From 3ec5102c245e2786999fcffaec589a3ffa7cfa30 Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Thu, 21 May 2020 19:49:30 -0600 Subject: [PATCH 1/9] Update FederationController, move signature validation to InboxValidator job --- app/Http/Controllers/FederationController.php | 32 ++++++++-------- app/Jobs/InboxPipeline/InboxValidator.php | 38 ++++++++++++------- 2 files changed, 40 insertions(+), 30 deletions(-) diff --git a/app/Http/Controllers/FederationController.php b/app/Http/Controllers/FederationController.php index 182725adf..43f363f1b 100644 --- a/app/Http/Controllers/FederationController.php +++ b/app/Http/Controllers/FederationController.php @@ -100,22 +100,22 @@ class FederationController extends Controller abort_if(!config('federation.activitypub.enabled'), 404); abort_if(!config('federation.activitypub.inbox'), 404); - // $headers = $request->headers->all(); - // $payload = $request->getContent(); - // InboxValidator::dispatch($username, $headers, $payload); - $profile = Profile::whereNull('domain')->whereUsername($username)->firstOrFail(); - if($profile->status != null) { - return ProfileController::accountCheck($profile); - } - $body = $request->getContent(); - $bodyDecoded = json_decode($body, true, 12); - if($this->verifySignature($request, $profile) == true) { - InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded); - } else if($this->blindKeyRotation($request, $profile) == true) { - InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded); - } else { - abort(400, 'Bad Signature'); - } + $headers = $request->headers->all(); + $payload = $request->getContent(); + InboxValidator::dispatch($username, $headers, $payload); + // $profile = Profile::whereNull('domain')->whereUsername($username)->firstOrFail(); + // if($profile->status != null) { + // return ProfileController::accountCheck($profile); + // } + // $body = $request->getContent(); + // $bodyDecoded = json_decode($body, true, 12); + // if($this->verifySignature($request, $profile) == true) { + // InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded); + // } else if($this->blindKeyRotation($request, $profile) == true) { + // InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded); + // } else { + // abort(400, 'Bad Signature'); + // } return; } diff --git a/app/Jobs/InboxPipeline/InboxValidator.php b/app/Jobs/InboxPipeline/InboxValidator.php index b16af5e10..fb2e24887 100644 --- a/app/Jobs/InboxPipeline/InboxValidator.php +++ b/app/Jobs/InboxPipeline/InboxValidator.php @@ -48,12 +48,16 @@ class InboxValidator implements ShouldQueue $profile = Profile::whereNull('domain')->whereUsername($username)->first(); + if(!isset($headers['signature']) || !isset($headers['date'])) { + return; + } + if(empty($profile) || empty($headers) || empty($payload)) { - return true; + return; } if($profile->status != null) { - return true; + return; } if($this->verifySignature($headers, $profile, $payload) == true) { @@ -73,13 +77,15 @@ class InboxValidator implements ShouldQueue $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; if(!$signature) { - abort(400, 'Missing signature header'); + return; } if(!$date) { - abort(400, 'Missing date header'); + return; } - if(!now()->parse($date)->gt(now()->subDays(1)) || !now()->parse($date)->lt(now()->addDays(1))) { - abort(400, 'Invalid date'); + if(!now()->parse($date)->gt(now()->subDays(1)) || + !now()->parse($date)->lt(now()->addDays(1)) + ) { + return; } $signatureData = HttpSignature::parseSignatureHeader($signature); $keyId = Helpers::validateUrl($signatureData['keyId']); @@ -91,10 +97,12 @@ class InboxValidator implements ShouldQueue && isset($bodyDecoded['object']['attributedTo']) ) { if(parse_url($bodyDecoded['object']['attributedTo'], PHP_URL_HOST) !