gnh1201/mastodon
1
0
Fork 0
mirror of https://github.com/mastodon/mastodon.git synced 2025-05-11 12:11:12 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* Check scheme in account and post links

* Harden media attachments

* Client-side mitigation

* Client-side mitigation for media attachments
This commit is contained in:
Claire 2025-05-06 15:02:13 +02:00 committed by GitHub
parent ec2023233d
commit 6d46225718
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 22 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
app/javascript/mastodon/actions/importer/normalizer.js
View File

@ -80,6 +80,17 @@ export function normalizeStatus(status, normalOldStatus) {
normalStatus.contentHtml = emojify(normalStatus.content, emojiMap); normalStatus.contentHtml = emojify(normalStatus.content, emojiMap);
normalStatus.spoilerHtml = emojify(escapeTextContentForBrowser(spoilerText), emojiMap); normalStatus.spoilerHtml = emojify(escapeTextContentForBrowser(spoilerText), emojiMap);
normalStatus.hidden = expandSpoilers ? false : spoilerText.length > 0 || normalStatus.sensitive; normalStatus.hidden = expandSpoilers ? false : spoilerText.length > 0 || normalStatus.sensitive;
if (normalStatus.url && !(normalStatus.url.startsWith('http://') || normalStatus.url.startsWith('https://'))) {
normalStatus.url = null;
}
normalStatus.url ||= normalStatus.uri;
normalStatus.media_attachments.forEach(item => {
if (item.remote_url && !(item.remote_url.startsWith('http://') || item.remote_url.startsWith('https://')))
item.remote_url = null;
});
} }
if (normalOldStatus) { if (normalOldStatus) {

1
app/javascript/mastodon/models/account.ts
View File

@ -150,5 +150,6 @@ export function createAccountFromServerJSON(serverJSON: ApiAccountJSON) {
), ),
note_emojified: emojify(accountJSON.note, emojiMap), note_emojified: emojify(accountJSON.note, emojiMap),
note_plain: unescapeHTML(accountJSON.note), note_plain: unescapeHTML(accountJSON.note),
url: accountJSON.url.startsWith('http://') || accountJSON.url.startsWith('https://') ? accountJSON.url : accountJSON.uri,
}); });
} }

6
app/lib/activitypub/parser/media_attachment_parser.rb
View File

@ -15,13 +15,15 @@ class ActivityPub::Parser::MediaAttachmentParser
end end
def remote_url def remote_url
Addressable::URI.parse(@json['url'])&.normalize&.to_s url = Addressable::URI.parse(@json['url'])&.normalize&.to_s
url unless unsupported_uri_scheme?(url)
rescue Addressable::URI::InvalidURIError rescue Addressable::URI::InvalidURIError
nil nil
end end
def thumbnail_remote_url def thumbnail_remote_url
Addressable::URI.parse(@json['icon'].is_a?(Hash) ? @json['icon']['url'] : @json['icon'])&.normalize&.to_s url = Addressable::URI.parse(@json['icon'].is_a?(Hash) ? @json['icon']['url'] : @json['icon'])&.normalize&.to_s
url unless unsupported_uri_scheme?(url)
rescue Addressable::URI::InvalidURIError rescue Addressable::URI::InvalidURIError
nil nil
end end

5
app/lib/activitypub/parser/status_parser.rb
View File

@ -28,7 +28,10 @@ class ActivityPub::Parser::StatusParser
end end
def url def url
url_to_href(@object['url'], 'text/html') if @object['url'].present? return if @object['url'].blank?
url = url_to_href(@object['url'], 'text/html')
url unless unsupported_uri_scheme?(url)
end end
def text def text

3
app/lib/activitypub/tag_manager.rb
View File

@ -4,6 +4,7 @@ require 'singleton'
class ActivityPub::TagManager class ActivityPub::TagManager
include Singleton include Singleton
include JsonLdHelper
include RoutingHelper include RoutingHelper
CONTEXT = 'https://www.w3.org/ns/activitystreams' CONTEXT = 'https://www.w3.org/ns/activitystreams'
@ -17,7 +18,7 @@ class ActivityPub::TagManager
end end
def url_for(target) def url_for(target)
return target.url if target.respond_to?(:local?) && !target.local? return unsupported_uri_scheme?(target.url) ? nil : target.url if target.respond_to?(:local?) && !target.local?
return unless target.respond_to?(:object_type) return unless target.respond_to?(:object_type)