daemon: Catch POST requests that try to send out messages.

Synapse seems to accept a POST requests on the
_matrix/client/r0/rooms/$ROOM/send/m.room.message path.

While this is not specced in any way people might shoot themselves in
the foot by sending unencrypted messages to a room if they, by accident,
use the wrong HTTP method.

This fixes: #56
This commit is contained in:
Damir Jelić 2020-06-24 15:04:37 +02:00
parent da08ccac5a
commit a1ce95076e
2 changed files with 6 additions and 1 deletions

View File

@ -19,6 +19,7 @@ import urllib.parse
import concurrent.futures import concurrent.futures
from json import JSONDecodeError from json import JSONDecodeError
from typing import Any, Dict from typing import Any, Dict
from uuid import uuid4
import aiohttp import aiohttp
import attr import attr
@ -817,7 +818,7 @@ class ProxyDaemon:
return await self.forward_to_web(request, token=client.access_token) return await self.forward_to_web(request, token=client.access_token)
msgtype = request.match_info["event_type"] msgtype = request.match_info["event_type"]
txnid = request.match_info["txnid"] txnid = request.match_info.get("txnid", uuid4())
try: try:
content = await request.json() content = await request.json()

View File

@ -69,6 +69,10 @@ async def init(data_dir, server_conf, send_queue, recv_queue):
r"/_matrix/client/r0/rooms/{room_id}/send/{event_type}/{txnid}", r"/_matrix/client/r0/rooms/{room_id}/send/{event_type}/{txnid}",
proxy.send_message, proxy.send_message,
), ),
web.post(
r"/_matrix/client/r0/rooms/{room_id}/send/{event_type}",
proxy.send_message,
),
web.post("/_matrix/client/r0/user/{user_id}/filter", proxy.filter), web.post("/_matrix/client/r0/user/{user_id}/filter", proxy.filter),
web.post("/.well-known/matrix/client", proxy.well_known), web.post("/.well-known/matrix/client", proxy.well_known),
web.get("/.well-known/matrix/client", proxy.well_known), web.get("/.well-known/matrix/client", proxy.well_known),