Failed to set avatar due to Synapse restriction

I know that #785 describes a similar issue, but I assume the issue owner somehow resolved their problem, and I have more details, so I'm opening a new issue.

I'm deploying the mautrix-telegram bridge today, and found that Synapse refuses to let it set the default avatar link:

[2023-02-19 18:35:35,353] [DEBUG@mau.as.api.bot] req #7: PUT http://127.0.0.1:8008/_matrix/client/v3/profile/%40telegrambot%3A[REDACTED]/avatar_url?user_id=@telegrambot:[REDACTED] {"avatar_url": "mxc://maunium.net/tJCRmUyJDsgRNgqhOgoiHWbX"}
[2023-02-19 18:35:35,360] [DEBUG@mau.as.api.bot] req #7 (/v3/profile/%40telegrambot%3A[REDACTED]/avatar_url) completed in 6.5ms with status 403
[2023-02-19 18:35:35,360] [ERROR@mau.mx] Failed to set bot avatar
Traceback (most recent call last):
  File "/opt/mautrix-telegram/app/lib/python3.10/site-packages/mautrix/bridge/matrix.py", line 268, in init_as_bot
    await self.az.intent.set_avatar_url(avatar if avatar != "remove" else "")
  File "/opt/mautrix-telegram/app/lib/python3.10/site-packages/mautrix/appservice/api/intent.py", line 127, in wrapper
    return await __method(*args, **kwargs)
  File "/opt/mautrix-telegram/app/lib/python3.10/site-packages/mautrix/client/api/user_data.py", line 125, in set_avatar_url
    await self.api.request(
  File "/opt/mautrix-telegram/app/lib/python3.10/site-packages/mautrix/api.py", line 401, in request
    resp_data, resp = await self._send(
  File "/opt/mautrix-telegram/app/lib/python3.10/site-packages/mautrix/api.py", line 256, in _send
    raise make_request_error(

Looking at the Synapse homeserver.log at the same time, I found that Synapse rejects the mxn:// URL that mautrix-telegram gave it:

2023-02-19 18:35:35,358 - synapse.handlers.profile - 328 - WARNING - PUT-16 - Forbidding avatar change to mxc://maunium.net/tJCRmUyJDsgRNgqhOgoiHWbX: avatar not on server
2023-02-19 18:35:35,358 - synapse.http.server - 108 - INFO - PUT-16 - <XForwardedForRequest at 0x7f1f4ae1df60 method='PUT' uri='/_matrix/client/v3/profile/%40telegrambot%3A[REDACTED]/avatar_url?user_id=@telegrambot:[REDACTED]' clientproto='HTTP/1.1' site='8008'> SynapseError: 403 - This avatar is not allowed
2023-02-19 18:35:35,359 - synapse.access.http.8008 - 460 - INFO - PUT-16 - 127.0.0.1 - 8008 - {@telegrambot:[REDACTED]} Processed request: 0.004sec/0.000sec (0.003sec, 0.000sec) (0.000sec/0.002sec/2) 62B 403 "PUT /_matrix/client/v3/profile/%40telegrambot%3A[REDACTED]/avatar_url?user_id=@telegrambot:[REDACTED] HTTP/1.1" "mautrix-telegram/0.12.2 mautrix-python/0.18.9 aiohttp/3.8.4 Python/3.10.10" [0 dbevts]

I then read Synapse's code, and found that it requires that the image is local or at least cached, and makes no attempt to download it remotely.

The current workaround for admins is to upload some image to the media repository and use that in mautrix-telegram.

mautrix / telegram

Failed to set avatar due to Synapse restriction #895