git.squeep.com Git - akkoma/blob - test/pleroma/web/activity_pub/mrf/simple_policy_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicyTest do
   6   use Pleroma.DataCase
   7   import Pleroma.Factory
   8   alias Pleroma.Web.ActivityPub.MRF.SimplePolicy
   9   alias Pleroma.Web.CommonAPI
  10
  11   setup do:
  12           clear_config(:mrf_simple,
  13             media_removal: [],
  14             media_nsfw: [],
  15             federated_timeline_removal: [],
  16             report_removal: [],
  17             reject: [],
  18             followers_only: [],
  19             accept: [],
  20             avatar_removal: [],
  21             banner_removal: [],
  22             reject_deletes: []
  23           )
  24
  25   describe "when :media_removal" do
  26     test "is empty" do
  27       clear_config([:mrf_simple, :media_removal], [])
  28       media_message = build_media_message()
  29       media_update_message = build_media_update_message()
  30       local_message = build_local_message()
  31
  32       assert SimplePolicy.filter(media_message) == {:ok, media_message}
  33       assert SimplePolicy.filter(media_update_message) == {:ok, media_update_message}
  34       assert SimplePolicy.filter(local_message) == {:ok, local_message}
  35     end
  36
  37     test "has a matching host" do
  38       clear_config([:mrf_simple, :media_removal], [{"remote.instance", "Some reason"}])
  39       media_message = build_media_message()
  40       media_update_message = build_media_update_message()
  41       local_message = build_local_message()
  42
  43       assert SimplePolicy.filter(media_message) ==
  44                {:ok,
  45                 media_message
  46                 |> Map.put("object", Map.delete(media_message["object"], "attachment"))}
  47
  48       assert SimplePolicy.filter(media_update_message) ==
  49                {:ok,
  50                 media_update_message
  51                 |> Map.put("object", Map.delete(media_update_message["object"], "attachment"))}
  52
  53       assert SimplePolicy.filter(local_message) == {:ok, local_message}
  54     end
  55
  56     test "match with wildcard domain" do
  57       clear_config([:mrf_simple, :media_removal], [{"*.remote.instance", "Whatever reason"}])
  58       media_message = build_media_message()
  59       media_update_message = build_media_update_message()
  60       local_message = build_local_message()
  61
  62       assert SimplePolicy.filter(media_message) ==
  63                {:ok,
  64                 media_message
  65                 |> Map.put("object", Map.delete(media_message["object"], "attachment"))}
  66
  67       assert SimplePolicy.filter(media_update_message) ==
  68                {:ok,
  69                 media_update_message
  70                 |> Map.put("object", Map.delete(media_update_message["object"], "attachment"))}
  71
  72       assert SimplePolicy.filter(local_message) == {:ok, local_message}
  73     end
  74   end
  75
  76   describe "when :media_nsfw" do
  77     test "is empty" do
  78       clear_config([:mrf_simple, :media_nsfw], [])
  79       media_message = build_media_message()
  80       media_update_message = build_media_update_message()
  81       local_message = build_local_message()
  82
  83       assert SimplePolicy.filter(media_message) == {:ok, media_message}
  84       assert SimplePolicy.filter(media_update_message) == {:ok, media_update_message}
  85       assert SimplePolicy.filter(local_message) == {:ok, local_message}
  86     end
  87
  88     test "has a matching host" do
  89       clear_config([:mrf_simple, :media_nsfw], [{"remote.instance", "Whetever"}])
  90       media_message = build_media_message()
  91       media_update_message = build_media_update_message()
  92       local_message = build_local_message()
  93
  94       assert SimplePolicy.filter(media_message) ==
  95                {:ok, put_in(media_message, ["object", "sensitive"], true)}
  96
  97       assert SimplePolicy.filter(media_update_message) ==
  98                {:ok, put_in(media_update_message, ["object", "sensitive"], true)}
  99
 100       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 101     end
 102
 103     test "match with wildcard domain" do
 104       clear_config([:mrf_simple, :media_nsfw], [{"*.remote.instance", "yeah yeah"}])
 105       media_message = build_media_message()
 106       media_update_message = build_media_update_message()
 107       local_message = build_local_message()
 108
 109       assert SimplePolicy.filter(media_message) ==
 110                {:ok, put_in(media_message, ["object", "sensitive"], true)}
