From 6c8f21b608eb6e9e7691983c7e57f1cbe0a28fc1 Mon Sep 17 00:00:00 2001
From: syuilo <4439005+syuilo@users.noreply.github.com>
Date: Mon, 17 Mar 2025 13:21:09 +0900
Subject: [PATCH] =?UTF-8?q?fix(backend):=20=E9=80=A3=E5=90=88=E7=84=A1?=
=?UTF-8?q?=E3=81=97=E3=83=A2=E3=83=BC=E3=83=89=E3=81=A7=E3=82=82=E5=A4=96?=
=?UTF-8?q?=E9=83=A8=E3=81=8B=E3=82=89=E7=85=A7=E4=BC=9A=E5=8F=AF=E8=83=BD?=
=?UTF-8?q?=E3=81=A0=E3=81=A3=E3=81=9F=E5=95=8F=E9=A1=8C=E3=82=92=E4=BF=AE?=
=?UTF-8?q?=E6=AD=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
CHANGELOG.md | 1 +
.../src/server/ActivityPubServerService.ts | 80 ++++++++++++++++++-
2 files changed, 80 insertions(+), 1 deletion(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd8027b050..cae884793b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@
### Server
- Fix: プロフィール追加情報で無効なURLに入力された場合に照会エラーを出るのを修正
- Fix: ActivityPubリクエストURLチェック実装は仕様に従っていないのを修正
+- Fix: 連合無しモードでも外部から照会可能だった問題を修正
## 2025.3.1
diff --git a/packages/backend/src/server/ActivityPubServerService.ts b/packages/backend/src/server/ActivityPubServerService.ts
index 20e985aaf2..48c80e5e61 100644
--- a/packages/backend/src/server/ActivityPubServerService.ts
+++ b/packages/backend/src/server/ActivityPubServerService.ts
@@ -13,7 +13,7 @@ import accepts from 'accepts';
import vary from 'vary';
import secureJson from 'secure-json-parse';
import { DI } from '@/di-symbols.js';
-import type { FollowingsRepository, NotesRepository, EmojisRepository, NoteReactionsRepository, UserProfilesRepository, UserNotePiningsRepository, UsersRepository, FollowRequestsRepository } from '@/models/_.js';
+import type { FollowingsRepository, NotesRepository, EmojisRepository, NoteReactionsRepository, UserProfilesRepository, UserNotePiningsRepository, UsersRepository, FollowRequestsRepository, MiMeta } from '@/models/_.js';
import * as url from '@/misc/prelude/url.js';
import type { Config } from '@/config.js';
import { ApRendererService } from '@/core/activitypub/ApRendererService.js';
@@ -42,6 +42,9 @@ export class ActivityPubServerService {
@Inject(DI.config)
private config: Config,
+ @Inject(DI.meta)
+ private meta: MiMeta,
+
@Inject(DI.usersRepository)
private usersRepository: UsersRepository,
@@ -102,6 +105,11 @@ export class ActivityPubServerService {
@bindThis
private inbox(request: FastifyRequest, reply: FastifyReply) {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
let signature;
try {
@@ -173,6 +181,11 @@ export class ActivityPubServerService {
request: FastifyRequest<{ Params: { user: string; }; Querystring: { cursor?: string; page?: string; }; }>,
reply: FastifyReply,
) {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const userId = request.params.user;
const cursor = request.query.cursor;
@@ -265,6 +278,11 @@ export class ActivityPubServerService {
request: FastifyRequest<{ Params: { user: string; }; Querystring: { cursor?: string; page?: string; }; }>,
reply: FastifyReply,
) {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const userId = request.params.user;
const cursor = request.query.cursor;
@@ -354,6 +372,11 @@ export class ActivityPubServerService {
@bindThis
private async featured(request: FastifyRequest<{ Params: { user: string; }; }>, reply: FastifyReply) {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const userId = request.params.user;
const user = await this.usersRepository.findOneBy({
@@ -398,6 +421,11 @@ export class ActivityPubServerService {
}>,
reply: FastifyReply,
) {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const userId = request.params.user;
const sinceId = request.query.since_id;
@@ -482,6 +510,11 @@ export class ActivityPubServerService {
@bindThis
private async userInfo(request: FastifyRequest, reply: FastifyReply, user: MiUser | null) {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
if (user == null) {
reply.code(404);
return;
@@ -564,6 +597,11 @@ export class ActivityPubServerService {
fastify.get<{ Params: { note: string; } }>('/notes/:note', { constraints: { apOrHtml: 'ap' } }, async (request, reply) => {
vary(reply.raw, 'Accept');
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const note = await this.notesRepository.findOneBy({
id: request.params.note,
visibility: In(['public', 'home']),
@@ -594,6 +632,11 @@ export class ActivityPubServerService {
fastify.get<{ Params: { note: string; } }>('/notes/:note/activity', async (request, reply) => {
vary(reply.raw, 'Accept');
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const note = await this.notesRepository.findOneBy({
id: request.params.note,
userHost: IsNull(),
@@ -634,6 +677,11 @@ export class ActivityPubServerService {
// publickey
fastify.get<{ Params: { user: string; } }>('/users/:user/publickey', async (request, reply) => {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const userId = request.params.user;
const user = await this.usersRepository.findOneBy({
@@ -661,6 +709,11 @@ export class ActivityPubServerService {
fastify.get<{ Params: { user: string; } }>('/users/:user', { constraints: { apOrHtml: 'ap' } }, async (request, reply) => {
vary(reply.raw, 'Accept');
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const userId = request.params.user;
const user = await this.usersRepository.findOneBy({
@@ -674,6 +727,11 @@ export class ActivityPubServerService {
fastify.get<{ Params: { acct: string; } }>('/@:acct', { constraints: { apOrHtml: 'ap' } }, async (request, reply) => {
vary(reply.raw, 'Accept');
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const acct = Acct.parse(request.params.acct);
const user = await this.usersRepository.findOneBy({
@@ -688,6 +746,11 @@ export class ActivityPubServerService {
// emoji
fastify.get<{ Params: { emoji: string; } }>('/emojis/:emoji', async (request, reply) => {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const emoji = await this.emojisRepository.findOneBy({
host: IsNull(),
name: request.params.emoji,
@@ -705,6 +768,11 @@ export class ActivityPubServerService {
// like
fastify.get<{ Params: { like: string; } }>('/likes/:like', async (request, reply) => {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
const reaction = await this.noteReactionsRepository.findOneBy({ id: request.params.like });
if (reaction == null) {
@@ -726,6 +794,11 @@ export class ActivityPubServerService {
// follow
fastify.get<{ Params: { follower: string; followee: string; } }>('/follows/:follower/:followee', async (request, reply) => {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
// This may be used before the follow is completed, so we do not
// check if the following exists.
@@ -752,6 +825,11 @@ export class ActivityPubServerService {
// follow
fastify.get<{ Params: { followRequestId: string; } }>('/follows/:followRequestId', async (request, reply) => {
+ if (this.meta.federation === 'none') {
+ reply.code(403);
+ return;
+ }
+
// This may be used before the follow is completed, so we do not
// check if the following exists and only check if the follow request exists.