FoundKeyGang/FoundKey
FoundKeyGang/FoundKey
7
19
Fork 22
Code Issues 37 Pull requests 4 Releases Activity

WIP: Secure mode #31

Closed
norm wants to merge 21 commits from (deleted):feat/secure-fetch into main
pull from: (deleted):feat/secure-fetch
merge into: FoundKeyGang:main
Conversation 9 Commits 21 Files changed 88 +19 -20
7 changed files with 19 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit b4582a829f - Show all commits

1
packages/backend/src/remote/activitypub/check-fetch.ts
View file

@ -7,7 +7,6 @@ import { toPuny } from '@/misc/convert-host.js';
import DbResolver from '@/remote/activitypub/db-resolver.js';
import { getApId } from '@/remote/activitypub/type.js';
export default async function checkFetch(req: IncomingMessage): Promise<number> {
Johann150 marked this conversation as resolved
Johann150 commented 2022-08-01 00:30:35 +00:00
Review
Copy link

If you want you could maybe take a stab at reusing this in packages/backend/src/queue/processors/inbox.ts since its essentially the same code for validating a HTTP signature.

If you want you could maybe take a stab at reusing this in `packages/backend/src/queue/processors/inbox.ts` since its essentially the same code for validating a HTTP signature.
norm commented 2022-08-01 04:32:37 +00:00
Review
Copy link

Not enitrely sure how to extract out the common logic here, may leave it to someone else to handle that.

Not enitrely sure how to extract out the common logic here, may leave it to someone else to handle that.
const meta = await fetchMeta();
if (meta.secureMode || meta.privateMode) {

18
packages/backend/src/server/activitypub.ts
View file

@ -70,7 +70,7 @@ router.get('/notes/:note', async (ctx, next) => {
if (!isActivityPubReq(ctx)) return await next();
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -87,7 +87,7 @@ router.get('/notes/:note', async (ctx, next) => {
}
// リモートだったらリダイレクト
if (note.userHost != null) {
if (note.userHost !== null) {
if (note.uri == null || isSelfHost(note.userHost)) {
ctx.status = 500;
return;
@ -110,7 +110,7 @@ router.get('/notes/:note', async (ctx, next) => {
// note activity
router.get('/notes/:note/activity', async ctx => {
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -160,7 +160,7 @@ router.get('/users/:user/publickey', async ctx => {
}
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -220,7 +220,7 @@ router.get('/users/:user', async (ctx, next) => {
}
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -246,7 +246,7 @@ router.get('/@:user', async (ctx, next) => {
}
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -269,7 +269,7 @@ router.get('/actor', async (ctx, next) => {
// emoji
router.get('/emojis/:emoji', async ctx => {
const verify = await checkFetch(ctx.req);
norm marked this conversation as resolved Outdated
Johann150 commented 2022-08-01 00:24:47 +00:00
Outdated
Review
Copy link

I think emojis are often not proxied by servers so clients will try to load the emoji from the original server. With requiring HTTP signatures even for this that will cause problems.

I think emojis are often not proxied by servers so clients will try to load the emoji from the original server. With requiring HTTP signatures even for this that will cause problems.
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -297,7 +297,7 @@ router.get('/emojis/:emoji', async ctx => {
// like
router.get('/likes/:like', async ctx => {
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -329,7 +329,7 @@ router.get('/likes/:like', async ctx => {
// follow
router.get('/follows/:follower/:followee', async ctx => {
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}

2
packages/backend/src/server/activitypub/featured.ts
View file

@ -11,7 +11,7 @@ import { fetchMeta } from '@/misc/fetch-meta.js';
export default async (ctx: Router.RouterContext) => {
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}

4
packages/backend/src/server/activitypub/followers.ts
View file

@ -14,7 +14,7 @@ import { fetchMeta } from '@/misc/fetch-meta.js';
export default async (ctx: Router.RouterContext) => {
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -22,7 +22,7 @@ export default async (ctx: Router.RouterContext) => {
const userId = ctx.params.user;
const cursor = ctx.request.query.cursor;
if (cursor != null && typeof cursor !== 'string') {
if (cursor !== null && typeof cursor !== 'string') {
ctx.status = 400;
return;
}

4
packages/backend/src/server/activitypub/following.ts
View file

@ -14,7 +14,7 @@ import { fetchMeta } from '@/misc/fetch-meta.js';
export default async (ctx: Router.RouterContext) => {
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -22,7 +22,7 @@ export default async (ctx: Router.RouterContext) => {
const userId = ctx.params.user;
const cursor = ctx.request.query.cursor;
if (cursor != null && typeof cursor !== 'string') {
if (cursor !== null && typeof cursor !== 'string') {
ctx.status = 400;
return;
}

8
packages/backend/src/server/activitypub/outbox.ts
View file

@ -18,7 +18,7 @@ import { fetchMeta } from '@/misc/fetch-meta.js';
export default async (ctx: Router.RouterContext) => {
const verify = await checkFetch(ctx.req);
if (verify != 200) {
if (verify !== 200) {
ctx.status = verify;
return;
}
@ -26,20 +26,20 @@ export default async (ctx: Router.RouterContext) => {
const userId = ctx.params.user;
const sinceId = ctx.request.query.since_id;
if (sinceId != null && typeof sinceId !== 'string') {
if (sinceId !== null && typeof sinceId !== 'string') {
ctx.status = 400;
return;
}
const untilId = ctx.request.query.until_id;
if (untilId != null && typeof untilId !== 'string') {
if (untilId !== null && typeof untilId !== 'string') {
ctx.status = 400;
return;
}
const page = ctx.request.query.page === 'true';
if (countIf(x => x != null, [sinceId, untilId]) > 1) {
if (countIf(x => x !== null, [sinceId, untilId]) > 1) {
ctx.status = 400;
return;
}

2
packages/backend/src/server/api/endpoints/notes/children.ts
View file

@ -55,7 +55,7 @@ export default define(meta, paramDef, async (ps, user) => {
.andWhere('note.id IN (SELECT id FROM note_replies(:noteId, :depth, :limit))', { noteId: ps.noteId, depth: ps.depth, limit: ps.limit })
.innerJoinAndSelect('note.user', 'user')
.leftJoinAndSelect('user.avatar', 'avatar')
.leftJoinAndSelect('user.banner', 'banner')
.leftJoinAndSelect('user.banner', 'banner');
generateVisibilityQuery(query, user);
if (user) {