Codebase list matrix-synapse / cdbe14e
New upstream version 1.61.1 Andrej Shadura 1 year, 10 months ago
5 changed file(s) with 86 addition(s) and 27 deletion(s). Raw diff Collapse all Expand all
+22
-1
CHANGES.md less more
0 Synapse 1.61.1 (2022-06-28)
1 ===========================
2
3 This patch release fixes a security issue regarding URL previews, affecting all prior versions of Synapse. Server administrators are encouraged to update Synapse as soon as possible. We are not aware of these vulnerabilities being exploited in the wild.
4
5 Server administrators who are unable to update Synapse may use the workarounds described in the linked GitHub Security Advisory below.
6
7 ## Security advisory
8
9 The following issue is fixed in 1.61.1.
10
11 * [GHSA-22p3-qrh9-cx32](https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx32) / [CVE-2022-31052](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31052)
12
13 Synapse instances with the [`url_preview_enabled`](https://matrix-org.github.io/synapse/v1.61/usage/configuration/config_documentation.html#media-store) homeserver config option set to `true` are affected. URL previews of some web pages can lead to unbounded recursion, causing the request to either fail, or in some cases crash the running Synapse process.
14
15 Requesting URL previews requires authentication. Nevertheless, it is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for.
16
17 Homeservers with the `url_preview_enabled` configuration option set to `false` (the default) are unaffected. Instances with the `enable_media_repo` configuration option set to `false` are also unaffected, as this also disables URL preview functionality.
18
19 Fixed by [fa1308061802ac7b7d20e954ba7372c5ac292333](https://github.com/matrix-org/synapse/commit/fa1308061802ac7b7d20e954ba7372c5ac292333).
20
021 Synapse 1.61.0 (2022-06-14)
122 ===========================
223
829 Improved Documentation
930 ----------------------
1031
11 - Mention removed community/group worker endpoints in [upgrade.md](https://github.com/matrix-org/synapse/blob/develop/docs/upgrade.md#upgrading-to-v1610s). Contributed by @olmari. ([\#13023](https://github.com/matrix-org/synapse/issues/13023))
32 - Mention removed community/group worker endpoints in [the upgrade notes](https://github.com/matrix-org/synapse/blob/develop/docs/upgrade.md#upgrading-to-v1610). Contributed by @olmari. ([\#13023](https://github.com/matrix-org/synapse/issues/13023))
1233
1334
1435 Synapse 1.61.0rc1 (2022-06-07)
+6
-0
debian/changelog less more
0 matrix-synapse-py3 (1.61.1) stable; urgency=medium
1
2 * New Synapse release 1.61.1.
3
4 -- Synapse Packaging team <packages@matrix.org> Tue, 28 Jun 2022 14:33:46 +0100
5
06 matrix-synapse-py3 (1.61.0) stable; urgency=medium
17
28 * New Synapse release 1.61.0.
+1
-1
pyproject.toml less more
5353
5454 [tool.poetry]
5555 name = "matrix-synapse"
56 version = "1.61.0"
56 version = "1.61.1"
5757 description = "Homeserver for the Matrix decentralised comms protocol"
5858 authors = ["Matrix.org Team and Contributors <packages@matrix.org>"]
5959 license = "Apache-2.0"
+40
-25
synapse/rest/media/v1/preview_html.py less more
1111 # See the License for the specific language governing permissions and
1212 # limitations under the License.
