Merge branch 'fix/object-attachment-spoof' into 'develop'
authorrinpatch <rinpatch@sdf.org>
Tue, 3 Nov 2020 13:59:18 +0000 (13:59 +0000)
committerrinpatch <rinpatch@sdf.org>
Thu, 5 Nov 2020 13:32:54 +0000 (16:32 +0300)
commit5116859f0e53a5b79a01f764fa3baf4c2110df1b
treea632077c2e8a72decbbcad50b103766fba666218
parent4d693b5e54b46c8863c463503d270a0d61d79c37
Merge branch 'fix/object-attachment-spoof' into 'develop'

Fix object spoofing vulnerability in attachments

See merge request pleroma/secteam/pleroma!18
lib/pleroma/object/fetcher.ex
test/fixtures/spoofed-object.json [new file with mode: 0644]
test/pleroma/object/fetcher_test.exs
test/pleroma/object_test.exs
test/pleroma/web/activity_pub/activity_pub_test.exs
test/pleroma/web/activity_pub/transmogrifier/announce_handling_test.exs
test/pleroma/web/activity_pub/transmogrifier/article_handling_test.exs
test/pleroma/web/activity_pub/transmogrifier/audio_handling_test.exs
test/pleroma/web/activity_pub/transmogrifier/event_handling_test.exs
test/support/http_request_mock.ex