== $keyDomain) { + return; abort(400, 'Invalid request'); } } if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) { + return; abort(400, 'Invalid request'); } $actor = Profile::whereKeyId($keyId)->first(); @@ -103,7 +111,7 @@ class InboxValidator implements ShouldQueue $actor = Helpers::profileFirstOrNew($actorUrl); } if(!$actor) { - return false; + return; } $pkey = openssl_pkey_get_public($actor->public_key); $inboxPath = "/users/{$profile->username}/inbox"; @@ -120,22 +128,24 @@ class InboxValidator implements ShouldQueue $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; if(!$signature) { - return false; + return; } if(!$date) { - return false; + return; } - if(!now()->parse($date)->gt(now()->subDays(1)) || !now()->parse($date)->lt(now()->addDays(1))) { - return false; + if(!now()->parse($date)->gt(now()->subDays(1)) || + !now()->parse($date)->lt(now()->addDays(1)) + ) { + return; } $signatureData = HttpSignature::parseSignatureHeader($signature); $keyId = Helpers::validateUrl($signatureData['keyId']); $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first(); if(!$actor) { - return false; + return; } if(Helpers::validateUrl($actor->remote_url) == false) { - return false; + return; } $res = Zttp::timeout(5)->withHeaders([ 'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', @@ -143,7 +153,7 @@ class InboxValidator implements ShouldQueue ])->get($actor->remote_url); $res = json_decode($res->body(), true, 8); if($res['publicKey']['id'] !== $actor->key_id) { - return false; + return; } $actor->public_key = $res['publicKey']['publicKeyPem']; $actor->save(); From 938e721e91e08f123a0ffb240101e05cda85d51c Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Thu, 21 May 2020 20:29:51 -0600 Subject: [PATCH 2/9] Update InboxValidator --- app/Jobs/InboxPipeline/InboxValidator.php | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/app/Jobs/InboxPipeline/InboxValidator.php b/app/Jobs/InboxPipeline/InboxValidator.php index fb2e24887..570bfe312 100644 --- a/app/Jobs/InboxPipeline/InboxValidator.php +++ b/app/Jobs/InboxPipeline/InboxValidator.php @@ -61,9 +61,11 @@ class InboxValidator implements ShouldQueue } if($this->verifySignature($headers, $profile, $payload) == true) { - InboxWorker::dispatchNow($headers, $profile, $payload)->onQueue('high'); + dispatch(new \App\Jobs\InboxPipeline\InboxWorker($headers, $profile, $payload)); + return; } else if($this->blindKeyRotation($headers, $profile, $payload) == true) { - InboxWorker::dispatchNow($headers, $profile, $payload)->onQueue('high'); + dispatch(new \App\Jobs\InboxPipeline\InboxWorker($headers, $profile, $payload)); + return; } else { return; } @@ -115,7 +117,7 @@ class InboxValidator implements ShouldQueue } $pkey = openssl_pkey_get_public($actor->public_key); $inboxPath = "/users/{$profile->username}/inbox"; - list($verified, $headers) = HTTPSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body); + list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body); if($verified == 1) { return true; } else { From 011e2c964c0e5876ffa4f19c9c31c60b7d3cf89f Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Thu, 21 May 2020 20:44:13 -0600 Subject: [PATCH 3/9] Update InboxValidator --- app/Jobs/InboxPipeline/InboxValidator.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/app/Jobs/InboxPipeline/InboxValidator.php b/app/Jobs/InboxPipeline/InboxValidator.php index 570bfe312..e38e0541b 100644 --- a/app/Jobs/InboxPipeline/InboxValidator.php +++ b/app/Jobs/InboxPipeline/InboxValidator.php @@ -23,6 +23,9 @@ class InboxValidator implements ShouldQueue protected $headers; protected $payload; + public $timeout = 5; + public $tries = 1; + /** * Create a new job instance. * @@ -61,11 +64,9 @@ class InboxValidator implements ShouldQueue } if($this->verifySignature($headers, $profile, $payload) == true) { - dispatch(new \App\Jobs\InboxPipeline\InboxWorker($headers, $profile, $payload)); - return; + (new Inbox($headers, $profile, $payload))->handle() } else if($this->blindKeyRotation($headers, $profile, $payload) == true) { - dispatch(new \App\Jobs\InboxPipeline\InboxWorker($headers, $profile, $payload)); - return; + (new Inbox($headers, $profile, $payload))->handle() } else { return; } From 2ab58fb723366a979fdb6efb338164f71636f69c Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Thu, 21 May 2020 20:58:31 -0600 Subject: [PATCH 4/9] Update InboxValidator, oof --- app/Jobs/InboxPipeline/InboxValidator.