 111
 112       assert SimplePolicy.filter(media_update_message) ==
 113                {:ok, put_in(media_update_message, ["object", "sensitive"], true)}
 114
 115       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 116     end
 117   end
 118
 119   defp build_media_message do
 120     %{
 121       "actor" => "https://remote.instance/users/bob",
 122       "type" => "Create",
 123       "object" => %{
 124         "attachment" => [%{}],
 125         "tag" => ["foo"],
 126         "sensitive" => false
 127       }
 128     }
 129   end
 130
 131   defp build_media_update_message do
 132     %{
 133       "actor" => "https://remote.instance/users/bob",
 134       "type" => "Update",
 135       "object" => %{
 136         "attachment" => [%{}],
 137         "tag" => ["foo"],
 138         "sensitive" => false
 139       }
 140     }
 141   end
 142
 143   describe "when :report_removal" do
 144     test "is empty" do
 145       clear_config([:mrf_simple, :report_removal], [])
 146       report_message = build_report_message()
 147       local_message = build_local_message()
 148
 149       assert SimplePolicy.filter(report_message) == {:ok, report_message}
 150       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 151     end
 152
 153     test "has a matching host" do
 154       clear_config([:mrf_simple, :report_removal], [{"remote.instance", "muh"}])
 155       report_message = build_report_message()
 156       local_message = build_local_message()
 157
 158       assert {:reject, _} = SimplePolicy.filter(report_message)
 159       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 160     end
 161
 162     test "match with wildcard domain" do
 163       clear_config([:mrf_simple, :report_removal], [{"*.remote.instance", "suya"}])
 164       report_message = build_report_message()
 165       local_message = build_local_message()
 166
 167       assert {:reject, _} = SimplePolicy.filter(report_message)
 168       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 169     end
 170   end
 171
 172   defp build_report_message do
 173     %{
 174       "actor" => "https://remote.instance/users/bob",
 175       "type" => "Flag"
 176     }
 177   end
 178
 179   describe "when :federated_timeline_removal" do
 180     test "is empty" do
 181       clear_config([:mrf_simple, :federated_timeline_removal], [])
 182       {_, ftl_message} = build_ftl_actor_and_message()
 183       local_message = build_local_message()
 184
 185       assert SimplePolicy.filter(ftl_message) == {:ok, ftl_message}
 186       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 187     end
 188
 189     test "has a matching host" do
 190       {actor, ftl_message} = build_ftl_actor_and_message()
 191
 192       ftl_message_actor_host =
 193         ftl_message
 194         |> Map.fetch!("actor")
 195         |> URI.parse()
 196         |> Map.fetch!(:host)
 197
 198       clear_config([:mrf_simple, :federated_timeline_removal], [{ftl_message_actor_host, "uwu"}])
 199       local_message = build_local_message()
 200
 201       assert {:ok, ftl_message} = SimplePolicy.filter(ftl_message)
 202       assert actor.follower_address in ftl_message["to"]
 203       refute actor.follower_address in ftl_message["cc"]
 204       refute "https://www.w3.org/ns/activitystreams#Public" in ftl_message["to"]
 205       assert "https://www.w3.org/ns/activitystreams#Public" in ftl_message["cc"]
 206
 207       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 208     end
 209
 210     test "match with wildcard domain" do
 211       {actor, ftl_message} = build_ftl_actor_and_message()
 212
 213       ftl_message_actor_host =
 214         ftl_message
 215         |> Map.fetch!("actor")
 216         |> URI.parse()
 217         |> Map.fetch!(:host)
 218
 219       clear_config([:mrf_simple, :federated_timeline_removal], [
 220         {"*." <> ftl_message_actor_host, "owo"}
 221       ])
 222
 223       local_message = build_local_message()
 224
 225       assert {:ok, ftl_message} = SimplePolicy.filter(ftl_message)
 226       assert actor.follower_address in ftl_message["to"]
 227       refute actor.follower_address in ftl_message["cc"]
 228       refute "https://www.w3.org/ns/activitystreams#Public" in ftl_message["to"]
 229       assert "https://www.w3.org/ns/activitystreams#Public" in ftl_message["cc"]
 230
 231       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 232     end
 233
 234     test "has a matching host but only as:Public in to" do
 235       {_actor, ftl_message} = build_ftl_actor_and_message()
 236
 237       ftl_message_actor_host =
 238         ftl_message
