From 06975b8a5e2bfcc0d8a055a05eae148830c88ab1 Mon Sep 17 00:00:00 2001
From: Sven Sauleau <sven@cloudflare.com>
Date: Wed, 18 Jan 2023 14:39:25 +0000
Subject: [PATCH] Fix post status formdata

---
 backend/src/activitypub/deliver.ts     |  4 ++++
 backend/src/utils/body.ts              | 12 +++++++++++-
 backend/test/mastodon/statuses.spec.ts | 27 ++++++++++++++++++++++++++
 3 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/backend/src/activitypub/deliver.ts b/backend/src/activitypub/deliver.ts
index 7a16b33..3562310 100644
--- a/backend/src/activitypub/deliver.ts
+++ b/backend/src/activitypub/deliver.ts
@@ -43,6 +43,10 @@ export async function deliverFollowers(
 	queue: Queue<DeliverMessageBody>
 ) {
 	const followers = await getFollowers(db, from)
+	if (followers.length === 0) {
+		// No one is following the user so no updates to send. Sad.
+		return
+	}
 
 	const messages: Array<MessageSendRequest<DeliverMessageBody>> = await Promise.all(
 		followers.map(async (id) => {
diff --git a/backend/src/utils/body.ts b/backend/src/utils/body.ts
index 95986cf..ef0f643 100644
--- a/backend/src/utils/body.ts
+++ b/backend/src/utils/body.ts
@@ -22,7 +22,17 @@ export async function readBody<T>(request: Request): Promise<T> {
 	const out: any = {}
 
 	for (const [key, value] of form) {
-		out[key] = value
+		if (key.endsWith('[]')) {
+			// The `key[]` notiation is used when sending an array of values.
+
+			const key2 = key.replace('[]', '')
+			if (out[key2] === undefined) {
+				out[key2] = []
+			}
+			out[key2].push(value)
+		} else {
+			out[key] = value
+		}
 	}
 	return out as T
 }
diff --git a/backend/test/mastodon/statuses.spec.ts b/backend/test/mastodon/statuses.spec.ts
index d6b75b2..303d2e4 100644
--- a/backend/test/mastodon/statuses.spec.ts
+++ b/backend/test/mastodon/statuses.spec.ts
@@ -627,6 +627,33 @@ describe('Mastodon APIs', () => {
 
 			const res = await statuses.handleRequest(req, db, actor, userKEK, queue, kv_cache)
 			assert.equal(res.status, 400)
+			const data = await res.json<any>()
+			assert(data.error.includes('Limit exceeded'))
+		})
+
+		test('create new status sending multipart and too many image', async () => {
+			const db = await makeDB()
+			const queue = makeQueue()
+			const actor = await createPerson(domain, db, userKEK, 'sven@cloudflare.com')
+
+			const body = new FormData()
+			body.append('status', 'my status')
+			body.append('visibility', 'public')
+			body.append('media_ids[]', 'id')
+			body.append('media_ids[]', 'id')
+			body.append('media_ids[]', 'id')
+			body.append('media_ids[]', 'id')
+			body.append('media_ids[]', 'id')
+
+			const req = new Request('https://example.com', {
+				method: 'POST',
+				body,
+			})
+
+			const res = await statuses.handleRequest(req, db, actor, userKEK, queue, kv_cache)
+			assert.equal(res.status, 400)
+			const data = await res.json<any>()
+			assert(data.error.includes('Limit exceeded'))
 		})
 	})
 })