Merge branch 'hellthread-filter-fix' into 'develop'

Hellthread filter fix

Closes #634

See merge request pleroma/pleroma!831

config/config.exs

@@ -228,8 +228,8 @@ config :pleroma, :mrf_rejectnonpublic,
   allow_direct: false
 
 config :pleroma, :mrf_hellthread,
-  delist_threshold: 5,
-  reject_threshold: 10
+  delist_threshold: 10,
+  reject_threshold: 20
 
 config :pleroma, :mrf_simple,
   media_removal: [],

lib/pleroma/web/activity_pub/mrf/hellthread_policy.ex

@@ -6,40 +6,80 @@ defmodule Pleroma.Web.ActivityPub.MRF.HellthreadPolicy do
   alias Pleroma.User
   @behaviour Pleroma.Web.ActivityPub.MRF
 
-  defp delist_message(message) do
+  defp delist_message(message, threshold) when threshold > 0 do
     follower_collection = User.get_cached_by_ap_id(message["actor"]).follower_address
 
-    message
-    |> Map.put("to", [follower_collection])
-    |> Map.put("cc", ["https://www.w3.org/ns/activitystreams#Public"])
+    follower_collection? = Enum.member?(message["to"] ++ message["cc"], follower_collection)
+
+    message =
+      case recipients = get_recipient_count(message) do
+        {:public, _}
+        when follower_collection? and recipients > threshold ->
+          message
+          |> Map.put("to", [follower_collection])
+          |> Map.put("cc", ["https://www.w3.org/ns/activitystreams#Public"])
+
+        {:public, _} when recipients > threshold ->
+          message
+          |> Map.put("to", [])
+          |> Map.put("cc", ["https://www.w3.org/ns/activitystreams#Public"])
+
+        _ ->
+          message
+      end
+
+    {:ok, message}
+  end
+
+  defp delist_message(message, _threshold), do: {:ok, message}
+
+  defp reject_message(message, threshold) when threshold > 0 do
+    with {_, recipients} <- get_recipient_count(message) do
+      if recipients > threshold do
+        {:reject, nil}
+      else
+        {:ok, message}
+      end
+    end
+  end
+
+  defp reject_message(message, _threshold), do: {:ok, message}
+
+  defp get_recipient_count(message) do
+    recipients = (message["to"] || []) ++ (message["cc"] || [])
+    follower_collection = User.get_cached_by_ap_id(message["actor"]).follower_address
+
+    if Enum.member?(recipients, "https://www.w3.org/ns/activitystreams#Public") do
+      recipients =
+        recipients
+        |> List.delete("https://www.w3.org/ns/activitystreams#Public")
+        |> List.delete(follower_collection)
+
+      {:public, length(recipients)}
+    else
+      recipients =
+        recipients
+        |> List.delete(follower_collection)
+
+      {:not_public, length(recipients)}
+    end
   end
 
   @impl true
   def filter(%{"type" => "Create"} = message) do
-    delist_threshold = Pleroma.Config.get([:mrf_hellthread, :delist_threshold])
-
     reject_threshold =
       Pleroma.Config.get(
         [:mrf_hellthread, :reject_threshold],
         Pleroma.Config.get([:mrf_hellthread, :threshold])
       )
 
-    recipients = (message["to"] || []) ++ (message["cc"] || [])
+    delist_threshold = Pleroma.Config.get([:mrf_hellthread, :delist_threshold])
 
-    cond do
-      length(recipients) > reject_threshold and reject_threshold > 0 ->
-        {:reject, nil}
-
-      length(recipients) > delist_threshold and delist_threshold > 0 ->
-        if Enum.member?(message["to"], "https://www.w3.org/ns/activitystreams#Public") or
-             Enum.member?(message["cc"], "https://www.w3.org/ns/activitystreams#Public") do
-          {:ok, delist_message(message)}
-        else
-          {:ok, message}
-        end
-
-      true ->
-        {:ok, message}
+    with {:ok, message} <- reject_message(message, reject_threshold),
+         {:ok, message} <- delist_message(message, delist_threshold) do
+      {:ok, message}
+    else
+      _e -> {:reject, nil}
     end
   end
 

test/web/activity_pub/mrf/hellthread_policy_test.exs

@@ -0,0 +1,50 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.MRF.HellthreadPolicyTest do
+  use Pleroma.DataCase
+  import Pleroma.Factory
+
+  import Pleroma.Web.ActivityPub.MRF.HellthreadPolicy
+
+  describe "hellthread filter tests" do
+    setup do
+      user = insert(:user)
+
+      message = %{
+        "actor" => user.ap_id,
+        "cc" => [user.follower_address],
+        "type" => "Create",
+        "to" => [
+          "https://www.w3.org/ns/activitystreams#Public",
+          "https://instace.tld/users/user1",
+          "https://instace.tld/users/user2",
+          "https://instace.tld/users/user3"
+        ]
+      }
+
+      [user: user, message: message]
+    end
+
+    test "reject test", %{message: message} do
+      Pleroma.Config.put([:mrf_hellthread], %{delist_threshold: 0, reject_threshold: 2})
+
+      {:reject, nil} = filter(message)
+    end
+
+    test "delist test", %{user: user, message: message} do
+      Pleroma.Config.put([:mrf_hellthread], %{delist_threshold: 2, reject_threshold: 0})
+
+      {:ok, message} = filter(message)
+      assert user.follower_address in message["to"]
+      assert "https://www.w3.org/ns/activitystreams#Public" in message["cc"]
+    end
+
+    test "excludes follower collection and public URI from threshold count", %{message: message} do
+      Pleroma.Config.put([:mrf_hellthread], %{delist_threshold: 0, reject_threshold: 3})
+
+      {:ok, _} = filter(message)
+    end
+  end
+end