Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

/directory/room leaks all involved homeservers #17298

Open
stefanceriu opened this issue Jun 12, 2024 · 2 comments
Open

/directory/room leaks all involved homeservers #17298

stefanceriu opened this issue Jun 12, 2024 · 2 comments

Comments

@stefanceriu
Copy link
Member

Description

  1. Try resolving an alias e.g. https://matrix-client.matrix.org/_matrix/client/v3/directory/room/%23jellyfinorg:matrix.org
  2. Get back 348 servers which presumably is all of them.
  3. Profit?

This is not only a privacy concern but also wasteful. If the client tries to use them to join the room it will fail and the client can't trim the list because no ordering is specified.

(joining jellyfin fails in this case with <html><body><h1>400 Bad request</h1>\nYour browser sent an invalid request.\n</body></html>\n, which is probably another problem in itself)

Steps to reproduce

Access https://matrix-client.matrix.org/_matrix/client/v3/directory/room/%23jellyfinorg:matrix.org

Homeserver

matrix.org

Synapse Version

server_version: "1.109.0rc1 (b=matrix-org-hotfixes,40975b3098,dirty)"

Installation Method

Other (please mention below)

Database

Workers

Single process

Platform

Configuration

Relevant log output

-

Anything else that would be useful to know?
@devonh
Copy link
Member

devonh commented Jun 21, 2024

Hmm. The response being returned is as per the spec: https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv3directoryroomroomalias
If you think the spec should be changed, I would suggest writing an MSC to do so.

As for being able to join the room (space) using the resolved alias from that request, I tried joining the space you mentioned with the room ID returned (!pvOfSyfiUOIEBrZDWF:matrix.org) using element desktop and it worked without issue.

@stefanceriu
Copy link
Member Author

I wasn't suggesting synapse isn't respecting the spec. The spec doesn't mention the maximum number of servers to return or their ordering (one way or another) so I'm trying to acertaing if this is inentional, a mistake, a miss or something else. If you agree that this is indeed a problem I can go ahead and write the MSC

As for joining, I don't know what Element Web is doing but the plain request is always failing for me, see

