misskey/packages/backend/src/server/ActivityPubServerService.ts, branch master

split url into webUrl and localUrl (like mastodon)

2026-03-05T17:55:43Z

enable and fix no-unused-vars and no-async-promise-executor (#17070)

2026-01-08T02:49:12Z

* dev: set --no-bail for lint task * lint: enable no-async-promise-executor lint and fix them * lint: enable no-unused-vars with allowing _ prefix * lint: fix semi

fix(backend): correct outbox pagination (#16176)

2025-06-08T00:12:59Z

fix: use ftt for outbox (#15819)

2025-04-15T07:15:27Z

* fix: use ftt for outbox * chore: check for enableFanoutTimeline * lint: fix lint

fix: resolve with non-lowercased acct is broken (#15813)

2025-04-13T09:34:33Z

* fix: resolve with non-lowercased acct is broken * docs(changelog): Fix: 大文字を含むユーザの URL で紹介された場合に 404 エラーを返す問題

fix(backend): 連合無しモードでも外部から照会可能だった問題を修正

2025-03-17T04:21:09Z

deps: update pnpm to v10 (#15588)

2025-03-07T07:03:52Z

* Revert "fix(build): corepackのバグの回避 (#15387)" This reverts commit 9c70a4e63130f85d191c5bc16d0a4be5cd1dece2. * deps: update pnpm to v10 * fix broken lockfile * update changelog * fix * fix * Revert "fix" This reverts commit 4abc6c194edc20989f5ec97d343307a4b8c9047d. * fix * fix * attempt to fix docker build * lint fixes * fix: revertしすぎた * detect pnpm version and install it * fix: そもそもpnpmを2回入れる必要がないかも * fix * refactor * fix * refactor: remove unnecessary arg * Update Dockerfile * update pnpm to v10.6.1 * Update Changelog * chore: use node to avoid installing jq

fix(backend): apOrHtml Constraintが正しく評価されない問題を修正 (#15213)

2025-01-08T10:35:09Z

* fix(backend/ActivityPubServerService): apOrHtml Constraintが正しく評価されない問題を修正 (MisskeyIO#869) * Update Changelog * indent --------- Co-authored-by: あわわわとーにゅ <17376330+u1-liquid@users.noreply.github.com>

Merge commit from fork

2024-11-20T23:20:09Z

* enhance: Add a few validation fixes from Sharkey See the original MR on the GitLab instance: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/484 Co-Authored-By: Dakkar * fix: primitive 2: acceptance of cross-origin alternate Co-Authored-By: Laura Hausmann * fix: primitive 3: validation of non-final url * fix: primitive 4: missing same-origin identifier validation of collection-wrapped activities * fix: primitives 5 & 8: reject activities with non string identifiers Co-Authored-By: Laura Hausmann * fix: primitive 6: reject anonymous objects that were fetched by their id * fix: primitives 9, 10 & 11: http signature validation doesn't enforce required headers or specify auth header name Co-Authored-By: Laura Hausmann * fix: primitive 14: improper validation of outbox, followers, following & shared inbox collections * fix: code style for primitive 14 * fix: primitive 15: improper same-origin validation for note uri and url Co-Authored-By: Laura Hausmann * fix: primitive 16: improper same-origin validation for user uri and url * fix: primitive 17: note same-origin identifier validation can be bypassed by wrapping the id in an array * fix: code style for primitive 17 * fix: check attribution against actor in notes While this isn't strictly required to fix the exploits at hand, this mirrors the fix in `ApQuestionService` for GHSA-5h8r-gq97-xv69, as a preemptive countermeasure. * fix: primitive 18: `ap/get` bypasses access checks One might argue that we could make this one actually preform access checks against the returned activity object, but I feel like that's a lot more work than just restricting it to administrators, since, to me at least, it seems more like a debugging tool than anything else. * fix: primitive 19 & 20: respect blocks and hide more Ideally, the user property should also be hidden (as leaving it in leaks information slightly), but given the schema of the note endpoint, I don't think that would be possible without introducing some kind of "ghost" user, who is attributed for posts by users who have you blocked. * fix: primitives 21, 22, and 23: reuse resolver This also increases the default `recursionLimit` for `Resolver`, as it theoretically will go higher that it previously would and could possibly fail on non-malicious collection activities. * fix: primitives 25-33: proper local instance checks * revert: fix: primitive 19 & 20 This reverts commit 465a9fe6591de90f78bd3d084e3c01e65dc3cf3c. --------- Co-authored-by: Dakkar Co-authored-by: Laura Hausmann Co-authored-by: syuilo <4439005+syuilo@users.noreply.github.com>

enhance(backend) : リモートユーザーの照会をオリジナルにリダイレクトするように (#12892) (#14897)

2024-11-09T01:54:44Z

* enhance(backend) : リモートユーザーの照会をオリジナルにリダイレクトするように (#12892) * オリジンリダイレクトのテストをtodoとして追加。 e2eテストにリモートユーザー考慮のテストがなさそうなので。次のコマンドで動くことは確認済みです。 curl "http://localhost:3000/@foo@bar" -H "accept: application/activity+json" -L * Acctのパースを既存のパーサーでするように修正 * lint