]> git.immae.eu Git - github/Chocobozzz/PeerTube.git/blobdiff - server/lib/activitypub/actor.ts
Sanitize invalid actor description
[github/Chocobozzz/PeerTube.git] / server / lib / activitypub / actor.ts
index 0882ab843e690ad4bd69077c2ce51900747ec36d..b7114bbee400dade56d7071521cbb6bc7d9e0396 100644 (file)
@@ -12,12 +12,13 @@ import { logger } from '../../helpers/logger'
 import { createPrivateAndPublicKeys } from '../../helpers/peertube-crypto'
 import { doRequest, doRequestAndSaveToFile } from '../../helpers/requests'
 import { getUrlFromWebfinger } from '../../helpers/webfinger'
-import { AVATAR_MIMETYPE_EXT, CONFIG, sequelizeTypescript } from '../../initializers'
+import { IMAGE_MIMETYPE_EXT, CONFIG, sequelizeTypescript, CONSTRAINTS_FIELDS } from '../../initializers'
 import { AccountModel } from '../../models/account/account'
 import { ActorModel } from '../../models/activitypub/actor'
 import { AvatarModel } from '../../models/avatar/avatar'
 import { ServerModel } from '../../models/server/server'
 import { VideoChannelModel } from '../../models/video/video-channel'
+import { truncate } from 'lodash'
 
 // Set account keys, this could be long so process after the account creation and do not block the client
 function setAsyncActorKeys (actor: ActorModel) {
@@ -64,7 +65,11 @@ async function getOrCreateActorAndServerAndModel (actorUrl: string, recurseIfNee
     actor = await retryTransactionWrapper(saveActorAndServerAndModelIfNotExist, options)
   }
 
-  return refreshActorIfNeeded(actor)
+  const options = {
+    arguments: [ actor ],
+    errorMessage: 'Cannot refresh actor if needed with many retries.'
+  }
+  return retryTransactionWrapper(refreshActorIfNeeded, options)
 }
 
 function buildActorInstance (type: ActivityPubActorType, url: string, preferredUsername: string, uuid?: string) {
@@ -132,23 +137,21 @@ async function fetchActorTotalItems (url: string) {
     activityPub: true
   }
 
-  let requestResult
   try {
-    requestResult = await doRequest(options)
+    const { body } = await doRequest(options)
+    return body.totalItems ? body.totalItems : 0
   } catch (err) {
     logger.warn('Cannot fetch remote actor count %s.', url, err)
-    return undefined
+    return 0
   }
-
-  return requestResult.totalItems ? requestResult.totalItems : 0
 }
 
 async function fetchAvatarIfExists (actorJSON: ActivityPubActor) {
   if (
-    actorJSON.icon && actorJSON.icon.type === 'Image' && AVATAR_MIMETYPE_EXT[actorJSON.icon.mediaType] !== undefined &&
+    actorJSON.icon && actorJSON.icon.type === 'Image' && IMAGE_MIMETYPE_EXT[actorJSON.icon.mediaType] !== undefined &&
     isActivityPubUrlValid(actorJSON.icon.url)
   ) {
-    const extension = AVATAR_MIMETYPE_EXT[actorJSON.icon.mediaType]
+    const extension = IMAGE_MIMETYPE_EXT[actorJSON.icon.mediaType]
 
     const avatarName = uuidv4() + extension
     const destPath = join(CONFIG.STORAGE.AVATARS_DIR, avatarName)
@@ -164,6 +167,24 @@ async function fetchAvatarIfExists (actorJSON: ActivityPubActor) {
   return undefined
 }
 
+function normalizeActor (actor: any) {
+  if (!actor) return
+
+  if (!actor.url || typeof actor.url !== 'string') {
+    actor.url = actor.url.href || actor.url.url
+  }
+
+  if (actor.summary && typeof actor.summary === 'string') {
+    actor.summary = truncate(actor.summary, { length: CONSTRAINTS_FIELDS.USERS.DESCRIPTION.max })
+
+    if (actor.summary.length < CONSTRAINTS_FIELDS.USERS.DESCRIPTION.min) {
+      actor.summary = null
+    }
+  }
+
+  return
+}
+
 export {
   getOrCreateActorAndServerAndModel,
   buildActorInstance,
@@ -171,7 +192,8 @@ export {
   fetchActorTotalItems,
   fetchAvatarIfExists,
   updateActorInstance,
-  updateActorAvatarInstance
+  updateActorAvatarInstance,
+  normalizeActor
 }
 
 // ---------------------------------------------------------------------------
@@ -214,15 +236,19 @@ function saveActorAndServerAndModelIfNotExist (
 
     // Force the actor creation, sometimes Sequelize skips the save() when it thinks the instance already exists
     // (which could be false in a retried query)
-    const actorCreated = await ActorModel.create(actor.toJSON(), { transaction: t })
+    const [ actorCreated ] = await ActorModel.findOrCreate({
+      defaults: actor.toJSON(),
+      where: {
+        url: actor.url
+      },
+      transaction: t
+    })
 
     if (actorCreated.type === 'Person' || actorCreated.type === 'Application') {
-      const account = await saveAccount(actorCreated, result, t)
-      actorCreated.Account = account
+      actorCreated.Account = await saveAccount(actorCreated, result, t)
       actorCreated.Account.Actor = actorCreated
     } else if (actorCreated.type === 'Group') { // Video channel
-      const videoChannel = await saveVideoChannel(actorCreated, result, ownerActor, t)
-      actorCreated.VideoChannel = videoChannel
+      actorCreated.VideoChannel = await saveVideoChannel(actorCreated, result, ownerActor, t)
       actorCreated.VideoChannel.Actor = actorCreated
     }
 
@@ -234,6 +260,7 @@ type FetchRemoteActorResult = {
   actor: ActorModel
   name: string
   summary: string
+  support?: string
   avatarName?: string
   attributedTo: ActivityPubAttributedTo[]
 }
@@ -248,6 +275,8 @@ async function fetchRemoteActor (actorUrl: string): Promise<FetchRemoteActorResu
   logger.info('Fetching remote actor %s.', actorUrl)
 
   const requestResult = await doRequest(options)
+  normalizeActor(requestResult.body)
+
   const actorJSON: ActivityPubActor = requestResult.body
 
   if (isActorObjectValid(actorJSON) === false) {
@@ -282,58 +311,86 @@ async function fetchRemoteActor (actorUrl: string): Promise<FetchRemoteActorResu
     name,
     avatarName,
     summary: actorJSON.summary,
+    support: actorJSON.support,
     attributedTo: actorJSON.attributedTo
   }
 }
 
-function saveAccount (actor: ActorModel, result: FetchRemoteActorResult, t: Transaction) {
-  const account = new AccountModel({
-    name: result.name,
-    actorId: actor.id
+async function saveAccount (actor: ActorModel, result: FetchRemoteActorResult, t: Transaction) {
+  const [ accountCreated ] = await AccountModel.findOrCreate({
+    defaults: {
+      name: result.name,
+      description: result.summary,
+      actorId: actor.id
+    },
+    where: {
+      actorId: actor.id
+    },
+    transaction: t
   })
 
-  return account.save({ transaction: t })
+  return accountCreated
 }
 
 async function saveVideoChannel (actor: ActorModel, result: FetchRemoteActorResult, ownerActor: ActorModel, t: Transaction) {
-  const videoChannel = new VideoChannelModel({
-    name: result.name,
-    description: result.summary,
-    actorId: actor.id,
-    accountId: ownerActor.Account.id
+  const [ videoChannelCreated ] = await VideoChannelModel.findOrCreate({
+    defaults: {
+      name: result.name,
+      description: result.summary,
+      support: result.support,
+      actorId: actor.id,
+      accountId: ownerActor.Account.id
+    },
+    where: {
+      actorId: actor.id
+    },
+    transaction: t
   })
 
-  return videoChannel.save({ transaction: t })
+  return videoChannelCreated
 }
 
 async function refreshActorIfNeeded (actor: ActorModel) {
   if (!actor.isOutdated()) return actor
 
-  const actorUrl = await getUrlFromWebfinger(actor.preferredUsername, actor.getHost())
-  const result = await fetchRemoteActor(actorUrl)
-  if (result === undefined) throw new Error('Cannot fetch remote actor in refresh actor.')
-
-  return sequelizeTypescript.transaction(async t => {
-    updateInstanceWithAnother(actor, result.actor)
-
-    if (result.avatarName !== undefined) {
-      await updateActorAvatarInstance(actor, result.avatarName, t)
+  try {
+    const actorUrl = await getUrlFromWebfinger(actor.preferredUsername, actor.getHost())
+    const result = await fetchRemoteActor(actorUrl)
+    if (result === undefined) {
+      logger.warn('Cannot fetch remote actor in refresh actor.')
+      return actor
     }
 
-    await actor.save({ transaction: t })
+    return sequelizeTypescript.transaction(async t => {
+      updateInstanceWithAnother(actor, result.actor)
 
-    if (actor.Account) {
-      await actor.save({ transaction: t })
+      if (result.avatarName !== undefined) {
+        await updateActorAvatarInstance(actor, result.avatarName, t)
+      }
 
-      actor.Account.set('name', result.name)
-      await actor.Account.save({ transaction: t })
-    } else if (actor.VideoChannel) {
+      // Force update
+      actor.setDataValue('updatedAt', new Date())
       await actor.save({ transaction: t })
 
-      actor.VideoChannel.set('name', result.name)
-      await actor.VideoChannel.save({ transaction: t })
-    }
+      if (actor.Account) {
+        await actor.save({ transaction: t })
 
+        actor.Account.set('name', result.name)
+        actor.Account.set('description', result.summary)
+        await actor.Account.save({ transaction: t })
+      } else if (actor.VideoChannel) {
+        await actor.save({ transaction: t })
+
+        actor.VideoChannel.set('name', result.name)
+        actor.VideoChannel.set('description', result.summary)
+        actor.VideoChannel.set('support', result.support)
+        await actor.VideoChannel.save({ transaction: t })
+      }
+
+      return actor
+    })
+  } catch (err) {
+    logger.warn('Cannot refresh actor.', err)
     return actor
-  })
+  }
 }