diff --git a/CHANGELOG.md b/CHANGELOG.md
index befe237b09..39ce36d678 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,9 +8,9 @@
### General
- Feat: コンテンツの表示にログインを必須にできるように
- Feat: 過去のノートを非公開化/フォロワーのみ表示可能にできるように
-- Fix: お知らせ作成時に画像URL入力欄を空欄に変更できないのを修正 ( #14976 )
- Enhance: 依存関係の更新
- Enhance: l10nの更新
+- Fix: お知らせ作成時に画像URL入力欄を空欄に変更できないのを修正 ( #14976 )
### Client
- Enhance: Bull DashboardでRelationship Queueの状態も確認できるように
@@ -30,6 +30,7 @@
(Based on https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/663)
- Enhance: サイドバーを簡単に展開・折りたたみできるように ( #14981 )
- Enhance: リノートメニューに「リノートの詳細」を追加
+- Enhance: 非ログイン状態でMisskeyを開いた際のパフォーマンスを向上
- Fix: 通知の範囲指定の設定項目が必要ない通知設定でも範囲指定の設定がでている問題を修正
- Fix: Turnstileが失敗・期限切れした際にも成功扱いとなってしまう問題を修正
(Cherry-picked from https://github.com/MisskeyIO/misskey/pull/768)
@@ -65,6 +66,8 @@
(Cherry-picked from https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/709)
- Fix: User Webhookテスト機能のMock Payloadを修正
- Fix: アカウント削除のモデレーションログが動作していないのを修正 (#14996)
+- Fix: リノートミュートが新規投稿通知に対して作用していなかった問題を修正
+- Fix: セキュリティに関する修正
### Misskey.js
- Fix: Stream初期化時、別途WebSocketを指定する場合の型定義を修正
diff --git a/locales/ca-ES.yml b/locales/ca-ES.yml
index b301780972..1aca3390e6 100644
--- a/locales/ca-ES.yml
+++ b/locales/ca-ES.yml
@@ -586,6 +586,7 @@ masterVolume: "Volum principal"
notUseSound: "Sense so"
useSoundOnlyWhenActive: "Reproduir sons només quan Misskey estigui actiu"
details: "Detalls"
+renoteDetails: "Més informació sobre l'impuls "
chooseEmoji: "Tria un emoji"
unableToProcess: "L'operació no pot ser completada "
recentUsed: "Utilitzat recentment"
diff --git a/locales/de-DE.yml b/locales/de-DE.yml
index 1b3925ef38..d85c930b73 100644
--- a/locales/de-DE.yml
+++ b/locales/de-DE.yml
@@ -1242,6 +1242,7 @@ keepOriginalFilenameDescription: "Wenn diese Einstellung deaktiviert ist, wird d
noDescription: "Keine Beschreibung vorhanden"
tryAgain: "Bitte später erneut versuchen"
confirmWhenRevealingSensitiveMedia: "Das Anzeigen von sensiblen Medien bestätigen"
+sensitiveMediaRevealConfirm: "Es könnte sich um sensible Medien handeln. Möchtest du sie anzeigen?"
createdLists: "Erstellte Listen"
createdAntennas: "Erstellte Antennen"
fromX: "Von {x}"
@@ -1253,6 +1254,8 @@ thereAreNChanges: "Es gibt {n} Änderung(en)"
signinWithPasskey: "Mit Passkey anmelden"
passkeyVerificationFailed: "Die Passkey-Verifizierung ist fehlgeschlagen."
passkeyVerificationSucceededButPasswordlessLoginDisabled: "Die Verifizierung des Passkeys war erfolgreich, aber die passwortlose Anmeldung ist deaktiviert."
+messageToFollower: "Nachricht an die Follower"
+testCaptchaWarning: "Diese Funktion ist für CAPTCHA-Testzwecke gedacht.\nNicht in einer Produktivumgebung verwenden."
prohibitedWordsForNameOfUser: "Verbotene Begriffe für Benutzernamen"
prohibitedWordsForNameOfUserDescription: "Wenn eine Zeichenfolge aus dieser Liste im Namen eines Benutzers enthalten ist, wird der Benutzername abgelehnt. Benutzer mit Moderatorenrechten sind von dieser Einschränkung nicht betroffen."
yourNameContainsProhibitedWords: "Dein Name enthält einen verbotenen Begriff"
@@ -1264,6 +1267,7 @@ _accountSettings:
requireSigninToViewContentsDescription1: "Erfordere eine Anmeldung, um alle Notizen und andere Inhalte anzuzeigen, die du erstellt hast. Dadurch wird verhindert, dass Crawler deine Informationen sammeln."
requireSigninToViewContentsDescription3: "Diese Einschränkungen gelten möglicherweise nicht für föderierte Inhalte von anderen Servern."
makeNotesFollowersOnlyBefore: "Macht frühere Notizen nur für Follower sichtbar"
+ makeNotesHiddenBefore: "Frühere Notizen privat machen"
mayNotEffectForFederatedNotes: "Dies hat möglicherweise keine Auswirkungen auf Notizen, die an andere Server föderiert werden."
_abuseUserReport:
forward: "Weiterleiten"
@@ -1274,6 +1278,7 @@ _delivery:
stop: "Gesperrt"
_type:
none: "Wird veröffentlicht"
+ manuallySuspended: "Manuell gesperrt"
_bubbleGame:
howToPlay: "Wie man spielt"
hold: "Halten"
diff --git a/locales/en-US.yml b/locales/en-US.yml
index 658914d3bc..69e6da1a6f 100644
--- a/locales/en-US.yml
+++ b/locales/en-US.yml
@@ -586,6 +586,7 @@ masterVolume: "Master volume"
notUseSound: "Disable sound"
useSoundOnlyWhenActive: "Output sounds only if Misskey is active."
details: "Details"
+renoteDetails: "Renote details"
chooseEmoji: "Select an emoji"
unableToProcess: "The operation could not be completed"
recentUsed: "Recently used"
diff --git a/locales/ko-KR.yml b/locales/ko-KR.yml
index d20a9754b1..d694d2dbae 100644
--- a/locales/ko-KR.yml
+++ b/locales/ko-KR.yml
@@ -586,6 +586,7 @@ masterVolume: "마스터 볼륨"
notUseSound: "음소거 하기"
useSoundOnlyWhenActive: "Misskey를 활성화한 때에만 소리를 출력하기"
details: "자세히"
+renoteDetails: "리노트 상세 내용"
chooseEmoji: "이모지 선택"
unableToProcess: "작업을 완료할 수 없습니다"
recentUsed: "최근 사용"
@@ -1299,6 +1300,7 @@ thisContentsAreMarkedAsSigninRequiredByAuthor: "게시자에 의해 로그인해
lockdown: "잠금"
pleaseSelectAccount: "계정을 선택해주세요."
availableRoles: "사용 가능한 역할"
+acknowledgeNotesAndEnable: "활성화 하기 전에 주의 사항을 확인했습니다."
_accountSettings:
requireSigninToViewContents: "콘텐츠 열람을 위해 로그인으 필수로 설정하기"
requireSigninToViewContentsDescription1: "자신이 작성한 모든 노트 등의 콘텐츠를 보기 위해 로그인을 필수로 설정합니다. 크롤러가 정보 수집하는 것을 방지하는 효과를 기대할 수 있습니다."
@@ -1455,6 +1457,8 @@ _serverSettings:
reactionsBufferingDescription: "활성화 한 경우, 리액션 작성 퍼포먼스가 대폭 향상되어 DB의 부하를 줄일 수 있으나, Redis의 메모리 사용량이 많아집니다."
inquiryUrl: "문의처 URL"
inquiryUrlDescription: "서버 운영자에게 보내는 문의 양식의 URL이나 운영자의 연락처 등이 적힌 웹 페이지의 URL을 설정합니다."
+ openRegistration: "회원 가입을 활성화 하기"
+ openRegistrationWarning: "회원 가입을 개방하는 것은 리스크가 따릅니다. 서버를 항상 감시할 수 있고, 문제가 발생했을 때 바로 대응할 수 있는 상태에서만 활성화 하는 것을 권장합니다."
thisSettingWillAutomaticallyOffWhenModeratorsInactive: "일정 기간동안 모더레이터의 활동이 감지되지 않는 경우, 스팸 방지를 위해 이 설정은 자동으로 꺼집니다."
