Page Menu
Home
Phorge
Search
Configure Global Search
Log In
Files
F85628969
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Award Token
Flag For Later
Size
13 KB
Referenced Files
None
Subscribers
None
View Options
diff --git a/test/pleroma/web/feed/user_controller_test.exs b/test/pleroma/web/feed/user_controller_test.exs
index 458f5ec8d..d12904ec0 100644
--- a/test/pleroma/web/feed/user_controller_test.exs
+++ b/test/pleroma/web/feed/user_controller_test.exs
@@ -1,426 +1,427 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.Feed.UserControllerTest do
use Pleroma.Web.ConnCase
import Pleroma.Factory
import SweetXml
alias Pleroma.Object
alias Pleroma.User
alias Pleroma.Web.CommonAPI
alias Pleroma.Web.Feed.FeedView
setup do: clear_config([:static_fe, :enabled], false)
describe "feed" do
setup do: clear_config([:feed])
setup do
clear_config(
[:feed, :post_title],
%{max_length: 15, omission: "..."}
)
activity = insert(:note_activity)
note =
insert(:note,
data: %{
"content" => "This & this is :moominmamma: note ",
"source" => "This & this is :moominmamma: note ",
"attachment" => [
%{
"url" => [
%{"mediaType" => "image/png", "href" => "https://pleroma.gov/image.png"}
]
}
],
"inReplyTo" => activity.data["id"],
"context" => "2hu & as",
"summary" => "2hu & as"
}
)
note_activity = insert(:note_activity, note: note)
user = User.get_cached_by_ap_id(note_activity.data["actor"])
note2 =
insert(:note,
user: user,
data: %{
"content" => "42 & This is :moominmamma: note ",
"inReplyTo" => activity.data["id"]
}
)
note_activity2 = insert(:note_activity, note: note2)
note3 =
insert(:note,
user: user,
data: %{
"content" => "This note tests whether HTML entities are truncated properly",
"summary" => "Won't, didn't fail",
"inReplyTo" => note_activity2.id
}
)
_note_activity3 = insert(:note_activity, note: note3)
object = Object.normalize(note_activity, fetch: false)
encoded_title = FeedView.activity_title(note3.data)
[user: user, object: object, max_id: note_activity2.id, encoded_title: encoded_title]
end
test "gets an atom feed", %{conn: conn, user: user, object: object, max_id: max_id} do
resp =
conn
|> put_req_header("accept", "application/atom+xml")
|> get(user_feed_path(conn, :feed, user.nickname))
|> response(200)
xml = SweetXml.parse(resp)
activity_titles = SweetXml.xpath(xml, ~x"//entry/title/text()"l)
assert activity_titles == [~c"Won't, didn'...", ~c"2hu", ~c"2hu & as"]
assert SweetXml.xpath(xml, ~x"//entry/link[@rel='self']/@href"sl) == []
assert length(SweetXml.xpath(xml, ~x"//entry/link[@rel='alternate']/@href"sl)) == 3
assert resp =~ FeedView.escape(object.data["content"])
assert resp =~ FeedView.escape(object.data["summary"])
assert resp =~ FeedView.escape(object.data["context"])
resp =
conn
|> put_req_header("accept", "application/atom+xml")
|> get("/users/#{user.nickname}/feed", %{"max_id" => max_id})
|> response(200)
activity_titles =
resp
|> SweetXml.parse()
|> SweetXml.xpath(~x"//entry/title/text()"l)
assert activity_titles == [~c"2hu & as"]
end
test "gets a rss feed", %{conn: conn, user: user, object: object, max_id: max_id} do
resp =
conn
|> put_req_header("accept", "application/rss+xml")
|> get("/users/#{user.nickname}/feed.rss")
|> response(200)
activity_titles =
resp
|> SweetXml.parse()
|> SweetXml.xpath(~x"//item/title/text()"l)
assert activity_titles == [~c"Won't, didn'...", ~c"2hu", ~c"2hu & as"]
assert resp =~ FeedView.escape(object.data["content"])
assert resp =~ FeedView.escape(object.data["summary"])
assert resp =~ FeedView.escape(object.data["context"])
resp =
conn
|> put_req_header("accept", "application/rss+xml")
|> get("/users/#{user.nickname}/feed.rss", %{"max_id" => max_id})
|> response(200)
activity_titles =
resp
|> SweetXml.parse()
|> SweetXml.xpath(~x"//item/title/text()"l)
assert activity_titles == [~c"2hu & as"]
end
test "escapes query parameters in feed self links", %{conn: conn, user: user} do
for format <- ~w[atom rss] do
response =
conn
|> get("/users/#{user.nickname}/feed.#{format}?first=one&second=two")
|> response(200)
assert response =~ "first=one&second=two"
refute response =~ "first=one&second=two"
end
end
test "keeps fallback summary markup inert in rendered Atom content", %{
conn: conn,
object: object,
user: user
} do
data =
object.data
|> Map.put("content", "")
|> Map.put("summary", "<script>alert('feed')</script>")
object
|> Ecto.Changeset.change(data: data)
|> Pleroma.Repo.update!()
response =
conn
|> get("/users/#{user.nickname}/feed.atom")
|> response(200)
- assert response =~ "&lt;script&gt;alert(&#39;feed&#39;)&lt;/script&gt;"
+ assert response =~
+ "&lt;script&gt;alert(&#39;feed&#39;)&lt;/script&gt;"
content_values = response |> parse() |> xpath(~x"//entry/content/text()"sl)
assert Enum.any?(content_values, fn content ->
String.starts_with?(content, "<script>alert('feed')</script>")
end)
end
test "does not expose sensitive attachments as enclosures", %{
conn: conn,
object: object,
user: user
} do
object
|> Ecto.Changeset.change(data: Map.put(object.data, "sensitive", true))
|> Pleroma.Repo.update!()
atom_response =
conn
|> get("/users/#{user.nickname}/feed.atom")
|> response(200)
rss_response =
conn
|> get("/users/#{user.nickname}/feed.rss")
|> response(200)
refute atom_response =~ "rel=\"enclosure\""
refute rss_response =~ "<enclosure "
end
test "uses enclosure fallbacks for user feeds", %{conn: conn, object: object, user: user} do
attachment = %{"url" => [%{"href" => "https://example.com/file.bin"}]}
object
|> Ecto.Changeset.change(data: Map.put(object.data, "attachment", [attachment]))
|> Pleroma.Repo.update!()
atom_xml =
conn
|> get("/users/#{user.nickname}/feed.atom")
|> response(200)
|> parse()
assert xpath(atom_xml, ~x"//entry/link[@rel='enclosure']/@href"sl) == [
"https://example.com/file.bin"
]
assert xpath(atom_xml, ~x"//entry/link[@rel='enclosure']/@type"sl) == [
"application/octet-stream"
]
assert xpath(atom_xml, ~x"//entry/link[@rel='enclosure']/@length"sl) == []
rss_xml =
conn
|> get("/users/#{user.nickname}/feed.rss")
|> response(200)
|> parse()
assert xpath(rss_xml, ~x"//item/enclosure/@url"sl) == []
assert xpath(rss_xml, ~x"//item/media:content/@url"sl) == ["https://example.com/file.bin"]
assert xpath(rss_xml, ~x"//item/media:content/@type"sl) == [
"application/octet-stream"
]
end
test "returns 404 for a missing feed", %{conn: conn} do
conn =
conn
|> put_req_header("accept", "application/atom+xml")
|> get(user_feed_path(conn, :feed, "nonexisting"))
assert response(conn, 404)
end
test "returns noindex meta for missing user", %{conn: conn} do
conn =
conn
|> put_req_header("accept", "text/html")
|> get("/users/nonexisting")
assert html_response(conn, 200) =~ "<meta content=\"noindex, noarchive\" name=\"robots\">"
end
test "returns feed with public and unlisted activities", %{conn: conn} do
user = insert(:user)
{:ok, _} = CommonAPI.post(user, %{status: "public", visibility: "public"})
{:ok, _} = CommonAPI.post(user, %{status: "direct", visibility: "direct"})
{:ok, _} = CommonAPI.post(user, %{status: "unlisted", visibility: "unlisted"})
{:ok, _} = CommonAPI.post(user, %{status: "private", visibility: "private"})
resp =
conn
|> put_req_header("accept", "application/atom+xml")
|> get(user_feed_path(conn, :feed, user.nickname))
|> response(200)
activity_titles =
resp
|> SweetXml.parse()
|> SweetXml.xpath(~x"//entry/title/text()"l)
|> Enum.sort()
assert activity_titles == [~c"public", ~c"unlisted"]
end
test "returns 404 when the user is remote", %{conn: conn} do
user = insert(:user, local: false)
{:ok, _} = CommonAPI.post(user, %{status: "test"})
assert conn
|> put_req_header("accept", "application/atom+xml")
|> get(user_feed_path(conn, :feed, user.nickname))
|> response(404)
end
test "does not require authentication on non-federating instances", %{conn: conn} do
clear_config([:instance, :federating], false)
user = insert(:user)
conn
|> put_req_header("accept", "application/rss+xml")
|> get("/users/#{user.nickname}/feed.rss")
|> response(200)
end
test "does not mangle HTML entities midway", %{
conn: conn,
user: user,
object: object,
encoded_title: encoded_title
} do
resp =
conn
|> put_req_header("accept", "application/atom+xml")
|> get(user_feed_path(conn, :feed, user.nickname))
|> response(200)
activity_titles =
resp
|> SweetXml.parse()
|> SweetXml.xpath(~x"//entry/title/text()"l)
assert activity_titles == [~c"Won't, didn'...", ~c"2hu", ~c"2hu & as"]
assert resp =~ FeedView.escape(object.data["content"])
assert resp =~ FeedView.escape(object.data["summary"])
assert resp =~ FeedView.escape(object.data["context"])
assert resp =~ encoded_title
end
end
# Note: see ActivityPubControllerTest for JSON format tests
describe "feed_redirect" do
test "with html format, it redirects to user feed", %{conn: conn} do
note_activity = insert(:note_activity)
user = User.get_cached_by_ap_id(note_activity.data["actor"])
response =
conn
|> get("/users/#{user.nickname}")
|> response(200)
assert response ==
Pleroma.Web.Fallback.RedirectController.redirector_with_meta(
conn,
%{user: user}
).resp_body
end
test "with html format, it falls back to frontend when user is remote", %{conn: conn} do
user = insert(:user, local: false)
{:ok, _} = CommonAPI.post(user, %{status: "test"})
response =
conn
|> get("/users/#{user.nickname}")
|> response(200)
assert response =~ "</html>"
end
test "with html format, it falls back to frontend when user is not found", %{conn: conn} do
response =
conn
|> get("/users/jimm")
|> response(200)
assert response =~ "</html>"
end
test "with non-html / non-json format, it redirects to user feed in atom format", %{
conn: conn
} do
note_activity = insert(:note_activity)
user = User.get_cached_by_ap_id(note_activity.data["actor"])
conn =
conn
|> put_req_header("accept", "application/xml")
|> get("/users/#{user.nickname}")
assert conn.status == 302
assert redirected_to(conn) ==
"#{Pleroma.Web.Endpoint.url()}/users/#{user.nickname}/feed.atom"
end
test "redirects to rss feed when explicitly requested", %{conn: conn} do
note_activity = insert(:note_activity)
user = User.get_cached_by_ap_id(note_activity.data["actor"])
conn =
conn
|> put_req_header("accept", "application/xml")
|> get("/users/#{user.nickname}.rss")
assert conn.status == 302
assert redirected_to(conn) ==
"#{Pleroma.Web.Endpoint.url()}/users/#{user.nickname}/feed.rss"
end
test "with non-html / non-json format, it returns error when user is not found", %{conn: conn} do
response =
conn
|> put_req_header("accept", "application/xml")
|> get(user_feed_path(conn, :feed, "jimm"))
|> response(404)
assert response == ~S({"error":"Not found"})
end
end
describe "private instance" do
setup do: clear_config([:instance, :public])
test "returns 404 for user feed", %{conn: conn} do
clear_config([:instance, :public], false)
user = insert(:user)
{:ok, _} = CommonAPI.post(user, %{status: "test"})
assert conn
|> put_req_header("accept", "application/atom+xml")
|> get(user_feed_path(conn, :feed, user.nickname))
|> response(404)
end
end
end
File Metadata
Details
Attached
Mime Type
text/x-diff
Expires
Sat, Aug 8, 4:15 PM (1 d, 22 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1723698
Default Alt Text
(13 KB)
Attached To
Mode
rPUBE pleroma-upstream
Attached
Detach File
Event Timeline
Log In to Comment