mirrors/activitypub-federation-rust
1
0
Fork 0
mirror of https://github.com/LemmyNet/activitypub-federation-rust.git synced 2025-05-20 01:18:52 +00:00
Code Issues Projects Releases Wiki Activity

prevent infinite recursion

Browse source
This commit is contained in:
Felix Ableitner 2025-01-22 15:09:17 +01:00
parent f822d45c6a
commit 7f2c303c36
2 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/fetch/mod.rs
View file

@ -59,7 +59,7 @@ pub async fn fetch_object_http<T: Clone, Kind: DeserializeOwned>(
r#"application/ld+json; profile="https://www.w3.org/ns/activitystreams""#, // activitypub standard r#"application/ld+json; profile="https://www.w3.org/ns/activitystreams""#, // activitypub standard
r#"application/activity+json; charset=utf-8"#, // mastodon r#"application/activity+json; charset=utf-8"#, // mastodon
]; ];
let res = fetch_object_http_with_accept(url, data, &FETCH_CONTENT_TYPE).await?; let res = fetch_object_http_with_accept(url, data, &FETCH_CONTENT_TYPE, false).await?;
// Ensure correct content-type to prevent vulnerabilities, with case insensitive comparison. // Ensure correct content-type to prevent vulnerabilities, with case insensitive comparison.
let content_type = res let content_type = res
@ -100,6 +100,7 @@ async fn fetch_object_http_with_accept<T: Clone, Kind: DeserializeOwned>(
url: &Url, url: &Url,
data: &Data<T>, data: &Data<T>,
content_type: &HeaderValue, content_type: &HeaderValue,
recursive: bool,
) -> Result<FetchObjectResponse<Kind>, Error> { ) -> Result<FetchObjectResponse<Kind>, Error> {
let config = &data.config; let config = &data.config;
config.verify_url_valid(url).await?; config.verify_url_valid(url).await?;
@ -132,10 +133,17 @@ async fn fetch_object_http_with_accept<T: Clone, Kind: DeserializeOwned>(
req.send().await? req.send().await?
}; };
// Allow a single redirect using recursion. Further redirects are ignored.
let location = res.headers().get(LOCATION).and_then(|l| l.to_str().ok()); let location = res.headers().get(LOCATION).and_then(|l| l.to_str().ok());
if let Some(location) = location { if let (Some(location), false) = (location, recursive) {
let location = location.parse()?; let location = location.parse()?;
return Box::pin(fetch_object_http_with_accept(&location, data, content_type)).await; return Box::pin(fetch_object_http_with_accept(
&location,
data,
content_type,
true,
))
.await;
} }
if res.status() == StatusCode::GONE { if res.status() == StatusCode::GONE {

1
src/fetch/webfinger.rs
View file

@ -69,6 +69,7 @@ where
&Url::parse(&fetch_url).map_err(Error::UrlParse)?, &Url::parse(&fetch_url).map_err(Error::UrlParse)?,
data, data,
&WEBFINGER_CONTENT_TYPE, &WEBFINGER_CONTENT_TYPE,
false,
) )
.await?; .await?;
if res.url.as_str() != fetch_url { if res.url.as_str() != fetch_url {