akkoma/test/fixtures/tesla_mock
Oneric 8684964c5d Only allow exact id matches
This protects us from falling for obvious spoofs as from the current
upload exploit (unfortunately we can’t reasonably do anything about
spoofs with exact matches as was possible via emoji and proxy).

Such objects being invalid is supported by the spec, sepcifically
sections 3.1 and 3.2: https://www.w3.org/TR/activitypub/#obj-id

Anonymous objects are not relevant here (they can only exists within
parent objects iiuc) and neither is client-to-server or transient objects
(as those cannot be fetched in the first place).
This leaves us with the requirement for `id` to (a) exist and
(b) be a publicly dereferencable URI from the originating server.
This alone does not yet demand strict equivalence, but the spec then
further explains objects ought to be fetchable _via their ID_.
Meaning an object not retrievable via its ID, is invalid.

This reading is supported by the fact, e.g. GoToSocial (recently) and
Mastodon (for 6+ years) do already implement such strict ID checks,
additionally proving this doesn’t cause federation issues in practice.

However, apart from canonical IDs there can also be additional display
URLs. *omas first redirect those to their canonical location, but *keys
and Mastodon directly serve the AP representation without redirects.

Mastodon and GTS deal with this in two different ways,
but both constitute an effective countermeasure:
 - Mastodon:
   Unless it already is a known AP id, two fetches occur.
   The first fetch just reads the `id` property and then refetches from
   the id. The last fetch requires the returned id to exactly match the
   URL the content was fetched from. (This can be optimised by skipping
   the second fetch if it already matches)
   05eda8d193/app/helpers/jsonld_helper.rb (L168)
   63f0979799

 - GTS:
   Only does a single fetch and then checks if _either_ the id
   _or_ url property (which can be an object) match the original fetch
   URL. This relies on implementations always including their display URL
   as "url" if differing from the id. For actors this is true for all
   investigated implementations, for posts only Mastodon includes an
   "url", but it is also the only one with a differing display URL.
   2bafd7daf5 (diff-943bbb02c8ac74ac5dc5d20807e561dcdfaebdc3b62b10730f643a20ac23c24fR222)

