SuperSeriousBusiness/GoToSocial
1
1
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial synced 2025-06-05 21:59:39 +02:00
Code Issues Projects Releases Wiki Activity

[security] harden account update logic (#3198)

Browse Source 
* on account update, ensure that public key has not changed

* change expected error message

* also support the case of changing account keys when expired (not waiting for handshake)

* tweak account update hardening logic, add tests for updating account with pubkey expired

* add check for whether incoming data was via federator, accepting keys if so

* use freshest window for federated account updates + comment about it
This commit is contained in:
kim
2024-08-13 15:37:09 +00:00
committed by GitHub
parent 5212a1057e
commit 9cd27b412d
4 changed files with 249 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
internal/processing/workers/fromfediapi.go
View File

@ -674,8 +674,13 @@ func (p *fediAPI) UpdateAccount(ctx context.Context, fMsg *messages.FromFediAPI)
fMsg.Receiving.Username,
account,
apubAcc,
// Force refresh within 5min window.
dereferencing.Fresh,
// Force refresh within 10s window.
//
// Missing account updates could be
// detrimental to federation if they
// include public key changes.
dereferencing.Freshest,
)
if err != nil {
log.Errorf(ctx, "error refreshing account: %v", err)