From 773c9b2afc4f2b99b2e0bf0c52db52953dc13fd4 Mon Sep 17 00:00:00 2001 From: Michael Manfre Date: Wed, 25 Jan 2023 22:59:50 -0500 Subject: [PATCH] Ensure expected fields exist for Post.by_ap --- activities/models/post.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/activities/models/post.py b/activities/models/post.py index e6a0e36..8d00f46 100644 --- a/activities/models/post.py +++ b/activities/models/post.py @@ -755,11 +755,20 @@ class Post(StatorModel): or it's from a blocked domain. """ try: + # Ensure data has the primary fields of all Posts + if ( + not isinstance(data["id"], str) + or not isinstance(data["attributedTo"], str) + or not isinstance(data["type"], str) + ): + raise TypeError() # Ensure the domain of the object's actor and ID match to prevent injection if urlparse(data["id"]).hostname != urlparse(data["attributedTo"]).hostname: raise ValueError("Object's ID domain is different to its author") - except (TypeError, KeyError): - raise ValueError("Object data is not a recognizable ActivityPub object") + except (TypeError, KeyError) as ex: + raise cls.DoesNotExist( + "Object data is not a recognizable ActivityPub object" + ) from ex # Do we have one with the right ID? created = False