No OneTemporary
Actions

Size

31 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/application.ex b/lib/pleroma/application.ex
	index 28a86d0aa..25fb11660 100644
	--- a/lib/pleroma/application.ex
	+++ b/lib/pleroma/application.ex
	@@ -1,296 +1,297 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Application do
	use Application

	import Cachex.Spec

	alias Pleroma.Config

	require Logger

	@name Mix.Project.config()[:name]
	@version Mix.Project.config()[:version]
	@repository Mix.Project.config()[:source_url]
	@mix_env Mix.env()

	def name, do: @name
	def version, do: @version
	def named_version, do: @name <> " " <> @version
	def repository, do: @repository

	def user_agent do
	if Process.whereis(Pleroma.Web.Endpoint) do
	case Config.get([:http, :user_agent], :default) do
	:default ->
	info = "#{Pleroma.Web.Endpoint.url()} <#{Config.get([:instance, :email], "")}>"
	named_version() <> "; " <> info

	custom ->
	custom
	end
	else
	# fallback, if endpoint is not started yet
	"Pleroma Data Loader"
	end
	end

	# See http://elixir-lang.org/docs/stable/elixir/Application.html
	# for more information on OTP Applications
	def start(_type, _args) do
	# Scrubbers are compiled at runtime and therefore will cause a conflict
	# every time the application is restarted, so we disable module
	# conflicts at runtime
	Code.compiler_options(ignore_module_conflict: true)
	# Disable warnings_as_errors at runtime, it breaks Phoenix live reload
	# due to protocol consolidation warnings
	Code.compiler_options(warnings_as_errors: false)
	Config.Holder.save_default()
	Pleroma.HTML.compile_scrubbers()
	Pleroma.Config.Oban.warn()
	Config.DeprecationWarnings.warn()
	Pleroma.Web.Plugs.HTTPSecurityPlug.warn_if_disabled()
	Pleroma.ApplicationRequirements.verify!()
	load_all_pleroma_modules()
	load_custom_modules()
	Pleroma.Docs.JSON.compile()
	limiters_setup()

	# Define workers and child supervisors to be supervised
	children =
	[
	Pleroma.Repo,
	Config.TransferTask,
	Pleroma.Emoji,
	Pleroma.Web.Plugs.RateLimiter.Supervisor,
	{Task.Supervisor, name: Pleroma.TaskSupervisor}
	] ++
	cachex_children() ++
	http_children() ++
	[
	Pleroma.Stats,
	Pleroma.JobQueueMonitor,
	{Majic.Pool, [name: Pleroma.MajicPool, pool_size: Config.get([:majic_pool, :size], 2)]},
	{Oban, Config.get(Oban)},
	Pleroma.Web.Endpoint,
	Pleroma.Web.Telemetry
	] ++
	elasticsearch_children() ++
	task_children(@mix_env) ++
	dont_run_in_test(@mix_env)

	# See http://elixir-lang.org/docs/stable/elixir/Supervisor.html
	# for other strategies and supported options
	# If we have a lot of caches, default max_restarts can cause test
	# resets to fail.
	# Go for the default 3 unless we're in test
	max_restarts =
	if @mix_env == :test do
	1000
	else
	3
	end

	opts = [strategy: :one_for_one, name: Pleroma.Supervisor, max_restarts: max_restarts]

	with {:ok, data} <- Supervisor.start_link(children, opts) do
	set_postgres_server_version()
	{:ok, data}
	else
	e ->
	Logger.error("Failed to start!")
	Logger.error("#{inspect(e)}")
	e
	end
	end

	defp set_postgres_server_version do
	version =
	with %{rows: [[version]]} <- Ecto.Adapters.SQL.query!(Pleroma.Repo, "show server_version"),
	{num, _} <- Float.parse(version) do
	num
	else
	e ->
	Logger.warning(
	"Could not get the postgres version: #{inspect(e)}.\nSetting the default value of 9.6"
	)

	9.6
	end

	:persistent_term.put({Pleroma.Repo, :postgres_version}, version)
	end

	def load_custom_modules do
	dir = Config.get([:modules, :runtime_dir])

	if dir && File.exists?(dir) do
	dir
	\|> Pleroma.Utils.compile_dir()
	\|> case do
	{:error, _errors, _warnings} ->
	raise "Invalid custom modules"

	{:ok, modules, _warnings} ->
	if @mix_env != :test do
	Enum.each(modules, fn mod ->
	Logger.info("Custom module loaded: #{inspect(mod)}")
	end)
	end

	:ok
	end
	end
	end

	def load_all_pleroma_modules do
	:code.all_available()
	\|> Enum.filter(fn {mod, _, _} ->
	mod
	\|> to_string()
	\|> String.starts_with?("Elixir.Pleroma.")
	end)
	\|> Enum.map(fn {mod, _, _} ->
	mod
	\|> to_string()
	\|> String.to_existing_atom()
	\|> Code.ensure_loaded!()
	end)

	# Use this when 1.15 is standard
	# \|> Code.ensure_all_loaded!()
	end

	defp cachex_children do
	[
	build_cachex("used_captcha", ttl_interval: seconds_valid_interval()),
	build_cachex("user", default_ttl: 25_000, ttl_interval: 1000, limit: 2500),
	build_cachex("object", default_ttl: 25_000, ttl_interval: 1000, limit: 2500),
	build_cachex("rich_media", default_ttl: :timer.minutes(120), limit: 5000),
	build_cachex("scrubber", limit: 2500),
	build_cachex("scrubber_management", limit: 2500),
	build_cachex("idempotency", expiration: idempotency_expiration(), limit: 2500),
	build_cachex("web_resp", limit: 2500),
	build_cachex("emoji_packs", expiration: emoji_packs_expiration(), limit: 10),
	build_cachex("failed_proxy_url", limit: 2500),
	build_cachex("banned_urls", default_ttl: :timer.hours(24 * 30), limit: 5_000),
	build_cachex("translations", default_ttl: :timer.hours(24 * 30), limit: 2500),
	build_cachex("instances", default_ttl: :timer.hours(24), ttl_interval: 1000, limit: 2500),
	build_cachex("request_signatures", default_ttl: :timer.hours(24 * 30), limit: 3000),
	- build_cachex("rel_me", default_ttl: :timer.hours(24 * 30), limit: 300)
	+ build_cachex("rel_me", default_ttl: :timer.hours(24 * 30), limit: 300),
	+ build_cachex("http_backoff", default_ttl: :timer.hours(24 * 30), limit: 10000)
	]
	end

	defp emoji_packs_expiration,
	do: expiration(default: :timer.seconds(5 * 60), interval: :timer.seconds(60))

	defp idempotency_expiration,
	do: expiration(default: :timer.seconds(6 * 60 * 60), interval: :timer.seconds(60))

	defp seconds_valid_interval,
	do: :timer.seconds(Config.get!([Pleroma.Captcha, :seconds_valid]))

	@spec build_cachex(String.t(), keyword()) :: map()
	def build_cachex(type, opts),
	do: %{
	id: String.to_atom("cachex_" <> type),
	start: {Cachex, :start_link, [String.to_atom(type <> "_cache"), opts]},
	type: :worker
	}

	defp dont_run_in_test(env) when env in [:test, :benchmark], do: []

	defp dont_run_in_test(_) do
	[
	{Registry,
	[
	name: Pleroma.Web.Streamer.registry(),
	keys: :duplicate,
	partitions: System.schedulers_online()
	]}
	] ++ background_migrators()
	end

	defp background_migrators do
	[
	Pleroma.Migrators.HashtagsTableMigrator
	]
	end

	@spec task_children(atom()) :: [map()]

	defp task_children(:test) do
	[
	%{
	id: :web_push_init,
	start: {Task, :start_link, [&Pleroma.Web.Push.init/0]},
	restart: :temporary
	}
	]
	end

	defp task_children(_) do
	[
	%{
	id: :web_push_init,
	start: {Task, :start_link, [&Pleroma.Web.Push.init/0]},
	restart: :temporary
	},
	%{
	id: :internal_fetch_init,
	start: {Task, :start_link, [&Pleroma.Web.ActivityPub.InternalFetchActor.init/0]},
	restart: :temporary
	}
	]
	end

