Check if user is in room before being able to tag it

changelog.d/17839.bugfix

@@ -0,0 +1 @@
+Check if user has membership in a room before tagging it. Contributed by Lama Alosaimi.

synapse/handlers/room_member.py

@@ -1190,6 +1190,13 @@
             origin_server_ts=origin_server_ts,
         )
 
+    async def check_user_membership(self, user_id: str, room_id: str) -> None:
+        result: Optional[Tuple[Optional[str], Optional[str]]] = await self.store.get_local_current_membership_for_user_in_room(user_id=user_id, room_id=room_id)
+
+        if result is None:
+            raise AuthError(403, f"You are not a member of the room {room_id}")
+
+
     async def _should_perform_remote_join(
         self,
         user_id: str,

synapse/rest/client/tags.py

@@ -78,13 +78,18 @@ def __init__(self, hs: "HomeServer"):
         super().__init__()
         self.auth = hs.get_auth()
         self.handler = hs.get_account_data_handler()
+        self.room_member_handler = hs.get_room_member_handler()
 
     async def on_PUT(
         self, request: SynapseRequest, user_id: str, room_id: str, tag: str
     ) -> Tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot add tags for other users.")
+        # Check if the user has any membership in the room and raise error if not.
+        # Although it's not harmful for users to tag random rooms, it's just superfluous
+        # data we don't need to track or allow.
+        await self.room_member_handler.check_user_membership(user_id=user_id, room_id=room_id)
 
         body = parse_json_object_from_request(request)