tests: add a test to verify the general fake direction protection works in all cases

diff --git a/test/fixtures/httpoison_mock/https__info.pleroma.site_activity4.json b/test/fixtures/httpoison_mock/https__info.pleroma.site_activity4.json
new file mode 100644 (file)
index 0000000..57a73b1
--- /dev/null
+++ b/test/fixtures/httpoison_mock/https__info.pleroma.site_activity4.json
@@ -0,0 +1,13 @@
+{
+        "@context": "https://www.w3.org/ns/activitystreams",
+        "attributedTo": "http://mastodon.example.org/users/admin",
+        "attachment": [],
+        "content": "<p>this post was not actually written by Haelwenn</p>",
+        "id": "http://mastodon.example.org/users/admin/activities/1234",
+        "published": "2018-09-01T22:15:00Z",
+        "tag": [],
+        "to": [
+            "https://www.w3.org/ns/activitystreams#Public"
+        ],
+        "type": "Note"
+}

diff --git a/test/support/httpoison_mock.ex b/test/support/httpoison_mock.ex
index e3310bb5df66badb125b8aaaef435331ba246636..0be09b6ce56b9ad403d2e56a7642a1312995c038 100644 (file)
--- a/test/support/httpoison_mock.ex
+++ b/test/support/httpoison_mock.ex
@@ -56,6 +56,14 @@ defmodule HTTPoisonMock do
      }}
   end
 
+  def get("https://info.pleroma.site/activity4.json", _, _) do
+    {:ok,
+     %Response{
+       status_code: 200,
+       body: File.read!("test/fixtures/httpoison_mock/https__info.pleroma.site_activity4.json")
+     }}
+  end
+
   def get("https://info.pleroma.site/actor.json", _, _) do
     {:ok,
      %Response{

diff --git a/test/web/activity_pub/transmogrifier_test.exs b/test/web/activity_pub/transmogrifier_test.exs
index f8a82dd5bf1cde9ef18f019cf35636ecbe7a9be5..9174d9b764f0d4886e62c5955ab3edc0acdd2927 100644 (file)
--- a/test/web/activity_pub/transmogrifier_test.exs
+++ b/test/web/activity_pub/transmogrifier_test.exs
@@ -967,5 +967,12 @@ defmodule Pleroma.Web.ActivityPub.TransmogrifierTest do
 
       {:error, _} = User.get_or_fetch_by_ap_id("https://n1u.moe/users/rye")
     end
+
+    test "all objects with fake directions are rejected by the object fetcher" do
+      {:error, _} =
+        ActivityPub.fetch_and_contain_remote_object_from_id(
+          "https://info.pleroma.site/activity4.json"
+        )
+    end
   end
 end