mirrors/gotosocial
1
0
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial.git synced 2025-11-18 14:07:35 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

[bugfix] harden checks for remotes masquerading as local, and return correct local account redirects early (#3706)

Browse source
This commit is contained in:
kim 2025-01-30 09:40:21 +00:00 • committed by tobi
commit aebb846327
3 changed files with 146 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

25
internal/federation/dereferencing/account.go
View file

@ -639,7 +639,16 @@ func (d *Dereferencer) enrichAccount(
return nil, nil, gtserror.Newf("db error getting account after redirects: %w", err)
}
if alreadyAcc != nil {
switch {
case alreadyAcc == nil:
// nothing to do
case alreadyAcc.IsLocal():
// Request eventually redirected to a
// local account. Return it as-is here.
return alreadyAcc, nil, nil
default:
// We had this account stored
// under discovered final URI.
//
@ -718,12 +727,6 @@ func (d *Dereferencer) enrichAccount(
latestAcc.Username = cmp.Or(latestAcc.Username, accUsername)
}
if latestAcc.Domain == "" {
// Ensure we have a domain set by this point,
// otherwise it gets stored as a local user!
return nil, nil, gtserror.Newf("empty domain for %s", uri)
}
// Ensure the final parsed account URI matches
// the input URI we fetched (or received) it as.
if matches, err := util.URIMatches(
@ -740,10 +743,16 @@ func (d *Dereferencer) enrichAccount(
} else if !matches {
return nil, nil, gtserror.Newf(
"account uri %s does not match %s",
latestAcc.URI, uri.String(),
latestAcc.URI, uri,
)
}
// Ensure this isn't a local account,
// or a remote masquerading as such!
if latestAcc.IsLocal() {
return nil, nil, gtserror.Newf("cannot dereference local account %s", uri)
}
// Get current time.
now := time.Now()