search

element-hq / synapse

Synapse: Matrix homeserver written in Python/Twisted.
https://element-hq.github.io/synapse
GNU Affero General Public License v3.0
987 stars 112 forks source link

/directory/room leaks all involved homeservers #17298

Open stefanceriu opened 3 weeks ago

stefanceriu commented 3 weeks ago

Description

1) Try resolving an alias e.g. https://matrix-client.matrix.org/_matrix/client/v3/directory/room/%23jellyfinorg:matrix.org 2) Get back 348 servers which presumably is all of them. 3) Profit?

This is not only a privacy concern but also wasteful. If the client tries to use them to join the room it will fail and the client can't trim the list because no ordering is specified.

(joining jellyfin fails in this case with <html><body><h1>400 Bad request</h1>\nYour browser sent an invalid request.\n</body></html>\n, which is probably another problem in itself)

Steps to reproduce

Access https://matrix-client.matrix.org/_matrix/client/v3/directory/room/%23jellyfinorg:matrix.org

Homeserver

matrix.org

Synapse Version

server_version: "1.109.0rc1 (b=matrix-org-hotfixes,40975b3098,dirty)"

Installation Method

Other (please mention below)

Database

-

Workers

Single process

Platform

-

Configuration

-

Relevant log output

-

Anything else that would be useful to know?

-

devonh commented 2 weeks ago

Hmm. The response being returned is as per the spec: https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv3directoryroomroomalias If you think the spec should be changed, I would suggest writing an MSC to do so.

As for being able to join the room (space) using the resolved alias from that request, I tried joining the space you mentioned with the room ID returned (!pvOfSyfiUOIEBrZDWF:matrix.org) using element desktop and it worked without issue.

stefanceriu commented 1 week ago

I wasn't suggesting synapse isn't respecting the spec. The spec doesn't mention the maximum number of servers to return or their ordering (one way or another) so I'm trying to acertaing if this is inentional, a mistake, a miss or something else. If you agree that this is indeed a problem I can go ahead and write the MSC

As for joining, I don't know what Element Web is doing but the plain request is always failing for me, see

