pixelfed/app/Util/ActivityPub/Helpers.php

453 lines
12 KiB
PHP
Raw Normal View History

2018-10-29 01:29:44 +00:00
<?php
namespace App\Util\ActivityPub;
2019-04-05 05:13:59 +00:00
use DB, Cache, Purify, Storage, Request, Validator;
2018-10-29 01:29:44 +00:00
use App\{
2019-03-08 06:46:38 +00:00
Activity,
Follower,
Like,
Media,
Notification,
Profile,
Status
2018-10-29 01:29:44 +00:00
};
use Zttp\Zttp;
use Carbon\Carbon;
use GuzzleHttp\Client;
use Illuminate\Http\File;
use Illuminate\Validation\Rule;
use App\Jobs\AvatarPipeline\CreateAvatar;
use App\Jobs\RemoteFollowPipeline\RemoteFollowImportRecent;
use App\Jobs\ImageOptimizePipeline\{ImageOptimize,ImageThumbnail};
use App\Jobs\StatusPipeline\NewStatusPipeline;
2018-12-21 19:57:43 +00:00
use App\Util\ActivityPub\HttpSignature;
2019-04-05 04:44:08 +00:00
use Illuminate\Support\Str;
2018-10-29 01:29:44 +00:00
class Helpers {
public static function validateObject($data)
{
2019-04-18 05:48:26 +00:00
$verbs = ['Create', 'Announce', 'Like', 'Follow', 'Delete', 'Accept', 'Reject', 'Undo', 'Tombstone'];
2018-10-29 01:29:44 +00:00
$valid = Validator::make($data, [
'type' => [
'required',
2019-04-18 06:32:27 +00:00
'string',
2018-10-29 01:29:44 +00:00
Rule::in($verbs)
],
'id' => 'required|string',
2019-04-18 05:29:22 +00:00
'actor' => 'required|string|url',
2018-10-29 01:29:44 +00:00
'object' => 'required',
'object.type' => 'required_if:type,Create',
2019-04-18 05:29:22 +00:00
'object.attributedTo' => 'required_if:type,Create|url',
2018-10-29 01:29:44 +00:00
'published' => 'required_if:type,Create|date'
])->passes();
return $valid;
}
public static function verifyAttachments($data)
{
if(!isset($data['object']) || empty($data['object'])) {
$data = ['object'=>$data];
}
$activity = $data['object'];
2019-06-12 19:21:41 +00:00
$mimeTypes = explode(',', config('pixelfed.media_types'));
$mediaTypes = in_array('video/mp4', $mimeTypes) ? ['Document', 'Image', 'Video'] : ['Document', 'Image'];
2019-03-08 06:46:38 +00:00
if(!isset($activity['attachment']) || empty($activity['attachment'])) {
return false;
}
$attachment = $activity['attachment'];
$valid = Validator::make($attachment, [
'*.type' => [
'required',
'string',
Rule::in($mediaTypes)
],
2019-04-18 05:29:22 +00:00
'*.url' => 'required|url|max:255',
2019-03-08 06:46:38 +00:00
'*.mediaType' => [
'required',
'string',
Rule::in($mimeTypes)
],
'*.name' => 'nullable|string|max:255'
])->passes();
return $valid;
2018-10-29 01:29:44 +00:00
}
public static function normalizeAudience($data, $localOnly = true)
{
if(!isset($data['to'])) {
return;
}
2019-03-08 06:46:38 +00:00
2018-10-29 01:29:44 +00:00
$audience = [];
$audience['to'] = [];
$audience['cc'] = [];
$scope = 'private';
if(is_array($data['to']) && !empty($data['to'])) {
foreach ($data['to'] as $to) {
if($to == 'https://www.w3.org/ns/activitystreams#Public') {
$scope = 'public';
continue;
}
$url = $localOnly ? self::validateLocalUrl($to) : self::validateUrl($to);
if($url != false) {
array_push($audience['to'], $url);
}
}
}
if(is_array($data['cc']) && !empty($data['cc'])) {
foreach ($data['cc'] as $cc) {
if($cc == 'https://www.w3.org/ns/activitystreams#Public') {
$scope = 'unlisted';
continue;
}
$url = $localOnly ? self::validateLocalUrl($cc) : self::validateUrl($cc);
if($url != false) {
array_push($audience['cc'], $url);
}
}
}
$audience['scope'] = $scope;
return $audience;
}
public static function userInAudience($profile, $data)
