Add check for wrong attribution of collections (#39525)

app/services/activitypub/process_featured_collection_service.rb

@@ -12,6 +12,7 @@ class ActivityPub::ProcessFeaturedCollectionService
     @json = json
     @request_id = request_id
     return if non_matching_uri_hosts?(@account.uri, @json['id'])
+    return unless @json['attributedTo'] == @account.uri
 
     with_redis_lock("collection:#{@json['id']}") do
       Collection.transaction do

spec/services/activitypub/process_featured_collection_service_spec.rb

@@ -7,12 +7,13 @@ RSpec.describe ActivityPub::ProcessFeaturedCollectionService do
 
   let(:account) { Fabricate(:remote_account) }
   let(:summary) { '<p>A list of remote actors you should follow.</p>' }
+  let(:attributed_to) { account.uri }
   let(:base_json) do
     {
       '@context' => 'https://www.w3.org/ns/activitystreams',
       'id' => 'https://example.com/featured_collections/1',
       'type' => 'FeaturedCollection',
-      'attributedTo' => account.uri,
+      'attributedTo' => attributed_to,
       'name' => 'Good people from other servers',
       'sensitive' => false,
       'discoverable' => true,
@@ -41,6 +42,16 @@ RSpec.describe ActivityPub::ProcessFeaturedCollectionService do
     end
   end
 
+  context 'when `attributedTo` does not match the given account' do
+    let(:attributed_to) { 'https://example.com/random/account' }
+
+    it 'does not create a collection and returns nil' do
+      expect do
+        expect(subject.call(account, featured_collection_json)).to be_nil
+      end.to_not change(Collection, :count)
+    end
+  end
+
   context 'when URIs match up' do
     it 'creates a collection and queues jobs to handle its items' do
       expect { subject.call(account, featured_collection_json) }.to change(account.collections, :count).by(1)