Validate the server name for the /publicRooms endpoint. (#9161)
If a remote server name is provided, ensure it is something reasonable before making remote connections to it.pull/9166/head
							parent
							
								
									94549771f7
								
							
						
					
					
						commit
						47d48a5853
					
				| 
						 | 
				
			
			@ -0,0 +1 @@
 | 
			
		|||
Fix a long-standing bug "ValueError: invalid literal for int() with base 10" when `/publicRooms` is requested with an invalid `server` parameter.
 | 
			
		||||
| 
						 | 
				
			
			@ -32,6 +32,7 @@ from synapse.api.errors import (
 | 
			
		|||
)
 | 
			
		||||
from synapse.api.filtering import Filter
 | 
			
		||||
from synapse.events.utils import format_event_for_client_v2
 | 
			
		||||
from synapse.http.endpoint import parse_and_validate_server_name
 | 
			
		||||
from synapse.http.servlet import (
 | 
			
		||||
    RestServlet,
 | 
			
		||||
    assert_params_in_dict,
 | 
			
		||||
| 
						 | 
				
			
			@ -347,8 +348,6 @@ class PublicRoomListRestServlet(TransactionRestServlet):
 | 
			
		|||
            # provided.
 | 
			
		||||
            if server:
 | 
			
		||||
                raise e
 | 
			
		||||
            else:
 | 
			
		||||
                pass
 | 
			
		||||
 | 
			
		||||
        limit = parse_integer(request, "limit", 0)
 | 
			
		||||
        since_token = parse_string(request, "since", None)
 | 
			
		||||
| 
						 | 
				
			
			@ -359,6 +358,14 @@ class PublicRoomListRestServlet(TransactionRestServlet):
 | 
			
		|||
 | 
			
		||||
        handler = self.hs.get_room_list_handler()
 | 
			
		||||
        if server and server != self.hs.config.server_name:
 | 
			
		||||
            # Ensure the server is valid.
 | 
			
		||||
            try:
 | 
			
		||||
                parse_and_validate_server_name(server)
 | 
			
		||||
            except ValueError:
 | 
			
		||||
                raise SynapseError(
 | 
			
		||||
                    400, "Invalid server name: %s" % (server,), Codes.INVALID_PARAM,
 | 
			
		||||
                )
 | 
			
		||||
 | 
			
		||||
            try:
 | 
			
		||||
                data = await handler.get_remote_public_room_list(
 | 
			
		||||
                    server, limit=limit, since_token=since_token
 | 
			
		||||
| 
						 | 
				
			
			@ -402,6 +409,14 @@ class PublicRoomListRestServlet(TransactionRestServlet):
 | 
			
		|||
 | 
			
		||||
        handler = self.hs.get_room_list_handler()
 | 
			
		||||
        if server and server != self.hs.config.server_name:
 | 
			
		||||
            # Ensure the server is valid.
 | 
			
		||||
            try:
 | 
			
		||||
                parse_and_validate_server_name(server)
 | 
			
		||||
            except ValueError:
 | 
			
		||||
                raise SynapseError(
 | 
			
		||||
                    400, "Invalid server name: %s" % (server,), Codes.INVALID_PARAM,
 | 
			
		||||
                )
 | 
			
		||||
 | 
			
		||||
            try:
 | 
			
		||||
                data = await handler.get_remote_public_room_list(
 | 
			
		||||
                    server,
 | 
			
		||||
| 
						 | 
				
			
			
 | 
			
		|||
		Loading…
	
		Reference in New Issue