tarrien/Mastodon
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix lax relevancy check in inbound activity processing (#39892)

Browse Source
This commit is contained in:
Claire 2026-07-21 17:03:01 +02:00 committed by Tarrien
parent 08e7e6e7a7
commit 99a2528f94
2 changed files with 25 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
app/lib/activitypub/activity/create.rb
View File

@ -15,7 +15,17 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
private private
def create_status def create_status
return reject_payload! if unsupported_object_type? || non_matching_uri_hosts?(@account.uri, object_uri) || tombstone_exists? || !related_to_local_activity? return reject_payload! if unsupported_object_type? || non_matching_uri_hosts?(@account.uri, object_uri) || tombstone_exists?
@status_parser = ActivityPub::Parser::StatusParser.new(
@json,
followers_collection: @account.followers_url,
following_collection: @account.following_url,
actor_uri: ActivityPub::TagManager.instance.uri_for(@account),
object: @object
)
return reject_payload! unless related_to_local_activity?
with_redis_lock("create:#{object_uri}") do with_redis_lock("create:#{object_uri}") do
Status.uncached do Status.uncached do
@ -34,13 +44,7 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
@status @status
end end
def audience_to delegate :audience_to, :audience_cc, to: :@status_parser
as_array(@object['to'] || @json['to']).map { |x| value_or_id(x) }
end
def audience_cc
as_array(@object['cc'] || @json['cc']).map { |x| value_or_id(x) }
end
def process_status def process_status
@tags = [] @tags = []
@ -91,14 +95,6 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
end end
def process_status_params def process_status_params
@status_parser = ActivityPub::Parser::StatusParser.new(
@json,
followers_collection: @account.followers_url,
following_collection: @account.following_url,
actor_uri: ActivityPub::TagManager.instance.uri_for(@account),
object: @object
)
attachment_ids = process_attachments.take(Status::MEDIA_ATTACHMENTS_LIMIT).map(&:id) attachment_ids = process_attachments.take(Status::MEDIA_ATTACHMENTS_LIMIT).map(&:id)
@params = { @params = {
@ -454,8 +450,16 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
end end
def related_to_local_activity? def related_to_local_activity?
fetch? || followed_by_local_accounts? || requested_through_relay? || return true if fetch?
responds_to_followed_account? || addresses_local_accounts?
case @status_parser.visibility
when :public, :unlisted
followed_by_local_accounts? || requested_through_relay? || responds_to_followed_account? || addresses_local_accounts?
when :private
followed_by_local_accounts? || addresses_local_accounts?
when :direct
addresses_local_accounts?
end
end end
def responds_to_followed_account? def responds_to_followed_account?

5
spec/lib/activitypub/activity/create_spec.rb
View File

@ -1334,7 +1334,7 @@ RSpec.describe ActivityPub::Activity::Create do
subject.perform subject.perform
end end
let(:object_json) { build_object } let(:object_json) { build_object(to: 'http://example.com/followers') }
it 'creates status' do it 'creates status' do
status = sender.statuses.first status = sender.statuses.first
@ -1350,7 +1350,8 @@ RSpec.describe ActivityPub::Activity::Create do
let!(:local_status) { Fabricate(:status) } let!(:local_status) { Fabricate(:status) }
let(:object_json) do let(:object_json) do
build_object( build_object(
inReplyTo: ActivityPub::TagManager.instance.uri_for(local_status) inReplyTo: ActivityPub::TagManager.instance.uri_for(local_status),
cc: 'https://www.w3.org/ns/activitystreams#Public'
) )
end end