Give a meaningful error message when a client tries to create a room with an invalid alias localpart. (#12779)

3 files changed, 19 insertions, 0 deletions

diff --git a/changelog.d/12779.bugfix b/changelog.d/12779.bugfix
new file mode 100644
index 0000000000..7cf7a1f65f
--- /dev/null
+++ b/changelog.d/12779.bugfix
@@ -0,0 +1 @@
+Give a meaningful error message when a client tries to create a room with an invalid alias localpart.
\ No newline at end of file
diff --git a/synapse/handlers/directory.py b/synapse/handlers/directory.py
index 33d827a45b..4aa33df884 100644
--- a/synapse/handlers/directory.py
+++ b/synapse/handlers/directory.py
@@ -71,6 +71,9 @@ class DirectoryHandler:
             if wchar in room_alias.localpart:
                 raise SynapseError(400, "Invalid characters in room alias")
 
+        if ":" in room_alias.localpart:
+            raise SynapseError(400, "Invalid character in room alias localpart: ':'.")
+
         if not self.hs.is_mine(room_alias):
             raise SynapseError(400, "Room alias must be local")
             # TODO(erikj): Change this.
diff --git a/synapse/handlers/room.py b/synapse/handlers/room.py
index a2973109ad..53569e5212 100644
--- a/synapse/handlers/room.py
+++ b/synapse/handlers/room.py
@@ -751,6 +751,21 @@ class RoomCreationHandler:
                 if wchar in config["room_alias_name"]:
                     raise SynapseError(400, "Invalid characters in room alias")
 
+            if ":" in config["room_alias_name"]:
+                # Prevent someone from trying to pass in a full alias here.
+                # Note that it's permissible for a room alias to have multiple
+                # hash symbols at the start (notably bridged over from IRC, too),
+                # but the first colon in the alias is defined to separate the local
+                # part from the server name.
+                # (remember server names can contain port numbers, also separated
+                # by a colon. But under no circumstances should the local part be
+                # allowed to contain a colon!)
+                raise SynapseError(
+                    400,
+                    "':' is not permitted in the room alias name. "
+                    "Please note this expects a local part — 'wombat', not '#wombat:example.com'.",
+                )
+
             room_alias = RoomAlias(config["room_alias_name"], self.hs.hostname)
             mapping = await self.store.get_association_from_room_alias(room_alias)