diff options
| author | santhoshivan23 <47689668+santhoshivan23@users.noreply.github.com> | 2022-06-22 20:02:18 +0530 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-06-22 15:32:18 +0100 |
| commit | d54909956ef616d976b3d9969be994df5b65030a (patch) | |
| tree | 48a096aa0c97feebc159b1f50e9c8bafb965eeb0 /synapse/rest/client/directory.py | |
| parent | Use caret (semver bounds) for matrix.org packages (#13082) (diff) | |
| download | synapse-d54909956ef616d976b3d9969be994df5b65030a.tar.xz | |
validate room alias before interacting with the room directory (#13106)
Diffstat (limited to 'synapse/rest/client/directory.py')
| -rw-r--r-- | synapse/rest/client/directory.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/synapse/rest/client/directory.py b/synapse/rest/client/directory.py index 9639d4fe2c..d6c89cb162 100644 --- a/synapse/rest/client/directory.py +++ b/synapse/rest/client/directory.py @@ -46,6 +46,8 @@ class ClientDirectoryServer(RestServlet): self.auth = hs.get_auth() async def on_GET(self, request: Request, room_alias: str) -> Tuple[int, JsonDict]: + if not RoomAlias.is_valid(room_alias): + raise SynapseError(400, "Room alias invalid", errcode=Codes.INVALID_PARAM) room_alias_obj = RoomAlias.from_string(room_alias) res = await self.directory_handler.get_association(room_alias_obj) @@ -55,6 +57,8 @@ class ClientDirectoryServer(RestServlet): async def on_PUT( self, request: SynapseRequest, room_alias: str ) -> Tuple[int, JsonDict]: + if not RoomAlias.is_valid(room_alias): + raise SynapseError(400, "Room alias invalid", errcode=Codes.INVALID_PARAM) room_alias_obj = RoomAlias.from_string(room_alias) content = parse_json_object_from_request(request) @@ -89,6 +93,8 @@ class ClientDirectoryServer(RestServlet): async def on_DELETE( self, request: SynapseRequest, room_alias: str ) -> Tuple[int, JsonDict]: + if not RoomAlias.is_valid(room_alias): + raise SynapseError(400, "Room alias invalid", errcode=Codes.INVALID_PARAM) room_alias_obj = RoomAlias.from_string(room_alias) requester = await self.auth.get_user_by_req(request) |