 239         |> Map.fetch!("actor")
 240         |> URI.parse()
 241         |> Map.fetch!(:host)
 242
 243       ftl_message = Map.put(ftl_message, "cc", [])
 244
 245       clear_config([:mrf_simple, :federated_timeline_removal], [
 246         {ftl_message_actor_host, "spiderwaifu goes 88w88"}
 247       ])
 248
 249       assert {:ok, ftl_message} = SimplePolicy.filter(ftl_message)
 250       refute "https://www.w3.org/ns/activitystreams#Public" in ftl_message["to"]
 251       assert "https://www.w3.org/ns/activitystreams#Public" in ftl_message["cc"]
 252     end
 253   end
 254
 255   describe "describe/1" do
 256     test "returns a description of the policy" do
 257       clear_config([:mrf_simple, :reject], [
 258         {"remote.instance", "did not give my catboy a burg"}
 259       ])
 260
 261       assert {:ok, %{mrf_simple: %{reject: ["remote.instance"]}}} = SimplePolicy.describe()
 262     end
 263
 264     test "excludes domains listed in :transparency_exclusions" do
 265       clear_config([:mrf, :transparency_exclusions], [{"remote.instance", ":("}])
 266
 267       clear_config([:mrf_simple, :reject], [
 268         {"remote.instance", "did not give my catboy a burg"}
 269       ])
 270
 271       {:ok, description} = SimplePolicy.describe()
 272       assert %{mrf_simple: %{reject: []}} = description
 273       assert description[:mrf_simple_info][:reject] == nil
 274     end
 275
 276     test "obfuscates domains listed in :transparency_obfuscate_domains" do
 277       clear_config([:mrf, :transparency_obfuscate_domains], ["remote.instance", "a.b"])
 278
 279       clear_config([:mrf_simple, :reject], [
 280         {"remote.instance", "did not give my catboy a burg"},
 281         {"a.b", "spam-poked me on facebook in 2006"}
 282       ])
 283
 284       assert {:ok,
 285               %{
 286                 mrf_simple: %{reject: ["rem***.*****nce", "a.b"]},
 287                 mrf_simple_info: %{reject: %{"rem***.*****nce" => %{}}}
 288               }} = SimplePolicy.describe()
 289     end
 290   end
 291
 292   defp build_ftl_actor_and_message do
 293     actor = insert(:user)
 294
 295     {actor,
 296      %{
 297        "actor" => actor.ap_id,
 298        "to" => ["https://www.w3.org/ns/activitystreams#Public", "http://foo.bar/baz"],
 299        "cc" => [actor.follower_address, "http://foo.bar/qux"]
 300      }}
 301   end
 302
 303   describe "when :reject" do
 304     test "is empty" do
 305       clear_config([:mrf_simple, :reject], [])
 306
 307       remote_message = build_remote_message()
 308
 309       assert SimplePolicy.filter(remote_message) == {:ok, remote_message}
 310     end
 311
 312     test "activity has a matching host" do
 313       clear_config([:mrf_simple, :reject], [{"remote.instance", ""}])
 314
 315       remote_message = build_remote_message()
 316
 317       assert {:reject, _} = SimplePolicy.filter(remote_message)
 318     end
 319
 320     test "activity matches with wildcard domain" do
 321       clear_config([:mrf_simple, :reject], [{"*.remote.instance", ""}])
 322
 323       remote_message = build_remote_message()
 324
 325       assert {:reject, _} = SimplePolicy.filter(remote_message)
 326     end
 327
 328     test "actor has a matching host" do
 329       clear_config([:mrf_simple, :reject], [{"remote.instance", ""}])
 330
 331       remote_user = build_remote_user()
 332
 333       assert {:reject, _} = SimplePolicy.filter(remote_user)
 334     end
 335
 336     test "reject Announce when object would be rejected" do
 337       clear_config([:mrf_simple, :reject], [{"blocked.tld", ""}])
 338
 339       announce = %{
 340         "type" => "Announce",
 341         "actor" => "https://okay.tld/users/alice",
 342         "object" => %{"type" => "Note", "actor" => "https://blocked.tld/users/bob"}
 343       }
 344
 345       assert {:reject, _} = SimplePolicy.filter(announce)
 346     end
 347
 348     test "reject by URI object" do
 349       clear_config([:mrf_simple, :reject], [{"blocked.tld", ""}])
 350
 351       announce = %{
 352         "type" => "Announce",
 353         "actor" => "https://okay.tld/users/alice",
 354         "object" => "https://blocked.tld/activities/1"
 355       }
 356
 357       assert {:reject, _} = SimplePolicy.filter(announce)
 358     end
 359   end
 360
 361   describe "when :followers_only" do
 362     test "is empty" do
 363       clear_config([:mrf_simple, :followers_only], [])
 364       {_, ftl_message} = build_ftl_actor_and_message()
 365       local_message = build_local_message()
 366
 367       assert SimplePolicy.filter(ftl_message) == {:ok, ftl_message}
 368       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 369     end
 370
 371     test "has a matching host" do
 372       actor = insert(:user)
 373       following_user = insert(:user)
 374       non_following_user = insert(:user)
 375
 376       {:ok, _, _, _} = CommonAPI.follow(following_user, actor)
 377
 378       activity = %{
 379         "actor" => actor.ap_id,
 380         "to" => [
 381           "https://www.w3.org/ns/activitystreams#Public",
 382           following_user.ap_id,
 383           non_following_user.ap_id
 384         ],
 385         "cc" => [actor.follower_address, "http://foo.bar/qux"]
 386       }
 387
 388       dm_activity = %{
 389         "actor" => actor.ap_id,
 390         "to" => [
 391           following_user.ap_id,
 392           non_following_user.ap_id
 393         ],
 394         "cc" => []
 395       }
 396
 397       actor_domain =
 398         activity
 399         |> Map.fetch!("actor")
 400         |> URI.parse()
 401         |> Map.fetch!(:host)
 402
 403       clear_config([:mrf_simple, :followers_only], [{actor_domain, ""}])
 404
 405       assert {:ok, new_activity} = SimplePolicy.filter(activity)
 406       assert actor.follower_address in new_activity["cc"]
 407       assert following_user.ap_id in new_activity["to"]
 408       refute "https://www.w3.org/ns/activitystreams#Public" in new_activity["to"]
 409       refute "https://www.w3.org/ns/activitystreams#Public" in new_activity["cc"]
 410       refute non_following_user.ap_id in new_activity["to"]
 411       refute non_following_user.ap_id in new_activity["cc"]
 412
 413       assert {:ok, new_dm_activity} = SimplePolicy.filter(dm_activity)
 414       assert new_dm_activity["to"] == [following_user.ap_id]
 415       assert new_dm_activity["cc"] == []
 416     end
 417   end
 418
 419   describe "when :accept" do
 420     test "is empty" do
 421       clear_config([:mrf_simple, :accept], [])
 422
 423       local_message = build_local_message()
 424       remote_message = build_remote_message()
 425
 426       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 427       assert SimplePolicy.filter(remote_message) == {:ok, remote_message}
 428     end
 429
 430     test "is not empty but activity doesn't have a matching host" do
 431       clear_config([:mrf_simple, :accept], [{"non.matching.remote", ""}])
 432
 433       local_message = build_local_message()
 434       remote_message = build_remote_message()
 435
 436       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 437       assert {:reject, _} = SimplePolicy.filter(remote_message)
 438     end
 439
 440     test "activity has a matching host" do
 441       clear_config([:mrf_simple, :accept], [{"remote.instance", ""}])
 442
 443       local_message = build_local_message()
 444       remote_message = build_remote_message()
 445
 446       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 447       assert SimplePolicy.filter(remote_message) == {:ok, remote_message}
 448     end
 449
 450     test "activity matches with wildcard domain" do
 451       clear_config([:mrf_simple, :accept], [{"*.remote.instance", ""}])
 452
 453       local_message = build_local_message()
 454       remote_message = build_remote_message()
 455
 456       assert SimplePolicy.filter(local_message) == {:ok, local_message}
 457       assert SimplePolicy.filter(remote_message) == {:ok, remote_message}
 458     end
 459
 460     test "actor has a matching host" do
 461       clear_config([:mrf_simple, :accept], [{"remote.instance", ""}])
 462
 463       remote_user = build_remote_user()
 464
 465       assert SimplePolicy.filter(remote_user) == {:ok, remote_user}
 466     end
 467   end
 468
 469   describe "when :avatar_removal" do
 470     test "is empty" do
 471       clear_config([:mrf_simple, :avatar_removal], [])
 472
 473       remote_user = build_remote_user()
 474
 475       assert SimplePolicy.filter(remote_user) == {:ok, remote_user}
 476     end
 477
 478     test "is not empty but it doesn't have a matching host" do
 479       clear_config([:mrf_simple, :avatar_removal], [{"non.matching.remote", ""}])
 480
 481       remote_user = build_remote_user()
 482
 483       assert SimplePolicy.filter(remote_user) == {:ok, remote_user}
 484     end
 485
 486     test "has a matching host" do
 487       clear_config([:mrf_simple, :avatar_removal], [{"remote.instance", ""}])
 488
 489       remote_user = build_remote_user()
 490       {:ok, filtered} = SimplePolicy.filter(remote_user)
 491
 492       refute filtered["icon"]
 493     end
 494
 495     test "match with wildcard domain" do
 496       clear_config([:mrf_simple, :avatar_removal], [{"*.remote.instance", ""}])
 497
 498       remote_user = build_remote_user()
 499       {:ok, filtered} = SimplePolicy.filter(remote_user)
 500
 501       refute filtered["icon"]
 502     end
 503   end
 504
 505   describe "when :banner_removal" do
 506     test "is empty" do
 507       clear_config([:mrf_simple, :banner_removal], [])
 508
 509       remote_user = build_remote_user()
 510
 511       assert SimplePolicy.filter(remote_user) == {:ok, remote_user}
 512     end
 513
 514     test "is not empty but it doesn't have a matching host" do
 515       clear_config([:mrf_simple, :banner_removal], [{"non.matching.remote", ""}])
 516
 517       remote_user = build_remote_user()
 518
 519       assert SimplePolicy.filter(remote_user) == {:ok, remote_user}
 520     end
 521
 522     test "has a matching host" do
 523       clear_config([:mrf_simple, :banner_removal], [{"remote.instance", ""}])
 524
 525       remote_user = build_remote_user()
 526       {:ok, filtered} = SimplePolicy.filter(remote_user)
 527
 528       refute filtered["image"]
 529     end
 530
 531     test "match with wildcard domain" do
 532       clear_config([:mrf_simple, :banner_removal], [{"*.remote.instance", ""}])
 533
 534       remote_user = build_remote_user()
 535       {:ok, filtered} = SimplePolicy.filter(remote_user)
 536
 537       refute filtered["image"]
 538     end
 539   end
 540
 541   describe "when :reject_deletes is empty" do
 542     setup do: clear_config([:mrf_simple, :reject_deletes], [])
 543
 544     test "it accepts deletions even from rejected servers" do
 545       clear_config([:mrf_simple, :reject], [{"remote.instance", ""}])
 546
 547       deletion_message = build_remote_deletion_message()
 548
 549       assert SimplePolicy.filter(deletion_message) == {:ok, deletion_message}
 550     end
 551
 552     test "it accepts deletions even from non-whitelisted servers" do
 553       clear_config([:mrf_simple, :accept], [{"non.matching.remote", ""}])
 554
 555       deletion_message = build_remote_deletion_message()
 556
 557       assert SimplePolicy.filter(deletion_message) == {:ok, deletion_message}
 558     end
 559   end
 560
 561   describe "when :reject_deletes is not empty but it doesn't have a matching host" do
 562     setup do: clear_config([:mrf_simple, :reject_deletes], [{"non.matching.remote", ""}])
 563
 564     test "it accepts deletions even from rejected servers" do
 565       clear_config([:mrf_simple, :reject], [{"remote.instance", ""}])
 566
 567       deletion_message = build_remote_deletion_message()
 568
 569       assert SimplePolicy.filter(deletion_message) == {:ok, deletion_message}
 570     end
 571
 572     test "it accepts deletions even from non-whitelisted servers" do
 573       clear_config([:mrf_simple, :accept], [{"non.matching.remote", ""}])
 574
 575       deletion_message = build_remote_deletion_message()
 576
 577       assert SimplePolicy.filter(deletion_message) == {:ok, deletion_message}
 578     end
 579   end
 580
 581   describe "when :reject_deletes has a matching host" do
 582     setup do: clear_config([:mrf_simple, :reject_deletes], [{"remote.instance", ""}])
 583
 584     test "it rejects the deletion" do
 585       deletion_message = build_remote_deletion_message()
 586
 587       assert {:reject, _} = SimplePolicy.filter(deletion_message)
 588     end
 589   end
 590
 591   describe "when :reject_deletes match with wildcard domain" do
 592     setup do: clear_config([:mrf_simple, :reject_deletes], [{"*.remote.instance", ""}])
 593
 594     test "it rejects the deletion" do
 595       deletion_message = build_remote_deletion_message()
 596
 597       assert {:reject, _} = SimplePolicy.filter(deletion_message)
 598     end
 599   end
 600
 601   defp build_local_message do
 602     %{
 603       "actor" => "#{Pleroma.Web.Endpoint.url()}/users/alice",
 604       "to" => [],
 605       "cc" => []
 606     }
 607   end
 608
 609   defp build_remote_message do
 610     %{"actor" => "https://remote.instance/users/bob"}
 611   end
 612
 613   defp build_remote_user do
 614     %{
 615       "id" => "https://remote.instance/users/bob",
 616       "icon" => %{
 617         "url" => "http://example.com/image.jpg",
 618         "type" => "Image"
 619       },
 620       "image" => %{
 621         "url" => "http://example.com/image.jpg",
 622         "type" => "Image"
 623       },
 624       "type" => "Person"
 625     }
 626   end
 627
 628   defp build_remote_deletion_message do
 629     %{
 630       "type" => "Delete",
 631       "actor" => "https://remote.instance/users/bob"
 632     }
 633   end
 634 end