Remove : from allowed client_secret chars (#8101)

Closes: #6766 Equivalent Sydent PR: matrix-org/sydent#309 I believe it's now time to remove the extra allowed `:` from `client_secret` parameters.
matrix-org · Aug 18, 2020 · 5cf7c12 · 5cf7c12
1 parent 408aef8
commit 5cf7c12
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 6 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -1,3 +1,17 @@
+For the next release
+====================
+
+Removal warning
+---------------
+
+Some older clients used a
+[disallowed character](https://matrix.org/docs/spec/client_server/r0.6.1#post-matrix-client-r0-register-email-requesttoken)
+(`:`) in the `client_secret` parameter of various endpoints. The incorrect
+behaviour was allowed for backwards compatibility, but is now being removed
+from Synapse as most users have updated their client. Further context can be
+found at [\#6766](https://github.com/matrix-org/synapse/issues/6766).
+
+
 Synapse 1.19.0 (2020-08-17)
 ===========================
 

diff --git a/changelog.d/8101.bugfix b/changelog.d/8101.bugfix
@@ -0,0 +1 @@
+Synapse now correctly enforces the valid characters in the `client_secret` parameter used in various endpoints.
diff --git a/synapse/util/stringutils.py b/synapse/util/stringutils.py
@@ -24,9 +24,7 @@
 _string_with_symbols = string.digits + string.ascii_letters + ".,;:^&*-_+=#~@"
 
 # https://matrix.org/docs/spec/client_server/r0.6.0#post-matrix-client-r0-register-email-requesttoken
-# Note: The : character is allowed here for older clients, but will be removed in a
-# future release. Context: https://github.com/matrix-org/synapse/issues/6766
-client_secret_regex = re.compile(r"^[0-9a-zA-Z\.\=\_\-\:]+$")
+client_secret_regex = re.compile(r"^[0-9a-zA-Z\.\=\_\-]+$")
 
 # random_string and random_string_with_symbols are used for a range of things,
 # some cryptographically important, some less so. We use SystemRandom to make sure

diff --git a/tests/util/test_stringutils.py b/tests/util/test_stringutils.py
@@ -28,9 +28,6 @@ def test_client_secret_regex(self):
             "_--something==_",
             "...--==-18913",
             "8Dj2odd-e9asd.cd==_--ddas-secret-",
-            # We temporarily allow : characters: https://github.com/matrix-org/synapse/issues/6766
-            # To be removed in a future release
-            "SECRET:1234567890",
         ]
 
         bad = [
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Synapse now correctly enforces the valid characters in the `client_secret` parameter used in various endpoints.