Skip to content

Commit

Permalink
2025.2.1-beta.0のlintがコケているのを修正 (#15546)
Browse files Browse the repository at this point in the history
  • Loading branch information
samunohito authored Feb 23, 2025
1 parent 9a619c6 commit 426940b
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 14 deletions.
26 changes: 13 additions & 13 deletions packages/backend/src/core/activitypub/misc/check-against-url.ts
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,12 @@ export enum FetchAllowSoftFailMask {
// Allow all softfail flags
//
// do not use this flag on released code
Any = ~0
Any = ~0,
}

/**
* Fuzz match on whether the candidate host has authority over the request host
*
*
* @param requestHost The host of the requested resources
* @param candidateHost The host of final response
* @returns Whether the candidate host has authority over the request host, or if a soft fail is required for a match
Expand Down Expand Up @@ -78,7 +78,7 @@ function normalizeSynonymousSubdomain(url: URL | string): URL {
export function assertActivityMatchesUrls(requestUrl: string | URL, activity: IObject, candidateUrls: (string | URL)[], allowSoftfail: FetchAllowSoftFailMask): FetchAllowSoftFailMask {
// must have a unique identifier to verify authority
if (!activity.id) {
throw new Error(`bad Activity: missing id field`);
throw new Error('bad Activity: missing id field');
}

let softfail = 0;
Expand All @@ -90,38 +90,38 @@ export function assertActivityMatchesUrls(requestUrl: string | URL, activity: IO
}

softfail |= needed;
}
};

const requestUrlParsed = normalizeSynonymousSubdomain(requestUrl);
const idParsed = normalizeSynonymousSubdomain(activity.id);

const candidateUrlsParsed = candidateUrls.map(it => normalizeSynonymousSubdomain(it));

const requestUrlSecure = requestUrlParsed.protocol === 'https:';
const finalUrlSecure = candidateUrlsParsed.every(it => it.protocol === 'https:');
if (requestUrlSecure && !finalUrlSecure) {
throw new Error(`bad Activity: id(${activity?.id}) is not allowed to have http:// in the url`);
throw new Error(`bad Activity: id(${activity.id}) is not allowed to have http:// in the url`);
}

// Compare final URL to the ID
if (!candidateUrlsParsed.some(it => it.href === idParsed.href)) {
requireSoftfail(FetchAllowSoftFailMask.NonCanonicalId, `bad Activity: id(${activity?.id}) does not match response url(${candidateUrlsParsed.map(it => it.toString())})`);
requireSoftfail(FetchAllowSoftFailMask.NonCanonicalId, `bad Activity: id(${activity.id}) does not match response url(${candidateUrlsParsed.map(it => it.toString())})`);

// at lease host need to match exactly (ActivityPub requirement)
// at lease host need to match exactly (ActivityPub requirement)
if (!candidateUrlsParsed.some(it => idParsed.host === it.host)) {
throw new Error(`bad Activity: id(${activity?.id}) does not match response host(${candidateUrlsParsed.map(it => it.host)})`);
throw new Error(`bad Activity: id(${activity.id}) does not match response host(${candidateUrlsParsed.map(it => it.host)})`);
}
}

// Compare request URL to the ID
if (!requestUrlParsed.href.includes(idParsed.href)) {
requireSoftfail(FetchAllowSoftFailMask.NonCanonicalId, `bad Activity: id(${activity?.id}) does not match request url(${requestUrlParsed.toString()})`);
requireSoftfail(FetchAllowSoftFailMask.NonCanonicalId, `bad Activity: id(${activity.id}) does not match request url(${requestUrlParsed.toString()})`);

// if cross-origin lookup is allowed, we can accept some variation between the original request URL to the final object ID (but not between the final URL and the object ID)
const hostResult = hostFuzzyMatch(requestUrlParsed.host, idParsed.host);

requireSoftfail(hostResult, `bad Activity: id(${activity?.id}) is valid but is not the same origin as request url(${requestUrlParsed.toString()})`);
requireSoftfail(hostResult, `bad Activity: id(${activity.id}) is valid but is not the same origin as request url(${requestUrlParsed.toString()})`);
}

return softfail;
}
}
2 changes: 1 addition & 1 deletion packages/backend/test/e2e/timelines.ts
Original file line number Diff line number Diff line change
Expand Up @@ -397,7 +397,7 @@ describe('Timelines', () => {
assert.strictEqual(res.body.some(note => note.id === bobNote2.id), true);
assert.strictEqual(res.body.some(note => note.id === carolNote1.id), false);
assert.strictEqual(res.body.some(note => note.id === carolNote2.id), false);
}, 1000 * 15);
}, 1000 * 30);

test.concurrent('フォローしているユーザーのチャンネル投稿が含まれない', async () => {
const [alice, bob] = await Promise.all([signup(), signup()]);
Expand Down

0 comments on commit 426940b

Please sign in to comment.