161sh/trashposs
1
0
Fork 0
mirror of https://iceshrimp.dev/crimekillz/trashposs synced 2024-11-22 00:43:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

[backend] Improved http signature verification checks

Browse Source 
This fixes an edge case where federation with split domain instances could fail.
This commit is contained in:
Laura Hausmann 2023-10-21 22:39:03 +02:00
parent 1f53affd76
commit 04fa6bef15
No known key found for this signature in database
GPG Key ID: D044E84C5BE01605
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
packages/backend/src/remote/activitypub/check-fetch.ts
View File

@ -81,8 +81,13 @@ export async function checkFetch(req: IncomingMessage): Promise<number> {
return 403;
}
// もう一回チェック
if (authUser.user.host !== host) {
// Cannot authenticate against local user
if (authUser.user.uri === null || authUser.user.host === null) {
return 400;
}
// Check if keyId hostname matches actor hostname
if (toPuny(new URL(authUser.user.uri).hostname) !== host) {
return 403;
}