_accountMigration:
moveFrom: "다른 계정에서 이 계정으로 이사"
@@ -2737,3 +2741,6 @@ _selfXssPrevention:
description1: "여기에 무언가를 붙여넣으면 악의적인 사용자에게 계정을 탈취당하거나 개인정보를 도용당할 수 있습니다."
description2: "붙여 넣으려는 항목이 무엇인지 정확히 이해하지 못하는 경우, %c지금 바로 작업을 중단하고 이 창을 닫으십시오."
description3: "자세한 내용은 여기를 확인해 주세요. {link}"
+_followRequest:
+ recieved: "받은 신청"
+ sent: "보낸 신청"
diff --git a/locales/zh-CN.yml b/locales/zh-CN.yml
index c5a581035d..08e007df7f 100644
--- a/locales/zh-CN.yml
+++ b/locales/zh-CN.yml
@@ -1707,9 +1707,9 @@ _achievements:
description: "在元旦登入"
flavor: "今年也请对本服务器多多指教！"
_cookieClicked:
- title: "点击饼干小游戏"
+ title: "饼干点点乐"
description: "点击了饼干"
- flavor: "用错软件了？"
+ flavor: "穿越了？"
_brainDiver:
title: "Brain Diver"
description: "发布了包含 Brain Diver 链接的帖子"
diff --git a/locales/zh-TW.yml b/locales/zh-TW.yml
index 1e8e27c7bd..d4ffb28c76 100644
--- a/locales/zh-TW.yml
+++ b/locales/zh-TW.yml
@@ -586,6 +586,7 @@ masterVolume: "主音量"
notUseSound: "關閉音效"
useSoundOnlyWhenActive: "瀏覽器在前景運作時，Misskey 才會發出音效"
details: "詳細資訊"
+renoteDetails: "轉發貼文的細節"
chooseEmoji: "選擇您的表情符號"
unableToProcess: "操作無法完成"
recentUsed: "最近使用"
diff --git a/package.json b/package.json
index 4dd411c10f..ccb6170a16 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "misskey",
- "version": "2024.11.0-alpha.2",
+ "version": "2024.11.0-beta.4",
"codename": "nasubi",
"repository": {
"type": "git",
diff --git a/packages/backend/src/core/DownloadService.ts b/packages/backend/src/core/DownloadService.ts
index 93f4a38246..2e78e6d877 100644
--- a/packages/backend/src/core/DownloadService.ts
+++ b/packages/backend/src/core/DownloadService.ts
@@ -6,7 +6,6 @@
import * as fs from 'node:fs';
import * as stream from 'node:stream/promises';
import { Inject, Injectable } from '@nestjs/common';
-import ipaddr from 'ipaddr.js';
import chalk from 'chalk';
import got, * as Got from 'got';
import { parse } from 'content-disposition';
@@ -70,13 +69,6 @@ export class DownloadService {
},
enableUnixSockets: false,
}).on('response', (res: Got.Response) => {
- if ((process.env.NODE_ENV === 'production' || process.env.NODE_ENV === 'test') && !this.config.proxy && res.ip) {
- if (this.isPrivateIp(res.ip)) {
- this.logger.warn(`Blocked address: ${res.ip}`);
- req.destroy();
- }
- }
-
const contentLength = res.headers['content-length'];
if (contentLength != null) {
const size = Number(contentLength);
@@ -139,18 +131,4 @@ export class DownloadService {
cleanup();
}
}
-
- @bindThis
- private isPrivateIp(ip: string): boolean {
- const parsedIp = ipaddr.parse(ip);
-
- for (const net of this.config.allowedPrivateNetworks ?? []) {
- const cidr = ipaddr.parseCIDR(net);
- if (cidr[0].kind() === parsedIp.kind() && parsedIp.match(ipaddr.parseCIDR(net))) {
- return false;
- }
- }
-
- return parsedIp.range() !== 'unicast';
- }
}
diff --git a/packages/backend/src/core/EmailService.ts b/packages/backend/src/core/EmailService.ts
index a176474b95..da198d0e42 100644
--- a/packages/backend/src/core/EmailService.ts
+++ b/packages/backend/src/core/EmailService.ts
@@ -312,6 +312,7 @@ export class EmailService {
Accept: 'application/json',
Authorization: truemailAuthKey,
},
+ isLocalAddressAllowed: true,
});
const json = (await res.json()) as {
diff --git a/packages/backend/src/core/HttpRequestService.ts b/packages/backend/src/core/HttpRequestService.ts
index 7f3cac7c58..083153940a 100644
--- a/packages/backend/src/core/HttpRequestService.ts
+++ b/packages/backend/src/core/HttpRequestService.ts
@@ -6,6 +6,7 @@
import * as http from 'node:http';
import * as https from 'node:https';
import * as net from 'node:net';
+import ipaddr from 'ipaddr.js';
import CacheableLookup from 'cacheable-lookup';
import fetch from 'node-fetch';
import { HttpProxyAgent, HttpsProxyAgent } from 'hpagent';
@@ -15,6 +16,7 @@ import type { Config } from '@/config.js';
import { StatusError } from '@/misc/status-error.js';
import { bindThis } from '@/decorators.js';
import { validateContentTypeSetAsActivityPub } from '@/core/activitypub/misc/validator.js';
+import { assertActivityMatchesUrls } from '@/core/activitypub/misc/check-against-url.js';
import type { IObject } from '@/core/activitypub/type.js';
import type { Response } from 'node-fetch';
import type { URL } from 'node:url';
@@ -24,8 +26,102 @@ export type HttpRequestSendOptions = {
validators?: ((res: Response) => void)[];
};
+declare module 'node:http' {
+ interface Agent {
+ createConnection(options: net.NetConnectOpts, callback?: (err: unknown, stream: net.Socket) => void): net.Socket;
+ }
+}
+
+class HttpRequestServiceAgent extends http.Agent {
+ constructor(
+ private config: Config,
+ options?: http.AgentOptions,
+ ) {
+ super(options);
+ }
+
+ @bindThis
+ public createConnection(options: net.NetConnectOpts, callback?: (err: unknown, stream: net.Socket) => void): net.Socket {
+ const socket = super.createConnection(options, callback)
+ .on('connect', () => {
+ const address = socket.remoteAddress;
+ if (process.env.NODE_ENV === 'production') {
+ if (address && ipaddr.isValid(address)) {
+ if (this.isPrivateIp(address)) {
+ socket.destroy(new Error(`Blocked address: ${address}`));
+ }
+ }
+ }
+ });
+ return socket;
+ }
+
+ @bindThis
+ private isPrivateIp(ip: string): boolean {
+ const parsedIp = ipaddr.parse(ip);
+
+ for (const net of this.config.allowedPrivateNetworks ?? []) {
+ const cidr = ipaddr.parseCIDR(net);
+ if (cidr[0].kind() === parsedIp.kind() && parsedIp.match(ipaddr.parseCIDR(net))) {
+ return false;
+ }
+ }
+
+ return parsedIp.range() !== 'unicast';
+ }
+}
+
+class HttpsRequestServiceAgent extends https.Agent {
+ constructor(
+ private config: Config,
+ options?: https.AgentOptions,
+ ) {
+ super(options);
+ }
+
+ @bindThis
+ public createConnection(options: net.NetConnectOpts, callback?: (err: unknown, stream: net.Socket) => void): net.Socket {
+ const socket = super.createConnection(options, callback)
+ .on('connect', () => {
+ const address = socket.remoteAddress;
+ if (process.env.NODE_ENV === 'production') {
+ if (address && ipaddr.isValid(address)) {
+ if (this.isPrivateIp(address)) {
+ socket.destroy(new Error(`Blocked address: ${address}`));
+ }
+ }
+ }
+ });
+ return socket;
+ }
+
+ @bindThis
+ private isPrivateIp(ip: string): boolean {
+ const parsedIp = ipaddr.parse(ip);
+
+ for (const net of this.config.allowedPrivateNetworks ?? []) {
+ const cidr = ipaddr.parseCIDR(net);
+ if (cidr[0].kind() === parsedIp.kind() && parsedIp.match(ipaddr.parseCIDR(net))) {
+ return false;
+ }
+ }
+
+ return parsedIp.range() !== 'unicast';
+ }
+}
+
@Injectable()
export class HttpRequestService {
+ /**
+ * Get http non-proxy agent (without local address filtering)
+ */
+ private httpNative: http.Agent;
+
+ /**
+ * Get https non-proxy agent (without local address filtering)
+ */
+ private httpsNative: https.Agent;
+
/**
* Get http non-proxy agent
*/
@@ -56,19 +152,20 @@ export class HttpRequestService {
lookup: false, // nativeのdns.lookupにfallbackしない
});
- this.http = new http.Agent({
+ const agentOption = {
keepAlive: true,
keepAliveMsecs: 30 * 1000,
lookup: cache.lookup as unknown as net.LookupFunction,
localAddress: config.outgoingAddress,
- });
+ };
- this.https = new https.Agent({
- keepAlive: true,
- keepAliveMsecs: 30 * 1000,
- lookup: cache.lookup as unknown as net.LookupFunction,
- localAddress: config.outgoingAddress,
- });
+ this.httpNative = new http.Agent(agentOption);
+
+ this.httpsNative = new https.Agent(agentOption);
+
+ this.http = new HttpRequestServiceAgent(config, agentOption);
+
+ this.https = new HttpsRequestServiceAgent(config, agentOption);
const maxSockets = Math.max(256, config.deliverJobConcurrency ?? 128);
@@ -103,16 +200,22 @@ export class HttpRequestService {
* @param bypassProxy Allways bypass proxy
*/
@bindThis
- public getAgentByUrl(url: URL, bypassProxy = false): http.Agent | https.Agent {
+ public getAgentByUrl(url: URL, bypassProxy = false, isLocalAddressAllowed = false): http.Agent | https.Agent {
