Improve AP validation for Notes

[github/Chocobozzz/PeerTube.git] / server / lib / activitypub / videos.ts

diff --git a/server/lib/activitypub/videos.ts b/server/lib/activitypub/videos.ts
index e65362190cb481814a936070b853af34c3aab7f1..2899acff3a7448fa96b0aa2433f3809aee0cc865 100644 (file)
--- a/server/lib/activitypub/videos.ts
+++ b/server/lib/activitypub/videos.ts
@@ -5,7 +5,7 @@ import * as request from 'request'
 import { ActivityIconObject } from '../../../shared/index'
 import { VideoTorrentObject } from '../../../shared/models/activitypub/objects'
 import { VideoPrivacy, VideoRateType } from '../../../shared/models/videos'
-import { isVideoTorrentObjectValid } from '../../helpers/custom-validators/activitypub/videos'
+import { sanitizeAndCheckVideoTorrentObject } from '../../helpers/custom-validators/activitypub/videos'
 import { isVideoFileInfoHashValid } from '../../helpers/custom-validators/videos'
 import { retryTransactionWrapper } from '../../helpers/database-utils'
 import { logger } from '../../helpers/logger'
@@ -56,37 +56,27 @@ function generateThumbnailFromUrl (video: VideoModel, icon: ActivityIconObject)
 
 async function videoActivityObjectToDBAttributes (videoChannel: VideoChannelModel,
                                                   videoObject: VideoTorrentObject,
-                                                  to: string[] = [],
-                                                  cc: string[] = []) {
-  let privacy = VideoPrivacy.PRIVATE
-  if (to.indexOf(ACTIVITY_PUB.PUBLIC) !== -1) privacy = VideoPrivacy.PUBLIC
-  else if (cc.indexOf(ACTIVITY_PUB.PUBLIC) !== -1) privacy = VideoPrivacy.UNLISTED
-
+                                                  to: string[] = []) {
+  const privacy = to.indexOf(ACTIVITY_PUB.PUBLIC) !== -1 ? VideoPrivacy.PUBLIC : VideoPrivacy.UNLISTED
   const duration = videoObject.duration.replace(/[^\d]+/, '')
-  let language = null
+
+  let language: string = null
   if (videoObject.language) {
-    language = parseInt(videoObject.language.identifier, 10)
+    language = videoObject.language.identifier
   }
 
-  let category = null
+  let category: number = null
   if (videoObject.category) {
     category = parseInt(videoObject.category.identifier, 10)
   }
 
-  let licence = null
+  let licence: number = null
   if (videoObject.licence) {
     licence = parseInt(videoObject.licence.identifier, 10)
   }
 
-  let description = null
-  if (videoObject.content) {
-    description = videoObject.content
-  }
-
-  let support = null
-  if (videoObject.support) {
-    support = videoObject.support
-  }
+  const description = videoObject.content || null
+  const support = videoObject.support || null
 
   return {
     name: videoObject.name,
@@ -147,6 +137,13 @@ function videoFileActivityUrlToDBAttributes (videoCreated: VideoModel, videoObje
   return attributes
 }
 
+function getOrCreateVideoChannel (videoObject: VideoTorrentObject) {
+  const channel = videoObject.attributedTo.find(a => a.type === 'Group')
+  if (!channel) throw new Error('Cannot find associated video channel to video ' + videoObject.url)
+
+  return getOrCreateActorAndServerAndModel(channel.id)
+}
+
 async function getOrCreateVideo (videoObject: VideoTorrentObject, channelActor: ActorModel) {
   logger.debug('Adding remote video %s.', videoObject.id)
 
@@ -157,12 +154,12 @@ async function getOrCreateVideo (videoObject: VideoTorrentObject, channelActor:
     const videoFromDatabase = await VideoModel.loadByUUIDOrURLAndPopulateAccount(videoObject.uuid, videoObject.id, t)
     if (videoFromDatabase) return videoFromDatabase
 
-    const videoData = await videoActivityObjectToDBAttributes(channelActor.VideoChannel, videoObject, videoObject.to, videoObject.cc)
+    const videoData = await videoActivityObjectToDBAttributes(channelActor.VideoChannel, videoObject, videoObject.to)
     const video = VideoModel.build(videoData)
 
     // Don't block on request
     generateThumbnailFromUrl(video, videoObject.icon)
-      .catch(err => logger.warn('Cannot generate thumbnail of %s.', videoObject.id, err))
+      .catch(err => logger.warn('Cannot generate thumbnail of %s.', videoObject.id, { err }))
 
     const videoCreated = await video.save(sequelizeOptions)
 
@@ -187,7 +184,9 @@ async function getOrCreateVideo (videoObject: VideoTorrentObject, channelActor:
 
 async function getOrCreateAccountAndVideoAndChannel (videoObject: VideoTorrentObject | string, actor?: ActorModel) {
   if (typeof videoObject === 'string') {
-    const videoFromDatabase = await VideoModel.loadByUrlAndPopulateAccount(videoObject)
+    const videoUrl = videoObject
+
+    const videoFromDatabase = await VideoModel.loadByUrlAndPopulateAccount(videoUrl)
     if (videoFromDatabase) {
       return {
         video: videoFromDatabase,
@@ -196,8 +195,8 @@ async function getOrCreateAccountAndVideoAndChannel (videoObject: VideoTorrentOb
       }
     }
 
-    videoObject = await fetchRemoteVideo(videoObject)
-    if (!videoObject) throw new Error('Cannot fetch remote video')
+    videoObject = await fetchRemoteVideo(videoUrl)
+    if (!videoObject) throw new Error('Cannot fetch remote video with url: ' + videoUrl)
   }
 
   if (!actor) {
@@ -207,10 +206,7 @@ async function getOrCreateAccountAndVideoAndChannel (videoObject: VideoTorrentOb
     actor = await getOrCreateActorAndServerAndModel(actorObj.id)
   }
 
-  const channel = videoObject.attributedTo.find(a => a.type === 'Group')
-  if (!channel) throw new Error('Cannot find associated video channel to video ' + videoObject.url)
-
-  const channelActor = await getOrCreateActorAndServerAndModel(channel.id)
+  const channelActor = await getOrCreateVideoChannel(videoObject)
 
   const options = {
     arguments: [ videoObject, channelActor ],
@@ -278,9 +274,12 @@ async function addVideoShares (instance: VideoModel, shareUrls: string[]) {
       json: true,
       activityPub: true
     })
-    const actorUrl = body.actor
-    if (!actorUrl) continue
+    if (!body || !body.actor) {
+      logger.warn('Cannot add remote share with url: %s, skipping...', shareUrl)
+      continue
+    }
 
+    const actorUrl = body.actor
     const actor = await getOrCreateActorAndServerAndModel(actorUrl)
 
     const entry = {
@@ -306,6 +305,7 @@ export {
   videoActivityObjectToDBAttributes,
   videoFileActivityUrlToDBAttributes,
   getOrCreateVideo,
+  getOrCreateVideoChannel,
   addVideoShares}
 
 // ---------------------------------------------------------------------------
@@ -322,7 +322,7 @@ async function fetchRemoteVideo (videoUrl: string): Promise<VideoTorrentObject>
 
   const { body } = await doRequest(options)
 
-  if (isVideoTorrentObjectValid(body) === false) {
+  if (sanitizeAndCheckVideoTorrentObject(body) === false) {
     logger.debug('Remote video JSON is not valid.', { body })
     return undefined
   }