mirrors/takahe
1
1
Fork 0
mirror of https://github.com/jointakahe/takahe.git synced 2024-11-25 00:30:59 +00:00
Code Issues Projects Releases Packages Wiki Activity

Ignore badly formed ActivityPub object data (#406)

Browse source
This commit is contained in:
Michael Manfre 2023-01-13 15:44:43 -05:00 committed by GitHub
parent cb66b9559d
commit 81fa9a6d34
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
activities/models/post.py
View file

@ -737,9 +737,13 @@ class Post(StatorModel):
Raises DoesNotExist if it's not found and create is False, Raises DoesNotExist if it's not found and create is False,
or it's from a blocked domain. or it's from a blocked domain.
""" """
# Ensure the domain of the object's actor and ID match to prevent injection try:
if urlparse(data["id"]).hostname != urlparse(data["attributedTo"]).hostname: # Ensure the domain of the object's actor and ID match to prevent injection
raise ValueError("Object's ID domain is different to its author") if urlparse(data["id"]).hostname != urlparse(data["attributedTo"]).hostname:
raise ValueError("Object's ID domain is different to its author")
except (TypeError, KeyError):
raise ValueError("Object data is not a recognizable ActivityPub object")
# Do we have one with the right ID? # Do we have one with the right ID?
created = False created = False
try: try: