Page MenuHomePhorge
Files F85829828

No OneTemporary
Actions

Authored By
Unknown
Size
4 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/changelog.d/c2s-hardening.security b/changelog.d/c2s-hardening.security
new file mode 100644
index 000000000..e10756143
--- /dev/null
+++ b/changelog.d/c2s-hardening.security
@@ -0,0 +1 @@
+Reject EmojiReact activities whose name is not a single emoji shortcode
diff --git a/lib/pleroma/emoji.ex b/lib/pleroma/emoji.ex
index 2fe425955..a8574b41e 100644
--- a/lib/pleroma/emoji.ex
+++ b/lib/pleroma/emoji.ex
@@ -145,7 +145,7 @@ defmodule Pleroma.Emoji do
def unicode?(_), do: false
- @emoji_regex ~r/:[A-Za-z0-9_-]+(@.+)?:/
+ @emoji_regex ~r/\A:[A-Za-z0-9_-]+(@[A-Za-z0-9_.-]+)?:\z/
def custom?(s) when is_binary(s), do: Regex.match?(@emoji_regex, s)
diff --git a/test/pleroma/emoji_test.exs b/test/pleroma/emoji_test.exs
index 85f4e8bbf..38acd3ab9 100644
--- a/test/pleroma/emoji_test.exs
+++ b/test/pleroma/emoji_test.exs
@@ -29,6 +29,21 @@ defmodule Pleroma.EmojiTest do
end
end
+ describe "custom?/1" do
+ test "accepts exactly one custom emoji shortcode" do
+ assert Emoji.custom?(":blobcat:")
+ assert Emoji.custom?(":blob_cat-2:")
+ assert Emoji.custom?(":blobcat@remote.example:")
+ assert Emoji.custom?(":blobcat@.:")
+
+ refute Emoji.custom?("blobcat")
+ refute Emoji.custom?("visit evil.example now :x: <b>bold</b>")
+ refute Emoji.custom?(":x: and more")
+ refute Emoji.custom?(":blobcat@<b>x</b>:")
+ refute Emoji.custom?(":blobcat:\n")
+ end
+ end
+
describe "get_all/0" do
setup do
emoji_list = Emoji.get_all()
diff --git a/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs b/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs
new file mode 100644
index 000000000..067550f08
--- /dev/null
+++ b/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs
@@ -0,0 +1,75 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.ActivityPubControllerC2STest do
+ # Regression tests for the C2S audit of 2026-10-30. C2S sends client JSON
+ # through the local pipeline, so the rules that CommonAPI enforces must also
+ # hold here.
+ use Pleroma.Web.ConnCase
+ use Oban.Testing, repo: Pleroma.Repo
+
+ alias Pleroma.Object
+ alias Pleroma.Web.CommonAPI
+
+ import Pleroma.Factory
+
+ setup do
+ Mox.stub_with(Pleroma.UnstubbedConfigMock, Pleroma.Test.StaticConfig)
+ :ok
+ end
+
+ setup_all do
+ Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+ :ok
+ end
+
+ setup do: clear_config([:instance, :federating], true)
+
+ defp post_outbox(conn, user, data, status) do
+ conn
+ |> assign(:user, user)
+ |> put_req_header("content-type", "application/activity+json")
+ |> post("/users/#{user.nickname}/outbox", data)
+ |> json_response(status)
+ end
+
+ defp emoji_tag(name, url) do
+ %{"type" => "Emoji", "name" => name, "icon" => %{"type" => "Image", "url" => url}}
+ end
+
+ describe "EmojiReact" do
+ setup do
+ {:ok, activity} = CommonAPI.post(insert(:user), %{status: "hi"})
+ %{object_id: activity.data["object"]}
+ end
+
+ test "rejects a reaction name that is not a single emoji", %{conn: conn, object_id: id} do
+ name = "visit evil.example now :x: <b>bold</b>"
+
+ data = %{
+ "type" => "EmojiReact",
+ "object" => id,
+ "content" => name,
+ "tag" => [emoji_tag(name, "https://tracker.example/pixel.png")]
+ }
+
+ post_outbox(conn, insert(:user), data, 400)
+ assert Object.get_by_ap_id(id).data["reactions"] in [nil, []]
+ end
+
+ test "accepts a custom emoji with a remote image", %{conn: conn, object_id: id} do
+ data = %{
+ "type" => "EmojiReact",
+ "object" => id,
+ "content" => ":blobcat:",
+ "tag" => [emoji_tag("blobcat", "https://remote.example/blobcat.png")]
+ }
+
+ post_outbox(conn, insert(:user), data, 201)
+
+ assert [["blobcat", [_], "https://remote.example/blobcat.png"]] =
+ Object.get_by_ap_id(id).data["reactions"]
+ end
+ end
+end

File Metadata

Mime Type
text/x-diff
Expires
Sun, Nov 1, 12:50 AM (17 h, 49 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1801993
Default Alt Text
(4 KB)

Event Timeline