if (bypassProxy || (this.config.proxyBypassHosts ?? []).includes(url.hostname)) {
+ if (isLocalAddressAllowed) {
+ return url.protocol === 'http:' ? this.httpNative : this.httpsNative;
+ }
return url.protocol === 'http:' ? this.http : this.https;
} else {
+ if (isLocalAddressAllowed && (!this.config.proxy)) {
+ return url.protocol === 'http:' ? this.httpNative : this.httpsNative;
+ }
return url.protocol === 'http:' ? this.httpAgent : this.httpsAgent;
}
}
@bindThis
- public async getActivityJson(url: string): Promise {
+ public async getActivityJson(url: string, isLocalAddressAllowed = false): Promise {
const res = await this.send(url, {
method: 'GET',
headers: {
@@ -120,16 +223,22 @@ export class HttpRequestService {
},
timeout: 5000,
size: 1024 * 256,
+ isLocalAddressAllowed: isLocalAddressAllowed,
}, {
throwErrorWhenResponseNotOk: true,
validators: [validateContentTypeSetAsActivityPub],
});
- return await res.json() as IObject;
+ const finalUrl = res.url; // redirects may have been involved
+ const activity = await res.json() as IObject;
+
+ assertActivityMatchesUrls(activity, [finalUrl]);
+
+ return activity;
}
@bindThis
- public async getJson(url: string, accept = 'application/json, */*', headers?: Record): Promise {
+ public async getJson(url: string, accept = 'application/json, */*', headers?: Record, isLocalAddressAllowed = false): Promise {
const res = await this.send(url, {
method: 'GET',
headers: Object.assign({
@@ -137,19 +246,21 @@ export class HttpRequestService {
}, headers ?? {}),
timeout: 5000,
size: 1024 * 256,
+ isLocalAddressAllowed: isLocalAddressAllowed,
});
return await res.json() as T;
}
@bindThis
- public async getHtml(url: string, accept = 'text/html, */*', headers?: Record): Promise {
+ public async getHtml(url: string, accept = 'text/html, */*', headers?: Record, isLocalAddressAllowed = false): Promise {
const res = await this.send(url, {
method: 'GET',
headers: Object.assign({
Accept: accept,
}, headers ?? {}),
timeout: 5000,
+ isLocalAddressAllowed: isLocalAddressAllowed,
});
return await res.text();
@@ -164,6 +275,7 @@ export class HttpRequestService {
headers?: Record,
timeout?: number,
size?: number,
+ isLocalAddressAllowed?: boolean,
} = {},
extra: HttpRequestSendOptions = {
throwErrorWhenResponseNotOk: true,
@@ -177,6 +289,8 @@ export class HttpRequestService {
controller.abort();
}, timeout);
+ const isLocalAddressAllowed = args.isLocalAddressAllowed ?? false;
+
const res = await fetch(url, {
method: args.method ?? 'GET',
headers: {
@@ -185,7 +299,7 @@ export class HttpRequestService {
},
body: args.body,
size: args.size ?? 10 * 1024 * 1024,
- agent: (url) => this.getAgentByUrl(url),
+ agent: (url) => this.getAgentByUrl(url, false, isLocalAddressAllowed),
signal: controller.signal,
});
diff --git a/packages/backend/src/core/NoteCreateService.ts b/packages/backend/src/core/NoteCreateService.ts
index 3647fa7231..56ddcefd7c 100644
--- a/packages/backend/src/core/NoteCreateService.ts
+++ b/packages/backend/src/core/NoteCreateService.ts
@@ -56,6 +56,7 @@ import { isReply } from '@/misc/is-reply.js';
import { trackPromise } from '@/misc/promise-tracker.js';
import { IdentifiableError } from '@/misc/identifiable-error.js';
import { CollapsedQueue } from '@/misc/collapsed-queue.js';
+import { CacheService } from '@/core/CacheService.js';
type NotificationType = 'reply' | 'renote' | 'quote' | 'mention';
@@ -217,6 +218,7 @@ export class NoteCreateService implements OnApplicationShutdown {
private instanceChart: InstanceChart,
private utilityService: UtilityService,
private userBlockingService: UserBlockingService,
+ private cacheService: CacheService,
) {
this.updateNotesCountQueue = new CollapsedQueue(process.env.NODE_ENV !== 'test' ? 60 * 1000 * 5 : 0, this.collapseNotesCount, this.performUpdateNotesCount);
}
@@ -543,13 +545,21 @@ export class NoteCreateService implements OnApplicationShutdown {
this.followingsRepository.findBy({
followeeId: user.id,
notify: 'normal',
- }).then(followings => {
+ }).then(async followings => {
if (note.visibility !== 'specified') {
+ const isPureRenote = this.isRenote(data) && !this.isQuote(data) ? true : false;
for (const following of followings) {
// TODO: ワードミュート考慮
- this.notificationService.createNotification(following.followerId, 'note', {
- noteId: note.id,
- }, user.id);
+ let isRenoteMuted = false;
+ if (isPureRenote) {
+ const userIdsWhoMeMutingRenotes = await this.cacheService.renoteMutingsCache.fetch(following.followerId);
+ isRenoteMuted = userIdsWhoMeMutingRenotes.has(user.id);
+ }
+ if (!isRenoteMuted) {
+ this.notificationService.createNotification(following.followerId, 'note', {
+ noteId: note.id,
+ }, user.id);
+ }
}
}
});
diff --git a/packages/backend/src/core/RemoteUserResolveService.ts b/packages/backend/src/core/RemoteUserResolveService.ts
index f5a55eb8bc..098b5e1706 100644
--- a/packages/backend/src/core/RemoteUserResolveService.ts
+++ b/packages/backend/src/core/RemoteUserResolveService.ts
@@ -56,7 +56,7 @@ export class RemoteUserResolveService {
host = this.utilityService.toPuny(host);
- if (this.config.host === host) {
+ if (host === this.utilityService.toPuny(this.config.host)) {
this.logger.info(`return local user: ${usernameLower}`);
return await this.usersRepository.findOneBy({ usernameLower, host: IsNull() }).then(u => {
if (u == null) {
diff --git a/packages/backend/src/core/UtilityService.ts b/packages/backend/src/core/UtilityService.ts
index 86082ccdcd..9a2ba72ed3 100644
--- a/packages/backend/src/core/UtilityService.ts
+++ b/packages/backend/src/core/UtilityService.ts
@@ -34,6 +34,11 @@ export class UtilityService {
return this.toPuny(this.config.host) === this.toPuny(host);
}
+ @bindThis
+ public isUriLocal(uri: string): boolean {
+ return this.punyHost(uri) === this.toPuny(this.config.host);
+ }
+
@bindThis
public isBlockedHost(blockedHosts: string[], host: string | null): boolean {
if (host == null) return false;
@@ -96,7 +101,7 @@ export class UtilityService {
@bindThis
public extractDbHost(uri: string): string {
const url = new URL(uri);
- return this.toPuny(url.hostname);
+ return this.toPuny(url.host);
}
@bindThis
@@ -110,6 +115,13 @@ export class UtilityService {
return toASCII(host.toLowerCase());
}
+ @bindThis
+ public punyHost(url: string): string {
+ const urlObj = new URL(url);
+ const host = `${this.toPuny(urlObj.hostname)}${urlObj.port.length > 0 ? ':' + urlObj.port : ''}`;
+ return host;
+ }
+
@bindThis
public isFederationAllowedHost(host: string): boolean {
if (this.meta.federation === 'none') return false;
diff --git a/packages/backend/src/core/WebAuthnService.ts b/packages/backend/src/core/WebAuthnService.ts
index 75ab0a207c..ad53192f18 100644
--- a/packages/backend/src/core/WebAuthnService.ts
+++ b/packages/backend/src/core/WebAuthnService.ts
@@ -246,14 +246,12 @@ export class WebAuthnService {
@bindThis
public async verifyAuthentication(userId: MiUser['id'], response: AuthenticationResponseJSON): Promise {
- const challenge = await this.redisClient.get(`webauthn:challenge:${userId}`);
+ const challenge = await this.redisClient.getdel(`webauthn:challenge:${userId}`);
if (!challenge) {
throw new IdentifiableError('2d16e51c-007b-4edd-afd2-f7dd02c947f6', 'challenge not found');
}
- await this.redisClient.del(`webauthn:challenge:${userId}`);
-
const key = await this.userSecurityKeysRepository.findOneBy({
id: response.id,
userId: userId,
diff --git a/packages/backend/src/core/activitypub/ApDbResolverService.ts b/packages/backend/src/core/activitypub/ApDbResolverService.ts
index 4192e8659a..5c16744a77 100644
--- a/packages/backend/src/core/activitypub/ApDbResolverService.ts
+++ b/packages/backend/src/core/activitypub/ApDbResolverService.ts
@@ -10,6 +10,7 @@ import type { Config } from '@/config.js';
import { MemoryKVCache } from '@/misc/cache.js';
import type { MiUserPublickey } from '@/models/UserPublickey.js';
