From 24021cc984f4027d544bb8f9535202d5945bb2e8 Mon Sep 17 00:00:00 2001
From: Quentin Gliech <quenting@element.io>
Date: Fri, 3 May 2024 16:09:07 +0200
Subject: [PATCH] matrix-synapse: urlencode parameters before sending them to
 Synapse

---
 Cargo.lock                       |  1 +
 crates/matrix-synapse/Cargo.toml |  1 +
 crates/matrix-synapse/src/lib.rs | 14 ++++++++++----
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e4286b79..401afea1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3411,6 +3411,7 @@ dependencies = [
  "tower",
  "tracing",
  "url",
+ "urlencoding",
 ]
 
 [[package]]
diff --git a/crates/matrix-synapse/Cargo.toml b/crates/matrix-synapse/Cargo.toml
index 302f36e3..98852fb0 100644
--- a/crates/matrix-synapse/Cargo.toml
+++ b/crates/matrix-synapse/Cargo.toml
@@ -19,6 +19,7 @@ serde.workspace = true
 tower.workspace = true
 tracing.workspace = true
 url.workspace = true
+urlencoding = "2.1.3"
 
 mas-axum-utils.workspace = true
 mas-http.workspace = true
diff --git a/crates/matrix-synapse/src/lib.rs b/crates/matrix-synapse/src/lib.rs
index f58c1714..adab19fc 100644
--- a/crates/matrix-synapse/src/lib.rs
+++ b/crates/matrix-synapse/src/lib.rs
@@ -152,6 +152,7 @@ impl HomeserverConnection for SynapseConnection {
         err(Display),
     )]
     async fn query_user(&self, mxid: &str) -> Result<MatrixUser, Self::Error> {
+        let mxid = urlencoding::encode(mxid);
         let mut client = self
             .http_client_factory
             .client("homeserver.query_user")
@@ -186,6 +187,7 @@ impl HomeserverConnection for SynapseConnection {
         err(Display),
     )]
     async fn is_localpart_available(&self, localpart: &str) -> Result<bool, Self::Error> {
+        let localpart = urlencoding::encode(localpart);
         let mut client = self
             .http_client_factory
             .client("homeserver.is_localpart_available");
@@ -252,11 +254,9 @@ impl HomeserverConnection for SynapseConnection {
             .request_bytes_to_body()
             .json_request();
 
+        let mxid = urlencoding::encode(request.mxid());
         let request = self
-            .put(&format!(
-                "_synapse/admin/v2/users/{mxid}",
-                mxid = request.mxid()
-            ))
+            .put(&format!("_synapse/admin/v2/users/{mxid}"))
             .body(body)?;
 
         let response = client.ready().await?.call(request).await?;
@@ -282,6 +282,7 @@ impl HomeserverConnection for SynapseConnection {
         err(Display),
     )]
     async fn create_device(&self, mxid: &str, device_id: &str) -> Result<(), Self::Error> {
+        let mxid = urlencoding::encode(mxid);
         let mut client = self
             .http_client_factory
             .client("homeserver.create_device")
@@ -312,6 +313,8 @@ impl HomeserverConnection for SynapseConnection {
         err(Display),
     )]
     async fn delete_device(&self, mxid: &str, device_id: &str) -> Result<(), Self::Error> {
+        let mxid = urlencoding::encode(mxid);
+        let device_id = urlencoding::encode(device_id);
         let mut client = self.http_client_factory.client("homeserver.delete_device");
 
         let request = self
@@ -340,6 +343,7 @@ impl HomeserverConnection for SynapseConnection {
         err(Display),
     )]
     async fn delete_user(&self, mxid: &str, erase: bool) -> Result<(), Self::Error> {
+        let mxid = urlencoding::encode(mxid);
         let mut client = self
             .http_client_factory
             .client("homeserver.delete_user")
@@ -370,6 +374,7 @@ impl HomeserverConnection for SynapseConnection {
         err(Display),
     )]
     async fn set_displayname(&self, mxid: &str, displayname: &str) -> Result<(), Self::Error> {
+        let mxid = urlencoding::encode(mxid);
         let mut client = self
             .http_client_factory
             .client("homeserver.set_displayname")
@@ -412,6 +417,7 @@ impl HomeserverConnection for SynapseConnection {
         err(Display),
     )]
     async fn allow_cross_signing_reset(&self, mxid: &str) -> Result<(), Self::Error> {
+        let mxid = urlencoding::encode(mxid);
         let mut client = self
             .http_client_factory
             .client("homeserver.allow_cross_signing_reset")