Page MenuHomePhorge
Files F85825368

No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/lib/pleroma/web/activity_pub/object_validators/user_validator.ex b/lib/pleroma/web/activity_pub/object_validators/user_validator.ex
index 183be4940..a368ccc16 100644
--- a/lib/pleroma/web/activity_pub/object_validators/user_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/user_validator.ex
@@ -10,7 +10,8 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.UserValidator do
addressing and visibility checks, and map signature key ids back to
the actor. If an actor could point any of these at another host, it
could redirect our signed deliveries or claim another actor's
- collections. Optional fields are only checked when present.
+ collections. Optional fields are only checked when present; null and
+ empty strings count as missing.
Based on Akkoma's UserValidator.
"""
@@ -38,7 +39,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.UserValidator do
def validate(_data, _meta), do: {:error, "Actor has no id"}
- defp same_origin?(_id, nil), do: true
+ defp same_origin?(_id, value) when value in [nil, ""], do: true
defp same_origin?(id, %{"id" => value}), do: same_origin?(id, value)
defp same_origin?(id, value), do: Containment.same_origin(id, value) == :ok
diff --git a/test/pleroma/web/activity_pub/object_validators/user_validator_test.exs b/test/pleroma/web/activity_pub/object_validators/user_validator_test.exs
index 91b33b9e2..fbc89462e 100644
--- a/test/pleroma/web/activity_pub/object_validators/user_validator_test.exs
+++ b/test/pleroma/web/activity_pub/object_validators/user_validator_test.exs
@@ -32,6 +32,16 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.UserValidatorTest do
end
end
+ test "treats empty and null fields as missing" do
+ data =
+ actor()
+ |> Map.merge(%{"inbox" => "", "followers" => nil, "following" => "", "featured" => ""})
+ |> put_in(["endpoints", "sharedInbox"], "")
+ |> put_in(["publicKey", "id"], "")
+
+ assert {:ok, _, _} = UserValidator.validate(data, [])
+ end
+
for field <- ["inbox", "followers", "following", "featured"] do
test "rejects an actor whose #{field} is on another host" do
data = Map.put(actor(), unquote(field), "https://victim.example/users/lain/x")

File Metadata

Mime Type
text/x-diff
Expires
Fri, Oct 30, 12:19 AM (1 d, 14 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1798973
Default Alt Text
(2 KB)

Event Timeline