	@spec elasticsearch_children :: [Pleroma.Search.Elasticsearch.Cluster]
	def elasticsearch_children do
	config = Config.get([Pleroma.Search, :module])

	if config == Pleroma.Search.Elasticsearch do
	[Pleroma.Search.Elasticsearch.Cluster]
	else
	[]
	end
	end

	@spec limiters_setup() :: :ok
	def limiters_setup do
	config = Config.get(ConcurrentLimiter, [])

	[
	Pleroma.Web.RichMedia.Helpers,
	Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy,
	Pleroma.Search
	]
	\|> Enum.each(fn module ->
	mod_config = Keyword.get(config, module, [])

	max_running = Keyword.get(mod_config, :max_running, 5)
	max_waiting = Keyword.get(mod_config, :max_waiting, 5)

	ConcurrentLimiter.new(module, max_running, max_waiting)
	end)
	end

	defp http_children do
	proxy_url = Config.get([:http, :proxy_url])
	proxy = Pleroma.HTTP.AdapterHelper.format_proxy(proxy_url)
	pool_size = Config.get([:http, :pool_size])

	:public_key.cacerts_load()

	config =
	[:http, :adapter]
	\|> Config.get([])
	\|> Pleroma.HTTP.AdapterHelper.add_pool_size(pool_size)
	\|> Pleroma.HTTP.AdapterHelper.maybe_add_proxy_pool(proxy)
	\|> Pleroma.HTTP.AdapterHelper.ensure_ipv6()
	\|> Keyword.put(:name, MyFinch)

	[{Finch, config}]
	end
	end
	diff --git a/lib/pleroma/http/backoff.ex b/lib/pleroma/http/backoff.ex
	new file mode 100644
	index 000000000..d51c0547a
	--- /dev/null
	+++ b/lib/pleroma/http/backoff.ex
	@@ -0,0 +1,57 @@
	+defmodule Pleroma.HTTP.Backoff do
	+ alias Pleroma.HTTP
	+ require Logger
	+
	+ @cachex Pleroma.Config.get([:cachex, :provider], Cachex)
	+ @backoff_cache :http_backoff_cache
	+
	+ defp next_backoff_timestamp(%{headers: headers}) when is_list(headers) do
	+ # figure out from the 429 response when we can make the next request
	+ # mastodon uses the x-ratelimit-reset header, so we will use that!
	+ # other servers may not, so we'll default to 5 minutes from now if we can't find it
	+ case Enum.find_value(headers, fn {"x-ratelimit-reset", value} -> value end) do
	+ nil ->
	+ DateTime.utc_now()
	+ \|> Timex.shift(seconds: 5 * 60)
	+
	+ value ->
	+ {:ok, stamp} = DateTime.from_iso8601(value)
	+ stamp
	+ end
	+ end
	+
	+ defp next_backoff_timestamp(_), do: DateTime.utc_now() \|> Timex.shift(seconds: 5 * 60)
	+
	+ def get(url, headers \\ [], options \\ []) do
	+ # this acts as a single throughput for all GET requests
	+ # we will check if the host is in the cache, and if it is, we will automatically fail the request
	+ # this ensures that we don't hammer the server with requests, and instead wait for the backoff to expire
	+ # this is a very simple implementation, and can be improved upon!
	+ %{host: host} = URI.parse(url)
	+
	+ case @cachex.get(@backoff_cache, host) do
	+ {:ok, nil} ->
	+ case HTTP.get(url, headers, options) do
	+ {:ok, env} ->
	+ case env.status do
	+ 429 ->
	+ Logger.error("Rate limited on #{host}! Backing off...")
	+ timestamp = next_backoff_timestamp(env)
	+ ttl = Timex.diff(timestamp, DateTime.utc_now(), :seconds)
	+ # we will cache the host for 5 minutes
	+ @cachex.put(@backoff_cache, host, true, ttl)
	+ {:error, :ratelimit}
	+
	+ _ ->
	+ {:ok, env}
	+ end
	+
	+ {:error, env} ->
	+ {:error, env}
	+ end
	+
	+ _ ->
	+ {:error, :ratelimit}
	+ end
	+ end
	+end
	diff --git a/lib/pleroma/object/fetcher.ex b/lib/pleroma/object/fetcher.ex
	index b9d8dbaaa..937026e04 100644
	--- a/lib/pleroma/object/fetcher.ex
	+++ b/lib/pleroma/object/fetcher.ex
	@@ -1,401 +1,401 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Object.Fetcher do
	alias Pleroma.HTTP
	alias Pleroma.Instances
	alias Pleroma.Maps
	alias Pleroma.Object
	alias Pleroma.Object.Containment
	alias Pleroma.Repo
	alias Pleroma.Signature
	alias Pleroma.Web.ActivityPub.InternalFetchActor
	alias Pleroma.Web.ActivityPub.ObjectValidator
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.Federator