the details

https://matrix-client.matrix.org/_matrix/client/v3/join/!NaLbfexyNIBQDbzGwB:bonifacelabs.ca?server_name=matrix.org&server_name=gianmarco.gg&server_name=matrix.unbl.ink&server_name=stukamanhpt4.com&server_name=wepa.gspot.lol&server_name=im.jellyfin.org&server_name=arm0.red&server_name=lermer.nl&server_name=chat.knightrealm.us&server_name=matrix.wiley.pub&server_name=robibe.ro&server_name=converser.eu&server_name=doshitan.com&server_name=sakura.ci&server_name=wasscher.com&server_name=janky.solutions&server_name=beeper.com&server_name=4d2.org&server_name=am.subby.pet&server_name=jpxs.io&server_name=matrix.lhax.xyz&server_name=memes.nz&server_name=darkskiez.co.uk&server_name=tasistro-hart.com&server_name=naoh.host&server_name=ohai.is&server_name=ma.ozx.me&server_name=private.coffee&server_name=based.center&server_name=vogel.xyz&server_name=fablab-bruchsal.de&server_name=matrix.zakariao.nl&server_name=christian-martins.fr&server_name=chat.generallyrubbish.net&server_name=rethelyi.space&server_name=matrix.besaid.de&server_name=tux.pizza&server_name=slothlife.ems.host&server_name=matrix.vanten-s.com&server_name=opensuse.org&server_name=rob.land&server_name=matrix.cheemsbread.xyz&server_name=matrix.lokiberra.cf&server_name=minds.com&server_name=auengun.net&server_name=gcaillaut.fr&server_name=matrix.zaggy.nl&server_name=hacked.place&server_name=everskold.com&server_name=matrix.vasbud.fun&server_name=bombed.dev&server_name=avery.ems.host&server_name=tedomum.net&server_name=bpulse.org&server_name=revreso.de&server_name=matrix.decwebb.com&server_name=breeze.town&server_name=chat.threepulse.com&server_name=flexinos.tech&server_name=decadesdrive.com&server_name=wesser.ems.host&server_name=screspo.me&server_name=seizure.icu&server_name=feline.support&server_name=shennarwp.com&server_name=lat3st.de&server_name=chat.olomorn.xyz&server_name=danbulant.cz&server_name=matrix.hermherm.org&server_name=chronoti.me&server_name=liber.li&server_name=im.m4fx.de&server_name=system1337.com&server_name=colorlesscube.com&server_name=matrix.klugmathias.me&server_name=flip.earth&server_name=ristein.de&server_name=sal.web.tr&server_name=vampdev.com&server_name=libresolutions.network&server_name=librecave.com&server_name=tetaneutral.net&server_name=cody.to&server_name=mtrx.nz&server_name=yharnam.city&server_name=mx.badnick.name&server_name=aguiarvieira.pt&server_name=hadesmonsta.de&server_name=linuxdelta.com&server_name=matrix.cookie559.lol&server_name=pynk.dev&server_name=zutto.fi&server_name=nexions.net&server_name=robbinsa.me&server_name=herrmann.dev&server_name=spacecadet.info&server_name=matrix.iofel.me&server_name=xd.cm&server_name=matrix.cubable.date&server_name=interslice.chat&server_name=chat.ie9.org&server_name=squirrellydave.net&server_name=simatime.com&server_name=jn.hn&server_name=toppoint.de&server_name=matrix.bngtzn.se&server_name=thebeanbakery.xyz&server_name=secureim.de&server_name=synapse.binarydad.com&server_name=matrix.thedisco.zone&server_name=matrix.gresille.org&server_name=noagenda.chat&server_name=matrix.borgcube.de&server_name=zibbp.net&server_name=popicraft.net&server_name=luebke.dev&server_name=shanetrs.ddns.net&server_name=matrix.iwolfking.xyz&server_name=oneplace.link&server_name=zachs.online&server_name=rany.eu.org&server_name=matrix.ericrao.icu&server_name=glasgow.social&server_name=nerdsin.space&server_name=chat.caino.dev&server_name=imihov.com&server_name=matrix.lambspork.ca&server_name=synapse.lif.ovh%3A443&server_name=liberta.casa&server_name=ccamtech.com&server_name=libertas.chat&server_name=stardrifter.net&server_name=possumlodge.me&server_name=ramondia.net&server_name=node2.tech&server_name=solver.red&server_name=yterhor.st&server_name=matrix.mebitek.com&server_name