Merge branch 'mastodon:stable-4.2' into stable-4.2

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to this project will be documented in this file.
 
+## [4.2.7] - 2024-02-16
+
+### Fixed
+
+- Fix OmniAuth tests and edge cases in error handling ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/29201), [ClearlyClaire](https://github.com/mastodon/mastodon/pull/29207))
+- Fix new installs by upgrading to the latest release of the `nsa` gem, instead of a no longer existing commit ([mjankowski](https://github.com/mastodon/mastodon/pull/29065))
+
+### Security
+
+- Fix insufficient checking of remote posts ([GHSA-jhrq-qvrm-qr36](https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36))
+
 ## [4.2.6] - 2024-02-14
 
 ### Security

Gemfile

@@ -61,7 +61,7 @@ gem 'kaminari', '~> 1.2'
 gem 'link_header', '~> 0.0'
 gem 'mime-types', '~> 3.5.0', require: 'mime/types/columnar'
 gem 'nokogiri', '~> 1.15'
-gem 'nsa', github: 'jhawthorn/nsa', ref: 'e020fcc3a54d993ab45b7194d89ab720296c111b'
+gem 'nsa'
 gem 'oj', '~> 3.14'
 gem 'ox', '~> 2.14'
 gem 'parslet'

Gemfile.lock

@@ -7,17 +7,6 @@ GIT
  hkdf (~> 0.2)
  jwt (~> 2.0)
 
-GIT
- remote: https://github.com/jhawthorn/nsa.git
- revision: e020fcc3a54d993ab45b7194d89ab720296c111b
- ref: e020fcc3a54d993ab45b7194d89ab720296c111b
- specs:
- nsa (0.2.8)
- activesupport (>= 4.2, < 7.2)
- concurrent-ruby (~> 1.0, >= 1.0.2)
- sidekiq (>= 3.5)
- statsd-ruby (~> 1.4, >= 1.4.0)
-
 GIT
  remote: https://github.com/mastodon/rails-settings-cached.git
  revision: 86328ef0bd04ce21cc0504ff5e334591e8c2ccab
@@ -483,6 +472,11 @@ GEM
  nokogiri (1.16.2)
  mini_portile2 (~> 2.8.2)
  racc (~> 1.4)
+ nsa (0.3.0)
+ activesupport (>= 4.2, < 7.2)
+ concurrent-ruby (~> 1.0, >= 1.0.2)
+ sidekiq (>= 3.5)
+ statsd-ruby (~> 1.4, >= 1.4.0)
  oj (3.16.1)
  omniauth (2.1.1)
  hashie (>= 3.4.6)
@@ -520,7 +514,7 @@ GEM
  parslet (2.0.0)
  pastel (0.8.0)
  tty-color (~> 0.5)
- pg (1.5.4)
+ pg (1.5.5)
  pghero (3.3.4)
  activerecord (>= 6)
  posix-spawn (0.3.15)
@@ -884,7 +878,7 @@ DEPENDENCIES
  net-http (~> 0.3.2)
  net-ldap (~> 0.18)
  nokogiri (~> 1.15)
- nsa!
+ nsa
  oj (~> 3.14)
  omniauth (~> 2.0)
  omniauth-cas!

SECURITY.md

@@ -13,8 +13,8 @@ A "vulnerability in Mastodon" is a vulnerability in the code distributed through
 
 ## Supported Versions
 
-| Version | Supported  |
-| ------- | ---------------- |
-| 4.2.x | Yes  |
-| 4.1.x | Yes  |
-| < 4.1 | No  |
+| Version | Supported |
+| ------- | --------- |
+| 4.2.x | Yes |
+| 4.1.x | Yes |
+| < 4.1 | No |

app/controllers/auth/omniauth_callbacks_controller.rb

@@ -16,6 +16,9 @@ def self.provides_callback_for(provider)
  session["devise.#{provider}_data"] = request.env['omniauth.auth']
  redirect_to new_user_registration_url
  end
+ rescue ActiveRecord::RecordInvalid
+ flash[:alert] = I18n.t('devise.failure.omniauth_user_creation_failure') if is_navigational_format?
+ redirect_to new_user_session_url
  end
  end
 

app/helpers/jsonld_helper.rb

@@ -174,7 +174,19 @@ def fetch_resource_without_id_validation(uri, on_behalf_of = nil, raise_on_tempo
  build_request(uri, on_behalf_of, options: request_options).perform do |response|
  raise Mastodon::UnexpectedResponseError, response unless response_successful?(response) || response_error_unsalvageable?(response) || !raise_on_temporary_error
 
- body_to_json(response.body_with_limit) if response.code == 200
+ body_to_json(response.body_with_limit) if response.code == 200 && valid_activitypub_content_type?(response)
+ end
+ end
+
+ def valid_activitypub_content_type?(response)
+ return true if response.mime_type == 'application/activity+json'
+
+ # When the mime type is `application/ld+json`, we need to check the profile,
+ # but `http.rb` does not parse it for us.
+ return false unless response.mime_type == 'application/ld+json'
+
+ response.headers[HTTP::Headers::CONTENT_TYPE]&.split(';')&.map(&:strip)&.any? do |str|
+ str.start_with?('profile="') && str[9...-1].split.include?('https://www.w3.org/ns/activitystreams')
  end
  end
 

app/services/fetch_resource_service.rb

@@ -44,7 +44,7 @@ def process_response(response, terminal = false)
  @response_code = response.code
  return nil if response.code != 200
 
- if ['application/activity+json', 'application/ld+json'].include?(response.mime_type)
+ if valid_activitypub_content_type?(response)
  body = response.body_with_limit
  json = body_to_json(body)
 

config/locales/devise.en.yml

@@ -12,6 +12,7 @@ en:
  last_attempt: You have one more attempt before your account is locked.
  locked: Your account is locked.
  not_found_in_database: Invalid %{authentication_keys} or password.
+ omniauth_user_creation_failure: Error creating an account for this identity.
  pending: Your account is still under review.
  timeout: Your session expired. Please login again to continue.
  unauthenticated: You need to login or sign up before continuing.

docker-compose.yml

@@ -56,7 +56,7 @@ services:
 
  web:
  build: .
- image: ghcr.io/mastodon/mastodon:v4.2.6
+ image: ghcr.io/mastodon/mastodon:v4.2.7
  restart: always
  env_file: .env.production
  command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
@@ -77,7 +77,7 @@ services:
 
  streaming:
  build: .
- image: ghcr.io/mastodon/mastodon:v4.2.6
+ image: ghcr.io/mastodon/mastodon:v4.2.7
  restart: always
  env_file: .env.production
  command: node ./streaming
@@ -95,7 +95,7 @@ services:
 
  sidekiq:
  build: .
- image: ghcr.io/mastodon/mastodon:v4.2.6
+ image: ghcr.io/mastodon/mastodon:v4.2.7
  restart: always
  env_file: .env.production
  command: bundle exec sidekiq

lib/mastodon/version.rb

@@ -13,7 +13,7 @@ def minor
  end
 
  def patch
- 6
+ 7
  end
 
  def default_prerelease

spec/helpers/jsonld_helper_spec.rb

@@ -56,36 +56,36 @@
  describe '#fetch_resource' do
  context 'when the second argument is false' do
  it 'returns resource even if the retrieved ID and the given URI does not match' do
- stub_request(:get, 'https://bob.test/').to_return body: '{"id": "https://alice.test/"}'
- stub_request(:get, 'https://alice.test/').to_return body: '{"id": "https://alice.test/"}'
+ stub_request(:get, 'https://bob.test/').to_return(body: '{"id": "https://alice.test/"}', headers: { 'Content-Type': 'application/activity+json' })
+ stub_request(:get, 'https://alice.test/').to_return(body: '{"id": "https://alice.test/"}', headers: { 'Content-Type': 'application/activity+json' })
 
  expect(fetch_resource('https://bob.test/', false)).to eq({ 'id' => 'https://alice.test/' })
  end
 
