summary refs log tree commit diff
path: root/synapse/rest/client
diff options
context:
space:
mode:
authorsanthoshivan23 <47689668+santhoshivan23@users.noreply.github.com>2022-06-22 20:02:18 +0530
committerGitHub <noreply@github.com>2022-06-22 15:32:18 +0100
commitd54909956ef616d976b3d9969be994df5b65030a (patch)
tree48a096aa0c97feebc159b1f50e9c8bafb965eeb0 /synapse/rest/client
parentUse caret (semver bounds) for matrix.org packages (#13082) (diff)
downloadsynapse-d54909956ef616d976b3d9969be994df5b65030a.tar.xz
validate room alias before interacting with the room directory (#13106)
Diffstat (limited to 'synapse/rest/client')
-rw-r--r--synapse/rest/client/directory.py6
1 files changed, 6 insertions, 0 deletions
diff --git a/synapse/rest/client/directory.py b/synapse/rest/client/directory.py
index 9639d4fe2c..d6c89cb162 100644
--- a/synapse/rest/client/directory.py
+++ b/synapse/rest/client/directory.py
@@ -46,6 +46,8 @@ class ClientDirectoryServer(RestServlet):
         self.auth = hs.get_auth()
 
     async def on_GET(self, request: Request, room_alias: str) -> Tuple[int, JsonDict]:
+        if not RoomAlias.is_valid(room_alias):
+            raise SynapseError(400, "Room alias invalid", errcode=Codes.INVALID_PARAM)
         room_alias_obj = RoomAlias.from_string(room_alias)
 
         res = await self.directory_handler.get_association(room_alias_obj)
@@ -55,6 +57,8 @@ class ClientDirectoryServer(RestServlet):
     async def on_PUT(
         self, request: SynapseRequest, room_alias: str
     ) -> Tuple[int, JsonDict]:
+        if not RoomAlias.is_valid(room_alias):
+            raise SynapseError(400, "Room alias invalid", errcode=Codes.INVALID_PARAM)
         room_alias_obj = RoomAlias.from_string(room_alias)
 
         content = parse_json_object_from_request(request)
@@ -89,6 +93,8 @@ class ClientDirectoryServer(RestServlet):
     async def on_DELETE(
         self, request: SynapseRequest, room_alias: str
     ) -> Tuple[int, JsonDict]:
+        if not RoomAlias.is_valid(room_alias):
+            raise SynapseError(400, "Room alias invalid", errcode=Codes.INVALID_PARAM)
         room_alias_obj = RoomAlias.from_string(room_alias)
         requester = await self.auth.get_user_by_req(request)