=matrix.sunlightmail.net&server_name=mashedlevers.xyz&server_name=matrix.furworks.de&server_name=matrix.computingcache.com&server_name=galaxy.cat&server_name=www.aletsch.duckdns.org&server_name=matrix.barronpm.com&server_name=techsaviours.org&server_name=matrix.blobfox.coffee&server_name=flueren.eu&server_name=hentai69.de&server_name=zernable.net&server_name=bozg.se&server_name=h2.gay&server_name=casplantje.nl&server_name=synapse.migou.synology.me&server_name=blyatflix.com&server_name=prasket.net&server_name=valdas.space&server_name=jacksn.dev&server_name=cthd.icu&server_name=talk.go7box.xyz&server_name=azelphur.com&server_name=xyborg.xyz&server_name=kapsi.fi&server_name=matrix.sarkasti.eu&server_name=koyax.org&server_name=chat.akdub.club&server_name=m.neb.cx&server_name=darkflame.dev&server_name=lemmy.world&server_name=matrix.joejoetv.de&server_name=bchn.foo&server_name=newcircuit.io&server_name=matrix.thegriffiths.ca&server_name=matrix.farley.pro&server_name=metaccount.de&server_name=arc.run&server_name=4ray.co&server_name=flux.industries&server_name=matrix.hydrar.de&server_name=protokolla.fi&server_name=matrix.thisisjoes.site&server_name=bukn.uk&server_name=matrix.devnullvoid.space&server_name=zhaofeng.li&server_name=v0lk.com&server_name=pyrox.dev&server_name=matrix.space-elephant.org&server_name=arschtronaut.de&server_name=cult.ltd&server_name=matrix.ucw.cz&server_name=nyanlout.re&server_name=hostpath.de&server_name=cub.icu&server_name=tubyte.net&server_name=genius.ke&server_name=etero.dev&server_name=privacytools.io&server_name=catgirl.cloud&server_name=bintrix.net&server_name=w9r.de&server_name=rom4nik.pl&server_name=matrix.h.etbus.ch&server_name=justsem.org&server_name=20220714-test.ems.host&server_name=matrix.hopfenspace.org&server_name=matrix.rbpatrick.xyz&server_name=antti.codes&server_name=matrix.cnv.solutions&server_name=illudar.com&server_name=drnk.org&server_name=krasserscheiss.cool&server_name=neo.angry.im&server_name=cordoba.beru.co&server_name=tjakosquad.nl&server_name=matrix.teamfriesen.com&server_name=chat.wilkinsons.cloud&server_name=mtx.vsanten.de&server_name=cebo29.ipv64.de&server_name=gunpoint.org.uk&server_name=chat.is-cute.ml&server_name=kucharczyk.xyz&server_name=thebias.nl&server_name=dendrite.dedyn.io&server_name=sosnowkadub.de&server_name=chatwave.org&server_name=szejner.com&server_name=jboi.nl&server_name=unredacted.org&server_name=trygve.me&server_name=matrix.futcloud.de&server_name=felixperron.com&server_name=datenburg.org&server_name=matrix.kabukimono.contact&server_name=darkmatter.rocks&server_name=matrix.kovalev.systems&server_name=dfn.su&server_name=matrix.jasondaigo.de&server_name=tchncs.de&server_name=linuiz.org&server_name=ferriroli.com&server_name=pkrm.dev&server_name=gelat.in&server_name=thedi.sh&server_name=rochestercastle.net&server_name=bark.lgbt&server_name=vincejv.com&server_name=club1.fr&server_name=lonenomad.net&server_name=clusterfsck.com&server_name=conduit.rs&server_name=buyvm.net&server_name=fambamslam.com&server_name=nekoarc.online&server_name=chaos.jetzt&server_name=theia.myadoran.com&server_name=computingcache.com&server_name=yvan.dev&server_name=pub.solar&server_name=dauden.me&server_name=matrix.lyall.cam&server_name=w33b.cloud&server_name=stormo.chat&server_name=alexandrebadalo.pt&server_name=waifuhunter.club&server_name=matrix.sndr.uk&server_name=empty.social&server_name=parcanum.hu&server_name=bitforged.net&server_name=matrix.im&server_name=matrix.spacetime.technology&server_name=bstr.cl&server_name=matrix.vehling.info&server_name=pieracy.online&server_name=avery.cafe&server_name=fairydust.space&server_name=hdzki.kozow.com&server_name=p0457.ninja&server_name=jarrod.cool&server_name=magdeburg.jetzt&server_name=sgf.lt&server