akkoma/test/pleroma/web
Oneric 0c2b33458d Restrict media usage to owners
In Mastodon media can only be used by owners and only be associated with
a single post. We currently allow media to be associated with several
posts and until now did not limit their usage in posts to media owners.
However, media update and GET lookup was already limited to owners.
(In accordance with allowing media reuse, we also still allow GET
lookups of media already used in a post unlike Mastodon)

Allowing reuse isn’t problematic per se, but allowing use by non-owners
can be problematic if media ids of private-scoped posts can be guessed
since creating a new post with this media id will reveal the uploaded
file content and alt text.
Given media ids are currently just part of a sequentieal series shared
with some other objects, guessing media ids is with some persistence
indeed feasible.

E.g. sampline some public media ids from a real-world
instance with 112 total and 61 monthly-active users:

  17.465.096  at  t0
  17.472.673  at  t1 = t0 + 4h
  17.473.248  at  t2 = t1 + 20min

This gives about 30 new ids per minute of which most won't be
local media but remote and local posts, poll answers etc.
Assuming the default ratelimit of 15 post actions per 10s, scraping all
media for the 4h interval takes about 84 minutes and scraping the 20min
range mere 6.3 minutes. (Until the preceding commit, post updates were
not rate limited at all, allowing even faster scraping.)
If an attacker can infer (e.g. via reply to a follower-only post not
accessbile to the attacker) some sensitive information was uploaded
during a specific time interval and has some pointers regarding the
nature of the information, identifying the specific upload out of all
scraped media for this timerange is not impossible.

Thus restrict media usage to owners.

Checking ownership just in ActivitDraft would already be sufficient,
since when a scheduled status actually gets posted it goes through
ActivityDraft again, but would erroneously return a success status
when scheduling an illegal post.

Independently discovered and fixed by mint in Pleroma
1afde067b1
2024-05-22 20:30:18 +02:00
..
activity_pub Merge pull request 'Read image description from EXIF data' (#744) from timorl/akkoma:elseinspe into develop 2024-04-25 12:52:31 +00:00
admin_api Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
akkoma_api Fix OpenAPI spec for preferred_frontend endpoint 2024-02-03 14:27:45 +01:00
api_spec Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
auth Support elixir1.15 2023-08-03 17:44:09 +01:00
common_api Restrict media usage to owners 2024-05-22 20:30:18 +02:00
feed Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
mastodon_api Restrict media usage to owners 2024-05-22 20:30:18 +02:00
media_proxy Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
metadata check if data is visible before embedding it in OG tags 2024-04-12 05:16:47 +01:00
o_auth update tests for oauth consumer 2023-12-17 21:48:19 +00:00
o_status Support elixir1.15 2023-08-03 17:44:09 +01:00
pleroma_api Always insert Dedupe upload filter 2024-03-18 22:33:10 -01:00
plugs Drop base_url special casing in test env 2024-04-07 00:20:12 +02:00
preload/providers Remove precompiled javascript (#55) 2022-07-08 13:03:18 +00:00
push Support elixir1.15 2023-08-03 17:44:09 +01:00
rich_media Support elixir1.15 2023-08-03 17:44:09 +01:00
static_fe Add tests for static-fe metadata tags 2024-02-21 00:33:32 +00:00
twitter_api Merge branch 'develop' into failed-fetch-processing 2024-04-16 12:35:54 +01:00
views Support elixir1.15 2023-08-03 17:44:09 +01:00
web_finger Don't list old accounts as aliases in WebFinger 2024-04-01 13:34:58 +02:00
common_api_test.exs Add ability to auto-approve followbacks 2024-02-13 15:42:37 +01:00
embed_controller_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
fallback_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
federator_test.exs Normalise public adressing to fix federation 2024-04-25 18:45:16 +02:00
gettext_test.exs Fix incorrect fallback when English is set to first language 2022-06-29 20:47:10 +01:00
manifest_controller_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
masto_fe_controller_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
media_proxy_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
mongoose_im_controller_test.exs Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
node_info_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
rel_me_test.exs Add more information about failed verifications 2023-03-10 03:51:24 +00:00
streamer_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
uploader_controller_test.exs Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
web_finger_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
xml_test.exs Add XML matcher 2023-08-07 11:12:14 +01:00