500 `TypeError: unhashable type: 'dict'` when setting membership state with non-string avatar_url

[DMRobertson]

https://sentry.tools.element.io/organizations/element/issues/39942/?project=2&query=is%3Aunresolved&statsPeriod=24h

Someone called PUT /_matrix/client/r0/rooms/!REDACTED%3Amatrix.org/state/m.room.member/%40REDACTED%3Amatrix.org with content of the form

{avatar_url: {content_uri: 'REDACTED'}, displayname: 'REDACTED, is_direct: False, membership: 'join'}

The avatar_url is malformed: it should be a string.

[JMoVS]

This seems to currently break setting a room specific avatar with /myroomavatar in element desktop if I'm not mistaken

[janisstreib]

Seeing this in my logs (1.70.1+bullseye1) as well after trying to use /myroomavatar:

synapse.http.server - 124 - ERROR - PUT-170 - Failed handle request via 'RoomStateEventRestServlet': <XForwardedForRequest at 0x7fe6787de910 method='PUT' uri='/_matrix/client/r0/rooms/<redacted>/state/m.room.member/<redacted>' clientproto='HTTP/1.1' site='8008'>
Traceback (most recent call last):
  File "/opt/venvs/matrix-synapse/lib/python3.9/site-packages/synapse/http/server.py", line 307, in _async_render_wrapper
    callback_return = await self._async_render(request)
  File "/opt/venvs/matrix-synapse/lib/python3.9/site-packages/synapse/http/server.py", line 513, in _async_render
    callback_return = await raw_callback_return
  File "/opt/venvs/matrix-synapse/lib/python3.9/site-packages/synapse/rest/client/room.py", line 278, in on_PUT
    event_id, _ = await self.room_member_handler.update_membership(
  File "/opt/venvs/matrix-synapse/lib/python3.9/site-packages/synapse/handlers/room_member.py", line 575, in update_membership
    result = await self.update_membership_locked(
  File "/opt/venvs/matrix-synapse/lib/python3.9/site-packages/synapse/handlers/room_member.py", line 703, in update_membership_locked
    if not await self.profile_handler.check_avatar_size_and_mime_type(
  File "/opt/venvs/matrix-synapse/lib/python3.9/site-packages/synapse/util/caches/descriptors.py", line 347, in _wrapped
    ret = cache.get(cache_key, callback=invalidate_callback)
  File "/opt/venvs/matrix-synapse/lib/python3.9/site-packages/synapse/util/caches/deferred_cache.py", line 165, in get
    val = self._pending_deferred_cache.get(key, _Sentinel.sentinel)
TypeError: unhashable type: 'dict'

[DMRobertson]

This seems to currently break setting a room specific avatar with /myroomavatar in element desktop if I'm not mistaken

Seeing this in my logs (1.70.1+bullseye1) as well after trying to use /myroomavatar:

Please report this as a bug against Element web.

(There is a problem in Synapse: we should reject the request and tell the client what they did wrong. But there is also a problem in the client sending us the wrong kind of request.)