From 541cf3453fa3460a2d75e32eb3d95bd55a7fd6c0 Mon Sep 17 00:00:00 2001 From: Richard van der Hoff Date: Thu, 30 Sep 2021 17:36:01 +0100 Subject: [PATCH] Ensure that we reject events which use rejected events for auth When we consider whether to accept events, we should not accept those which depend on rejected events for their auth events. This (together with earlier changes such as https://github.com/matrix-org/synapse/pull/10771 and https://github.com/matrix-org/synapse/pull/10896) forms a partial fix to https://github.com/matrix-org/synapse/issues/9595. There still remain code paths where we do not check the `auth_events` at all. --- changelog.d/10956.bugfix | 1 + synapse/event_auth.py | 6 ++++++ 2 files changed, 7 insertions(+) create mode 100644 changelog.d/10956.bugfix diff --git a/changelog.d/10956.bugfix b/changelog.d/10956.bugfix new file mode 100644 index 000000000000..13b8e5983b73 --- /dev/null +++ b/changelog.d/10956.bugfix @@ -0,0 +1 @@ +Fix a long-standing bug which meant that events received over federation were sometimes incorrectly accepted into the room state. diff --git a/synapse/event_auth.py b/synapse/event_auth.py index 7a1adc27509e..ca0293a3dc86 100644 --- a/synapse/event_auth.py +++ b/synapse/event_auth.py @@ -155,6 +155,12 @@ def check_auth_rules_for_event( "which is in room %s" % (event.event_id, room_id, auth_event.event_id, auth_event.room_id), ) + if auth_event.rejected_reason: + raise AuthError( + 403, + "During auth for event %s: found rejected event %s in the state" + % (event.event_id, auth_event.event_id), + ) # Implementation of https://matrix.org/docs/spec/rooms/v1#authorization-rules #