limit id length of all incoming activities

This commit is contained in:
Johann150 2022-09-12 18:30:53 +02:00
parent 1120b6959d
commit 7ceb96b148
Signed by untrusted user: Johann150
GPG key ID: 9EE6577A2A06F8F1

View file

@ -127,13 +127,18 @@ export default async (job: Bull.Job<InboxJobData>): Promise<string> => {
}
}
// activity.idがあればホストが署名者のホストであることを確認する
if (typeof activity.id === 'string') {
// Verify that activity and actor are from the same host.
const signerHost = extractDbHost(authUser.user.uri!);
const activityIdHost = extractDbHost(activity.id);
if (signerHost !== activityIdHost) {
return `skip: signerHost(${signerHost}) !== activity.id host(${activityIdHost}`;
}
// Verify that the id has a sane length
if (activity.id.length > 2048) {
return `skip: overly long id from ${signerHost}`;
}
}
// Update stats