diff options
| author | MeiMei <30769358+mei23@users.noreply.github.com> | 2018-12-16 01:44:59 +0900 |
|---|---|---|
| committer | syuilo <Syuilotan@yahoo.co.jp> | 2018-12-16 01:44:59 +0900 |
| commit | ffb80efe2103b9a368ba03a856d809151c41d53b (patch) | |
| tree | 314ce6b0c3caa1e30de0613acc372d100025ded5 /src/server/activitypub/outbox.ts | |
| parent | Update analog-clock.vue (diff) | |
| download | sharkey-ffb80efe2103b9a368ba03a856d809151c41d53b.tar.gz sharkey-ffb80efe2103b9a368ba03a856d809151c41d53b.tar.bz2 sharkey-ffb80efe2103b9a368ba03a856d809151c41d53b.zip | |
Return 404 for invalid Object ID (#3627)
* Update activitypub.ts
* Update activitypub.ts
* Update featured.ts
* Update followers.ts
* Update following.ts
* Update outbox.ts
* Fix following, outbox
Diffstat (limited to 'src/server/activitypub/outbox.ts')
| -rw-r--r-- | src/server/activitypub/outbox.ts | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/src/server/activitypub/outbox.ts b/src/server/activitypub/outbox.ts index 6b917ef843..c35298e3a8 100644 --- a/src/server/activitypub/outbox.ts +++ b/src/server/activitypub/outbox.ts @@ -1,7 +1,8 @@ -import * as mongo from 'mongodb'; +import { ObjectID } from 'mongodb'; import * as Router from 'koa-router'; import config from '../../config'; -import $ from 'cafy'; import ID, { transform } from '../../misc/cafy-id'; +import $ from 'cafy'; +import ID, { transform } from '../../misc/cafy-id'; import User from '../../models/user'; import pack from '../../remote/activitypub/renderer'; import renderOrderedCollection from '../../remote/activitypub/renderer/ordered-collection'; @@ -15,7 +16,12 @@ import renderAnnounce from '../../remote/activitypub/renderer/announce'; import { countIf } from '../../prelude/array'; export default async (ctx: Router.IRouterContext) => { - const userId = new mongo.ObjectID(ctx.params.user); + if (!ObjectID.isValid(ctx.params.user)) { + ctx.status = 404; + return; + } + + const userId = new ObjectID(ctx.params.user); // Get 'sinceId' parameter const [sinceId, sinceIdErr] = $.type(ID).optional.get(ctx.request.query.since_id); |