tests: add a second spoofing variant

test/fixtures/httpoison_mock/https__info.pleroma.site_activity3.json

@@ -0,0 +1,13 @@
+{
+        "@context": "https://www.w3.org/ns/activitystreams",
+        "attributedTo": "http://mastodon.example.org/users/admin",
+        "attachment": [],
+        "content": "<p>this post was not actually written by Haelwenn</p>",
+        "id": "https://info.pleroma.site/activity2.json",
+        "published": "2018-09-01T22:15:00Z",
+        "tag": [],
+        "to": [
+            "https://www.w3.org/ns/activitystreams#Public"
+        ],
+        "type": "Note"
+}

test/support/httpoison_mock.ex

@@ -48,6 +48,14 @@ def get("https://info.pleroma.site/activity2.json", _, _) do
      }}
   end
 
+  def get("https://info.pleroma.site/activity3.json", _, _) do
+    {:ok,
+     %Response{
+       status_code: 200,
+       body: File.read!("test/fixtures/httpoison_mock/https__info.pleroma.site_activity3.json")
+     }}
+  end
+
   def get("https://info.pleroma.site/actor.json", _, _) do
     {:ok,
      %Response{

test/web/activity_pub/transmogrifier_test.exs

@@ -884,11 +884,11 @@ test "it rejects activities which reference objects with bogus origins" do
       :error = Transmogrifier.handle_incoming(data)
     end
 
-    test "it rejects objects when the ID does not match the fetched URI" do
+    test "it rejects objects when attributedTo is wrong (variant 1)" do
       {:error, _} = ActivityPub.fetch_object_from_id("https://info.pleroma.site/activity2.json")
     end
 
-    test "it rejects activities which reference objects by mismatched URI" do
+    test "it rejects activities which reference objects that have an incorrect attribution (variant 1)" do
       data = %{
         "@context" => "https://www.w3.org/ns/activitystreams",
         "id" => "http://mastodon.example.org/users/admin/activities/1234",
@@ -900,5 +900,22 @@ test "it rejects activities which reference objects by mismatched URI" do
 
       :error = Transmogrifier.handle_incoming(data)
     end
+
+    test "it rejects objects when attributedTo is wrong (variant 2)" do
+      {:error, _} = ActivityPub.fetch_object_from_id("https://info.pleroma.site/activity3.json")
+    end
+
+    test "it rejects activities which reference objects that have an incorrect attribution (variant 2)" do
+      data = %{
+        "@context" => "https://www.w3.org/ns/activitystreams",
+        "id" => "http://mastodon.example.org/users/admin/activities/1234",
+        "actor" => "http://mastodon.example.org/users/admin",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "object" => "https://info.pleroma.site/activity3.json",
+        "type" => "Announce"
+      }
+
+      :error = Transmogrifier.handle_incoming(data)
+    end
   end
 end