Ignore badly formed ActivityPub object data (#406)

pull/411/head
Michael Manfre 2023-01-13 15:44:43 -05:00 zatwierdzone przez GitHub
rodzic cb66b9559d
commit 81fa9a6d34
Nie znaleziono w bazie danych klucza dla tego podpisu
ID klucza GPG: 4AEE18F83AFDEB23
1 zmienionych plików z 7 dodań i 3 usunięć

Wyświetl plik

@ -737,9 +737,13 @@ class Post(StatorModel):
Raises DoesNotExist if it's not found and create is False,
or it's from a blocked domain.
"""
# Ensure the domain of the object's actor and ID match to prevent injection
if urlparse(data["id"]).hostname != urlparse(data["attributedTo"]).hostname:
raise ValueError("Object's ID domain is different to its author")
try:
# Ensure the domain of the object's actor and ID match to prevent injection
if urlparse(data["id"]).hostname != urlparse(data["attributedTo"]).hostname:
raise ValueError("Object's ID domain is different to its author")
except (TypeError, KeyError):
raise ValueError("Object data is not a recognizable ActivityPub object")
# Do we have one with the right ID?
created = False
try: