From: Felix Ableitner <me@nutomic.com>
Date: Tue, 13 Oct 2020 16:06:26 +0000 (+0200)
Subject: Add domain checks for private message inbox
X-Git-Url: http://these/git/%24%7BgetStaticDir%28%29%7D/styles/%7B%60/feeds/c/%24%7Bthis.state.communityName%7D.xml?a=commitdiff_plain;h=3f9ede79edadfc80e732da4b80e71700a7c7509a;p=lemmy.git

Add domain checks for private message inbox
---

diff --git a/lemmy_apub/src/inbox/user_inbox.rs b/lemmy_apub/src/inbox/user_inbox.rs
index 77917850..7bc36a0f 100644
--- a/lemmy_apub/src/inbox/user_inbox.rs
+++ b/lemmy_apub/src/inbox/user_inbox.rs
@@ -8,6 +8,7 @@ use crate::{
 use activitystreams::{
   activity::{Accept, ActorAndObject, Create, Delete, Undo, Update},
   base::AnyBase,
+  error::DomainError,
   object::Note,
   prelude::*,
 };
@@ -130,7 +131,17 @@ async fn receive_create_private_message(
   )?
   .context(location_info!())?;
 
-  let domain = Some(create.id_unchecked().context(location_info!())?.to_owned());
+  let actor = create
+    .actor()?
+    .to_owned()
+    .single_xsd_any_uri()
+    .context(location_info!())?;
+  let domain = Some(
+    create
+      .id(actor.domain().context(location_info!())?)?
+      .context(location_info!())?
+      .to_owned(),
+  );
   let private_message = PrivateMessageForm::from_apub(&note, context, domain).await?;
 
   let inserted_private_message = blocking(&context.pool(), move |conn| {
@@ -171,7 +182,17 @@ async fn receive_update_private_message(
   )?
   .context(location_info!())?;
 
-  let domain = Some(update.id_unchecked().context(location_info!())?.to_owned());
+  let actor = update
+    .actor()?
+    .to_owned()
+    .single_xsd_any_uri()
+    .context(location_info!())?;
+  let domain = Some(
+    update
+      .id(actor.domain().context(location_info!())?)?
+      .context(location_info!())?
+      .to_owned(),
+  );
   let private_message_form = PrivateMessageForm::from_apub(&note, context, domain).await?;
 
   let private_message_ap_id = private_message_form
@@ -220,6 +241,18 @@ async fn receive_delete_private_message(
     .to_owned()
     .single_xsd_any_uri()
     .context(location_info!())?;
+  let actor = delete
+    .actor()?
+    .to_owned()
+    .single_xsd_any_uri()
+    .context(location_info!())?;
+  let delete_id = delete
+    .id(actor.domain().context(location_info!())?)?
+    .map(|i| i.domain())
+    .flatten();
+  if private_message_id.domain() != delete_id {
+    return Err(DomainError.into());
+  }
   let private_message = blocking(context.pool(), move |conn| {
     PrivateMessage::read_from_apub_id(conn, private_message_id.as_str())
   })
@@ -258,6 +291,19 @@ async fn receive_undo_delete_private_message(
     .to_owned()
     .single_xsd_any_uri()
     .context(location_info!())?;
+  let actor = undo
+    .actor()?
+    .to_owned()
+    .single_xsd_any_uri()
+    .context(location_info!())?;
+  let undo_id = undo
+    .id(actor.domain().context(location_info!())?)?
+    .map(|i| i.domain())
+    .flatten();
+  if private_message_id.domain() != undo_id {
+    return Err(DomainError.into());
+  }
+
   let private_message = blocking(context.pool(), move |conn| {
     PrivateMessage::read_from_apub_id(conn, private_message_id.as_str())
   })