Update status codes to be more sensible

INSTALL.md

@@ -257,18 +257,38 @@ https://github.com/spantaleev/matrix-docker-ansible-deploy
 #### Matrix.org packages
 
 Matrix.org provides Debian/Ubuntu packages of the latest stable version of
-Synapse via https://matrix.org/packages/debian/. To use them:
+Synapse via https://packages.matrix.org/debian/. To use them:
+
+For Debian 9 (Stretch), Ubuntu 16.04 (Xenial), and later:
 
 ```
-sudo apt install -y lsb-release curl apt-transport-https
-echo "deb https://matrix.org/packages/debian `lsb_release -cs` main" |
+sudo apt install -y lsb-release wget apt-transport-https
+sudo wget -O /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" |
     sudo tee /etc/apt/sources.list.d/matrix-org.list
-curl "https://matrix.org/packages/debian/repo-key.asc" |
-    sudo apt-key add -
 sudo apt update
 sudo apt install matrix-synapse-py3
 ```
 
+For Debian 8 (Jessie):
+
+```
+sudo apt install -y lsb-release wget apt-transport-https
+sudo wget -O /etc/apt/trusted.gpg.d/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+echo "deb [signed-by=5586CCC0CBBBEFC7A25811ADF473DD4473365DE1] https://packages.matrix.org/debian/ $(lsb_release -cs) main" |
+    sudo tee /etc/apt/sources.list.d/matrix-org.list
+sudo apt update
+sudo apt install matrix-synapse-py3
+```
+
+**Note**: if you followed a previous version of these instructions which
+recommended using `apt-key add` to add an old key from
+`https://matrix.org/packages/debian/`, you should note that this key has been
+revoked. You should remove the old key with `sudo apt-key remove
+C35EB17E1EAE708E6603A9B3AD0592FE47F0DF61`, and follow the above instructions to
+update your configuration.
+
+
 #### Downstream Debian/Ubuntu packages
 
 For `buster` and `sid`, Synapse is available in the Debian repositories and

synapse/handlers/profile.py

@@ -31,6 +31,9 @@ from ._base import BaseHandler
 
 logger = logging.getLogger(__name__)
 
+MAX_DISPLAYNAME_LEN = 128
+MAX_AVATARURL_LEN = 128
+
 
 class BaseProfileHandler(BaseHandler):
     """Handles fetching and updating user profile information.
@@ -80,6 +83,10 @@ class BaseProfileHandler(BaseHandler):
                     },
                     ignore_backoff=True,
                 )
+                if len(result.get("displayname", "")) > MAX_DISPLAYNAME_LEN:
+                    raise SynapseError(400, "Displayname is too long", Codes.UNKNONW)
+                if len(result.get("avatar_url", "")) > MAX_AVATARURL_LEN:
+                    raise SynapseError(400, "Avatar_url is too long", Codes.UNKNONW)
                 defer.returnValue(result)
             except CodeMessageException as e:
                 if e.code != 404:
@@ -142,6 +149,9 @@ class BaseProfileHandler(BaseHandler):
                 if e.code != 404:
                     logger.exception("Failed to get displayname")
                 raise
+            
+            if len(result.get("displayname", "")) > MAX_DISPLAYNAME_LEN:
+                raise SynapseError(400, "Displayname is too long", Codes.UNKNONW)
 
             defer.returnValue(result["displayname"])
 
@@ -156,10 +166,13 @@ class BaseProfileHandler(BaseHandler):
             by_admin (bool): Whether this change was made by an administrator.
         """
         if not self.hs.is_mine(target_user):
-            raise SynapseError(400, "User is not hosted on this Home Server")
+            raise SynapseError(404, "User is not hosted on this Home Server")
 
         if not by_admin and target_user != requester.user:
-            raise AuthError(400, "Cannot set another user's displayname")
+            raise AuthError(403, "Cannot set another user's displayname")
+            
+        if len(new_displayname) > MAX_DISPLAYNAME_LEN:
+            raise SynapseError(400, "Displayname is too long", Codes.UNKNONW)
 
         if new_displayname == '':
             new_displayname = None
@@ -204,6 +217,9 @@ class BaseProfileHandler(BaseHandler):
                     logger.exception("Failed to get avatar_url")
                 raise
 
+            if len(result.get("avatar_url", "")) > MAX_AVATARURL_LEN:
+                raise SynapseError(400, "Avatar_url is too long", Codes.UNKNONW)
+
             defer.returnValue(result["avatar_url"])
 
     @defer.inlineCallbacks
@@ -211,11 +227,15 @@ class BaseProfileHandler(BaseHandler):
         """target_user is the user whose avatar_url is to be changed;
         auth_user is the user attempting to make this change."""
         if not self.hs.is_mine(target_user):
-            raise SynapseError(400, "User is not hosted on this Home Server")
+            raise SynapseError(404, "User is not hosted on this Home Server")
 
         if not by_admin and target_user != requester.user:
-            raise AuthError(400, "Cannot set another user's avatar_url")
+            raise AuthError(403, "Cannot set another user's avatar_url")
 
+            
+        if len(new_avatar_url) > MAX_AVATARURL_LEN:
+            raise SynapseError(400, "Avatar_url is too long", Codes.UNKNONW)
+            
         yield self.store.set_profile_avatar_url(
             target_user.localpart, new_avatar_url
         )
@@ -232,7 +252,7 @@ class BaseProfileHandler(BaseHandler):
     def on_profile_query(self, args):
         user = UserID.from_string(args["user_id"])
         if not self.hs.is_mine(user):
-            raise SynapseError(400, "User is not hosted on this Home Server")
+            raise SynapseError(404, "User is not hosted on this Home Server")
 
         just_field = args.get("field", None)
 
@@ -252,6 +272,12 @@ class BaseProfileHandler(BaseHandler):
                 raise SynapseError(404, "Profile was not found", Codes.NOT_FOUND)
             raise
 
+        if len(response.get("displayname", "")) > MAX_DISPLAYNAME_LEN:
+            raise SynapseError(400, "Displayname is too long", Codes.UNKNONW)
+
+        if len(response.get("avatar_url", "")) > MAX_AVATARURL_LEN:
+            raise SynapseError(400, "Avatar_url is too long", Codes.UNKNONW)
+
         defer.returnValue(response)
 
     @defer.inlineCallbacks
@@ -335,6 +361,11 @@ class MasterProfileHandler(BaseProfileHandler):
                     user_id, displayname, avatar_url
                 )
                 continue
+            
+            if len(profile.get("displayname", "")) > MAX_DISPLAYNAME_LEN:
+                raise SynapseError(400, "Displayname is too long", Codes.UNKNONW)
+            if len(profile.get("avatar_url", "")) > MAX_AVATARURL_LEN:
+                raise SynapseError(400, "Avatar_url is too long", Codes.UNKNONW)
 
             new_name = profile.get("displayname")
             new_avatar = profile.get("avatar_url")