Add HTTP signature check before linked signature

[github/Chocobozzz/PeerTube.git] / server / middlewares / validators / activitypub / activity.ts

diff --git a/server/middlewares/validators/activitypub/activity.ts b/server/middlewares/validators/activitypub/activity.ts
index 8c292032826be4492f83860d8be5ceaf368a91c5..3f9057c0c395288ac838e03681524ee0281a9c0f 100644 (file)
--- a/server/middlewares/validators/activitypub/activity.ts
+++ b/server/middlewares/validators/activitypub/activity.ts
@@ -1,29 +1,26 @@
 import * as express from 'express'
-import { body } from 'express-validator/check'
 import { isRootActivityValid } from '../../../helpers/custom-validators/activitypub/activity'
 import { logger } from '../../../helpers/logger'
 import { getServerActor } from '../../../helpers/utils'
 import { ActorModel } from '../../../models/activitypub/actor'
-import { areValidationErrors } from '../utils'
 
-const activityPubValidator = [
-  body('').custom((value, { req }) => isRootActivityValid(req.body)),
+async function activityPubValidator (req: express.Request, res: express.Response, next: express.NextFunction) {
+  logger.debug('Checking activity pub parameters')
 
-  async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking activity pub parameters')
-
-    if (areValidationErrors(req, res)) return
-
-    const serverActor = await getServerActor()
-    const remoteActor = res.locals.signature.actor as ActorModel
-    if (serverActor.id === remoteActor.id) {
-      logger.error('Receiving request in INBOX by ourselves!', req.body)
-      return res.status(409).end()
-    }
+  if (!isRootActivityValid(req.body)) {
+    logger.warn('Incorrect activity parameters.', { activity: req.body })
+    return res.status(400).json({ error: 'Incorrect activity.' })
+  }
 
-    return next()
+  const serverActor = await getServerActor()
+  const remoteActor = res.locals.signature.actor as ActorModel
+  if (serverActor.id === remoteActor.id) {
+    logger.error('Receiving request in INBOX by ourselves!', req.body)
+    return res.status(409).end()
   }
-]
+
+  return next()
+}
 
 // ---------------------------------------------------------------------------