Modify the behavior of how bad data is handled to fail closed.

Author: clokep

synapse/handlers/room_member.py

@@ -210,10 +210,10 @@ async def _can_join_without_invite(
         if join_rules_event.content.get("join_rule") != JoinRules.MSC3083_RESTRICTED:
             return True
 
-        # If allowed is of the wrong form, then ignore it (and treat the room as public).
+        # If allowed is of the wrong form, then only allows invites.
         allowed_spaces = join_rules_event.content.get("allow", [])
         if not isinstance(allowed_spaces, list):
-            return True
+            return False
 
         # Get the list of joined rooms and see if there's an overlap.
         joined_rooms = await self.store.get_rooms_for_user(user_id)