Fix use of unsanitised string in Errorf

If the error message returned by the server contained a `%` character, `Errorf`
would attempt to interpolate it, causing a panic.

Author: richvdh

spec/matrixerror.go

@@ -15,6 +15,7 @@
 package spec
 
 import (
+	"errors"
 	"fmt"
 )
 
@@ -63,7 +64,7 @@ func (e MatrixError) Error() string {
 }
 
 func (e MatrixError) Unwrap() error {
-	return fmt.Errorf(e.Err)
+	return errors.New(e.Err)
 }
 
 // InternalServerError
@@ -231,7 +232,7 @@ func (e IncompatibleRoomVersionError) Error() string {
 }
 
 func (e IncompatibleRoomVersionError) Unwrap() error {
-	return fmt.Errorf(e.Err)
+	return errors.New(e.Err)
 }
 
 // IncompatibleRoomVersion is an error which is returned when the client

tokens/tokens_test.go

@@ -61,17 +61,17 @@ func serializationTestError(err error) string {
 func TestSerialization(t *testing.T) {
 	fakeToken, err := GenerateLoginToken(validTokenOp)
 	if err != nil {
-		t.Errorf(serializationTestError(err))
+		t.Errorf("%s", serializationTestError(err))
 	}
 
 	fakeMacaroon, err := deSerializeMacaroon(fakeToken)
 	if err != nil {
-		t.Errorf(serializationTestError(err))
+		t.Errorf("%s", serializationTestError(err))
 	}
 
 	sameFakeToken, err := serializeMacaroon(fakeMacaroon)
 	if err != nil {
-		t.Errorf(serializationTestError(err))
+		t.Errorf("%s", serializationTestError(err))
 	}
 
 	if sameFakeToken != fakeToken {