import { CacheService } from '@/core/CacheService.js';
+import { UtilityService } from '@/core/UtilityService.js';
import type { MiNote } from '@/models/Note.js';
import { bindThis } from '@/decorators.js';
import { MiLocalUser, MiRemoteUser } from '@/models/User.js';
@@ -53,6 +54,7 @@ export class ApDbResolverService implements OnApplicationShutdown {
private cacheService: CacheService,
private apPersonService: ApPersonService,
+ private utilityService: UtilityService,
) {
this.publicKeyCache = new MemoryKVCache(1000 * 60 * 60 * 12); // 12h
this.publicKeyByUserIdCache = new MemoryKVCache(1000 * 60 * 60 * 12); // 12h
@@ -63,7 +65,9 @@ export class ApDbResolverService implements OnApplicationShutdown {
const separator = '/';
const uri = new URL(getApId(value));
- if (uri.origin !== this.config.url) return { local: false, uri: uri.href };
+ if (this.utilityService.toPuny(uri.host) !== this.utilityService.toPuny(this.config.host)) {
+ return { local: false, uri: uri.href };
+ }
const [, type, id, ...rest] = uri.pathname.split(separator);
return {
diff --git a/packages/backend/src/core/activitypub/ApInboxService.ts b/packages/backend/src/core/activitypub/ApInboxService.ts
index 376c9c0151..ee3f691c51 100644
--- a/packages/backend/src/core/activitypub/ApInboxService.ts
+++ b/packages/backend/src/core/activitypub/ApInboxService.ts
@@ -89,15 +89,26 @@ export class ApInboxService {
}
@bindThis
- public async performActivity(actor: MiRemoteUser, activity: IObject): Promise {
+ public async performActivity(actor: MiRemoteUser, activity: IObject, resolver?: Resolver): Promise {
let result = undefined as string | void;
if (isCollectionOrOrderedCollection(activity)) {
const results = [] as [string, string | void][];
- const resolver = this.apResolverService.createResolver();
- for (const item of toArray(isCollection(activity) ? activity.items : activity.orderedItems)) {
+ // eslint-disable-next-line no-param-reassign
+ resolver ??= this.apResolverService.createResolver();
+
+ const items = toArray(isCollection(activity) ? activity.items : activity.orderedItems);
+ if (items.length >= resolver.getRecursionLimit()) {
+ throw new Error(`skipping activity: collection would surpass recursion limit: ${this.utilityService.extractDbHost(actor.uri)}`);
+ }
+
+ for (const item of items) {
const act = await resolver.resolve(item);
+ if (act.id == null || this.utilityService.extractDbHost(act.id) !== this.utilityService.extractDbHost(actor.uri)) {
+ this.logger.debug('skipping activity: activity id is null or mismatching');
+ continue;
+ }
try {
- results.push([getApId(item), await this.performOneActivity(actor, act)]);
+ results.push([getApId(item), await this.performOneActivity(actor, act, resolver)]);
} catch (err) {
if (err instanceof Error || typeof err === 'string') {
this.logger.error(err);
@@ -112,13 +123,14 @@ export class ApInboxService {
result = results.map(([id, reason]) => `${id}: ${reason}`).join('\n');
}
} else {
- result = await this.performOneActivity(actor, activity);
+ result = await this.performOneActivity(actor, activity, resolver);
}
// ついでにリモートユーザーの情報が古かったら更新しておく
if (actor.uri) {
if (actor.lastFetchedAt == null || Date.now() - actor.lastFetchedAt.getTime() > 1000 * 60 * 60 * 24) {
setImmediate(() => {
+ // 同一ユーザーの情報を再度処理するので、使用済みのresolverを再利用してはいけない
this.apPersonService.updatePerson(actor.uri);
});
}
@@ -127,37 +139,37 @@ export class ApInboxService {
}
@bindThis
- public async performOneActivity(actor: MiRemoteUser, activity: IObject): Promise {
+ public async performOneActivity(actor: MiRemoteUser, activity: IObject, resolver?: Resolver): Promise {
if (actor.isSuspended) return;
if (isCreate(activity)) {
- return await this.create(actor, activity);
+ return await this.create(actor, activity, resolver);
} else if (isDelete(activity)) {
return await this.delete(actor, activity);
} else if (isUpdate(activity)) {
- return await this.update(actor, activity);
+ return await this.update(actor, activity, resolver);
} else if (isFollow(activity)) {
return await this.follow(actor, activity);
} else if (isAccept(activity)) {
- return await this.accept(actor, activity);
+ return await this.accept(actor, activity, resolver);
} else if (isReject(activity)) {
- return await this.reject(actor, activity);
+ return await this.reject(actor, activity, resolver);
} else if (isAdd(activity)) {
- return await this.add(actor, activity);
+ return await this.add(actor, activity, resolver);
} else if (isRemove(activity)) {
- return await this.remove(actor, activity);
+ return await this.remove(actor, activity, resolver);
} else if (isAnnounce(activity)) {
- return await this.announce(actor, activity);
+ return await this.announce(actor, activity, resolver);
} else if (isLike(activity)) {
return await this.like(actor, activity);
} else if (isUndo(activity)) {
- return await this.undo(actor, activity);
+ return await this.undo(actor, activity, resolver);
} else if (isBlock(activity)) {
return await this.block(actor, activity);
} else if (isFlag(activity)) {
return await this.flag(actor, activity);
} else if (isMove(activity)) {
- return await this.move(actor, activity);
+ return await this.move(actor, activity, resolver);
} else {
return `unrecognized activity type: ${activity.type}`;
}
@@ -199,12 +211,13 @@ export class ApInboxService {
}
@bindThis
- private async accept(actor: MiRemoteUser, activity: IAccept): Promise {
+ private async accept(actor: MiRemoteUser, activity: IAccept, resolver?: Resolver): Promise {
const uri = activity.id ?? activity;
this.logger.info(`Accept: ${uri}`);
- const resolver = this.apResolverService.createResolver();
+ // eslint-disable-next-line no-param-reassign
+ resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activity.object).catch(err => {
this.logger.error(`Resolution failed: ${err}`);
@@ -241,7 +254,7 @@ export class ApInboxService {
}
@bindThis
- private async add(actor: MiRemoteUser, activity: IAdd): Promise {
+ private async add(actor: MiRemoteUser, activity: IAdd, resolver?: Resolver): Promise {
if (actor.uri !== activity.actor) {
return 'invalid actor';
}
@@ -251,7 +264,7 @@ export class ApInboxService {
}
if (activity.target === actor.featured) {
- const note = await this.apNoteService.resolveNote(activity.object);
+ const note = await this.apNoteService.resolveNote(activity.object, { resolver });
if (note == null) return 'note not found';
await this.notePiningService.addPinned(actor, note.id);
return;
@@ -261,12 +274,13 @@ export class ApInboxService {
}
@bindThis
- private async announce(actor: MiRemoteUser, activity: IAnnounce): Promise {
+ private async announce(actor: MiRemoteUser, activity: IAnnounce, resolver?: Resolver): Promise {
const uri = getApId(activity);
this.logger.info(`Announce: ${uri}`);
- const resolver = this.apResolverService.createResolver();
+ // eslint-disable-next-line no-param-reassign
+ resolver ??= this.apResolverService.createResolver();
if (!activity.object) return 'skip: activity has no object property';
const targetUri = getApId(activity.object);
@@ -283,7 +297,7 @@ export class ApInboxService {
}
@bindThis
- private async announceNote(actor: MiRemoteUser, activity: IAnnounce, target: IPost): Promise {
+ private async announceNote(actor: MiRemoteUser, activity: IAnnounce, target: IPost, resolver?: Resolver): Promise {
const uri = getApId(activity);
if (actor.isSuspended) {
@@ -305,7 +319,7 @@ export class ApInboxService {
// Announce対象をresolve
let renote;
try {
- renote = await this.apNoteService.resolveNote(target);
+ renote = await this.apNoteService.resolveNote(target, { resolver });
if (renote == null) return 'announce target is null';
} catch (err) {
// 対象が4xxならスキップ
@@ -324,7 +338,7 @@ export class ApInboxService {
this.logger.info(`Creating the (Re)Note: ${uri}`);
- const activityAudience = await this.apAudienceService.parseAudience(actor, activity.to, activity.cc);
