*-_+=#~@"
 
+# https://matrix.org/docs/spec/client_server/r0.6.0#post-matrix-client-r0-register-email-requesttoken
+# Note: The : character is allowed here for older clients, but will be removed in a
+# future release. Context: https://github.com/matrix-org/synapse/issues/6766
+client_secret_regex = re.compile(r"^[0-9a-zA-Z\.\=\_\-\:]+$")
+
 # random_string and random_string_with_symbols are used for a range of things,
 # some cryptographically important, some less so. We use SystemRandom to make sure
 # we get cryptographically-secure randoms.
 rand = random.SystemRandom()
 
-client_secret_regex = re.compile(r"^[0-9a-zA-Z.=_-]+$")
-
 
 def random_string(length):
     return "".join(rand.choice(string.ascii_letters) for _ in range(length))