_name=blueplate.de&server_name=hacklab.fi&server_name=lhax.xyz&server_name=ungleich.ch&server_name=matrix.kulzaus.top&server_name=flow-soft.uk&server_name=hawaii.viaregio-services.de&server_name=dowdell.media&server_name=holycowman.com&server_name=nerdyredneck.net&server_name=speedie.site&server_name=ma.bupkis.ca&server_name=matrix.thehawken.org&server_name=matrix.imihov.com&server_name=codeine.world&server_name=matrix.ilike.green&server_name=jupiterbroadcasting.com&server_name=midov.pl&server_name=cloudf.de&server_name=mandragot.org&server_name=nmmcguire.com&server_name=uddu.chat&server_name=xescu.re&server_name=mymatrix.yorili.com&server_name=wired.lain.io&server_name=uwueviee.live&server_name=matrix.snld.ca&server_name=makussu.de&server_name=matrix.randalor.net&server_name=harha.net&server_name=matrix.vending-machine.xyz&server_name=randomsonicnet.org&server_name=matrix.servur.net&server_name=oppi.li&server_name=thalhammer.it&server_name=matrix.divisionismanmade.net&server_name=matrix.irrealidad.xyz&server_name=matrix.dupiec.gay&server_name=matrix.safeguard.network&server_name=cronce.io&server_name=streamhq.lol&server_name=librem.one&server_name=thewired.ch&server_name=staging.d.sb&server_name=libreti.net&server_name=matrix.pikko.xyz&server_name=dodsorf.as&server_name=okash.it&server_name=shinra.dev&server_name=stultus.net&server_name=matrix.bortle-host.io&server_name=matrix.justyn.io&server_name=matrix.darkflame.dev&server_name=matrix.quickbrb.com&server_name=matrix.ruglesms.xyz&server_name=asra.gr&server_name=chat.leleet.tk&server_name=altillimity.com&server_name=t2bot.io&server_name=pudl.es&server_name=matrix.hgs.moe&server_name=eyjhb.dk&server_name=cyberpantheon.com&server_name=malined.com&server_name=u.pikko.xyz&server_name=matrix.incogne.io&server_name=bouvier.family&server_name=matrix.schotty.com&server_name=magaya.org&server_name=matrix.markovcloud.com&server_name=vpsguige.ovh&server_name=saggis.com&server_name=exotic.sh&server_name=workly.ai&server_name=synaptrix.dedyn.io&server_name=cybre.space&server_name=galli.li&server_name=chat.binarydad.com&server_name=cancioc.com&server_name=kribs.net&server_name=mnemi.moe&server_name=ads34.de&server_name=diffey.dev&server_name=entorta.xyz&server_name=matrix.vpshk.mingye.ch&server_name=parlote.fr&server_name=matrix.bttd.hu&server_name=0x6b.dev&server_name=bitwrk.de&server_name=vigue.me&server_name=chatinamatrix.xyz&server_name=decentralised.cafe&server_name=kzhub.cc&server_name=yuri.im&server_name=shine.horse&server_name=craftlinux.ems.host&server_name=open-matrix.se&server_name=chat.kass.im&server_name=mozilla.org&server_name=matrix.krwh.io&server_name=p2pnode.org&server_name=www.wigger.one&server_name=imagisphe.re&server_name=netsoj.nl&server_name=matrix.knightrealm.us&server_name=matrix.byrdcrouse.com&server_name=ghostcorp.net&server_name=bngrs.net&server_name=plusultra.duckdns.org&server_name=matrix.hdhog.ru&server_name=matrix.pgbtech.com&server_name=matrix.tdstoragebay.com&server_name=matrix.vctor.me&server_name=envs.net&server_name=hsn.dev&server_name=lettuce.burggit.moe&server_name=shivering-isles.com&server_name=opaline.uk&server_name=veri.dev&server_name=astrr.ru&server_name=matrix.magadoux.fr&server_name=monero.social&server_name=matrix.artichokenetwork.com&server_name=matrix.devineemail.com&server_name=matrix.serpentnet.nl&server_name=rhamzeh.com&server_name=0ut0f.space&server_name=russ.network&server_name=matrix.casually.cat&server_name=fslhome.org&server_name=matrix.bbalm.me&server_name=matrix.flexinos.tech&server_name=0dmg.win&server_name=glittr.im&server_name=futa.catgirls.date&server_name=hackliberty.org&server_name=arcticfoxes.net&server_name=sierraromeo.miami&server_name=matrix.tab-e.de&server_name=n07070