ForgeFlux/activitypub-federation-rust
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prevent overwriting local object (#130)

Browse source 
* Throw error when attempting to http fetch local object

* clippy
This commit is contained in:
Nutomic 2024-11-12 13:20:02 +01:00 committed by GitHub
parent 6814ff1932
commit 1c29f4e66b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/fetch/object_id.rs
View file

@ -92,7 +92,7 @@ where
// object found in database // object found in database
if let Some(object) = db_object { if let Some(object) = db_object {
if let Some(last_refreshed_at) = object.last_refreshed_at() { if let Some(last_refreshed_at) = object.last_refreshed_at() {
let is_local = data.config.is_local_url(&self.0); let is_local = self.is_local(data);
if !is_local && should_refetch_object(last_refreshed_at) { if !is_local && should_refetch_object(last_refreshed_at) {
// object is outdated and should be refetched // object is outdated and should be refetched
return self.dereference_from_http(data, Some(object)).await; return self.dereference_from_http(data, Some(object)).await;
@ -175,6 +175,14 @@ where
let res = res?; let res = res?;
let redirect_url = &res.url; let redirect_url = &res.url;
// Prevent overwriting local object
if data.config.is_local_url(redirect_url) {
return self
.dereference_from_db(data)
.await?
.ok_or(Error::NotFound.into());
}
Box::pin(Kind::verify(&res.object, redirect_url, data)).await?; Box::pin(Kind::verify(&res.object, redirect_url, data)).await?;
Box::pin(Kind::from_json(res.object, data)).await Box::pin(Kind::from_json(res.object, data)).await
} }