Only ASCII MXIDs are allowed to be checked with the mutual rooms endpoint

[velikopter]

Description

Only ASCII user IDs are allowed to be checked with the mutual rooms endpoints, but non-ASCII characters are legal in user IDs.

Steps to reproduce

• request mutual rooms with @🛒:vel.fsky.io with /_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms?user_id=%40%F0%9F%9B%92%3Avel.fsky.io

Homeserver

velcrohtrfmnahtx4i5ibjcsjnxebvb54umnsdwklwzmmir2cp2ciiqd.onion

Synapse Version

1.139.0rc3

[anoadragon453]

This is due to the relevant UserMutualRoomsServlet calling parse_strings_from_args without setting the encoding parameter.

synapse/synapse/rest/client/mutual_rooms.py

Line 58 in e2ec3b7

user_ids = parse_strings_from_args(args, "user_id", required=True)

The default is "ascii", which would explain the behaviour you're seeing.

When a client makes a request, non-ascii characters, such as 🛒 are encoded as UTF-8 bytes, then percent-encoded (as you've done ?user_id=%40%F0%9F%9B%92%3Avel.fsky.io). Twisted will then percent-decode these to bytes for us. It's then up to us to decode the bytes in the appropriate format.

So the fix here is to set encoding="utf-8" on parse_strings_from_args. It's likely worth just setting the default to "utf-8" as well, as I could see many other endpoints not accepting UTF-8 query parameters as a result.