fix(feed): preserve standard media enclosures

lib/pleroma/web/templates/feed/feed/_activity.atom.eex

@@ -22,9 +22,13 @@
     <category term="<%= tag %>"></category>
   <% end %>
 
-  <%= for attachment <- @data["attachment"] || [] do %>
+  <%= unless @data["sensitive"] do %>
-    <%= unless attachment_previewable?(attachment) do %>
+    <%= for attachment <- @data["attachment"] || [] do %>
-      <link rel="enclosure" href="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= attachment_size(attachment) %>"/>
+      <%= if size = attachment_size_positive(attachment) do %>
+        <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size %>"/>
+      <% else %>
+        <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>"/>
+      <% end %>
     <% end %>
   <% end %>
 

lib/pleroma/web/templates/feed/feed/_activity.rss.eex

@@ -18,11 +18,14 @@
     <% end %>
   <% end %>
 
-  <%= for attachment <- @data["attachment"] || [] do %>
+  <%= unless @data["sensitive"] do %>
-    <%= size = attachment_size_positive(attachment) %>
+    <%= with [attachment | _] <- @data["attachment"] || [] do %>
-    <%= unless attachment_previewable?(attachment) do %>
+      <%= size = attachment_size_positive(attachment) %>
-      <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>" />
+      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size || 0 %>" />
     <% end %>
+  <% end %>
+
+  <%= for attachment <- @data["attachment"] || [] do %>
     <%= media_content_xml(attachment, @data["sensitive"]) %>
   <% end %>
 

lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex

@@ -25,9 +25,13 @@
     <category term="<%= tag %>"></category>
   <% end %>
 
-  <%= for attachment <- @data["attachment"] || [] do %>
+  <%= unless @data["sensitive"] do %>
-    <%= unless attachment_previewable?(attachment) do %>
+    <%= for attachment <- @data["attachment"] || [] do %>
-      <link rel="enclosure" href="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= attachment_size(attachment) %>"/>
+      <%= if size = attachment_size_positive(attachment) do %>
+        <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size %>"/>
+      <% else %>
+        <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>"/>
+      <% end %>
     <% end %>
   <% end %>
 

lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex

@@ -6,11 +6,14 @@
   <description><%= activity_description(@data) %></description>
   <content:encoded><![CDATA[<%= rss_content_encoded(@data) %>]]></content:encoded>
 
-  <%= for attachment <- @data["attachment"] || [] do %>
+  <%= unless @data["sensitive"] do %>
-    <%= size = attachment_size_positive(attachment) %>
+    <%= with [attachment | _] <- @data["attachment"] || [] do %>
-    <%= unless attachment_previewable?(attachment) do %>
+      <%= size = attachment_size_positive(attachment) %>
-      <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>"/>
+      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size || 0 %>"/>
     <% end %>
+  <% end %>
+
+  <%= for attachment <- @data["attachment"] || [] do %>
     <%= media_content_xml(attachment, @data["sensitive"]) %>
   <% end %>
 

test/pleroma/web/feed/tag_controller_test.exs

@@ -31,8 +31,18 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
           "url" => [
             %{
               "href" =>
-                "https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4",
+                "https://peertube.moe/video.mp4?first=one&second=two",
               "mediaType" => "video/mp4",
+              "size" => "123",
+              "type" => "Link"
+            }
+          ]
+        },
+        %{
+          "url" => [
+            %{
+              "href" => "https://peertube.moe/notes.pdf",
+              "mediaType" => "application/pdf",
               "type" => "Link"
             }
           ]
@@ -64,6 +74,13 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
 
     assert xpath(xml, ~x"//feed/entry/author/name/text()"ls) == [user.nickname, user.nickname]
 
+    assert xpath(xml, ~x"//feed/entry/link[@rel='enclosure']/@href"sl) == [
+             "https://peertube.moe/video.mp4?first=one&second=two",
+             "https://peertube.moe/notes.pdf"
+           ]
+
+    assert xpath(xml, ~x"//feed/entry/link[@rel='enclosure']/@length"sl) == ["123"]
+
     conn =
       conn
       |> put_req_header("accept", "application/atom+xml")
@@ -97,8 +114,18 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
           "url" => [
             %{
               "href" =>
-                "https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4",
+                "https://peertube.moe/video.mp4?first=one&second=two",
               "mediaType" => "video/mp4",
+              "size" => "123",
+              "type" => "Link"
+            }
+          ]
+        },
+        %{
+          "url" => [
+            %{
+              "href" => "https://peertube.moe/notes.pdf",
+              "mediaType" => "application/pdf",
               "type" => "Link"
             }
           ]
@@ -147,9 +174,16 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
              FeedView.to_rfc2822(edited_at)
 
     assert xpath(xml, ~x"//channel/item/media:content/@url"sl) == [
-             "https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4"
+             "https://peertube.moe/video.mp4?first=one&second=two",
+             "https://peertube.moe/notes.pdf"
            ]
 
+    assert xpath(xml, ~x"//channel/item/enclosure/@url"sl) == [
+             "https://peertube.moe/video.mp4?first=one&second=two"
+           ]
+
+    assert xpath(xml, ~x"//channel/item/enclosure/@length"sl) == ["123"]
+
     obj1 = Object.normalize(activity1, fetch: false)
     obj2 = Object.normalize(activity2, fetch: false)
 

test/pleroma/web/feed/user_controller_test.exs

@@ -150,6 +150,63 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
       end
     end
 
+    test "does not expose sensitive attachments as enclosures", %{
+      conn: conn,
+      object: object,
+      user: user
+    } do
+      object
+      |> Ecto.Changeset.change(data: Map.put(object.data, "sensitive", true))
+      |> Pleroma.Repo.update!()
+
+      atom_response =
+        conn
+        |> get("/users/#{user.nickname}/feed.atom")
+        |> response(200)
+
+      rss_response =
+        conn
+        |> get("/users/#{user.nickname}/feed.rss")
+        |> response(200)
+
+      refute atom_response =~ "rel=\"enclosure\""
+      refute rss_response =~ "<enclosure "
+    end
+
+    test "uses enclosure fallbacks for user feeds", %{conn: conn, object: object, user: user} do
+      attachment = %{"url" => [%{"href" => "https://example.com/file.bin"}]}
+
+      object
+      |> Ecto.Changeset.change(data: Map.put(object.data, "attachment", [attachment]))
+      |> Pleroma.Repo.update!()
+
+      atom_xml =
+        conn
+        |> get("/users/#{user.nickname}/feed.atom")
+        |> response(200)
+        |> parse()
+
+      assert xpath(atom_xml, ~x"//entry/link[@rel='enclosure']/@href"sl) == [
+               "https://example.com/file.bin"
+             ]
+
+      assert xpath(atom_xml, ~x"//entry/link[@rel='enclosure']/@type"sl) == [
+               "application/octet-stream"
+             ]
+
+      assert xpath(atom_xml, ~x"//entry/link[@rel='enclosure']/@length"sl) == []
+
+      rss_xml =
+        conn
+        |> get("/users/#{user.nickname}/feed.rss")
+        |> response(200)
+        |> parse()
+
+      assert xpath(rss_xml, ~x"//item/enclosure/@url"sl) == ["https://example.com/file.bin"]
+      assert xpath(rss_xml, ~x"//item/enclosure/@type"sl) == ["application/octet-stream"]
+      assert xpath(rss_xml, ~x"//item/enclosure/@length"sl) == ["0"]
+    end
+
     test "returns 404 for a missing feed", %{conn: conn} do
       conn =
         conn