Page MenuHomePhorge
Files F85829846

No OneTemporary
Actions

Authored By
Unknown
Size
3 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/changelog.d/c2s-hardening.security b/changelog.d/c2s-hardening.security
index 97a60bebc..eb6870667 100644
--- a/changelog.d/c2s-hardening.security
+++ b/changelog.d/c2s-hardening.security
@@ -4,7 +4,7 @@ Only allow pinning own posts, and only public or unlisted ones for local users;
Validate the object of local Updates; the server builds the edit history and edit time and keeps poll results
Hold new local polls to the poll limits and reject preset vote counts
Reject local replies to and quotes of posts the author cannot see or quote
-Local posts and edits only accept own uploads as attachments, within the attachment and description limits, and emoji with shortcode names
-C2S: the server sets publish time, context and other server-owned fields of new objects, scrubs their HTML and counts contentMap toward the character limit
+Local posts and edits only accept own uploads as attachments, within the attachment and description limits
+C2S: the server sets publish time, context and other server-owned fields of new objects (also Listen), scrubs their HTML, checks emoji names and counts contentMap toward the character limit
Feeds scrub post content like the Mastodon API and no longer fail on posts without a publish time
C2S: reject bare objects that are not wrapped in an activity
diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
index 6d1d20ae8..ac4a9a9c8 100644
--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@@ -540,8 +540,8 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
@server_set_fields ~w(published updated formerRepresentations replies source url
repliesCount quotesCount)
- defp fix_user_message(%User{ap_id: actor}, %{"type" => "Create", "object" => object} = activity)
- when is_map(object) do
+ defp fix_user_message(%User{ap_id: actor}, %{"type" => type, "object" => object} = activity)
+ when type in ["Create", "Listen"] and is_map(object) do
object =
object
|> Transmogrifier.strip_internal_fields()
diff --git a/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs b/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs
index 5a9d1d02c..8fcaa3948 100644
--- a/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs
+++ b/test/pleroma/web/activity_pub/activity_pub_controller_c2s_test.exs
@@ -539,6 +539,39 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerC2STest do
post_outbox(conn, insert(:user), data, 201)
end
+ test "Listen objects get the same normalization", %{conn: conn} do
+ user = insert(:user)
+
+ data = %{
+ "type" => "Listen",
+ "to" => [@public],
+ "cc" => [],
+ "object" => %{
+ "type" => "Audio",
+ "title" => "song",
+ "artist" => "band",
+ "name" => "<script>alert(1)</script>tune",
+ "to" => [@public],
+ "cc" => [],
+ "id" => "https://evil.example/objects/1",
+ "published" => "2001-01-01T00:00:00Z",
+ "url" => "https://phish.example/"
+ }
+ }
+
+ stored = stored(post_outbox(conn, user, data, 201))
+
+ assert stored["actor"] == user.ap_id
+ refute stored["id"] == "https://evil.example/objects/1"
+ refute stored["published"] =~ "2001"
+ refute stored["url"] == "https://phish.example/"
+ refute stored["name"] =~ "<script"
+
+ clear_config([:instance, :limit], 10)
+ data = put_in(data, ["object", "name"], String.duplicate("a", 20))
+ post_outbox(conn, user, data, 400)
+ end
+
test "a bare object is a bad request and is not stored", %{conn: conn} do
user = insert(:user)
{:ok, post} = CommonAPI.post(user, %{status: "hi"})

File Metadata

Mime Type
text/x-diff
Expires
Sun, Nov 1, 12:50 AM (15 h, 13 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1802011
Default Alt Text
(3 KB)

Event Timeline