diff options
| author | syuilo <Syuilotan@yahoo.co.jp> | 2021-10-08 14:05:07 +0900 |
|---|---|---|
| committer | syuilo <Syuilotan@yahoo.co.jp> | 2021-10-08 14:05:07 +0900 |
| commit | 5bf69476f625f3c4764cfb242d7d6a21c808f8b8 (patch) | |
| tree | d7ed00070479af5d2de34a728b4a6a0b158b91c2 | |
| parent | Revert "Revert "Fix idb"" (#7860) (diff) | |
| download | sharkey-5bf69476f625f3c4764cfb242d7d6a21c808f8b8.tar.gz sharkey-5bf69476f625f3c4764cfb242d7d6a21c808f8b8.tar.bz2 sharkey-5bf69476f625f3c4764cfb242d7d6a21c808f8b8.zip | |
enhance(api): ap系のエンドポイントをログイン必須化+レートリミット追加
他のサーバーにリクエストを送信するという性質上、攻撃の踏み台にされることがあるため
| -rw-r--r-- | CHANGELOG.md | 1 | ||||
| -rw-r--r-- | src/server/api/endpoints/ap/get.ts | 8 | ||||
| -rw-r--r-- | src/server/api/endpoints/ap/show.ts | 8 |
3 files changed, 15 insertions, 2 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index bd526fd694..f65de79116 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ - クライアント: アニメーションを減らす設定をメニューのアニメーションにも適用するように - クライアント: MFM関数構文のサジェストを実装 - ActivityPub: HTML -> MFMの変換を強化 +- API: ap系のエンドポイントをログイン必須化+レートリミット追加 ### Bugfixes - Fix createDeleteAccountJob diff --git a/src/server/api/endpoints/ap/get.ts b/src/server/api/endpoints/ap/get.ts index 2cffce1f16..2f97a24774 100644 --- a/src/server/api/endpoints/ap/get.ts +++ b/src/server/api/endpoints/ap/get.ts @@ -2,11 +2,17 @@ import $ from 'cafy'; import define from '../../define'; import Resolver from '@/remote/activitypub/resolver'; import { ApiError } from '../../error'; +import ms from 'ms'; export const meta = { tags: ['federation'], - requireCredential: false as const, + requireCredential: true as const, + + limit: { + duration: ms('1hour'), + max: 30 + }, params: { uri: { diff --git a/src/server/api/endpoints/ap/show.ts b/src/server/api/endpoints/ap/show.ts index aa0dae070c..32685d44bd 100644 --- a/src/server/api/endpoints/ap/show.ts +++ b/src/server/api/endpoints/ap/show.ts @@ -11,11 +11,17 @@ import { Note } from '@/models/entities/note'; import { User } from '@/models/entities/user'; import { fetchMeta } from '@/misc/fetch-meta'; import { isActor, isPost, getApId } from '@/remote/activitypub/type'; +import ms from 'ms'; export const meta = { tags: ['federation'], - requireCredential: false as const, + requireCredential: true as const, + + limit: { + duration: ms('1hour'), + max: 30 + }, params: { uri: { |