  it 'returns nil if the object identified by the given URI and the object identified by the retrieved ID does not match' do
- stub_request(:get, 'https://mallory.test/').to_return body: '{"id": "https://marvin.test/"}'
- stub_request(:get, 'https://marvin.test/').to_return body: '{"id": "https://alice.test/"}'
+ stub_request(:get, 'https://mallory.test/').to_return(body: '{"id": "https://marvin.test/"}', headers: { 'Content-Type': 'application/activity+json' })
+ stub_request(:get, 'https://marvin.test/').to_return(body: '{"id": "https://alice.test/"}', headers: { 'Content-Type': 'application/activity+json' })
 
  expect(fetch_resource('https://mallory.test/', false)).to be_nil
  end
  end
 
  context 'when the second argument is true' do
  it 'returns nil if the retrieved ID and the given URI does not match' do
- stub_request(:get, 'https://mallory.test/').to_return body: '{"id": "https://alice.test/"}'
+ stub_request(:get, 'https://mallory.test/').to_return(body: '{"id": "https://alice.test/"}', headers: { 'Content-Type': 'application/activity+json' })
  expect(fetch_resource('https://mallory.test/', true)).to be_nil
  end
  end
  end
 
  describe '#fetch_resource_without_id_validation' do
  it 'returns nil if the status code is not 200' do
- stub_request(:get, 'https://host.test/').to_return status: 400, body: '{}'
+ stub_request(:get, 'https://host.test/').to_return(status: 400, body: '{}', headers: { 'Content-Type': 'application/activity+json' })
  expect(fetch_resource_without_id_validation('https://host.test/')).to be_nil
  end
 
  it 'returns hash' do
- stub_request(:get, 'https://host.test/').to_return status: 200, body: '{}'
+ stub_request(:get, 'https://host.test/').to_return(status: 200, body: '{}', headers: { 'Content-Type': 'application/activity+json' })
  expect(fetch_resource_without_id_validation('https://host.test/')).to eq({})
  end
  end

spec/lib/activitypub/activity/announce_spec.rb

@@ -35,7 +35,7 @@
  context 'when sender is followed by a local account' do
  before do
  Fabricate(:account).follow!(sender)
- stub_request(:get, 'https://example.com/actor/hello-world').to_return(body: Oj.dump(unknown_object_json))
+ stub_request(:get, 'https://example.com/actor/hello-world').to_return(body: Oj.dump(unknown_object_json), headers: { 'Content-Type': 'application/activity+json' })
  subject.perform
  end
 
@@ -120,7 +120,7 @@
  let(:object_json) { 'https://example.com/actor/hello-world' }
 
  before do
- stub_request(:get, 'https://example.com/actor/hello-world').to_return(body: Oj.dump(unknown_object_json))
+ stub_request(:get, 'https://example.com/actor/hello-world').to_return(body: Oj.dump(unknown_object_json), headers: { 'Content-Type': 'application/activity+json' })
  end
 
  context 'when the relay is enabled' do

spec/requests/omniauth_callbacks_spec.rb

@@ -60,11 +60,13 @@
  end
 
  context 'when ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH is not set to true' do
- it 'does not match the existing user or create an identity' do
+ it 'does not match the existing user or create an identity, and redirects to login page' do
  expect { subject }
  .to not_change(User, :count)
  .and not_change(Identity, :count)
  .and not_change(LoginActivity, :count)
+
+ expect(response).to redirect_to(new_user_session_url)
  end
  end
  end

