Sharkey/packages/backend/test/unit/misc/check-against-url.ts
dakkar c05cc63e24 look inside url when checking activity origin - #512
The previous assertion that:

> if it's a complicated thing and the `activity.id` doesn't match, I
> think we're fine rejecting the activity

was wrong: at least peertube sends activities that have `url` as an
array of objects.

Notice that this does *not*, in fact, fix #512: the peertube activity
does not contain its short URL (`https://example.com/w/someid`), so
there's no way to confirm that it is the activity we requested.
2024-05-18 16:48:10 +01:00

51 lines
1.9 KiB
TypeScript

/*
* SPDX-FileCopyrightText: dakkar and sharkey-project
* SPDX-License-Identifier: AGPL-3.0-only
*/
import type { IObject } from '@/core/activitypub/type.js';
import { describe, expect, test } from '@jest/globals';
import { assertActivityMatchesUrls } from '@/core/activitypub/misc/check-against-url.js';
function assertOne(activity: IObject) {
// return a function so we can use `.toThrow`
return () => assertActivityMatchesUrls(activity, ['good']);
}
describe('assertActivityMatchesUrls', () => {
test('id', () => {
expect(assertOne({ id: 'bad' })).toThrow(/bad Activity/);
expect(assertOne({ id: 'good' })).not.toThrow();
});
test('simple url', () => {
expect(assertOne({ url: 'bad' })).toThrow(/bad Activity/);
expect(assertOne({ url: 'good' })).not.toThrow();
});
test('array of urls', () => {
expect(assertOne({ url: ['bad'] })).toThrow(/bad Activity/);
expect(assertOne({ url: ['bad', 'other'] })).toThrow(/bad Activity/);
expect(assertOne({ url: ['good'] })).not.toThrow();
expect(assertOne({ url: ['bad', 'good'] })).not.toThrow();
});
test('array of objects', () => {
expect(assertOne({ url: [{ href: 'bad' }] })).toThrow(/bad Activity/);
expect(assertOne({ url: [{ href: 'bad' }, { href: 'other' }] })).toThrow(/bad Activity/);
expect(assertOne({ url: [{ href: 'good' }] })).not.toThrow();
expect(assertOne({ url: [{ href: 'bad' }, { href: 'good' }] })).not.toThrow();
});
test('mixed array', () => {
expect(assertOne({ url: [{ href: 'bad' }, 'other'] })).toThrow(/bad Activity/);
expect(assertOne({ url: [{ href: 'bad' }, 'good'] })).not.toThrow();
expect(assertOne({ url: ['bad', { href: 'good' }] })).not.toThrow();
});
test('id and url', () => {
expect(assertOne({ id: 'other', url: 'bad' })).toThrow(/bad Activity/);
expect(assertOne({ id: 'bad', url: 'good' })).not.toThrow();
expect(assertOne({ id: 'good', url: 'bad' })).not.toThrow();
});
});