hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Enforce an exact domain match for WebFinger resolution

Browse source 
The regex was not being terminated with an $
This commit is contained in:
Mark Felder 2025-07-03 12:08:36 -07:00
commit 17987e3990
3 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/pleroma/web/web_finger.ex
View file

@ -35,9 +35,9 @@ defmodule Pleroma.Web.WebFinger do
regex =
if webfinger_domain = Pleroma.Config.get([__MODULE__, :domain]) do
~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@(#{host}|#{webfinger_domain})/
~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@(#{host}|#{webfinger_domain})$/
else
~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@#{host}/
~r/(acct:)?(?<username>[a-z0-9A-Z_\.-]+)@#{host}$/
end
with %{"username" => username} <- Regex.named_captures(regex, resource),