check actor

MisskeyIO · Dec 28, 2024 · e7ba414 · e7ba414
1 parent 7c5db4b
commit e7ba414
Showing 1 changed file with 7 additions and 4 deletions.
diff --git a/packages/backend/src/core/activitypub/models/ApNoteService.ts b/packages/backend/src/core/activitypub/models/ApNoteService.ts
@@ -102,11 +102,14 @@ export class ApNoteService {
 			return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', 'invalid Note: published timestamp is malformed');
 		}
 
-		if (actor) {
-			const attribution = (object.attributedTo) ? getOneApId(object.attributedTo) : actor.uri;
+		if (actor?.uri) {
+			if (object.id && !this.utilityService.isRelatedUris(object.id, actor.uri)) {
+				return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', `invalid Note: id has unrelated host to actor. actor: ${actor.uri}, id: ${object.id}`);
+			}
 
-			if (attribution !== actor.uri) {
-				return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', `invalid Note: attribution does not match the actor that send it. attribution: ${attribution}, actor: ${actor.uri}`);
+			const attributedTo = object.attributedTo && getOneApId(object.attributedTo);
+			if (attributedTo && !this.utilityService.isRelatedUris(attributedTo, actor.uri)) {
+				return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', `invalid Note: attributedTo has unrelated host to actor. actor: ${actor.uri}, attributedTo: ${attributedTo}`);
 			}
 		}