Filip/matrix-spec
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-spec synced 2026-03-12 22:44:09 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

The server-name segment of MXC URIs is sanitised differently from the media-id segment

Browse source 
Fixes: #1990
Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>
This commit is contained in:
Johannes Marbach 2025-09-26 14:50:45 +02:00
parent 21109b4d5b
commit 02c1aba233
2 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelogs/client_server/newsfragments/2217.clarification Normal file
View file

@ -0,0 +1 @@
The `server-name` segment of MXC URIs is sanitised differently from the `media-id` segment.

11
content/client-server-api/modules/content_repo.md
View file

@ -134,9 +134,14 @@ entity isn't in the room.
`mxc://` URIs are vulnerable to directory traversal attacks such as
`mxc://127.0.0.1/../../../some_service/etc/passwd`. This would cause the
target homeserver to try to access and return this file. As such,
homeservers MUST sanitise `mxc://` URIs by allowing only alphanumeric
(`A-Za-z0-9`), `_` and `-` characters in the `server-name` and
`media-id` values. This set of whitelisted characters allows URL-safe
homeservers MUST sanitise `mxc://` URIs by:
- restricting the `server-name` segment to valid
[server names](/appendices/#server-name)
- allowing only alphanumeric (`A-Za-z0-9`), `_` and `-` characters in
the `media-id` segment
The resulting set of whitelisted characters allows URL-safe
base64 encodings specified in RFC 4648. Applying this character
whitelist is preferable to blacklisting `.` and `/` as there are
techniques around blacklisted characters (percent-encoded characters,