git.squeep.com Git - akkoma/blob - test/object/containment_test.exs

   1 defmodule Pleroma.Object.ContainmentTest do
   2   use Pleroma.DataCase
   3
   4   alias Pleroma.User
   5   alias Pleroma.Object.Containment
   6   alias Pleroma.Web.ActivityPub.ActivityPub
   7
   8   import Pleroma.Factory
   9
  10   describe "general origin containment" do
  11     test "contain_origin_from_id() catches obvious spoofing attempts" do
  12       data = %{
  13         "id" => "http://example.com/~alyssa/activities/1234.json"
  14       }
  15
  16       :error =
  17         Containment.contain_origin_from_id(
  18           "http://example.org/~alyssa/activities/1234.json",
  19           data
  20         )
  21     end
  22
  23     test "contain_origin_from_id() allows alternate IDs within the same origin domain" do
  24       data = %{
  25         "id" => "http://example.com/~alyssa/activities/1234.json"
  26       }
  27
  28       :ok =
  29         Containment.contain_origin_from_id(
  30           "http://example.com/~alyssa/activities/1234",
  31           data
  32         )
  33     end
  34
  35     test "contain_origin_from_id() allows matching IDs" do
  36       data = %{
  37         "id" => "http://example.com/~alyssa/activities/1234.json"
  38       }
  39
  40       :ok =
  41         Containment.contain_origin_from_id(
  42           "http://example.com/~alyssa/activities/1234.json",
  43           data
  44         )
  45     end
  46
  47     test "users cannot be collided through fake direction spoofing attempts" do
  48       user =
  49         insert(:user, %{
  50           nickname: "rye@niu.moe",
  51           local: false,
  52           ap_id: "https://niu.moe/users/rye",
  53           follower_address: User.ap_followers(%User{nickname: "rye@niu.moe"})
  54         })
  55
  56       {:error, _} = User.get_or_fetch_by_ap_id("https://n1u.moe/users/rye")
  57     end
  58   end
  59 end