	require Logger
	require Pleroma.Constants

	@moduledoc """
	This module deals with correctly fetching Acitivity Pub objects in a safe way.

	The core function is `fetch_and_contain_remote_object_from_id/1` which performs
	the actual fetch and common safety and authenticity checks. Other `fetch_*`
	function use the former and perform some additional tasks
	"""

	@mix_env Mix.env()

	defp touch_changeset(changeset) do
	updated_at =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.truncate(:second)

	Ecto.Changeset.put_change(changeset, :updated_at, updated_at)
	end

	defp maybe_reinject_internal_fields(%{data: %{} = old_data}, new_data) do
	has_history? = fn
	%{"formerRepresentations" => %{"orderedItems" => list}} when is_list(list) -> true
	_ -> false
	end

	internal_fields = Map.take(old_data, Pleroma.Constants.object_internal_fields())

	remote_history_exists? = has_history?.(new_data)

	# If the remote history exists, we treat that as the only source of truth.
	new_data =
	if has_history?.(old_data) and not remote_history_exists? do
	Map.put(new_data, "formerRepresentations", old_data["formerRepresentations"])
	else
	new_data
	end

	# If the remote does not have history information, we need to manage it ourselves
	new_data =
	if not remote_history_exists? do
	changed? =
	Pleroma.Constants.status_updatable_fields()
	\|> Enum.any?(fn field -> Map.get(old_data, field) != Map.get(new_data, field) end)

	%{updated_object: updated_object} =
	new_data
	\|> Object.Updater.maybe_update_history(old_data,
	updated: changed?,
	use_history_in_new_object?: false
	)

	updated_object
	else
	new_data
	end

	Map.merge(new_data, internal_fields)
	end

	defp maybe_reinject_internal_fields(_, new_data), do: new_data

	@spec reinject_object(struct(), map()) :: {:ok, Object.t()} \| {:error, any()}
	defp reinject_object(%Object{data: %{"type" => "Question"}} = object, new_data) do
	Logger.debug("Reinjecting object #{new_data["id"]}")

	with data <- maybe_reinject_internal_fields(object, new_data),
	{:ok, data, _} <- ObjectValidator.validate(data, %{}),
	changeset <- Object.change(object, %{data: data}),
	changeset <- touch_changeset(changeset),
	{:ok, object} <- Repo.insert_or_update(changeset),
	{:ok, object} <- Object.set_cache(object) do
	{:ok, object}
	else
	e ->
	Logger.error("Error while processing object: #{inspect(e)}")
	{:error, e}
	end
	end

	defp reinject_object(%Object{} = object, new_data) do
	Logger.debug("Reinjecting object #{new_data["id"]}")

	with new_data <- Transmogrifier.fix_object(new_data),
	data <- maybe_reinject_internal_fields(object, new_data),
	changeset <- Object.change(object, %{data: data}),
	changeset <- touch_changeset(changeset),
	{:ok, object} <- Repo.insert_or_update(changeset),
	{:ok, object} <- Object.set_cache(object) do
	{:ok, object}
	else
	e ->
	Logger.error("Error while processing object: #{inspect(e)}")
	{:error, e}
	end
	end

	@doc "Assumes object already is in our database and refetches from remote to update (e.g. for polls)"
	def refetch_object(%Object{data: %{"id" => id}} = object) do
	with {:local, false} <- {:local, Object.local?(object)},
	{:ok, new_data} <- fetch_and_contain_remote_object_from_id(id),
	{:id, true} <- {:id, new_data["id"] == id},
	{:ok, object} <- reinject_object(object, new_data) do
	{:ok, object}
	else
	{:local, true} -> {:ok, object}
	{:id, false} -> {:error, :id_mismatch}
	e -> {:error, e}
	end
	end

