Sanitize actor displaynames (#4864)
* Sanitize AP name possible XSS * Pull out sanitizing method + remove rendering markdown for AP chat messages * Add tests around AP message rendering and usernames * Add sanitization tests to AP integration test
This commit is contained in:
Gabe Kangas
@@ -1,57 +0,0 @@
|
||||
name: ActivityPub Federation Tests
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- "activitypub/**"
|
||||
- "webserver/**"
|
||||
- "test/automated/activitypub/**"
|
||||
- ".github/workflows/activitypub-federation-tests.yaml"
|
||||
pull_request:
|
||||
paths:
|
||||
- "activitypub/**"
|
||||
- "webserver/**"
|
||||
- "test/automated/activitypub/**"
|
||||
- ".github/workflows/activitypub-federation-tests.yaml"
|
||||
|
||||
jobs:
|
||||
federation-test:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- id: skip_check
|
||||
uses: fkirc/skip-duplicate-actions@v5
|
||||
with:
|
||||
concurrent_skipping: "same_content_newer"
|
||||
|
||||
- name: Check out repository code
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: "^1.23"
|
||||
cache: true
|
||||
|
||||
- name: Install Caddy
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl
|
||||
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
||||
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y caddy
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo apt-get install -y snac2 ffmpeg
|
||||
|
||||
- name: Run setup
|
||||
run: |
|
||||
cd test/automated/activitypub
|
||||
sudo ./setup.sh
|
||||
|
||||
- name: Run federation test
|
||||
run: |
|
||||
cd test/automated/activitypub
|
||||
CI=true USER_COUNT=20 ./run.sh
|
||||
@@ -1,47 +0,0 @@
|
||||
name: ActivityPub Follower Validation Tests
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- "activitypub/**"
|
||||
- "config/**"
|
||||
- "main.go"
|
||||
- "test/automated/activitypub/**"
|
||||
- ".github/workflows/activitypub-follower-validation-tests.yaml"
|
||||
pull_request:
|
||||
paths:
|
||||
- "activitypub/**"
|
||||
- "config/**"
|
||||
- "main.go"
|
||||
- "test/automated/activitypub/**"
|
||||
- ".github/workflows/activitypub-follower-validation-tests.yaml"
|
||||
|
||||
jobs:
|
||||
follower-validation-test:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- id: skip_check
|
||||
uses: fkirc/skip-duplicate-actions@v5
|
||||
with:
|
||||
concurrent_skipping: "same_content_newer"
|
||||
|
||||
- name: Check out repository code
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: "^1.23"
|
||||
cache: true
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y sqlite3 ffmpeg jq
|
||||
|
||||
- name: Run follower validation test
|
||||
timeout-minutes: 15
|
||||
run: |
|
||||
cd test/automated/activitypub
|
||||
./test-follower-validation.sh
|
||||
@@ -0,0 +1,130 @@
|
||||
name: ActivityPub Tests
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- "activitypub/**"
|
||||
- "core/chat/**"
|
||||
- "config/**"
|
||||
- "main.go"
|
||||
- "webserver/**"
|
||||
- "test/automated/activitypub/**"
|
||||
- ".github/workflows/activitypub-tests.yaml"
|
||||
pull_request:
|
||||
paths:
|
||||
- "activitypub/**"
|
||||
- "core/chat/**"
|
||||
- "config/**"
|
||||
- "main.go"
|
||||
- "webserver/**"
|
||||
- "test/automated/activitypub/**"
|
||||
- ".github/workflows/activitypub-tests.yaml"
|
||||
|
||||
jobs:
|
||||
federation-test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- id: skip_check
|
||||
uses: fkirc/skip-duplicate-actions@v5
|
||||
with:
|
||||
concurrent_skipping: "same_content_newer"
|
||||
|
||||
- name: Check out repository code
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: "^1.23"
|
||||
cache: true
|
||||
|
||||
- name: Install Caddy
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl
|
||||
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
||||
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y caddy
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo apt-get install -y snac2 ffmpeg
|
||||
|
||||
- name: Run setup
|
||||
run: |
|
||||
cd test/automated/activitypub
|
||||
sudo ./setup.sh
|
||||
|
||||
- name: Run federation test
|
||||
run: |
|
||||
cd test/automated/activitypub
|
||||
CI=true USER_COUNT=20 ./test-federation.sh
|
||||
|
||||
chat-sanitization-test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- id: skip_check
|
||||
uses: fkirc/skip-duplicate-actions@v5
|
||||
with:
|
||||
concurrent_skipping: "same_content_newer"
|
||||
|
||||
- name: Check out repository code
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: "^1.23"
|
||||
cache: true
|
||||
|
||||
- name: Install Caddy
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl
|
||||
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
||||
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y caddy
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo apt-get install -y snac2 ffmpeg
|
||||
|
||||
- name: Run setup
|
||||
run: |
|
||||
cd test/automated/activitypub
|
||||
sudo ./setup.sh
|
||||
|
||||
- name: Run chat sanitization test
|
||||
run: |
|
||||
cd test/automated/activitypub
|
||||
CI=true ./test-chat-sanitization.sh
|
||||
|
||||
follower-validation-test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- id: skip_check
|
||||
uses: fkirc/skip-duplicate-actions@v5
|
||||
with:
|
||||
concurrent_skipping: "same_content_newer"
|
||||
|
||||
- name: Check out repository code
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: "^1.23"
|
||||
cache: true
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y sqlite3 ffmpeg jq
|
||||
|
||||
- name: Run follower validation test
|
||||
timeout-minutes: 15
|
||||
run: |
|
||||
cd test/automated/activitypub
|
||||
./test-follower-validation.sh
|
||||
Reference in New Issue
Block a user