diff options
| author | dakkar <dakkar@thenautilus.net> | 2024-03-30 11:05:58 +0000 |
|---|---|---|
| committer | Amelia Yukii <amelia.yukii@shourai.de> | 2024-03-30 11:05:58 +0000 |
| commit | 074de82bf72161528911283de7fd68dde119d251 (patch) | |
| tree | 44b519f0ccc9537057adad4fb658cf186d301028 /packages/backend/src/core/HttpRequestService.ts | |
| parent | merge: always align code to the left - fixes #436 (!453) (diff) | |
| download | sharkey-074de82bf72161528911283de7fd68dde119d251.tar.gz sharkey-074de82bf72161528911283de7fd68dde119d251.tar.bz2 sharkey-074de82bf72161528911283de7fd68dde119d251.zip | |
some validation fixes
Diffstat (limited to 'packages/backend/src/core/HttpRequestService.ts')
| -rw-r--r-- | packages/backend/src/core/HttpRequestService.ts | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/packages/backend/src/core/HttpRequestService.ts b/packages/backend/src/core/HttpRequestService.ts index 7f3cac7c58..bea5dee6ab 100644 --- a/packages/backend/src/core/HttpRequestService.ts +++ b/packages/backend/src/core/HttpRequestService.ts @@ -15,6 +15,7 @@ import type { Config } from '@/config.js'; import { StatusError } from '@/misc/status-error.js'; import { bindThis } from '@/decorators.js'; import { validateContentTypeSetAsActivityPub } from '@/core/activitypub/misc/validator.js'; +import { assertActivityMatchesUrls } from '@/core/activitypub/misc/check-against-url.js'; import type { IObject } from '@/core/activitypub/type.js'; import type { Response } from 'node-fetch'; import type { URL } from 'node:url'; @@ -125,7 +126,12 @@ export class HttpRequestService { validators: [validateContentTypeSetAsActivityPub], }); - return await res.json() as IObject; + const finalUrl = res.url; // redirects may have been involved + const activity = await res.json() as IObject; + + assertActivityMatchesUrls(activity, [url, finalUrl]); + + return activity; } @bindThis |