Albeit Mastodon’s refetch offers higher compatibility with theoretical
implmentations using either multiple different display URL or not
denoting any of them as "url" at all, for now we chose to adopt a
GTS-like refetch-free approach to avoid additional implementation
concerns wrt to whether redirects should be allowed when fetching a
canonical AP id and potential for accidentally loosening some checks
(e.g. cross-domain refetches) for one of the fetches.
This may be reconsidered in the future.
2024-03-25 14:05:05 -01:00
..
dist Mix Task Frontend test: Expand. 2020-08-07 16:03:06 +02:00
7even.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
7369654.html Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
admin@mastdon.example.org.json User search respect discoverable flag 2020-09-17 12:15:50 -04:00
atarifrosch_webfinger.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
baptiste.gelex.xyz-article.json Fixtures: Pretty print. 2020-07-01 11:47:45 +02:00
baptiste.gelex.xyz-user.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
craigmaloney.json convert markdown content to html 2020-04-28 09:32:43 +03:00
eal_sakamoto.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
emelie.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
emoji-in-summary.json Copy emoji in the subject from parent post 2021-03-22 21:20:47 +03:00
framasoft@framatube.org.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
framatube.org-video.json Pipeline Ingestion: Video 2020-09-11 01:39:39 +02:00
framatube.org_host_meta Support reaching user@sub.domain.tld at user@domain.tld (#134) 2022-08-02 13:54:22 +00:00
frontend.zip Mix Task Frontend: Add tests. 2020-08-07 15:10:34 +02:00
frontend_dist.zip Mix Task Frontend test: Expand. 2020-08-07 16:03:06 +02:00
funkwhale_audio.json Add support for funkwhale Audio activity 2020-03-11 13:46:42 +01:00
funkwhale_channel.json Add support for funkwhale Audio activity 2020-03-11 13:46:42 +01:00
funkwhale_create_audio.json Pipeline Ingestion: Audio (Part 2) 2020-08-19 00:06:31 +02:00
gerzilla.de_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
gnusocial.de_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
gs.example.org_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
helene@p.helene.moe.json Transmogrifier: fix reply context fixing 2022-08-04 12:57:48 +01:00
hellpie.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
http___gs.example.org_4040_index.php_user_1.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
http___mastodon.example.org_users_admin_status_1234.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___framatube.org_accounts_framasoft.json Fix getting videos from peertube 2020-07-07 09:38:38 +02:00
https___info.pleroma.site_actor.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___lm.kazv.moe_users_mewmew.xml implement Move activities (#45) 2022-07-04 16:29:39 +00:00
https___mastodon.social_users_lambadalambda.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___osada.macgirvin.com.html Move get_favicon to Pleroma.Instances, use / 2020-07-08 06:28:39 +02:00
https___osada.macgirvin.com_channel_mike.json Sanity check fetched user data 2024-03-25 14:05:05 -01:00
https___pawoo.net_users_aqidaqidaqid.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___pawoo.net_users_pekorino.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___pleroma.soykaf.com_users_lain.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___prismo.news__mxb.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___shitposter.club_notice_2827873.html Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___shitposter.club_user_1.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___social.heldscal.la_user_23211.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https___social.heldscal.la_user_29191.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https__info.pleroma.site_activity.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https__info.pleroma.site_activity2.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
https__info.pleroma.site_activity3.json Only allow exact id matches 2024-03-25 14:05:05 -01:00
https__info.pleroma.site_activity4.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
kaniini@gerzilla.de.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
kaniini@hubzilla.example.org.json Sanity check fetched user data 2024-03-25 14:05:05 -01:00
kpherox@mstdn.jp.xml Add WebFinger test for AP-only account 2019-07-25 01:27:34 +09:00
lain_squeet.me_webfinger.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
lemmy-page.json Pipeline Ingestion: Page 2021-06-04 20:06:33 +02:00
lemmy-user.json Pipeline Ingestion: Page 2021-06-04 20:06:33 +02:00
lm.kazv.moe_host_meta implement Move activities (#45) 2022-07-04 16:29:39 +00:00
lucifermysticus.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
macgirvin.com_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
mametsuko@mk.absturztau.be.json Transmogrifier: fix reply context fixing 2022-08-04 12:57:48 +01:00
mamot.fr_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
mastodon.social_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
mastodon.xyz_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
mayumayu.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
mayumayupost.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
mewmew@lm.kazv.moe.json implement Move activities (#45) 2022-07-04 16:29:39 +00:00
mike@osada.macgirvin.com.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
misskey_poll_no_end_date.json Mastodon API Poll view: Fix handling of polls without an end date 2019-09-05 12:03:39 +03:00
mk.absturztau.be-93e7nm8wqg-activity.json CommonFixes: more predictable context generation 2023-06-14 16:22:26 +00:00
mk.absturztau.be-93e7nm8wqg.json Transmogrifier: fix reply context fixing 2022-08-04 12:57:48 +01:00
mobilizon.org-event.json Add ActivityPub Object Event type support 2019-12-17 16:16:21 +01:00
mobilizon.org-user.json Add ActivityPub Object Event type support 2019-12-17 16:16:21 +01:00
moonman@shitposter.club.json add some missing tesla fixtures 2019-10-18 14:50:10 +00:00
mstdn.jp_host_meta provide mocks for webfinger endpoints 2019-10-09 16:32:28 +00:00
nonexistant@social.heldscal.la.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
osada-user-indio.json Transmogrifier: Fix follow handling when the actor is an object. 2019-08-26 14:34:52 -05:00
p.helene.moe-AM7S6vZQmL6pI9TgPY.json Transmogrifier: fix reply context fixing 2022-08-04 12:57:48 +01:00
pawoo.net_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
peertube-social.json convert markdown content to html 2020-04-28 09:32:43 +03:00
peertube.moe-vid.json Fixtures: Pretty print. 2020-07-01 11:47:45 +02:00
pekorino@pawoo.net_host_meta.json provide mocks for webfinger endpoints 2019-10-09 16:32:28 +00:00
pleroma.soykaf.com_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
poll_attachment.json Fix attachments in polls 2020-07-15 12:32:42 +02:00
poll_modified.json Initial poll refresh support 2019-09-18 18:13:21 +03:00
poll_original.json Initial poll refresh support 2019-09-18 18:13:21 +03:00
puckipedia.com.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
relay@mastdon.example.org.json Only allow exact id matches 2024-03-25 14:05:05 -01:00
rin.json Initial poll refresh support 2019-09-18 18:13:21 +03:00
rinpatch.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
rye.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
sdf.org_host_meta provide mocks for webfinger endpoints 2019-10-09 16:32:28 +00:00
shitposter.club_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
shp@pleroma.soykaf.com.webfigner Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
shp@social.heldscal.la.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
sjw.json Mastodon API Poll view: Fix handling of polls without an end date 2019-09-05 12:03:39 +03:00
skruyb@mamot.fr.atom Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
snowdusk@sdf.org_host_meta.json provide mocks for webfinger endpoints 2019-10-09 16:32:28 +00:00
social.heldscal.la_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
social.sakamoto.gq_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
social.stopwatchingus-heidelberg.de_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
social.wxcafe.net_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
soykaf.com_host_meta provide mocks for webfinger endpoints 2019-10-09 16:32:28 +00:00
spc_5381_xrd.xml Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
squeet.me_host_meta Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
status.alpicola.com_host_meta Support reaching user@sub.domain.tld at user@domain.tld (#134) 2022-08-02 13:54:22 +00:00
status.emelie.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
stopwatchingus-heidelberg.de_host_meta provide mocks for webfinger endpoints 2019-10-09 16:32:28 +00:00
webfinger_emelie.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00
wedistribute-article.json Show the url advertised in the Activity in the Status JSON response 2019-07-24 19:28:21 +00:00
wedistribute-create-article.json Pipeline Ingestion: Article 2020-09-11 01:40:20 +02:00
wedistribute-user.json Show the url advertised in the Activity in the Status JSON response 2019-07-24 19:28:21 +00:00
winterdienst_webfinger.json Remove httpoison from dependencies 2019-07-03 14:42:24 +07:00