	@doc """
	Fetches a new object and puts it through the processing pipeline for inbound objects

	Note: will also insert a fake Create activity, since atm we internally
	need everything to be traced back to a Create activity.
	"""
	def fetch_object_from_id(id, options \\ []) do
	with %URI{} = uri <- URI.parse(id),
	# let's check the URI is even vaguely valid first
	{:valid_uri_scheme, true} <-
	{:valid_uri_scheme, uri.scheme == "http" or uri.scheme == "https"},
	# If we have instance restrictions, apply them here to prevent fetching from unwanted instances
	{:mrf_reject_check, {:ok, nil}} <-
	{:mrf_reject_check, Pleroma.Web.ActivityPub.MRF.SimplePolicy.check_reject(uri)},
	{:mrf_accept_check, {:ok, _}} <-
	{:mrf_accept_check, Pleroma.Web.ActivityPub.MRF.SimplePolicy.check_accept(uri)},
	{_, nil} <- {:fetch_object, Object.get_cached_by_ap_id(id)},
	{_, true} <- {:allowed_depth, Federator.allowed_thread_distance?(options[:depth])},
	{_, {:ok, data}} <- {:fetch, fetch_and_contain_remote_object_from_id(id)},
	{_, nil} <- {:normalize, Object.normalize(data, fetch: false)},
	params <- prepare_activity_params(data),
	{_, {:ok, activity}} <-
	{:transmogrifier, Transmogrifier.handle_incoming(params, options)},
	{_, _data, %Object{} = object} <-
	{:object, data, Object.normalize(activity, fetch: false)} do
	{:ok, object}
	else
	{:allowed_depth, false} = e ->
	log_fetch_error(id, e)
	{:error, :allowed_depth}

	{:valid_uri_scheme, _} = e ->
	log_fetch_error(id, e)
	{:error, :invalid_uri_scheme}

	{:mrf_reject_check, _} = e ->
	log_fetch_error(id, e)
	{:reject, :mrf}

	{:mrf_accept_check, _} = e ->
	log_fetch_error(id, e)
	{:reject, :mrf}

	{:containment, reason} = e ->
	log_fetch_error(id, e)
	{:error, reason}

	{:transmogrifier, {:error, {:reject, reason}}} = e ->
	log_fetch_error(id, e)
	{:reject, reason}

	{:transmogrifier, {:reject, reason}} = e ->
	log_fetch_error(id, e)
	{:reject, reason}

	{:transmogrifier, reason} = e ->
	log_fetch_error(id, e)
	{:error, reason}

	{:object, data, nil} ->
	reinject_object(%Object{}, data)

	{:normalize, object = %Object{}} ->
	{:ok, object}

	{:fetch_object, %Object{} = object} ->
	{:ok, object}

	{:fetch, {:error, reason}} = e ->
	log_fetch_error(id, e)
	{:error, reason}

	e ->
	log_fetch_error(id, e)
	{:error, e}
	end
	end

	defp log_fetch_error(id, error) do
	Logger.metadata(object: id)
	Logger.error("Object rejected while fetching #{id} #{inspect(error)}")
	end

	defp prepare_activity_params(data) do
	%{
	"type" => "Create",
	# Should we seriously keep this attributedTo thing?
	"actor" => data["actor"] \|\| data["attributedTo"],
	"object" => data
	}
	\|> Maps.put_if_present("to", data["to"])
	\|> Maps.put_if_present("cc", data["cc"])
	\|> Maps.put_if_present("bto", data["bto"])
	\|> Maps.put_if_present("bcc", data["bcc"])
	end

	defp make_signature(id, date) do
	uri = URI.parse(id)

	signature =
	InternalFetchActor.get_actor()
	\|> Signature.sign(%{
	"(request-target)": "get #{uri.path}",
	host: uri.host,
	date: date
	})

	{"signature", signature}
	end

	defp sign_fetch(headers, id, date) do
	if Pleroma.Config.get([:activitypub, :sign_object_fetches]) do
	[make_signature(id, date) \| headers]
	else
	headers
	end
	end

	defp maybe_date_fetch(headers, date) do
	if Pleroma.Config.get([:activitypub, :sign_object_fetches]) do
	[{"date", date} \| headers]
	else
	headers
	end
	end

	@doc "Fetches arbitrary remote object and performs basic safety and authenticity checks"
	def fetch_and_contain_remote_object_from_id(id)

	def fetch_and_contain_remote_object_from_id(%{"id" => id}),
	do: fetch_and_contain_remote_object_from_id(id)

	def fetch_and_contain_remote_object_from_id(id) when is_binary(id) do
	Logger.debug("Fetching object #{id} via AP")

	with {:valid_uri_scheme, true} <- {:valid_uri_scheme, String.starts_with?(id, "http")},
	%URI{} = uri <- URI.parse(id),
	{:mrf_reject_check, {:ok, nil}} <-
	{:mrf_reject_check, Pleroma.Web.ActivityPub.MRF.SimplePolicy.check_reject(uri)},
	{:mrf_accept_check, {:ok, _}} <-
	{:mrf_accept_check, Pleroma.Web.ActivityPub.MRF.SimplePolicy.check_accept(uri)},
	{:local_fetch, :ok} <- {:local_fetch, Containment.contain_local_fetch(id)},
	{:ok, final_id, body} <- get_object(id),
	{:ok, data} <- safe_json_decode(body),
	{_, :ok} <- {:strict_id, Containment.contain_id_to_fetch(final_id, data)},
	{_, :ok} <- {:containment, Containment.contain_origin(final_id, data)} do
	unless Instances.reachable?(final_id) do
	Instances.set_reachable(final_id)
	end

	{:ok, data}
	else
	{:strict_id, _} = e ->
	log_fetch_error(id, e)
	{:error, :id_mismatch}

	{:mrf_reject_check, _} = e ->
	log_fetch_error(id, e)
	{:reject, :mrf}

	{:mrf_accept_check, _} = e ->
	log_fetch_error(id, e)
	{:reject, :mrf}

	{:valid_uri_scheme, _} = e ->
	log_fetch_error(id, e)
	{:error, :invalid_uri_scheme}

	{:local_fetch, _} = e ->
	log_fetch_error(id, e)
	{:error, :local_resource}

	{:containment, reason} ->
	log_fetch_error(id, reason)
	{:error, reason}

	{:error, e} ->
	{:error, e}

	e ->
	{:error, e}
	end
	end

	def fetch_and_contain_remote_object_from_id(_id),
	do: {:error, :invalid_id}

	defp check_crossdomain_redirect(final_host, original_url)

	# HOPEFULLY TEMPORARY
	# Basically none of our Tesla mocks in tests set the (supposed to
	# exist for Tesla proper) url parameter for their responses
	# causing almost every fetch in test to fail otherwise
	if @mix_env == :test do
	defp check_crossdomain_redirect(nil, _) do
	{:cross_domain_redirect, false}
	end
	end

	defp check_crossdomain_redirect(final_host, original_url) do
	{:cross_domain_redirect, final_host != URI.parse(original_url).host}
	end

	if @mix_env == :test do
	defp get_final_id(nil, initial_url), do: initial_url
	defp get_final_id("", initial_url), do: initial_url
	end

	defp get_final_id(final_url, _intial_url) do
	final_url
	end

	@doc "Do NOT use; only public for use in tests"
	def get_object(id) do
	date = Pleroma.Signature.signed_date()

	headers =
	[
	# The first is required by spec, the second provided as a fallback for buggy implementations
	{"accept", "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""},
	{"accept", "application/activity+json"}
	]
	\|> maybe_date_fetch(date)
	\|> sign_fetch(id, date)

	with {:ok, %{body: body, status: code, headers: headers, url: final_url}}
	when code in 200..299 <-
	- HTTP.get(id, headers),
	+ HTTP.Backoff.get(id, headers),
	remote_host <-
	URI.parse(final_url).host,
	{:cross_domain_redirect, false} <-
	check_crossdomain_redirect(remote_host, id),
	{:has_content_type, {_, content_type}} <-
	{:has_content_type, List.keyfind(headers, "content-type", 0)},
	{:parse_content_type, {:ok, "application", subtype, type_params}} <-
	{:parse_content_type, Plug.Conn.Utils.media_type(content_type)} do
	final_id = get_final_id(final_url, id)

	case {subtype, type_params} do
	{"activity+json", _} ->
	{:ok, final_id, body}

	{"ld+json", %{"profile" => "https://www.w3.org/ns/activitystreams"}} ->
	{:ok, final_id, body}

	_ ->
	{:error, {:content_type, content_type}}
	end
	else
	{:ok, %{status: code}} when code in [401, 403] ->
	{:error, :forbidden}

	{:ok, %{status: code}} when code in [404, 410] ->
	{:error, :not_found}

	{:error, e} ->
	{:error, e}

	{:has_content_type, _} ->
	{:error, {:content_type, nil}}

	{:parse_content_type, e} ->
	{:error, {:content_type, e}}

	e ->
	{:error, e}
	end
	end

	defp safe_json_decode(nil), do: {:ok, nil}
	defp safe_json_decode(json), do: Jason.decode(json)
	end
	diff --git a/lib/pleroma/web/web_finger.ex b/lib/pleroma/web/web_finger.ex
	index 9d5efbb3e..280ed236e 100644
	--- a/lib/pleroma/web/web_finger.ex
	+++ b/lib/pleroma/web/web_finger.ex
	@@ -1,226 +1,227 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.WebFinger do
	alias Pleroma.HTTP
	alias Pleroma.User
	alias Pleroma.Web.Endpoint
	alias Pleroma.Web.Federator.Publisher
	alias Pleroma.Web.XML
	alias Pleroma.XmlBuilder
	require Jason
	require Logger

	def host_meta do
	base_url = Endpoint.url()

	{
	:XRD,
	%{xmlns: "http://docs.oasis-open.org/ns/xri/xrd-1.0"},
	{
	:Link,
	%{
	rel: "lrdd",
	type: "application/xrd+xml",
	template: "#{base_url}/.well-known/webfinger?resource={uri}"
	}
	}
	}
	\|> XmlBuilder.to_doc()
	end

	def webfinger(resource, fmt) when fmt in ["XML", "JSON"] do
	host = Pleroma.Web.Endpoint.host()

	regex =
	if webfinger_domain = Pleroma.Config.get([__MODULE__, :domain]) do
	~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@(#{host}\|#{webfinger_domain})/
	else
	~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@#{host}/
	end

	with %{"username" => username} <- Regex.named_captures(regex, resource),
	%User{} = user <- User.get_cached_by_nickname(username) do
	{:ok, represent_user(user, fmt)}
	else
	_e ->
	with %User{} = user <- User.get_cached_by_ap_id(resource) do
	{:ok, represent_user(user, fmt)}
	else
	_e ->
	{:error, "Couldn't find user"}
	end
	end
	end

	defp gather_links(%User{} = user) do
	[
	%{
	"rel" => "http://webfinger.net/rel/profile-page",
	"type" => "text/html",
	"href" => user.ap_id
	}
	] ++ Publisher.gather_webfinger_links(user)
	end

	defp gather_aliases(%User{} = user) do
	[user.ap_id]
	end

	def represent_user(user, "JSON") do
	%{
	"subject" => "acct:#{user.nickname}@#{domain()}",
	"aliases" => gather_aliases(user),
	"links" => gather_links(user)
	}
	end

	def represent_user(user, "XML") do
	aliases =
	user
	\|> gather_aliases()
	\|> Enum.map(&{:Alias, &1})

	links =
	gather_links(user)
	\|> Enum.map(fn link -> {:Link, link} end)

	{
	:XRD,
	%{xmlns: "http://docs.oasis-open.org/ns/xri/xrd-1.0"},
	[
	{:Subject, "acct:#{user.nickname}@#{domain()}"}
	] ++ aliases ++ links
	}
	\|> XmlBuilder.to_doc()
	end

	def domain do
	Pleroma.Config.get([__MODULE__, :domain]) \|\| Pleroma.Web.Endpoint.host()
	end

	@spec webfinger_from_xml(binary()) :: {:ok, map()} \| nil
	defp webfinger_from_xml(body) do
	with {:ok, doc} <- XML.parse_document(body) do
	subject = XML.string_from_xpath("//Subject", doc)

	subscribe_address =
	~s{//Link[@rel="http://ostatus.org/schema/1.0/subscribe"]/@template}
	\|> XML.string_from_xpath(doc)

	ap_id =
	~s{//Link[@rel="self" and @type="application/activity+json"]/@href}
	\|> XML.string_from_xpath(doc)

	data = %{
	"subject" => subject,
	"subscribe_address" => subscribe_address,
	"ap_id" => ap_id
	}

	{:ok, data}
	end
	end

	defp webfinger_from_json(body) do
	with {:ok, doc} <- Jason.decode(body) do
	data =
	Enum.reduce(doc["links"], %{"subject" => doc["subject"]}, fn link, data ->
	case {link["type"], link["rel"]} do
	{"application/activity+json", "self"} ->
	Map.put(data, "ap_id", link["href"])

	{"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"", "self"} ->
	Map.put(data, "ap_id", link["href"])

	{nil, "http://ostatus.org/schema/1.0/subscribe"} ->
	Map.put(data, "subscribe_address", link["template"])

	_ ->
	Logger.debug("Unhandled type: #{inspect(link["type"])}")
	data
	end
	end)

	{:ok, data}
	end
	end

	def get_template_from_xml(body) do
	xpath = "//Link[@rel='lrdd']/@template"

	with {:ok, doc} <- XML.parse_document(body),
	template when template != nil <- XML.string_from_xpath(xpath, doc) do
	{:ok, template}
	end
	end

	def find_lrdd_template(domain) do
	# WebFinger is restricted to HTTPS - https://tools.ietf.org/html/rfc7033#section-9.1
	meta_url = "https://#{domain}/.well-known/host-meta"

	- with {:ok, %{status: status, body: body}} when status in 200..299 <- HTTP.get(meta_url) do
	+ with {:ok, %{status: status, body: body}} when status in 200..299 <-
	+ HTTP.Backoff.get(meta_url) do
	get_template_from_xml(body)
	else
	error ->
	Logger.warning("Can't find LRDD template in #{inspect(meta_url)}: #{inspect(error)}")
	{:error, :lrdd_not_found}
	end
	end

	defp get_address_from_domain(domain, encoded_account) when is_binary(domain) do
	case find_lrdd_template(domain) do
	{:ok, template} ->
	String.replace(template, "{uri}", encoded_account)

	_ ->
	"https://#{domain}/.well-known/webfinger?resource=#{encoded_account}"
	end
	end

	defp get_address_from_domain(_, _), do: {:error, :webfinger_no_domain}

	@spec finger(String.t()) :: {:ok, map()} \| {:error, any()}
	def finger(account) do
	account = String.trim_leading(account, "@")

	domain =
	with [_name, domain] <- String.split(account, "@") do
	domain
	else
	_e ->
	URI.parse(account).host
	end

	encoded_account = URI.encode("acct:#{account}")

	with address when is_binary(address) <- get_address_from_domain(domain, encoded_account),
	{:ok, %{status: status, body: body, headers: headers}} when status in 200..299 <-
	- HTTP.get(
	+ HTTP.Backoff.get(
	address,
	[{"accept", "application/xrd+xml,application/jrd+json"}]
	) do
	case List.keyfind(headers, "content-type", 0) do
	{_, content_type} ->
	case Plug.Conn.Utils.media_type(content_type) do
	{:ok, "application", subtype, _} when subtype in ~w(xrd+xml xml) ->
	webfinger_from_xml(body)

	{:ok, "application", subtype, _} when subtype in ~w(jrd+json json) ->
	webfinger_from_json(body)

	_ ->
	{:error, {:content_type, content_type}}
	end

	_ ->
	{:error, {:content_type, nil}}
	end
	else
	error ->
	Logger.debug("Couldn't finger #{account}: #{inspect(error)}")
	error
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Aug 8, 9:30 PM (1 d, 17 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1723987
Default Alt Text: (31 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions