MIX FORMAT

CHANGELOG.md

@@ -16,6 +16,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Fixed
 - Documentation issue in which a non-existing nginx file was referenced
+- Issue where a bad inbox URL could break federation
 
 ## 2023.08
 

lib/mix/pleroma.ex

@@ -39,8 +39,6 @@ def start_pleroma do
 
     Enum.each(@apps, &Application.ensure_all_started/1)
 
-    Pleroma.Application.load_all_pleroma_modules()
-
     oban_config = [
       crontab: [],
       repo: Pleroma.Repo,

lib/mix/tasks/pleroma/diagnostics.ex

@@ -17,13 +17,6 @@ def run(["http", url]) do
     |> IO.inspect()
   end
 
-  def run(["get_object", url]) do
-    start_pleroma()
-
-    Pleroma.Object.Fetcher.fetch_object_from_id(url)
-    |> IO.inspect()
-  end
-
   def run(["home_timeline", nickname]) do
     start_pleroma()
     user = Repo.get_by!(User, nickname: nickname)

lib/pleroma/application.ex

@@ -48,6 +48,7 @@ def start(_type, _args) do
     # due to protocol consolidation warnings
     Code.compiler_options(warnings_as_errors: false)
     Config.Holder.save_default()
+    Pleroma.HTML.compile_scrubbers()
     Pleroma.Config.Oban.warn()
     Config.DeprecationWarnings.warn()
     Pleroma.Web.Plugs.HTTPSecurityPlug.warn_if_disabled()

lib/pleroma/html.ex

@@ -8,6 +8,20 @@ defmodule Pleroma.HTML do
 
   @cachex Pleroma.Config.get([:cachex, :provider], Cachex)
 
+  def compile_scrubbers do
+    dir = Path.join(:code.priv_dir(:pleroma), "scrubbers")
+
+    dir
+    |> Pleroma.Utils.compile_dir()
+    |> case do
+      {:error, _errors, _warnings} ->
+        raise "Compiling scrubbers failed"
+
+      {:ok, _modules, _warnings} ->
+        :ok
+    end
+  end
+
   defp get_scrubbers(scrubber) when is_atom(scrubber), do: [scrubber]
   defp get_scrubbers(scrubbers) when is_list(scrubbers), do: scrubbers
   defp get_scrubbers(_), do: [Pleroma.HTML.Scrubber.Default]

lib/pleroma/web/activity_pub/publisher.ex

@@ -115,13 +115,18 @@ defp allowed_instances do
   def should_federate?(url) do
     %{host: host} = URI.parse(url)
 
-    with allowed <- allowed_instances(),
+    with {nil, false} <- {nil, is_nil(host)},
+         allowed <- allowed_instances(),
          false <- Enum.empty?(allowed) do
       allowed
       |> Pleroma.Web.ActivityPub.MRF.instance_list_from_tuples()
       |> Pleroma.Web.ActivityPub.MRF.subdomains_regex()
       |> Pleroma.Web.ActivityPub.MRF.subdomain_match?(host)
     else
+      # oi!
+      {nil, true} ->
+        false
+
       _ ->
         quarantined_instances =
           blocked_instances()

lib/pleroma/web/activity_pub/views/user_view.ex

@@ -18,16 +18,16 @@ defmodule Pleroma.Web.ActivityPub.UserView do
   import Ecto.Query
 
   def render("endpoints.json", %{user: %User{nickname: nil, local: true} = _user}) do
-    %{"sharedInbox" => ~p"/inbox"}
+    %{"sharedInbox" => url(~p"/inbox")}
   end
 
   def render("endpoints.json", %{user: %User{local: true} = _user}) do
     %{
-      "oauthAuthorizationEndpoint" => ~p"/oauth/authorize",
-      "oauthRegistrationEndpoint" => ~p"/api/v1/apps",
-      "oauthTokenEndpoint" => ~p"/oauth/token",
-      "sharedInbox" => ~p"/inbox",
-      "uploadMedia" => ~p"/api/ap/upload_media"
+      "oauthAuthorizationEndpoint" => url(~p"/oauth/authorize"),
+      "oauthRegistrationEndpoint" => url(~p"/api/v1/apps"),
+      "oauthTokenEndpoint" => url(~p"/oauth/token"),
+      "sharedInbox" => url(~p"/inbox"),
+      "uploadMedia" => url(~p"/api/ap/upload_media")
     }
   end
 

test/pleroma/web/activity_pub/publisher_test.exs

@@ -487,4 +487,11 @@ test "publish to url with with different ports" do
              )
     end
   end
+
+  describe "should_federate/1" do
+    test "should not obliterate itself if the inbox URL is bad" do
+      url = "/inbox"
+      refute Pleroma.Web.ActivityPub.Publisher.should_federate?(url)
+    end
+  end
 end