AP C2S tests: Make sure you can't use another user's AP id

This commit is contained in:
Haelwenn (lanodan) Monnier 2020-07-15 09:58:35 +02:00
parent f918b6f86d
commit 6d8427cca2
No known key found for this signature in database
GPG key ID: D5B7A8E43C997DEE

View file

@ -1082,6 +1082,45 @@ test "it increases like count when receiving a like action", %{conn: conn} do
assert object = Object.get_by_ap_id(note_object.data["id"]) assert object = Object.get_by_ap_id(note_object.data["id"])
assert object.data["like_count"] == 1 assert object.data["like_count"] == 1
end end
test "it doesn't spreads faulty attributedTo or actor fields", %{
conn: conn,
activity: activity
} do
reimu = insert(:user, nickname: "reimu")
cirno = insert(:user, nickname: "cirno")
assert reimu.ap_id
assert cirno.ap_id
activity =
activity
|> put_in(["object", "actor"], reimu.ap_id)
|> put_in(["object", "attributedTo"], reimu.ap_id)
|> put_in(["actor"], reimu.ap_id)
|> put_in(["attributedTo"], reimu.ap_id)
_reimu_outbox =
conn
|> assign(:user, cirno)
|> put_req_header("content-type", "application/activity+json")
|> post("/users/#{reimu.nickname}/outbox", activity)
|> json_response(403)
cirno_outbox =
conn
|> assign(:user, cirno)
|> put_req_header("content-type", "application/activity+json")
|> post("/users/#{cirno.nickname}/outbox", activity)
|> json_response(201)
assert cirno_outbox["attributedTo"] == nil
assert cirno_outbox["actor"] == cirno.ap_id
assert cirno_object = Object.normalize(cirno_outbox["object"])
assert cirno_object.data["actor"] == cirno.ap_id
assert cirno_object.data["attributedTo"] == cirno.ap_id
end
end end
describe "/relay/followers" do describe "/relay/followers" do