daemon: Catch POST requests that try to send out messages.

Synapse seems to accept a POST requests on the
_matrix/client/r0/rooms/$ROOM/send/m.room.message path.

While this is not specced in any way people might shoot themselves in
the foot by sending unencrypted messages to a room if they, by accident,
use the wrong HTTP method.

This fixes: #56
This commit is contained in:
Damir Jelić 2020-06-24 15:04:37 +02:00
parent da08ccac5a
commit a1ce95076e
2 changed files with 6 additions and 1 deletions

View File

@ -19,6 +19,7 @@ import urllib.parse
import concurrent.futures
from json import JSONDecodeError
from typing import Any, Dict
from uuid import uuid4
import aiohttp
import attr
@ -817,7 +818,7 @@ class ProxyDaemon:
return await self.forward_to_web(request, token=client.access_token)
msgtype = request.match_info["event_type"]
txnid = request.match_info["txnid"]
txnid = request.match_info.get("txnid", uuid4())
try:
content = await request.json()

View File

@ -69,6 +69,10 @@ async def init(data_dir, server_conf, send_queue, recv_queue):
r"/_matrix/client/r0/rooms/{room_id}/send/{event_type}/{txnid}",
proxy.send_message,
),
web.post(
r"/_matrix/client/r0/rooms/{room_id}/send/{event_type}",
proxy.send_message,
),
web.post("/_matrix/client/r0/user/{user_id}/filter", proxy.filter),
web.post("/.well-known/matrix/client", proxy.well_known),
web.get("/.well-known/matrix/client", proxy.well_known),