Merge branch 'hardening/stop-misusing-sharedinbox' into 'develop'

[akkoma] / test / object / fetcher_test.exs

diff --git a/test/object/fetcher_test.exs b/test/object/fetcher_test.exs
index 568c5cc4c845d8955938d91f80548929105e9304..482252cffa6fa10ca7346df8e7fbc77917b331a1 100644 (file)
--- a/test/object/fetcher_test.exs
+++ b/test/object/fetcher_test.exs
@@ -1,21 +1,57 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+

 defmodule Pleroma.Object.FetcherTest do
   use Pleroma.DataCase
 
   alias Pleroma.Activity
   alias Pleroma.Object
   alias Pleroma.Object.Fetcher
 defmodule Pleroma.Object.FetcherTest do
   use Pleroma.DataCase
 
   alias Pleroma.Activity
   alias Pleroma.Object
   alias Pleroma.Object.Fetcher

+  import Tesla.Mock
+  import Mock
+
+  setup do
+    mock(fn
+      %{method: :get, url: "https://mastodon.example.org/users/userisgone"} ->
+        %Tesla.Env{status: 410}
+
+      %{method: :get, url: "https://mastodon.example.org/users/userisgone404"} ->
+        %Tesla.Env{status: 404}
+
+      env ->
+        apply(HttpRequestMock, :request, [env])
+    end)
+
+    :ok
+  end

 
   describe "actor origin containment" do
 
   describe "actor origin containment" do

-    test "it rejects objects with a bogus origin" do
+    test_with_mock "it rejects objects with a bogus origin",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
 
     end
 

-    test "it rejects objects when attributedTo is wrong (variant 1)" do
+    test_with_mock "it rejects objects when attributedTo is wrong (variant 1)",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity2.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity2.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
 
     end
 

-    test "it rejects objects when attributedTo is wrong (variant 2)" do
+    test_with_mock "it rejects objects when attributedTo is wrong (variant 2)",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity3.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity3.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
   end
 
     end
   end
 


@@ -24,7 +60,7 @@ defmodule Pleroma.Object.FetcherTest do
       {:ok, object} =
         Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
 
       {:ok, object} =
         Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
 

-      assert activity = Activity.get_create_activity_by_object_ap_id(object.data["id"])
+      assert activity = Activity.get_create_by_object_ap_id(object.data["id"])

       assert activity.data["id"]
 
       {:ok, object_again} =
       assert activity.data["id"]
 
       {:ok, object_again} =


@@ -38,7 +74,7 @@ defmodule Pleroma.Object.FetcherTest do
 
     test "it works with objects only available via Ostatus" do
       {:ok, object} = Fetcher.fetch_object_from_id("https://shitposter.club/notice/2827873")
 
     test "it works with objects only available via Ostatus" do
       {:ok, object} = Fetcher.fetch_object_from_id("https://shitposter.club/notice/2827873")

-      assert activity = Activity.get_create_activity_by_object_ap_id(object.data["id"])
+      assert activity = Activity.get_create_by_object_ap_id(object.data["id"])

       assert activity.data["id"]
 
       {:ok, object_again} = Fetcher.fetch_object_from_id("https://shitposter.club/notice/2827873")
       assert activity.data["id"]
 
       {:ok, object_again} = Fetcher.fetch_object_from_id("https://shitposter.club/notice/2827873")


@@ -75,10 +111,73 @@ defmodule Pleroma.Object.FetcherTest do
     end
 
     test "all objects with fake directions are rejected by the object fetcher" do
     end
 
     test "all objects with fake directions are rejected by the object fetcher" do

-      {:error, _} =
-        Fetcher.fetch_and_contain_remote_object_from_id(
-          "https://info.pleroma.site/activity4.json"
-        )
+      assert {:error, _} =
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://info.pleroma.site/activity4.json"
+               )
+    end
+
+    test "handle HTTP 410 Gone response" do
+      assert {:error, "Object has been deleted"} ==
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://mastodon.example.org/users/userisgone"
+               )
+    end
+
+    test "handle HTTP 404 response" do
+      assert {:error, "Object has been deleted"} ==
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://mastodon.example.org/users/userisgone404"
+               )
+    end
+  end
+
+  describe "pruning" do
+    test "it can refetch pruned objects" do
+      object_id = "http://mastodon.example.org/@admin/99541947525187367"
+
+      {:ok, object} = Fetcher.fetch_object_from_id(object_id)
+
+      assert object
+
+      {:ok, _object} = Object.prune(object)
+
+      refute Object.get_by_ap_id(object_id)
+
+      {:ok, %Object{} = object_two} = Fetcher.fetch_object_from_id(object_id)
+
+      assert object.data["id"] == object_two.data["id"]
+      assert object.id != object_two.id
+    end
+  end
+
+  describe "signed fetches" do
+    test_with_mock "it signs fetches when configured to do so",
+                   Pleroma.Signature,
+                   [:passthrough],
+                   [] do
+      option = Pleroma.Config.get([:activitypub, :sign_object_fetches])
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], true)
+
+      Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
+
+      assert called(Pleroma.Signature.sign(:_, :_))
+
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], option)
+    end
+
+    test_with_mock "it doesn't sign fetches when not configured to do so",
+                   Pleroma.Signature,
+                   [:passthrough],
+                   [] do
+      option = Pleroma.Config.get([:activitypub, :sign_object_fetches])
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], false)
+
+      Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
+
+      refute called(Pleroma.Signature.sign(:_, :_))
+
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], option)

     end
   end
 end
     end
   end
 end