Merge fe6c97f498 into a6da9443da

changelogs/server_server/newsfragments/2284.clarification

@@ -1 +1 @@
-Specified input validation for PDUs passed to and returned from federation membership endpoints.
+Specified input validation for PDUs passed to federation membership endpoints.

content/server-server-api.md

@@ -868,10 +868,8 @@ selecting a resident from the candidate list, and using the
 enough information for the joining server to fill in the event.
 
 The joining server is expected to add or replace the `origin`,
-`origin_server_ts`, and `event_id` on the templated event received by the
-resident server. The joining server MUST also verify that the `type`, `room_id`,
-`sender`, `state_key` and `content.membership` fields have the expected values.
-This event is then signed by the joining server.
+`origin_server_ts`, and `event_id` on the templated event received by
+the resident server. This event is then signed by the joining server.
 
 To complete the join handshake, the joining server submits this new event
 to the resident server it used for `GET /make_join`, using the `PUT /send_join`

data/api/server-server/invites-v1.yaml

@@ -36,30 +36,6 @@ paths:
         Also note that if the remote homeserver is already in the room, it will receive the
         invite event twice; once through this endpoint, and again through a [federation
         transaction](/server-server-api/#transactions).
-
-        Servers MUST apply certain validation to ensure they don't accidentally sign non-invite
-        events from a malicious server. The `M_MISSING_PARAM` error code is used to indicate one
-        or more of the following:
-
-        * The invite event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
-        * The event type is not `m.room.member`.
-        * The `membership` field inside the event content is not `invite`.
-        * The event sender is not a user ID on the origin server.
-        * The `state_key` is not a user ID on the receiving server.
-
-        The `M_MISSING_PARAM` error code is also used to indicate one or more of the following
-        problems in the `invite_room_state` field:
-
-        * The `m.room.create` event is missing from `invite_room_state`.
-        * One or more entries in `invite_room_state` are not formatted according
-          to the room's version.
-        * One or more events fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
-        * One or more events does not reside in the same room as the invite.
-          Note: Some room versions may require calculating the room ID for an
-          event rather than relying on the presence of `room_id`.
-
-        Servers MAY apply the `invite_room_state` validation to room versions 1 through 11,
-        and SHOULD apply the validation to all other room versions.
       operationId: sendInviteV1
       security:
         - signedRequest: []
@@ -202,7 +178,34 @@ paths:
                   }
         "400":
           description: |-
-            The request is invalid in some way.
+            The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
+
+            * The invite event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
+            * The event type is not `m.room.member`.
+            * The `membership` field inside the event content is not `invite`.
+            * The event sender is not a user ID on the origin server.
+            * The `state_key` is not a user ID on the receiving server.
+
+            Servers MUST apply the validation above to the invite event before
+            signing it regardless of room version.
+
+            The `M_MISSING_PARAM` error code is used to indicate one or more of
+            the following:
+
+            * The `m.room.create` event is missing from `invite_room_state`.
+            * One or more entries in `invite_room_state` are not formatted according
+              to the room's version.
+            * One or more events fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
+            * One or more events does not reside in the same room as the invite.
+              Note: Some room versions may require calculating the room ID for an
+              event rather than relying on the presence of `room_id`.
+
+            Servers MAY apply the validation above to room versions 1 through 11,
+            and SHOULD apply the validation above to all other room versions.
+
+            If `M_MISSING_PARAM` or `M_INVALID_PARAM` is returned and the request
+            is associated with a Client-Server API request, the Client-Server API
+            request SHOULD fail with a 5xx error rather than being passed through.
           content:
             application/json:
               schema:

data/api/server-server/invites-v2.yaml

@@ -40,30 +40,6 @@ paths:
         Also note that if the remote homeserver is already in the room, it will receive the
         invite event twice; once through this endpoint, and again through a [federation
         transaction](/server-server-api/#transactions).
-
-        Servers MUST apply certain validation to ensure they don't accidentally sign non-invite
-        events from a malicious server. The `M_MISSING_PARAM` error code is used to indicate one
-        or more of the following:
-
-        * The invite event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
-        * The event type is not `m.room.member`.
-        * The `membership` field inside the event content is not `invite`.
-        * The event sender is not a user ID on the origin server.
-        * The `state_key` is not a user ID on the receiving server.
-
-        The `M_MISSING_PARAM` error code is also used to indicate one or more of the following
-        problems in the `invite_room_state` field:
-
-        * The `m.room.create` event is missing from `invite_room_state`.
-        * One or more entries in `invite_room_state` are not formatted according
-          to the room's version.
-        * One or more events fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
-        * One or more events does not reside in the same room as the invite.
-          Note: Some room versions may require calculating the room ID for an
-          event rather than relying on the presence of `room_id`.
-
-        Servers MAY apply the `invite_room_state` validation to room versions 1 through 11,
-        and SHOULD apply the validation to all other room versions.
       operationId: sendInviteV2
       security:
         - signedRequest: []
@@ -178,9 +154,34 @@ paths:
             The error should be passed through to clients so that they
             may give better feedback to users.
 
