summary refs log tree commit diff
path: root/synapse/rest
diff options
context:
space:
mode:
authorDavid Robertson <davidr@element.io>2021-08-20 15:47:03 +0100
committerGitHub <noreply@github.com>2021-08-20 15:47:03 +0100
commitee3b2ac59a5645cb213b3c11c473613b80fe1e0f (patch)
treee6ec57cf1b94e684cd8245611e58d3e68e935500 /synapse/rest
parentSplit `on_receive_pdu` in half (#10640) (diff)
downloadsynapse-ee3b2ac59a5645cb213b3c11c473613b80fe1e0f.tar.xz
Validate device_keys for C-S /keys/query requests (#10593)
* Validate device_keys for C-S /keys/query requests

Closes #10354

A small, not particularly critical fix. I'm interested in seeing if we
can find a more systematic approach though. #8445 is the place for any discussion.
Diffstat (limited to 'synapse/rest')
-rw-r--r--synapse/rest/client/keys.py16
1 files changed, 15 insertions, 1 deletions
diff --git a/synapse/rest/client/keys.py b/synapse/rest/client/keys.py
index d0d9d30d40..012491f597 100644
--- a/synapse/rest/client/keys.py
+++ b/synapse/rest/client/keys.py
@@ -15,8 +15,9 @@
 # limitations under the License.
 
 import logging
+from typing import Any
 
-from synapse.api.errors import SynapseError
+from synapse.api.errors import InvalidAPICallError, SynapseError
 from synapse.http.servlet import (
     RestServlet,
     parse_integer,
@@ -163,6 +164,19 @@ class KeyQueryServlet(RestServlet):
         device_id = requester.device_id
         timeout = parse_integer(request, "timeout", 10 * 1000)
         body = parse_json_object_from_request(request)
+
+        device_keys = body.get("device_keys")
+        if not isinstance(device_keys, dict):
+            raise InvalidAPICallError("'device_keys' must be a JSON object")
+
+        def is_list_of_strings(values: Any) -> bool:
+            return isinstance(values, list) and all(isinstance(v, str) for v in values)
+
+        if any(not is_list_of_strings(keys) for keys in device_keys.values()):
+            raise InvalidAPICallError(
+                "'device_keys' values must be a list of strings",
+            )
+
         result = await self.e2e_keys_handler.query_devices(
             body, timeout, user_id, device_id
         )