.xyz&server_name=boj4ck.com&server_name=e4xo.org&server_name=saintnet.tech&server_name=quailflux.com&server_name=matrix.teckids.org&server_name=matrix.rei.moe&server_name=rix.serkozh.me&server_name=chat.madiator.cloud&server_name=hrzn.tv&server_name=utwente.io&server_name=chat.lfx.linuxfoundation.org&server_name=matrix.intuinewin.dev&server_name=thecum.zone&server_name=millerhub.net&server_name=lunarsphere.net&server_name=pullopen.xyz&server_name=arclight.pro&server_name=waelwindows.duckdns.org&server_name=chat.dassystem.rocks&server_name=stephenson.systems&server_name=matrix.2xl.su&server_name=thesilentlink.org&server_name=pikaviestin.fi&server_name=rejowski.xyz&server_name=matrix.lonninator.net&server_name=one.ems.host&server_name=ordo-h.club&server_name=curtain.wtf&server_name=nope.chat&server_name=pynk.sh&server_name=nexy7574.co.uk&server_name=xmr.se&server_name=exani.me&server_name=siddharthagolu.com&server_name=downey.family&server_name=zand.dev&server_name=matrix.adrianmora.dev&server_name=matrix.rkowl.com&server_name=matrix.robindecker.me&server_name=cmkse.de&server_name=waffle.tech&server_name=nibbana.jp&server_name=matrix.possumlodge.me&server_name=massivebox.net&server_name=yatrix.org&server_name=matrix.pierre-couy.fr&server_name=nitro.chat&server_name=tomato.burggit.moe&server_name=matrix.mvpts.at&server_name=stow.live&server_name=matrix.neb.cx&server_name=mayeul.net&server_name=ofsg.eu&server_name=neomidgar.xyz&server_name=gogel.me&server_name=plsno.com&server_name=matrix.edvgarbe.de&server_name=matrix.nicksplace.io&server_name=zyner.org&server_name=cyan.gay&server_name=gish.gg&server_name=fedora.im&server_name=matrix.gaterealm.com&server_name=matrix.2gbcss.net&server_name=matrix.nbios.net&server_name=matrix.mrcsharp.dev&server_name=mtrx.fukt.lol&server_name=serifos.uk&server_name=hoho.nu&server_name=matrix.biggerontheinsi.de&server_name=weebvr.com&server_name=puffer.fish&server_name=eschbach.house&server_name=otsuka.haus&server_name=sigil.host&server_name=matrix.shardfall.co.uk&server_name=alkema.co&server_name=tiktalk.space&server_name=ausset.me&server_name=capsulecorp.dev&server_name=chat2.dassystem.rocks&server_name=shiz0ids.pro&server_name=pl.sb&server_name=jameskitt616.one&server_name=ingwie.io&server_name=that.host&server_name=hai.haus&server_name=vartiovaara.dy.fi&server_name=matrix.cuatrolibertades.org&server_name=genepicks.club&server_name=matrix.bozg.se&server_name=fedichat.cybik.moe&server_name=mjex.me&server_name=3bb.io&server_name=matrix.24mail.xyz&server_name=dgng.no&server_name=neurario.com&server_name=braed.co&server_name=hoppu.me&server_name=matrix.firehawk-systems.com&server_name=gotlandia.net&server_name=noleron.com&server_name=foss.wtf&server_name=kde.org&server_name=subr0sa.0j0.jp&server_name=matrix.petegregory.net&server_name=kitsunes.club&server_name=khorne.me&server_name=bonifacelabs.ca&server_name=zerojay.com&server_name=cracked-floppies.com&server_name=cirr.com&server_name=deepcore.dev&server_name=dendrite.codyrobibero.dev&server_name=chatting.jdysmcl.xyz&server_name=matrix.asso-fare.fr&server_name=matrix.weinbauer.heim-server.de&server_name=matrix.raitsc.uk&server_name=matrix.sysnet.in.net&server_name=mbree.xyz&server_name=m.dyox.in&server_name=national-security.agency&server_name=hamilton.ws&server_name=matrix.aviancarrier.de&server_name=kungfu-g.rip&server_name=cthompson.com&server_name=plxbx.eu&server_name=piracy.guide&server_name=jw6.us&server_name=boing.icu&server_name=s4k.nl&server_name=matrix.vgorcum.com&server_name=freeself.one&server_name=matrix.sussywebsite.xyz&server_name=kitsunet.info&server_name=chat.astafu.de&server_name=underzsea.com&server_name=tee.world&server_name=ait-younes.fr&server_name=chat.braed.co&server_name=lrss.dk&server_name=secroot.xyz&server_name=half-shot.uk&server_name=qoto.org&server_name=mx.m4fx.de&server_name=zorix.us&server_name=explodingpineapple.net&server_name=fopnu.pw&server_name=matrix.zxspectrummail.net&server_name=matrix.fregram.com&server_name=helveticastandard.com&server_name=mongle.me&server_name=cutelab.space&server_name=hansol.ca&server_name=aria-net.org&server_name=chmbr.in&server_name=taktpraha.cz&server_name=matrix.duck-pond.de&server_name=chrrreeeeesss.com&server_name=nulln0de.com&server_name=arbyon.com&server_name=lofitrek.com&server_name=nolex.io&server_name=axerr.dev&server_name=starritt.dev&server_name=ap0calypse.ninja&server_name=matrix.piperservers.net&server_name=matrix.interhop.org&server_name=matrix.bahnhof.cz&server_name=matrix.nahtway.xyz&server_name=chat.deepdive.gg&server_name=agdersam.no&server_name=refchat.net&server_name=cool110.xyz&server_name=matrix.based.zone&server_name=matrix.allismspeaks.org&server_name=poa.st&server_name=thelander.xyz&server_name=theonecurly.page&server_name=csc-rodgau.de&server_name=instly.im&server_name=iris.cmmoore.tech&server_name=matrix.ceti.se&server_name=nop.chat&server_name=fedibay.com&server_name=matthice.nl&server_name=sockermunk.se&server_name=senan.xyz&server_name=uqlel.ovh&server_name=kashofer.org&server_name=matrix.kjg-dossenheim.org&server_name=k-fortytwo.de&server_name=casually.cat&server_name=matrix.metachthonia.io&server_name=nakunga.com&server_name=neov.im&server_name=jmbz.dev&server_name=conduit.compuverse.uk&server_name=matrix.atikayda.link&server_name=onionsherpa.com&server_name=staeding.com&server_name=lukitomo.com&server_name=matrix.tu-berlin.de&server_name=rubyowo.me&server_name=craftingcomrades.net&server_name=katniss.top&server_name=cutefunny.art&server_name=matrix.connorsite.xyz&server_name=idonotknow.xyz&server_name=zumhebel.com&server_name=conduit.papy.azurael.ovh&server_name=deltaa.xyz&server_name=matrix.carelesslisper.xyz&server_name=soontm.de&server_name=berryez.xyz&server_name=m4tr1x.net&server_name=nahsi.dev&server_name=syntaxchat.net&server_name=moeken.eu&server_name=destrocodpiece.wtf&server_name=mingye.ch&server_name=stormcloaks.org&server_name=matrix.mengsk.org&server_name=littlevortex.net&server_name=broccoli.town&server_name=pfaff.dev&server_name=lifehacker.moe&server_name=setmyx.net&server_name=hayden.moe&server_name=tavo.one&server_name=hempton.us&server_name=shrimpcode.ml&server_name=ephemeralbridges.online&server_name=vanderpot.net&server_name=matrix.fallenbagel.com&server_name=infosec.exchange&server_name=squall.fdisk.io&server_name=coolmule0.com&server_name=pijean.ovh&server_name=matrix.raqnet.org&server_name=matrix.jklmnop.xyz&server_name=lolimbeer.com&server_name=icy.name&server_name=boehm.sh&server_name=matrix.anonion.social&server_name=pentago.nl&server_name=matrix.jparenas.com&server_name=matrix-dev.luebke.dev&server_name=matrix.kinsel-web.de&server_name=proxymana.net&server_name=zion.bitcoinalchemy.io&server_name=horton.ems.host&server_name=brodi.me&server_name=mtx.dark.cx&server_name=matrix.ashik.se&server_name=cloudforce.linkpc.net&server_name=matrix.obamium.net&server_name=fufu.foo&server_name=matrix.gabets.me&server_name=matrix.arcanedealer.com&server_name=matrix.tux.si&server_name=matrix.steken.xyz&server_name=snailsoft.dev&server_name=dark.cx&server_name=mawalabs.de&server_name=matrix.aroy-art.com&server_name=zoit.net&server_name=corestorage.co.uk&server_name=matrixapp.chat

HTTP/1.1 400 Bad Request
Date: Mon, 24 Jun 2024 06:05:43 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 898a871ba8f6989c-OTP

<html><body><h1>400 Bad request</h1>
Your browser sent an invalid request.
</body></html>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@stefanceriu @devonh