mirrors/gotosocial
1
0
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial.git synced 2025-11-24 03:23:31 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

[bugfix] add stricter checks during all stages of dereferencing remote AS objects (#2639)

Browse source 
* add stricter checks during all stages of dereferencing remote AS objects

* a comment
This commit is contained in:
kim 2024-02-14 11:13:38 +00:00 • committed by tobi
commit b9013a8ab3
15 changed files with 351 additions and 167 deletions
Download patch file Download diff file Expand all files Collapse all files

14
internal/transport/finger.go
View file

@ -97,9 +97,17 @@ func (t *transport) Finger(ctx context.Context, targetUsername string, targetDom
// again here to renew the TTL
t.controller.state.Caches.GTS.Webfinger().Set(targetDomain, url)
}
if rsp.StatusCode == http.StatusGone {
return nil, fmt.Errorf("account has been deleted/is gone")
}
// Ensure that the incoming request content-type is expected.
if ct := rsp.Header.Get("Content-Type"); !apiutil.JSONJRDContentType(ct) {
err := gtserror.Newf("non webfinger type response: %s", ct)
return nil, gtserror.SetMalformed(err)
}
return io.ReadAll(rsp.Body)
}
@ -192,6 +200,12 @@ func (t *transport) webfingerFromHostMeta(ctx context.Context, targetDomain stri
return "", fmt.Errorf("GET request for %s failed: %s", req.URL.String(), rsp.Status)
}
// Ensure that the incoming request content-type is expected.
if ct := rsp.Header.Get("Content-Type"); !apiutil.XMLXRDContentType(ct) {
err := gtserror.Newf("non host-meta type response: %s", ct)
return "", gtserror.SetMalformed(err)
}
e := xml.NewDecoder(rsp.Body)
var hm apimodel.HostMeta
if err := e.Decode(&hm); err != nil {