the details

https://matrix-client.matrix.org/_matrix/client/v3/join/!NaLbfexyNIBQDbzGwB:bonifacelabs.ca?server_name=matrix.org&server_name=gianmarco.gg&server_name=matrix.unbl.ink&server_name=stukamanhpt4.com&server_name=wepa.gspot.lol&server_name=im.jellyfin.org&server_name=arm0.red&server_name=lermer.nl&server_name=chat.knightrealm.us&server_name=matrix.wiley.pub&server_name=robibe.ro&server_name=converser.eu&server_name=doshitan.com&server_name=sakura.ci&server_name=wasscher.com&server_name=janky.solutions&server_name=beeper.com&server_name=4d2.org&server_name=am.subby.pet&server_name=jpxs.io&server_name=matrix.lhax.xyz&server_name=memes.nz&server_name=darkskiez.co.uk&server_name=tasistro-hart.com&server_name=naoh.host&server_name=ohai.is&server_name=ma.ozx.me&server_name=private.coffee&server_name=based.center&server_name=vogel.xyz&server_name=fablab-bruchsal.de&server_name=matrix.zakariao.nl&server_name=christian-martins.fr&server_name=chat.generallyrubbish.net&server_name=rethelyi.space&server_name=matrix.besaid.de&server_name=tux.pizza&server_name=slothlife.ems.host&server_name=matrix.vanten-s.com&server_name=opensuse.org&server_name=rob.land&server_name=matrix.cheemsbread.xyz&server_name=matrix.lokiberra.cf&server_name=minds.com&server_name=auengun.net&server_name=gcaillaut.fr&server_name=matrix.zaggy.nl&server_name=hacked.place&server_name=everskold.com&server_name=matrix.vasbud.fun&server_name=bombed.dev&server_name=avery.ems.host&server_name=tedomum.net&server_name=bpulse.org&server_name=revreso.de&server_name=matrix.decwebb.com&server_name=breeze.town&server_name=chat.threepulse.com&server_name=flexinos.tech&server_name=decadesdrive.com&server_name=wesser.ems.host&server_name=screspo.me&server_name=seizure.icu&server_name=feline.support&server_name=shennarwp.com&server_name=lat3st.de&server_name=chat.olomorn.xyz&server_name=danbulant.cz&server_name=matrix.hermherm.org&server_name=chronoti.me&server_name=liber.li&server_name=im.m4fx.de&server_name=system1337.com&server_name=colorlesscube.com&server_name=matrix.klugmathias.me&server_name=flip.earth&server_name=ristein.de&server_name=sal.web.tr&server_name=vampdev.com&server_name=libresolutions.network&server_name=librecave.com&server_name=tetaneutral.net&server_name=cody.to&server_name=mtrx.nz&server_name=yharnam.city&server_name=mx.badnick.name&server_name=aguiarvieira.pt&server_name=hadesmonsta.de&server_name=linuxdelta.com&server_name=matrix.cookie559.lol&server_name=pynk.dev&server_name=zutto.fi&server_name=nexions.net&server_name=robbinsa.me&server_name=herrmann.dev&server_name=spacecadet.info&server_name=matrix.iofel.me&server_name=xd.cm&server_name=matrix.cubable.date&server_name=interslice.chat&server_name=chat.ie9.org&server_name=squirrellydave.net&server_name=simatime.com&server_name=jn.hn&server_name=toppoint.de&server_name=matrix.bngtzn.se&server_name=thebeanbakery.xyz&server_name=secureim.de&server_name=synapse.binarydad.com&server_name=matrix.thedisco.zone&server_name=matrix.gresille.org&server_name=noagenda.chat&server_name=matrix.borgcube.de&server_name=zibbp.net&server_name=popicraft.net&server_name=luebke.dev&server_name=shanetrs.ddns.net&server_name=matrix.iwolfking.xyz&server_name=oneplace.link&server_name=zachs.online&server_name=rany.eu.org&server_name=matrix.ericrao.icu&server_name=glasgow.social&server_name=nerdsin.space&server_name=chat.caino.dev&server_name=imihov.com&server_name=matrix.lambspork.ca&server_name=synapse.lif.ovh%3A443&server_name=liberta.casa&server_name=ccamtech.com&server_name=libertas.chat&server_name=stardrifter.net&server_name=possumlodge.me&server_name=ramondia.net&server_name=node2.tech&server_name=solver.red&server_name=yterhor.st&server_name=matrix.mebitek