kawaiipunk/laipower
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

updated plugin ActivityPub version 9.1.0

Browse Source
This commit is contained in:
KawaiiPunk
2026-07-28 15:03:10 +00:00
committed by Gitium
parent bf428f0e45
commit ff806e1811
217 changed files with 6098 additions and 3025 deletions
Download Patch File Download Diff File Expand all files Collapse all files

190
wp-content/plugins/activitypub/includes/class-http.php
View File

@ -18,9 +18,9 @@ class Http {
/**
* Send a POST Request with the needed HTTP Headers
*
* @param string $url The URL endpoint.
* @param string $body The Post Body.
* @param int $user_id The WordPress User-ID.
* @param string $url The URL endpoint.
* @param string $body The Post Body.
* @param int|null $user_id The WordPress User-ID, or null to sign with the Application key.
*
* @return array|\WP_Error The POST Response or an WP_Error.
*/
@ -28,9 +28,9 @@ class Http {
/**
* Fires before an HTTP POST request is made.
*
* @param string $url The URL endpoint.
* @param string $body The POST body.
* @param int $user_id The WordPress User ID.
* @param string $url The URL endpoint.
* @param string $body The POST body.
* @param int|null $user_id The WordPress User ID, or null when signing with the Application key.
*/
\do_action( 'activitypub_pre_http_post', $url, $body, $user_id );
@ -49,6 +49,12 @@ class Http {
*/
$timeout = \apply_filters( 'activitypub_remote_post_timeout', 10 );
/*
* Get the private key for signing the request. If a user ID is provided,
* get the user's private key; otherwise, use the application's private key.
*/
$private_key = null === $user_id ? Application::get_private_key() : Actors::get_private_key( $user_id );
$args = array(
'timeout' => $timeout,
'limit_response_size' => 1048576,
@ -61,7 +67,7 @@ class Http {
),
'body' => $body,
'key_id' => \json_decode( $body )->actor . '#main-key',
'private_key' => Actors::get_private_key( $user_id ),
'private_key' => $private_key,
'user_id' => $user_id,
);
@ -71,7 +77,7 @@ class Http {
if ( $code >= 400 ) {
$response = new \WP_Error(
$code,
__( 'Failed HTTP Request', 'activitypub' ),
\__( 'Failed HTTP Request', 'activitypub' ),
array(
'status' => $code,
'response' => $response,
@ -85,7 +91,7 @@ class Http {
* @param array|\WP_Error $response The response of the remote POST request.
* @param string $url The URL endpoint.
* @param string $body The Post Body.
* @param int $user_id The WordPress User-ID.
* @param int|null $user_id The WordPress User-ID, or null when signing with the Application key.
*/
\do_action( 'activitypub_safe_remote_post_response', $response, $url, $body, $user_id );
@ -98,7 +104,8 @@ class Http {
* @param string $url The URL endpoint.
* @param array $args Optional. Additional arguments to customize the request.
* - 'headers': Array of headers to override defaults.
* @param bool|int $cached Optional. Whether to return cached results, or cache duration. Default false.
* @param bool|int $cached Optional. Whether to cache the response, or the cache duration in seconds for
* successful responses. Failed responses use a fixed short backoff duration. Default false.
*
* @return array|\WP_Error The GET Response or a WP_Error.
*/
@ -165,8 +172,8 @@ class Http {
'Content-Type' => 'application/activity+json',
'Date' => \gmdate( 'D, d M Y H:i:s T' ),
),
'key_id' => Actors::get_by_id( Actors::APPLICATION_USER_ID )->get_id() . '#main-key',
'private_key' => Actors::get_private_key( Actors::APPLICATION_USER_ID ),
'key_id' => Application::get_key_id(),
'private_key' => Application::get_private_key(),
);
$args = \wp_parse_args( $args, $defaults );
@ -176,23 +183,33 @@ class Http {
$code = \wp_remote_retrieve_response_code( $response );
if ( \is_wp_error( $response ) || $code >= 400 ) {
// Capture the served-from URL before $response is replaced by the error below.
