Page MenuHomePhorge
Files F85829838

No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/changelog.d/c2s-hardening.security b/changelog.d/c2s-hardening.security
index 134d674bd..97a60bebc 100644
--- a/changelog.d/c2s-hardening.security
+++ b/changelog.d/c2s-hardening.security
@@ -7,3 +7,4 @@ Reject local replies to and quotes of posts the author cannot see or quote
Local posts and edits only accept own uploads as attachments, within the attachment and description limits, and emoji with shortcode names
C2S: the server sets publish time, context and other server-owned fields of new objects, scrubs their HTML and counts contentMap toward the character limit
Feeds scrub post content like the Mastodon API and no longer fail on posts without a publish time
+C2S: reject bare objects that are not wrapped in an activity
diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
index 69d8d9acf..25f45783d 100644
--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@@ -29,6 +29,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
alias Pleroma.Web.Plugs.OAuthScopesPlug
require Logger
+ require Pleroma.Constants
action_fallback(:errors)
@@ -666,6 +667,10 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
defp check_allowed_action(%{ap_id: ap_id}, %{"type" => "Update", "object" => %{"id" => ap_id}}),
do: {:error, "Updating profile is not currently supported in C2S"}
+ # Objects must come wrapped in a Create, or the pipeline would store them alone.
+ defp check_allowed_action(_, %{"type" => type}) when type in Pleroma.Constants.object_types(),
+ do: {:error, "Objects must be sent in a Create activity"}
+
defp check_allowed_action(_, activity), do: {:ok, activity}
defp validate_visibility(%User{} = user, %{"type" => type, "object" => object} = activity) do
diff --git a/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs b/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs
index 7f5e446de..3784cbd2e 100644
--- a/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs
+++ b/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs
@@ -529,6 +529,23 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerC2STest do
post_outbox(conn, insert(:user), data, 201)
end
+ test "a bare object is a bad request and is not stored", %{conn: conn} do
+ user = insert(:user)
+ {:ok, post} = CommonAPI.post(user, %{status: "hi"})
+ count = Pleroma.Repo.aggregate(Object, :count)
+
+ data = %{
+ "type" => "Note",
+ "object" => post.data["object"],
+ "content" => "orphan",
+ "to" => [@public],
+ "cc" => []
+ }
+
+ post_outbox(conn, user, data, 400)
+ assert Pleroma.Repo.aggregate(Object, :count) == count
+ end
+
test "a body without an object is a bad request", %{conn: conn} do
post_outbox(conn, insert(:user), %{"type" => "Like"}, 400)
end

File Metadata

Mime Type
text/x-diff
Expires
Sun, Nov 1, 12:50 AM (16 h, 2 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1802003
Default Alt Text
(2 KB)

Event Timeline