From 5cb24e84700cba0d23d2c4f46fcc121aab3209d3 Mon Sep 17 00:00:00 2001 From: syuilo Date: Wed, 15 Nov 2023 11:07:10 +0900 Subject: [PATCH 01/13] update pnpm --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index cc765f09ba..1369249260 100644 --- a/package.json +++ b/package.json @@ -6,7 +6,7 @@ "type": "git", "url": "https://github.com/misskey-dev/misskey.git" }, - "packageManager": "pnpm@8.10.0", + "packageManager": "pnpm@8.10.5", "workspaces": [ "packages/frontend", "packages/backend", From 3939360e5569e6a3b851f89616ff2bed1b72fb41 Mon Sep 17 00:00:00 2001 From: syuilo Date: Wed, 15 Nov 2023 11:09:54 +0900 Subject: [PATCH 02/13] =?UTF-8?q?fix(frontend):=20=E7=89=B9=E5=AE=9A?= =?UTF-8?q?=E3=81=AE=E6=9D=A1=E4=BB=B6=E4=B8=8B=E3=81=A7=E3=83=8E=E3=83=BC?= =?UTF-8?q?=E3=83=88=E3=81=8Cnyaize=E3=81=95=E3=82=8C=E3=81=AA=E3=81=84?= =?UTF-8?q?=E5=95=8F=E9=A1=8C=E3=82=92=E4=BF=AE=E6=AD=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix #12331 --- CHANGELOG.md | 1 + packages/frontend/src/components/MkNote.vue | 8 ++++---- packages/frontend/src/components/MkNoteDetailed.vue | 6 +++--- packages/frontend/src/components/MkNotePreview.vue | 2 +- packages/frontend/src/components/MkNoteSimple.vue | 2 +- packages/frontend/src/components/MkNoteSub.vue | 2 +- packages/frontend/src/components/MkSubNoteContent.vue | 2 +- .../src/components/global/MkMisskeyFlavoredMarkdown.ts | 4 ++-- 8 files changed, 14 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9de4b0aae9..6e32249ee7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -27,6 +27,7 @@ - Fix: 「フォロー中の人全員の返信を含める/含めないようにする」のボタンを押下した際の確認が機能していない問題を修正 - Fix: 非ログイン時に「ノートを追加」を表示しないように変更 #12309 - Fix: 絵文字ピッカーでの検索が更新されない問題を修正 +- Fix: 特定の条件下でノートがnyaizeされない問題を修正 ### Server - Fix: トークンのないプラグインをアンインストールするときにエラーが出ないように diff --git a/packages/frontend/src/components/MkNote.vue b/packages/frontend/src/components/MkNote.vue index 7e8b4c9b2b..e300ef88a5 100644 --- a/packages/frontend/src/components/MkNote.vue +++ b/packages/frontend/src/components/MkNote.vue @@ -43,7 +43,7 @@ SPDX-License-Identifier: AGPL-3.0-only
- +
@@ -53,7 +53,7 @@ SPDX-License-Identifier: AGPL-3.0-only

- +

@@ -65,7 +65,7 @@ SPDX-License-Identifier: AGPL-3.0-only :parsedNodes="parsed" :text="appearNote.text" :author="appearNote.user" - :nyaize="'account'" + :nyaize="'respect'" :emojiUrls="appearNote.emojis" :enableEmojiMenu="true" :enableEmojiMenuReaction="true" @@ -74,7 +74,7 @@ SPDX-License-Identifier: AGPL-3.0-only
{{ i18n.t('translatedFrom', { x: translation.sourceLang }) }}: - +
diff --git a/packages/frontend/src/components/MkNoteDetailed.vue b/packages/frontend/src/components/MkNoteDetailed.vue index 920debc884..d1bc3f676f 100644 --- a/packages/frontend/src/components/MkNoteDetailed.vue +++ b/packages/frontend/src/components/MkNoteDetailed.vue @@ -67,7 +67,7 @@ SPDX-License-Identifier: AGPL-3.0-only

- +

@@ -78,7 +78,7 @@ SPDX-License-Identifier: AGPL-3.0-only :parsedNodes="parsed" :text="appearNote.text" :author="appearNote.user" - :nyaize="'account'" + :nyaize="'respect'" :emojiUrls="appearNote.emojis" :enableEmojiMenu="true" :enableEmojiMenuReaction="true" @@ -88,7 +88,7 @@ SPDX-License-Identifier: AGPL-3.0-only
{{ i18n.t('translatedFrom', { x: translation.sourceLang }) }}: - +
