diff --git a/packages/backend/src/remote/activitypub/resolver.ts b/packages/backend/src/remote/activitypub/resolver.ts index 8cf1ecd71..94b8a6503 100644 --- a/packages/backend/src/remote/activitypub/resolver.ts +++ b/packages/backend/src/remote/activitypub/resolver.ts @@ -45,7 +45,7 @@ export class Resolver { } } - public async resolve(value: string | IObject): Promise { + public async resolve(value: string | IObject, allowRedirect = false): Promise { if (value == null) { throw new Error('resolvee is null (or undefined)'); } @@ -94,7 +94,7 @@ export class Resolver { ) // Did we actually get the object that corresponds to the canonical URL? // Does the host we requested stuff from actually correspond to the host that owns the activity? - || !(getApId(object) == null || getApId(object) === value) + || !(getApId(object) == null || getApId(object) === value || allowRedirect) ) { throw new Error('invalid response'); } diff --git a/packages/backend/src/server/api/endpoints/ap/get.ts b/packages/backend/src/server/api/endpoints/ap/get.ts index 7f261b0bf..3a051086a 100644 --- a/packages/backend/src/server/api/endpoints/ap/get.ts +++ b/packages/backend/src/server/api/endpoints/ap/get.ts @@ -29,6 +29,6 @@ export const paramDef = { // eslint-disable-next-line import/no-default-export export default define(meta, paramDef, async (ps) => { const resolver = new Resolver(); - const object = await resolver.resolve(ps.uri); + const object = await resolver.resolve(ps.uri, true); return object; }); diff --git a/packages/backend/src/server/api/endpoints/ap/show.ts b/packages/backend/src/server/api/endpoints/ap/show.ts index 4f8832d6b..7770e1220 100644 --- a/packages/backend/src/server/api/endpoints/ap/show.ts +++ b/packages/backend/src/server/api/endpoints/ap/show.ts @@ -98,9 +98,10 @@ async function fetchAny(uri: string, me: CacheableLocalUser | null | undefined): ])); if (local != null) return local; - // リモートから一旦オブジェクトフェッチ + // fetch object from remote const resolver = new Resolver(); - const object = await resolver.resolve(uri) as any; + // allow redirect + const object = await resolver.resolve(uri, true) as any; // /@user のような正規id以外で取得できるURIが指定されていた場合、ここで初めて正規URIが確定する // これはDBに存在する可能性があるため再度DB検索