mirror of https://github.com/mastodon/mastodon.git
Fix possibility of unrightful webfinger redirect (#2147)
* Fix possibility of unrightful webfinger redirect * Add more tests for FollowRemoteAccountServicepull/2155/head
parent
708bdd53f1
commit
1d47910d3b
|
@ -10,7 +10,7 @@ class FollowRemoteAccountService < BaseService
|
||||||
# important information from their feed
|
# important information from their feed
|
||||||
# @param [String] uri User URI in the form of username@domain
|
# @param [String] uri User URI in the form of username@domain
|
||||||
# @return [Account]
|
# @return [Account]
|
||||||
def call(uri)
|
def call(uri, redirected = nil)
|
||||||
username, domain = uri.split('@')
|
username, domain = uri.split('@')
|
||||||
|
|
||||||
return Account.find_local(username) if TagManager.instance.local_domain?(domain)
|
return Account.find_local(username) if TagManager.instance.local_domain?(domain)
|
||||||
|
@ -24,8 +24,14 @@ class FollowRemoteAccountService < BaseService
|
||||||
|
|
||||||
raise Goldfinger::Error, 'Missing resource links' if data.link('http://schemas.google.com/g/2010#updates-from').nil? || data.link('salmon').nil? || data.link('http://webfinger.net/rel/profile-page').nil? || data.link('magic-public-key').nil?
|
raise Goldfinger::Error, 'Missing resource links' if data.link('http://schemas.google.com/g/2010#updates-from').nil? || data.link('salmon').nil? || data.link('http://webfinger.net/rel/profile-page').nil? || data.link('magic-public-key').nil?
|
||||||
|
|
||||||
|
# Disallow account hijacking
|
||||||
confirmed_username, confirmed_domain = data.subject.gsub(/\Aacct:/, '').split('@')
|
confirmed_username, confirmed_domain = data.subject.gsub(/\Aacct:/, '').split('@')
|
||||||
|
|
||||||
|
unless confirmed_username.casecmp(username).zero? && confirmed_domain.casecmp(domain).zero?
|
||||||
|
return call("#{confirmed_username}@#{confirmed_domain}", true) if redirected.nil?
|
||||||
|
raise Goldfinger::Error, 'Requested and returned acct URI do not match'
|
||||||
|
end
|
||||||
|
|
||||||
return Account.find_local(confirmed_username) if TagManager.instance.local_domain?(confirmed_domain)
|
return Account.find_local(confirmed_username) if TagManager.instance.local_domain?(confirmed_domain)
|
||||||
|
|
||||||
confirmed_account = Account.find_remote(confirmed_username, confirmed_domain)
|
confirmed_account = Account.find_remote(confirmed_username, confirmed_domain)
|
||||||
|
|
|
@ -3,10 +3,35 @@ require 'rails_helper'
|
||||||
RSpec.describe FollowRemoteAccountService do
|
RSpec.describe FollowRemoteAccountService do
|
||||||
subject { FollowRemoteAccountService.new }
|
subject { FollowRemoteAccountService.new }
|
||||||
|
|
||||||
it 'returns nil if no such user can be resolved via webfinger'
|
before do
|
||||||
it 'returns nil if the domain does not have webfinger'
|
stub_request(:get, "https://quitter.no/.well-known/host-meta").to_return(request_fixture('.host-meta.txt'))
|
||||||
it 'returns nil if remote user does not offer a hub URL'
|
stub_request(:get, "https://example.com/.well-known/host-meta").to_return(status: 404)
|
||||||
it 'returns an already existing remote account'
|
stub_request(:get, "https://quitter.no/.well-known/webfinger?resource=acct:gargron@quitter.no").to_return(request_fixture('webfinger.txt'))
|
||||||
it 'returns a new remote account'
|
stub_request(:get, "https://quitter.no/.well-known/webfinger?resource=acct:catsrgr8@quitter.no").to_return(status: 404)
|
||||||
it 'fills the remote account with profile information'
|
stub_request(:get, "https://quitter.no/api/statuses/user_timeline/7477.atom").to_return(request_fixture('feed.txt'))
|
||||||
|
stub_request(:get, "https://quitter.no/avatar/7477-300-20160211190340.png").to_return(request_fixture('avatar.txt'))
|
||||||
|
end
|
||||||
|
|
||||||
|
it 'raises error if no such user can be resolved via webfinger' do
|
||||||
|
expect { subject.call('catsrgr8@quitter.no') }.to raise_error Goldfinger::Error
|
||||||
|
end
|
||||||
|
|
||||||
|
it 'raises error if the domain does not have webfinger' do
|
||||||
|
expect { subject.call('catsrgr8@example.com') }.to raise_error Goldfinger::Error
|
||||||
|
end
|
||||||
|
|
||||||
|
it 'returns an already existing remote account' do
|
||||||
|
old_account = Fabricate(:account, username: 'gargron', domain: 'quitter.no')
|
||||||
|
returned_account = subject.call('gargron@quitter.no')
|
||||||
|
|
||||||
|
expect(old_account.id).to eq returned_account.id
|
||||||
|
end
|
||||||
|
|
||||||
|
it 'returns a new remote account' do
|
||||||
|
account = subject.call('gargron@quitter.no')
|
||||||
|
|
||||||
|
expect(account.username).to eq 'gargron'
|
||||||
|
expect(account.domain).to eq 'quitter.no'
|
||||||
|
expect(account.remote_url).to eq 'https://quitter.no/api/statuses/user_timeline/7477.atom'
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue