20354e0aeeThe fetcher accepted any document whose id was on the same host as the fetch URL. Anyone who can place a JSON file on a host, for example through an upload, could pass it off as another object or actor from that host. The id of a fetched document must now be the URL it came from (after redirects), ignoring a trailing slash, the fragment, the host case and differences that our URL encoding removes. If it differs, as for Mastodon's /@user/123 display URLs, we refetch once from that id, which must be on the same host. The refetch must not redirect and must match exactly. Test mocks that served a document under a different URL now serve it from its own id. Based on Akkoma 8684964c5 and 940792f8b. |
||
|---|---|---|
| .. | ||
| builders | ||
| captcha | ||
| api_spec_helpers.ex | ||
| cachex_proxy.ex | ||
| channel_case.ex | ||
| cluster.ex | ||
| conn_case.ex | ||
| data_case.ex | ||
| factory.ex | ||
| helpers.ex | ||
| http_request_mock.ex | ||
| http_signatures_proxy.ex | ||
| mocks.ex | ||
| mrf_module_mock.ex | ||
| null_cache.ex | ||
| oban_helpers.ex | ||
| translation_mock.ex | ||
| websocket_client.ex | ||