{
$audience = self::normalizeAudience($data);
$url = $profile->permalink();
return in_array($url, $audience);
}
public static function validateUrl($url)
{
$localhosts = [
2019-03-08 06:46:38 +00:00
'127.0.0.1', 'localhost', '::1'
];
2018-10-29 01:29:44 +00:00
2019-04-02 00:26:15 +00:00
if(mb_substr($url, 0, 8) !== 'https://') {
return false;
}
2019-03-08 06:46:38 +00:00
$valid = filter_var($url, FILTER_VALIDATE_URL);
2018-10-29 01:29:44 +00:00
2019-04-05 01:57:13 +00:00
if(!$valid) {
return false;
}
$host = parse_url($valid, PHP_URL_HOST);
2019-06-24 04:22:23 +00:00
if(count(dns_get_record($host, DNS_A | DNS_AAAA)) == 0) {
return false;
}
2019-04-05 01:57:13 +00:00
if(config('costar.enabled') == true) {
2019-04-05 03:26:10 +00:00
if(
2019-06-24 04:22:23 +00:00
(config('costar.domain.block') != null && Str::contains($host, config('costar.domain.block')) == true) ||
2019-04-05 03:26:10 +00:00
(config('costar.actor.block') != null && in_array($url, config('costar.actor.block')) == true)
) {
2019-04-05 01:57:13 +00:00
return false;
}
}
if(in_array($host, $localhosts)) {
2019-03-08 06:46:38 +00:00
return false;
}
2018-10-29 01:29:44 +00:00
2019-03-08 06:46:38 +00:00
return $valid;
2018-10-29 01:29:44 +00:00
}
public static function validateLocalUrl($url)
{
$url = self::validateUrl($url);
2019-04-05 03:26:10 +00:00
if($url == true) {
2018-10-29 01:29:44 +00:00
$domain = config('pixelfed.domain.app');
$host = parse_url($url, PHP_URL_HOST);
$url = $domain === $host ? $url : false;
return $url;
}
return false;
}
public static function zttpUserAgent()
{
return [
2019-03-08 06:46:38 +00:00
'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
'User-Agent' => 'PixelfedBot - https://pixelfed.org',
2019-03-08 06:46:38 +00:00
];
2018-10-29 01:29:44 +00:00
}
public static function fetchFromUrl($url)
{
2019-04-02 00:29:59 +00:00
$url = self::validateUrl($url);
if($url == false) {
return;
}
2019-03-08 06:46:38 +00:00
$res = Zttp::withHeaders(self::zttpUserAgent())->get($url);
$res = json_decode($res->body(), true, 8);
if(json_last_error() == JSON_ERROR_NONE) {
return $res;
} else {
return false;
}
2018-10-29 01:29:44 +00:00
}
public static function fetchProfileFromUrl($url)
{
return self::fetchFromUrl($url);
}
2019-06-25 04:46:35 +00:00
public static function statusFirstOrFetch($url, $replyTo = false)
2018-10-29 01:29:44 +00:00
{
$url = self::validateUrl($url);
if($url == false) {
return;
}
$host = parse_url($url, PHP_URL_HOST);
$local = config('pixelfed.domain.app') == $host ? true : false;
if($local) {
$id = (int) last(explode('/', $url));
return Status::findOrFail($id);
} else {
$cached = Status::whereUrl($url)->first();
if($cached) {
return $cached;
}
$res = self::fetchFromUrl($url);
if(!$res || empty($res)) {
return;
}
if(isset($res['object'])) {
$activity = $res;
} else {
$activity = ['object' => $res];
}
2019-04-05 04:44:08 +00:00
if(isset($res['content']) == false) {
abort(400, 'Invalid object');
}
$scope = 'private';
2019-04-18 04:49:27 +00:00
2019-04-05 04:44:08 +00:00
$cw = isset($activity['sensitive']) ? (bool) $activity['sensitive'] : false;
2019-04-18 04:49:27 +00:00
if(isset($res['to']) == true) {
if(is_array($res['to']) && in_array('https://www.w3.org/ns/activitystreams#Public', $res['to'])) {
$scope = 'public';
}
if(is_string($res['to']) && 'https://www.w3.org/ns/activitystreams#Public' == $res['to']) {
$scope = 'public';
}