$effective_url = \is_wp_error( $response ) ? '' : self::effective_url( $response );
if ( ! $code ) {
$code = 0;
}
$response = new \WP_Error( $code, __( 'Failed HTTP Request', 'activitypub' ), array( 'status' => $code ) );
$response = new \WP_Error( $code, \__( 'Failed HTTP Request', 'activitypub' ), array( 'status' => $code ) );
/*
* Always cache errors to prevent repeated timeout waits.
* Cache errors to prevent repeated timeout waits, but never one reached via a
* cross-host redirect: cached under the requested URL's key, a one-off open
* redirect on the requested host would let a transient 4xx be replayed as a
* repeatable federation outage (the same caching concern as the success path
* below, just with a WP_Error instead of a document).
*
* - Retriable errors (timeouts, 5xx): 1 minute (server may recover quickly).
* - Other errors (4xx): 15 minutes (client errors are more permanent).
*/
if ( \in_array( $code, ACTIVITYPUB_RETRY_ERROR_CODES, true ) || 0 === $code ) {
$cache_duration = MINUTE_IN_SECONDS;
} else {
$cache_duration = 15 * MINUTE_IN_SECONDS;
}
if ( $cached && ( ! $effective_url || is_same_host( $url, $effective_url ) ) ) {
if ( \in_array( $code, ACTIVITYPUB_RETRY_ERROR_CODES, true ) || 0 === $code ) {
$cache_duration = MINUTE_IN_SECONDS;
} else {
$cache_duration = 15 * MINUTE_IN_SECONDS;
}
\set_transient( $transient_key, $response, $cache_duration );
\set_transient( $transient_key, $response, $cache_duration );
}
return $response;
}
@ -205,12 +222,26 @@ class Http {
*/
\do_action( 'activitypub_safe_remote_get_response', $response, $url );
// Always cache successful responses.
$cache_duration = $cached;
if ( ! is_int( $cache_duration ) ) {
$cache_duration = HOUR_IN_SECONDS;
/*
* Never persist a response that was redirected to a different host. The cache
* is keyed on the requested URL, so caching cross-origin content under that key
* would let a one-off open redirect on the requested host durably associate the
* other host's document with that URL — a later lookup (e.g. a public-key fetch)
* would then return it. Same-host redirects (e.g. http→https) stay cacheable.
*/
$effective_url = self::effective_url( $response );
if ( $effective_url && ! is_same_host( $url, $effective_url ) ) {
return $response;
}
// Cache successful responses when caching is requested.
if ( $cached ) {
$cache_duration = $cached;
if ( ! \is_int( $cache_duration ) ) {
$cache_duration = HOUR_IN_SECONDS;
}
\set_transient( $transient_key, $response, $cache_duration );
}
\set_transient( $transient_key, $response, $cache_duration );
return $response;
}
@ -223,7 +254,7 @@ class Http {
* @return bool True if the URL is a tombstone.
*/
public static function is_tombstone( $url ) {
_deprecated_function( __METHOD__, '7.3.0', 'Activitypub\Tombstone::exists_remote' );
\_deprecated_function( __METHOD__, '7.3.0', 'Activitypub\Tombstone::exists_remote' );
return Tombstone::exists_remote( $url );
}
@ -242,6 +273,15 @@ class Http {
/**
* Requests the Data from the Object-URL or Object-Array.
*
* Fetched objects are self-confirmed before they are returned, the same way
* Mastodon's `JsonLdHelper#fetch_resource` works: an object is trusted only when
* its own `id` is the URL it was actually served from (after any redirects). If
* the document served at the requested URL declares a different `id`, that id is
* dereferenced from its own host and accepted only when it self-confirms. This
* makes every caller safe to cache the result under its `id` — one host can never
* serve an object (and its public key) under another host's id — without each
* caller having to re-check the origin itself.