diff --git a/packages/frontend/src/components/MkNotePreview.vue b/packages/frontend/src/components/MkNotePreview.vue index 79ce60baff..9b7a39b537 100644 --- a/packages/frontend/src/components/MkNotePreview.vue +++ b/packages/frontend/src/components/MkNotePreview.vue @@ -12,7 +12,7 @@ SPDX-License-Identifier: AGPL-3.0-only
- +
diff --git a/packages/frontend/src/components/MkNoteSimple.vue b/packages/frontend/src/components/MkNoteSimple.vue index 28b00af246..a40dcaf003 100644 --- a/packages/frontend/src/components/MkNoteSimple.vue +++ b/packages/frontend/src/components/MkNoteSimple.vue @@ -10,7 +10,7 @@ SPDX-License-Identifier: AGPL-3.0-only

- +

diff --git a/packages/frontend/src/components/MkNoteSub.vue b/packages/frontend/src/components/MkNoteSub.vue index f61b963d9b..422e9094cc 100644 --- a/packages/frontend/src/components/MkNoteSub.vue +++ b/packages/frontend/src/components/MkNoteSub.vue @@ -12,7 +12,7 @@ SPDX-License-Identifier: AGPL-3.0-only

- +

diff --git a/packages/frontend/src/components/MkSubNoteContent.vue b/packages/frontend/src/components/MkSubNoteContent.vue index e9f2b838d2..638407872f 100644 --- a/packages/frontend/src/components/MkSubNoteContent.vue +++ b/packages/frontend/src/components/MkSubNoteContent.vue @@ -9,7 +9,7 @@ SPDX-License-Identifier: AGPL-3.0-only ({{ i18n.ts.private }}) ({{ i18n.ts.deleted }}) - + RN: ...
diff --git a/packages/frontend/src/components/global/MkMisskeyFlavoredMarkdown.ts b/packages/frontend/src/components/global/MkMisskeyFlavoredMarkdown.ts index 441731d7ca..d14a1fb63c 100644 --- a/packages/frontend/src/components/global/MkMisskeyFlavoredMarkdown.ts +++ b/packages/frontend/src/components/global/MkMisskeyFlavoredMarkdown.ts @@ -36,7 +36,7 @@ type MfmProps = { isNote?: boolean; emojiUrls?: string[]; rootScale?: number; - nyaize: boolean | 'account'; + nyaize: boolean | 'respect'; parsedNodes?: mfm.MfmNode[] | null; enableEmojiMenu?: boolean; enableEmojiMenuReaction?: boolean; @@ -45,7 +45,7 @@ type MfmProps = { // eslint-disable-next-line import/no-default-export export default function(props: MfmProps) { const isNote = props.isNote ?? true; - const shouldNyaize = props.nyaize ? props.nyaize === 'account' ? props.author?.isCat : false : false; + const shouldNyaize = props.nyaize ? props.nyaize === 'respect' ? props.author?.isCat : false : false; // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition if (props.text == null || props.text === '') return; From aa6d0d4359d58a8295c60a79c44ab0dfe094b04e Mon Sep 17 00:00:00 2001 From: zyoshoka <107108195+zyoshoka@users.noreply.github.com> Date: Wed, 15 Nov 2023 11:10:45 +0900 Subject: [PATCH 03/13] =?UTF-8?q?fix(backend):=20=E9=9D=9E=E5=85=AC?= =?UTF-8?q?=E9=96=8B=E3=81=AE=E6=8A=95=E7=A8=BF=E3=81=AB=E5=AF=BE=E3=81=97?= =?UTF-8?q?=E3=81=A6=E8=BF=94=E4=BF=A1=E3=81=A7=E3=81=8D=E3=81=AA=E3=81=84?= =?UTF-8?q?