2019-04-05 04:44:08 +00:00
}
2019-04-18 04:49:27 +00:00
if(isset($res['cc']) == true) {
if(is_array($res['cc']) && in_array('https://www.w3.org/ns/activitystreams#Public', $res['cc'])) {
$scope = 'unlisted';
}
if(is_string($res['cc']) && 'https://www.w3.org/ns/activitystreams#Public' == $res['cc']) {
$scope = 'unlisted';
}
2019-04-05 04:44:08 +00:00
}
if(config('costar.enabled') == true) {
$blockedKeywords = config('costar.keyword.block');
if($blockedKeywords !== null) {
$keywords = config('costar.keyword.block');
foreach($keywords as $kw) {
if(Str::contains($res['content'], $kw) == true) {
abort(400, 'Invalid object');
}
}
}
$unlisted = config('costar.domain.unlisted');
if(in_array(parse_url($url, PHP_URL_HOST), $unlisted) == true) {
$unlisted = true;
$scope = 'unlisted';
} else {
$unlisted = false;
}
$cw = config('costar.domain.cw');
if(in_array(parse_url($url, PHP_URL_HOST), $cw) == true) {
$cw = true;
} else {
$cw = isset($activity['sensitive']) ? (bool) $activity['sensitive'] : false;
}
}
2019-06-16 05:30:12 +00:00
if(!self::validateUrl($res['id']) ||
!self::validateUrl($activity['object']['attributedTo'])
) {
abort(400, 'Invalid object url');
}
2018-12-26 06:56:18 +00:00
$idDomain = parse_url($res['id'], PHP_URL_HOST);
2018-12-26 05:05:47 +00:00
$urlDomain = parse_url($url, PHP_URL_HOST);
$actorDomain = parse_url($activity['object']['attributedTo'], PHP_URL_HOST);
if(
$idDomain !== $urlDomain ||
$actorDomain !== $urlDomain ||
$idDomain !== $actorDomain
) {
abort(400, 'Invalid object');
}
2018-10-29 01:29:44 +00:00
$profile = self::profileFirstOrNew($activity['object']['attributedTo']);
if(isset($activity['object']['inReplyTo']) && !empty($activity['object']['inReplyTo']) && $replyTo == true) {
$reply_to = self::statusFirstOrFetch($activity['object']['inReplyTo'], false);
$reply_to = $reply_to->id;
} else {
$reply_to = null;
}
2018-12-21 19:57:43 +00:00
$ts = is_array($res['published']) ? $res['published'][0] : $res['published'];
2019-04-05 05:13:59 +00:00
$status = DB::transaction(function() use($profile, $res, $url, $ts, $reply_to, $cw, $scope) {
$status = new Status;
$status->profile_id = $profile->id;
$status->url = isset($res['url']) ? $res['url'] : $url;
$status->uri = isset($res['url']) ? $res['url'] : $url;
$status->caption = strip_tags($res['content']);
$status->rendered = Purify::clean($res['content']);
$status->created_at = Carbon::parse($ts);
$status->in_reply_to_id = $reply_to;
$status->local = false;
$status->is_nsfw = $cw;
$status->scope = $scope;
$status->visibility = $scope;
$status->save();
2019-06-09 18:53:32 +00:00
self::importNoteAttachment($res, $status);
2019-04-05 05:13:59 +00:00
return $status;
});
2018-10-29 01:29:44 +00:00
return $status;
}
}
2019-06-25 04:44:01 +00:00
public static function statusFetch($url)
{
return self::statusFirstOrFetch($url);
}
2018-10-29 01:29:44 +00:00
public static function importNoteAttachment($data, Status $status)
{
if(self::verifyAttachments($data) == false) {
return;
}
$attachments = isset($data['object']) ? $data['object']['attachment'] : $data['attachment'];
$user = $status->profile;
$monthHash = hash('sha1', date('Y').date('m'));
$userHash = hash('sha1', $user->id.(string) $user->created_at);
2019-03-08 06:46:38 +00:00
$storagePath = "public/m/{$monthHash}/{$userHash}";
$allowed = explode(',', config('pixelfed.media_types'));
2019-06-12 19:21:41 +00:00
2018-10-29 01:29:44 +00:00
