This repository was archived by the owner on Apr 26, 2024. It is now read-only.
This repository was archived by the owner on Apr 26, 2024. It is now read-only.
Synapse does not correctly enforce the spec's regex for client_secret #6766
Description
The spec states that we should enforce a regex on client_secret. Synapse currently does not do this.
As a result of this, FluffyChat has started sending client_secret parameters that do not comply with the spec: https://gitlab.com/ChristianPauly/fluffychat/issues/160 Specifically, it sends client_secret values with : in them.
#6767 is written to allow client_secret to take : values, while otherwise respecting the specification. This will allow older versions of FluffyChat to continue working while a fix in put in place and people upgrade.
Eventually we will remove : from the client_secret regex, and will use this as a tracking issue for that.