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/app/Jobs/InboxPipeline/InboxValidator.php b/app/Jobs/InboxPipeline/InboxValidator.php index e38e0541b..6b2e90010 100644 --- a/app/Jobs/InboxPipeline/InboxValidator.php +++ b/app/Jobs/InboxPipeline/InboxValidator.php @@ -64,9 +64,11 @@ class InboxValidator implements ShouldQueue } if($this->verifySignature($headers, $profile, $payload) == true) { - (new Inbox($headers, $profile, $payload))->handle() + (new Inbox($headers, $profile, $payload))->handle(); + return; } else if($this->blindKeyRotation($headers, $profile, $payload) == true) { - (new Inbox($headers, $profile, $payload))->handle() + (new Inbox($headers, $profile, $payload))->handle(); + return; } else { return; } From 29ce725c70cba679d621387fb1a278bd01967b9c Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Thu, 21 May 2020 21:02:16 -0600 Subject: [PATCH 5/9] Update FederationController, dispatch inbox jobs now on high queue --- app/Http/Controllers/FederationController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/Http/Controllers/FederationController.php b/app/Http/Controllers/FederationController.php index 43f363f1b..5c0111d83 100644 --- a/app/Http/Controllers/FederationController.php +++ b/app/Http/Controllers/FederationController.php @@ -102,7 +102,7 @@ class FederationController extends Controller $headers = $request->headers->all(); $payload = $request->getContent(); - InboxValidator::dispatch($username, $headers, $payload); + InboxValidator::dispatchNow($username, $headers, $payload)->onQueue('high'); // $profile = Profile::whereNull('domain')->whereUsername($username)->firstOrFail(); // if($profile->status != null) { // return ProfileController::accountCheck($profile); From 1f59d55d11519b66a16259b7fe2c0db720cf1ab5 Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Fri, 22 May 2020 15:42:15 -0600 Subject: [PATCH 6/9] Update ComposeModal, fixes #2198 --- resources/assets/js/components/ComposeModal.vue | 1 - 1 file changed, 1 deletion(-) diff --git a/resources/assets/js/components/ComposeModal.vue b/resources/assets/js/components/ComposeModal.vue index ab54a93df..9e893c9e0 100644 --- a/resources/assets/js/components/ComposeModal.vue +++ b/resources/assets/js/components/ComposeModal.vue @@ -616,7 +616,6 @@ export default { mediaWatcher() { let self = this; $(document).on('change', '#pf-dz', function(e) { - e.preventDefault(); self.mediaUpload(); }); }, From fe4d880f2cc7f0a7a63a2e9ff715ff545098b4f7 Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Fri, 22 May 2020 15:48:50 -0600 Subject: [PATCH 7/9] Update compiled assets --- public/js/compose.js | Bin 99288 -> 99261 bytes public/mix-manifest.json | Bin 1939 -> 1939 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/public/js/compose.js b/public/js/compose.js index 3aa5534a425471f652a7dbf2d088538a9c3a6dbd..c33ef84110f3f81707cbf1a8e1083eeb9f080ec4 100644 GIT binary patch delta 912 zcmYL{Uq}>D6vml#UA9(N!qT*@wXyWB&d%zRNXjIpB8w9)YJZ?Kt~=LtaCT;0XEzNq zNlAi?miwTu(L+H+3-cgFQV<07(t}iMrl>(7_)tAn57C*G+K2hL-#Nc?4rlI7&)61c zY^gDaakb!Xp^dG>;xU$f<4UdV?LDXI#)%sSTRv~exMWiuH5_GjTwha9juSs!ar9(O zeco`^r1BD3!{=Yg8Y4fDHCAVT)~HUQ;9u+BhCwYsVpMaM(T~oyEL2%=)*7fi*+x6d ztBtLr=WKMFdtfYizXTbPKAk|8pg`}O*=ziqc+4=OaewlH1roVa0%*(BYtYoRi+ZN7 zLozjOw?p8`O+V;%M%}YMICsu+kRG4yW9&hMJzPu(8k@IzX)%_2V_D@wOMrVyc@+i_haq@xmK0g=m`5{QXv={*s!U{nW7dJUMg2SXcqG|e|tcKfE+^-Nx7zJ3NC50j{ z#qgzo$?!NDRmPA==V=qHlBV~NQ$)m5QBiwX5XktrXv{vVErwm6FYN>1-I66|7XbVy zAfmDU-VT3{Zhd$O`Y7E2`YZhk^u;pN80lq84w#is?V#nW4WNCix?4ngrXH!hLI!jJ zTveriFsmb+`>fUsoBI37Jhz zYNsP$nE-HqHq1?mHtT>EH^aFuQ5f)zGHjKTp^u9TXtdapyq+qSlO(I;qS~7|V^kNc4|FOi8BW!