Oneric c4cf4d7f0b Reject cross-domain redirects when fetching AP objects ... Such redirects on AP queries seem most likely to be a spoofing attempt. If the object is legit, the id should match the final domain anyway and users can directly use the canonical URL. The lack of such a check (and use of the initially queried domain’s authority instead of the final domain) was enabling the current exploit to even affect instances which already migrated away from a same-domain upload/proxy setup in the past, but retained a redirect to not break old attachments. (In theory this redirect could, with some effort, have been limited to only old files, but common guides employed a catch-all redirect, which allows even future uploads to be reachable via an initial query to the main domain) Same-domain redirects are valid and also used by ourselves, e.g. for redirecting /notice/XXX to /objects/YYY.		2024-03-25 14:05:05 -01:00
..
containment_test.exs	Bump Copyright to 2021	2021-01-13 07:49:50 +01:00
fetcher_test.exs	Reject cross-domain redirects when fetching AP objects	2024-03-25 14:05:05 -01:00
pruner_test.exs	Fixing up deletes a bit (#327)	2022-12-01 15:00:53 +00:00
updater_test.exs	Post editing (#202)	2022-09-06 19:24:02 +00:00