X-Git-Url: https://git.squeep.com/?a=blobdiff_plain;ds=sidebyside;f=test%2Fweb%2Factivity_pub%2Ftransmogrifier%2Fchat_message_test.exs;h=c5600e84eb17b94038832ca550ba0a3323b82423;hb=e055b8d2036e18a95d84f6f1db08fc465fe9975d;hp=5b238f9c4d4274475308c93c38d5f46b0cfbe9c7;hpb=41fdcb72828d52a23d57c41f910b02da5156e979;p=akkoma

diff --git a/test/web/activity_pub/transmogrifier/chat_message_test.exs b/test/web/activity_pub/transmogrifier/chat_message_test.exs
index 5b238f9c4..c5600e84e 100644
--- a/test/web/activity_pub/transmogrifier/chat_message_test.exs
+++ b/test/web/activity_pub/transmogrifier/chat_message_test.exs
@@ -8,6 +8,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.ChatMessageTest do
   import Pleroma.Factory
 
   alias Pleroma.Activity
+  alias Pleroma.Chat
   alias Pleroma.Object
   alias Pleroma.Web.ActivityPub.Transmogrifier
 
@@ -42,6 +43,22 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.ChatMessageTest do
       {:error, _} = Transmogrifier.handle_incoming(data)
     end
 
+    test "it rejects messages where the `to` field of activity and object don't match" do
+      data =
+        File.read!("test/fixtures/create-chat-message.json")
+        |> Poison.decode!()
+
+      author = insert(:user, ap_id: data["actor"])
+      _recipient = insert(:user, ap_id: List.first(data["to"]))
+
+      data =
+        data
+        |> Map.put("to", author.ap_id)
+
+      assert match?({:error, _}, Transmogrifier.handle_incoming(data))
+      refute Object.get_by_ap_id(data["object"]["id"])
+    end
+
     test "it inserts it and creates a chat" do
       data =
         File.read!("test/fixtures/create-chat-message.json")
@@ -51,12 +68,19 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.ChatMessageTest do
       recipient = insert(:user, ap_id: List.first(data["to"]), local: true)
 
       {:ok, %Activity{} = activity} = Transmogrifier.handle_incoming(data)
+      assert activity.local == false
 
       assert activity.actor == author.ap_id
       assert activity.recipients == [recipient.ap_id, author.ap_id]
 
       %Object{} = object = Object.get_by_ap_id(activity.data["object"])
+
       assert object
+      assert object.data["content"] == "You expected a cute girl? Too bad. alert('XSS')"
+      assert match?(%{"firefox" => _}, object.data["emoji"])
+
+      refute Chat.get(author.id, recipient.ap_id)
+      assert Chat.get(recipient.id, author.ap_id)
     end
   end
 end