diff options
author | Eugen Rochko <eugen@zeonfederated.com> | 2018-08-22 20:55:14 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2018-08-22 20:55:14 +0200 |
commit | 802cf6a4c53175c7da17ded39cf75679fa352385 (patch) | |
tree | ea3833a78c7282626f58475175d491254a64e0d8 /app/services/fetch_remote_account_service.rb | |
parent | ad41806e53e6b024aaca01d1d59fcc82d1c4b804 (diff) |
Improve federated ID validation (#8372)
* Fix URI not being sufficiently validated with prefetched JSON * Add additional id validation to OStatus documents, when possible
Diffstat (limited to 'app/services/fetch_remote_account_service.rb')
-rw-r--r-- | app/services/fetch_remote_account_service.rb | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/app/services/fetch_remote_account_service.rb b/app/services/fetch_remote_account_service.rb index a0f031a44..cfc560022 100644 --- a/app/services/fetch_remote_account_service.rb +++ b/app/services/fetch_remote_account_service.rb @@ -27,7 +27,7 @@ class FetchRemoteAccountService < BaseService account = author_from_xml(xml.at_xpath('/xmlns:feed', xmlns: OStatus::TagManager::XMLNS), false) - UpdateRemoteProfileService.new.call(xml, account) unless account.nil? + UpdateRemoteProfileService.new.call(xml, account) if account.present? && trusted_domain?(url, account) account rescue TypeError @@ -37,4 +37,9 @@ class FetchRemoteAccountService < BaseService Rails.logger.debug 'Invalid XML or missing namespace' nil end + + def trusted_domain?(url, account) + domain = Addressable::URI.parse(url).normalized_host + domain.casecmp(account.domain).zero? || domain.casecmp(Addressable::URI.parse(account.remote_url.presence || account.uri).normalized_host).zero? + end end |