activitypub 0.4.3 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e07c19938d44be1b64a307808cce4aa7d75034fc3df547c2554164692ba423a8
-  data.tar.gz: 96671de06f1cb30a6b37529b985a4a8f82bb49136018f29919ed5e61df89021c
+  metadata.gz: 259eb9ee62ae1fdd8155792569764c2ed1725755463cdf97ad3ec1807bdcf88a
+  data.tar.gz: b8758711d3bdd3eafe0747c7f16f279634f87ee67ad4c6ce3e18fada660a2648
 SHA512:
-  metadata.gz: '07290f328de7cf87742c570d345d790b0aefed8eac1b1de5d294b5f00c04fcc9f2f3865ea838aa7347fab0d1a23413cf4adf5dcfba697c463d710513d0b579bb'
-  data.tar.gz: 9077e1a93d5e442547b7ddb38e108d84a9d6141ffd0dc798babfa3b061b82885fbb37bfc10a1c7d02cd08d5ec0982da87252cfb5796cc2f1f3c5967de50883fb
+  metadata.gz: d38fe32f27c42f7ff652cbafdb7a97506d963bed70c94d49782da0a44396232b2236e0965bb08547928f73c7fcb9b232461cef384f051d51dd4000f1f22f6fd1
+  data.tar.gz: 0a3c78633eae0eaf5a7f74c5cb424de24e4f0148c10209de6da8e2f956c3ed1e563cedda71c79c7a14bb19284b6081526d6a1d244f42a37069b435439b6fa586

data/lib/activitypub/base.rb

@@ -6,11 +6,11 @@ module ActivityPub
   class Error < StandardError; end
 
   
-  def self.from_json(json)
-    from_hash(JSON.parse(json))
+  def self.from_json(json, resolver: nil)
+    from_hash(JSON.parse(json), resolver:)
   end
 
-  def self.from_hash(h)
+  def self.from_hash(h, resolver: nil)
     type = h&.dig("type")
 
     raise Error, "'type' attribute is required" if !type
@@ -21,6 +21,7 @@ module ActivityPub
     klass = ActivityPub.const_get(type)
 
     ob = klass ? klass.new : nil
+    ob._resolver = resolver
 
     # FIXME: Useful for debug. Add flag to allow enabling.
     # ob.instance_variable_set("@_raw",h)
@@ -42,6 +43,7 @@ module ActivityPub
 
         if t = klass.ap_types[attr]
           v = t.new(v) if v && !v.kind_of?(ActivityPub::Base)
+          v._resolver = ob._resolver if v
         end
         ob.instance_variable_set("@#{attr}", v) if !v.nil?
       end
@@ -57,6 +59,8 @@ module ActivityPub
     def _context = @_context || "https://www.w3.org/ns/activitystreams"
     def _type = self.class.name.split("::").last
 
+    attr_accessor :_resolver
+
 
     # FIXME: Allow specifying a type (e.g. URI)
     def self.ap_attr(name, type=nil)

data/lib/activitypub/resolvers.rb

@@ -0,0 +1,47 @@
+
+require 'uri'
+require 'faraday'
+
+# Classes to resolve URI's into objects.
+
+
+module ActivityPub
+
+  class WebResolver
+    def self.call(path)
+      response = Faraday.get(path, {}, {"Accept": "application/activity+json"})
+      if response.status == 200
+        ActivityPub.from_json(response.body)
+      else
+        response
+      end
+    end
+  end
+
+  #
+  # UnsafeResolver supports filesystem references. It's named as it is to make
+  # you stop and think. If you load remote objects and allow the use of UnsafeResolver,
+  # it *will* try to load things from your filesystem. If you subsequently
+  # allow access to that data in ways that are not strictly controlled, you run
+  # the risk of a security hole.
+  #
+  # A future version will likely allow containing this to specific paths,
+  # but currently it makes *NO ATTEMPTS* to sanitise paths, so paths including
+  # ".." etc. will allow filesystem traversal.
+  #
+  class UnsafeResolver
+    def initialize(base)
+      @base = File.expand_path(base)
+    end
+    
+    def call(path)
+      path = File.expand_path(path,@base)
+      raise "Illegal path" if path[0...@base.length] != @base
+      if File.exist?(path)
+        data = File.read(path)
+        return ActivityPub.from_json(data)
+      end
+      WebResolver.call(path)
+    end
+  end
+end

data/lib/activitypub/types.rb

@@ -238,8 +238,8 @@ module ActivityPub
 
     # Mastodon extension per
     # https://docs-p.joinmastodon.org/spec/activitypub/#extensions
-    ap_attr :likes
-    ap_attr :bookmarks
+    ap_attr :likes, URI
+    ap_attr :bookmarks, URI
     ap_attr :manuallyApprovesFollowers
   end
 

data/lib/activitypub/uri.rb

@@ -1,23 +1,20 @@
 
-require 'uri'
-require 'faraday'
+require_relative 'resolvers'
 
 module ActivityPub
   class URI
-    def initialize(href)
+    attr_accessor :_resolver
+
+    def initialize(href, resolver: nil)
       @href = href
+      @_resolver = resolver || WebResolver
     end
 
     def to_s = @href
     def to_json(...) = @href
 
     def get
-      response = Faraday.get(self.to_s, {}, {"Accept": "application/activity+json"})
-      if response.status == 200
-        ActivityPub.from_json(response.body)
-      else
-        response
-      end
+      @_resolver&.call(self.to_s)
     end
   end
 end

data/lib/activitypub/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActivityPub
-  VERSION = "0.4.3"
+  VERSION = "0.5.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activitypub
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.5.1
 platform: ruby
 authors:
 - Vidar Hokstad
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-07-17 00:00:00.000000000 Z
+date: 2024-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: webfinger
@@ -40,6 +40,7 @@ files:
 - examples/get_actor.rb
 - lib/activitypub.rb
 - lib/activitypub/base.rb
+- lib/activitypub/resolvers.rb
 - lib/activitypub/types.rb
 - lib/activitypub/uri.rb
 - lib/activitypub/version.rb