Raise an error for remote url in StatusFinder (#4776)

* Raise an error for remote url in StatusFinder

Previous implementation had allowed remote url with status id which also exists on local.

Then that bug leads /api/web/embed to return wrong embed url.

* Fix oembed_controller_spec

diff --git a/app/lib/status_finder.rb b/app/lib/status_finder.rb
index bd910f12bb2a51e12d9fafb622d3a45455c1e13b..4d1aed297952c7a7f9fb756d78c6e42a988c1b42 100644 (file)
--- a/app/lib/status_finder.rb
+++ b/app/lib/status_finder.rb
@@ -10,6 +10,8 @@ class StatusFinder
   def status
     verify_action!
 
+    raise ActiveRecord::RecordNotFound unless TagManager.instance.local_url?(url)
+
     case recognized_params[:controller]
     when 'stream_entries'
       StreamEntry.find(recognized_params[:id]).status

diff --git a/spec/controllers/api/oembed_controller_spec.rb b/spec/controllers/api/oembed_controller_spec.rb
index 43631a7e5a0b23abac5fdd222c35db65e8f603e4..7af4a6a5be81095d59649f3be0805d305bbcf1bc 100644 (file)
--- a/spec/controllers/api/oembed_controller_spec.rb
+++ b/spec/controllers/api/oembed_controller_spec.rb
@@ -8,6 +8,7 @@ RSpec.describe Api::OEmbedController, type: :controller do
 
   describe 'GET #show' do
     before do
+      request.host = Rails.configuration.x.local_domain
       get :show, params: { url: account_stream_entry_url(alice, status.stream_entry) }, format: :json
     end
 

diff --git a/spec/lib/status_finder_spec.rb b/spec/lib/status_finder_spec.rb
index 5c2f2dbe87114c4ef6a5b8b3fc1cba1582e399f5..3ef086736cec1f3aa8d7824f67efae0901516d02 100644 (file)
--- a/spec/lib/status_finder_spec.rb
+++ b/spec/lib/status_finder_spec.rb
@@ -34,6 +34,16 @@ describe StatusFinder do
       end
     end
 
+    context 'with a remote url even if id exists on local' do
+      let(:status) { Fabricate(:status) }
+      let(:url) { "https://example.com/users/test/statuses/#{status.id}" }
+      subject { described_class.new(url) }
+
+      it 'raises an error' do
+        expect { subject.status }.to raise_error(ActiveRecord::RecordNotFound)
+      end
+    end
+
     context 'with a plausible url' do
       let(:url) { 'https://example.com/users/test/updates/123/embed' }
       subject { described_class.new(url) }