Merge branch 'hardening/stop-misusing-sharedinbox' into 'develop'

[akkoma] / test / object / fetcher_test.exs

diff --git a/test/object/fetcher_test.exs b/test/object/fetcher_test.exs
index 3bbade9d13104230c1d9f0c3cccb37131ea30ff7..482252cffa6fa10ca7346df8e7fbc77917b331a1 100644 (file)
--- a/test/object/fetcher_test.exs
+++ b/test/object/fetcher_test.exs
@@ -1,22 +1,57 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+

 defmodule Pleroma.Object.FetcherTest do
   use Pleroma.DataCase
 
 defmodule Pleroma.Object.FetcherTest do
   use Pleroma.DataCase
 

-  alias Pleroma.{Activity, Object}
+  alias Pleroma.Activity
+  alias Pleroma.Object

   alias Pleroma.Object.Fetcher
   alias Pleroma.Object.Fetcher

+  import Tesla.Mock
+  import Mock
+
+  setup do
+    mock(fn
+      %{method: :get, url: "https://mastodon.example.org/users/userisgone"} ->
+        %Tesla.Env{status: 410}
+
+      %{method: :get, url: "https://mastodon.example.org/users/userisgone404"} ->
+        %Tesla.Env{status: 404}

 
 

-  import Pleroma.Factory
+      env ->
+        apply(HttpRequestMock, :request, [env])
+    end)
+
+    :ok
+  end

 
   describe "actor origin containment" do
 
   describe "actor origin containment" do

-    test "it rejects objects with a bogus origin" do
+    test_with_mock "it rejects objects with a bogus origin",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
 
     end
 

-    test "it rejects objects when attributedTo is wrong (variant 1)" do
+    test_with_mock "it rejects objects when attributedTo is wrong (variant 1)",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity2.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity2.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
 
     end
 

-    test "it rejects objects when attributedTo is wrong (variant 2)" do
+    test_with_mock "it rejects objects when attributedTo is wrong (variant 2)",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity3.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity3.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
   end
 
     end
   end
 


@@ -25,7 +60,7 @@ defmodule Pleroma.Object.FetcherTest do
       {:ok, object} =
         Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
 
       {:ok, object} =
         Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
 

-      assert activity = Activity.get_create_activity_by_object_ap_id(object.data["id"])
+      assert activity = Activity.get_create_by_object_ap_id(object.data["id"])

       assert activity.data["id"]
 
       {:ok, object_again} =
       assert activity.data["id"]
 
       {:ok, object_again} =


@@ -39,7 +74,7 @@ defmodule Pleroma.Object.FetcherTest do
 
     test "it works with objects only available via Ostatus" do
       {:ok, object} = Fetcher.fetch_object_from_id("https://shitposter.club/notice/2827873")
 
     test "it works with objects only available via Ostatus" do
       {:ok, object} = Fetcher.fetch_object_from_id("https://shitposter.club/notice/2827873")

-      assert activity = Activity.get_create_activity_by_object_ap_id(object.data["id"])
+      assert activity = Activity.get_create_by_object_ap_id(object.data["id"])

       assert activity.data["id"]
 
       {:ok, object_again} = Fetcher.fetch_object_from_id("https://shitposter.club/notice/2827873")
       assert activity.data["id"]
 
       {:ok, object_again} = Fetcher.fetch_object_from_id("https://shitposter.club/notice/2827873")


@@ -76,10 +111,73 @@ defmodule Pleroma.Object.FetcherTest do
     end
 
     test "all objects with fake directions are rejected by the object fetcher" do
     end
 
     test "all objects with fake directions are rejected by the object fetcher" do

-      {:error, _} =
-        Fetcher.fetch_and_contain_remote_object_from_id(
-          "https://info.pleroma.site/activity4.json"
-        )
+      assert {:error, _} =
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://info.pleroma.site/activity4.json"
+               )
+    end
+
+    test "handle HTTP 410 Gone response" do
+      assert {:error, "Object has been deleted"} ==
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://mastodon.example.org/users/userisgone"
+               )
+    end
+
+    test "handle HTTP 404 response" do
+      assert {:error, "Object has been deleted"} ==
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://mastodon.example.org/users/userisgone404"
+               )
+    end
+  end
+
+  describe "pruning" do
+    test "it can refetch pruned objects" do
+      object_id = "http://mastodon.example.org/@admin/99541947525187367"
+
+      {:ok, object} = Fetcher.fetch_object_from_id(object_id)
+
+      assert object
+
+      {:ok, _object} = Object.prune(object)
+
+      refute Object.get_by_ap_id(object_id)
+
+      {:ok, %Object{} = object_two} = Fetcher.fetch_object_from_id(object_id)
+
+      assert object.data["id"] == object_two.data["id"]
+      assert object.id != object_two.id
+    end
+  end
+
+  describe "signed fetches" do
+    test_with_mock "it signs fetches when configured to do so",
+                   Pleroma.Signature,
+                   [:passthrough],
+                   [] do
+      option = Pleroma.Config.get([:activitypub, :sign_object_fetches])
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], true)
+
+      Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
+
+      assert called(Pleroma.Signature.sign(:_, :_))
+
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], option)
+    end
+
+    test_with_mock "it doesn't sign fetches when not configured to do so",
+                   Pleroma.Signature,
+                   [:passthrough],
+                   [] do
+      option = Pleroma.Config.get([:activitypub, :sign_object_fetches])
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], false)
+
+      Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
+
+      refute called(Pleroma.Signature.sign(:_, :_))
+
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], option)

     end
   end
 end
     end
   end
 end