From 052d6bb173eab71b2910c3fe6c4ae31b9a02f29c Mon Sep 17 00:00:00 2001 From: David Roetzel Date: Fri, 19 Jun 2026 16:30:39 +0200 Subject: [PATCH] Add check for wrong attribution of collections (#39525) --- .../process_featured_collection_service.rb | 1 + .../process_featured_collection_service_spec.rb | 13 ++++++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/app/services/activitypub/process_featured_collection_service.rb b/app/services/activitypub/process_featured_collection_service.rb index 18e0da32d7..624cb19206 100644 --- a/app/services/activitypub/process_featured_collection_service.rb +++ b/app/services/activitypub/process_featured_collection_service.rb @@ -12,6 +12,7 @@ class ActivityPub::ProcessFeaturedCollectionService @json = json @request_id = request_id return if non_matching_uri_hosts?(@account.uri, @json['id']) + return unless @json['attributedTo'] == @account.uri with_redis_lock("collection:#{@json['id']}") do Collection.transaction do diff --git a/spec/services/activitypub/process_featured_collection_service_spec.rb b/spec/services/activitypub/process_featured_collection_service_spec.rb index 6a74eaa398..66c3cc65c9 100644 --- a/spec/services/activitypub/process_featured_collection_service_spec.rb +++ b/spec/services/activitypub/process_featured_collection_service_spec.rb @@ -7,12 +7,13 @@ RSpec.describe ActivityPub::ProcessFeaturedCollectionService do let(:account) { Fabricate(:remote_account) } let(:summary) { '

A list of remote actors you should follow.

' } + let(:attributed_to) { account.uri } let(:base_json) do { '@context' => 'https://www.w3.org/ns/activitystreams', 'id' => 'https://example.com/featured_collections/1', 'type' => 'FeaturedCollection', - 'attributedTo' => account.uri, + 'attributedTo' => attributed_to, 'name' => 'Good people from other servers', 'sensitive' => false, 'discoverable' => true, @@ -41,6 +42,16 @@ RSpec.describe ActivityPub::ProcessFeaturedCollectionService do end end + context 'when `attributedTo` does not match the given account' do + let(:attributed_to) { 'https://example.com/random/account' } + + it 'does not create a collection and returns nil' do + expect do + expect(subject.call(account, featured_collection_json)).to be_nil + end.to_not change(Collection, :count) + end + end + context 'when URIs match up' do it 'creates a collection and queues jobs to handle its items' do expect { subject.call(account, featured_collection_json) }.to change(account.collections, :count).by(1)