mirror of
https://git.joinsharkey.org/Sharkey/Sharkey.git
synced 2024-11-26 01:33:08 +02:00
Compare commits
2 commits
9d6c24fb6d
...
68d8b11be7
| Author | SHA1 | Date | |
|---|---|---|---|
|
68d8b11be7 | ||
|
|
b6c59fa98e |
5 changed files with 209 additions and 150 deletions
|
|
@ -474,177 +474,177 @@ export class MfmService {
|
|||
}
|
||||
|
||||
const handlers: {
|
||||
[K in mfm.MfmNode['type']]: (node: mfm.NodeType<K>) => any;
|
||||
} = {
|
||||
async bold(node) {
|
||||
const el = doc.createElement('span');
|
||||
el.textContent = '**';
|
||||
await appendChildren(node.children, el);
|
||||
el.textContent += '**';
|
||||
return el;
|
||||
},
|
||||
[K in mfm.MfmNode['type']]: (node: mfm.NodeType<K>) => any;
|
||||
} = {
|
||||
async bold(node) {
|
||||
const el = doc.createElement('span');
|
||||
el.textContent = '**';
|
||||
await appendChildren(node.children, el);
|
||||
el.textContent += '**';
|
||||
return el;
|
||||
},
|
||||
|
||||
async small(node) {
|
||||
const el = doc.createElement('small');
|
||||
await appendChildren(node.children, el);
|
||||
return el;
|
||||
},
|
||||
async small(node) {
|
||||
const el = doc.createElement('small');
|
||||
await appendChildren(node.children, el);
|
||||
return el;
|
||||
},
|
||||
|
||||
async strike(node) {
|
||||
const el = doc.createElement('span');
|
||||
el.textContent = '~~';
|
||||
await appendChildren(node.children, el);
|
||||
el.textContent += '~~';
|
||||
return el;
|
||||
},
|
||||
async strike(node) {
|
||||
const el = doc.createElement('span');
|
||||
el.textContent = '~~';
|
||||
await appendChildren(node.children, el);
|
||||
el.textContent += '~~';
|
||||
return el;
|
||||
},
|
||||
|
||||
async italic(node) {
|
||||
const el = doc.createElement('span');
|
||||
el.textContent = '*';
|
||||
await appendChildren(node.children, el);
|
||||
el.textContent += '*';
|
||||
return el;
|
||||
},
|
||||
async italic(node) {
|
||||
const el = doc.createElement('span');
|
||||
el.textContent = '*';
|
||||
await appendChildren(node.children, el);
|
||||
el.textContent += '*';
|
||||
return el;
|
||||
},
|
||||
|
||||
async fn(node) {
|
||||
const el = doc.createElement('span');
|
||||
el.textContent = '*';
|
||||
await appendChildren(node.children, el);
|
||||
el.textContent += '*';
|
||||
return el;
|
||||
},
|
||||
async fn(node) {
|
||||
const el = doc.createElement('span');
|
||||
el.textContent = '*';
|
||||
await appendChildren(node.children, el);
|
||||
el.textContent += '*';
|
||||
return el;
|
||||
},
|
||||
|
||||
blockCode(node) {
|
||||
const pre = doc.createElement('pre');
|
||||
const inner = doc.createElement('code');
|
||||
blockCode(node) {
|
||||
const pre = doc.createElement('pre');
|
||||
const inner = doc.createElement('code');
|
||||
|
||||
const nodes = node.props.code
|
||||
.split(/\r\n|\r|\n/)
|
||||
.map((x) => doc.createTextNode(x));
|
||||
const nodes = node.props.code
|
||||
.split(/\r\n|\r|\n/)
|
||||
.map((x) => doc.createTextNode(x));
|
||||
|
||||
for (const x of intersperse<FIXME | 'br'>('br', nodes)) {
|
||||
inner.appendChild(x === 'br' ? doc.createElement('br') : x);
|
||||
}
|
||||
for (const x of intersperse<FIXME | 'br'>('br', nodes)) {
|
||||
inner.appendChild(x === 'br' ? doc.createElement('br') : x);
|
||||
}
|
||||
|
||||
pre.appendChild(inner);
|
||||
return pre;
|
||||
},
|
||||
pre.appendChild(inner);
|
||||
return pre;
|
||||
},
|
||||
|
||||
async center(node) {
|
||||
const el = doc.createElement('div');
|
||||
await appendChildren(node.children, el);
|
||||
return el;
|
||||
},
|
||||
async center(node) {
|
||||
const el = doc.createElement('div');
|
||||
await appendChildren(node.children, el);
|
||||
return el;
|
||||
},
|
||||
|
||||
emojiCode(node) {
|
||||
return doc.createTextNode(`\u200B:${node.props.name}:\u200B`);
|
||||
},
|
||||
emojiCode(node) {
|
||||
return doc.createTextNode(`\u200B:${node.props.name}:\u200B`);
|
||||
},
|
||||
|
||||
unicodeEmoji(node) {
|
||||
