about summary refs log tree commit diff
path: root/app/services/activitypub
diff options
context:
space:
mode:
authorEugen Rochko <eugen@zeonfederated.com>2018-01-08 05:00:23 +0100
committerGitHub <noreply@github.com>2018-01-08 05:00:23 +0100
commite4a241abefaa68492938c3fbb7e5e5401d12138e (patch)
treef6f97d531d969aa6d32f6463045e1c2930e06dc2 /app/services/activitypub
parent93555182c3cfd810fc481d9451e990955a696ea4 (diff)
Fix bad URL schemes being accepted (#6219)
* Fix actors accepting invalid URI schemes or different host between URI and URL

* Fix statuses accepting invalid URI scheme or different host to actor

* Adjust tests to new requirements

* Improve readability of mismatching_origin?/invalid_origin? methods
Diffstat (limited to 'app/services/activitypub')
-rw-r--r--app/services/activitypub/process_account_service.rb18
1 files changed, 16 insertions, 2 deletions
diff --git a/app/services/activitypub/process_account_service.rb b/app/services/activitypub/process_account_service.rb
index 0fbf18c00..f43edafe7 100644
--- a/app/services/activitypub/process_account_service.rb
+++ b/app/services/activitypub/process_account_service.rb
@@ -6,7 +6,7 @@ class ActivityPub::ProcessAccountService < BaseService
   # Should be called with confirmed valid JSON
   # and WebFinger-resolved username and domain
   def call(username, domain, json)
-    return if json['inbox'].blank?
+    return if json['inbox'].blank? || unsupported_uri_scheme?(json['id'])
 
     @json        = json
     @uri         = @json['id']
@@ -107,7 +107,21 @@ class ActivityPub::ProcessAccountService < BaseService
 
   def url
     return if @json['url'].blank?
-    url_to_href(@json['url'], 'text/html')
+
+    url_candidate = url_to_href(@json['url'], 'text/html')
+
+    if unsupported_uri_scheme?(url_candidate) || mismatching_origin?(url_candidate)
+      nil
+    else
+      url_candidate
+    end
+  end
+
+  def mismatching_origin?(url)
+    needle   = Addressable::URI.parse(url).host
+    haystack = Addressable::URI.parse(@uri).host
+
+    !haystack.casecmp(needle).zero?
   end
 
   def outbox_total_items