FoundKeyGang/FoundKey
FoundKeyGang/FoundKey
7
19
Fork 22
Code Issues 37 Pull requests 4 Releases Activity

activitypub: no longer accept LD Signatures
Some checks failed
ci/woodpecker/push/lint-foundkey-js Pipeline was successful
Details
ci/woodpecker/push/lint-backend Pipeline failed
Details
ci/woodpecker/push/lint-client Pipeline failed
Details
ci/woodpecker/push/build Pipeline was successful
Details
ci/woodpecker/push/lint-sw Pipeline failed
Details
ci/woodpecker/push/test Pipeline failed
Details

Browse source 
LD signatures are not properly securely implemented, further they
do not seem to be necessary any more.

closes #373

Changelog: Removed
This commit is contained in:
Johann150 2024-04-20 17:26:25 +02:00
parent d34f7c7faa
commit c18a7a8d30
Signed by: Johann150
GPG key ID: 9EE6577A2A06F8F1
1 changed files with 2 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
packages/backend/src/queue/processors/inbox.ts
View file

@ -9,8 +9,7 @@ import { extractPunyHost } from '@/misc/convert-host.js';
import { getApId } from '@/remote/activitypub/type.js';
import { fetchInstanceMetadata } from '@/services/fetch-instance-metadata.js';
import { Resolver } from '@/remote/activitypub/resolver.js';
import { LdSignature } from '@/remote/activitypub/misc/ld-signature.js';
import { AuthUser, getAuthUser } from '@/remote/activitypub/misc/auth-user.js';
import { AuthUser } from '@/remote/activitypub/misc/auth-user.js';
import { InboxJobData } from '@/queue/types.js';
import { shouldBlockInstance } from '@/misc/should-block-instance.js';
import { verifyHttpSignature } from '@/remote/http-signature.js';
@ -35,44 +34,7 @@ export default async (job: Bull.Job<InboxJobData>): Promise<string> => {
// The signature must be valid.
// The signature must also match the actor otherwise anyone could sign any activity.
if (validated.status !== 'valid' || validated.authUser.user.uri !== activity.actor) {
// Last resort: LD-Signature
if (activity.signature) {
if (activity.signature.type !== 'RsaSignature2017') {
return `skip: unsupported LD-signature type ${activity.signature.type}`;
}
try {
// get user based on LD-Signature key id.
// lets assume that the creator has this common form:
// <https://example.com/users/user#main-key>
// Then we can use it as the key id and (without fragment part) user id.
authUser = await getAuthUser(activity.signature.creator, activity.signature.creator.replace(/#.*$/, ''), resolver);
if (authUser == null) throw new Error();
} catch {
return 'skip: failed to resolve LD-Signature user';
}
// LD-Signature verification
const ldSignature = new LdSignature();
const verified = await ldSignature.verifyRsaSignature2017(activity, authUser.key.keyPem).catch(() => false);
if (!verified) {
return 'skip: LD-Signatureの検証に失敗しました';
}
// Again, the actor must match.
if (authUser.user.uri !== activity.actor) {
return `skip: LD-Signature user(${authUser.user.uri}) !== activity.actor(${activity.actor})`;
}
// Stop if the host is blocked.
const ldHost = extractPunyHost(authUser.user.uri);
if (await shouldBlockInstance(ldHost)) {
return `Blocked request: ${ldHost}`;
}
} else {
return `skip: http-signature verification failed and no LD-Signature. keyId=${signature.keyId}`;
}
return `skip: http-signature verification failed. keyId=${signature.keyId}`;
}
// authUser cannot be null at this point: