Skip to content

limit link schemes in in messages in e-mail push notifications #19741

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RamReso wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

limit link schemes in in messages in e-mail push notifications #19741

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c89ccb3
limit link schemes in in messages in e-mail push notifications
RamReso Apr 29, 2026
7909158
added changelog.
RamReso Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/19741.misc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Limit the allowed link schemes to `["http", "https", "mailto"]` from messages contained in e-mail push notifications. Contributed by Noah Markert.
4 changes: 2 additions & 2 deletions synapse/push/mailer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,7 @@
"img": ["src"],
}
# When bleach release a version with this option, we can specify schemes
Copy link
Copy Markdown
Contributor

@MadLittleMods MadLittleMods May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment is no longer relevant since we're using a version of bleach that supports this

Suggested change
# When bleach release a version with this option, we can specify schemes

# ALLOWED_SCHEMES = ["http", "https", "ftp", "mailto"]
ALLOWED_SCHEMES = ["http", "https", "mailto"]
Comment on lines 114 to +115
Copy link
Copy Markdown
Contributor

@MadLittleMods MadLittleMods May 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Depending on the answer to #19741 (comment) we can at-least use this PR remove this entire comment (and the commented out usage).



class Mailer:
Expand Down Expand Up @@ -972,7 +972,7 @@ def safe_markup(raw_html: str) -> Markup:
tags=ALLOWED_TAGS,
attributes=ALLOWED_ATTRS,
# bleach master has this, but it isn't released yet
# protocols=ALLOWED_SCHEMES,
protocols=ALLOWED_SCHEMES,
Copy link
Copy Markdown
Contributor

@MadLittleMods MadLittleMods May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally: add a test case (or otherwise) demonstrate that safe_markup makes use of the this schema allowlist.

-- @DMRobertson, matrix-org/synapse#2860 (comment)

A test would be good. Have you at least tested this manually? Please provide some instructions

Copy link
Copy Markdown
Contributor

@MadLittleMods MadLittleMods May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we even need to define this?

The list of ALLOWED_PROTOCOLS now defaults to http, https
and mailto

-- https://github.com/mozilla/bleach/releases/tag/v1.5

And I can see it in their code: https://github.com/mozilla/bleach/blob/913ab75992b845e2c9c060c41f24d46921db4693/bleach/sanitizer.py#L37-L38

Copy link
Copy Markdown
Contributor

@MadLittleMods MadLittleMods May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To make it more clear, the minimum version of bleach needed to use the protocols argument is 1.5 (https://github.com/mozilla/bleach/releases/tag/v1.5)

We're now using bleach>=3.2.0 as our minimum so we're good on this front ✅

synapse/pyproject.toml

Lines 75 to 76 in 8eb220a

# 3.2.0 updates collections.abc imports to avoid Python 3.10 incompatibility.
"bleach>=3.2.0",

strip=True,
)
)
Expand Down
Loading