laoxong/misskey
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

masterブランチをmaster_securityとマージ (#9260)

Browse Source 
* Fix: forkbomb 2

* 12.119.2

Co-authored-by: mei23 <m@m544.net>
This commit is contained in:
rinsuki 2022-12-04 05:34:51 +09:00 committed by GitHub
parent fccd9c32e8
commit fcabc99303
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG.md
View File

@ -9,6 +9,10 @@
You should also include the user name that made the change. You should also include the user name that made the change.
--> -->
## 12.119.2 (2022/12/04)
### Bugfixes
- Server: Backported versions mitigate isn't working @mei23
## 12.119.1 (2022/12/03) ## 12.119.1 (2022/12/03)
### Bugfixes ### Bugfixes
- Server: Mitigate AP reference chain DoS vector @skehmatics - Server: Mitigate AP reference chain DoS vector @skehmatics

2
package.json
View File

@ -1,6 +1,6 @@
{ {
"name": "misskey", "name": "misskey",
"version": "12.119.1", "version": "12.119.2",
"codename": "indigo", "codename": "indigo",
"repository": { "repository": {
"type": "git", "type": "git",

4
packages/backend/src/remote/activitypub/models/mention.ts
View File

@ -5,11 +5,9 @@ import { IObject, isMention, IApMention } from '../type.js';
import Resolver from '../resolver.js'; import Resolver from '../resolver.js';
import { resolvePerson } from './person.js'; import { resolvePerson } from './person.js';
export async function extractApMentions(tags: IObject | IObject[] | null | undefined) { export async function extractApMentions(tags: IObject | IObject[] | null | undefined, resolver: Resolver) {
const hrefs = unique(extractApMentionObjects(tags).map(x => x.href as string)); const hrefs = unique(extractApMentionObjects(tags).map(x => x.href as string));
const resolver = new Resolver();
const limit = promiseLimit<CacheableUser | null>(2); const limit = promiseLimit<CacheableUser | null>(2);
const mentionedUsers = (await Promise.all( const mentionedUsers = (await Promise.all(
hrefs.map(x => limit(() => resolvePerson(x, resolver).catch(() => null))), hrefs.map(x => limit(() => resolvePerson(x, resolver).catch(() => null))),

4
packages/backend/src/remote/activitypub/models/note.ts
View File

@ -97,7 +97,7 @@ export async function createNote(value: string | IObject, resolver?: Resolver, s
throw new Error('actor has been suspended'); throw new Error('actor has been suspended');
} }
const noteAudience = await parseAudience(actor, note.to, note.cc); const noteAudience = await parseAudience(actor, note.to, note.cc, resolver);
let visibility = noteAudience.visibility; let visibility = noteAudience.visibility;
const visibleUsers = noteAudience.visibleUsers; const visibleUsers = noteAudience.visibleUsers;
@ -111,7 +111,7 @@ export async function createNote(value: string | IObject, resolver?: Resolver, s
let isTalk = note._misskey_talk && visibility === 'specified'; let isTalk = note._misskey_talk && visibility === 'specified';
const apMentions = await extractApMentions(note.tag); const apMentions = await extractApMentions(note.tag, resolver);
const apHashtags = await extractApHashtags(note.tag); const apHashtags = await extractApHashtags(note.tag);
// 添付ファイル // 添付ファイル

1
packages/backend/src/remote/activitypub/resolver.ts
View File

@ -23,6 +23,7 @@ export default class Resolver {
constructor(recursionLimit = 100) { constructor(recursionLimit = 100) {
this.history = new Set(); this.history = new Set();
this.recursionLimit = recursionLimit;
} }
public getHistory(): string[] { public getHistory(): string[] {