forked-synapse/synapse
David Robertson 4f00432ce1
Fix potential leak of per-room profiles when the user dir is rebuilt. (#10981)
There are two steps to rebuilding the user directory:

1. a scan over rooms, followed by
2. a scan over local users.

The former reads avatars and display names from the `room_memberships`
table and therefore contains potentially private avatars and
display names. The latter reads from the the `profiles` table which only
contains public data; moreover it will overwrite any private profiles
that the rooms scan may have written to the user directory. This means
that the rebuild could leak private user while the rebuild was in
progress, only to later cover up the leaks once the rebuild had completed.

This change skips over local users when writing user_directory rows
when scanning rooms. Doing so means that it'll take longer for a rebuild
to make local users searchable, which is unfortunate. I think a future
PR can improve this by swapping the order of the two steps above. (And
indeed there's more to do here, e.g. copying from `profiles` without
going via Python.)

Small tidy-ups while I'm here:

* Remove duplicated code from test_initial. This was meant to be pulled into `purge_and_rebuild_user_dir`.
* Move `is_public` before updating sharing tables. No functional change; it's still before the first read of `is_public`.
* Don't bother creating a set from dict keys. Slightly nicer and makes the code simpler.

Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>
2021-10-05 18:35:25 +01:00
..
_scripts Remove shebang line from module files (#10415) 2021-07-29 21:34:14 +01:00
api Strip "join_authorised_via_users_server" from join events which do not need it. (#10933) 2021-10-01 11:39:17 -04:00
app Use direct references for configuration variables (part 6). (#10916) 2021-09-29 06:44:15 -04:00
appservice Use inline type hints in various other places (in synapse/) (#10380) 2021-07-15 11:02:43 +01:00
config Use direct references for configuration variables (part 6). (#10916) 2021-09-29 06:44:15 -04:00
crypto Use direct references for configuration variables (part 5). (#10897) 2021-09-24 07:25:21 -04:00
events Strip "join_authorised_via_users_server" from join events which do not need it. (#10933) 2021-10-01 11:39:17 -04:00
federation Strip "join_authorised_via_users_server" from join events which do not need it. (#10933) 2021-10-01 11:39:17 -04:00
groups Use direct references for configuration variables (part 4). (#10893) 2021-09-23 12:03:01 -04:00
handlers Fix logic flaw preventing tracking of MSC2716 events in existing room versions (#10962) 2021-10-05 11:51:57 -05:00
http Synapse 1.44.0rc1 (2021-09-29) 2021-09-29 14:23:39 +01:00
logging Log stack traces when a missing opentracing span is detected (#10983) 2021-10-05 12:23:25 +01:00
metrics [pyupgrade] synapse/ (#10348) 2021-07-19 15:28:05 +01:00
module_api Use direct references for some configuration variables (part 3) (#10885) 2021-09-23 07:13:34 -04:00
push Encode JSON responses on a thread in C, mk2 (#10905) 2021-09-28 09:37:58 +00:00
replication Pass str to twisted's IReactorTCP (#10895) 2021-09-30 12:51:47 +01:00
res Allow configuration of the oEmbed URLs. (#10714) 2021-08-31 18:37:07 -04:00
rest Use direct references for configuration variables (part 7). (#10959) 2021-10-04 07:18:54 -04:00
server_notices Use direct references for configuration variables (part 6). (#10916) 2021-09-29 06:44:15 -04:00
spam_checker_api Remove redundant "coding: utf-8" lines (#9786) 2021-04-14 15:34:27 +01:00
state Split event_auth.check into two parts (#10940) 2021-09-29 18:59:15 +01:00
static Display an error page during failure of fallback UIA. (#10561) 2021-08-18 08:13:35 -04:00
storage Fix potential leak of per-room profiles when the user dir is rebuilt. (#10981) 2021-10-05 18:35:25 +01:00
streams Remove unnecessary parentheses around tuples returned from methods (#10889) 2021-09-23 11:59:07 +01:00
util Use direct references for configuration variables (part 7). (#10959) 2021-10-04 07:18:54 -04:00
__init__.py 1.44.0 2021-10-05 13:45:24 +01:00
event_auth.py Ensure that we reject events which use rejected events for auth (#10956) 2021-10-05 13:23:29 +01:00
notifier.py Add type hints for event streams. (#10856) 2021-09-21 13:34:26 -04:00
python_dependencies.py Validate new m.room.power_levels events (#10232) 2021-08-26 17:07:58 +01:00
server.py Use direct references for some configuration variables (part 2) (#10812) 2021-09-15 08:34:52 -04:00
types.py Remove unnecessary parentheses around tuples returned from methods (#10889) 2021-09-23 11:59:07 +01:00
visibility.py [pyupgrade] synapse/ (#10348) 2021-07-19 15:28:05 +01:00