Validators: ObjectID is an http uri.

2 files changed, 50 insertions, 4 deletions

diff --git a/lib/pleroma/web/activity_pub/object_validators/types/object.ex b/lib/pleroma/web/activity_pub/object_validators/types/object.ex
index 92fc13ba8..8e70effe4 100644
--- a/lib/pleroma/web/activity_pub/object_validators/types/object.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/types/object.ex
@@ -4,12 +4,20 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.Types.ObjectID do
   def type, do: :string
 
   def cast(object) when is_binary(object) do
-    {:ok, object}
+    with %URI{
+           scheme: scheme,
+           host: host
+         }
+         when scheme in ["https", "http"] and not is_nil(host) <-
+           URI.parse(object) do
+      {:ok, object}
+    else
+      _ ->
+        :error
+    end
   end
 
-  def cast(%{"id" => object}) when is_binary(object) do
-    {:ok, object}
-  end
+  def cast(%{"id" => object}), do: cast(object)
 
   def cast(_) do
     :error
diff --git a/test/web/activity_pub/object_validators/types/object_id_test.exs b/test/web/activity_pub/object_validators/types/object_id_test.exs
new file mode 100644
index 000000000..f4c5ed1dc
--- /dev/null
+++ b/test/web/activity_pub/object_validators/types/object_id_test.exs
@@ -0,0 +1,38 @@
+defmodule Pleroma.Web.ObjectValidators.Types.ObjectIDTest do
+  alias Pleroma.Web.ActivityPub.ObjectValidators.Types.ObjectID
+  use Pleroma.DataCase
+
+  @uris [
+    "http://lain.com/users/lain",
+    "http://lain.com",
+    "https://lain.com/object/1"
+  ]
+
+  @non_uris [
+    "https://",
+    "rin"
+  ]
+
+  test "it rejects integers" do
+    assert :error == ObjectID.cast(1)
+  end
+
+  test "it accepts http uris" do
+    Enum.each(@uris, fn uri ->
+      assert {:ok, uri} == ObjectID.cast(uri)
+    end)
+  end
+
+  test "it accepts an object with a nested uri id" do
+    Enum.each(@uris, fn uri ->
+      assert {:ok, uri} == ObjectID.cast(%{"id" => uri})
+    end)
+  end
+
+  test "it rejects non-uri strings" do
+    Enum.each(@non_uris, fn non_uri ->
+      assert :error == ObjectID.cast(non_uri)
+      assert :error == ObjectID.cast(%{"id" => non_uri})
+    end)
+  end
+end