From 61fd2a8f591f20fe9d1cffe659336664bf44e742 Mon Sep 17 00:00:00 2001
From: Erik Johnston <erik@matrix.org>
Date: Thu, 3 Mar 2022 10:52:35 +0000
Subject: [PATCH] Limit the size of the aggregation_key (#12101)
There's no reason to let people use long keys.
---
changelog.d/12101.misc | 1 +
synapse/handlers/message.py | 3 +++
2 files changed, 4 insertions(+)
create mode 100644 changelog.d/12101.misc
diff --git a/changelog.d/12101.misc b/changelog.d/12101.misc
new file mode 100644
index 0000000000..d165f73d13
--- /dev/null
+++ b/changelog.d/12101.misc
@@ -0,0 +1 @@
+Limit the size of `aggregation_key` on annotations.
diff --git a/synapse/handlers/message.py b/synapse/handlers/message.py
index 61cb133ef2..0799ec9a84 100644
--- a/synapse/handlers/message.py
+++ b/synapse/handlers/message.py
@@ -1069,6 +1069,9 @@ class EventCreationHandler:
if relation_type == RelationTypes.ANNOTATION:
aggregation_key = relation["key"]
+ if len(aggregation_key) > 500:
+ raise SynapseError(400, "Aggregation key is too long")
+
already_exists = await self.store.has_user_annotated_event(
relates_to, event.type, aggregation_key, event.sender
)
--
GitLab