+ const activityAudience = await this.apAudienceService.parseAudience(actor, activity.to, activity.cc, resolver);
const createdAt = activity.published ? new Date(activity.published) : null;
if (createdAt && createdAt < this.idService.parse(renote.id).date) {
@@ -362,7 +376,7 @@ export class ApInboxService {
}
@bindThis
- private async create(actor: MiRemoteUser, activity: ICreate): Promise {
+ private async create(actor: MiRemoteUser, activity: ICreate, resolver?: Resolver): Promise {
const uri = getApId(activity);
this.logger.info(`Create: ${uri}`);
@@ -387,7 +401,8 @@ export class ApInboxService {
activity.object.attributedTo = activity.actor;
}
- const resolver = this.apResolverService.createResolver();
+ // eslint-disable-next-line no-param-reassign
+ resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activity.object).catch(e => {
this.logger.error(`Resolution failed: ${e}`);
@@ -414,6 +429,8 @@ export class ApInboxService {
if (this.utilityService.extractDbHost(actor.uri) !== this.utilityService.extractDbHost(note.id)) {
return 'skip: host in actor.uri !== note.id';
}
+ } else {
+ return 'skip: note.id is not a string';
}
}
@@ -423,7 +440,7 @@ export class ApInboxService {
const exist = await this.apNoteService.fetchNote(note);
if (exist) return 'skip: note exists';
- await this.apNoteService.createNote(note, resolver, silent);
+ await this.apNoteService.createNote(note, actor, resolver, silent);
return 'ok';
} catch (err) {
if (err instanceof StatusError && !err.isRetryable) {
@@ -555,12 +572,13 @@ export class ApInboxService {
}
@bindThis
- private async reject(actor: MiRemoteUser, activity: IReject): Promise {
+ private async reject(actor: MiRemoteUser, activity: IReject, resolver?: Resolver): Promise {
const uri = activity.id ?? activity;
this.logger.info(`Reject: ${uri}`);
- const resolver = this.apResolverService.createResolver();
+ // eslint-disable-next-line no-param-reassign
+ resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activity.object).catch(e => {
this.logger.error(`Resolution failed: ${e}`);
@@ -597,7 +615,7 @@ export class ApInboxService {
}
@bindThis
- private async remove(actor: MiRemoteUser, activity: IRemove): Promise {
+ private async remove(actor: MiRemoteUser, activity: IRemove, resolver?: Resolver): Promise {
if (actor.uri !== activity.actor) {
return 'invalid actor';
}
@@ -607,7 +625,7 @@ export class ApInboxService {
}
if (activity.target === actor.featured) {
- const note = await this.apNoteService.resolveNote(activity.object);
+ const note = await this.apNoteService.resolveNote(activity.object, { resolver });
if (note == null) return 'note not found';
await this.notePiningService.removePinned(actor, note.id);
return;
@@ -617,7 +635,7 @@ export class ApInboxService {
}
@bindThis
- private async undo(actor: MiRemoteUser, activity: IUndo): Promise {
+ private async undo(actor: MiRemoteUser, activity: IUndo, resolver?: Resolver): Promise {
if (actor.uri !== activity.actor) {
return 'invalid actor';
}
@@ -626,7 +644,8 @@ export class ApInboxService {
this.logger.info(`Undo: ${uri}`);
- const resolver = this.apResolverService.createResolver();
+ // eslint-disable-next-line no-param-reassign
+ resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activity.object).catch(e => {
this.logger.error(`Resolution failed: ${e}`);
@@ -750,14 +769,15 @@ export class ApInboxService {
}
@bindThis
- private async update(actor: MiRemoteUser, activity: IUpdate): Promise {
+ private async update(actor: MiRemoteUser, activity: IUpdate, resolver?: Resolver): Promise {
if (actor.uri !== activity.actor) {
return 'skip: invalid actor';
}
this.logger.debug('Update');
- const resolver = this.apResolverService.createResolver();
+ // eslint-disable-next-line no-param-reassign
+ resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activity.object).catch(e => {
this.logger.error(`Resolution failed: ${e}`);
@@ -768,7 +788,7 @@ export class ApInboxService {
await this.apPersonService.updatePerson(actor.uri, resolver, object);
return 'ok: Person updated';
} else if (getApType(object) === 'Question') {
- await this.apQuestionService.updateQuestion(object, resolver).catch(err => console.error(err));
+ await this.apQuestionService.updateQuestion(object, actor, resolver).catch(err => console.error(err));
return 'ok: Question updated';
} else {
return `skip: Unknown type: ${getApType(object)}`;
@@ -776,11 +796,11 @@ export class ApInboxService {
}
@bindThis
- private async move(actor: MiRemoteUser, activity: IMove): Promise {
+ private async move(actor: MiRemoteUser, activity: IMove, resolver?: Resolver): Promise {
// fetch the new and old accounts
const targetUri = getApHrefNullable(activity.target);
if (!targetUri) return 'skip: invalid activity target';
- return await this.apPersonService.updatePerson(actor.uri) ?? 'skip: nothing to do';
+ return await this.apPersonService.updatePerson(actor.uri, resolver) ?? 'skip: nothing to do';
}
}
diff --git a/packages/backend/src/core/activitypub/ApRequestService.ts b/packages/backend/src/core/activitypub/ApRequestService.ts
index c7d19adfd5..8c3b7295e4 100644
--- a/packages/backend/src/core/activitypub/ApRequestService.ts
+++ b/packages/backend/src/core/activitypub/ApRequestService.ts
@@ -11,11 +11,14 @@ import { DI } from '@/di-symbols.js';
import type { Config } from '@/config.js';
import type { MiUser } from '@/models/User.js';
import { UserKeypairService } from '@/core/UserKeypairService.js';
+import { UtilityService } from '@/core/UtilityService.js';
import { HttpRequestService } from '@/core/HttpRequestService.js';
import { LoggerService } from '@/core/LoggerService.js';
import { bindThis } from '@/decorators.js';
import type Logger from '@/logger.js';
import { validateContentTypeSetAsActivityPub } from '@/core/activitypub/misc/validator.js';
+import { assertActivityMatchesUrls } from '@/core/activitypub/misc/check-against-url.js';
+import type { IObject } from './type.js';
type Request = {
url: string;
@@ -145,6 +148,7 @@ export class ApRequestService {
private userKeypairService: UserKeypairService,
private httpRequestService: HttpRequestService,
private loggerService: LoggerService,
+ private utilityService: UtilityService,
) {
// eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
this.logger = this.loggerService?.getLogger('ap-request'); // なぜか TypeError: Cannot read properties of undefined (reading 'getLogger') と言われる
@@ -238,7 +242,7 @@ export class ApRequestService {
const alternate = document.querySelector('head > link[rel="alternate"][type="application/activity+json"]');
if (alternate) {
const href = alternate.getAttribute('href');
- if (href) {
+ if (href && this.utilityService.punyHost(url) === this.utilityService.punyHost(href)) {
return await this.signedGet(href, user, false);
}
}
@@ -251,7 +255,11 @@ export class ApRequestService {
//#endregion
validateContentTypeSetAsActivityPub(res);
+ const finalUrl = res.url; // redirects may have been involved
+ const activity = await res.json() as IObject;
- return await res.json();
+ assertActivityMatchesUrls(activity, [finalUrl]);
+
+ return activity;
}
}
diff --git a/packages/backend/src/core/activitypub/ApResolverService.ts b/packages/backend/src/core/activitypub/ApResolverService.ts
index ca35608d9b..b0b35274ea 100644
--- a/packages/backend/src/core/activitypub/ApResolverService.ts
+++ b/packages/backend/src/core/activitypub/ApResolverService.ts
@@ -41,7 +41,7 @@ export class Resolver {
private apRendererService: ApRendererService,
private apDbResolverService: ApDbResolverService,
private loggerService: LoggerService,
- private recursionLimit = 100,
+ private recursionLimit = 256,
) {
this.history = new Set();
this.logger = this.loggerService.getLogger('ap-resolve');
@@ -52,6 +52,11 @@ export class Resolver {
return Array.from(this.history);
}
+ @bindThis
+ public getRecursionLimit(): number {
