Forbid non-ASes from registering users whose names begin with '_' (SYN-738)

1 files changed, 7 insertions, 0 deletions

diff --git a/synapse/handlers/register.py b/synapse/handlers/register.py

index b9b5880d64..dd75c4fecf 100644
--- a/synapse/handlers/register.py
+++ b/synapse/handlers/register.py
@@ -53,6 +53,13 @@ class RegistrationHandler(BaseHandler):
                 Codes.INVALID_USERNAME
             )
 
+        if localpart[0] == '_':
+            raise SynapseError(
+                400,
+                "User ID may not begin with _",
+                Codes.INVALID_USERNAME
+            )
+
         user = UserID(localpart, self.hs.hostname)
         user_id = user.to_string()