.com&server_name=matrix.sunlightmail.net&server_name=mashedlevers.xyz&server_name=matrix.furworks.de&server_name=matrix.computingcache.com&server_name=galaxy.cat&server_name=www.aletsch.duckdns.org&server_name=matrix.barronpm.com&server_name=techsaviours.org&server_name=matrix.blobfox.coffee&server_name=flueren.eu&server_name=hentai69.de&server_name=zernable.net&server_name=bozg.se&server_name=h2.gay&server_name=casplantje.nl&server_name=synapse.migou.synology.me&server_name=blyatflix.com&server_name=prasket.net&server_name=valdas.space&server_name=jacksn.dev&server_name=cthd.icu&server_name=talk.go7box.xyz&server_name=azelphur.com&server_name=xyborg.xyz&server_name=kapsi.fi&server_name=matrix.sarkasti.eu&server_name=koyax.org&server_name=chat.akdub.club&server_name=m.neb.cx&server_name=darkflame.dev&server_name=lemmy.world&server_name=matrix.joejoetv.de&server_name=bchn.foo&server_name=newcircuit.io&server_name=matrix.thegriffiths.ca&server_name=matrix.farley.pro&server_name=metaccount.de&server_name=arc.run&server_name=4ray.co&server_name=flux.industries&server_name=matrix.hydrar.de&server_name=protokolla.fi&server_name=matrix.thisisjoes.site&server_name=bukn.uk&server_name=matrix.devnullvoid.space&server_name=zhaofeng.li&server_name=v0lk.com&server_name=pyrox.dev&server_name=matrix.space-elephant.org&server_name=arschtronaut.de&server_name=cult.ltd&server_name=matrix.ucw.cz&server_name=nyanlout.re&server_name=hostpath.de&server_name=cub.icu&server_name=tubyte.net&server_name=genius.ke&server_name=etero.dev&server_name=privacytools.io&server_name=catgirl.cloud&server_name=bintrix.net&server_name=w9r.de&server_name=rom4nik.pl&server_name=matrix.h.etbus.ch&server_name=justsem.org&server_name=20220714-test.ems.host&server_name=matrix.hopfenspace.org&server_name=matrix.rbpatrick.xyz&server_name=antti.codes&server_name=matrix.cnv.solutions&server_name=illudar.com&server_name=drnk.org&server_name=krasserscheiss.cool&server_name=neo.angry.im&server_name=cordoba.beru.co&server_name=tjakosquad.nl&server_name=matrix.teamfriesen.com&server_name=chat.wilkinsons.cloud&server_name=mtx.vsanten.de&server_name=cebo29.ipv64.de&server_name=gunpoint.org.uk&server_name=chat.is-cute.ml&server_name=kucharczyk.xyz&server_name=thebias.nl&server_name=dendrite.dedyn.io&server_name=sosnowkadub.de&server_name=chatwave.org&server_name=szejner.com&server_name=jboi.nl&server_name=unredacted.org&server_name=trygve.me&server_name=matrix.futcloud.de&server_name=felixperron.com&server_name=datenburg.org&server_name=matrix.kabukimono.contact&server_name=darkmatter.rocks&server_name=matrix.kovalev.systems&server_name=dfn.su&server_name=matrix.jasondaigo.de&server_name=tchncs.de&server_name=linuiz.org&server_name=ferriroli.com&server_name=pkrm.dev&server_name=gelat.in&server_name=thedi.sh&server_name=rochestercastle.net&server_name=bark.lgbt&server_name=vincejv.com&server_name=club1.fr&server_name=lonenomad.net&server_name=clusterfsck.com&server_name=conduit.rs&server_name=buyvm.net&server_name=fambamslam.com&server_name=nekoarc.online&server_name=chaos.jetzt&server_name=theia.myadoran.com&server_name=computingcache.com&server_name=yvan.dev&server_name=pub.solar&server_name=dauden.me&server_name=matrix.lyall.cam&server_name=w33b.cloud&server_name=stormo.chat&server_name=alexandrebadalo.pt&server_name=waifuhunter.club&server_name=matrix.sndr.uk&server_name=empty.social&server_name=parcanum.hu&server_name=bitforged.net&server_name=matrix.im&server_name=matrix.spacetime.technology&server_name=bstr.cl&server_name=matrix.vehling.info&server_name=pieracy.online&server_name=avery.cafe&server_name=fairydust.space&server_name=hdzki.kozow.com&server_name=p0457.ninja&server_name=jarrod.cool&server_name=magdeburg.jetzt&server_name=sgf.lt&server_name=blueplate.de&server_name=hacklab.fi&server_name=lhax.xyz&server_name=ungleich.ch&server_name=matrix.kulzaus.top&server_name=flow-soft.uk&server_name=hawaii.viaregio-services.de&server_name=dowdell.media&server_name=holycowman.com&server_name=nerdyredneck.net&server_name=speedie.site&server_name=ma.bupkis.ca&server_name=matrix.thehawken.org&server_name=matrix.imihov.com&server_name=codeine.world&server_name=matrix.ilike.green&server_name=jupiterbroadcasting.com&server_name=midov.pl&server_name=cloudf.de&server_name=mandragot.org&server_name=nmmcguire.com&server_name=uddu.chat&server_name=xescu.re&server_name=mymatrix.yorili.com&server_name=wired.lain.io&server_name=uwueviee.live&server_name=matrix.snld.ca&server_name=makussu.de&server_name=matrix.randalor.net&server_name=harha.net&server_name=matrix.vending-machine.xyz&server_name=randomsonicnet.org&server_name=matrix.servur.net&server_name=oppi.li&server_name=thalhammer.it&server_name=matrix.divisionismanmade.net&server_name=matrix.irrealidad.xyz&server_name=matrix.dupiec.gay&server_name=matrix.safeguard.network&server_name=cronce.io&server_name=streamhq.lol&server_name=librem.one&server_name=thewired.ch&server_name=staging.d.sb&server_name=libreti.net&server_name=matrix.pikko.xyz&server_name=dodsorf.as&server_name=okash.it&server_name=shinra.dev&server_name=stultus.net&server_name=matrix.bortle-host.io&server_name=matrix.justyn.io&server_name=matrix.darkflame.dev&server_name=matrix.quickbrb.com&server_name=matrix.ruglesms.xyz&server_name=asra.gr&server_name=chat.leleet.tk&server_name=altillimity.com&server_name=t2bot.io&server_name=pudl.es&server_name=matrix.hgs.moe&server_name=eyjhb.dk&server_name=cyberpantheon.com&server_name=malined.com&server_name=u.pikko.xyz&server_name=matrix.incogne.io&server_name=bouvier.family&server_name=matrix.schotty.com&server_name=magaya.org&server_name=matrix.markovcloud.com&server_name=vpsguige.ovh&server_name=saggis.com&server_name=exotic.sh&server_name=workly.ai&server_name=synaptrix.dedyn.io&server_name=cybre.space&server_name=galli.li&server_name=chat.binarydad.com&server_name=cancioc.com&server_name=kribs.net&server_name=mnemi.moe&server_name=ads34.de&server_name=diffey.dev&server_name=entorta.xyz&server_name=matrix.vpshk.mingye.ch&server_name=parlote.fr&server_name=matrix.bttd.hu&server_name=0x6b.dev&server_name=bitwrk.de&server_name=vigue.me&server_name=chatinamatrix.xyz&server_name=decentralised.cafe&server_name=kzhub.cc&server_name=yuri.im&server_name=shine.horse&server_name=craftlinux.ems.host&server_name=open-matrix.se&server_name=chat.kass.im&server_name=mozilla.org&server_name=matrix.krwh.io&server_name=p2pnode.org&server_name=www.wigger.one&server_name=imagisphe.re&server_name=netsoj.nl&server_name=matrix.knightrealm.us&server_name=matrix.byrdcrouse.com&server_name=ghostcorp.net&server_name=bngrs.net&server_name=plusultra.duckdns.org&server_name=matrix.hdhog.ru&server_name=matrix.pgbtech.com&server_name=matrix.tdstoragebay.com&server_name=matrix.vctor.me&server_name=envs.net&server_name=hsn.dev&server_name=lettuce.burggit.moe&server_name=shivering-isles.com&server_name=opaline.uk&server_name=veri.dev&server_name=astrr.ru&server_name=matrix.magadoux.fr&server_name=monero.social&server_name=matrix.artichokenetwork.com&server_name=matrix.devineemail.com&server_name=matrix.serpentnet.nl&server_name=rhamzeh.com&server_name=0ut0f.space&server_name=russ.network&server_name=matrix.casually.cat&server_name=fslhome.org&server_name=matrix.bbalm.me&server_name=matrix.flexinos.tech&server_name=0dmg.win&server_name=glittr.im&server_name=futa.catgirls.date&server_name=hackliberty.org&server_name=arcticfoxes.net&server_name=sierraromeo.miami&server