diff --git a/examples/local_federation/main.rs b/examples/local_federation/main.rs index f0ea3c4..41a0cad 100644 --- a/examples/local_federation/main.rs +++ b/examples/local_federation/main.rs @@ -46,7 +46,7 @@ async fn main() -> Result<(), Error> { info!("Alpha user follows beta user via webfinger"); alpha .local_user() - .follow("beta@localhost:8002", &alpha.to_request_data()) + .follow("beta@localhost.:8002", &alpha.to_request_data()) .await?; assert_eq!( beta.local_user().followers(), diff --git a/src/config.rs b/src/config.rs index bca7805..b28240f 100644 --- a/src/config.rs +++ b/src/config.rs @@ -206,7 +206,16 @@ impl FederationConfig { } } - self.url_verifier.verify(url).await?; + // It is valid but uncommon for domains to end with `.` char. Drop this so it cant be used + // to bypass domain blocklist. Avoid cloning url in common case. + if domain.ends_with(".") { + let mut url = url.clone(); + let domain = &domain[0..domain.len() - 1]; + url.set_host(Some(domain))?; + self.url_verifier.verify(&url).await?; + } else { + self.url_verifier.verify(url).await?; + } Ok(()) }