make sure media attachments are not from a blocked account, CDN, or their subdomains

3 files changed, 9 insertions, 5 deletions

diff --git a/app/controllers/media_proxy_controller.rb b/app/controllers/media_proxy_controller.rb
index d820b257e..c46fc2124 100644
--- a/app/controllers/media_proxy_controller.rb
+++ b/app/controllers/media_proxy_controller.rb
@@ -7,7 +7,7 @@ class MediaProxyController < ApplicationController
     RedisLock.acquire(lock_options) do |lock|
       if lock.acquired?
         @media_attachment = MediaAttachment.remote.find(params[:id])
-        redownload! if @media_attachment.needs_redownload? && !reject_media?
+        redownload! if !@media_attachment.blocked? && @media_attachment.needs_redownload?
       else
         raise Mastodon::RaceConditionError
       end
@@ -35,8 +35,4 @@ class MediaProxyController < ApplicationController
   def lock_options
     { redis: Redis.current, key: "media_download:#{params[:id]}" }
   end
-
-  def reject_media?
-    DomainBlock.find_by(domain: @media_attachment.account.domain)&.reject_media?
-  end
 end
diff --git a/app/models/media_attachment.rb b/app/models/media_attachment.rb
index 932632b20..f624e0721 100644
--- a/app/models/media_attachment.rb
+++ b/app/models/media_attachment.rb
@@ -161,6 +161,13 @@ class MediaAttachment < ApplicationRecord
     (file.blank? || (Paperclip::Attachment.default_options[:storage] == :filesystem && !File.exist?(file.path))) && remote_url.present?
   end
 
+  def blocked?
+    domains = Set[self.account.domain]
+    domains.add(remote_url.scan(/[\w\-]+\.[\w\-]+(?:\.[\w\-]+)*/).first) if remote_url.present?
+    blocks = DomainBlock.suspend.or(DomainBlock.where(reject_media: true))
+    domains.any? { |domain| blocks.where(domain: domain).or(blocks.where('domain LIKE ?', "%.#{domain}")).exists? }
+  end
+
   def video_or_audio?
     video? || gifv? || audio?
   end
diff --git a/app/workers/fetch_media_worker.rb b/app/workers/fetch_media_worker.rb
index 5dc8cc84b..8b17186a3 100644
--- a/app/workers/fetch_media_worker.rb
+++ b/app/workers/fetch_media_worker.rb
@@ -5,6 +5,7 @@ class FetchMediaWorker
 
   def perform(media_attachment_id, remote_url = nil)
     object = MediaAttachment.find(media_attachment_id.to_i)
+    return if object.blocked?
     if remote_url.nil?
       return if object.remote_url.nil?
     else