_name=matrix.tab-e.de&server_name=n07070.xyz&server_name=boj4ck.com&server_name=e4xo.org&server_name=saintnet.tech&server_name=quailflux.com&server_name=matrix.teckids.org&server_name=matrix.rei.moe&server_name=rix.serkozh.me&server_name=chat.madiator.cloud&server_name=hrzn.tv&server_name=utwente.io&server_name=chat.lfx.linuxfoundation.org&server_name=matrix.intuinewin.dev&server_name=thecum.zone&server_name=millerhub.net&server_name=lunarsphere.net&server_name=pullopen.xyz&server_name=arclight.pro&server_name=waelwindows.duckdns.org&server_name=chat.dassystem.rocks&server_name=stephenson.systems&server_name=matrix.2xl.su&server_name=thesilentlink.org&server_name=pikaviestin.fi&server_name=rejowski.xyz&server_name=matrix.lonninator.net&server_name=one.ems.host&server_name=ordo-h.club&server_name=curtain.wtf&server_name=nope.chat&server_name=pynk.sh&server_name=nexy7574.co.uk&server_name=xmr.se&server_name=exani.me&server_name=siddharthagolu.com&server_name=downey.family&server_name=zand.dev&server_name=matrix.adrianmora.dev&server_name=matrix.rkowl.com&server_name=matrix.robindecker.me&server_name=cmkse.de&server_name=waffle.tech&server_name=nibbana.jp&server_name=matrix.possumlodge.me&server_name=massivebox.net&server_name=yatrix.org&server_name=matrix.pierre-couy.fr&server_name=nitro.chat&server_name=tomato.burggit.moe&server_name=matrix.mvpts.at&server_name=stow.live&server_name=matrix.neb.cx&server_name=mayeul.net&server_name=ofsg.eu&server_name=neomidgar.xyz&server_name=gogel.me&server_name=plsno.com&server_name=matrix.edvgarbe.de&server_name=matrix.nicksplace.io&server_name=zyner.org&server_name=cyan.gay&server_name=gish.gg&server_name=fedora.im&server_name=matrix.gaterealm.com&server_name=matrix.2gbcss.net&server_name=matrix.nbios.net&server_name=matrix.mrcsharp.dev&server_name=mtrx.fukt.lol&server_name=serifos.uk&server_name=hoho.nu&server_name=matrix.biggerontheinsi.de&server_name=weebvr.com&server_name=puffer.fish&server_name=eschbach.house&server_name=otsuka.haus&server_name=sigil.host&server_name=matrix.shardfall.co.uk&server_name=alkema.co&server_name=tiktalk.space&server_name=ausset.me&server_name=capsulecorp.dev&server_name=chat2.dassystem.rocks&server_name=shiz0ids.pro&server_name=pl.sb&server_name=jameskitt616.one&server_name=ingwie.io&server_name=that.host&server_name=hai.haus&server_name=vartiovaara.dy.fi&server_name=matrix.cuatrolibertades.org&server_name=genepicks.club&server_name=matrix.bozg.se&server_name=fedichat.cybik.moe&server_name=mjex.me&server_name=3bb.io&server_name=matrix.24mail.xyz&server_name=dgng.no&server_name=neurario.com&server_name=braed.co&server_name=hoppu.me&server_name=matrix.firehawk-systems.com&server_name=gotlandia.net&server_name=noleron.com&server_name=foss.wtf&server_name=kde.org&server_name=subr0sa.0j0.jp&server_name=matrix.petegregory.net&server_name=kitsunes.club&server_name=khorne.me&server_name=bonifacelabs.ca&server_name=zerojay.com&server_name=cracked-floppies.com&server_name=cirr.com&server_name=deepcore.dev&server_name=dendrite.codyrobibero.dev&server_name=chatting.jdysmcl.xyz&server_name=matrix.asso-fare.fr&server_name=matrix.weinbauer.heim-server.de&server_name=matrix.raitsc.uk&server_name=matrix.sysnet.in.net&server_name=mbree.xyz&server_name=m.dyox.in&server_name=national-security.agency&server_name=hamilton.ws&server_name=matrix.aviancarrier.de&server_name=kungfu-g.rip&server_name=cthompson.com&server_name=plxbx.eu&server_name=piracy.guide&server_name=jw6.us&server_name=boing.icu&server_name=s4k.nl&server_name=matrix.vgorcum.com&server_name=freeself.one&server_name=matrix.sussywebsite.xyz&server_name=kitsunet.info&server_name=chat.astafu.de&server_name=underzsea.com&server_name=tee.world&server_name