mirror of
https://akkoma.dev/AkkomaGang/akkoma.git
synced 2024-11-27 00:09:35 +00:00
8684964c5d
This protects us from falling for obvious spoofs as from the current upload exploit (unfortunately we can’t reasonably do anything about spoofs with exact matches as was possible via emoji and proxy). Such objects being invalid is supported by the spec, sepcifically sections 3.1 and 3.2: https://www.w3.org/TR/activitypub/#obj-id Anonymous objects are not relevant here (they can only exists within parent objects iiuc) and neither is client-to-server or transient objects (as those cannot be fetched in the first place). This leaves us with the requirement for `id` to (a) exist and (b) be a publicly dereferencable URI from the originating server. This alone does not yet demand strict equivalence, but the spec then further explains objects ought to be fetchable _via their ID_. Meaning an object not retrievable via its ID, is invalid. This reading is supported by the fact, e.g. GoToSocial (recently) and Mastodon (for 6+ years) do already implement such strict ID checks, additionally proving this doesn’t cause federation issues in practice. However, apart from canonical IDs there can also be additional display URLs. *omas first redirect those to their canonical location, but *keys and Mastodon directly serve the AP representation without redirects. Mastodon and GTS deal with this in two different ways, but both constitute an effective countermeasure: - Mastodon: Unless it already is a known AP id, two fetches occur. The first fetch just reads the `id` property and then refetches from the id. The last fetch requires the returned id to exactly match the URL the content was fetched from. (This can be optimised by skipping the second fetch if it already matches) |
||
|---|---|---|
| .. | ||
| activity | ||
| akkoma | ||
| collections | ||
| config | ||
| conversation | ||
| docs | ||
| ecto_type/activity_pub/object_validators | ||
| emails | ||
| emoji | ||
| http | ||
| instances | ||
| integration | ||
| mfa | ||
| migration_helper | ||
| object | ||
| password | ||
| repo/migrations | ||
| search | ||
| translators | ||
| upload | ||
| uploaders | ||
| user | ||
| web | ||
| workers | ||
| activity_test.exs | ||
| announcement_read_relationship_test.exs | ||
| announcement_test.exs | ||
| application_requirements_test.exs | ||
| bookmark_test.exs | ||
| captcha_test.exs | ||
| config_db_test.exs | ||
| config_test.exs | ||
| conversation_test.exs | ||
| emoji_test.exs | ||
| filter_test.exs | ||
| following_relationship_test.exs | ||
| formatter_test.exs | ||
| frontend_test.exs | ||
| hashtag_test.exs | ||
| healthcheck_test.exs | ||
| html_test.exs | ||
| http_test.exs | ||
| instances_test.exs | ||
| iso639_test.exs | ||
| job_queue_monitor_test.exs | ||
| keys_test.exs | ||
| list_test.exs | ||
| marker_test.exs | ||
| mfa_test.exs | ||
| moderation_log_test.exs | ||
| notification_test.exs | ||
| object_test.exs | ||
| otp_version_test.exs | ||
| pagination_test.exs | ||
| password_test.exs | ||
| registration_test.exs | ||
| repo_test.exs | ||
| report_note_test.exs | ||
| reverse_proxy_test.exs | ||
| runtime_test.exs | ||
| safe_jsonb_set_test.exs | ||
| scheduled_activity_test.exs | ||
| signature_test.exs | ||
| stats_test.exs | ||
| upload_test.exs | ||
| user_invite_token_test.exs | ||
| user_note_test.exs | ||
| user_relationship_test.exs | ||
| user_search_test.exs | ||
| user_test.exs | ||
| utils_test.exs | ||
| xml_builder_test.exs | ||