Matrix-Mirrors/anonymousland-synapse
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse.git synced 2025-05-05 14:14:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

Add additional validation to pusher URLs. (#8865)

Browse source 
Pusher URLs now must end in `/_matrix/push/v1/notify` per the
specification.
This commit is contained in:
Patrick Cloke 2020-12-04 10:51:56 -05:00 • committed by GitHub
parent df3e6a23a7
commit b774c555d8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 107 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

16
synapse/push/httppusher.py
View file

@ -14,6 +14,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
import logging
import urllib.parse
from prometheus_client import Counter
@ -97,9 +98,22 @@ class HttpPusher:
if self.data is None:
raise PusherConfigException("data can not be null for HTTP pusher")
# Validate that there's a URL and it is of the proper form.
if "url" not in self.data:
raise PusherConfigException("'url' required in data for HTTP pusher")
self.url = self.data["url"]
url = self.data["url"]
if not isinstance(url, str):
raise PusherConfigException("'url' must be a string")
url_parts = urllib.parse.urlparse(url)
# Note that the specification also says the scheme must be HTTPS, but
# it isn't up to the homeserver to verify that.
if url_parts.path != "/_matrix/push/v1/notify":
raise PusherConfigException(
"'url' must have a path of '/_matrix/push/v1/notify'"
)
self.url = url
self.http_client = hs.get_proxied_blacklisted_http_client()
self.data_minus_url = {}
self.data_minus_url.update(self.data)