-            If `M_MISSING_PARAM` is returned and the request is associated with a
-            Client-Server API request, the Client-Server API request SHOULD fail
-            with a 5xx error rather than being passed through.
+            The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
+
+            * The invite event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
+            * The event type is not `m.room.member`.
+            * The `membership` field inside the event content is not `invite`.
+            * The event sender is not a user ID on the origin server.
+            * The `state_key` is not a user ID on the receiving server.
+
+            Servers MUST apply the validation above to the invite event before
+            signing it regardless of room version.
+
+            The `M_MISSING_PARAM` error code is used to indicate one or more of
+            the following:
+
+            * The `m.room.create` event is missing from `invite_room_state`.
+            * One or more entries in `invite_room_state` are not formatted according
+              to the room's version.
+            * One or more events fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
+            * One or more events does not reside in the same room as the invite.
+              Note: Some room versions may require calculating the room ID for an
+              event rather than relying on the presence of `room_id`.
+
+            Servers MAY apply the validation above to room versions 1 through 11,
+            and SHOULD apply the validation above to all other room versions.
+
+            If `M_MISSING_PARAM` or `M_INVALID_PARAM` is returned and the request
+            is associated with a Client-Server API request, the Client-Server API
+            request SHOULD fail with a 5xx error rather than being passed through.
           content:
             application/json:
               schema:

data/api/server-server/joins-v1.yaml

@@ -23,17 +23,6 @@ paths:
       description: |-
         Asks the receiving server to return information that the sending
         server will need to prepare a join event to get into the room.
-
-        Before signing the returned template and calling `/send_join`,
-        the sending server MUST verify that:
-
-        * the `room_id` is equal to the `roomId` path parameter.
-        * both the `sender` and `state_key` are equal to the `userId` path parameter.
-        * the `type` of the event is `m.room.member`.
-        * the `membership` field inside `content` is `join`.
-
-        In case any of the above checks fail, the response MUST be treated as malformed and
-        discarded. The caller MAY try to join through another server.
       operationId: makeJoin
       security:
         - signedRequest: []
@@ -249,15 +238,6 @@ paths:
         **The request and response body here describe the common
         event fields in more detail and may be missing other required
         fields for a PDU.**
-
-        The receiving server MUST apply certain validation before accepting the event.
-        The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
-
-        * The join event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
-        * The event type is not `m.room.member`.
-        * The `membership` field inside the event content is not `join`.
-        * The event sender is not a user ID on the origin server.
-        * The `state_key` is not equal to the `sender`.
       operationId: sendJoinV1
       security:
         - signedRequest: []
@@ -411,6 +391,16 @@ paths:
         "400":
           description: |-
             The request is invalid in some way.
+
+            The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
+
+            * The join event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
+            * The event type is not `m.room.member`.
+            * The `membership` field inside the event content is not `join`.
+            * The event sender is not a user ID on the origin server.
+            * The `state_key` is not equal to the `sender`.
+
+            Servers MUST apply the validation above to the join event.
           content:
             application/json:
               schema:

data/api/server-server/joins-v2.yaml

@@ -38,15 +38,6 @@ paths:
         **The request and response body here describe the common
         event fields in more detail and may be missing other required
         fields for a PDU.**
-
-        The receiving server MUST apply certain validation before accepting the event.
-        The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
-
-        * The join event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
-        * The event type is not `m.room.member`.
-        * The `membership` field inside the event content is not `join`.
-        * The event sender is not a user ID on the origin server.
-        * The `state_key` is not equal to the `sender`.
       operationId: sendJoinV2
       security:
         - signedRequest: []
@@ -256,9 +247,15 @@ paths:
             The error should be passed through to clients so that they
             may give better feedback to users.
 
-            If `M_MISSING_PARAM` is returned and the request is associated with a
-            Client-Server API request, the Client-Server API request SHOULD fail
-            with a 5xx error rather than being passed through.
+            The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
+
+            * The join event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
+            * The event type is not `m.room.member`.
+            * The `membership` field inside the event content is not `join`.
+            * The event sender is not a user ID on the origin server.
+            * The `state_key` is not equal to the `sender`.
+
+            Servers MUST apply the validation above to the join event.
 
