]> Untitled Git - lemmy.git/blobdiff - crates/apub/src/objects/person.rs
Sanitize html (#3708)
[lemmy.git] / crates / apub / src / objects / person.rs
index 662871dc14ea0a59672ab6a89e37ee3ea5cbdbfa..2c238fb56c309d4c23accaa81633e06f4190fae6 100644 (file)
 use crate::{
-  extensions::{context::lemmy_context, person_extension::PersonExtension},
-  objects::{
-    check_object_domain,
-    get_source_markdown_value,
-    set_content_and_source,
-    FromApub,
-    FromApubToForm,
-    ToApub,
+  check_apub_id_valid_with_strictness,
+  local_site_data_cached,
+  objects::{instance::fetch_instance_actor_for_object, read_from_string_or_source_opt},
+  protocol::{
+    objects::{
+      person::{Person, UserTypes},
+      Endpoints,
+    },
+    ImageObject,
+    Source,
   },
-  ActorType,
-  PersonExt,
 };
-use activitystreams::{
-  actor::{ApActor, Endpoints, Person},
-  object::{ApObject, Image, Tombstone},
-  prelude::*,
+use activitypub_federation::{
+  config::Data,
+  protocol::verification::verify_domains_match,
+  traits::{Actor, Object},
+};
+use chrono::NaiveDateTime;
+use lemmy_api_common::{
+  context::LemmyContext,
+  utils::{generate_outbox_url, local_site_opt_to_slur_regex, sanitize_html, sanitize_html_opt},
 };
-use activitystreams_ext::Ext2;
-use anyhow::Context;
-use lemmy_api_structs::blocking;
-use lemmy_db_queries::{ApubObject, DbPool};
 use lemmy_db_schema::{
-  naive_now,
-  source::person::{Person as DbPerson, PersonForm},
+  source::person::{Person as DbPerson, PersonInsertForm, PersonUpdateForm},
+  traits::{ApubActor, Crud},
+  utils::naive_now,
 };
 use lemmy_utils::{
-  location_info,
-  settings::structs::Settings,
-  utils::{check_slurs, check_slurs_opt, convert_datetime},
-  LemmyError,
+  error::LemmyError,
+  utils::{
+    markdown::markdown_to_html,
+    slurs::{check_slurs, check_slurs_opt},
+    time::convert_datetime,
+  },
 };
-use lemmy_websocket::LemmyContext;
+use std::ops::Deref;
 use url::Url;
 
-#[async_trait::async_trait(?Send)]
-impl ToApub for DbPerson {
-  type ApubType = PersonExt;
-
-  async fn to_apub(&self, _pool: &DbPool) -> Result<PersonExt, LemmyError> {
-    let mut person = ApObject::new(Person::new());
-    person
-      .set_many_contexts(lemmy_context()?)
-      .set_id(self.actor_id.to_owned().into_inner())
-      .set_published(convert_datetime(self.published));
-
-    if let Some(u) = self.updated {
-      person.set_updated(convert_datetime(u));
-    }
-
-    if let Some(avatar_url) = &self.avatar {
-      let mut image = Image::new();
-      image.set_url::<Url>(avatar_url.to_owned().into());
-      person.set_icon(image.into_any_base()?);
-    }
-
-    if let Some(banner_url) = &self.banner {
-      let mut image = Image::new();
-      image.set_url::<Url>(banner_url.to_owned().into());
-      person.set_image(image.into_any_base()?);
-    }
-
-    if let Some(bio) = &self.bio {
-      set_content_and_source(&mut person, bio)?;
-    }
-
-    if let Some(i) = self.preferred_username.to_owned() {
-      person.set_name(i);
-    }
-
-    let mut ap_actor = ApActor::new(self.inbox_url.clone().into(), person);
-    ap_actor
-      .set_preferred_username(self.name.to_owned())
-      .set_outbox(self.get_outbox_url()?)
-      .set_endpoints(Endpoints {
-        shared_inbox: Some(self.get_shared_inbox_or_inbox_url()),
-        ..Default::default()
-      });
-
-    let person_ext = PersonExtension::new(self.matrix_user_id.to_owned())?;
-    Ok(Ext2::new(ap_actor, person_ext, self.get_public_key_ext()?))
-  }
-  fn to_tombstone(&self) -> Result<Tombstone, LemmyError> {
-    unimplemented!()
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ApubPerson(pub(crate) DbPerson);
+
+impl Deref for ApubPerson {
+  type Target = DbPerson;
+  fn deref(&self) -> &Self::Target {
+    &self.0
   }
 }
 
-#[async_trait::async_trait(?Send)]
-impl FromApub for DbPerson {
-  type ApubType = PersonExt;
-
-  async fn from_apub(
-    person: &PersonExt,
-    context: &LemmyContext,
-    expected_domain: Url,
-    request_counter: &mut i32,
-    mod_action_allowed: bool,
-  ) -> Result<DbPerson, LemmyError> {
-    let person_id = person.id_unchecked().context(location_info!())?.to_owned();
-    let domain = person_id.domain().context(location_info!())?;
-    if domain == Settings::get().hostname() {
-      let person = blocking(context.pool(), move |conn| {
-        DbPerson::read_from_apub_id(conn, &person_id.into())
-      })
-      .await??;
-      Ok(person)
-    } else {
-      let person_form = PersonForm::from_apub(
-        person,
-        context,
-        expected_domain,
-        request_counter,
-        mod_action_allowed,
-      )
-      .await?;
-      let person = blocking(context.pool(), move |conn| {
-        DbPerson::upsert(conn, &person_form)
-      })
-      .await??;
-      Ok(person)
-    }
+impl From<DbPerson> for ApubPerson {
+  fn from(p: DbPerson) -> Self {
+    ApubPerson(p)
   }
 }
 
-#[async_trait::async_trait(?Send)]
-impl FromApubToForm<PersonExt> for PersonForm {
-  async fn from_apub(
-    person: &PersonExt,
-    _context: &LemmyContext,
-    expected_domain: Url,
-    _request_counter: &mut i32,
-    _mod_action_allowed: bool,
-  ) -> Result<Self, LemmyError> {
-    let avatar = match person.icon() {
-      Some(any_image) => Some(
-        Image::from_any_base(any_image.as_one().context(location_info!())?.clone())?
-          .context(location_info!())?
-          .url()
-          .context(location_info!())?
-          .as_single_xsd_any_uri()
-          .map(|url| url.to_owned()),
-      ),
-      None => None,
+#[async_trait::async_trait]
+impl Object for ApubPerson {
+  type DataType = LemmyContext;
+  type Kind = Person;
+  type Error = LemmyError;
+
+  fn last_refreshed_at(&self) -> Option<NaiveDateTime> {
+    Some(self.last_refreshed_at)
+  }
+
+  #[tracing::instrument(skip_all)]
+  async fn read_from_id(
+    object_id: Url,
+    context: &Data<Self::DataType>,
+  ) -> Result<Option<Self>, LemmyError> {
+    Ok(
+      DbPerson::read_from_apub_id(&mut context.pool(), &object_id.into())
+        .await?
+        .map(Into::into),
+    )
+  }
+
+  #[tracing::instrument(skip_all)]
+  async fn delete(self, context: &Data<Self::DataType>) -> Result<(), LemmyError> {
+    let form = PersonUpdateForm::builder().deleted(Some(true)).build();
+    DbPerson::update(&mut context.pool(), self.id, &form).await?;
+    Ok(())
+  }
+
+  #[tracing::instrument(skip_all)]
+  async fn into_json(self, _context: &Data<Self::DataType>) -> Result<Person, LemmyError> {
+    let kind = if self.bot_account {
+      UserTypes::Service
+    } else {
+      UserTypes::Person
     };
 
-    let banner = match person.image() {
-      Some(any_image) => Some(
-        Image::from_any_base(any_image.as_one().context(location_info!())?.clone())
-          .context(location_info!())?
-          .context(location_info!())?
-          .url()
-          .context(location_info!())?
-          .as_single_xsd_any_uri()
-          .map(|url| url.to_owned()),
-      ),
-      None => None,
+    let person = Person {
+      kind,
+      id: self.actor_id.clone().into(),
+      preferred_username: self.name.clone(),
+      name: self.display_name.clone(),
+      summary: self.bio.as_ref().map(|b| markdown_to_html(b)),
+      source: self.bio.clone().map(Source::new),
+      icon: self.avatar.clone().map(ImageObject::new),
+      image: self.banner.clone().map(ImageObject::new),
+      matrix_user_id: self.matrix_user_id.clone(),
+      published: Some(convert_datetime(self.published)),
+      outbox: generate_outbox_url(&self.actor_id)?.into(),
+      endpoints: self.shared_inbox_url.clone().map(|s| Endpoints {
+        shared_inbox: s.into(),
+      }),
+      public_key: self.public_key(),
+      updated: self.updated.map(convert_datetime),
+      inbox: self.inbox_url.clone().into(),
     };
+    Ok(person)
+  }
 
-    let name: String = person
-      .inner
-      .preferred_username()
-      .context(location_info!())?
-      .to_string();
-    let preferred_username: Option<String> = person
-      .name()
-      .map(|n| n.one())
-      .flatten()
-      .map(|n| n.to_owned().xsd_string())
-      .flatten();
-    let bio = get_source_markdown_value(person)?;
-    let shared_inbox = person
-      .inner
-      .endpoints()?
-      .map(|e| e.shared_inbox)
-      .flatten()
-      .map(|s| s.to_owned().into());
-
-    check_slurs(&name)?;
-    check_slurs_opt(&preferred_username)?;
-    check_slurs_opt(&bio)?;
-
-    Ok(PersonForm {
+  #[tracing::instrument(skip_all)]
+  async fn verify(
+    person: &Person,
+    expected_domain: &Url,
+    context: &Data<Self::DataType>,
+  ) -> Result<(), LemmyError> {
+    let local_site_data = local_site_data_cached(&mut context.pool()).await?;
+    let slur_regex = &local_site_opt_to_slur_regex(&local_site_data.local_site);
+    check_slurs(&person.preferred_username, slur_regex)?;
+    check_slurs_opt(&person.name, slur_regex)?;
+
+    verify_domains_match(person.id.inner(), expected_domain)?;
+    check_apub_id_valid_with_strictness(person.id.inner(), false, context).await?;
+
+    let bio = read_from_string_or_source_opt(&person.summary, &None, &person.source);
+    check_slurs_opt(&bio, slur_regex)?;
+    Ok(())
+  }
+
+  #[tracing::instrument(skip_all)]
+  async fn from_json(
+    person: Person,
+    context: &Data<Self::DataType>,
+  ) -> Result<ApubPerson, LemmyError> {
+    let instance_id = fetch_instance_actor_for_object(&person.id, context).await?;
+
+    let name = sanitize_html(&person.preferred_username);
+    let display_name = sanitize_html_opt(&person.name);
+    let bio = read_from_string_or_source_opt(&person.summary, &None, &person.source);
+    let bio = sanitize_html_opt(&bio);
+
+    // Some Mastodon users have `name: ""` (empty string), need to convert that to `None`
+    // https://github.com/mastodon/mastodon/issues/25233
+    let display_name = display_name.filter(|n| !n.is_empty());
+
+    let person_form = PersonInsertForm {
       name,
-      preferred_username: Some(preferred_username),
+      display_name,
       banned: None,
-      deleted: None,
-      avatar: avatar.map(|o| o.map(|i| i.into())),
-      banner: banner.map(|o| o.map(|i| i.into())),
-      published: person.inner.published().map(|u| u.to_owned().naive_local()),
-      updated: person.updated().map(|u| u.to_owned().naive_local()),
-      actor_id: Some(check_object_domain(person, expected_domain)?),
-      bio: Some(bio),
+      ban_expires: None,
+      deleted: Some(false),
+      avatar: person.icon.map(|i| i.url.into()),
+      banner: person.image.map(|i| i.url.into()),
+      published: person.published.map(|u| u.naive_local()),
+      updated: person.updated.map(|u| u.naive_local()),
+      actor_id: Some(person.id.into()),
+      bio,
       local: Some(false),
       admin: Some(false),
+      bot_account: Some(person.kind == UserTypes::Service),
       private_key: None,
-      public_key: Some(Some(person.ext_two.public_key.to_owned().public_key_pem)),
+      public_key: person.public_key.public_key_pem,
       last_refreshed_at: Some(naive_now()),
-      inbox_url: Some(person.inner.inbox()?.to_owned().into()),
-      shared_inbox_url: Some(shared_inbox),
-      matrix_user_id: Some(person.ext_one.matrix_user_id.to_owned()),
-    })
+      inbox_url: Some(person.inbox.into()),
+      shared_inbox_url: person.endpoints.map(|e| e.shared_inbox.into()),
+      matrix_user_id: person.matrix_user_id,
+      instance_id,
+    };
+    let person = DbPerson::upsert(&mut context.pool(), &person_form).await?;
+
+    Ok(person.into())
+  }
+}
+
+impl Actor for ApubPerson {
+  fn id(&self) -> Url {
+    self.actor_id.inner().clone()
+  }
+
+  fn public_key_pem(&self) -> &str {
+    &self.public_key
+  }
+
+  fn private_key_pem(&self) -> Option<String> {
+    self.private_key.clone()
+  }
+
+  fn inbox(&self) -> Url {
+    self.inbox_url.clone().into()
+  }
+
+  fn shared_inbox(&self) -> Option<Url> {
+    self.shared_inbox_url.clone().map(Into::into)
+  }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+  #![allow(clippy::unwrap_used)]
+  #![allow(clippy::indexing_slicing)]
+
+  use super::*;
+  use crate::{
+    objects::{
+      instance::{tests::parse_lemmy_instance, ApubSite},
+      tests::init_context,
+    },
+    protocol::{objects::instance::Instance, tests::file_to_json_object},
+  };
+  use activitypub_federation::fetch::object_id::ObjectId;
+  use lemmy_db_schema::{source::site::Site, traits::Crud};
+  use serial_test::serial;
+
+  pub(crate) async fn parse_lemmy_person(context: &Data<LemmyContext>) -> (ApubPerson, ApubSite) {
+    let site = parse_lemmy_instance(context).await;
+    let json = file_to_json_object("assets/lemmy/objects/person.json").unwrap();
+    let url = Url::parse("https://enterprise.lemmy.ml/u/picard").unwrap();
+    ApubPerson::verify(&json, &url, context).await.unwrap();
+    let person = ApubPerson::from_json(json, context).await.unwrap();
+    assert_eq!(context.request_count(), 0);
+    (person, site)
+  }
+
+  #[tokio::test]
+  #[serial]
+  async fn test_parse_lemmy_person() {
+    let context = init_context().await;
+    let (person, site) = parse_lemmy_person(&context).await;
+
+    assert_eq!(person.display_name, Some("Jean-Luc Picard".to_string()));
+    assert!(!person.local);
+    assert_eq!(person.bio.as_ref().unwrap().len(), 39);
+
+    cleanup((person, site), &context).await;
+  }
+
+  #[tokio::test]
+  #[serial]
+  async fn test_parse_pleroma_person() {
+    let context = init_context().await;
+
+    // create and parse a fake pleroma instance actor, to avoid network request during test
+    let mut json: Instance = file_to_json_object("assets/lemmy/objects/instance.json").unwrap();
+    json.id = ObjectId::parse("https://queer.hacktivis.me/").unwrap();
+    let url = Url::parse("https://queer.hacktivis.me/users/lanodan").unwrap();
+    ApubSite::verify(&json, &url, &context).await.unwrap();
+    let site = ApubSite::from_json(json, &context).await.unwrap();
+
+    let json = file_to_json_object("assets/pleroma/objects/person.json").unwrap();
+    ApubPerson::verify(&json, &url, &context).await.unwrap();
+    let person = ApubPerson::from_json(json, &context).await.unwrap();
+
+    assert_eq!(person.actor_id, url.into());
+    assert_eq!(person.name, "lanodan");
+    assert!(!person.local);
+    assert_eq!(context.request_count(), 0);
+    assert_eq!(person.bio.as_ref().unwrap().len(), 873);
+
+    cleanup((person, site), &context).await;
+  }
+
+  async fn cleanup(data: (ApubPerson, ApubSite), context: &LemmyContext) {
+    DbPerson::delete(&mut context.pool(), data.0.id)
+      .await
+      .unwrap();
+    Site::delete(&mut context.pool(), data.1.id).await.unwrap();
   }
 }