git.squeep.com Git - akkoma/blob - test/object/containment_test.exs

   1 defmodule Pleroma.Object.ContainmentTest do
   2   use Pleroma.DataCase
   3
   4   alias Pleroma.Object.Containment
   5   alias Pleroma.User
   6
   7   import Pleroma.Factory
   8
   9   describe "general origin containment" do
  10     test "contain_origin_from_id() catches obvious spoofing attempts" do
  11       data = %{
  12         "id" => "http://example.com/~alyssa/activities/1234.json"
  13       }
  14
  15       :error =
  16         Containment.contain_origin_from_id(
  17           "http://example.org/~alyssa/activities/1234.json",
  18           data
  19         )
  20     end
  21
  22     test "contain_origin_from_id() allows alternate IDs within the same origin domain" do
  23       data = %{
  24         "id" => "http://example.com/~alyssa/activities/1234.json"
  25       }
  26
  27       :ok =
  28         Containment.contain_origin_from_id(
  29           "http://example.com/~alyssa/activities/1234",
  30           data
  31         )
  32     end
  33
  34     test "contain_origin_from_id() allows matching IDs" do
  35       data = %{
  36         "id" => "http://example.com/~alyssa/activities/1234.json"
  37       }
  38
  39       :ok =
  40         Containment.contain_origin_from_id(
  41           "http://example.com/~alyssa/activities/1234.json",
  42           data
  43         )
  44     end
  45
  46     test "users cannot be collided through fake direction spoofing attempts" do
  47       _user =
  48         insert(:user, %{
  49           nickname: "rye@niu.moe",
  50           local: false,
  51           ap_id: "https://niu.moe/users/rye",
  52           follower_address: User.ap_followers(%User{nickname: "rye@niu.moe"})
  53         })
  54
  55       {:error, _} = User.get_or_fetch_by_ap_id("https://n1u.moe/users/rye")
  56     end
  57   end
  58 end