foreach($attachments as $media) {
$type = $media['mediaType'];
$url = $media['url'];
$valid = self::validateUrl($url);
if(in_array($type, $allowed) == false || $valid == false) {
continue;
}
2019-06-09 18:53:32 +00:00
$media = new Media();
2019-06-09 23:38:29 +00:00
$media->remote_media = true;
2019-06-09 18:53:32 +00:00
$media->status_id = $status->id;
$media->profile_id = $status->profile_id;
$media->user_id = null;
2019-07-19 04:08:39 +00:00
$media->media_path = $url;
$media->remote_url = $url;
$media->mime = $type;
2019-06-09 18:53:32 +00:00
$media->save();
2018-10-29 01:29:44 +00:00
}
2019-06-12 19:21:41 +00:00
$status->viewType();
2018-10-29 01:29:44 +00:00
return;
}
public static function profileFirstOrNew($url, $runJobs = false)
{
2019-03-06 02:52:12 +00:00
$url = self::validateUrl($url);
2019-04-05 04:44:08 +00:00
if($url == false) {
abort(400, 'Invalid url');
}
2019-03-06 02:52:12 +00:00
$host = parse_url($url, PHP_URL_HOST);
$local = config('pixelfed.domain.app') == $host ? true : false;
if($local == true) {
$id = last(explode('/', $url));
2019-07-25 01:25:26 +00:00
return Profile::whereNull('status')
->whereNull('domain')
->whereUsername($id)
->firstOrFail();
2019-03-06 02:52:12 +00:00
}
2019-03-08 06:46:38 +00:00
$res = self::fetchProfileFromUrl($url);
if(isset($res['id']) == false) {
return;
}
$domain = parse_url($res['id'], PHP_URL_HOST);
2019-06-24 06:01:49 +00:00
$username = (string) Purify::clean($res['preferredUsername']);
if(empty($username)) {
return;
}
2019-03-08 06:46:38 +00:00
$remoteUsername = "@{$username}@{$domain}";
2018-10-29 01:29:44 +00:00
2019-04-18 05:29:22 +00:00
abort_if(!self::validateUrl($res['inbox']), 400);
abort_if(!self::validateUrl($res['outbox']), 400);
abort_if(!self::validateUrl($res['id']), 400);
2018-12-25 04:29:16 +00:00
$profile = Profile::whereRemoteUrl($res['id'])->first();
2018-10-29 01:29:44 +00:00
if(!$profile) {
2019-06-27 06:44:09 +00:00
$profile = new Profile();
2019-03-08 06:46:38 +00:00
$profile->domain = $domain;
2019-06-24 06:01:49 +00:00
$profile->username = (string) Purify::clean($remoteUsername);
2019-04-18 04:49:27 +00:00
$profile->name = Purify::clean($res['name']) ?? 'user';
2019-03-08 06:46:38 +00:00
$profile->bio = Purify::clean($res['summary']);
$profile->sharedInbox = isset($res['endpoints']) && isset($res['endpoints']['sharedInbox']) ? $res['endpoints']['sharedInbox'] : null;
$profile->inbox_url = $res['inbox'];
$profile->outbox_url = $res['outbox'];
$profile->remote_url = $res['id'];
$profile->public_key = $res['publicKey']['publicKeyPem'];
$profile->key_id = $res['publicKey']['id'];
$profile->save();
if($runJobs == true) {
2019-04-03 19:20:57 +00:00
// RemoteFollowImportRecent::dispatch($res, $profile);
2018-10-29 01:29:44 +00:00
CreateAvatar::dispatch($profile);
2019-03-08 06:46:38 +00:00
}
2018-10-29 01:29:44 +00:00
}
return $profile;
}
2019-06-25 04:44:01 +00:00
public static function profileFetch($url)
{
return self::profileFirstOrNew($url);
}
2019-03-08 06:46:38 +00:00
public static function sendSignedObject($senderProfile, $url, $body)
{
2019-04-18 05:29:22 +00:00
abort_if(!self::validateUrl($url), 400);
2019-04-18 04:49:27 +00:00
2019-03-08 06:46:38 +00:00
$payload = json_encode($body);
$headers = HttpSignature::sign($senderProfile, $url, $body);
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HEADER, true);
$response = curl_exec($ch);
return;
}
2018-10-29 01:29:44 +00:00
}