Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Using URL component port in url_preview_url_blacklist leads to TypeError #12328

Closed
lxp opened this issue Mar 29, 2022 · 1 comment · Fixed by #12333
Closed

Using URL component port in url_preview_url_blacklist leads to TypeError #12328

lxp opened this issue Mar 29, 2022 · 1 comment · Fixed by #12333
Labels
S-Minor Blocks non-critical functionality, workarounds exist. T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues.

Comments

@lxp
Copy link

lxp commented Mar 29, 2022

Description

If url_preview_url_blacklist uses the port URL component an TypeError is thrown.

Steps to reproduce

  • Use an url_preview_url_blacklist with the URL component port in your homeserver.yaml.
url_preview_url_blacklist:
  # blacklist any URL with an explicit port
  - port: '*'
  • When an URL preview for an URL explicit port set is requested, the following exception is logged:
2022-03-29 18:49:55,029 - synapse.http.server - 100 - ERROR - GET-685 - Failed handle request via 'PreviewUrlResource': <XForwardedForRequest at 0x7fa7fb6a1d00 method='GET' uri='/_matrix/media/r0/preview_url?url=https%3A%2F%2Fgoogle.com%3A1234%2F&ts=1648572540000' clientproto='HTTP/1.0' site='8008'>
Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/synapse/http/server.py", line 268, in _async_render_wrapper
callback_return = await self._async_render(request)
File "/usr/local/lib/python3.9/site-packages/synapse/http/server.py", line 296, in _async_render
callback_return = await raw_callback_return
File "/usr/local/lib/python3.9/site-packages/synapse/rest/media/v1/preview_url_resource.py", line 212, in _async_render_GET
if not fnmatch.fnmatch(getattr(url_tuple, attrib), pattern):
File "/usr/local/lib/python3.9/fnmatch.py", line 40, in fnmatch
name = os.path.normcase(name)
File "/usr/local/lib/python3.9/posixpath.py", line 54, in normcase
return os.fspath(s)
TypeError: expected str, bytes or os.PathLike object, not int
  • The same also applies to a regex configuration leading to a slightly different exception:
url_preview_url_blacklist:
  # blacklist any URL with an explicit port
  - port: '^.*$'
2022-03-29 18:52:00,582 - synapse.http.server - 100 - ERROR - GET-9 - Failed handle request via 'PreviewUrlResource': <XForwardedForRequest at 0x7f33e13238b0 method='GET' uri='/_matrix/media/r0/preview_url?url=https%3A%2F%2Fgoogle.com%3A1234%2F&ts=1648572720000' clientproto='HTTP/1.0' site='8008'>
Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/synapse/http/server.py", line 268, in _async_render_wrapper
callback_return = await self._async_render(request)
File "/usr/local/lib/python3.9/site-packages/synapse/http/server.py", line 296, in _async_render
callback_return = await raw_callback_return
File "/usr/local/lib/python3.9/site-packages/synapse/rest/media/v1/preview_url_resource.py", line 208, in _async_render_GET
if not re.match(pattern, getattr(url_tuple, attrib)):
File "/usr/local/lib/python3.9/re.py", line 191, in match
return _compile(pattern, flags).match(string)
TypeError: expected string or bytes-like object
  • The problem seems to appear because urlsplit returns an int for the port but it is not converted appropriately before applying the matching function.

Version information

  • Homeserver: Not matrix.org
  • Version: 1.55.2

  • Install method: Docker

  • Platform: Container
@babolivier
Copy link
Contributor

The problem seems to appear because urlsplit returns an int for the port but it is not converted appropriately before applying the matching function.

Yes I believe your diagnostic is correct here.

@babolivier babolivier added S-Minor Blocks non-critical functionality, workarounds exist. T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues. labels Mar 30, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
S-Minor Blocks non-critical functionality, workarounds exist. T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues.
Projects
None yet
2 participants