Merge abae4537bf into 752606fe88

Bumps the typescript-eslint group with 2 updates in the / directory: [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) and [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser).


Updates `@typescript-eslint/eslint-plugin` from 7.1.0 to 8.15.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.15.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 7.1.0 to 8.15.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.15.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: typescript-eslint
- dependency-name: "@typescript-eslint/parser"
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: typescript-eslint
...

Signed-off-by: dependabot[bot] <support@github.com>

CHANGELOG.md

@@ -8,9 +8,9 @@
 ### General
 - Feat: コンテンツの表示にログインを必須にできるように
 - Feat: 過去のノートを非公開化/フォロワーのみ表示可能にできるように
-- Fix: お知らせ作成時に画像URL入力欄を空欄に変更できないのを修正 ( #14976 )
 - Enhance: 依存関係の更新
 - Enhance: l10nの更新
+- Fix: お知らせ作成時に画像URL入力欄を空欄に変更できないのを修正 ( #14976 )
 
 ### Client
 - Enhance: Bull DashboardでRelationship Queueの状態も確認できるように  
@@ -67,6 +67,7 @@
 - Fix: User Webhookテスト機能のMock Payloadを修正  
 - Fix: アカウント削除のモデレーションログが動作していないのを修正 (#14996)  
 - Fix: リノートミュートが新規投稿通知に対して作用していなかった問題を修正
+- Fix: セキュリティに関する修正
 
 ### Misskey.js
 - Fix: Stream初期化時、別途WebSocketを指定する場合の型定義を修正

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "misskey",
-	"version": "2024.11.0-alpha.2",
+	"version": "2024.11.0-beta.4",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",
@@ -66,8 +66,8 @@
 	"devDependencies": {
 		"@misskey-dev/eslint-plugin": "2.0.3",
 		"@types/node": "22.9.0",
-		"@typescript-eslint/eslint-plugin": "7.17.0",
+		"@typescript-eslint/eslint-plugin": "8.15.0",
-		"@typescript-eslint/parser": "7.17.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"cross-env": "7.0.3",
 		"cypress": "13.15.2",
 		"eslint": "9.14.0",

packages/backend/package.json

@@ -229,8 +229,8 @@
 		"@types/vary": "1.1.3",
 		"@types/web-push": "3.6.4",
 		"@types/ws": "8.5.13",
-		"@typescript-eslint/eslint-plugin": "7.17.0",
+		"@typescript-eslint/eslint-plugin": "8.15.0",
-		"@typescript-eslint/parser": "7.17.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"aws-sdk-client-mock": "4.0.1",
 		"cross-env": "7.0.3",
 		"eslint-plugin-import": "2.30.0",

packages/backend/src/core/HttpRequestService.ts

@@ -54,19 +54,19 @@ class HttpRequestServiceAgent extends http.Agent {
 				}
 			});
 		return socket;
-	};
+	}
 
 	@bindThis
 	private isPrivateIp(ip: string): boolean {
 		const parsedIp = ipaddr.parse(ip);
-	
+
 		for (const net of this.config.allowedPrivateNetworks ?? []) {
 			const cidr = ipaddr.parseCIDR(net);
 			if (cidr[0].kind() === parsedIp.kind() && parsedIp.match(ipaddr.parseCIDR(net))) {
 				return false;
 			}
 		}
-	
+
 		return parsedIp.range() !== 'unicast';
 	}
 }
@@ -93,19 +93,19 @@ class HttpsRequestServiceAgent extends https.Agent {
 				}
 			});
 		return socket;
-	};
+	}
 
 	@bindThis
 	private isPrivateIp(ip: string): boolean {
 		const parsedIp = ipaddr.parse(ip);
-	
+
 		for (const net of this.config.allowedPrivateNetworks ?? []) {
 			const cidr = ipaddr.parseCIDR(net);
 			if (cidr[0].kind() === parsedIp.kind() && parsedIp.match(ipaddr.parseCIDR(net))) {
 				return false;
 			}
 		}
-	
+
 		return parsedIp.range() !== 'unicast';
 	}
 }

packages/backend/src/core/RemoteUserResolveService.ts

@@ -54,7 +54,7 @@ export class RemoteUserResolveService {
 			}) as MiLocalUser;
 		}
 
