Merge branch 'bugfix/websub-hardening' into 'develop'

websub: improve error handling

See merge request pleroma/pleroma!670

lib/pleroma/web/websub/websub.ex

@@ -121,6 +121,12 @@ def incoming_subscription_request(user, %{"hub.mode" => "subscribe"} = params) d
     end
   end
 
+  def incoming_subscription_request(user, params) do
+    Logger.info("Unhandled WebSub request for #{user.nickname}: #{inspect(params)}")
+
+    {:error, "Invalid WebSub request"}
+  end
+
   defp get_subscription(topic, callback) do
     Repo.get_by(WebsubServerSubscription, topic: topic, callback: callback) ||
       %WebsubServerSubscription{}

lib/pleroma/web/websub/websub_controller.ex

@@ -67,6 +67,13 @@ def websub_subscription_confirmation(
     end
   end
 
+  def websub_subscription_confirmation(conn, params) do
+    Logger.info("Invalid WebSub confirmation request: #{inspect(params)}")
+
+    conn
+    |> send_resp(500, "Invalid parameters")
+  end
+
   def websub_incoming(conn, %{"id" => id}) do
     with "sha1=" <> signature <- hd(get_req_header(conn, "x-hub-signature")),
          signature <- String.downcase(signature),