             New in `v1.2`, the following error conditions might happen:
 

data/api/server-server/knocks.yaml

@@ -23,17 +23,6 @@ paths:
       description: |-
         Asks the receiving server to return information that the sending
         server will need to prepare a knock event for the room.
-
-        Before signing the returned template and calling `/send_knock`,
-        the sending server MUST verify that:
-
-        * the `room_id` is equal to the `roomId` path parameter.
-        * both the `sender` and `state_key` are equal to the `userId` path parameter.
-        * the `type` of the event is `m.room.member`.
-        * the `membership` field inside `content` is `knock`.
-
-        In case any of the above checks fail, the response MUST be treated as malformed and
-        discarded. The caller MAY try to knock through another server.
       operationId: makeKnock
       security:
         - signedRequest: []
@@ -215,15 +204,6 @@ paths:
         **The request and response body here describe the common
         event fields in more detail and may be missing other required
         fields for a PDU.**
-
-        The receiving server MUST apply certain validation before accepting the event.
-        The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
-
-        * The knock event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
-        * The event type is not `m.room.member`.
-        * The `membership` field inside the event content is not `knock`.
-        * The event sender is not a user ID on the origin server.
-        * The `state_key` is not equal to the `sender`.
       operationId: sendKnock
       security:
         - signedRequest: []
@@ -352,7 +332,15 @@ paths:
                   }
         "400":
           description: |-
-            The request is invalid in some way.
+            The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
+
+            * The knock event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
+            * The event type is not `m.room.member`.
+            * The `membership` field inside the event content is not `knock`.
+            * The event sender is not a user ID on the origin server.
+            * The `state_key` is not equal to the `sender`.
+
+            Servers MUST apply the validation above to the knock event.
           content:
             application/json:
               schema:

data/api/server-server/leaving-v1.yaml

@@ -23,17 +23,6 @@ paths:
       description: |-
         Asks the receiving server to return information that the sending
         server will need to prepare a leave event to get out of the room.
-
-        Before signing the returned template and calling `/send_leave`,
-        the sending server MUST verify that:
-
-        * the `room_id` is equal to the `roomId` path parameter.
-        * both the `sender` and `state_key` are equal to the `userId` path parameter.
-        * the `type` of the event is `m.room.member`.
-        * the `membership` field inside `content` is `leave`.
-
-        In case any of the above checks fail, the response MUST be treated as malformed and
-        discarded. The caller MAY try to leave through another server.
       operationId: makeLeave
       security:
         - signedRequest: []
@@ -164,15 +153,6 @@ paths:
         **The request and response body here describe the common
         event fields in more detail and may be missing other required
         fields for a PDU.**
-
-        The receiving server MUST apply certain validation before accepting the event.
-        The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
-
-        * The leave event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
-        * The event type is not `m.room.member`.
-        * The `membership` field inside the event content is not `leave`.
-        * The event sender is not a user ID on the origin server.
-        * The `state_key` is not equal to the `sender`.
       operationId: sendLeaveV1
       security:
         - signedRequest: []
@@ -271,7 +251,15 @@ paths:
                   ]
         "400":
           description: |-
-            The request is invalid in some way.
+            The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
+
+            * The leave event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
+            * The event type is not `m.room.member`.
+            * The `membership` field inside the event content is not `leave`.
+            * The event sender is not a user ID on the origin server.
+            * The `state_key` is not equal to the `sender`.
+
+            Servers MUST apply the validation above to the leave event.
           content:
             application/json:
               schema:

data/api/server-server/leaving-v2.yaml

@@ -38,15 +38,6 @@ paths:
         **The request and response body here describe the common
         event fields in more detail and may be missing other required
         fields for a PDU.**
-
-        The receiving server MUST apply certain validation before accepting the event.
-        The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
-
-        * The leave event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
-        * The event type is not `m.room.member`.
-        * The `membership` field inside the event content is not `leave`.
-        * The event sender is not a user ID on the origin server.
-        * The `state_key` is not equal to the `sender`.
       operationId: sendLeaveV2
       security:
         - signedRequest: []
@@ -145,7 +136,15 @@ paths:
                   value: {}
         "400":
           description: |-
-            The request is invalid in some way.
+            The `M_INVALID_PARAM` error code is used to indicate one or more of the following:
+
+            * The leave event fails a [signature check](/server-server-api/#validating-hashes-and-signatures-on-received-events).
+            * The event type is not `m.room.member`.
+            * The `membership` field inside the event content is not `leave`.
+            * The event sender is not a user ID on the origin server.
+            * The `state_key` is not equal to the `sender`.
+
+            Servers MUST apply the validation above to the leave event.
           content:
             application/json:
               schema: