about summary refs log tree commit diff
path: root/app/lib/activitypub/activity.rb
diff options
context:
space:
mode:
authorThibG <thib@sitedethib.com>2020-07-22 11:43:17 +0200
committerGitHub <noreply@github.com>2020-07-22 11:43:17 +0200
commitbcf85b5208c936486550da0ce978098840218073 (patch)
tree10dd2d9da71622ccb7b600c0ec495f86b68fe7a7 /app/lib/activitypub/activity.rb
parenta8b6524b43235a3ce477b7594c918eaa957f27a2 (diff)
Dereference object URIs in Create and Update messages (#14359)
* Dereference object URIs in Create and Update messages

Fixes #14353

Signed-off-by: Thibaut Girka <thib@sitedethib.com>

* Refactor, and perform origin check *before* attempting to fetch object

Co-authored-by: Fire Demon <firedemon@creature.cafe>
Diffstat (limited to 'app/lib/activitypub/activity.rb')
-rw-r--r--app/lib/activitypub/activity.rb28
1 files changed, 28 insertions, 0 deletions
diff --git a/app/lib/activitypub/activity.rb b/app/lib/activitypub/activity.rb
index 0ce279d28..ab946470b 100644
--- a/app/lib/activitypub/activity.rb
+++ b/app/lib/activitypub/activity.rb
@@ -157,6 +157,34 @@ class ActivityPub::Activity
     fetch_remote_original_status
   end
 
+  def dereference_object!
+    return unless @object.is_a?(String)
+    return if invalid_origin?(@object)
+
+    object = fetch_resource(@object, true, signed_fetch_account)
+    return unless object.present? && object.is_a?(Hash) && supported_context?(object)
+
+    @object = object
+  end
+
+  def signed_fetch_account
+    first_mentioned_local_account || first_local_follower
+  end
+
+  def first_mentioned_local_account
+    audience = (as_array(@json['to']) + as_array(@json['cc'])).uniq
+    local_usernames = audience.select { |uri| ActivityPub::TagManager.instance.local_uri?(uri) }
+                              .map { |uri| ActivityPub::TagManager.instance.uri_to_local_id(uri, :username) }
+
+    return if local_usernames.empty?
+
+    Account.local.where(username: local_usernames).first
+  end
+
+  def first_local_follower
+    @account.followers.local.first
+  end
+
   def follow_request_from_object
     @follow_request ||= FollowRequest.find_by(target_account: @account, uri: object_uri) unless object_uri.nil?
   end