fix(feed): tighten enclosure metadata

lib/pleroma/web/feed/feed_view.ex

@@ -131,7 +131,7 @@ defmodule Pleroma.Web.Feed.FeedView do
       end
 
     attachments_html =
-      if data["sensitive"] do
+      if sensitive?(data) do
         ""
       else
         (data["attachment"] || [])
@@ -181,6 +181,8 @@ defmodule Pleroma.Web.Feed.FeedView do
 
   def activity_context(activity), do: escape(activity.data["context"])
 
+  def sensitive?(data), do: data["sensitive"] in [true, "true"]
+
   def feed_self_url(conn) do
     conn
     |> Phoenix.Controller.current_url()
@@ -237,15 +239,15 @@ defmodule Pleroma.Web.Feed.FeedView do
     end
   end
 
-  def attachment_previewable?(attachment) do
+  def rss_enclosure_attachment(attachments) do
-    attachment_medium(attachment) in ["image", "video", "audio"]
+    Enum.find(attachments || [], &(not is_nil(attachment_size_positive(&1))))
   end
 
   def attachment_description(attachment) do
     attachment["name"] || ""
   end
 
-  def media_content_xml(_attachment, true), do: ""
+  def media_content_xml(_attachment, sensitive) when sensitive in [true, "true"], do: ""
 
   def media_content_xml(attachment, _sensitive) do
     href = escape(attachment_href(attachment) || "")

lib/pleroma/web/templates/feed/feed/_activity.atom.eex

@@ -21,7 +21,7 @@
     <category term="<%= tag %>"></category>
   <% end %>
 
-  <%= unless @data["sensitive"] do %>
+  <%= unless sensitive?(@data) do %>
     <%= for attachment <- @data["attachment"] || [] do %>
       <%= if size = attachment_size_positive(attachment) do %>
         <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size %>"/>

lib/pleroma/web/templates/feed/feed/_activity.rss.eex

@@ -18,15 +18,14 @@
     <% end %>
   <% end %>
 
-  <%= unless @data["sensitive"] do %>
+  <%= unless sensitive?(@data) do %>
-    <%= with [attachment | _] <- @data["attachment"] || [] do %>
+    <%= with attachment when not is_nil(attachment) <- rss_enclosure_attachment(@data["attachment"]) do %>
-      <%= size = attachment_size_positive(attachment) %>
+      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= attachment_size_positive(attachment) %>" />
-      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size || 0 %>" />
     <% end %>
   <% end %>
 
   <%= for attachment <- @data["attachment"] || [] do %>
-    <%= media_content_xml(attachment, @data["sensitive"]) %>
+    <%= media_content_xml(attachment, sensitive?(@data)) %>
   <% end %>
 
   <%= if @data["inReplyTo"] do %>

lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex

@@ -24,7 +24,7 @@
     <category term="<%= tag %>"></category>
   <% end %>
 
-  <%= unless @data["sensitive"] do %>
+  <%= unless sensitive?(@data) do %>
     <%= for attachment <- @data["attachment"] || [] do %>
       <%= if size = attachment_size_positive(attachment) do %>
         <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size %>"/>

lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex

@@ -6,15 +6,14 @@
   <description><%= activity_description(@data) %></description>
   <content:encoded><![CDATA[<%= rss_content_encoded(@data) %>]]></content:encoded>
 
-  <%= unless @data["sensitive"] do %>
+  <%= unless sensitive?(@data) do %>
-    <%= with [attachment | _] <- @data["attachment"] || [] do %>
+    <%= with attachment when not is_nil(attachment) <- rss_enclosure_attachment(@data["attachment"]) do %>
-      <%= size = attachment_size_positive(attachment) %>
+      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= attachment_size_positive(attachment) %>"/>
-      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size || 0 %>"/>
     <% end %>
   <% end %>
 
   <%= for attachment <- @data["attachment"] || [] do %>
-    <%= media_content_xml(attachment, @data["sensitive"]) %>
+    <%= media_content_xml(attachment, sensitive?(@data)) %>
   <% end %>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>

test/pleroma/web/feed/feed_view_test.exs

@@ -35,6 +35,7 @@ defmodule Pleroma.Web.Feed.FeedViewTest do
     assert FeedView.atom_content_encoded(data) == "content warning"
     assert FeedView.rss_content_encoded(data) == "content warning"
     assert FeedView.media_content_xml(attachment, true) == ""
+    assert FeedView.media_content_xml(attachment, "true") == ""
 
     media_content = FeedView.media_content_xml(attachment, false)
     assert media_content =~ "<media:description type=\"plain\">spoiler</media:description>"
@@ -43,4 +44,16 @@ defmodule Pleroma.Web.Feed.FeedViewTest do
     assert FeedView.media_content_xml(Map.delete(attachment, "name"), false) ==
              ~s(<media:content url="https://example.com/spoiler.png" type="image/png" medium="image"/>\n)
   end
+
+  test "does not treat a legacy false string as sensitive" do
+    data = %{
+      "attachment" => [
+        %{"url" => [%{"href" => "https://example.com/image.png", "mediaType" => "image/png"}]}
+      ],
+      "content" => "visible",
+      "sensitive" => "false"
+    }
+
+    assert FeedView.atom_content_encoded(data) =~ "<img"
+  end
 end

test/pleroma/web/feed/user_controller_test.exs

@@ -202,9 +202,12 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
         |> response(200)
         |> parse()
 
-      assert xpath(rss_xml, ~x"//item/enclosure/@url"sl) == ["https://example.com/file.bin"]
+      assert xpath(rss_xml, ~x"//item/enclosure/@url"sl) == []
-      assert xpath(rss_xml, ~x"//item/enclosure/@type"sl) == ["application/octet-stream"]
+      assert xpath(rss_xml, ~x"//item/media:content/@url"sl) == ["https://example.com/file.bin"]
-      assert xpath(rss_xml, ~x"//item/enclosure/@length"sl) == ["0"]
+
+      assert xpath(rss_xml, ~x"//item/media:content/@type"sl) == [
+               "application/octet-stream"
+             ]
     end
 
     test "returns 404 for a missing feed", %{conn: conn} do