Remote user's activity sent to appservice if their mxid matches regex #1606

New issue

Open

opened 2026-04-02 20:17:13 +00:00 by grgergo · 3 comments

grgergo commented

2026-04-02 20:17:13 +00:00

I have an appservice registration on a server (say piros.pitty.hu) like:

id: test
as_token: asdf
hs_token: hjkl
url: "http://localhost:35628"
sender_localpart: test
namespaces:
  users:
    - exclusive: true
      regex: "@test.*"

Now if I send messages from a different server with a user matching the regex (say @testing:dinnye.pitty.hu), the events get pushed to the appservice.
The appservice spec says this shouldn't happen: https://spec.matrix.org/v1.17/application-service-api/#registration (blue INFO box)

Video of the above

Code of the demo "appservice" in the video

from flask import Flask, request
app = Flask(__name__)

@app.put("/_matrix/app/v1/transactions/<txnId>")
def transaction(txnId):
    print(request.data)
    return "{}"

I have an appservice registration on a server (say `piros.pitty.hu`) like: ```yaml id: test as_token: asdf hs_token: hjkl url: "http://localhost:35628" sender_localpart: test namespaces: users: - exclusive: true regex: "@test.*" ``` Now if I send messages from a different server with a user matching the regex (say `@testing:dinnye.pitty.hu`), the events get pushed to the appservice. The appservice spec says this shouldn't happen: [https://spec.matrix.org/v1.17/application-service-api/#registration](https://spec.matrix.org/v1.17/application-service-api/#registration:~:text=Events%20affecting%20users%20on%20other%20homeservers%20are%20not%20sent%20to%20an%20application%20service%2C%20even%20if%20the%20user%20happens%20to%20match%20the%20one%20of%20the%20users%20namespaces) (blue INFO box) <details><summary>Video of the above</summary><video src="/attachments/52a3c342-b467-455c-8d80-4efa5267a0dc" title="Peek 2026-04-02 21-54" controls></video></details> <details><summary>Code of the demo "appservice" in the video</summary> ```python from flask import Flask, request app = Flask(__name__) @app.put("/_matrix/app/v1/transactions/<txnId>") def transaction(txnId): print(request.data) return "{}" ``` </details>

Peek 2026-04-02 21-54.mp4

556 KiB

Jade added the

Bug

Good first issue

Matrix/Appservices

labels

2026-04-02 20:21:52 +00:00

grgergo commented

2026-04-03 21:35:34 +00:00

Author

Turns out I can also send events as the remote user from the appservice:

curl -X PUT -H 'Authorization: Bearer asdf' \
  'http://localhost:8008/_matrix/client/v3/rooms/!qv1GYwvEamOCkc0Gct:piros.pitty.hu/send/m.room.message/test?user_id=@testing:dinnye.pitty.hu' \
  --data-raw '{"msgtype":"m.text","body":"test from as"}'

ends up as

I can send state events like this too... (and that turns into a split-brain kinda thing)

Turns out I can also send events as the remote user from the appservice: ``` curl -X PUT -H 'Authorization: Bearer asdf' \ 'http://localhost:8008/_matrix/client/v3/rooms/!qv1GYwvEamOCkc0Gct:piros.pitty.hu/send/m.room.message/test?user_id=@testing:dinnye.pitty.hu' \ --data-raw '{"msgtype":"m.text","body":"test from as"}' ``` ends up as ![screenshot247](/attachments/66ae7e67-6b01-4b58-b552-05c700dcdd62) I can send state events like this too... (and that turns into a split-brain kinda thing) ![screenshot248](/attachments/c21e1db2-1944-4afa-a08b-3ab0dd9d894a)

screenshot247.png

70 KiB

screenshot248.png

29 KiB

Jade commented

2026-04-03 23:21:08 +00:00

Owner

Oh lmfao OK then

Jade added the

Status

Confirmed

label

2026-04-03 23:22:16 +00:00

nex commented

2026-04-05 21:39:38 +00:00

Owner

The issue where you can send events as remote users has been fixed in 688cd8f46a, the original issue isn't possible to fix with our current architecture so I'll fix it when I rewrite the sender service (I'll leave this issue open)

The issue where you can send events as remote users has been fixed in 688cd8f46a69bbc7b31e1668df5f7ca4e751eb82, the original issue isn't possible to fix with our current architecture so I'll fix it when I rewrite the sender service (I'll leave this issue open)