3 files changed, 21 insertions, 7 deletions
diff --git a/packages/backend/src/core/activitypub/models/ApPersonService.ts b/packages/backend/src/core/activitypub/models/ApPersonService.ts
index dde5762f53..631e86c8a8 100644
--- a/packages/backend/src/core/activitypub/models/ApPersonService.ts
+++ b/packages/backend/src/core/activitypub/models/ApPersonService.ts
@@ -445,7 +445,11 @@ export class ApPersonService implements OnModuleInit, OnApplicationShutdown {
 					makeNotesFollowersOnlyBefore: (person as any).makeNotesFollowersOnlyBefore ?? null,
 					makeNotesHiddenBefore: (person as any).makeNotesHiddenBefore ?? null,
 					emojis,
-					attributionDomains: (Array.isArray(person.attributionDomains) && person.attributionDomains.every(x => typeof x === 'string')) ? person.attributionDomains : [],
+					attributionDomains: Array.isArray(person.attributionDomains)
+						? person.attributionDomains
+							.filter((a: unknown) => typeof(a) === 'string' && a.length > 0 && a.length <= 128)
+							.slice(0, 32)
+						: [],
 				})) as MiRemoteUser;
 
 				let _description: string | null = null;
@@ -629,7 +633,11 @@ export class ApPersonService implements OnModuleInit, OnApplicationShutdown {
 			// We use "!== false" to handle incorrect types, missing / null values, and "default to true" logic.
 			hideOnlineStatus: person.hideOnlineStatus !== false,
 			isExplorable: person.discoverable !== false,
-			attributionDomains: (Array.isArray(person.attributionDomains) && person.attributionDomains.every(x => typeof x === 'string')) ? person.attributionDomains : [],
+			attributionDomains: Array.isArray(person.attributionDomains)
+				? person.attributionDomains
+					.filter((a: unknown) => typeof(a) === 'string' && a.length > 0 && a.length <= 128)
+					.slice(0, 32)
+				: [],
 			...(await this.resolveAvatarAndBanner(exist, person.icon, person.image, person.backgroundUrl).catch(() => ({}))),
 		} as Partial<MiRemoteUser> & Pick<MiRemoteUser, 'isBot' | 'isCat' | 'speakAsCat' | 'isLocked' | 'movedToUri' | 'alsoKnownAs' | 'isExplorable'>;
 
diff --git a/packages/backend/src/models/User.ts b/packages/backend/src/models/User.ts
index 2f13400944..f40bb41a22 100644
--- a/packages/backend/src/models/User.ts
+++ b/packages/backend/src/models/User.ts
@@ -390,9 +390,9 @@ export class MiUser {
 	})
 	public allowUnsignedFetch: UserUnsignedFetchOption;
 
-	@Column('varchar', {
+	@Column('text', {
 		name: 'attributionDomains',
-		length: 128, array: true, default: '{}',
+		array: true, default: '{}',
 	})
 	public attributionDomains: string[];
 
diff --git a/packages/backend/src/server/api/endpoints/i/update.ts b/packages/backend/src/server/api/endpoints/i/update.ts
index dad605f151..5a160d632c 100644
--- a/packages/backend/src/server/api/endpoints/i/update.ts
+++ b/packages/backend/src/server/api/endpoints/i/update.ts
@@ -263,9 +263,15 @@ export const paramDef = {
 			enum: userUnsignedFetchOptions,
 			nullable: false,
 		},
-		attributionDomains: { type: 'array', items: {
-			type: 'string',
-		} },
+		attributionDomains: {
+			type: 'array',
+			items: {
+				type: 'string',
+				minLength: 1,
+				maxLength: 128,
+			},
+			maxLength: 32,
+		},
 	},
 } as const;