hj/pleroma - Forgejo

hj/pleroma

1 line

139 B

Text

Raw Normal View History

fix(fetcher): require fetched documents to have the fetched id The fetcher accepted any document whose id was on the same host as the fetch URL. Anyone who can place a JSON file on a host, for example through an upload, could pass it off as another object or actor from that host. The id of a fetched document must now be the URL it came from (after redirects), ignoring a trailing slash, the fragment, the host case and differences that our URL encoding removes. If it differs, as for Mastodon's /@user/123 display URLs, we refetch once from that id, which must be on the same host. The refetch must not redirect and must match exactly. Test mocks that served a document under a different URL now serve it from its own id. Based on Akkoma 8684964c5 and 940792f8b.

2026-10-27 21:45:14 +04:00

Only accept fetched objects whose id is the URL they were fetched from; for other ids, refetch once from the canonical id on the same host