Tupambae_Org/friendica_2021-01
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

AP: Security check against forged "create" activities

Browse source
This commit is contained in:
Michael 2018-11-20 20:40:47 +00:00
parent a76c00de66
commit 5c39779b45
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/Protocol/ActivityPub/Receiver.php
View file

@ -309,6 +309,16 @@ class Receiver
} }
// Don't trust the source if "actor" differs from "attributedTo". The content could be forged.
if ($trust_source && ($type == 'as:Create') && is_array($activity['as:object'])) {
$actor = JsonLD::fetchElement($activity, 'as:actor');
$attributed_to = JsonLD::fetchElement($activity['as:object'], 'as:attributedTo');
$trust_source = ($actor == $attributed_to);
if (!$trust_source) {
Logger::log('Not trusting actor: ' . $actor . '. It differs from attributedTo: ' . $attributed_to, Logger::DEBUG);
}
}
// $trust_source is called by reference and is set to true if the content was retrieved successfully // $trust_source is called by reference and is set to true if the content was retrieved successfully
$object_data = self::prepareObjectData($activity, $uid, $trust_source); $object_data = self::prepareObjectData($activity, $uid, $trust_source);
if (empty($object_data)) { if (empty($object_data)) {