=I!OcF;&Kxc(t7JXy2(A) zU-ma+x@OO}Msc_R3ld^A9c!+7;k6vXAF6hOD z1(*7CETl7uLL2WVN<()*A-xJ>onF??xoE}2b;d=IyB;B4gXMx6pWrDn1kCrMJH|d35 z2oC)+nS=&#dc*iu<4x=*JPros7!qj*Jq?3T(`P74M8sZFQdKAjq_0m@Ti;fh%_34D zha_GmK1EPCEEHBkY4zcfE+ridd@o#!>dYqtygT~h^LxP1aueYE@`odP?!;J^_W7s3 z=u$xRXyrWM#>z=Rc2xn4ujb`}jgM(<1H9556o8b4%dr+~Pqnyeg^9OU*BOf@)CSYE zWOu}!1n9QDnW3Ix4L*-ryB1)o_p9-LYAB?YhdPNq&~vxj*YC%`pZ&vsz#>w;R9Y1DRd{d5UuQ5! zOJNx69@cc&Xvi` V8x!k3chJfVdiVa7`28UU{RO;xJ~#jX diff --git a/public/mix-manifest.json b/public/mix-manifest.json index a77b623bd48108a2a394417bd51aae654dc8acd4..c32b868dfd61d34ed956ca3024debbf616d0e623 100644 GIT binary patch delta 33 ocmbQtKbe1nGqZ?EQlgnfvZZ-aN>WNnvaxZJg^B6raAq480I5d_kN^Mx delta 33 ocmbQtKbe1nGqZ@LiGf9;p^>>sQi_3@g{7%kvZcl5aAq480G2)od;kCd From 0309f8a4e13377afe92ebbc9deba89d97141a97d Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Fri, 22 May 2020 15:52:49 -0600 Subject: [PATCH 8/9] Update FederationController, remove old code --- app/Http/Controllers/FederationController.php | 98 ------------------- 1 file changed, 98 deletions(-) diff --git a/app/Http/Controllers/FederationController.php b/app/Http/Controllers/FederationController.php index 5c0111d83..e6f06fbc6 100644 --- a/app/Http/Controllers/FederationController.php +++ b/app/Http/Controllers/FederationController.php @@ -103,107 +103,9 @@ class FederationController extends Controller $headers = $request->headers->all(); $payload = $request->getContent(); InboxValidator::dispatchNow($username, $headers, $payload)->onQueue('high'); - // $profile = Profile::whereNull('domain')->whereUsername($username)->firstOrFail(); - // if($profile->status != null) { - // return ProfileController::accountCheck($profile); - // } - // $body = $request->getContent(); - // $bodyDecoded = json_decode($body, true, 12); - // if($this->verifySignature($request, $profile) == true) { - // InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded); - // } else if($this->blindKeyRotation($request, $profile) == true) { - // InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded); - // } else { - // abort(400, 'Bad Signature'); - // } return; } - - protected function verifySignature(Request $request, Profile $profile) - { - $body = $request->getContent(); - $bodyDecoded = json_decode($body, true, 8); - $signature = $request->header('signature'); - $date = $request->header('date'); - $digest = $request->header('digest'); - if(!$digest) { - abort(400, 'Missing digest header'); - } - if(!$signature) { - abort(400, 'Missing signature header'); - } - if(!$date) { - abort(400, 'Missing date header'); - } - if(!now()->parse($date)->gt(now()->subDays(1)) || !now()->parse($date)->lt(now()->addDays(1))) { - abort(400, 'Invalid date'); - } - $signatureData = HttpSignature::parseSignatureHeader($signature); - $keyId = Helpers::validateUrl($signatureData['keyId']); - $id = Helpers::validateUrl($bodyDecoded['id']); - $keyDomain = parse_url($keyId, PHP_URL_HOST); - $idDomain = parse_url($id, PHP_URL_HOST); - if($keyDomain == config('pixelfed.domain.app') || $idDomain == config('pixelfed.domain.app')) { - return false; - } - if(isset($bodyDecoded['object']) - && is_array($bodyDecoded['object']) - && isset($bodyDecoded['object']['attributedTo']) - ) { - if(parse_url($bodyDecoded['object']['attributedTo'], PHP_URL_HOST) !== $keyDomain) { - abort(400, 'Invalid request'); - } - } - if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) { - abort(400, 'Invalid request'); - } - $actor = Profile::whereKeyId($keyId)->first(); - if(!$actor) { - $actor = Helpers::profileFirstOrNew($bodyDecoded['actor']); - } - if(!