Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Commit

Permalink
filter out m.room.aliases from the CS API until a better solution is …
Browse files Browse the repository at this point in the history
…specced (#6878)

We're in the middle of properly mitigating spam caused by malicious aliases being added to a room. However, until this work fully lands, we temporarily filter out all m.room.aliases events from /sync and /messages on the CS API, to remove abusive aliases. This is considered acceptable as m.room.aliases events were never a reliable record of the given alias->id mapping and were purely informational, and in their current state do more harm than good.
  • Loading branch information
ara4n authored Feb 10, 2020
1 parent fe73f0d commit 8e64c5a
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 0 deletions.
1 change: 1 addition & 0 deletions changelog.d/6878.feature
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Filter out m.room.aliases from the CS API to mitigate abuse while a better solution is specced.
7 changes: 7 additions & 0 deletions synapse/visibility.py
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,13 @@ def allowed(event):
if not event.is_state() and event.sender in ignore_list:
return None

# Until MSC2261 has landed we can't redact malicious alias events, so for
# now we temporarily filter out m.room.aliases entirely to mitigate
# abuse, while we spec a better solution to advertising aliases
# on rooms.
if event.type == EventTypes.Aliases:
return None

# Don't try to apply the room's retention policy if the event is a state event, as
# MSC1763 states that retention is only considered for non-state events.
if apply_retention_policies and not event.is_state():
Expand Down

0 comments on commit 8e64c5a

Please sign in to comment.