CHANGELOG.md

@@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - handling of GET /api/v1/preferences
 - Akkoma API is now documented
 - ability to auto-approve follow requests from users you are already following
+- The SimplePolicy MRF can now strip user backgrounds from selected remote hosts
 
 ## Changed
 - OTP builds are now built on erlang OTP26

docs/docs/configuration/cheatsheet.md

@@ -144,6 +144,7 @@ To add configuration to your config file, you can copy it from the base config.
 * `report_removal`: List of instances to reject reports from and the reason for doing so.
 * `avatar_removal`: List of instances to strip avatars from and the reason for doing so.
 * `banner_removal`: List of instances to strip banners from and the reason for doing so.
+* `background_removal`: List of instances to strip user backgrounds from and the reason for doing so.
 * `reject_deletes`: List of instances to reject deletions from and the reason for doing so.
 
 #### :mrf_subchain

docs/docs/configuration/mrf.md

@@ -35,6 +35,7 @@ Once `SimplePolicy` is enabled, you can configure various groups in the `:mrf_si
 * `media_removal`: Servers in this group will have media stripped from incoming messages.
 * `avatar_removal`: Avatars from these servers will be stripped from incoming messages.
 * `banner_removal`: Banner images from these servers will be stripped from incoming messages.
+* `background_removal`: User background images from these servers will be stripped from incoming messages.
 * `report_removal`: Servers in this group will have their reports (flags) rejected.
 * `federated_timeline_removal`: Servers in this group will have their messages unlisted from the public timelines by flipping the `to` and `cc` fields.
 * `reject_deletes`: Deletion requests will be rejected from these servers.

lib/pleroma/web/activity_pub/mrf/simple_policy.ex

@@ -178,6 +178,23 @@ defp check_banner_removal(%{host: actor_host} = _actor_info, %{"image" => _image
 
   defp check_banner_removal(_actor_info, object), do: {:ok, object}
 
+  defp check_background_removal(
+         %{host: actor_host} = _actor_info,
+         %{"backgroundUrl" => _bg} = object
+       ) do
+    background_removal =
+      instance_list(:background_removal)
+      |> MRF.subdomains_regex()
+
+    if MRF.subdomain_match?(background_removal, actor_host) do
+      {:ok, Map.delete(object, "backgroundUrl")}
+    else
+      {:ok, object}
+    end
+  end
+
+  defp check_background_removal(_actor_info, object), do: {:ok, object}
+
   defp extract_context_uri(%{"conversation" => "tag:" <> rest}) do
     rest
     |> String.split(",", parts: 2, trim: true)
@@ -283,7 +300,8 @@ def filter(%{"id" => actor, "type" => obj_type} = object)
     with {:ok, _} <- check_accept(actor_info),
          {:ok, _} <- check_reject(actor_info),
          {:ok, object} <- check_avatar_removal(actor_info, object),
-         {:ok, object} <- check_banner_removal(actor_info, object) do
+         {:ok, object} <- check_banner_removal(actor_info, object),
+         {:ok, object} <- check_background_removal(actor_info, object) do
       {:ok, object}
     else
       {:reject, nil} -> {:reject, "[SimplePolicy]"}
@@ -447,6 +465,11 @@ def config_description do
              key: :banner_removal,
              description: "List of instances to strip banners from and the reason for doing so"
            },
+           %{
+             key: :background_removal,
+             description:
+               "List of instances to strip user backgrounds from and the reason for doing so"
+           },
            %{
              key: :reject_deletes,
              description: "List of instances to reject deletions from and the reason for doing so"

test/pleroma/web/activity_pub/mrf/simple_policy_test.exs

@@ -19,6 +19,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicyTest do
             accept: [],
             avatar_removal: [],
             banner_removal: [],
+            background_removal: [],
             reject_deletes: []
           )
 
@@ -618,6 +619,42 @@ test "match with wildcard domain" do
     end
   end
 
+  describe "when :background_removal" do
+    test "is empty" do
+      clear_config([:mrf_simple, :background_removal], [])
+
+      remote_user = build_remote_user()
+
+      assert SimplePolicy.filter(remote_user) == {:ok, remote_user}
+    end
+
+    test "is not empty but it doesn't have a matching host" do
+      clear_config([:mrf_simple, :background_removal], [{"non.matching.remote", ""}])
+
+      remote_user = build_remote_user()
+
+      assert SimplePolicy.filter(remote_user) == {:ok, remote_user}
+    end
+
+    test "has a matching host" do
+      clear_config([:mrf_simple, :background_removal], [{"remote.instance", ""}])
+
+      remote_user = build_remote_user()
+      {:ok, filtered} = SimplePolicy.filter(remote_user)
+
+      refute filtered["backgroundUrl"]
+    end
+
+    test "match with wildcard domain" do
+      clear_config([:mrf_simple, :background_removal], [{"*.remote.instance", ""}])
+
+      remote_user = build_remote_user()
+      {:ok, filtered} = SimplePolicy.filter(remote_user)
+
+      refute filtered["backgroundUrl"]
+    end
+  end
+
   describe "when :reject_deletes is empty" do
     setup do: clear_config([:mrf_simple, :reject_deletes], [])
 
@@ -701,6 +738,10 @@ defp build_remote_user do
         "url" => "http://example.com/image.jpg",
         "type" => "Image"
       },
+      "backgroundUrl" => %{
+        "url" => "http://example.com/background.jpg",
+        "type" => "Image"
+      },
       "type" => "Person"
     }
   end