limepotato/jormungandr-bite
1
0
Fork 0
mirror of https://iceshrimp.dev/limepotato/jormungandr-bite.git synced 2024-11-25 19:37:34 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Discard notes made before Fedi's existence, or after today (#9605)

Browse source 
This PR should kill #9531 - Safeguarding against posts that are made before 2007 (Identica being made in 2008, the 'first ever activitypub software' according to wikipedia.)

Personally, if gone unnoticed, I believe that notes from the past can be used as an attack vector to silently flood a database.

Co-authored-by: Kio-td <kio.thedev@gmail.com>
Reviewed-on: https://codeberg.org/calckey/calckey/pulls/9605
Co-authored-by: daikei <daikei@noreply.codeberg.org>
Co-committed-by: daikei <daikei@noreply.codeberg.org>
This commit is contained in:
daikei 2023-02-11 21:05:31 +00:00 committed by Kainoa Kanter
parent 1e7f8c3ab8
commit 13af804543
1 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
packages/backend/src/remote/activitypub/models/note.ts
View file

@ -125,6 +125,23 @@ export async function createNote(
logger.info(`Creating the Note: ${note.id}`); logger.info(`Creating the Note: ${note.id}`);
// Skip if note is made before 2007 (1yr before Fedi was created)
// OR skip if note is made 3 days in advance
if (note.published) {
const DateChecker = new Date(note.published)
const FutureCheck = new Date()
FutureCheck.setDate(FutureCheck.getDate() + 3) // Allow some wiggle room for misconfigured hosts
if (DateChecker.getFullYear() < 2007) {
logger.warn('Note somehow made before Activitypub was created; discarding');
return null;
}
if (DateChecker > FutureCheck) {
logger.warn('Note somehow made after today; discarding')
return null;
}
}
// Fetch author // Fetch author
const actor = (await resolvePerson( const actor = (await resolvePerson(
getOneApId(note.attributedTo), getOneApId(note.attributedTo),