diff --git a/app/controllers/activitypub/inboxes_controller.rb b/app/controllers/activitypub/inboxes_controller.rb index cf46bf21b5..b5926d94fd 100644 --- a/app/controllers/activitypub/inboxes_controller.rb +++ b/app/controllers/activitypub/inboxes_controller.rb @@ -26,9 +26,9 @@ class ActivityPub::InboxesController < ActivityPub::BaseController end def unknown_affected_account? - json = Oj.load(body, mode: :strict) + json = JSON.parse(body) json.is_a?(Hash) && %w(Delete Update).include?(json['type']) && json['actor'].present? && json['actor'] == value_or_id(json['object']) && !Account.exists?(uri: json['actor']) - rescue Oj::ParseError + rescue JSON::ParserError false end diff --git a/spec/requests/activitypub/inboxes_spec.rb b/spec/requests/activitypub/inboxes_spec.rb index e33afa53c9..fd013f38d6 100644 --- a/spec/requests/activitypub/inboxes_spec.rb +++ b/spec/requests/activitypub/inboxes_spec.rb @@ -156,6 +156,24 @@ RSpec.describe 'ActivityPub Inboxes' do expect(response) .to have_http_status(401) end + + context 'when sending an unknown account' do + let(:unknown_actor) do + { + actor: 'https://unknown-actor.host', + object: 'https://unknown-actor.host', + type: 'Update', + } + end + let(:headers) { { 'CONTENT_TYPE' => 'application/json' } } + + it 'returns http accepted' do + post(inbox_path, params: unknown_actor.to_json, headers:) + + expect(response) + .to have_http_status(202) + end + end end end end