spec/services/activitypub/fetch_featured_collection_service_spec.rb

@@ -62,10 +62,10 @@
 
  shared_examples 'sets pinned posts' do
  before do
- stub_request(:get, 'https://example.com/account/pinned/known').to_return(status: 200, body: Oj.dump(status_json_pinned_known))
- stub_request(:get, 'https://example.com/account/pinned/unknown-inlined').to_return(status: 200, body: Oj.dump(status_json_pinned_unknown_inlined))
+ stub_request(:get, 'https://example.com/account/pinned/known').to_return(status: 200, body: Oj.dump(status_json_pinned_known), headers: { 'Content-Type': 'application/activity+json' })
+ stub_request(:get, 'https://example.com/account/pinned/unknown-inlined').to_return(status: 200, body: Oj.dump(status_json_pinned_unknown_inlined), headers: { 'Content-Type': 'application/activity+json' })
  stub_request(:get, 'https://example.com/account/pinned/unknown-unreachable').to_return(status: 404)
- stub_request(:get, 'https://example.com/account/pinned/unknown-reachable').to_return(status: 200, body: Oj.dump(status_json_pinned_unknown_reachable))
+ stub_request(:get, 'https://example.com/account/pinned/unknown-reachable').to_return(status: 200, body: Oj.dump(status_json_pinned_unknown_reachable), headers: { 'Content-Type': 'application/activity+json' })
 
  subject.call(actor, note: true, hashtag: false)
  end
@@ -82,7 +82,7 @@
  describe '#call' do
  context 'when the endpoint is a Collection' do
  before do
- stub_request(:get, actor.featured_collection_url).to_return(status: 200, body: Oj.dump(payload))
+ stub_request(:get, actor.featured_collection_url).to_return(status: 200, body: Oj.dump(payload), headers: { 'Content-Type': 'application/activity+json' })
  end
 
  it_behaves_like 'sets pinned posts'
@@ -99,7 +99,7 @@
  end
 
  before do
- stub_request(:get, actor.featured_collection_url).to_return(status: 200, body: Oj.dump(payload))
+ stub_request(:get, actor.featured_collection_url).to_return(status: 200, body: Oj.dump(payload), headers: { 'Content-Type': 'application/activity+json' })
  end
 
  it_behaves_like 'sets pinned posts'
@@ -108,7 +108,7 @@
  let(:items) { 'https://example.com/account/pinned/unknown-reachable' }
 
  before do
- stub_request(:get, 'https://example.com/account/pinned/unknown-reachable').to_return(status: 200, body: Oj.dump(status_json_pinned_unknown_reachable))
+ stub_request(:get, 'https://example.com/account/pinned/unknown-reachable').to_return(status: 200, body: Oj.dump(status_json_pinned_unknown_reachable), headers: { 'Content-Type': 'application/activity+json' })
  subject.call(actor, note: true, hashtag: false)
  end
 
@@ -135,7 +135,7 @@
  end
 
  before do
- stub_request(:get, actor.featured_collection_url).to_return(status: 200, body: Oj.dump(payload))
+ stub_request(:get, actor.featured_collection_url).to_return(status: 200, body: Oj.dump(payload), headers: { 'Content-Type': 'application/activity+json' })
  end
 
  it_behaves_like 'sets pinned posts'
@@ -144,7 +144,7 @@
  let(:items) { 'https://example.com/account/pinned/unknown-reachable' }
 
  before do
- stub_request(:get, 'https://example.com/account/pinned/unknown-reachable').to_return(status: 200, body: Oj.dump(status_json_pinned_unknown_reachable))
+ stub_request(:get, 'https://example.com/account/pinned/unknown-reachable').to_return(status: 200, body: Oj.dump(status_json_pinned_unknown_reachable), headers: { 'Content-Type': 'application/activity+json' })
  subject.call(actor, note: true, hashtag: false)
  end
 

spec/services/activitypub/fetch_featured_tags_collection_service_spec.rb

@@ -38,15 +38,15 @@
  describe '#call' do
  context 'when the endpoint is a Collection' do
  before do
- stub_request(:get, collection_url).to_return(status: 200, body: Oj.dump(payload))
+ stub_request(:get, collection_url).to_return(status: 200, body: Oj.dump(payload), headers: { 'Content-Type': 'application/activity+json' })
  end
 
