diff --git a/protocol.py b/protocol.py index 67b697d..546871c 100644 --- a/protocol.py +++ b/protocol.py @@ -707,6 +707,8 @@ class Protocol: actor = as1.get_owner(obj.as1) if not actor: error('Activity missing actor or author', status=400) + elif from_cls.owns_id(actor) is False: + error(f"{from_cls.LABEL} doesn't own actor {actor}, this is probably a bridged activity. Skipping.", status=204) if authed_as: assert isinstance(authed_as, str) diff --git a/tests/test_activitypub.py b/tests/test_activitypub.py index 1358c5f..c77c8e6 100644 --- a/tests/test_activitypub.py +++ b/tests/test_activitypub.py @@ -962,11 +962,12 @@ class ActivityPubTest(TestCase): self.assert_user(ActivityPub, 'https://mas.to/actor', obj_as2=LIKE_ACTOR) def test_inbox_like_no_object_error(self, *_): - Fake.fetchable = {'fake:user': {'id': 'fake:user'}} + swentel = self.make_user('https://inst/user', cls=ActivityPub) + got = self.post('/inbox', json={ - 'id': 'fake:like', + 'id': 'https://inst/like', 'type': 'Like', - 'actor': 'fake:user', + 'actor': 'https://inst/user', 'object': None, }) self.assertEqual(400, got.status_code) diff --git a/tests/test_protocol.py b/tests/test_protocol.py index 885dc66..250f254 100644 --- a/tests/test_protocol.py +++ b/tests/test_protocol.py @@ -1649,6 +1649,27 @@ class ProtocolReceiveTest(TestCase): self.assertEqual(1, len(followers)) self.assertEqual(self.alice.key, followers[0].to) + def test_skip_bridged_user(self): + """If the actor isn't from the source protocol, skip the activity. + + (It's probably from a bridged user, and we only want to handle source + activities, not bridged activities.) + """ + self.user.copies = [Target(uri='other:user', protocol='other')] + self.user.put() + + with self.assertRaises(NoContent): + OtherFake.receive_as1({ + 'id': 'other:follow', + 'objectType': 'activity', + 'verb': 'follow', + 'actor': 'fake:user', + 'object': 'fake:alice', + }) + self.assertEqual(0, len(OtherFake.sent)) + self.assertEqual(0, len(Fake.sent)) + self.assertIsNone(Object.get_by_id('other:follow')) + @patch('requests.post') @patch('requests.get') def test_skip_web_same_domain(self, mock_get, mock_post):