Filip/matrix-spec
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-spec synced 2025-12-30 12:38:38 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Federation requests must be for local users. (#1672)

Browse source 
This is already mentioned for /user/devices, but is not mentioned for /query/profile, /user/keys/claim, or /user/keys/query.

See GHSA-mp92-3jfm-3575 for an issue found with this in Synapse.
This commit is contained in:
Patrick Cloke 2023-11-14 11:15:57 -05:00 committed by GitHub
parent 7b72c42ba6
commit 161a4a2cfb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelogs/server_server/newsfragments/1672.clarification Normal file
View file

@ -0,0 +1 @@
Clarify that federation requests for non-local users are invalid.

2
data/api/server-server/query.yaml
View file

@ -121,7 +121,7 @@ paths:
parameters: parameters:
- in: query - in: query
name: user_id name: user_id
description: The user ID to query. description: The user ID to query. Must be a user local to the receiving homeserver.
required: true required: true
example: "@someone:example.org" example: "@someone:example.org"
schema: schema:

6
data/api/server-server/user_keys.yaml
View file

@ -34,7 +34,8 @@ paths:
type: object type: object
description: |- description: |-
The keys to be claimed. A map from user ID, to a map from The keys to be claimed. A map from user ID, to a map from
device ID to algorithm name. device ID to algorithm name. Requested users must be local
to the receiving homeserver.
additionalProperties: additionalProperties:
type: object type: object
additionalProperties: additionalProperties:
@ -121,7 +122,8 @@ paths:
description: |- description: |-
The keys to be downloaded. A map from user ID, to a list of The keys to be downloaded. A map from user ID, to a list of
device IDs, or to an empty list to indicate all devices for the device IDs, or to an empty list to indicate all devices for the
corresponding user. corresponding user. Requested users must be local to the
receiving homeserver.
additionalProperties: additionalProperties:
type: array type: array
items: items: