comments to remote posts are federated with activity ids pointing at the remote instance #1161

新しいイシュー

オープン

dakkarが2024-11-18 14:22:20 +00:00に作成 · 0件のコメント

dakkar がコメント

2024-11-18 14:22:20 +00:00

Hello!

While inspecting logs of an unrelated fediverse instance, we noticed a mismatch between the host in the signer's URL, and the host in the activity id, with the signature belonging to https://fediverse.blog/@/someone/ but the activity identifying itself as https://writeworks.uk/~/someblog/somepost//comment/12345

This looked like an impersonation attempt (the signer pretending to be a writeworks account), and it was consequently discarded by our instance.

Looking into your source code, I believe the cause of the problem to be in https://git.joinplu.me/Plume/Plume/src/branch/main/plume-models/src/comments.rs#L64-L69 where it generates the URL for the comment based on the URL for the post being commented on. Which is fine when commenting on local posts, but generates nonsensical URLs when the post is remote: it's mashing a remote base URL with a locally-generated primary key. The generated AP URL needs to be under the hostname of the local instance, and should ideally be resolvable to the contents of the comment itself.

(please note that my knowledge of Rust is very rudimentary, and I had never looked at your codebase before now, so I can't really provide a fix…)

Hello! While inspecting logs of an unrelated fediverse instance, we noticed a mismatch between the host in the signer's URL, and the host in the activity id, with the signature belonging to `https://fediverse.blog/@/someone/` but the activity identifying itself as `https://writeworks.uk/~/someblog/somepost//comment/12345` This looked like an impersonation attempt (the signer pretending to be a writeworks account), and it was consequently discarded by our instance. Looking into your source code, I believe the cause of the problem to be in https://git.joinplu.me/Plume/Plume/src/branch/main/plume-models/src/comments.rs#L64-L69 where it generates the URL for the comment based on the URL for the post being commented on. Which is fine when commenting on local posts, but generates nonsensical URLs when the post is remote: it's mashing a remote base URL with a locally-generated primary key. The generated AP URL needs to be under the hostname of the local instance, and should ideally be resolvable to the contents of the comment itself. (please note that my knowledge of Rust is very rudimentary, and I had never looked at your codebase before now, so I can't really provide a fix…)

dakkar がラベル

C: Bug

を追加 2024-11-18 14:22:20 +00:00

サインインしてこの会話に参加。

マイルストーンなし

プロジェクトなし

担当者なし

1 人の参加者

通知

期日

期日が正しくないか範囲を超えています。 "yyyy-mm-dd" の形式で入力してください。

期日は未設定です。

依存関係

依存関係が設定されていません。

リファレンス: Plume/Plume#1161

説明はありません。

Rows
Columns