oscar-surf/misskey
oscar-surf/misskey
0
0
Fork 0
Code Issues Activity

hotfix(backend): GHSA-qqrm-9grj-6v32 (MisskeyIO#460)

Browse source 
* hotfix(backend): GHSA-qqrm-9grj-6v32

Cherry-picked from 9a70ce8f5e

Co-authored-by: tamaina <tamaina@hotmail.co.jp>

* security fix: regexp

Co-authored-by: Ry0taK <49341894+Ry0taK@users.noreply.github.com>

---------

Co-authored-by: tamaina <tamaina@hotmail.co.jp>
Co-authored-by: Ry0taK <49341894+Ry0taK@users.noreply.github.com>
This commit is contained in:
まっちゃとーにゅ 2024-02-17 15:23:56 +09:00 • committed by GitHub
parent 8325431d4e
commit d5f229e72b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 144 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

40
packages/backend/test/e2e/fetch-validate-ap-deny.ts Normal file
View file

@ -0,0 +1,40 @@
/*
* SPDX-FileCopyrightText: syuilo and misskey-project
* SPDX-License-Identifier: AGPL-3.0-only
*/
process.env.NODE_ENV = 'test';
import { validateContentTypeSetAsActivityPub, validateContentTypeSetAsJsonLD } from '@/core/activitypub/misc/validator.js';
import { signup, uploadFile, relativeFetch } from '../utils.js';
import type * as misskey from 'misskey-js';
describe('validateContentTypeSetAsActivityPub/JsonLD (deny case)', () => {
let alice: misskey.entities.SignupResponse;
let aliceUploadedFile: any;
beforeAll(async () => {
alice = await signup({ username: 'alice' });
aliceUploadedFile = await uploadFile(alice);
}, 1000 * 60 * 2);
test('ActivityStreams: ファイルはエラーになる', async () => {
const res = await relativeFetch(aliceUploadedFile.webpublicUrl);
function doValidate() {
validateContentTypeSetAsActivityPub(res);
}
expect(doValidate).toThrow('Content type is not');
});
test('JSON-LD: ファイルはエラーになる', async () => {
const res = await relativeFetch(aliceUploadedFile.webpublicUrl);
function doValidate() {
validateContentTypeSetAsJsonLD(res);
}
expect(doValidate).toThrow('Content type is not');
});
});

2
packages/backend/test/unit/activitypub.ts
View file

@ -203,7 +203,7 @@ describe('ActivityPub', () => {
describe('Renderer', () => {
test('Render an announce with visibility: followers', () => {
rendererService.renderAnnounce(null, {
rendererService.renderAnnounce('https://example.com/notes/00example', {
id: genAidx(Date.now()),
visibility: 'followers',
} as MiNote);

10
packages/backend/test/utils.ts
View file

@ -15,6 +15,7 @@ import { JSDOM } from 'jsdom';
import * as Redis from 'ioredis';
import { DEFAULT_POLICIES } from '@/core/RoleService.js';
import { Packed } from '@/misc/json-schema.js';
import { validateContentTypeSetAsActivityPub } from '@/core/activitypub/misc/validator.js';
import { entities } from '@/postgres.js';
import { loadConfig } from '@/config.js';
import type * as misskey from 'misskey-js';
@ -328,7 +329,6 @@ export const uploadFile = async (user?: UserToken, { path, name, blob }: UploadO
});
const body = res.status !== 204 ? await res.json() as misskey.Endpoints['drive/files/create']['res'] : null;
return {
status: res.status,
headers: res.headers,
@ -477,6 +477,14 @@ export const simpleGet = async (path: string, accept = '*/*', cookie: any = unde
'text/html; charset=utf-8',
];
if (res.ok && (
accept.startsWith('application/activity+json') ||
(accept.startsWith('application/ld+json') && accept.includes('https://www.w3.org/ns/activitystreams'))
)) {
// validateContentTypeSetAsActivityPubのテストを兼ねる
validateContentTypeSetAsActivityPub(res);
}
const body =
jsonTypes.includes(res.headers.get('content-type') ?? '') ? await res.json() :
htmlTypes.includes(res.headers.get('content-type') ?? '') ? new JSDOM(await res.text()) :