Merge pull request #2651 from pixelfed/staging

Staging

CHANGELOG.md

@@ -41,6 +41,8 @@
 - Updated Hashtag component, fix null infinite loading bug. Fixes #2637. ([55136518](https://github.com/pixelfed/pixelfed/commit/55136518))
 - Updated filesystems config, add backup driver to store backups on other filesystems. ([ae90eef9](https://github.com/pixelfed/pixelfed/commit/ae90eef9))
 - Updated Embeds. Fix Profile + Status embeds, remove following count and improve cache invalidation and hidden follower counts. ([5ac9d0e8](https://github.com/pixelfed/pixelfed/commit/5ac9d0e8))
+- Updated FederationController, return 404 for invalid webfinger addresses. Fixes ([#2647](https://github.com/pixelfed/pixelfed/issues/2647)). ([deb6f115](https://github.com/pixelfed/pixelfed/commit/deb6f115))
+- Updated InboxPipeline, fail earlier for invalid public keys. Fixes ([#2648](https://github.com/pixelfed/pixelfed/issues/2648)). ([d1c5e9b8](https://github.com/pixelfed/pixelfed/commit/d1c5e9b8))
 -  ([](https://github.com/pixelfed/pixelfed/commit/))
 
 ## [v0.10.10 (2021-01-28)](https://github.com/pixelfed/pixelfed/compare/v0.10.9...v0.10.10)

app/Http/Controllers/FederationController.php

@@ -53,8 +53,8 @@ class FederationController extends Controller
 
         $resource = $request->input('resource');
         $parsed = Nickname::normalizeProfileUrl($resource);
-        if($parsed['domain'] !== config('pixelfed.domain.app')) {
+        if(empty($parsed) || $parsed['domain'] !== config('pixelfed.domain.app')) {
-            abort(400);
+            abort(404);
         }
         $username = $parsed['username'];
         $profile = Profile::whereNull('domain')->whereUsername($username)->firstOrFail();

app/Jobs/InboxPipeline/InboxValidator.php

@@ -173,6 +173,9 @@ class InboxValidator implements ShouldQueue
             return;
         }
         $pkey = openssl_pkey_get_public($actor->public_key);
+        if(!$pkey) {
+            return 0;
+        }
         $inboxPath = "/users/{$profile->username}/inbox";
         list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body);
         if($verified == 1) { 

app/Jobs/InboxPipeline/InboxWorker.php

@@ -161,6 +161,9 @@ class InboxWorker implements ShouldQueue
             return;
         }
         $pkey = openssl_pkey_get_public($actor->public_key);
+        if(!$pkey) {
+            return 0;
+        }
         $inboxPath = "/f/inbox";
         list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body);
         if($verified == 1) { 

tests/Feature/InstalledTest.php

@@ -8,6 +8,7 @@ use Illuminate\Foundation\Testing\WithoutMiddleware;
 
 class InstalledTest extends TestCase
 {
+
 	/** @test */
 	public function nodeinfo_api()
 	{

tests/Feature/LoginTest.php

@@ -9,7 +9,6 @@ use App\User;
 
 class LoginTest extends TestCase
 {
-
 	/** @test */
 	public function view_login_page()
 	{

tests/Unit/DateTimeTest.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Tests\Unit;
+
+use Carbon\Carbon;
+use Tests\TestCase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+class DateTimeTest extends TestCase
+{
+	/** @test */
+	public function mastodonTimestamp()
+	{
+		$ts = Carbon::createFromFormat(\DateTime::ISO8601, '2019-09-16T02:41:57Z');
+		$this->assertEquals(9, $ts->month);
+		$this->assertEquals(16, $ts->day);
+		$this->assertEquals(2019, $ts->year);
+		$this->assertEquals(2, $ts->hour);
+		$this->assertEquals(41, $ts->minute);
+	}
+
+	/** @test */
+	public function p3kTimestamp()
+	{
+		$ts = Carbon::createFromFormat(\DateTime::ISO8601, '2019-09-16T08:40:55+10:00');
+		$this->assertEquals(9, $ts->month);
+		$this->assertEquals(16, $ts->day);
+		$this->assertEquals(2019, $ts->year);
+		$this->assertEquals(8, $ts->hour);
+		$this->assertEquals(40, $ts->minute);
+	}
+}

tests/Unit/Lexer/RestrictedNameTest.php

@@ -12,9 +12,10 @@ class RestrictedNameTest extends TestCase
 	/** @test */
 	public function restrictedUsername()
 	{
-        $this->assertContains('p', RestrictedNames::get());
+		$names = RestrictedNames::get();
-        $this->assertContains('admin', RestrictedNames::get());
+		$this->assertContains('p', $names);
-        $this->assertNotContains('dansup', RestrictedNames::get());
+		$this->assertContains('admin', $names);
-        $this->assertNotContains('lain', RestrictedNames::get());
+		$this->assertNotContains('dansup', $names);
+		$this->assertNotContains('earth', $names);
 	}
 }

tests/Unit/SnowflakeTest.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Tests\Unit;
+
+use Tests\TestCase;
+use App\Services\SnowflakeService;
+
+class Snowflake extends TestCase
+{
+    /** @test */
+    public function snowflakeTest()
+    {
+    	$expected = 266077397319815168;
+    	$actual = SnowflakeService::byDate(now()->parse('2021-02-13T05:36:35+00:00'));
+    	$this->assertEquals($expected, $actual);
+    }
+}

tests/Unit/WebfingerTest.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace Tests\Unit;
+
+use Tests\TestCase;
+use App\Util\Lexer\Nickname;
+
+class WebfingerTest extends TestCase
+{
+	/** @test */
+	public function webfingerTest()
+	{
+		$expected = [
+			"domain" => "pixelfed.org",
+			"username" => "dansup",
+		];
+		$actual = Nickname::normalizeProfileUrl('acct:dansup@pixelfed.org');
+		$this->assertEquals($expected, $actual);
+
+		$expected = [
+			"domain" => "pixelfed.org",
+			"username" => "dansup_",
+		];
+		$actual = Nickname::normalizeProfileUrl('acct:dansup@pixelfed.org');
+		$this->assertNotEquals($expected, $actual);
+
+		$expected = [
+			"domain" => "pixelfed.org",
+			"username" => "dansup",
+		];
+		$actual = Nickname::normalizeProfileUrl('acct:@dansup@pixelfed.org');
+		$this->assertEquals($expected, $actual);
+
+		$expected = [
+			"domain" => "pixelfed.org",
+			"username" => "dansup",
+		];
+		$actual = Nickname::normalizeProfileUrl('dansup@pixelfed.org');
+		$this->assertEquals($expected, $actual);
+
+		$expected = [
+			"domain" => "pixelfed.org",
+			"username" => "dansup",
+		];
+		$actual = Nickname::normalizeProfileUrl('@dansup@pixelfed.org');
+		$this->assertEquals($expected, $actual);
+	}
+}