avoid processing incoming posts that have invisible participants

1 files changed, 10 insertions, 1 deletions

diff --git a/app/lib/activitypub/activity/create.rb b/app/lib/activitypub/activity/create.rb
index c95317646..59a962fe7 100644
--- a/app/lib/activitypub/activity/create.rb
+++ b/app/lib/activitypub/activity/create.rb
@@ -138,7 +138,16 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
       # control anyway
       account = account_from_uri(audience)
 
-      next if account.nil? || @mentions.any? { |mention| mention.account_id == account.id }
+      if account.nil?
+        if @options[:requested]
+          @potential_scope_leak = true unless Account.where(followers_url: audience, suspended_at: nil).exists?
+        else
+          @potential_scope_leak = true unless Account.where(followers_url: audience, known: true, suspended_at: nil).exists?
+        end
+        next
+      end
+
+      next if @mentions.any? { |mention| mention.account_id == account.id }
 
       @mentions << Mention.new(account: account, silent: true)