From 8de99a305bbed84d120f20fae454585872fbe5a3 Mon Sep 17 00:00:00 2001 From: Pavel Turinsky Date: Sat, 17 Oct 2020 11:33:22 +0200 Subject: [PATCH 1/5] Check status codes that profile handler returns fixes #8520 Signed-off-by: Pavel Turinsky --- synapse/handlers/profile.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/synapse/handlers/profile.py b/synapse/handlers/profile.py index b78493875522..2525cd51de5d 100644 --- a/synapse/handlers/profile.py +++ b/synapse/handlers/profile.py @@ -89,6 +89,14 @@ async def get_profile(self, user_id): except RequestSendFailed as e: raise SynapseError(502, "Failed to fetch profile") from e except HttpResponseException as e: + if e.code < 500 and e.code != 404: + # Other codes are not allowed in c2s API + logger.error( + "Server replied with wrong response: %s %s", str(e.code), e.msg + ) + # Change to 500 not to confuse clients + e.code = 500 + e.msg = "Remote server replied: {} {}".format(str(e.code), e.msg) raise e.to_synapse_error() async def get_profile_from_cache(self, user_id): From 4865c708367c6696a01098c0caa0f6b8c25b7932 Mon Sep 17 00:00:00 2001 From: Pavel Turinsky Date: Sat, 17 Oct 2020 12:44:12 +0200 Subject: [PATCH 2/5] Add changelog record --- changelog.d/8580.bugfix | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelog.d/8580.bugfix diff --git a/changelog.d/8580.bugfix b/changelog.d/8580.bugfix new file mode 100644 index 000000000000..31734fd97d71 --- /dev/null +++ b/changelog.d/8580.bugfix @@ -0,0 +1 @@ +Fix a bug where Synapse would blindly forward bad responses from federation to clients when retrieving profile information. From ed12369b12a8fbb5c86fcf726bcc2b71137a165b Mon Sep 17 00:00:00 2001 From: Pavel Turinsky Date: Sun, 18 Oct 2020 13:38:26 +0200 Subject: [PATCH 3/5] Remove useless conversions to str --- synapse/handlers/profile.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/synapse/handlers/profile.py b/synapse/handlers/profile.py index 2525cd51de5d..4b87097d400f 100644 --- a/synapse/handlers/profile.py +++ b/synapse/handlers/profile.py @@ -92,11 +92,11 @@ async def get_profile(self, user_id): if e.code < 500 and e.code != 404: # Other codes are not allowed in c2s API logger.error( - "Server replied with wrong response: %s %s", str(e.code), e.msg + "Server replied with wrong response: %s %s", e.code, e.msg ) # Change to 500 not to confuse clients e.code = 500 - e.msg = "Remote server replied: {} {}".format(str(e.code), e.msg) + e.msg = "Remote server replied: {} {}".format(e.code, e.msg) raise e.to_synapse_error() async def get_profile_from_cache(self, user_id): From 629eb6b43387f62fd506af9cfe3b8b6d93ea3905 Mon Sep 17 00:00:00 2001 From: LEdoian Date: Thu, 22 Oct 2020 20:47:24 +0200 Subject: [PATCH 4/5] Create new exception on failure, fix logging Co-authored-by: Erik Johnston --- synapse/handlers/profile.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/synapse/handlers/profile.py b/synapse/handlers/profile.py index 4b87097d400f..2683b9b2f22d 100644 --- a/synapse/handlers/profile.py +++ b/synapse/handlers/profile.py @@ -91,12 +91,11 @@ async def get_profile(self, user_id): except HttpResponseException as e: if e.code < 500 and e.code != 404: # Other codes are not allowed in c2s API - logger.error( + logger.info( "Server replied with wrong response: %s %s", e.code, e.msg ) - # Change to 500 not to confuse clients - e.code = 500 - e.msg = "Remote server replied: {} {}".format(e.code, e.msg) + + raise SynapseError(502, "Failed to fetch profile") raise e.to_synapse_error() async def get_profile_from_cache(self, user_id): From 72a6b497572aa1d165192b4334185a4747dcf084 Mon Sep 17 00:00:00 2001 From: Pavel Turinsky Date: Thu, 22 Oct 2020 23:00:00 +0200 Subject: [PATCH 5/5] Fix style --- synapse/handlers/profile.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/synapse/handlers/profile.py b/synapse/handlers/profile.py index 2683b9b2f22d..13772e64ce0f 100644 --- a/synapse/handlers/profile.py +++ b/synapse/handlers/profile.py @@ -94,7 +94,7 @@ async def get_profile(self, user_id): logger.info( "Server replied with wrong response: %s %s", e.code, e.msg ) - + raise SynapseError(502, "Failed to fetch profile") raise e.to_synapse_error()