-
Notifications
You must be signed in to change notification settings - Fork 82
Description
If Hookshot is configured with an empty list of users in appservice namespace configuration then it will ignore invites and messages from users on the same homeserver.
Hookshot does not pass the list of users in the appservice namespace configuration to matrix-bot-sdk verbatim (unlike the list of rooms or aliases), instead it joins all the configured regexes together into a single regular expression:
matrix-hookshot/src/Appservice.ts
Lines 46 to 55 in b0b61a7
| // Support multiple users | |
| users: [ | |
| { | |
| regex: | |
| "(" + | |
| registration.namespaces.users.map((r) => r.regex).join(")|(") + | |
| ")", | |
| exclusive: true, | |
| }, | |
| ], |
However, if this list is empty (e.g. Hookshot is being used without any of the modules which create service bots), then this results in the empty regular expression (), which matches all usernames on the homeserver. This means that the checks in the invite and message handlers which guard against processing messages originating from Hookshot itself will trigger for every user on the same homeserver, which will result in invites and messages being ignored.