$actor) { - return false; - } - $pkey = openssl_pkey_get_public($actor->public_key); - $inboxPath = "/users/{$profile->username}/inbox"; - list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $request->headers->all(), $inboxPath, $body); - if($verified == 1) { - return true; - } else { - return false; - } - } - - protected function blindKeyRotation(Request $request, Profile $profile) - { - $signature = $request->header('signature'); - $date = $request->header('date'); - if(!$signature) { - abort(400, 'Missing signature header'); - } - if(!$date) { - abort(400, 'Missing date header'); - } - if(!now()->parse($date)->gt(now()->subDays(1)) || !now()->parse($date)->lt(now()->addDays(1))) { - abort(400, 'Invalid date'); - } - $signatureData = HttpSignature::parseSignatureHeader($signature); - $keyId = Helpers::validateUrl($signatureData['keyId']); - $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->firstOrFail(); - $res = Zttp::timeout(5)->withHeaders([ - 'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', - 'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org', - ])->get($actor->remote_url); - $res = json_decode($res->body(), true, 8); - if($res['publicKey']['id'] !== $actor->key_id) { - return false; - } - $actor->public_key = $res['publicKey']['publicKeyPem']; - $actor->save(); - return $this->verifySignature($request, $profile); - } - public function userFollowing(Request $request, $username) { abort_if(!config('federation.activitypub.enabled'), 404); From 64768555198abc229305fa5f4d5ef3a6ad9a8fbb Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Fri, 22 May 2020 15:53:59 -0600 Subject: [PATCH 9/9] Update jobs, add retry and timeout attributes --- app/Jobs/CommentPipeline/CommentPipeline.php | 3 +++ app/Jobs/LikePipeline/LikePipeline.php | 3 +++ app/Jobs/StatusPipeline/NewStatusPipeline.php | 3 +++ app/Jobs/StatusPipeline/StatusEntityLexer.php | 9 ++++++++- 4 files changed, 17 insertions(+), 1 deletion(-) diff --git a/app/Jobs/CommentPipeline/CommentPipeline.php b/app/Jobs/CommentPipeline/CommentPipeline.php index b1cd5df38..0ca74e78b 100644 --- a/app/Jobs/CommentPipeline/CommentPipeline.php +++ b/app/Jobs/CommentPipeline/CommentPipeline.php @@ -30,6 +30,9 @@ class CommentPipeline implements ShouldQueue * @var bool */ public $deleteWhenMissingModels = true; + + public $timeout = 5; + public $tries = 1; /** * Create a new job instance. diff --git a/app/Jobs/LikePipeline/LikePipeline.php b/app/Jobs/LikePipeline/LikePipeline.php index 593b4c4bc..3e4d28506 100644 --- a/app/Jobs/LikePipeline/LikePipeline.php +++ b/app/Jobs/LikePipeline/LikePipeline.php @@ -28,6 +28,9 @@ class LikePipeline implements ShouldQueue */ public $deleteWhenMissingModels = true; + public $timeout = 5; + public $tries = 1; + /** * Create a new job instance. * diff --git a/app/Jobs/StatusPipeline/NewStatusPipeline.php b/app/Jobs/StatusPipeline/NewStatusPipeline.php index e2f2a4c69..8ccb2926f 100644 --- a/app/Jobs/StatusPipeline/NewStatusPipeline.php +++ b/app/Jobs/StatusPipeline/NewStatusPipeline.php @@ -23,6 +23,9 @@ class NewStatusPipeline implements ShouldQueue * @var bool */ public $deleteWhenMissingModels = true; + + public $timeout = 5; + public $tries = 1; /** * Create a new job instance. diff --git a/app/Jobs/StatusPipeline/StatusEntityLexer.php b/app/Jobs/StatusPipeline/StatusEntityLexer.php index 197477672..82ef38890 100644 --- a/app/Jobs/StatusPipeline/StatusEntityLexer.php +++ b/app/Jobs/StatusPipeline/StatusEntityLexer.php @@ -8,6 +8,7 @@ use App\Mention; use App\Profile; use App\Status; use App\StatusHashtag; +use App\Services\PublicTimelineService; use App\Util\Lexer\Autolink; use App\Util\Lexer\Extractor; use DB; @@ -136,7 +137,13 @@ class StatusEntityLexer implements ShouldQueue public function deliver() { - if(config('federation.activitypub.enabled') == true) { + $status = $this->status; + + if($status->uri == null && $status->scope == 'public') { + PublicTimelineService::add($status->id); + } + + if(config('federation.activitypub.enabled') == true && config('app.env') == 'production') { StatusActivityPubDeliver::dispatch($this->status); } }