+ return this.recursionLimit;
+ }
+
@bindThis
public async resolveCollection(value: string | IObject): Promise {
const collection = typeof value === 'string'
@@ -113,6 +118,18 @@ export class Resolver {
throw new Error('invalid response');
}
+ // HttpRequestService / ApRequestService have already checked that
+ // `object.id` or `object.url` matches the URL used to fetch the
+ // object after redirects; here we double-check that no redirects
+ // bounced between hosts
+ if (object.id == null) {
+ throw new Error('invalid AP object: missing id');
+ }
+
+ if (this.utilityService.punyHost(object.id) !== this.utilityService.punyHost(value)) {
+ throw new Error(`invalid AP object ${value}: id ${object.id} has different host`);
+ }
+
return object;
}
diff --git a/packages/backend/src/core/activitypub/misc/check-against-url.ts b/packages/backend/src/core/activitypub/misc/check-against-url.ts
new file mode 100644
index 0000000000..78ba891a2e
--- /dev/null
+++ b/packages/backend/src/core/activitypub/misc/check-against-url.ts
@@ -0,0 +1,19 @@
+/*
+ * SPDX-FileCopyrightText: dakkar and sharkey-project
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+import type { IObject } from '../type.js';
+
+export function assertActivityMatchesUrls(activity: IObject, urls: string[]) {
+ const idOk = activity.id !== undefined && urls.includes(activity.id);
+
+ // technically `activity.url` could be an `ApObject = IObject |
+ // string | (IObject | string)[]`, but if it's a complicated thing
+ // and the `activity.id` doesn't match, I think we're fine
+ // rejecting the activity
+ const urlOk = typeof(activity.url) === 'string' && urls.includes(activity.url);
+
+ if (!idOk && !urlOk) {
+ throw new Error(`bad Activity: neither id(${activity?.id}) nor url(${activity?.url}) match location(${urls})`);
+ }
+}
diff --git a/packages/backend/src/core/activitypub/models/ApNoteService.ts b/packages/backend/src/core/activitypub/models/ApNoteService.ts
index 2d333b3634..eb2e771a38 100644
--- a/packages/backend/src/core/activitypub/models/ApNoteService.ts
+++ b/packages/backend/src/core/activitypub/models/ApNoteService.ts
@@ -77,7 +77,7 @@ export class ApNoteService {
}
@bindThis
- public validateNote(object: IObject, uri: string): Error | null {
+ public validateNote(object: IObject, uri: string, actor?: MiRemoteUser): Error | null {
const expectHost = this.utilityService.extractDbHost(uri);
const apType = getApType(object);
@@ -98,6 +98,14 @@ export class ApNoteService {
return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', 'invalid Note: published timestamp is malformed');
}
+ if (actor) {
+ const attribution = (object.attributedTo) ? getOneApId(object.attributedTo) : actor.uri;
+
+ if (attribution !== actor.uri) {
+ return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', `invalid Note: attribution does not match the actor that send it. attribution: ${attribution}, actor: ${actor.uri}`);
+ }
+ }
+
return null;
}
@@ -115,14 +123,14 @@ export class ApNoteService {
* Noteを作成します。
*/
@bindThis
- public async createNote(value: string | IObject, resolver?: Resolver, silent = false): Promise {
+ public async createNote(value: string | IObject, actor?: MiRemoteUser, resolver?: Resolver, silent = false): Promise {
// eslint-disable-next-line no-param-reassign
if (resolver == null) resolver = this.apResolverService.createResolver();
const object = await resolver.resolve(value);
const entryUri = getApId(value);
- const err = this.validateNote(object, entryUri);
+ const err = this.validateNote(object, entryUri, actor);
if (err) {
this.logger.error(err.message, {
resolver: { history: resolver.getHistory() },
@@ -136,14 +144,24 @@ export class ApNoteService {
this.logger.debug(`Note fetched: ${JSON.stringify(note, null, 2)}`);
- if (note.id && !checkHttps(note.id)) {
+ if (note.id == null) {
+ throw new Error('Refusing to create note without id');
+ }
+
+ if (!checkHttps(note.id)) {
throw new Error('unexpected schema of note.id: ' + note.id);
}
const url = getOneApHrefNullable(note.url);
- if (url && !checkHttps(url)) {
- throw new Error('unexpected schema of note url: ' + url);
+ if (url != null) {
+ if (!checkHttps(url)) {
+ throw new Error('unexpected schema of note url: ' + url);
+ }
+
+ if (this.utilityService.punyHost(url) !== this.utilityService.punyHost(note.id)) {
+ throw new Error(`note url & uri host mismatch: note url: ${url}, note uri: ${note.id}`);
+ }
}
this.logger.info(`Creating the Note: ${note.id}`);
@@ -156,8 +174,9 @@ export class ApNoteService {
const uri = getOneApId(note.attributedTo);
// ローカルで投稿者を検索し、もし凍結されていたらスキップ
- const cachedActor = await this.apPersonService.fetchPerson(uri) as MiRemoteUser;
- if (cachedActor && cachedActor.isSuspended) {
+ // eslint-disable-next-line no-param-reassign
+ actor ??= await this.apPersonService.fetchPerson(uri) as MiRemoteUser | undefined;
+ if (actor && actor.isSuspended) {
throw new IdentifiableError('85ab9bd7-3a41-4530-959d-f07073900109', 'actor has been suspended');
}
@@ -189,7 +208,8 @@ export class ApNoteService {
}
//#endregion
- const actor = cachedActor ?? await this.apPersonService.resolvePerson(uri, resolver) as MiRemoteUser;
+ // eslint-disable-next-line no-param-reassign
+ actor ??= await this.apPersonService.resolvePerson(uri, resolver) as MiRemoteUser;
// 解決した投稿者が凍結されていたらスキップ
if (actor.isSuspended) {
@@ -348,7 +368,7 @@ export class ApNoteService {
if (exist) return exist;
//#endregion
- if (uri.startsWith(this.config.url)) {
+ if (this.utilityService.isUriLocal(uri)) {
throw new StatusError('cannot resolve local note', 400, 'cannot resolve local note');
}
@@ -356,7 +376,7 @@ export class ApNoteService {
// ここでuriの代わりに添付されてきたNote Objectが指定されていると、サーバーフェッチを経ずにノートが生成されるが
// 添付されてきたNote Objectは偽装されている可能性があるため、常にuriを指定してサーバーフェッチを行う。
const createFrom = options.sentFrom?.origin === new URL(uri).origin ? value : uri;
- return await this.createNote(createFrom, options.resolver, true);
+ return await this.createNote(createFrom, undefined, options.resolver, true);
} finally {
unlock();
}
diff --git a/packages/backend/src/core/activitypub/models/ApPersonService.ts b/packages/backend/src/core/activitypub/models/ApPersonService.ts
index 8c4e40c561..8590861ca0 100644
--- a/packages/backend/src/core/activitypub/models/ApPersonService.ts
+++ b/packages/backend/src/core/activitypub/models/ApPersonService.ts
@@ -129,12 +129,6 @@ export class ApPersonService implements OnModuleInit {
this.logger = this.apLoggerService.logger;
}
- private punyHost(url: string): string {
- const urlObj = new URL(url);
- const host = `${this.utilityService.toPuny(urlObj.hostname)}${urlObj.port.length > 0 ? ':' + urlObj.port : ''}`;
- return host;
- }
-
/**
* Validate and convert to actor object
* @param x Fetched object
@@ -142,7 +136,7 @@ export class ApPersonService implements OnModuleInit {
*/
@bindThis
private validateActor(x: IObject, uri: string): IActor {
- const expectHost = this.punyHost(uri);
+ const expectHost = this.utilityService.punyHost(uri);
if (!isActor(x)) {
throw new Error(`invalid Actor type '${x.type}'`);
@@ -156,6 +150,32 @@ export class ApPersonService implements OnModuleInit {
throw new Error('invalid Actor: wrong inbox');
}
+ if (this.utilityService.punyHost(x.inbox) !== expectHost) {
+ throw new Error('invalid Actor: inbox has different host');
+ }
+
+ const sharedInboxObject = x.sharedInbox ?? (x.endpoints ? x.endpoints.sharedInbox : undefined);
+ if (sharedInboxObject != null) {
+ const sharedInbox = getApId(sharedInboxObject);
+ if (!(typeof sharedInbox === 'string' && sharedInbox.length > 0 && this.utilityService.punyHost(sharedInbox) === expectHost)) {
+ throw new Error('invalid Actor: wrong shared inbox');
+ }
+ }
+
+ for (const collection of ['outbox', 'followers', 'following'] as (keyof IActor)[]) {
+ const xCollection = (x as IActor)[collection];
+ if (xCollection != null) {
+ const collectionUri = getApId(xCollection);
