From d9cb081f0723881343b6dd71e1bb1b52b5492f2b Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sat, 17 Nov 2018 18:12:11 +0000
Subject: [PATCH] tests: add additional spoofing tests

---
 test/web/activity_pub/transmogrifier_test.exs | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/test/web/activity_pub/transmogrifier_test.exs b/test/web/activity_pub/transmogrifier_test.exs
index 9250598f4..0ba969263 100644
--- a/test/web/activity_pub/transmogrifier_test.exs
+++ b/test/web/activity_pub/transmogrifier_test.exs
@@ -883,5 +883,22 @@ test "it rejects activities which reference objects with bogus origins" do
 
       :error = Transmogrifier.handle_incoming(data)
     end
+
+    test "it rejects objects when the ID does not match the fetched URI" do
+      {:error, _} = ActivityPub.fetch_object_from_id("https://info.pleroma.site/activity2.json")
+    end
+
+    test "it rejects activities which reference objects by mismatched URI" do
+      data = %{
+        "@context" => "https://www.w3.org/ns/activitystreams",
+        "id" => "http://mastodon.example.org/users/admin/activities/1234",
+        "actor" => "http://mastodon.example.org/users/admin",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "object" => "https://info.pleroma.site/activity2.json",
+        "type" => "Announce"
+      }
+
+      :error = Transmogrifier.handle_incoming(data)
+    end
   end
 end