Filip/matrix-spec
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-spec synced 2026-03-13 06:54:10 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

The server-name segment of MXC URIs is sanitised differently from the media-id segment

Browse source 
Fixes: #1990
Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>
This commit is contained in:
Johannes Marbach 2025-09-26 14:50:45 +02:00
parent 21109b4d5b
commit 02c1aba233
2 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelogs/client_server/newsfragments/2217.clarification Normal file
View file

@ -0,0 +1 @@
The `server-name` segment of MXC URIs is sanitised differently from the `media-id` segment.

11
content/client-server-api/modules/content_repo.md
View file

@ -134,9 +134,14 @@ entity isn't in the room.
`mxc://` URIs are vulnerable to directory traversal attacks such as `mxc://` URIs are vulnerable to directory traversal attacks such as
`mxc://127.0.0.1/../../../some_service/etc/passwd`. This would cause the `mxc://127.0.0.1/../../../some_service/etc/passwd`. This would cause the
target homeserver to try to access and return this file. As such, target homeserver to try to access and return this file. As such,
homeservers MUST sanitise `mxc://` URIs by allowing only alphanumeric homeservers MUST sanitise `mxc://` URIs by:
(`A-Za-z0-9`), `_` and `-` characters in the `server-name` and
`media-id` values. This set of whitelisted characters allows URL-safe - restricting the `server-name` segment to valid
[server names](/appendices/#server-name)
- allowing only alphanumeric (`A-Za-z0-9`), `_` and `-` characters in
the `media-id` segment
The resulting set of whitelisted characters allows URL-safe
base64 encodings specified in RFC 4648. Applying this character base64 encodings specified in RFC 4648. Applying this character
whitelist is preferable to blacklisting `.` and `/` as there are whitelist is preferable to blacklisting `.` and `/` as there are
techniques around blacklisted characters (percent-encoded characters, techniques around blacklisted characters (percent-encoded characters,