Fix webfinger returning wrong status code on malformed or missing param (#13759)

Fixes #13757

diff --git a/app/controllers/well_known/webfinger_controller.rb b/app/controllers/well_known/webfinger_controller.rb
index 480e58f3f043fca439dbfaa762ffb09bd9ee96c9..9de9db6ba8c1b4448b2982df71d9211b33169f2a 100644 (file)
--- a/app/controllers/well_known/webfinger_controller.rb
+++ b/app/controllers/well_known/webfinger_controller.rb
@@ -8,7 +8,8 @@ module WellKnown
     before_action :set_account
     before_action :check_account_suspension
 
-    rescue_from ActiveRecord::RecordNotFound, ActionController::ParameterMissing, with: :not_found
+    rescue_from ActiveRecord::RecordNotFound, with: :not_found
+    rescue_from ActionController::ParameterMissing, WebfingerResource::InvalidRequest, with: :bad_request
 
     def show
       expires_in 3.days, public: true
@@ -37,6 +38,10 @@ module WellKnown
       expires_in(3.minutes, public: true) && gone if @account.suspended?
     end
 
+    def bad_request
+      head 400
+    end
+
     def not_found
       head 404
     end

diff --git a/app/lib/webfinger_resource.rb b/app/lib/webfinger_resource.rb
index 22d78874a4b263ef2c1a359c4bd7076936d340a1..42094548595f0726baeabeca23e685b92dffd4e8 100644 (file)
--- a/app/lib/webfinger_resource.rb
+++ b/app/lib/webfinger_resource.rb
@@ -3,6 +3,8 @@
 class WebfingerResource
   attr_reader :resource
 
+  class InvalidRequest < StandardError; end
+
   def initialize(resource)
     @resource = resource
   end
@@ -14,7 +16,7 @@ class WebfingerResource
     when /\@/
       username_from_acct
     else
-      raise(ActiveRecord::RecordNotFound)
+      raise InvalidRequest
     end
   end
 

diff --git a/spec/controllers/well_known/webfinger_controller_spec.rb b/spec/controllers/well_known/webfinger_controller_spec.rb
index 20275aa63bc33f958a2e3cfe2575c44800067fad..46f63185b9ec7c530d55d7bcab9407eba9052f22 100644 (file)
--- a/spec/controllers/well_known/webfinger_controller_spec.rb
+++ b/spec/controllers/well_known/webfinger_controller_spec.rb
@@ -84,5 +84,15 @@ PEM
 
       expect(response).to have_http_status(:not_found)
     end
+
+    it 'returns http bad request when not given a resource parameter' do
+      get :show, params: { }, format: :json
+      expect(response).to have_http_status(:bad_request)
+    end
+
+    it 'returns http bad request when given a nonsense parameter' do
+      get :show, params: { resource: 'df/:dfkj' }
+      expect(response).to have_http_status(:bad_request)
+    end
   end
 end

diff --git a/spec/lib/webfinger_resource_spec.rb b/spec/lib/webfinger_resource_spec.rb
index 287537a26102f02cd051302685f01224d08138b8..236e9f3e2d77d6b3041b7139d667c7c92343b922 100644 (file)
--- a/spec/lib/webfinger_resource_spec.rb
+++ b/spec/lib/webfinger_resource_spec.rb
@@ -39,7 +39,7 @@ describe WebfingerResource do
 
         expect {
           WebfingerResource.new(resource).username
-        }.to raise_error(ActiveRecord::RecordNotFound)
+        }.to raise_error(WebfingerResource::InvalidRequest)
       end
 
       it 'finds the username in a valid https route' do
@@ -123,5 +123,15 @@ describe WebfingerResource do
         expect(result).to eq 'alice'
       end
     end
+
+    describe 'with a nonsense resource' do
+      it 'raises InvalidRequest' do
+        resource = 'df/:dfkj'
+
+        expect {
+          WebfingerResource.new(resource).username
+        }.to raise_error(WebfingerResource::InvalidRequest)
+      end
+    end
   end
 end