+ if (typeof collectionUri === 'string' && collectionUri.length > 0) {
+ if (this.utilityService.punyHost(collectionUri) !== expectHost) {
+ throw new Error(`invalid Actor: ${collection} has different host`);
+ }
+ } else if (collectionUri != null) {
+ throw new Error(`invalid Actor: wrong ${collection}`);
+ }
+ }
+ }
+
if (!(typeof x.preferredUsername === 'string' && x.preferredUsername.length > 0 && x.preferredUsername.length <= 128 && /^\w([\w-.]*\w)?$/.test(x.preferredUsername))) {
throw new Error('invalid Actor: wrong username');
}
@@ -179,7 +199,7 @@ export class ApPersonService implements OnModuleInit {
x.summary = truncate(x.summary, summaryLength);
}
- const idHost = this.punyHost(x.id);
+ const idHost = this.utilityService.punyHost(x.id);
if (idHost !== expectHost) {
throw new Error('invalid Actor: id has different host');
}
@@ -189,7 +209,7 @@ export class ApPersonService implements OnModuleInit {
throw new Error('invalid Actor: publicKey.id is not a string');
}
- const publicKeyIdHost = this.punyHost(x.publicKey.id);
+ const publicKeyIdHost = this.utilityService.punyHost(x.publicKey.id);
if (publicKeyIdHost !== expectHost) {
throw new Error('invalid Actor: publicKey.id has different host');
}
@@ -280,7 +300,8 @@ export class ApPersonService implements OnModuleInit {
public async createPerson(uri: string, resolver?: Resolver): Promise {
if (typeof uri !== 'string') throw new Error('uri is not string');
- if (uri.startsWith(this.config.url)) {
+ const host = this.utilityService.punyHost(uri);
+ if (host === this.utilityService.toPuny(this.config.host)) {
throw new StatusError('cannot resolve local user', 400, 'cannot resolve local user');
}
@@ -294,8 +315,6 @@ export class ApPersonService implements OnModuleInit {
this.logger.info(`Creating the Person: ${person.id}`);
- const host = this.punyHost(object.id);
-
const fields = this.analyzeAttachments(person.attachment ?? []);
const tags = extractApHashtags(person.tag).map(normalizeForSearch).splice(0, 32);
@@ -321,8 +340,18 @@ export class ApPersonService implements OnModuleInit {
const url = getOneApHrefNullable(person.url);
- if (url && !checkHttps(url)) {
- throw new Error('unexpected schema of person url: ' + url);
+ if (person.id == null) {
+ throw new Error('Refusing to create person without id');
+ }
+
+ if (url != null) {
+ if (!checkHttps(url)) {
+ throw new Error('unexpected schema of person url: ' + url);
+ }
+
+ if (this.utilityService.punyHost(url) !== this.utilityService.punyHost(person.id)) {
+ throw new Error(`person url <> uri host mismatch: ${url} <> ${person.id}`);
+ }
}
// Create user
@@ -465,7 +494,7 @@ export class ApPersonService implements OnModuleInit {
if (typeof uri !== 'string') throw new Error('uri is not string');
// URIがこのサーバーを指しているならスキップ
- if (uri.startsWith(`${this.config.url}/`)) return;
+ if (this.utilityService.isUriLocal(uri)) return;
//#region このサーバーに既に登録されているか
const exist = await this.fetchPerson(uri) as MiRemoteUser | null;
@@ -514,8 +543,18 @@ export class ApPersonService implements OnModuleInit {
const url = getOneApHrefNullable(person.url);
- if (url && !checkHttps(url)) {
- throw new Error('unexpected schema of person url: ' + url);
+ if (person.id == null) {
+ throw new Error('Refusing to update person without id');
+ }
+
+ if (url != null) {
+ if (!checkHttps(url)) {
+ throw new Error('unexpected schema of person url: ' + url);
+ }
+
+ if (this.utilityService.punyHost(url) !== this.utilityService.punyHost(person.id)) {
+ throw new Error(`person url <> uri host mismatch: ${url} <> ${person.id}`);
+ }
}
const updates = {
@@ -728,7 +767,7 @@ export class ApPersonService implements OnModuleInit {
await this.updatePerson(src.movedToUri, undefined, undefined, [...movePreventUris, src.uri]);
dst = await this.fetchPerson(src.movedToUri) ?? dst;
} else {
- if (src.movedToUri.startsWith(`${this.config.url}/`)) {
+ if (this.utilityService.isUriLocal(src.movedToUri)) {
// ローカルユーザーっぽいのにfetchPersonで見つからないということはmovedToUriが間違っている
return 'failed: movedTo is local but not found';
}
diff --git a/packages/backend/src/core/activitypub/models/ApQuestionService.ts b/packages/backend/src/core/activitypub/models/ApQuestionService.ts
index 73004d10b0..a2cdaf02ca 100644
--- a/packages/backend/src/core/activitypub/models/ApQuestionService.ts
+++ b/packages/backend/src/core/activitypub/models/ApQuestionService.ts
@@ -5,16 +5,18 @@
import { Inject, Injectable } from '@nestjs/common';
import { DI } from '@/di-symbols.js';
-import type { NotesRepository, PollsRepository } from '@/models/_.js';
+import type { UsersRepository, NotesRepository, PollsRepository } from '@/models/_.js';
import type { Config } from '@/config.js';
import type { IPoll } from '@/models/Poll.js';
+import type { MiRemoteUser } from '@/models/User.js';
import type Logger from '@/logger.js';
import { bindThis } from '@/decorators.js';
-import { isQuestion } from '../type.js';
+import { getOneApId, isQuestion } from '../type.js';
+import { UtilityService } from '@/core/UtilityService.js';
import { ApLoggerService } from '../ApLoggerService.js';
import { ApResolverService } from '../ApResolverService.js';
import type { Resolver } from '../ApResolverService.js';
-import type { IObject, IQuestion } from '../type.js';
+import type { IObject } from '../type.js';
@Injectable()
export class ApQuestionService {
@@ -24,6 +26,9 @@ export class ApQuestionService {
@Inject(DI.config)
private config: Config,
+ @Inject(DI.usersRepository)
+ private usersRepository: UsersRepository,
+
@Inject(DI.notesRepository)
private notesRepository: NotesRepository,
@@ -32,6 +37,7 @@ export class ApQuestionService {
private apResolverService: ApResolverService,
private apLoggerService: ApLoggerService,
+ private utilityService: UtilityService,
) {
this.logger = this.apLoggerService.logger;
}
@@ -65,12 +71,12 @@ export class ApQuestionService {
* @returns true if updated
*/
@bindThis
- public async updateQuestion(value: string | IObject, resolver?: Resolver): Promise {
+ public async updateQuestion(value: string | IObject, actor?: MiRemoteUser, resolver?: Resolver): Promise {
const uri = typeof value === 'string' ? value : value.id;
if (uri == null) throw new Error('uri is null');
// URIがこのサーバーを指しているならスキップ
- if (uri.startsWith(this.config.url + '/')) throw new Error('uri points local');
+ if (this.utilityService.isUriLocal(uri)) throw new Error('uri points local');
//#region このサーバーに既に登録されているか
const note = await this.notesRepository.findOneBy({ uri });
@@ -78,15 +84,26 @@ export class ApQuestionService {
const poll = await this.pollsRepository.findOneBy({ noteId: note.id });
if (poll == null) throw new Error('Question is not registered');
+
+ const user = await this.usersRepository.findOneBy({ id: poll.userId });
+ if (user == null) throw new Error('Question is not registered');
//#endregion
// resolve new Question object
// eslint-disable-next-line no-param-reassign
if (resolver == null) resolver = this.apResolverService.createResolver();
- const question = await resolver.resolve(value) as IQuestion;
+ const question = await resolver.resolve(value);
this.logger.debug(`fetched question: ${JSON.stringify(question, null, 2)}`);
- if (question.type !== 'Question') throw new Error('object is not a Question');
+ if (!isQuestion(question)) throw new Error('object is not a Question');
+
+ const attribution = (question.attributedTo) ? getOneApId(question.attributedTo) : user.uri;
+ const attributionMatchesExisting = attribution === user.uri;
+ const actorMatchesAttribution = (actor) ? attribution === actor.uri : true;
+
+ if (!attributionMatchesExisting || !actorMatchesAttribution) {
+ throw new Error('Refusing to ingest update for poll by different user');
+ }
const apChoices = question.oneOf ?? question.anyOf;
if (apChoices == null) throw new Error('invalid apChoices: ' + apChoices);
@@ -96,7 +113,7 @@ export class ApQuestionService {
for (const choice of poll.choices) {
const oldCount = poll.votes[poll.choices.indexOf(choice)];
const newCount = apChoices.filter(ap => ap.name === choice).at(0)?.replies?.totalItems;
- if (newCount == null) throw new Error('invalid newCount: ' + newCount);
+ if (newCount == null || !(Number.isInteger(newCount) && newCount >= 0)) throw new Error('invalid newCount: ' + newCount);
if (oldCount !== newCount) {
changed = true;
diff --git a/packages/backend/src/queue/processors/InboxProcessorService.ts b/packages/backend/src/queue/processors/InboxProcessorService.ts
index 95d764e4d8..004fe1382d 100644
--- a/packages/backend/src/queue/processors/InboxProcessorService.ts
+++ b/packages/backend/src/queue/processors/InboxProcessorService.ts
@@ -190,6 +190,8 @@ export class InboxProcessorService implements OnApplicationShutdown {
if (signerHost !== activityIdHost) {
throw new Bull.UnrecoverableError(`skip: signerHost(${signerHost}) !== activity.id host(${activityIdHost}`);
}
+ } else {
+ throw new Bull.UnrecoverableError('skip: activity id is not a string');
}
this.apRequestChart.inbox();
diff --git a/packages/backend/src/server/ActivityPubServerService.ts b/packages/backend/src/server/ActivityPubServerService.ts
index ba2342b630..f34f6583d3 100644
--- a/packages/backend/src/server/ActivityPubServerService.ts
+++ b/packages/backend/src/server/ActivityPubServerService.ts
@@ -105,7 +105,7 @@ export class ActivityPubServerService {
let signature;
try {
- signature = httpSignature.parseRequest(request.raw, { 'headers': [] });
+ signature = httpSignature.parseRequest(request.raw, { 'headers': ['(request-target)', 'host', 'date'], authorizationHeaderName: 'signature' });
} catch (e) {
reply.code(401);
return;
diff --git a/packages/backend/src/server/api/endpoints/ap/get.ts b/packages/backend/src/server/api/endpoints/ap/get.ts
index d8c55de7ec..14286bc23e 100644
--- a/packages/backend/src/server/api/endpoints/ap/get.ts
+++ b/packages/backend/src/server/api/endpoints/ap/get.ts
@@ -11,6 +11,7 @@ import { ApResolverService } from '@/core/activitypub/ApResolverService.js';
export const meta = {
tags: ['federation'],
+ requireAdmin: true,
requireCredential: true,
kind: 'read:federation',
diff --git a/packages/backend/src/server/api/endpoints/ap/show.ts b/packages/backend/src/server/api/endpoints/ap/show.ts
index c52608cefb..24d5a7b0f1 100644
--- a/packages/backend/src/server/api/endpoints/ap/show.ts
+++ b/packages/backend/src/server/api/endpoints/ap/show.ts
@@ -118,6 +118,11 @@ export default class extends Endpoint { // eslint-
]));
if (local != null) return local;
+ const host = this.utilityService.extractDbHost(uri);
+
+ // local object, not found in db? fail
+ if (this.utilityService.isSelfHost(host)) return null;
+
// リモートから一旦オブジェクトフェッチ
const resolver = this.apResolverService.createResolver();
const object = await resolver.resolve(uri) as any;
@@ -132,10 +137,11 @@ export default class extends Endpoint { // eslint-
if (local != null) return local;
}
+ // 同一ユーザーの情報を再度処理するので、使用済みのresolverを再利用してはいけない
return await this.mergePack(
me,
isActor(object) ? await this.apPersonService.createPerson(getApId(object)) : null,
- isPost(object) ? await this.apNoteService.createNote(getApId(object), undefined, true) : null,
+ isPost(object) ? await this.apNoteService.createNote(getApId(object), undefined, undefined, true) : null,
);
}
diff --git a/packages/backend/src/server/web/ClientServerService.ts b/packages/backend/src/server/web/ClientServerService.ts
index 5ebec4ffd0..1b8873214b 100644
--- a/packages/backend/src/server/web/ClientServerService.ts
+++ b/packages/backend/src/server/web/ClientServerService.ts
@@ -559,7 +559,7 @@ export class ClientServerService {
}
});
- //#region SSR (for crawlers)
+ //#region SSR
// User
fastify.get<{ Params: { user: string; sub?: string; } }>('/@:user/:sub?', async (request, reply) => {
const { username, host } = Acct.parse(request.params.user);
@@ -584,11 +584,17 @@ export class ClientServerService {
reply.header('X-Robots-Tag', 'noimageai');
reply.header('X-Robots-Tag', 'noai');
}
+
+ const _user = await this.userEntityService.pack(user);
+
return await reply.view('user', {
user, profile, me,
avatarUrl: user.avatarUrl ?? this.userEntityService.getIdenticonUrl(user),
sub: request.params.sub,
...await this.generateCommonPugData(this.meta),
+ clientCtx: htmlSafeJsonStringify({
+ user: _user,
+ }),
});
} else {
// リモートユーザーなので
@@ -641,6 +647,9 @@ export class ClientServerService {
// TODO: Let locale changeable by instance setting
summary: getNoteSummary(_note),
...await this.generateCommonPugData(this.meta),
+ clientCtx: htmlSafeJsonStringify({
+ note: _note,
+ }),
});
} else {
return await renderBase(reply);
@@ -729,6 +738,9 @@ export class ClientServerService {
profile,
avatarUrl: _clip.user.avatarUrl,
...await this.generateCommonPugData(this.meta),
+ clientCtx: htmlSafeJsonStringify({
+ clip: _clip,
+ }),
});
} else {
return await renderBase(reply);
diff --git a/packages/backend/src/server/web/UrlPreviewService.ts b/packages/backend/src/server/web/UrlPreviewService.ts
index 5d493c2c46..9b5f0acd2c 100644
--- a/packages/backend/src/server/web/UrlPreviewService.ts
+++ b/packages/backend/src/server/web/UrlPreviewService.ts
@@ -145,6 +145,6 @@ export class UrlPreviewService {
contentLengthRequired: meta.urlPreviewRequireContentLength,
});
- return this.httpRequestService.getJson(`${proxy}?${queryStr}`);
+ return this.httpRequestService.getJson(`${proxy}?${queryStr}`, 'application/json, */*', undefined, true);
}
}
diff --git a/packages/backend/src/server/web/views/base.pug b/packages/backend/src/server/web/views/base.pug
index 280a5923c2..3883b5e5ab 100644
--- a/packages/backend/src/server/web/views/base.pug
+++ b/packages/backend/src/server/web/views/base.pug
@@ -74,6 +74,9 @@ html
script(type='application/json' id='misskey_meta' data-generated-at=now)
!= metaJson
+ script(type='application/json' id='misskey_clientCtx' data-generated-at=now)
+ != clientCtx
+
script
include ../boot.js
diff --git a/packages/backend/test-federation/.config/example.default.yml b/packages/backend/test-federation/.config/example.default.yml
index ff1760a5a6..28d51ac86e 100644
--- a/packages/backend/test-federation/.config/example.default.yml
+++ b/packages/backend/test-federation/.config/example.default.yml
@@ -19,7 +19,6 @@ proxyBypassHosts:
- challenges.cloudflare.com
proxyRemoteFiles: true
signToActivityPubGet: true
-allowedPrivateNetworks: [
- '127.0.0.1/32',
- '172.20.0.0/16'
-]
+allowedPrivateNetworks:
+ - 127.0.0.1/32
+ - 172.20.0.0/16
diff --git a/packages/backend/test/unit/activitypub.ts b/packages/backend/test/unit/activitypub.ts
index 2fc08aec91..9df947982b 100644
--- a/packages/backend/test/unit/activitypub.ts
+++ b/packages/backend/test/unit/activitypub.ts
@@ -176,7 +176,7 @@ describe('ActivityPub', () => {
resolver.register(actor.id, actor);
resolver.register(post.id, post);
- const note = await noteService.createNote(post.id, resolver, true);
+ const note = await noteService.createNote(post.id, undefined, resolver, true);
assert.deepStrictEqual(note?.uri, post.id);
assert.deepStrictEqual(note.visibility, 'public');
@@ -336,7 +336,7 @@ describe('ActivityPub', () => {
resolver.register(actor.featured, featured);
resolver.register(firstNote.id, firstNote);
- const note = await noteService.createNote(firstNote.id as string, resolver);
+ const note = await noteService.createNote(firstNote.id as string, undefined, resolver);
assert.strictEqual(note?.uri, firstNote.id);
});
});
diff --git a/packages/frontend/src/components/global/MkCustomEmoji.vue b/packages/frontend/src/components/global/MkCustomEmoji.vue
index 66f82a7898..ec1d859080 100644
--- a/packages/frontend/src/components/global/MkCustomEmoji.vue
+++ b/packages/frontend/src/components/global/MkCustomEmoji.vue
@@ -25,17 +25,18 @@ SPDX-License-Identifier: AGPL-3.0-only