  it_behaves_like 'sets featured tags'
  end
 
  context 'when the account already has featured tags' do
  before do
- stub_request(:get, collection_url).to_return(status: 200, body: Oj.dump(payload))
+ stub_request(:get, collection_url).to_return(status: 200, body: Oj.dump(payload), headers: { 'Content-Type': 'application/activity+json' })
 
  actor.featured_tags.create!(name: 'FoO')
  actor.featured_tags.create!(name: 'baz')
@@ -67,7 +67,7 @@
  end
 
  before do
- stub_request(:get, collection_url).to_return(status: 200, body: Oj.dump(payload))
+ stub_request(:get, collection_url).to_return(status: 200, body: Oj.dump(payload), headers: { 'Content-Type': 'application/activity+json' })
  end
 
  it_behaves_like 'sets featured tags'
@@ -88,7 +88,7 @@
  end
 
  before do
- stub_request(:get, collection_url).to_return(status: 200, body: Oj.dump(payload))
+ stub_request(:get, collection_url).to_return(status: 200, body: Oj.dump(payload), headers: { 'Content-Type': 'application/activity+json' })
  end
 
  it_behaves_like 'sets featured tags'

spec/services/activitypub/fetch_remote_account_service_spec.rb

@@ -44,7 +44,7 @@
  before do
  actor[:inbox] = nil
 
- stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor))
+ stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor), headers: { 'Content-Type': 'application/activity+json' })
  stub_request(:get, 'https://example.com/.well-known/webfinger?resource=acct:alice@example.com').to_return(body: Oj.dump(webfinger), headers: { 'Content-Type': 'application/jrd+json' })
  end
 
@@ -67,7 +67,7 @@
  let!(:webfinger) { { subject: 'acct:alice@example.com', links: [{ rel: 'self', href: 'https://example.com/alice' }] } }
 
  before do
- stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor))
+ stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor), headers: { 'Content-Type': 'application/activity+json' })
  stub_request(:get, 'https://example.com/.well-known/webfinger?resource=acct:alice@example.com').to_return(body: Oj.dump(webfinger), headers: { 'Content-Type': 'application/jrd+json' })
  end
 
@@ -93,7 +93,7 @@
  let!(:webfinger) { { subject: 'acct:alice@iscool.af', links: [{ rel: 'self', href: 'https://example.com/alice' }] } }
 
  before do
- stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor))
+ stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor), headers: { 'Content-Type': 'application/activity+json' })
  stub_request(:get, 'https://example.com/.well-known/webfinger?resource=acct:alice@example.com').to_return(body: Oj.dump(webfinger), headers: { 'Content-Type': 'application/jrd+json' })
  stub_request(:get, 'https://iscool.af/.well-known/webfinger?resource=acct:alice@iscool.af').to_return(body: Oj.dump(webfinger), headers: { 'Content-Type': 'application/jrd+json' })
  end
@@ -125,7 +125,7 @@
  let!(:webfinger) { { subject: 'acct:alice@example.com', links: [{ rel: 'self', href: 'https://example.com/bob' }] } }
 
  before do
- stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor))
+ stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor), headers: { 'Content-Type': 'application/activity+json' })
  stub_request(:get, 'https://example.com/.well-known/webfinger?resource=acct:alice@example.com').to_return(body: Oj.dump(webfinger), headers: { 'Content-Type': 'application/jrd+json' })
  end
 
@@ -148,7 +148,7 @@
  let!(:webfinger) { { subject: 'acct:alice@iscool.af', links: [{ rel: 'self', href: 'https://example.com/bob' }] } }
 
  before do
- stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor))
+ stub_request(:get, 'https://example.com/alice').to_return(body: Oj.dump(actor), headers: { 'Content-Type': 'application/activity+json' })
  stub_request(:get, 'https://example.com/.well-known/webfinger?resource=acct:alice@example.com').to_return(body: Oj.dump(webfinger), headers: { 'Content-Type': 'application/jrd+json' })
  stub_request(:get, 'https://iscool.af/.well-known/webfinger?resource=acct:alice@iscool.af').to_return(body: Oj.dump(webfinger), headers: { 'Content-Type': 'application/jrd+json' })
  end