1313 import codecs
14 import itertools
1514 import logging
1615 import re
17 from typing import TYPE_CHECKING, Dict, Generator, Iterable, Optional, Set, Union
16 from typing import TYPE_CHECKING, Dict, Generator, Iterable, List, Optional, Set, Union
1817
1918 if TYPE_CHECKING:
2019 from lxml import etree
275274
276275 from lxml import etree
277276
278 TAGS_TO_REMOVE = (
277 TAGS_TO_REMOVE = {
279278 "header",
280279 "nav",
281280 "aside",
290289 "img",
291290 "picture",
292291 etree.Comment,
293 )
292 }
294293
295294 # Split all the text nodes into paragraphs (by splitting on new
296295 # lines)
297296 text_nodes = (
298297 re.sub(r"\s+", "\n", el).strip()
299 for el in _iterate_over_text(tree.find("body"), *TAGS_TO_REMOVE)
298 for el in _iterate_over_text(tree.find("body"), TAGS_TO_REMOVE)
300299 )
301300 return summarize_paragraphs(text_nodes)
302301
303302
304303 def _iterate_over_text(
305 tree: "etree.Element", *tags_to_ignore: Union[str, "etree.Comment"]
304 tree: Optional["etree.Element"],
305 tags_to_ignore: Set[Union[str, "etree.Comment"]],
306 stack_limit: int = 1024,
306307 ) -> Generator[str, None, None]:
307308 """Iterate over the tree returning text nodes in a depth first fashion,
308309 skipping text nodes inside certain tags.
309 """
310 # This is basically a stack that we extend using itertools.chain.
311 # This will either consist of an element to iterate over *or* a string
310
311 Args:
312 tree: The parent element to iterate. Can be None if there isn't one.
313 tags_to_ignore: Set of tags to ignore
314 stack_limit: Maximum stack size limit for depth-first traversal.
315 Nodes will be dropped if this limit is hit, which may truncate the
316 textual result.
317 Intended to limit the maximum working memory when generating a preview.
318 """
319
320 if tree is None:
321 return
322
323 # This is a stack whose items are elements to iterate over *or* strings
312324 # to be returned.
313 elements = iter([tree])
314 while True:
315 el = next(elements, None)
316 if el is None:
317 return
325 elements: List[Union[str, "etree.Element"]] = [tree]
326 while elements:
327 el = elements.pop()
318328
319329 if isinstance(el, str):
320330 yield el
328338 if el.text:
329339 yield el.text
330340
331 # We add to the stack all the elements children, interspersed with
332 # each child's tail text (if it exists). The tail text of a node
333 # is text that comes *after* the node, so we always include it even
334 # if we ignore the child node.
335 elements = itertools.chain(
336 itertools.chain.from_iterable( # Basically a flatmap
337 [child, child.tail] if child.tail else [child]
338 for child in el.iterchildren()
339 ),
340 elements,
341 )
341 # We add to the stack all the element's children, interspersed with
342 # each child's tail text (if it exists).
343 #
344 # We iterate in reverse order so that earlier pieces of text appear
345 # closer to the top of the stack.
346 for child in el.iterchildren(reversed=True):
347 if len(elements) > stack_limit:
348 # We've hit our limit for working memory
349 break
350
351 if child.tail:
352 # The tail text of a node is text that comes *after* the node,
353 # so we always include it even if we ignore the child node.
354 elements.append(child.tail)
355
356 elements.append(child)
342357
343358
344359 def summarize_paragraphs(
+17
-0
tests/rest/media/v1/test_html_preview.py less more
369369 og = parse_html_to_open_graph(tree)
370370 self.assertEqual(og, {"og:title": "รณ", "og:description": "Some text."})
371371
372 def test_nested_nodes(self) -> None:
373 """A body with some nested nodes. Tests that we iterate over children
374 in the right order (and don't reverse the order of the text)."""
375 html = b"""
376 <a href="somewhere">Welcome <b>the bold <u>and underlined text <svg>
377 with a cheeky SVG</svg></u> and <strong>some</strong> tail text</b></a>
378 """
379 tree = decode_body(html, "http://example.com/test.html")
380 og = parse_html_to_open_graph(tree)
381 self.assertEqual(
382 og,
383 {
384 "og:title": None,
385 "og:description": "Welcome\n\nthe bold\n\nand underlined text\n\nand\n\nsome\n\ntail text",
386 },
387 )
388
372389
373390 class MediaEncodingTestCase(unittest.TestCase):
374391 def test_meta_charset(self) -> None: