Merge branch 'hardening/stop-misusing-sharedinbox' into 'develop'

[akkoma] / test / object / fetcher_test.exs

diff --git a/test/object/fetcher_test.exs b/test/object/fetcher_test.exs
index d604fd5f59f42e1528e8df22d10cd63b5fd68c39..482252cffa6fa10ca7346df8e7fbc77917b331a1 100644 (file)
--- a/test/object/fetcher_test.exs
+++ b/test/object/fetcher_test.exs
@@ -1,3 +1,7 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+

 defmodule Pleroma.Object.FetcherTest do
   use Pleroma.DataCase
 
 defmodule Pleroma.Object.FetcherTest do
   use Pleroma.DataCase
 


@@ -5,23 +9,49 @@ defmodule Pleroma.Object.FetcherTest do
   alias Pleroma.Object
   alias Pleroma.Object.Fetcher
   import Tesla.Mock
   alias Pleroma.Object
   alias Pleroma.Object.Fetcher
   import Tesla.Mock

+  import Mock

 
   setup do
 
   setup do

-    mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    mock(fn
+      %{method: :get, url: "https://mastodon.example.org/users/userisgone"} ->
+        %Tesla.Env{status: 410}
+
+      %{method: :get, url: "https://mastodon.example.org/users/userisgone404"} ->
+        %Tesla.Env{status: 404}
+
+      env ->
+        apply(HttpRequestMock, :request, [env])
+    end)
+

     :ok
   end
 
   describe "actor origin containment" do
     :ok
   end
 
   describe "actor origin containment" do

-    test "it rejects objects with a bogus origin" do
+    test_with_mock "it rejects objects with a bogus origin",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
 
     end
 

-    test "it rejects objects when attributedTo is wrong (variant 1)" do
+    test_with_mock "it rejects objects when attributedTo is wrong (variant 1)",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity2.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity2.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
 
     end
 

-    test "it rejects objects when attributedTo is wrong (variant 2)" do
+    test_with_mock "it rejects objects when attributedTo is wrong (variant 2)",
+                   Pleroma.Web.OStatus,
+                   [:passthrough],
+                   [] do

       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity3.json")
       {:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity3.json")

+
+      refute called(Pleroma.Web.OStatus.fetch_activity_from_url(:_))

     end
   end
 
     end
   end
 


@@ -81,10 +111,24 @@ defmodule Pleroma.Object.FetcherTest do
     end
 
     test "all objects with fake directions are rejected by the object fetcher" do
     end
 
     test "all objects with fake directions are rejected by the object fetcher" do

-      {:error, _} =
-        Fetcher.fetch_and_contain_remote_object_from_id(
-          "https://info.pleroma.site/activity4.json"
-        )
+      assert {:error, _} =
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://info.pleroma.site/activity4.json"
+               )
+    end
+
+    test "handle HTTP 410 Gone response" do
+      assert {:error, "Object has been deleted"} ==
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://mastodon.example.org/users/userisgone"
+               )
+    end
+
+    test "handle HTTP 404 response" do
+      assert {:error, "Object has been deleted"} ==
+               Fetcher.fetch_and_contain_remote_object_from_id(
+                 "https://mastodon.example.org/users/userisgone404"
+               )

     end
   end
 
     end
   end
 


@@ -106,4 +150,34 @@ defmodule Pleroma.Object.FetcherTest do
       assert object.id != object_two.id
     end
   end
       assert object.id != object_two.id
     end
   end

+
+  describe "signed fetches" do
+    test_with_mock "it signs fetches when configured to do so",
+                   Pleroma.Signature,
+                   [:passthrough],
+                   [] do
+      option = Pleroma.Config.get([:activitypub, :sign_object_fetches])
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], true)
+
+      Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
+
+      assert called(Pleroma.Signature.sign(:_, :_))
+
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], option)
+    end
+
+    test_with_mock "it doesn't sign fetches when not configured to do so",
+                   Pleroma.Signature,
+                   [:passthrough],
+                   [] do
+      option = Pleroma.Config.get([:activitypub, :sign_object_fetches])
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], false)
+
+      Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")
+
+      refute called(Pleroma.Signature.sign(:_, :_))
+
+      Pleroma.Config.put([:activitypub, :sign_object_fetches], option)
+    end
+  end

 end
 end