return doc.createTextNode(node.props.emoji);
|
||||
},
|
||||
unicodeEmoji(node) {
|
||||
return doc.createTextNode(node.props.emoji);
|
||||
},
|
||||
|
||||
hashtag: (node) => {
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('href', `${this.config.url}/tags/${node.props.hashtag}`);
|
||||
a.textContent = `#${node.props.hashtag}`;
|
||||
a.setAttribute('rel', 'tag');
|
||||
a.setAttribute('class', 'hashtag');
|
||||
return a;
|
||||
},
|
||||
hashtag: (node) => {
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('href', `${this.config.url}/tags/${node.props.hashtag}`);
|
||||
a.textContent = `#${node.props.hashtag}`;
|
||||
a.setAttribute('rel', 'tag');
|
||||
a.setAttribute('class', 'hashtag');
|
||||
return a;
|
||||
},
|
||||
|
||||
inlineCode(node) {
|
||||
const el = doc.createElement('code');
|
||||
el.textContent = node.props.code;
|
||||
return el;
|
||||
},
|
||||
inlineCode(node) {
|
||||
const el = doc.createElement('code');
|
||||
el.textContent = node.props.code;
|
||||
return el;
|
||||
},
|
||||
|
||||
mathInline(node) {
|
||||
const el = doc.createElement('code');
|
||||
el.textContent = node.props.formula;
|
||||
return el;
|
||||
},
|
||||
mathInline(node) {
|
||||
const el = doc.createElement('code');
|
||||
el.textContent = node.props.formula;
|
||||
return el;
|
||||
},
|
||||
|
||||
mathBlock(node) {
|
||||
const el = doc.createElement('code');
|
||||
el.textContent = node.props.formula;
|
||||
return el;
|
||||
},
|
||||
mathBlock(node) {
|
||||
const el = doc.createElement('code');
|
||||
el.textContent = node.props.formula;
|
||||
return el;
|
||||
},
|
||||
|
||||
async link(node) {
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('rel', 'nofollow noopener noreferrer');
|
||||
a.setAttribute('target', '_blank');
|
||||
a.setAttribute('href', node.props.url);
|
||||
await appendChildren(node.children, a);
|
||||
return a;
|
||||
},
|
||||
async link(node) {
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('rel', 'nofollow noopener noreferrer');
|
||||
a.setAttribute('target', '_blank');
|
||||
a.setAttribute('href', node.props.url);
|
||||
await appendChildren(node.children, a);
|
||||
return a;
|
||||
},
|
||||
|
||||
async mention(node) {
|
||||
const { username, host, acct } = node.props;
|
||||
const resolved = mentionedRemoteUsers.find(remoteUser => remoteUser.username === username && remoteUser.host === host);
|
||||
async mention(node) {
|
||||
const { username, host, acct } = node.props;
|
||||
const resolved = mentionedRemoteUsers.find(remoteUser => remoteUser.username === username && remoteUser.host === host);
|
||||
|
||||
const el = doc.createElement('span');
|
||||
if (!resolved) {
|
||||
el.textContent = acct;
|
||||
} else {
|
||||
el.setAttribute('class', 'h-card');
|
||||
el.setAttribute('translate', 'no');
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('href', resolved.url ? resolved.url : resolved.uri);
|
||||
a.className = 'u-url mention';
|
||||
const span = doc.createElement('span');
|
||||
span.textContent = resolved.username || username;
|
||||
a.textContent = '@';
|
||||
a.appendChild(span);
|
||||
el.appendChild(a);
|
||||
}
|
||||
const el = doc.createElement('span');
|
||||
if (!resolved) {
|
||||
el.textContent = acct;
|
||||
} else {
|
||||
el.setAttribute('class', 'h-card');
|
||||
el.setAttribute('translate', 'no');
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('href', resolved.url ? resolved.url : resolved.uri);
|
||||
a.className = 'u-url mention';
|
||||
const span = doc.createElement('span');
|
||||
span.textContent = resolved.username || username;
|
||||
a.textContent = '@';
|
||||
a.appendChild(span);
|
||||
el.appendChild(a);
|
||||
}
|
||||
|
||||
return el;
|
||||
},
|
||||
return el;
|
||||
},
|
||||
|
||||
async quote(node) {
|
||||
const el = doc.createElement('blockquote');
|
||||
await appendChildren(node.children, el);
|
||||
return el;
|
||||
},
|
||||
async quote(node) {
|
||||
const el = doc.createElement('blockquote');
