GKaszewski/movies-diary
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

harden federation: sanitize incoming AP content, fix error handling, tighten rate limits
Some checks failed
CI / Check / Test (push) Successful in 10m54s
Details
CI / Release build (push) Failing after 1m20s
Details

Browse Source
This commit is contained in:
Gabriel Kaszewski
2026-05-29 12:23:29 +02:00
parent d1f9f55d4f
commit 84ddf04d28
7 changed files with 188 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
crates/adapters/activitypub/src/review_handler.rs
View File

@@ -77,13 +77,15 @@ impl ApObjectHandler for ReviewObjectHandler {
_actor_url: &Url,
object: serde_json::Value,
) -> anyhow::Result<()> {
let obj: ReviewObject = match serde_json::from_value(object) {
let mut obj: ReviewObject = match serde_json::from_value(object) {
Ok(o) => o,
Err(e) => {
tracing::debug!("ignoring unrecognized Create object: {}", e);
tracing::warn!("ignoring unrecognized Create object: {}", e);
return Ok(());
}
};
obj.movie_title = ammonia::clean(&obj.movie_title);
obj.comment = obj.comment.map(|c| ammonia::clean(&c));
let actor_url_str = obj.attributed_to.to_string();
let review_id = ReviewId::generate();
@@ -130,13 +132,15 @@ impl ApObjectHandler for ReviewObjectHandler {
actor_url: &Url,
object: serde_json::Value,
) -> anyhow::Result<()> {
let obj: ReviewObject = match serde_json::from_value(object) {
let mut obj: ReviewObject = match serde_json::from_value(object) {
Ok(o) => o,
Err(_) => {
tracing::debug!(actor = %actor_url, "ignoring non-review Update activity");
tracing::warn!(actor = %actor_url, "ignoring non-review Update activity");
return Ok(());
}
};
obj.movie_title = ammonia::clean(&obj.movie_title);
obj.comment = obj.comment.map(|c| ammonia::clean(&c));
if obj.attributed_to != *actor_url {
anyhow::bail!("update actor does not match object attributed_to");