friendica
/
friendica
mirror of https://github.com/friendica/friendica
6
0
Fork 1
Code Issues Packages Projects Releases 1 Wiki Activity

Merge pull request #14018 from annando/content-type-check 

Improved Content-Type check on incoming requests
This commit is contained in:
Hypolite Petovan 2024-03-21 11:58:08 +00:00 committed by GitHub
parent f60638787e 11a16589da
commit f26f35f009
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 36 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/Module/ActivityPub/Inbox.php
View File

@ -77,6 +77,11 @@ class Inbox extends BaseApi
throw new \Friendica\Network\HTTPException\BadRequestException();
}
if (!HTTPSignature::isValidContentType($this->server['CONTENT_TYPE'] ?? '')) {
Logger::notice('Unexpected content type', ['content-type' => $this->server['CONTENT_TYPE'] ?? '', 'agent' => $this->server['HTTP_USER_AGENT'] ?? '']);
throw new \Friendica\Network\HTTPException\UnsupportedMediaTypeException();
}
if (DI::config()->get('debug', 'ap_inbox_log')) {
if (HTTPSignature::getSigner($postdata, $_SERVER)) {
$filename = 'signed-activitypub';

15
src/Protocol/ActivityPub.php
View File

@ -95,16 +95,17 @@ class ActivityPub
public static function isRequest(): bool
{
header('Vary: Accept', false);
$isrequest = stristr($_SERVER['HTTP_ACCEPT'] ?? '', 'application/activity+json') ||
stristr($_SERVER['HTTP_ACCEPT'] ?? '', 'application/json') ||
stristr($_SERVER['HTTP_ACCEPT'] ?? '', 'application/ld+json');
if ($isrequest) {
if (stristr($_SERVER['HTTP_ACCEPT'] ?? '', 'application/activity+json') || stristr($_SERVER['HTTP_ACCEPT'] ?? '', 'application/ld+json')) {
Logger::debug('Is AP request', ['accept' => $_SERVER['HTTP_ACCEPT'], 'agent' => $_SERVER['HTTP_USER_AGENT'] ?? '']);
return true;
}
return $isrequest;
if (stristr($_SERVER['HTTP_ACCEPT'] ?? '', 'application/json')) {
Logger::debug('Is JSON request', ['accept' => $_SERVER['HTTP_ACCEPT'], 'agent' => $_SERVER['HTTP_USER_AGENT'] ?? '']);
return true;
}
return false;
}
private static function getAccountType(array $apcontact): int