From 774ac4930dbb0e6f2f6dad4b9eb4630154e1e161 Mon Sep 17 00:00:00 2001
From: Carl Bordum Hansen <carl@bordum.dk>
Date: Wed, 25 May 2022 11:14:45 +0200
Subject: [PATCH] Make sure `prev_ids` defaults to empty list (#12829)
Signed-off-by: Carl Bordum Hansen <carl@bordum.dk>
---
changelog.d/12829.bugfix | 1 +
synapse/handlers/device.py | 4 ++++
2 files changed, 5 insertions(+)
create mode 100644 changelog.d/12829.bugfix
diff --git a/changelog.d/12829.bugfix b/changelog.d/12829.bugfix
new file mode 100644
index 0000000000..dfa1fed34e
--- /dev/null
+++ b/changelog.d/12829.bugfix
@@ -0,0 +1 @@
+Fix a bug where we did not correctly handle invalid device list updates over federation. Contributed by Carl Bordum Hansen.
diff --git a/synapse/handlers/device.py b/synapse/handlers/device.py
index 1d6d1f8a92..e59937fd75 100644
--- a/synapse/handlers/device.py
+++ b/synapse/handlers/device.py
@@ -763,6 +763,10 @@ class DeviceListUpdater:
device_id = edu_content.pop("device_id")
stream_id = str(edu_content.pop("stream_id")) # They may come as ints
prev_ids = edu_content.pop("prev_id", [])
+ if not isinstance(prev_ids, list):
+ raise SynapseError(
+ 400, "Device list update had an invalid 'prev_ids' field"
+ )
prev_ids = [str(p) for p in prev_ids] # They may come as ints
if get_domain_from_id(user_id) != origin:
--
GitLab