*
* @param array|string $url_or_object The Object or the Object URL.
* @param bool $cached Optional. Whether the result should be cached. Default true.
*
@ -251,10 +291,13 @@ class Http {
/**
* Filters the preemptive return value of a remote object request.
*
* This is an explicit in-process override (used for caching and tests), not
* untrusted network data, so it is returned as-is without self-confirmation.
*
* @param array|string|null $response The response.
* @param array|string|null $url_or_object The Object or the Object URL.
*/
$response = apply_filters( 'activitypub_pre_http_get_remote_object', null, $url_or_object );
$response = \apply_filters( 'activitypub_pre_http_get_remote_object', null, $url_or_object );
if ( null !== $response ) {
return $response;
}
@ -280,6 +323,59 @@ class Http {
return $url;
}
$final_url = '';
$object = self::fetch_object( $url, $cached, $final_url );
if ( \is_wp_error( $object ) ) {
return $object;
}
// Trust the document when it is served under its own id (after redirects).
if ( id_matches_url( $object, $final_url ) ) {
return $object;
}
$declared_id = isset( $object['id'] ) && \is_string( $object['id'] ) ? $object['id'] : '';
/*
* An id-less object cannot be cached under an id, so it cannot be written
* under another id in an id-keyed cache. Return the document as served.
*/
if ( '' === $declared_id ) {
return $object;
}
// Re-fetch the declared id from its own host and require it to self-confirm. One hop only.
$object = self::fetch_object( $declared_id, $cached, $final_url );
if ( \is_wp_error( $object ) ) {
return $object;
}
if ( ! id_matches_url( $object, $final_url ) ) {
return new \WP_Error(
'activitypub_object_id_mismatch',
\__( 'The object id does not match the URL it was served from', 'activitypub' ),
array( 'status' => 400 )
);
}
return $object;
}
/**
* Fetch and JSON-decode a single remote document.
*
* @param string $url The URL to fetch. Must already be resolved (not a WebFinger acct).
* @param bool $cached Whether the result may be served from and written to cache.
* @param string $final_url Filled by reference with the URL the document was served from,
* after following any redirects.
*
* @return array|\WP_Error The decoded document, or WP_Error on failure.
*/
private static function fetch_object( $url, $cached, &$final_url ) {
$final_url = $url;
if ( ! \wp_http_validate_url( $url ) ) {
return new \WP_Error(
'activitypub_no_valid_object_url',
@ -297,8 +393,12 @@ class Http {
return $response;
}
$data = \wp_remote_retrieve_body( $response );
$data = \json_decode( $data, true );
$effective_url = self::effective_url( $response );
if ( $effective_url ) {
$final_url = $effective_url;
}
$data = \json_decode( \wp_remote_retrieve_body( $response ), true );
if ( ! $data ) {
return new \WP_Error(
@ -313,4 +413,36 @@ class Http {
return $data;
}
/**
* Extract the effective URL a response was served from, after redirects.
*
* WordPress follows redirects transparently and exposes the final URL only on
* the underlying Requests response object. Returns an empty string when the URL
* cannot be determined, so callers fall back to the URL they requested.
*
* SECURITY: the redirect protections that build on this (the self-confirmation in
* get_remote_object() and the cross-host cache skip in get()) fail OPEN when this
* returns an empty string — self-confirmation then compares against the requested
* URL, which a redirect could have bounced away from. This relies on the internal
* `http_response` → Requests response `url` shape; if a future WordPress release
* changes it, re-verify that this still returns the post-redirect URL.
*
* @param array $response A `wp_remote_get()` response array.
*
* @return string The final URL, or an empty string when unavailable.
*/
private static function effective_url( $response ) {
if ( empty( $response['http_response'] ) || ! \is_object( $response['http_response'] ) ) {
return '';
}
$requests_response = $response['http_response']->get_response_object();
if ( ! \is_object( $requests_response ) || empty( $requests_response->url ) ) {
return '';
}
return (string) $requests_response->url;
}
}