Merge branch 'hardening/stop-misusing-sharedinbox' into 'develop'

[akkoma] / test / object / fetcher_test.exs

diff --git a/test/object/fetcher_test.exs b/test/object/fetcher_test.exs
index 72f61678291d02deb61f6ccc8e8d87461fadae7c..482252cffa6fa10ca7346df8e7fbc77917b331a1 100644 (file)
--- a/test/object/fetcher_test.exs
+++ b/test/object/fetcher_test.exs
@@ -1,3 +1,7 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+

 defmodule Pleroma.Object.FetcherTest do
   use Pleroma.DataCase
 
 defmodule Pleroma.Object.FetcherTest do
   use Pleroma.DataCase
 


@@ -5,23 +9,49 @@ defmodule Pleroma.Object.FetcherTest do
   alias Pleroma.Object
   alias Pleroma.Object.Fetcher
   import Tesla.Mock
   alias Pleroma.Object
   alias Pleroma.Object.Fetcher
   import Tesla.Mock

+  import Mock

 
   setup do
 
   setup do

-    mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    mock(fn
+      %{method: :get, url: "https://mastodon.example.org/users/userisgone"} ->
+        %Tesla.Env{status: 410}
+
+      %{method: :get, url: "https://mastodon.example.org/users/userisgone404"} ->
+        %Tesla.Env{status: 404}
+
+      env ->
+        apply(HttpRequestMock, :request, [env])
+    end)
+

     :ok
   end
 
   describe "actor origin containment" do
     :ok
   end
 
   describe "actor origin containment" do

-    test "it rejects objects with a bogus origin" do
+    test_with_mock "it rejects objects with a bogus origin",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
 
     end
 

-    test "it rejects objects when attributedTo is wrong (variant 1)" do
+    test_with_mock "it rejects objects when attributedTo is wrong (variant 1)",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity2.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity2.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
 
     end
 

-    test "it rejects objects when attributedTo is wrong (variant 2)" do
+    test_with_mock "it rejects objects when attributedTo is wrong (variant 2)",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity3.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity3.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
   end
 
     end
   end
 


@@ -81,10 +111,73 @@ defmodule Pleroma.Object.FetcherTest do
     end
 
     test "all objects with fake directions are rejected by the object fetcher" do
     end
 
     test "all objects with fake directions are rejected by the object fetcher" do

-      {:error, _} =
-        Fetcher.fetch_and_contain_remote_object_from_id(
-          "https://info.pleroma.site/activity4.json"
-        )
+      assert {:error, _} =
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://info.pleroma.site/activity4.json"
+               )
+    end
+
+    test "handle HTTP 410 Gone response" do
+      assert {:error, "Object has been deleted"} ==
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://mastodon.example.org/users/userisgone"
+               )
+    end
+
+    test "handle HTTP 404 response" do
+      assert {:error, "Object has been deleted"} ==
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://mastodon.example.org/users/userisgone404"
+               )
+    end
+  end
+
+  describe "pruning" do
+    test "it can refetch pruned objects" do
+      object_id = "http://mastodon.example.org/@admin/99541947525187367"
+
+      {:ok, object} = Fetcher.fetch_object_from_id(object_id)
+
+      assert object
+
+      {:ok, _object} = Object.prune(object)
+
+      refute Object.get_by_ap_id(object_id)
+
+      {:ok, %Object{} = object_two} = Fetcher.fetch_object_from_id(object_id)
+
+      assert object.data["id"] == object_two.data["id"]
+      assert object.id != object_two.id
+    end
+  end
+
+  describe "signed fetches" do
+    test_with_mock "it signs fetches when configured to do so",
+                   Pleroma.Signature,
+                   [:passthrough],
+                   [] do
+      option = Pleroma.Config.get([:activitypub, :sign_object_fetches])
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], true)
+
+      Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
+
+      assert called(Pleroma.Signature.sign(:_, :_))
+
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], option)
+    end
+
+    test_with_mock "it doesn't sign fetches when not configured to do so",
+                   Pleroma.Signature,
+                   [:passthrough],
+                   [] do
+      option = Pleroma.Config.get([:activitypub, :sign_object_fetches])
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], false)
+
+      Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
+
+      refute called(Pleroma.Signature.sign(:_, :_))
+
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], option)

     end
   end
 end
     end
   end
 end