=E3=82=88=E3=81=86=E3=81=AB=20(#12333)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(backend): 非公開の投稿に対して返信できないように * Update CHANGELOG.md * fix: test --- CHANGELOG.md | 1 + packages/backend/src/server/api/endpoints/notes/create.ts | 8 ++++++++ packages/backend/test/e2e/timelines.ts | 1 + 3 files changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6e32249ee7..c08cb036f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,6 +34,7 @@ - Fix: 投稿通知がオンでもダイレクト投稿はユーザーに通知されないようにされました - Fix: ユーザタイムラインの「ノート」選択時にリノートが混ざり込んでしまうことがある問題の修正 #12306 - Fix: ActivityPubに関するセキュリティの向上 +- Fix: 非公開の投稿に対して返信できないように ## 2023.11.0 diff --git a/packages/backend/src/server/api/endpoints/notes/create.ts b/packages/backend/src/server/api/endpoints/notes/create.ts index df02d3acb7..513b77b98a 100644 --- a/packages/backend/src/server/api/endpoints/notes/create.ts +++ b/packages/backend/src/server/api/endpoints/notes/create.ts @@ -70,6 +70,12 @@ export const meta = { id: '749ee0f6-d3da-459a-bf02-282e2da4292c', }, + cannotReplyToInvisibleNote: { + message: 'You cannot reply to an invisible Note.', + code: 'CANNOT_REPLY_TO_AN_INVISIBLE_NOTE', + id: 'b98980fa-3780-406c-a935-b6d0eeee10d1', + }, + cannotReplyToPureRenote: { message: 'You can not reply to a pure Renote.', code: 'CANNOT_REPLY_TO_A_PURE_RENOTE', @@ -276,6 +282,8 @@ export default class extends Endpoint { // eslint- throw new ApiError(meta.errors.noSuchReplyTarget); } else if (isPureRenote(reply)) { throw new ApiError(meta.errors.cannotReplyToPureRenote); + } else if (!await this.noteEntityService.isVisibleForMe(reply, me.id)) { + throw new ApiError(meta.errors.cannotReplyToInvisibleNote); } // Check blocking diff --git a/packages/backend/test/e2e/timelines.ts b/packages/backend/test/e2e/timelines.ts index 760bb8a574..73c446444b 100644 --- a/packages/backend/test/e2e/timelines.ts +++ b/packages/backend/test/e2e/timelines.ts @@ -152,6 +152,7 @@ describe('Timelines', () => { await api('/following/create', { userId: bob.id }, alice); await api('/following/create', { userId: carol.id }, alice); + await api('/following/create', { userId: carol.id }, bob); await api('/following/update', { userId: bob.id, withReplies: true }, alice); await sleep(1000); const carolNote = await post(carol, { text: 'hi', visibility: 'followers' }); From 04075ee0bede198452dcd5e8ca6a00a3b750208b Mon Sep 17 00:00:00 2001 From: Jaehong Kang Date: Wed, 15 Nov 2023 11:13:34 +0900 Subject: [PATCH 04/13] enhance(backend): Implementation of HTTP header and body validation to fix SIF-2023-002 (#12334) Using Buffer instead of string Co-authored-by: perillamint --- packages/backend/package.json | 1 + .../src/server/ActivityPubServerService.ts | 26 ++++++++++++++++--- packages/backend/src/server/ServerService.ts | 4 +-- pnpm-lock.yaml | 3 +++ 4 files changed, 29 insertions(+), 5 deletions(-) diff --git a/packages/backend/package.json b/packages/backend/package.json index c0e9016c91..beb9661fa1 100644 --- a/packages/backend/package.json +++ b/packages/backend/package.json @@ -151,6 +151,7 @@ "rss-parser": "3.13.0", "rxjs": "7.8.1", "sanitize-html": "2.11.0", + "secure-json-parse": "^2.4.0", "sharp": "0.32.6", "sharp-read-bmp": "github:misskey-dev/sharp-read-bmp", "slacc": "0.0.10", diff --git a/packages/backend/src/server/ActivityPubServerService.ts b/packages/backend/src/server/ActivityPubServerService.ts index 17c503ef8e..2c9e2cf24f 100644 --- a/packages/backend/src/server/ActivityPubServerService.ts +++ b/packages/backend/src/server/ActivityPubServerService.ts @@ -11,6 +11,7 @@ import httpSignature from '@peertube/http-signature'; import { Brackets, In, IsNull, LessThan, Not } from 'typeorm'; import accepts from 'accepts'; import vary from 'vary'; +import secureJson from 'secure-json-parse'; import { DI } from '@/di-symbols.js'; import type { FollowingsRepository, NotesRepository, EmojisRepository, NoteReactionsRepository, UserProfilesRepository, UserNotePiningsRepository, UsersRepository, FollowRequestsRepository } from '@/models/_.js'; import * as url from '@/misc/prelude/url.js'; @@ -28,7 +29,7 @@ import { UserEntityService } from '@/core/entities/UserEntityService.js'; import { bindThis } from '@/decorators.js'; import { IActivity } from '@/core/activitypub/type.js'; import { isPureRenote } from '@/misc/is-pure-renote.js'; -import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyPluginOptions } from 'fastify'; +import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyPluginOptions, FastifyBodyParser } from 'fastify'; import type { FindOptionsWhere } from 'typeorm'; const ACTIVITY_JSON = 'application/activity+json; charset=utf-8'; @@ -512,9 +513,28 @@ export class ActivityPubServerService { }, }); + const almostDefaultJsonParser: FastifyBodyParser = function (request, rawBody, done) { + if (rawBody.length === 0) { + const err = new Error('Body cannot be empty!') as any; + err.statusCode = 400; + return done(err); + } + + try { + const json = secureJson.parse(rawBody.toString('utf8'), null, { + protoAction: 'ignore', + constructorAction: 'ignore', + }); + done(null, json); + } catch (err: any) { + err.statusCode = 400; + return done(err); + } + }; + fastify.register(fastifyAccepts); - fastify.addContentTypeParser('application/activity+json', { parseAs: 'string' }, fastify.getDefaultJsonParser('ignore', 'ignore')); - fastify.addContentTypeParser('application/ld+json', { parseAs: 'string' }, fastify.getDefaultJsonParser('ignore', 'ignore')); + fastify.addContentTypeParser('application/activity+json', { parseAs: 'buffer' }, almostDefaultJsonParser); + fastify.addContentTypeParser('application/ld+json', { parseAs: 'buffer' }, almostDefaultJsonParser); fastify.addHook('onRequest', (request, reply, done) => { reply.header('Access-Control-Allow-Headers', 'Accept'); diff --git a/packages/backend/src/server/ServerService.ts b/packages/backend/src/server/ServerService.ts index 6e1956cd1d..17c2a93525 100644 --- a/packages/backend/src/server/ServerService.ts +++ b/packages/backend/src/server/ServerService.ts @@ -88,9 +88,9 @@ export class ServerService implements OnApplicationShutdown { } // Register raw-body parser for ActivityPub HTTP signature validation. - fastify.register(fastifyRawBody, { + await fastify.register(fastifyRawBody, { global: false, - encoding: 'utf-8', + encoding: null, runFirst: true, }); diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index db58506858..f483eacfd6 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -338,6 +338,9 @@ importers: sanitize-html: specifier: 2.11.0 version: 2.11.0 + secure-json-parse: + specifier: ^2.4.0 + version: 2.7.0 sharp: specifier: 0.32.6 version: 0.32.6 From 6cc0685f2af85d2eead26667430592eab6068aab Mon Sep 17 00:00:00 2001 From: atsuchan <83960488+atsu1125@users.noreply.github.com> Date: Wed, 15 Nov 2023 11:14:27 +0900 Subject: [PATCH 05/13] =?UTF-8?q?Fix(frontend):=20=E3=82=B5=E3=83=BC?