fix: better logic for choosing webfinger lookups

NodeBB · Apr 25, 2024 · ed84eed · ed84eed
1 parent dd71340
commit ed84eed
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 8 deletions.
diff --git a/src/activitypub/actors.js b/src/activitypub/actors.js
@@ -31,8 +31,9 @@ Actors.assert = async (ids, options = {}) => {
 	// Translate webfinger handles to uris
 	ids = (await Promise.all(ids.map(async (id) => {
 		const originalId = id;
-		if (id.includes('@')) {
-			const isUri = activitypub.helpers.isUri(id);
+		const isUri = activitypub.helpers.isUri(id);
+		// only look up webfinger if the id is not a supported URI
+		if (id.includes('@') && !(isUri && activitypub._constants.acceptedProtocols.includes(new URL(id).protocol.slice(0, -1)))) {
 			const host = isUri ? new URL(id).host : id.split('@')[1];
 			if (host === nconf.get('url_parsed').host) { // do not assert loopback ids
 				return null;

diff --git a/src/activitypub/helpers.js b/src/activitypub/helpers.js
@@ -22,15 +22,10 @@ Helpers.isUri = (value) => {
 		value = String(value);
 	}
 
-	const protocols = ['https'];
-	if (process.env.CI === 'true') {
-		protocols.push('http');
-	}
-
 	return validator.isURL(value, {
 		require_protocol: true,
 		require_host: true,
-		protocols,
+		protocols: activitypub._constants.acceptedProtocols,
 		require_valid_protocol: true,
 		require_tld: false, // temporary — for localhost
 	});

diff --git a/src/activitypub/index.js b/src/activitypub/index.js
@@ -24,6 +24,7 @@ ActivityPub._constants = Object.freeze({
 	acceptedPostTypes: [
 		'Note', 'Page', 'Article', 'Question',
 	],
+	acceptedProtocols: ['https', ...(process.env.CI === 'true' ? ['http'] : [])],
 });
 ActivityPub._cache = requestCache;