updated plugin ActivityPub version 9.1.0

wp-content/plugins/activitypub/includes/rest/class-actors-controller.php

@@ -10,6 +10,8 @@ namespace Activitypub\Rest;
 use Activitypub\Collection\Actors as Actor_Collection;
 use Activitypub\Webfinger;
 
+use function Activitypub\get_client_ip;
+
 /**
  * ActivityPub Actors REST-Class.
  *
@@ -118,6 +120,23 @@ class Actors_Controller extends \WP_REST_Controller {
 	 * @return \WP_REST_Response|\WP_Error Response object on success, or WP_Error object on failure.
 	 */
 	public function get_remote_follow_item( $request ) {
+		/*
+		 * This endpoint is unauthenticated and triggers an outbound WebFinger request to a
+		 * user-supplied host, so throttle it per IP (max 10 per minute) to limit its use as
+		 * a blind SSRF / request-amplification vector. Fail closed when no IP is available.
+		 */
+		$ip = get_client_ip();
+		if ( '' === $ip ) {
+			return self::rate_limit_response();
+		}
+
+		$transient_key = 'ap_remote_follow_' . \md5( $ip );
+		$count         = (int) \get_transient( $transient_key );
+		if ( $count >= 10 ) {
+			return self::rate_limit_response();
+		}
+		\set_transient( $transient_key, $count + 1, MINUTE_IN_SECONDS );
+
 		$resource = $request->get_param( 'resource' );
 		$user_id  = $request->get_param( 'user_id' );
 		$user     = Actor_Collection::get_by_id( $user_id );
@@ -139,6 +158,24 @@ class Actors_Controller extends \WP_REST_Controller {
 		);
 	}
 
+	/**
+	 * Build a 429 rate-limit response for the remote-follow endpoint.
+	 *
+	 * @return \WP_REST_Response The rate-limit response.
+	 */
+	private static function rate_limit_response() {
+		return new \WP_REST_Response(
+			array(
+				'code'    => 'activitypub_rate_limited',
+				'message' => \__( 'Too many requests. Please try again later.', 'activitypub' ),
+				'data'    => array( 'status' => 429 ),
+			),
+			429,
+			// RFC 6585 §4: send Retry-After so clients can back off.
+			array( 'Retry-After' => (string) MINUTE_IN_SECONDS )
+		);
+	}
+
 	/**
 	 * Retrieves the actor schema, conforming to JSON Schema.
 	 *