-
-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Limit which clients are allowed to send read receipts without a body #11156
Description
The Matrix Spec requires that requests to POST /rooms/{roomId}/receipt/{receiptType}/{eventId}
have a body, even if it's just {}
. Unfortunately, older Element Android clients omitted this and sent empty bodies instead.
We worked around this in #10531, but we'd like to eventually remove the workaround per #10534.
To prevent the problem from getting worse, we should limit the scope of the workaround to only apply to known bad clients.
Specifically, instead of unconditionally setting allow_empty_body=True
here:
synapse/synapse/rest/client/receipts.py
Line 55 in ba00e20
body = parse_json_object_from_request(request, allow_empty_body=True) |
We should only set it to True
if the result of get_request_user_agent(request)
contains Android
and satisfies one of the following:
- Contains
Riot
(e.g.,Old Riot.im
,Riot
,RiotX
,Element (Riot.im)
) - Starts with
Element/1.[012].*
- Starts with
SchildiChat/1.[012].*
(This will unnecessarily allow all Element 1.2.x releases to send empty bodies, instead of just versions < 1.2.1, but doing so really simplifies the glob, and we know that 1.2.1 and later are well behaved, so no harm done.)