|
||||
await appendChildren(node.children, el);
|
||||
return el;
|
||||
},
|
||||
|
||||
text(node) {
|
||||
const el = doc.createElement('span');
|
||||
const nodes = node.props.text
|
||||
.split(/\r\n|\r|\n/)
|
||||
.map((x) => doc.createTextNode(x));
|
||||
text(node) {
|
||||
const el = doc.createElement('span');
|
||||
const nodes = node.props.text
|
||||
.split(/\r\n|\r|\n/)
|
||||
.map((x) => doc.createTextNode(x));
|
||||
|
||||
for (const x of intersperse<FIXME | 'br'>('br', nodes)) {
|
||||
el.appendChild(x === 'br' ? doc.createElement('br') : x);
|
||||
}
|
||||
for (const x of intersperse<FIXME | 'br'>('br', nodes)) {
|
||||
el.appendChild(x === 'br' ? doc.createElement('br') : x);
|
||||
}
|
||||
|
||||
return el;
|
||||
},
|
||||
return el;
|
||||
},
|
||||
|
||||
url(node) {
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('rel', 'nofollow noopener noreferrer');
|
||||
a.setAttribute('target', '_blank');
|
||||
a.setAttribute('href', node.props.url);
|
||||
a.textContent = node.props.url.replace(/^https?:\/\//, '');
|
||||
return a;
|
||||
},
|
||||
url(node) {
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('rel', 'nofollow noopener noreferrer');
|
||||
a.setAttribute('target', '_blank');
|
||||
a.setAttribute('href', node.props.url);
|
||||
a.textContent = node.props.url.replace(/^https?:\/\//, '');
|
||||
return a;
|
||||
},
|
||||
|
||||
search: (node) => {
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('href', `https"google.com/${node.props.query}`);
|
||||
a.textContent = node.props.content;
|
||||
return a;
|
||||
},
|
||||
search: (node) => {
|
||||
const a = doc.createElement('a');
|
||||
a.setAttribute('href', `https"google.com/${node.props.query}`);
|
||||
a.textContent = node.props.content;
|
||||
return a;
|
||||
},
|
||||
|
||||
async plain(node) {
|
||||
const el = doc.createElement('span');
|
||||
await appendChildren(node.children, el);
|
||||
return el;
|
||||
},
|
||||
};
|
||||
|
||||
async plain(node) {
|
||||
const el = doc.createElement('span');
|
||||
await appendChildren(node.children, el);
|
||||
return el;
|
||||
},
|
||||
};
|
||||
|
||||
await appendChildren(nodes, doc.body);
|
||||
|
||||
if (quoteUri !== null) {
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ import type { MiUserProfile, UserProfilesRepository, UsersRepository } from '@/m
|
|||
import { bindThis } from '@/decorators.js';
|
||||
import { isDuplicateKeyValueError } from '@/misc/is-duplicate-key-value-error.js';
|
||||
import type { MiLocalUser } from '@/models/User.js';
|
||||
import * as crypto from 'node:crypto';
|
||||
import { secureishCompare } from '@/misc/secure-ish-compare.js';
|
||||
|
||||
@Injectable()
|
||||
export class UserAuthService {
|
||||
|
|
@ -29,7 +29,7 @@ export class UserAuthService {
|
|||
if (profile.twoFactorBackupSecret?.includes(token)) {
|
||||
await this.userProfilesRepository.update({ userId: profile.userId }, {
|
||||
twoFactorBackupSecret: profile.twoFactorBackupSecret.filter(
|
||||
(secret) => !crypto.timingSafeEqual(secret, token)
|
||||
(secret) => !secureishCompare(secret, token)
|
||||
),
|
||||
});
|
||||
} else {
|
||||
|
|
|
|||
33
packages/backend/src/misc/secure-ish-compare.ts
Normal file
33
packages/backend/src/misc/secure-ish-compare.ts
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
/*
|
||||
* SPDX-FileCopyrightText: dakkar and other sharkey contributors
|
||||
* SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
import * as crypto from 'node:crypto';
|
||||
|
||||
export function secureishCompare(expected: string, given:string) {
|
||||
const expectedLen = expected.length;
|
||||
const givenLen = given.length;
|
||||
|
||||
/*
|
||||
this ensures that the two strings are the same length, so
|
||||
`timingSafeEqual` will not throw an error
|
||||
|
||||
notice that we perform the same operations regardless of the
|
||||
length of the strings, we're trying not to leak timing
|
||||
information!
