hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Enforce an exact domain match for WebFinger resolution

Browse source 
The regex was not being terminated with an $
This commit is contained in:
Mark Felder 2025-07-03 12:08:36 -07:00
commit 17987e3990
3 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/webfinger-resolution.fix Normal file
View file

@ -0,0 +1 @@
Enforce an exact domain match for WebFinger resolution

4
lib/pleroma/web/web_finger.ex
View file

@ -35,9 +35,9 @@ defmodule Pleroma.Web.WebFinger do
regex =
if webfinger_domain = Pleroma.Config.get([__MODULE__, :domain]) do
~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@(#{host}|#{webfinger_domain})/
~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@(#{host}|#{webfinger_domain})$/
else
~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@#{host}/
~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@#{host}$/
end
with %{"username" => username} <- Regex.named_captures(regex, resource),

17
test/pleroma/web/web_finger_test.exs
View file

@ -39,6 +39,23 @@ defmodule Pleroma.Web.WebFingerTest do
end
end
test "requires exact match for Endpoint host or WebFinger domain" do
clear_config([Pleroma.Web.WebFinger, :domain], "pleroma.dev")
user = insert(:user)
assert {:error, "Couldn't find user"} ==
WebFinger.webfinger("#{user.nickname}@#{Pleroma.Web.Endpoint.host()}xxxx", "JSON")
assert {:error, "Couldn't find user"} ==
WebFinger.webfinger("#{user.nickname}@pleroma.devxxxx", "JSON")
assert {:ok, _} =
WebFinger.webfinger("#{user.nickname}@#{Pleroma.Web.Endpoint.host()}", "JSON")
assert {:ok, _} =
WebFinger.webfinger("#{user.nickname}@pleroma.dev", "JSON")
end
describe "fingering" do
test "returns error for nonsensical input" do
assert {:error, _} = WebFinger.finger("bliblablu")