-		host = this.utilityService.punyHost(host);
+		host = this.utilityService.toPuny(host);
 
 		if (host === this.utilityService.toPuny(this.config.host)) {
 			this.logger.info(`return local user: ${usernameLower}`);

packages/backend/src/core/WebAuthnService.ts

@@ -246,14 +246,12 @@ export class WebAuthnService {
 
 	@bindThis
 	public async verifyAuthentication(userId: MiUser['id'], response: AuthenticationResponseJSON): Promise<boolean> {
-		const challenge = await this.redisClient.get(`webauthn:challenge:${userId}`);
+		const challenge = await this.redisClient.getdel(`webauthn:challenge:${userId}`);
 
 		if (!challenge) {
 			throw new IdentifiableError('2d16e51c-007b-4edd-afd2-f7dd02c947f6', 'challenge not found');
 		}
 
-		await this.redisClient.del(`webauthn:challenge:${userId}`);
-
 		const key = await this.userSecurityKeysRepository.findOneBy({
 			id: response.id,
 			userId: userId,

packages/backend/src/core/activitypub/ApInboxService.ts

@@ -130,6 +130,7 @@ export class ApInboxService {
 		if (actor.uri) {
 			if (actor.lastFetchedAt == null || Date.now() - actor.lastFetchedAt.getTime() > 1000 * 60 * 60 * 24) {
 				setImmediate(() => {
+					// 同一ユーザーの情報を再度処理するので、使用済みのresolverを再利用してはいけない
 					this.apPersonService.updatePerson(actor.uri);
 				});
 			}

packages/backend/src/core/activitypub/models/ApPersonService.ts

@@ -163,13 +163,16 @@ export class ApPersonService implements OnModuleInit {
 		}
 
 		for (const collection of ['outbox', 'followers', 'following'] as (keyof IActor)[]) {
-			const collectionUri = getApId((x as IActor)[collection]);
+			const xCollection = (x as IActor)[collection];
-			if (typeof collectionUri === 'string' && collectionUri.length > 0) {
+			if (xCollection != null) {
-				if (this.utilityService.punyHost(collectionUri) !== expectHost) {
+				const collectionUri = getApId(xCollection);
-					throw new Error(`invalid Actor: ${collection} has different host`);
+				if (typeof collectionUri === 'string' && collectionUri.length > 0) {
+					if (this.utilityService.punyHost(collectionUri) !== expectHost) {
+						throw new Error(`invalid Actor: ${collection} has different host`);
+					}
+				} else if (collectionUri != null) {
+					throw new Error(`invalid Actor: wrong ${collection}`);
 				}
-			} else if (collectionUri != null) {
-				throw new Error(`invalid Actor: wrong ${collection}`);
 			}
 		}
 

packages/backend/src/server/api/endpoints/ap/show.ts

@@ -137,10 +137,11 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 			if (local != null) return local;
 		}
 
+		// 同一ユーザーの情報を再度処理するので、使用済みのresolverを再利用してはいけない
 		return await this.mergePack(
 			me,
 			isActor(object) ? await this.apPersonService.createPerson(getApId(object)) : null,
-			isPost(object) ? await this.apNoteService.createNote(getApId(object), undefined, true) : null,
+			isPost(object) ? await this.apNoteService.createNote(getApId(object), undefined, undefined, true) : null,
 		);
 	}
 

packages/backend/test-federation/.config/example.default.yml

@@ -19,7 +19,6 @@ proxyBypassHosts:
   - challenges.cloudflare.com
 proxyRemoteFiles: true
 signToActivityPubGet: true
-allowedPrivateNetworks: [
+allowedPrivateNetworks:
-  '127.0.0.1/32',
+  - 127.0.0.1/32
-  '172.20.0.0/16'
+  - 172.20.0.0/16
-]

packages/backend/test/unit/activitypub.ts

@@ -176,7 +176,7 @@ describe('ActivityPub', () => {
 			resolver.register(actor.id, actor);
 			resolver.register(post.id, post);
 
-			const note = await noteService.createNote(post.id, resolver, true);
+			const note = await noteService.createNote(post.id, undefined, resolver, true);
 
 			assert.deepStrictEqual(note?.uri, post.id);
 			assert.deepStrictEqual(note.visibility, 'public');
@@ -336,7 +336,7 @@ describe('ActivityPub', () => {
 			resolver.register(actor.featured, featured);
 			resolver.register(firstNote.id, firstNote);
 
