mirrors/misskey
1
0
Fork 1
mirror of https://github.com/misskey-dev/misskey.git synced 2026-07-28 14:14:40 +02:00
Code Releases Activity

Merge commit from fork

Browse Source 
* fix: Prevent timing attacks and RDF-graph rewrites

* fix: Proper vuln fix, not a bandaid

* fix: Accidental removal

* fix: Explicitly check for null

* fix: Address issues

* clean up

* lint fixes

* fix: reset pnpm-lock.yaml to current develop

---------

Co-authored-by: kakkokari-gtyih <67428053+kakkokari-gtyih@users.noreply.github.com>
This commit is contained in:
Julia Johannesen
2026-05-20 09:02:25 -04:00
committed by GitHub
parent 408e94f41f
commit 6c40c96369
2 changed files with 108 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
packages/backend/src/queue/processors/InboxProcessorService.ts
View File

@@ -21,7 +21,7 @@ import { ApDbResolverService } from '@/core/activitypub/ApDbResolverService.js';
import { StatusError } from '@/misc/status-error.js';
import { UtilityService } from '@/core/UtilityService.js';
import { ApPersonService } from '@/core/activitypub/models/ApPersonService.js';
import { JsonLdService } from '@/core/activitypub/JsonLdService.js';
import { JsonLdError, JsonLdService } from '@/core/activitypub/JsonLdService.js';
import { ApInboxService } from '@/core/activitypub/ApInboxService.js';
import { bindThis } from '@/decorators.js';
import { IdentifiableError } from '@/misc/identifiable-error.js';
@@ -163,22 +163,17 @@ export class InboxProcessorService implements OnApplicationShutdown {
const jsonLd = this.jsonLdService.use();
// LD-Signature検証
const verified = await jsonLd.verifyRsaSignature2017(activity, authUser.key.keyPem).catch(() => false);
if (!verified) {
throw new Bull.UnrecoverableError('skip: LD-Signatureの検証に失敗しました');
}
// アクティビティを正規化
delete activity.signature;
try {
activity = await jsonLd.compact(activity) as IActivity;
} catch (e) {
throw new Bull.UnrecoverableError(`skip: failed to compact activity: ${e}`);
} catch (error) {
throw new Bull.UnrecoverableError(`skip: failed to compact activity: ${error}`);
}
try {
jsonLd.checkForForbiddenDirectives(activity);
} catch (error) {
throw new Bull.UnrecoverableError(`skip: ${error}`);
}
// TODO: 元のアクティビティと非互換な形に正規化される場合は転送をスキップする
// https://github.com/mastodon/mastodon/blob/664b0ca/app/services/activitypub/process_collection_service.rb#L24-L29
activity.signature = ldSignature;
//#region Log
const compactedInfo = Object.assign({}, activity);
@@ -186,6 +181,25 @@ export class InboxProcessorService implements OnApplicationShutdown {
this.logger.debug(`compacted: ${JSON.stringify(compactedInfo, null, 2)}`);
//#endregion
activity.signature = ldSignature;
jsonLd.freeze();
// LD-Signature検証
let verified;
try {
verified = await jsonLd.verifyRsaSignature2017(activity, authUser.key.keyPem);
if (!verified) {
throw new Bull.UnrecoverableError('skip: LD-Signatureの検証に失敗しました');
}
} catch (error) {
if (error instanceof JsonLdError) {
throw new Bull.UnrecoverableError(`skip: encountered a JSON-LD error while verifying signature: ${error}`);
} else {
throw error;
}
}
// もう一度actorチェック
if (authUser.user.uri !== getApId(activity.actor)) {
throw new Bull.UnrecoverableError(`skip: LD-Signature user(${authUser.user.uri}) !== activity.actor(${getApId(activity.actor)})`);