hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

StealEmojiPolicy: Sanitize shortcodes

Browse source 
Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3245
This commit is contained in:
Haelwenn (lanodan) Monnier 2024-02-20 08:45:48 +01:00
commit 7d624c4750
No known key found for this signature in database
3 changed files with 29 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs
View file

@ -87,6 +87,32 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicyTest do
assert File.exists?(fullpath)
end
test "rejects invalid shortcodes", %{path: path} do
message = %{
"type" => "Create",
"object" => %{
"emoji" => [{"fired/fox", "https://example.org/emoji/firedfox"}],
"actor" => "https://example.org/users/admin"
}
}
fullpath = Path.join(path, "fired/fox.png")
Tesla.Mock.mock(fn %{method: :get, url: "https://example.org/emoji/firedfox"} ->
%Tesla.Env{status: 200, body: File.read!("test/fixtures/image.jpg")}
end)
clear_config(:mrf_steal_emoji, hosts: ["example.org"], size_limit: 284_468)
refute "firedfox" in installed()
refute File.exists?(path)
assert {:ok, _message} = StealEmojiPolicy.filter(message)
refute "fired/fox" in installed()
refute File.exists?(fullpath)
end
test "reject regex shortcode", %{message: message} do
refute "firedfox" in installed()