Johann150
c18a7a8d30
Some checks failed
ci/woodpecker/push/lint-foundkey-js Pipeline was successful
ci/woodpecker/push/lint-backend Pipeline failed
ci/woodpecker/push/lint-client Pipeline failed
ci/woodpecker/push/build Pipeline was successful
ci/woodpecker/push/lint-sw Pipeline failed
ci/woodpecker/push/test Pipeline failed
LD signatures are not properly securely implemented, further they do not seem to be necessary any more. closes #373 Changelog: Removed
83 lines
3 KiB
TypeScript
83 lines
3 KiB
TypeScript
import { URL } from 'node:url';
|
|
import Bull from 'bull';
|
|
import { perform } from '@/remote/activitypub/perform.js';
|
|
import Logger from '@/services/logger.js';
|
|
import { registerOrFetchInstanceDoc } from '@/services/register-or-fetch-instance-doc.js';
|
|
import { Instances } from '@/models/index.js';
|
|
import { apRequestChart, federationChart, instanceChart } from '@/services/chart/index.js';
|
|
import { extractPunyHost } from '@/misc/convert-host.js';
|
|
import { getApId } from '@/remote/activitypub/type.js';
|
|
import { fetchInstanceMetadata } from '@/services/fetch-instance-metadata.js';
|
|
import { Resolver } from '@/remote/activitypub/resolver.js';
|
|
import { AuthUser } from '@/remote/activitypub/misc/auth-user.js';
|
|
import { InboxJobData } from '@/queue/types.js';
|
|
import { shouldBlockInstance } from '@/misc/should-block-instance.js';
|
|
import { verifyHttpSignature } from '@/remote/http-signature.js';
|
|
|
|
const logger = new Logger('inbox');
|
|
|
|
// Processing when an activity arrives in the user's inbox
|
|
export default async (job: Bull.Job<InboxJobData>): Promise<string> => {
|
|
const signature = job.data.signature; // HTTP-signature
|
|
const activity = job.data.activity;
|
|
const resolver = new Resolver();
|
|
|
|
//#region Log
|
|
const info = Object.assign({}, activity) as any;
|
|
delete info['@context'];
|
|
logger.debug(JSON.stringify(info, null, 2));
|
|
//#endregion
|
|
|
|
const validated = await verifyHttpSignature(signature, resolver, getApId(activity.actor));
|
|
let authUser = validated.authUser;
|
|
|
|
// The signature must be valid.
|
|
// The signature must also match the actor otherwise anyone could sign any activity.
|
|
if (validated.status !== 'valid' || validated.authUser.user.uri !== activity.actor) {
|
|
return `skip: http-signature verification failed. keyId=${signature.keyId}`;
|
|
}
|
|
|
|
// authUser cannot be null at this point:
|
|
// either it was already not null because the HTTP signature was valid
|
|
// or, if the LD signature was not verified, this function will already have returned.
|
|
authUser = authUser as AuthUser;
|
|
|
|
// Verify that the actor's host is not blocked
|
|
const signerHost = extractPunyHost(authUser.user.uri!);
|
|
if (await shouldBlockInstance(signerHost)) {
|
|
return `Blocked request: ${signerHost}`;
|
|
}
|
|
|
|
if (typeof activity.id === 'string') {
|
|
// Verify that activity and actor are from the same host.
|
|
const activityIdHost = extractPunyHost(activity.id);
|
|
if (signerHost !== activityIdHost) {
|
|
return `skip: signerHost(${signerHost}) !== activity.id host(${activityIdHost}`;
|
|
}
|
|
|
|
// Verify that the id has a sane length
|
|
if (activity.id.length > 2048) {
|
|
return `skip: overly long id from ${signerHost}`;
|
|
}
|
|
}
|
|
|
|
// Update stats
|
|
registerOrFetchInstanceDoc(authUser.user.host).then(i => {
|
|
Instances.update(i.id, {
|
|
latestRequestReceivedAt: new Date(),
|
|
lastCommunicatedAt: new Date(),
|
|
isNotResponding: false,
|
|
});
|
|
|
|
fetchInstanceMetadata(i);
|
|
|
|
instanceChart.requestReceived(i.host);
|
|
apRequestChart.inbox();
|
|
federationChart.inbox(i.host);
|
|
});
|
|
|
|
// process the activity
|
|
await perform(authUser.user, activity, resolver);
|
|
return 'ok';
|
|
};
|