From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sat, 1 May 2021 21:18:59 +0000 (+0200)
Subject: Fix trying to fetch key from empty URI when verifying HTTP signature (#16100)
X-Git-Url: https://git.xn--scling-oua.cat.family/?a=commitdiff_plain;h=f627d2eb938d220eb767b0211b66b4281c921f75;p=mastodon.git

Fix trying to fetch key from empty URI when verifying HTTP signature (#16100)
---

diff --git a/app/helpers/jsonld_helper.rb b/app/helpers/jsonld_helper.rb
index 1c473efa3..62eb50f78 100644
--- a/app/helpers/jsonld_helper.rb
+++ b/app/helpers/jsonld_helper.rb
@@ -67,7 +67,7 @@ module JsonLdHelper
     unless id
       json = fetch_resource_without_id_validation(uri, on_behalf_of)
 
-      return unless json
+      return if !json.is_a?(Hash) || unsupported_uri_scheme?(json['id'])
 
       uri = json['id']
     end
diff --git a/app/services/activitypub/fetch_remote_key_service.rb b/app/services/activitypub/fetch_remote_key_service.rb
index df17d9079..c48288b3b 100644
--- a/app/services/activitypub/fetch_remote_key_service.rb
+++ b/app/services/activitypub/fetch_remote_key_service.rb
@@ -5,6 +5,8 @@ class ActivityPub::FetchRemoteKeyService < BaseService
 
   # Returns account that owns the key
   def call(uri, id: true, prefetched_body: nil)
+    return if uri.blank?
+
     if prefetched_body.nil?
       if id
         @json = fetch_resource_without_id_validation(uri)