diff --git a/packages/backend/src/core/activitypub/models/ApPersonService.ts b/packages/backend/src/core/activitypub/models/ApPersonService.ts index 73281078e5..b32d2af3bb 100644 --- a/packages/backend/src/core/activitypub/models/ApPersonService.ts +++ b/packages/backend/src/core/activitypub/models/ApPersonService.ts @@ -156,6 +156,21 @@ export class ApPersonService implements OnModuleInit { throw new Error('invalid Actor: wrong inbox'); } + try { + new URL(x.inbox); + } catch { + throw new Error('invalid Actor: wrong inbox'); + } + + const sharedInbox = x.sharedInbox ?? x.endpoints?.sharedInbox; + if (typeof sharedInbox === 'string') { + try { + new URL(sharedInbox); + } catch { + throw new Error('invalid Actor: wrong sharedInbox'); + } + } + if (!(typeof x.preferredUsername === 'string' && x.preferredUsername.length > 0 && x.preferredUsername.length <= 128 && /^\w([\w-.]*\w)?$/.test(x.preferredUsername))) { throw new Error('invalid Actor: wrong username'); }