-			const note = await noteService.createNote(firstNote.id as string, resolver);
+			const note = await noteService.createNote(firstNote.id as string, undefined, resolver);
 			assert.strictEqual(note?.uri, firstNote.id);
 		});
 	});

packages/frontend-embed/package.json

@@ -48,8 +48,8 @@
 		"@types/tinycolor2": "1.4.6",
 		"@types/uuid": "10.0.0",
 		"@types/ws": "8.5.13",
-		"@typescript-eslint/eslint-plugin": "7.17.0",
+		"@typescript-eslint/eslint-plugin": "8.15.0",
-		"@typescript-eslint/parser": "7.17.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"@vitest/coverage-v8": "1.6.0",
 		"@vue/runtime-core": "3.5.12",
 		"acorn": "8.14.0",

packages/frontend-shared/package.json

@@ -22,8 +22,8 @@
 	},
 	"devDependencies": {
 		"@types/node": "22.9.0",
-		"@typescript-eslint/eslint-plugin": "7.17.0",
+		"@typescript-eslint/eslint-plugin": "8.15.0",
-		"@typescript-eslint/parser": "7.17.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"esbuild": "0.24.0",
 		"eslint-plugin-vue": "9.31.0",
 		"typescript": "5.6.3",

packages/frontend/package.json

@@ -108,8 +108,8 @@
 		"@types/tinycolor2": "1.4.6",
 		"@types/uuid": "10.0.0",
 		"@types/ws": "8.5.13",
-		"@typescript-eslint/eslint-plugin": "7.17.0",
+		"@typescript-eslint/eslint-plugin": "8.15.0",
-		"@typescript-eslint/parser": "7.17.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"@vitest/coverage-v8": "1.6.0",
 		"@vue/runtime-core": "3.5.12",
 		"acorn": "8.14.0",

packages/misskey-bubble-game/package.json

@@ -25,8 +25,8 @@
 		"@types/matter-js": "0.19.7",
 		"@types/seedrandom": "3.0.8",
 		"@types/node": "22.9.0",
-		"@typescript-eslint/eslint-plugin": "7.1.0",
+		"@typescript-eslint/eslint-plugin": "8.15.0",
-		"@typescript-eslint/parser": "7.1.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"nodemon": "3.1.7",
 		"execa": "8.0.1",
 		"typescript": "5.6.3",

packages/misskey-js/generator/package.json

@@ -9,8 +9,8 @@
 	"devDependencies": {
 		"@readme/openapi-parser": "2.6.0",
 		"@types/node": "22.9.0",
-		"@typescript-eslint/eslint-plugin": "7.17.0",
+		"@typescript-eslint/eslint-plugin": "8.15.0",
-		"@typescript-eslint/parser": "7.17.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"openapi-types": "12.1.3",
 		"openapi-typescript": "6.7.3",
 		"ts-case-convert": "2.1.0",

packages/misskey-js/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "misskey-js",
-	"version": "2024.11.0-alpha.2",
+	"version": "2024.11.0-beta.4",
 	"description": "Misskey SDK for JavaScript",
 	"license": "MIT",
 	"main": "./built/index.js",
@@ -39,8 +39,8 @@
 		"@swc/jest": "0.2.37",
 		"@types/jest": "29.5.14",
 		"@types/node": "22.9.0",
-		"@typescript-eslint/eslint-plugin": "7.17.0",
+		"@typescript-eslint/eslint-plugin": "8.15.0",
-		"@typescript-eslint/parser": "7.17.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"jest": "29.7.0",
 		"jest-fetch-mock": "3.0.3",
 		"jest-websocket-mock": "2.5.0",

packages/misskey-reversi/package.json

@@ -23,8 +23,8 @@
 	},
 	"devDependencies": {
 		"@types/node": "22.9.0",
-		"@typescript-eslint/eslint-plugin": "7.1.0",
+		"@typescript-eslint/eslint-plugin": "8.15.0",
-		"@typescript-eslint/parser": "7.1.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"execa": "8.0.1",
 		"nodemon": "3.1.7",
 		"typescript": "5.6.3",

packages/sw/package.json

@@ -14,7 +14,7 @@
 		"misskey-js": "workspace:*"
 	},
 	"devDependencies": {
-		"@typescript-eslint/parser": "7.17.0",
+		"@typescript-eslint/parser": "8.15.0",
 		"@typescript/lib-webworker": "npm:@types/serviceworker@0.0.67",
 		"eslint-plugin-import": "2.30.0",
 		"nodemon": "3.1.7",