Don't fail /submit_token requests on incorrect session ID if request_token_inhibit_3pid_errors is turned on

synapse/storage/databases/main/registration.py

@@ -1323,6 +1323,14 @@ def validate_threepid_session_txn(txn):
 
             if not row:
                 if self._ignore_unknown_session_error:
+                    # If we need to inhibit the error caused by an incorrect session,
+                    # use None as placeholder values for the client secret and the
+                    # validation timestamp if the session ID doesn't exist.
+                    # It shouldn't be an issue because they're both only checked after
+                    # the token check, which should fail. And if it doesn't for some
+                    # reason, the next check is on the client secret, which is NOT NULL,
+                    # so we don't have to worry about the client secret matching by
+                    # accident.
                     row = {"client_secret": None, "validated_at": None}
                 else:
                     raise ThreepidValidationError(400, "Unknown session_id")

tests/storage/test_registration.py

@@ -17,6 +17,7 @@
 from twisted.internet import defer
 
 from synapse.api.constants import UserTypes
+from synapse.api.errors import ThreepidValidationError
 
 from tests import unittest
 from tests.utils import setup_test_homeserver
@@ -116,3 +117,29 @@ def test_is_support_user(self):
         )
         res = yield self.store.is_support_user(SUPPORT_USER)
         self.assertTrue(res)
+
+    @defer.inlineCallbacks
+    def test_3pid_inhibit_invalid_validation_session_error(self):
+        """Tests that enabling the configuration option to inhibit 3PID errors on
+        /requestToken also inhibits validation errors caused by an unknown session ID.
+        """
+
+        # Check that, with the config setting set to false (the default value), a
+        # validation error is caused by the unknown session ID.
+        try:
+            yield self.store.validate_threepid_session(
+                "fake_sid", "fake_client_secret", "fake_token", 0,
+            )
+        except ThreepidValidationError as e:
+            self.assertEquals(e.msg, "Unknown session_id", e)
+
+        # Set the config setting to true.
+        self.store._ignore_unknown_session_error = True
+
+        # Check that now the validation error is caused by the token not matching.
+        try:
+            yield self.store.validate_threepid_session(
+                "fake_sid", "fake_client_secret", "fake_token", 0,
+            )
+        except ThreepidValidationError as e:
+            self.assertEquals(e.msg, "Validation token not found or has expired", e)