From 34a8652366c60d785e5c0510749e615d0dec9ec0 Mon Sep 17 00:00:00 2001
From: Timshel <Timshel@users.noreply.github.com>
Date: Wed, 8 May 2024 15:56:16 +0200
Subject: [PATCH] Optional whitespace support in Authorization (#1350) (#17145)

Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
---
 changelog.d/17145.bugfix                        | 1 +
 synapse/federation/transport/server/_base.py    | 6 +++++-
 tests/federation/transport/server/test__base.py | 7 +++++++
 3 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/17145.bugfix

diff --git a/changelog.d/17145.bugfix b/changelog.d/17145.bugfix
new file mode 100644
index 0000000000..5c1e600f4e
--- /dev/null
+++ b/changelog.d/17145.bugfix
@@ -0,0 +1 @@
+Add support for optional whitespace around the Federation API's `Authorization` header's parameter commas.
diff --git a/synapse/federation/transport/server/_base.py b/synapse/federation/transport/server/_base.py
index 23d1254127..db0f5076a9 100644
--- a/synapse/federation/transport/server/_base.py
+++ b/synapse/federation/transport/server/_base.py
@@ -180,7 +180,11 @@ def _parse_auth_header(header_bytes: bytes) -> Tuple[str, str, str, Optional[str
     """
     try:
         header_str = header_bytes.decode("utf-8")
-        params = re.split(" +", header_str)[1].split(",")
+        space_or_tab = "[ \t]"
+        params = re.split(
+            rf"{space_or_tab}*,{space_or_tab}*",
+            re.split(r"^X-Matrix +", header_str, maxsplit=1)[1],
+        )
         param_dict: Dict[str, str] = {
             k.lower(): v for k, v in [param.split("=", maxsplit=1) for param in params]
         }
diff --git a/tests/federation/transport/server/test__base.py b/tests/federation/transport/server/test__base.py
index 065e85957e..0e3b41ec4d 100644
--- a/tests/federation/transport/server/test__base.py
+++ b/tests/federation/transport/server/test__base.py
@@ -147,3 +147,10 @@ class BaseFederationAuthorizationTests(unittest.TestCase):
             ),
             ("foo", "ed25519:1", "sig", "bar"),
         )
+        # test that "optional whitespace(s)" (space and tabulation) are allowed between comma-separated auth-param components
+        self.assertEqual(
+            _parse_auth_header(
+                b'X-Matrix origin=foo , key="ed25519:1",  sig="sig",	destination="bar",		extra_field=ignored'
+            ),
+            ("foo", "ed25519:1", "sig", "bar"),
+        )