Improve AP validation for Notes

[github/Chocobozzz/PeerTube.git] / server / lib / activitypub / actor.ts

diff --git a/server/lib/activitypub/actor.ts b/server/lib/activitypub/actor.ts
index 897acee8598c2acc52b0aad4fe041c8b345375e7..5773fc34fc9d5c6987b18dda58deebab139a198e 100644 (file)
--- a/server/lib/activitypub/actor.ts
+++ b/server/lib/activitypub/actor.ts
@@ -5,6 +5,7 @@ import * as url from 'url'
 import * as uuidv4 from 'uuid/v4'
 import { ActivityPubActor, ActivityPubActorType } from '../../../shared/models/activitypub'
 import { ActivityPubAttributedTo } from '../../../shared/models/activitypub/objects'
+import { getActorUrl } from '../../helpers/activitypub'
 import { isActorObjectValid } from '../../helpers/custom-validators/activitypub/actor'
 import { isActivityPubUrlValid } from '../../helpers/custom-validators/activitypub/misc'
 import { retryTransactionWrapper, updateInstanceWithAnother } from '../../helpers/database-utils'
@@ -12,12 +13,13 @@ import { logger } from '../../helpers/logger'
 import { createPrivateAndPublicKeys } from '../../helpers/peertube-crypto'
 import { doRequest, doRequestAndSaveToFile } from '../../helpers/requests'
 import { getUrlFromWebfinger } from '../../helpers/webfinger'
-import { IMAGE_MIMETYPE_EXT, CONFIG, sequelizeTypescript } from '../../initializers'
+import { IMAGE_MIMETYPE_EXT, CONFIG, sequelizeTypescript, CONSTRAINTS_FIELDS } from '../../initializers'
 import { AccountModel } from '../../models/account/account'
 import { ActorModel } from '../../models/activitypub/actor'
 import { AvatarModel } from '../../models/avatar/avatar'
 import { ServerModel } from '../../models/server/server'
 import { VideoChannelModel } from '../../models/video/video-channel'
+import { truncate } from 'lodash'
 
 // Set account keys, this could be long so process after the account creation and do not block the client
 function setAsyncActorKeys (actor: ActorModel) {
@@ -28,12 +30,14 @@ function setAsyncActorKeys (actor: ActorModel) {
       return actor.save()
     })
     .catch(err => {
-      logger.error('Cannot set public/private keys of actor %d.', actor.uuid, err)
+      logger.error('Cannot set public/private keys of actor %d.', actor.uuid, { err })
       return actor
     })
 }
 
-async function getOrCreateActorAndServerAndModel (actorUrl: string, recurseIfNeeded = true) {
+async function getOrCreateActorAndServerAndModel (activityActor: string | ActivityPubActor, recurseIfNeeded = true) {
+  const actorUrl = getActorUrl(activityActor)
+
   let actor = await ActorModel.loadByUrl(actorUrl)
 
   // We don't have this actor in our database, fetch it on remote
@@ -113,7 +117,7 @@ async function updateActorAvatarInstance (actorInstance: ActorModel, avatarName:
       try {
         await actorInstance.Avatar.destroy({ transaction: t })
       } catch (err) {
-        logger.error('Cannot remove old avatar of actor %s.', actorInstance.url, err)
+        logger.error('Cannot remove old avatar of actor %s.', actorInstance.url, { err })
       }
     }
 
@@ -140,7 +144,7 @@ async function fetchActorTotalItems (url: string) {
     const { body } = await doRequest(options)
     return body.totalItems ? body.totalItems : 0
   } catch (err) {
-    logger.warn('Cannot fetch remote actor count %s.', url, err)
+    logger.warn('Cannot fetch remote actor count %s.', url, { err })
     return 0
   }
 }
@@ -166,6 +170,24 @@ async function fetchAvatarIfExists (actorJSON: ActivityPubActor) {
   return undefined
 }
 
+function normalizeActor (actor: any) {
+  if (!actor) return
+
+  if (!actor.url || typeof actor.url !== 'string') {
+    actor.url = actor.url.href || actor.url.url
+  }
+
+  if (actor.summary && typeof actor.summary === 'string') {
+    actor.summary = truncate(actor.summary, { length: CONSTRAINTS_FIELDS.USERS.DESCRIPTION.max })
+
+    if (actor.summary.length < CONSTRAINTS_FIELDS.USERS.DESCRIPTION.min) {
+      actor.summary = null
+    }
+  }
+
+  return
+}
+
 export {
   getOrCreateActorAndServerAndModel,
   buildActorInstance,
@@ -173,7 +195,8 @@ export {
   fetchActorTotalItems,
   fetchAvatarIfExists,
   updateActorInstance,
-  updateActorAvatarInstance
+  updateActorAvatarInstance,
+  normalizeActor
 }
 
 // ---------------------------------------------------------------------------
@@ -255,7 +278,9 @@ async function fetchRemoteActor (actorUrl: string): Promise<FetchRemoteActorResu
   logger.info('Fetching remote actor %s.', actorUrl)
 
   const requestResult = await doRequest(options)
-  const actorJSON: ActivityPubActor = normalizeActor(requestResult.body)
+  normalizeActor(requestResult.body)
+
+  const actorJSON: ActivityPubActor = requestResult.body
 
   if (isActorObjectValid(actorJSON) === false) {
     logger.debug('Remote actor JSON is not valid.', { actorJSON: actorJSON })
@@ -328,7 +353,7 @@ async function saveVideoChannel (actor: ActorModel, result: FetchRemoteActorResu
   return videoChannelCreated
 }
 
-async function refreshActorIfNeeded (actor: ActorModel) {
+async function refreshActorIfNeeded (actor: ActorModel): Promise<ActorModel> {
   if (!actor.isOutdated()) return actor
 
   try {
@@ -368,14 +393,7 @@ async function refreshActorIfNeeded (actor: ActorModel) {
       return actor
     })
   } catch (err) {
-    logger.warn('Cannot refresh actor.', err)
+    logger.warn('Cannot refresh actor.', { err })
     return actor
   }
 }
-
-function normalizeActor (actor: any) {
-  if (actor && actor.url && typeof actor.url === 'string') return actor
-
-  actor.url = actor.url.href || actor.url.url
-  return actor
-}