search

matrix-org / matrix-spec

The Matrix protocol specification
Apache License 2.0
197 stars 97 forks source link

C-S API MXC Security Consideration pretty much all MXCs are invalid #1990

Open t3chguy opened 2 weeks ago

t3chguy commented 2 weeks ago

Link to problem area:

https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5

Issue

It states

As such, homeservers MUST sanitise mxc:// URIs by allowing only alphanumeric (A-Za-z0-9), _ and - characters in the server-name and media-id values.

Given that server-name the vast majority of the time is a qualified domain with a TLD, the .tld would make it invalid. Ports, IPv4 and IPv6 addresses would also be invalid. It should be updated such that the grammar only applies to the media-id segment, and server-name should refer to https://spec.matrix.org/v1.12/appendices/#server-name for valid grammar.