=ait-younes.fr&server_name=chat.braed.co&server_name=lrss.dk&server_name=secroot.xyz&server_name=half-shot.uk&server_name=qoto.org&server_name=mx.m4fx.de&server_name=zorix.us&server_name=explodingpineapple.net&server_name=fopnu.pw&server_name=matrix.zxspectrummail.net&server_name=matrix.fregram.com&server_name=helveticastandard.com&server_name=mongle.me&server_name=cutelab.space&server_name=hansol.ca&server_name=aria-net.org&server_name=chmbr.in&server_name=taktpraha.cz&server_name=matrix.duck-pond.de&server_name=chrrreeeeesss.com&server_name=nulln0de.com&server_name=arbyon.com&server_name=lofitrek.com&server_name=nolex.io&server_name=axerr.dev&server_name=starritt.dev&server_name=ap0calypse.ninja&server_name=matrix.piperservers.net&server_name=matrix.interhop.org&server_name=matrix.bahnhof.cz&server_name=matrix.nahtway.xyz&server_name=chat.deepdive.gg&server_name=agdersam.no&server_name=refchat.net&server_name=cool110.xyz&server_name=matrix.based.zone&server_name=matrix.allismspeaks.org&server_name=poa.st&server_name=thelander.xyz&server_name=theonecurly.page&server_name=csc-rodgau.de&server_name=instly.im&server_name=iris.cmmoore.tech&server_name=matrix.ceti.se&server_name=nop.chat&server_name=fedibay.com&server_name=matthice.nl&server_name=sockermunk.se&server_name=senan.xyz&server_name=uqlel.ovh&server_name=kashofer.org&server_name=matrix.kjg-dossenheim.org&server_name=k-fortytwo.de&server_name=casually.cat&server_name=matrix.metachthonia.io&server_name=nakunga.com&server_name=neov.im&server_name=jmbz.dev&server_name=conduit.compuverse.uk&server_name=matrix.atikayda.link&server_name=onionsherpa.com&server_name=staeding.com&server_name=lukitomo.com&server_name=matrix.tu-berlin.de&server_name=rubyowo.me&server_name=craftingcomrades.net&server_name=katniss.top&server_name=cutefunny.art&server_name=matrix.connorsite.xyz&server_name=idonotknow.xyz&server_name=zumhebel.com&server_name=conduit.papy.azurael.ovh&server_name=deltaa.xyz&server_name=matrix.carelesslisper.xyz&server_name=soontm.de&server_name=berryez.xyz&server_name=m4tr1x.net&server_name=nahsi.dev&server_name=syntaxchat.net&server_name=moeken.eu&server_name=destrocodpiece.wtf&server_name=mingye.ch&server_name=stormcloaks.org&server_name=matrix.mengsk.org&server_name=littlevortex.net&server_name=broccoli.town&server_name=pfaff.dev&server_name=lifehacker.moe&server_name=setmyx.net&server_name=hayden.moe&server_name=tavo.one&server_name=hempton.us&server_name=shrimpcode.ml&server_name=ephemeralbridges.online&server_name=vanderpot.net&server_name=matrix.fallenbagel.com&server_name=infosec.exchange&server_name=squall.fdisk.io&server_name=coolmule0.com&server_name=pijean.ovh&server_name=matrix.raqnet.org&server_name=matrix.jklmnop.xyz&server_name=lolimbeer.com&server_name=icy.name&server_name=boehm.sh&server_name=matrix.anonion.social&server_name=pentago.nl&server_name=matrix.jparenas.com&server_name=matrix-dev.luebke.dev&server_name=matrix.kinsel-web.de&server_name=proxymana.net&server_name=zion.bitcoinalchemy.io&server_name=horton.ems.host&server_name=brodi.me&server_name=mtx.dark.cx&server_name=matrix.ashik.se&server_name=cloudforce.linkpc.net&server_name=matrix.obamium.net&server_name=fufu.foo&server_name=matrix.gabets.me&server_name=matrix.arcanedealer.com&server_name=matrix.tux.si&server_name=matrix.steken.xyz&server_name=snailsoft.dev&server_name=dark.cx&server_name=mawalabs.de&server_name=matrix.aroy-art.com&server_name=zoit.net&server_name=corestorage.co.uk&server_name=matrixapp.chat
HTTP/1.1 400 Bad Request
Date: Mon, 24 Jun 2024 06:05:43 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 898a871ba8f6989c-OTP

<html><body><h1>400 Bad request</h1>
Your browser sent an invalid request.
</body></html>