From 1618b68bfa740ed655ac45d7d5f4f46fed6c8c62 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Fri, 14 Jul 2017 20:41:49 +0200 Subject: HTTP signatures (#4146) * Add Request class with HTTP signature generator Spec: https://tools.ietf.org/html/draft-cavage-http-signatures-06 * Add HTTP signature verification concern * Add test for SignatureVerification concern * Add basic test for Request class * Make PuSH subscribe/unsubscribe requests use new Request class Accidentally fix lease_seconds not being set and sent properly, and change the new minimum subscription duration to 1 day * Make all PuSH workers use new Request class * Make Salmon sender use new Request class * Make FetchLinkService use new Request class * Make FetchAtomService use the new Request class * Make Remotable use the new Request class * Make ResolveRemoteAccountService use the new Request class * Add more tests * Allow +-30 seconds window for signed request to remain valid * Disable time window validation for signed requests, restore 7 days as PuSH subscription duration (which was previous default due to a bug) --- spec/lib/request_spec.rb | 54 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 spec/lib/request_spec.rb (limited to 'spec/lib') diff --git a/spec/lib/request_spec.rb b/spec/lib/request_spec.rb new file mode 100644 index 000000000..782f14b18 --- /dev/null +++ b/spec/lib/request_spec.rb @@ -0,0 +1,54 @@ +# frozen_string_literal: true + +require 'rails_helper' + +describe Request do + subject { Request.new(:get, 'http://example.com') } + + describe '#headers' do + it 'returns user agent' do + expect(subject.headers['User-Agent']).to be_present + end + + it 'returns the date header' do + expect(subject.headers['Date']).to be_present + end + + it 'returns the host header' do + expect(subject.headers['Host']).to be_present + end + + it 'does not return virtual request-target header' do + expect(subject.headers['(request-target)']).to be_nil + end + end + + describe '#on_behalf_of' do + it 'when used, adds signature header' do + subject.on_behalf_of(Fabricate(:account)) + expect(subject.headers['Signature']).to be_present + end + end + + describe '#add_headers' do + it 'adds headers to the request' do + subject.add_headers('Test' => 'Foo') + expect(subject.headers['Test']).to eq 'Foo' + end + end + + describe '#perform' do + before do + stub_request(:get, 'http://example.com') + subject.perform + end + + it 'executes a HTTP request' do + expect(a_request(:get, 'http://example.com')).to have_been_made.once + end + + it 'sets headers' do + expect(a_request(:get, 'http://example.com').with(headers: subject.headers)).to have_been_made + end + end +end -- cgit From de397f3bc1f1c7e632d0db0754711beb6ce04664 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Fri, 14 Jul 2017 22:31:38 +0200 Subject: Fix subsequent replies to unresolved status not being filtered from home (#4190) Resolves #4177 - smaller changeset --- app/lib/feed_manager.rb | 7 ++++--- spec/lib/feed_manager_spec.rb | 7 +++++++ 2 files changed, 11 insertions(+), 3 deletions(-) (limited to 'spec/lib') diff --git a/app/lib/feed_manager.rb b/app/lib/feed_manager.rb index c507f2636..b1ae11084 100644 --- a/app/lib/feed_manager.rb +++ b/app/lib/feed_manager.rb @@ -93,7 +93,7 @@ class FeedManager end def filter_from_home?(status, receiver_id) - return true if status.reply? && status.in_reply_to_id.nil? + return true if status.reply? && (status.in_reply_to_id.nil? || status.in_reply_to_account_id.nil?) check_for_mutes = [status.account_id] check_for_mutes.concat([status.reblog.account_id]) if status.reblog? @@ -120,12 +120,13 @@ class FeedManager end def filter_from_mentions?(status, receiver_id) + return true if receiver_id == status.account_id + check_for_blocks = [status.account_id] check_for_blocks.concat(status.mentions.pluck(:account_id)) check_for_blocks.concat([status.in_reply_to_account]) if status.reply? && !status.in_reply_to_account_id.nil? - should_filter = receiver_id == status.account_id # Filter if I'm mentioning myself - should_filter ||= Block.where(account_id: receiver_id, target_account_id: check_for_blocks).any? # or it's from someone I blocked, in reply to someone I blocked, or mentioning someone I blocked + should_filter = Block.where(account_id: receiver_id, target_account_id: check_for_blocks).any? # Filter if it's from someone I blocked, in reply to someone I blocked, or mentioning someone I blocked should_filter ||= (status.account.silenced? && !Follow.where(account_id: receiver_id, target_account_id: status.account_id).exists?) # of if the account is silenced and I'm not following them should_filter diff --git a/spec/lib/feed_manager_spec.rb b/spec/lib/feed_manager_spec.rb index 4bdc96866..22439cf35 100644 --- a/spec/lib/feed_manager_spec.rb +++ b/spec/lib/feed_manager_spec.rb @@ -81,6 +81,13 @@ RSpec.describe FeedManager do expect(FeedManager.instance.filter?(:home, reply, bob.id)).to be true end + it 'returns true for the second reply by followee to a non-federated status' do + reply = Fabricate(:status, text: 'Reply 1', reply: true, account: alice) + second_reply = Fabricate(:status, text: 'Reply 2', thread: reply, account: alice) + bob.follow!(alice) + expect(FeedManager.instance.filter?(:home, second_reply, bob.id)).to be true + end + it 'returns false for status by followee mentioning another account' do bob.follow!(alice) status = PostStatusService.new.call(alice, 'Hey @jeff') -- cgit