|
||||
*/
|
||||
const paddedExpected = Buffer.from(expected + given);
|
||||
const paddedGiven = Buffer.from(given + expected);
|
||||
|
||||
/*
|
||||
if the two strings were equal, `sortOfEqual` will be true
|
||||
|
||||
if will be true in other cases, too! like `abc` and `abcabc`; but
|
||||
then, `expectedLen` and `givenLen` would be different, and we'd
|
||||
return false
|
||||
*/
|
||||
const sortOfEqual = crypto.timingSafeEqual(paddedExpected, paddedGiven);
|
||||
|
||||
return sortOfEqual && (givenLen === expectedLen);
|
||||
}
|
||||
|
|
@ -38,6 +38,7 @@ import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyPluginOption
|
|||
import type { FindOptionsWhere } from 'typeorm';
|
||||
import type Logger from '@/logger.js';
|
||||
import { LoggerService } from '@/core/LoggerService.js';
|
||||
import { secureishCompare } from '@/misc/secure-ish-compare.js';
|
||||
|
||||
const ACTIVITY_JSON = 'application/activity+json; charset=utf-8';
|
||||
const LD_JSON = 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"; charset=utf-8';
|
||||
|
|
@ -287,7 +288,7 @@ export class ActivityPubServerService {
|
|||
|
||||
const hash = crypto.createHash('sha256').update(request.rawBody).digest('base64');
|
||||
|
||||
if (! crypto.timingSafeEqual(hash, digestValue)) {
|
||||
if (!secureishCompare(hash, digestValue)) {
|
||||
// Invalid digest
|
||||
reply.code(401);
|
||||
return;
|
||||
|
|
@ -795,7 +796,7 @@ export class ActivityPubServerService {
|
|||
|
||||
fastify.get<{ Params: { user: string; } }>('/users/:user', { constraints: { apOrHtml: 'ap' } }, async (request, reply) => {
|
||||
if (await this.shouldRefuseGetRequest(request, reply, request.params.user)) return;
|
||||
|
||||
|
||||
vary(reply.raw, 'Accept');
|
||||
|
||||
const userId = request.params.user;
|
||||
|
|
@ -811,7 +812,7 @@ export class ActivityPubServerService {
|
|||
|
||||
fastify.get<{ Params: { user: string; } }>('/@:user', { constraints: { apOrHtml: 'ap' } }, async (request, reply) => {
|
||||
if (await this.shouldRefuseGetRequest(request, reply, request.params.user)) return;
|
||||
|
||||
|
||||
vary(reply.raw, 'Accept');
|
||||
|
||||
const user = await this.usersRepository.findOneBy({
|
||||
|
|
|
|||
25
packages/backend/test/unit/misc/secure-ish-compare.ts
Normal file
25
packages/backend/test/unit/misc/secure-ish-compare.ts
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
/*
|
||||
* SPDX-FileCopyrightText: dakkar and other sharkey contributors
|
||||
* SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
import { secureishCompare } from '@/misc/secure-ish-compare.js';
|
||||
|
||||
describe(secureishCompare, () => {
|
||||
it('should return true if strings are equal', () => {
|
||||
expect(secureishCompare('abc','abc')).toBe(true);
|
||||
expect(secureishCompare('aaa','aaa')).toBe(true);
|
||||
});
|
||||
it('should return false if strings are different', () => {
|
||||
expect(secureishCompare('abc','def')).toBe(false);
|
||||
});
|
||||
it('should return false if one is prefix of the other', () => {
|
||||
expect(secureishCompare('abc','abcabc')).toBe(false);
|
||||
expect(secureishCompare('abcabc','abc')).toBe(false);
|
||||
expect(secureishCompare('aaa','aa')).toBe(false);
|
||||
});
|
||||
it('should return false if strings are very different', () => {
|
||||
expect(secureishCompare('abc','defghi')).toBe(false);
|
||||
expect(secureishCompare('defghi','abc')).toBe(false);
|
||||
});
|
||||
});
|
||||
Loading…
Reference in a new issue