[barodeur]

This partially fixes the bug #20116

Device list update EDUs from non-compliant (grandfathered historical) user IDs are currently accepted over federation, stored, and surfaced to clients in /sync's device_lists.changed array.

For current room versions, servers must still accept events using such user IDs over federation; however they SHOULD NOT forward such user IDs to clients when referenced outside the context of an event. For example, device list updates from non-compliant user IDs would be dropped by the receiving server.

-- Matrix spec, clarified in Matrix v1.14 by matrix-spec#1506

Problem Example

A remote server sends an m.device_list_update EDU for @héllo:remote.example (non-ASCII localpart, outside the compliant U+0021–U+007E range). Synapse:

• accepts and processes the update (resyncing the user's device list if needed)
• stores it in the remote device list cache
• forwards @héllo:remote.example to local clients via device_lists.changed in /sync (the leak — a non-compliant user ID referenced outside event context)

---

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
  • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
• Code style is correct (run the linters)