= =?UTF-8?q?=E3=83=90=E3=83=BC=E3=82=B5=E3=82=A4=E3=83=AC=E3=83=B3=E3=82=B9?= =?UTF-8?q?=20(#12292)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- packages/frontend/src/pages/admin/federation.vue | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/frontend/src/pages/admin/federation.vue b/packages/frontend/src/pages/admin/federation.vue index 7dc0b46946..41849894ea 100644 --- a/packages/frontend/src/pages/admin/federation.vue +++ b/packages/frontend/src/pages/admin/federation.vue @@ -23,6 +23,7 @@ SPDX-License-Identifier: AGPL-3.0-only + @@ -83,6 +84,7 @@ const pagination = { state === 'publishing' ? { publishing: true } : state === 'suspended' ? { suspended: true } : state === 'blocked' ? { blocked: true } : + state === 'silenced' ? { silenced: true } : state === 'notResponding' ? { notResponding: true } : {}), })), @@ -91,6 +93,7 @@ const pagination = { function getStatus(instance) { if (instance.isSuspended) return 'Suspended'; if (instance.isBlocked) return 'Blocked'; + if (instance.isSilenced) return 'Silenced'; if (instance.isNotResponding) return 'Error'; return 'Alive'; } From 96f1728573204498482b2a8424ad789dc038c205 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E3=81=8A=E3=81=95=E3=82=80=E3=81=AE=E3=81=B2=E3=81=A8?= <46447427+samunohito@users.noreply.github.com> Date: Wed, 15 Nov 2023 11:24:54 +0900 Subject: [PATCH 06/13] =?UTF-8?q?fix:=20=E8=A1=A8=E7=A4=BA=E6=B8=88?= =?UTF-8?q?=E3=81=BF=E3=81=AE=E3=82=AB=E3=83=A9=E3=83=A0=E3=81=8B=E3=82=89?= =?UTF-8?q?=E5=88=A5=E3=81=AE=E3=83=81=E3=83=A3=E3=83=B3=E3=83=8D=E3=83=AB?= =?UTF-8?q?=E3=82=92=E9=81=B8=E6=8A=9E=E3=81=97=E3=81=9F=E6=99=82=E3=80=81?= =?UTF-8?q?=E3=82=BF=E3=82=A4=E3=83=A0=E3=83=A9=E3=82=A4=E3=83=B3=E3=81=AE?= =?UTF-8?q?=E5=86=85=E5=AE=B9=E3=81=8C=E8=BF=BD=E5=BE=93=E3=81=97=E3=81=A6?= =?UTF-8?q?=E5=A4=89=E6=9B=B4=E3=81=95=E3=82=8C=E3=81=AA=E3=81=84=E5=95=8F?= =?UTF-8?q?=E9=A1=8C=E3=81=AB=E5=AF=BE=E5=87=A6=20(#12237)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * 表示済みのカラムから別のチャンネルを選択した時、タイムラインの内容が追従して変更されない問題に対処 * fix CHANGELOG.md * fix code style * Update MkTimeline.vue * コメント対応（MkButtonのimportとonBeforeUpdate->watch） * fix CHANGELOG.md * Update MkPagination.vue --------- Co-authored-by: osamu <46447427+sam-osamu@users.noreply.github.com> Co-authored-by: syuilo --- CHANGELOG.md | 1 + .../frontend/src/components/MkPagination.vue | 16 +- .../frontend/src/components/MkTimeline.vue | 198 +++++++++++------- 3 files changed, 130 insertions(+), 85 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c08cb036f7..42cc4e137b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,6 +22,7 @@ ### Client - Enhance: プラグインでエラーが発生した場合のハンドリングを強化 - Enhance: 細かなUIのブラッシュアップ +- Fix: デッキに表示されたチャンネルの表示先チャンネルを切り替えた際、即座に反映されない問題を修正 #12236 - Fix: プラグインでノートの表示を書き換えられない問題を修正 - Fix: アイコンデコレーションが見切れる場合がある問題を修正 - Fix: 「フォロー中の人全員の返信を含める/含めないようにする」のボタンを押下した際の確認が機能していない問題を修正 diff --git a/packages/frontend/src/components/MkPagination.vue b/packages/frontend/src/components/MkPagination.vue index 5643de7683..e7796dfcb5 100644 --- a/packages/frontend/src/components/MkPagination.vue +++ b/packages/frontend/src/components/MkPagination.vue @@ -43,12 +43,11 @@ SPDX-License-Identifier: AGPL-3.0-only