Support more variations of ActivityPub keyId in signature (#4630)

- Tries to avoid performing HTTP request if the keyId is an actor URI
- Likewise if the URI is a fragment URI on top of actor URI
- Resolves public key, returns owner if the owner links back to the key
This commit is contained in:
Eugen Rochko 2017-08-21 22:57:34 +02:00 committed by GitHub
parent f391a4673a
commit 72bb3e03fd
8 changed files with 60 additions and 7 deletions

View file

@ -98,7 +98,9 @@ module SignatureVerification
if key_id.start_with?('acct:') if key_id.start_with?('acct:')
ResolveRemoteAccountService.new.call(key_id.gsub(/\Aacct:/, '')) ResolveRemoteAccountService.new.call(key_id.gsub(/\Aacct:/, ''))
elsif !ActivityPub::TagManager.instance.local_uri?(key_id) elsif !ActivityPub::TagManager.instance.local_uri?(key_id)
ActivityPub::FetchRemoteAccountService.new.call(key_id) account = ActivityPub::TagManager.instance.uri_to_resource(key_id, Account)
account ||= ActivityPub::FetchRemoteKeyService.new.call(key_id)
account
end end
end end
end end

View file

@ -9,6 +9,10 @@ module JsonLdHelper
value.is_a?(Array) ? value.first : value value.is_a?(Array) ? value.first : value
end end
def value_or_id(value)
value.is_a?(String) ? value : value['id']
end
def supported_context?(json) def supported_context?(json)
equals_or_includes?(json['@context'], ActivityPub::TagManager::CONTEXT) equals_or_includes?(json['@context'], ActivityPub::TagManager::CONTEXT)
end end
@ -20,7 +24,7 @@ module JsonLdHelper
end end
def body_to_json(body) def body_to_json(body)
body.nil? ? nil : Oj.load(body, mode: :strict) body.is_a?(String) ? Oj.load(body, mode: :strict) : body
rescue Oj::ParseError rescue Oj::ParseError
nil nil
end end

View file

@ -58,7 +58,7 @@ class ActivityPub::Activity
end end
def object_uri def object_uri
@object_uri ||= @object.is_a?(String) ? @object : @object['id'] @object_uri ||= value_or_id(@object)
end end
def redis def redis

View file

@ -20,6 +20,6 @@ class ActivityPub::Activity::Accept < ActivityPub::Activity
end end
def target_uri def target_uri
@target_uri ||= @object['actor'] @target_uri ||= value_or_id(@object['actor'])
end end
end end

View file

@ -20,6 +20,6 @@ class ActivityPub::Activity::Reject < ActivityPub::Activity
end end
def target_uri def target_uri
@target_uri ||= @object['actor'] @target_uri ||= value_or_id(@object['actor'])
end end
end end

View file

@ -64,6 +64,6 @@ class ActivityPub::Activity::Undo < ActivityPub::Activity
end end
def target_uri def target_uri
@target_uri ||= @object['object'].is_a?(String) ? @object['object'] : @object['object']['id'] @target_uri ||= value_or_id(@object['object'])
end end
end end

View file

@ -93,7 +93,7 @@ class ActivityPub::TagManager
elsif ::TagManager.instance.local_id?(uri) elsif ::TagManager.instance.local_id?(uri)
klass.find_by(id: ::TagManager.instance.unique_tag_to_local_id(uri, klass.to_s)) klass.find_by(id: ::TagManager.instance.unique_tag_to_local_id(uri, klass.to_s))
else else
klass.find_by(uri: uri) klass.find_by(uri: uri.split('#').first)
end end
end end
end end

View file

@ -0,0 +1,47 @@
# frozen_string_literal: true
class ActivityPub::FetchRemoteKeyService < BaseService
include JsonLdHelper
# Returns account that owns the key
def call(uri, prefetched_json = nil)
@json = body_to_json(prefetched_json) || fetch_resource(uri)
return unless supported_context?(@json) && expected_type?
return find_account(uri, @json) if person?
@owner = fetch_resource(owner_uri)
return unless supported_context?(@owner) && confirmed_owner?
find_account(owner_uri, @owner)
end
private
def find_account(uri, prefetched_json)
account = ActivityPub::TagManager.instance.uri_to_resource(uri, Account)
account ||= ActivityPub::FetchRemoteAccountService.new.call(uri, prefetched_json)
account
end
def expected_type?
person? || public_key?
end
def person?
@json['type'] == 'Person'
end
def public_key?
@json['publicKeyPem'].present? && @json['owner'].present?
end
def owner_uri
@owner_uri ||= value_or_id(@json['owner'])
end
def confirmed_owner?
@owner['type'] == 'Person' && value_or_id(@owner['publicKey']) == @json['id']
end
end