Skip to content

Synapse doesn't merge signatures correctly when a policy server is running on the same domain #19796

@tulir

Description

@tulir

This code is wrong, as the comment in the code explains: https://github.com/element-hq/synapse/blob/v1.153.0/synapse/handlers/room_policy.py#L264 (.update() is implemented in rust and overwrites all existing signatures as per https://github.com/element-hq/synapse/blob/v1.153.0/rust/src/events/signatures.rs#L128)
If signatures are already present from the server, the policy server signature must be merged instead of replacing the existing signature.

The bug was originally fixed by #19503 and later reintroduced by #19706

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions