From 718e8e1edb537aca984216be39b3be5c8af4e6da Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Sun, 16 May 2021 21:39:58 -0500
Subject: [PATCH 01/65] Create NsfwApiPolicy

---
 config/config.exs                             |   7 +
 .../web/activity_pub/mrf/nsfw_api_policy.ex   | 185 ++++++++++++++++++
 2 files changed, 192 insertions(+)
 create mode 100644 lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex

diff --git a/config/config.exs b/config/config.exs
index 66aee3264..d96dc1646 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -404,6 +404,13 @@
   threshold: 604_800,
   actions: [:delist, :strip_followers]
 
+config :pleroma, :mrf_nsfw_api,
+  url: "http://127.0.0.1:5000/",
+  threshold: 0.7,
+  mark_sensitive: true,
+  unlist: false,
+  reject: false
+
 config :pleroma, :rich_media,
   enabled: true,
   ignore_hosts: [],
diff --git a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
new file mode 100644
index 000000000..9ad175b1b
--- /dev/null
+++ b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
@@ -0,0 +1,185 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.MRF.NsfwApiPolicy do
+  @moduledoc """
+  Hide, delete, or mark sensitive NSFW content with artificial intelligence.
+
+  Requires a NSFW API server, configured like so:
+
+      config :pleroma, Pleroma.Web.ActivityPub.MRF.NsfwMRF,
+        url: "http://127.0.0.1:5000/",
+        threshold: 0.8,
+        mark_sensitive: true,
+        unlist: false,
+        reject: false
+
+  The NSFW API server must implement an HTTP endpoint like this:
+
+      curl http://localhost:5000/?url=https://fedi.com/images/001.jpg
+
+  Returning a response like this:
+
+      {"score", 0.314}
+
+  Where a score is 0-1, with `1` being definitely NSFW.
+
+  A good API server is here: https://github.com/EugenCepoi/nsfw_api
+  You can run it with Docker with a one-liner:
+
+      docker run -it -p 127.0.0.1:5000:5000/tcp --env PORT=5000 eugencepoi/nsfw_api:latest
+
+  Options:
+
+  - `url`: Base URL of the API server. Default: "http://127.0.0.1:5000/"
+  - `threshold`: Lowest score to take action on. Default: `0.7`
+  - `mark_sensitive`: Mark sensitive all detected NSFW content? Default: `true`
+  - `unlist`: Unlist all detected NSFW content? Default: `false`
+  - `reject`: Reject all detected NSFW content (takes precedence)? Default: `false`
+  """
+  alias Pleroma.Config
+  alias Pleroma.Constants
+  alias Pleroma.HTTP
+  alias Pleroma.User
+
+  require Logger
+  require Pleroma.Constants
+
+  @behaviour Pleroma.Web.ActivityPub.MRF
+  @policy :mrf_nsfw_api
+
+  defp build_request_url(url) do
+    Config.get([@policy, :url])
+    |> URI.parse()
+    |> Map.put(:query, "url=#{url}")
+    |> URI.to_string()
+  end
+
+  defp parse_url(url) do
+    request = build_request_url(url)
+
+    with {:ok, %Tesla.Env{body: body}} <- HTTP.get(request) do
+      Jason.decode(body)
+    else
+      error ->
+        Logger.warn("""
+        [NsfwApiPolicy]: The API server failed. Skipping.
+        #{inspect(error)}
+        """)
+
+        error
+    end
+  end
+
+  defp check_url_nsfw(url) when is_binary(url) do
+    threshold = Config.get([@policy, :threshold])
+
+    case parse_url(url) do
+      {:ok, %{"score" => score}} when score >= threshold ->
+        {:nsfw, %{url: url, score: score, threshold: threshold}}
+
+      _ ->
+        {:sfw, url}
+    end
+  end
+
+  defp check_url_nsfw(%{"href" => url}) when is_binary(url) do
+    check_url_nsfw(url)
+  end
+
+  defp check_attachment_nsfw(%{"url" => urls} = attachment) when is_list(urls) do
+    if Enum.all?(urls, &match?({:sfw, _}, check_url_nsfw(&1))) do
+      {:sfw, attachment}
+    else
+      {:nsfw, attachment}
+    end
+  end
+
+  defp check_object_nsfw(%{"attachment" => attachments} = object) when is_list(attachments) do
+    if Enum.all?(attachments, &match?({:sfw, _}, check_attachment_nsfw(&1))) do
+      {:sfw, object}
+    else
+      {:nsfw, object}
+    end
+  end
+
+  defp check_object_nsfw(%{"object" => %{} = child_object} = object) do
+    case check_object_nsfw(child_object) do
+      {:sfw, _} -> {:sfw, object}
+      {:nsfw, _} -> {:nsfw, object}
+    end
+  end
+
+  defp check_object_nsfw(object), do: {:sfw, object}
+
+  @impl true
+  def filter(object) do
+    with {:sfw, object} <- check_object_nsfw(object) do
+      {:ok, object}
+    else
+      {:nsfw, _data} -> handle_nsfw(object)
+      _ -> {:reject, "NSFW: Attachment rejected"}
+    end
+  end
+
+  defp handle_nsfw(object) do
+    if Config.get([@policy, :reject]) do
+      {:reject, object}
+    else
+      {:ok,
+       object
+       |> maybe_unlist()
+       |> maybe_mark_sensitive()}
+    end
+  end
+
+  defp maybe_unlist(object) do
+    if Config.get([@policy, :unlist]) do
+      unlist(object)
+    else
+      object
+    end
+  end
+
+  defp maybe_mark_sensitive(object) do
+    if Config.get([@policy, :mark_sensitive]) do
+      mark_sensitive(object)
+    else
+      object
+    end
+  end
+
+  defp unlist(%{"to" => to, "cc" => cc, "actor" => actor} = object) do
+    with %User{} = user <- User.get_cached_by_ap_id(actor) do
+      to =
+        [user.follower_address | to]
+        |> List.delete(Constants.as_public())
+        |> Enum.uniq()
+
+      cc =
+        [Constants.as_public() | cc]
+        |> List.delete(user.follower_address)
+        |> Enum.uniq()
+
+      object
+      |> Map.put("to", to)
+      |> Map.put("cc", cc)
+    end
+  end
+
+  defp mark_sensitive(%{"object" => child_object} = object) when is_map(child_object) do
+    Map.put(object, "object", mark_sensitive(child_object))
+  end
+
+  defp mark_sensitive(object) when is_map(object) do
+    tags = (object["tag"] || []) ++ ["nsfw"]
+
+    object
+    |> Map.put("tag", tags)
+    |> Map.put("sensitive", true)
+  end
+
+  @impl true
+  def describe, do: {:ok, %{}}
+end

From f15d419062b5f9aba2a2e84257dc2379b44f92e8 Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Wed, 16 Jun 2021 22:30:18 -0500
Subject: [PATCH 02/65] NsfwApiPolicy: raise if can't fetch user

---
 lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
index 9ad175b1b..63e6af0a0 100644
--- a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
@@ -165,6 +165,8 @@ defp unlist(%{"to" => to, "cc" => cc, "actor" => actor} = object) do
       object
       |> Map.put("to", to)
       |> Map.put("cc", cc)
+    else
+      _ -> raise "[NsfwApiPolicy]: Could not fetch user #{actor}"
     end
   end
 

From 2b3dfbb42f7ec0c5604876276a81d55a05955416 Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Thu, 17 Jun 2021 14:36:51 -0500
Subject: [PATCH 03/65] NsfwApiPolicy: add tests

---
 .../web/activity_pub/mrf/nsfw_api_policy.ex   |  45 ++-
 .../activity_pub/mrf/nsfw_api_policy_test.exs | 267 ++++++++++++++++++
 2 files changed, 299 insertions(+), 13 deletions(-)
 create mode 100644 test/pleroma/web/activity_pub/mrf/nsfw_api_policy_test.exs

diff --git a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
index 63e6af0a0..9dcdf560e 100644
--- a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
@@ -49,14 +49,15 @@ defmodule Pleroma.Web.ActivityPub.MRF.NsfwApiPolicy do
   @behaviour Pleroma.Web.ActivityPub.MRF
   @policy :mrf_nsfw_api
 
-  defp build_request_url(url) do
+  def build_request_url(url) do
     Config.get([@policy, :url])
     |> URI.parse()
+    |> fix_path()
     |> Map.put(:query, "url=#{url}")
     |> URI.to_string()
   end
 
-  defp parse_url(url) do
+  def parse_url(url) do
     request = build_request_url(url)
 
     with {:ok, %Tesla.Env{body: body}} <- HTTP.get(request) do
@@ -72,23 +73,26 @@ defp parse_url(url) do
     end
   end
 
-  defp check_url_nsfw(url) when is_binary(url) do
+  def check_url_nsfw(url) when is_binary(url) do
     threshold = Config.get([@policy, :threshold])
 
     case parse_url(url) do
       {:ok, %{"score" => score}} when score >= threshold ->
         {:nsfw, %{url: url, score: score, threshold: threshold}}
 
+      {:ok, %{"score" => score}} ->
+        {:sfw, %{url: url, score: score, threshold: threshold}}
+
       _ ->
-        {:sfw, url}
+        {:sfw, %{url: url, score: nil, threshold: threshold}}
     end
   end
 
-  defp check_url_nsfw(%{"href" => url}) when is_binary(url) do
+  def check_url_nsfw(%{"href" => url}) when is_binary(url) do
     check_url_nsfw(url)
   end
 
-  defp check_attachment_nsfw(%{"url" => urls} = attachment) when is_list(urls) do
+  def check_attachment_nsfw(%{"url" => urls} = attachment) when is_list(urls) do
     if Enum.all?(urls, &match?({:sfw, _}, check_url_nsfw(&1))) do
       {:sfw, attachment}
     else
@@ -96,7 +100,14 @@ defp check_attachment_nsfw(%{"url" => urls} = attachment) when is_list(urls) do
     end
   end
 
-  defp check_object_nsfw(%{"attachment" => attachments} = object) when is_list(attachments) do
+  def check_attachment_nsfw(%{"url" => url} = attachment) when is_binary(url) do
+    case check_url_nsfw(url) do
+      {:sfw, _} -> {:sfw, attachment}
+      {:nsfw, _} -> {:nsfw, attachment}
+    end
+  end
+
+  def check_object_nsfw(%{"attachment" => attachments} = object) when is_list(attachments) do
     if Enum.all?(attachments, &match?({:sfw, _}, check_attachment_nsfw(&1))) do
       {:sfw, object}
     else
@@ -104,14 +115,14 @@ defp check_object_nsfw(%{"attachment" => attachments} = object) when is_list(att
     end
   end
 
-  defp check_object_nsfw(%{"object" => %{} = child_object} = object) do
+  def check_object_nsfw(%{"object" => %{} = child_object} = object) do
     case check_object_nsfw(child_object) do
       {:sfw, _} -> {:sfw, object}
       {:nsfw, _} -> {:nsfw, object}
     end
   end
 
-  defp check_object_nsfw(object), do: {:sfw, object}
+  def check_object_nsfw(object), do: {:sfw, object}
 
   @impl true
   def filter(object) do
@@ -150,7 +161,7 @@ defp maybe_mark_sensitive(object) do
     end
   end
 
-  defp unlist(%{"to" => to, "cc" => cc, "actor" => actor} = object) do
+  def unlist(%{"to" => to, "cc" => cc, "actor" => actor} = object) do
     with %User{} = user <- User.get_cached_by_ap_id(actor) do
       to =
         [user.follower_address | to]
@@ -166,15 +177,15 @@ defp unlist(%{"to" => to, "cc" => cc, "actor" => actor} = object) do
       |> Map.put("to", to)
       |> Map.put("cc", cc)
     else
-      _ -> raise "[NsfwApiPolicy]: Could not fetch user #{actor}"
+      _ -> raise "[NsfwApiPolicy]: Could not find user #{actor}"
     end
   end
 
-  defp mark_sensitive(%{"object" => child_object} = object) when is_map(child_object) do
+  def mark_sensitive(%{"object" => child_object} = object) when is_map(child_object) do
     Map.put(object, "object", mark_sensitive(child_object))
   end
 
-  defp mark_sensitive(object) when is_map(object) do
+  def mark_sensitive(object) when is_map(object) do
     tags = (object["tag"] || []) ++ ["nsfw"]
 
     object
@@ -182,6 +193,14 @@ defp mark_sensitive(object) when is_map(object) do
     |> Map.put("sensitive", true)
   end
 
+  # Hackney needs a trailing slash
+  defp fix_path(%URI{path: path} = uri) when is_binary(path) do
+    path = String.trim_trailing(path, "/") <> "/"
+    Map.put(uri, :path, path)
+  end
+
+  defp fix_path(%URI{path: nil} = uri), do: Map.put(uri, :path, "/")
+
   @impl true
   def describe, do: {:ok, %{}}
 end
diff --git a/test/pleroma/web/activity_pub/mrf/nsfw_api_policy_test.exs b/test/pleroma/web/activity_pub/mrf/nsfw_api_policy_test.exs
new file mode 100644
index 000000000..0beb9c2cb
--- /dev/null
+++ b/test/pleroma/web/activity_pub/mrf/nsfw_api_policy_test.exs
@@ -0,0 +1,267 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.MRF.NsfwApiPolicyTest do
+  use Pleroma.DataCase
+
+  import ExUnit.CaptureLog
+  import Pleroma.Factory
+
+  alias Pleroma.Constants
+  alias Pleroma.Web.ActivityPub.MRF.NsfwApiPolicy
+
+  require Pleroma.Constants
+
+  @policy :mrf_nsfw_api
+
+  @sfw_url "https://kittens.co/kitty.gif"
+  @nsfw_url "https://b00bies.com/nsfw.jpg"
+  @timeout_url "http://time.out/i.jpg"
+
+  setup_all do
+    clear_config(@policy,
+      url: "http://127.0.0.1:5000/",
+      threshold: 0.7,
+      mark_sensitive: true,
+      unlist: false,
+      reject: false
+    )
+  end
+
+  setup do
+    Tesla.Mock.mock(fn
+      # NSFW URL
+      %{method: :get, url: "http://127.0.0.1:5000/?url=#{@nsfw_url}"} ->
+        %Tesla.Env{status: 200, body: ~s({"score":0.99772077798843384,"url":"#{@nsfw_url}"})}
+
+      # SFW URL
+      %{method: :get, url: "http://127.0.0.1:5000/?url=#{@sfw_url}"} ->
+        %Tesla.Env{status: 200, body: ~s({"score":0.00011714912398019806,"url":"#{@sfw_url}"})}
+
+      # Timeout URL
+      %{method: :get, url: "http://127.0.0.1:5000/?url=#{@timeout_url}"} ->
+        {:error, :timeout}
+
+      # Fallback URL
+      %{method: :get, url: "http://127.0.0.1:5000/?url=" <> url} ->
+        body =
+          ~s({"error_code":500,"error_reason":"[Errno -2] Name or service not known","url":"#{url}"})
+
+        %Tesla.Env{status: 500, body: body}
+    end)
+
+    :ok
+  end
+
+  describe "build_request_url/1" do
+    test "it works" do
+      expected = "http://127.0.0.1:5000/?url=https://b00bies.com/nsfw.jpg"
+      assert NsfwApiPolicy.build_request_url(@nsfw_url) == expected
+    end
+
+    test "it adds a trailing slash" do
+      clear_config([@policy, :url], "http://localhost:5000")
+
+      expected = "http://localhost:5000/?url=https://b00bies.com/nsfw.jpg"
+      assert NsfwApiPolicy.build_request_url(@nsfw_url) == expected
+    end
+
+    test "it adds a trailing slash preserving the path" do
+      clear_config([@policy, :url], "http://localhost:5000/nsfw_api")
+
+      expected = "http://localhost:5000/nsfw_api/?url=https://b00bies.com/nsfw.jpg"
+      assert NsfwApiPolicy.build_request_url(@nsfw_url) == expected
+    end
+  end
+
+  describe "parse_url/1" do
+    test "returns decoded JSON from the API server" do
+      expected = %{"score" => 0.99772077798843384, "url" => @nsfw_url}
+      assert NsfwApiPolicy.parse_url(@nsfw_url) == {:ok, expected}
+    end
+
+    test "warns when the API server fails" do
+      expected = "[NsfwApiPolicy]: The API server failed. Skipping."
+      assert capture_log(fn -> NsfwApiPolicy.parse_url(@timeout_url) end) =~ expected
+    end
+
+    test "returns {:error, _} tuple when the API server fails" do
+      capture_log(fn ->
+        assert {:error, _} = NsfwApiPolicy.parse_url(@timeout_url)
+      end)
+    end
+  end
+
+  describe "check_url_nsfw/1" do
+    test "returns {:nsfw, _} tuple" do
+      expected = {:nsfw, %{url: @nsfw_url, score: 0.99772077798843384, threshold: 0.7}}
+      assert NsfwApiPolicy.check_url_nsfw(@nsfw_url) == expected
+    end
+
+    test "returns {:sfw, _} tuple" do
+      expected = {:sfw, %{url: @sfw_url, score: 0.00011714912398019806, threshold: 0.7}}
+      assert NsfwApiPolicy.check_url_nsfw(@sfw_url) == expected
+    end
+
+    test "returns {:sfw, _} on failure" do
+      expected = {:sfw, %{url: @timeout_url, score: nil, threshold: 0.7}}
+
+      capture_log(fn ->
+        assert NsfwApiPolicy.check_url_nsfw(@timeout_url) == expected
+      end)
+    end
+
+    test "works with map URL" do
+      expected = {:nsfw, %{url: @nsfw_url, score: 0.99772077798843384, threshold: 0.7}}
+      assert NsfwApiPolicy.check_url_nsfw(%{"href" => @nsfw_url}) == expected
+    end
+  end
+
+  describe "check_attachment_nsfw/1" do
+    test "returns {:nsfw, _} if any items are NSFW" do
+      attachment = %{"url" => [%{"href" => @nsfw_url}, @nsfw_url, @sfw_url]}
+      assert NsfwApiPolicy.check_attachment_nsfw(attachment) == {:nsfw, attachment}
+    end
+
+    test "returns {:sfw, _} if all items are SFW" do
+      attachment = %{"url" => [%{"href" => @sfw_url}, @sfw_url, @sfw_url]}
+      assert NsfwApiPolicy.check_attachment_nsfw(attachment) == {:sfw, attachment}
+    end
+
+    test "works with binary URL" do
+      attachment = %{"url" => @nsfw_url}
+      assert NsfwApiPolicy.check_attachment_nsfw(attachment) == {:nsfw, attachment}
+    end
+  end
+
+  describe "check_object_nsfw/1" do
+    test "returns {:nsfw, _} if any items are NSFW" do
+      object = %{"attachment" => [%{"url" => [%{"href" => @nsfw_url}, @sfw_url]}]}
+      assert NsfwApiPolicy.check_object_nsfw(object) == {:nsfw, object}
+    end
+
+    test "returns {:sfw, _} if all items are SFW" do
+      object = %{"attachment" => [%{"url" => [%{"href" => @sfw_url}, @sfw_url]}]}
+      assert NsfwApiPolicy.check_object_nsfw(object) == {:sfw, object}
+    end
+
+    test "works with embedded object" do
+      object = %{"object" => %{"attachment" => [%{"url" => [%{"href" => @nsfw_url}, @sfw_url]}]}}
+      assert NsfwApiPolicy.check_object_nsfw(object) == {:nsfw, object}
+    end
+  end
+
+  describe "unlist/1" do
+    test "unlist addressing" do
+      user = insert(:user)
+
+      object = %{
+        "to" => [Constants.as_public()],
+        "cc" => [user.follower_address, "https://hello.world/users/alex"],
+        "actor" => user.ap_id
+      }
+
+      expected = %{
+        "to" => [user.follower_address],
+        "cc" => [Constants.as_public(), "https://hello.world/users/alex"],
+        "actor" => user.ap_id
+      }
+
+      assert NsfwApiPolicy.unlist(object) == expected
+    end
+
+    test "raise if user isn't found" do
+      object = %{
+        "to" => [Constants.as_public()],
+        "cc" => [],
+        "actor" => "https://hello.world/users/alex"
+      }
+
+      assert_raise(RuntimeError, fn ->
+        NsfwApiPolicy.unlist(object)
+      end)
+    end
+  end
+
+  describe "mark_sensitive/1" do
+    test "adds nsfw tag and marks sensitive" do
+      object = %{"tag" => ["yolo"]}
+      expected = %{"tag" => ["yolo", "nsfw"], "sensitive" => true}
+      assert NsfwApiPolicy.mark_sensitive(object) == expected
+    end
+
+    test "works with embedded object" do
+      object = %{"object" => %{"tag" => ["yolo"]}}
+      expected = %{"object" => %{"tag" => ["yolo", "nsfw"], "sensitive" => true}}
+      assert NsfwApiPolicy.mark_sensitive(object) == expected
+    end
+  end
+
+  describe "filter/1" do
+    setup do
+      user = insert(:user)
+
+      nsfw_object = %{
+        "to" => [Constants.as_public()],
+        "cc" => [user.follower_address],
+        "actor" => user.ap_id,
+        "attachment" => [%{"url" => @nsfw_url}]
+      }
+
+      sfw_object = %{
+        "to" => [Constants.as_public()],
+        "cc" => [user.follower_address],
+        "actor" => user.ap_id,
+        "attachment" => [%{"url" => @sfw_url}]
+      }
+
+      %{user: user, nsfw_object: nsfw_object, sfw_object: sfw_object}
+    end
+
+    test "passes SFW object through", %{sfw_object: object} do
+      {:ok, _} = NsfwApiPolicy.filter(object)
+    end
+
+    test "passes NSFW object through when actions are disabled", %{nsfw_object: object} do
+      clear_config([@policy, :mark_sensitive], false)
+      clear_config([@policy, :unlist], false)
+      clear_config([@policy, :reject], false)
+      {:ok, _} = NsfwApiPolicy.filter(object)
+    end
+
+    test "passes NSFW object through when :threshold is 1", %{nsfw_object: object} do
+      clear_config([@policy, :reject], true)
+      clear_config([@policy, :threshold], 1)
+      {:ok, _} = NsfwApiPolicy.filter(object)
+    end
+
+    test "rejects SFW object through when :threshold is 0", %{sfw_object: object} do
+      clear_config([@policy, :reject], true)
+      clear_config([@policy, :threshold], 0)
+      {:reject, _} = NsfwApiPolicy.filter(object)
+    end
+
+    test "rejects NSFW when :reject is enabled", %{nsfw_object: object} do
+      clear_config([@policy, :reject], true)
+      {:reject, _} = NsfwApiPolicy.filter(object)
+    end
+
+    test "passes NSFW through when :reject is disabled", %{nsfw_object: object} do
+      clear_config([@policy, :reject], false)
+      {:ok, _} = NsfwApiPolicy.filter(object)
+    end
+
+    test "unlists NSFW when :unlist is enabled", %{user: user, nsfw_object: object} do
+      clear_config([@policy, :unlist], true)
+      {:ok, object} = NsfwApiPolicy.filter(object)
+      assert object["to"] == [user.follower_address]
+    end
+
+    test "passes NSFW through when :unlist is disabled", %{nsfw_object: object} do
+      clear_config([@policy, :unlist], false)
+      {:ok, object} = NsfwApiPolicy.filter(object)
+      assert object["to"] == [Constants.as_public()]
+    end
+  end
+end

From b293c14a1b01398029dfa80aea306946efc2f284 Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Thu, 17 Jun 2021 14:52:07 -0500
Subject: [PATCH 04/65] NsfwApiPolicy: add describe/0 and config_description/0

---
 .../web/activity_pub/mrf/nsfw_api_policy.ex   | 56 ++++++++++++++++++-
 1 file changed, 54 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
index 9dcdf560e..a1560c584 100644
--- a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
@@ -10,7 +10,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.NsfwApiPolicy do
 
       config :pleroma, Pleroma.Web.ActivityPub.MRF.NsfwMRF,
         url: "http://127.0.0.1:5000/",
-        threshold: 0.8,
+        threshold: 0.7,
         mark_sensitive: true,
         unlist: false,
         reject: false
@@ -202,5 +202,57 @@ defp fix_path(%URI{path: path} = uri) when is_binary(path) do
   defp fix_path(%URI{path: nil} = uri), do: Map.put(uri, :path, "/")
 
   @impl true
-  def describe, do: {:ok, %{}}
+  def describe do
+    options = %{
+      threshold: Config.get([@policy, :threshold]),
+      mark_sensitive: Config.get([@policy, :mark_sensitive]),
+      unlist: Config.get([@policy, :unlist]),
+      reject: Config.get([@policy, :reject])
+    }
+
+    {:ok, %{@policy => options}}
+  end
+
+  @impl true
+  def config_description do
+    %{
+      key: @policy,
+      related_policy: to_string(__MODULE__),
+      label: "NSFW API Policy",
+      description:
+        "Hide, delete, or mark sensitive NSFW content with artificial intelligence. Requires running an external API server.",
+      children: [
+        %{
+          key: :url,
+          type: :string,
+          description: "Base URL of the API server.",
+          suggestions: ["http://127.0.0.1:5000/"]
+        },
+        %{
+          key: :threshold,
+          type: :float,
+          description: "Lowest score to take action on. Between 0 and 1.",
+          suggestions: [0.7]
+        },
+        %{
+          key: :mark_sensitive,
+          type: :boolean,
+          description: "Mark sensitive all detected NSFW content?",
+          suggestions: [true]
+        },
+        %{
+          key: :unlist,
+          type: :boolean,
+          description: "Unlist sensitive all detected NSFW content?",
+          suggestions: [false]
+        },
+        %{
+          key: :reject,
+          type: :boolean,
+          description: "Reject sensitive all detected NSFW content (takes precedence)?",
+          suggestions: [false]
+        }
+      ]
+    }
+  end
 end

From c802c3055ef6c1f763d5df68f9e5308093f7d565 Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Thu, 17 Jun 2021 15:04:40 -0500
Subject: [PATCH 05/65] NsfwApiPolicy: add systemd example file

---
 installation/nsfw-api.service | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 installation/nsfw-api.service

diff --git a/installation/nsfw-api.service b/installation/nsfw-api.service
new file mode 100644
index 000000000..ec629df67
--- /dev/null
+++ b/installation/nsfw-api.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=NSFW API
+After=docker.service
+Requires=docker.service
+
+[Service]
+TimeoutStartSec=0
+Restart=always
+ExecStartPre=-/usr/bin/docker stop %n
+ExecStartPre=-/usr/bin/docker rm %n
+ExecStartPre=/usr/bin/docker pull eugencepoi/nsfw_api:latest
+ExecStart=/usr/bin/docker run --rm -p 127.0.0.1:5000:5000/tcp --env PORT=5000 --name %n eugencepoi/nsfw_api:latest
+
+[Install]
+WantedBy=multi-user.target

From a704d5499c03cb5609ea38a5f2ef06095ced3ef3 Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Thu, 17 Jun 2021 15:32:42 -0500
Subject: [PATCH 06/65] NsfwApiPolicy: Fall back more generously when functions
 don't match

---
 lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
index a1560c584..920821f38 100644
--- a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
@@ -92,6 +92,11 @@ def check_url_nsfw(%{"href" => url}) when is_binary(url) do
     check_url_nsfw(url)
   end
 
+  def check_url_nsfw(url) do
+    threshold = Config.get([@policy, :threshold])
+    {:sfw, %{url: url, score: nil, threshold: threshold}}
+  end
+
   def check_attachment_nsfw(%{"url" => urls} = attachment) when is_list(urls) do
     if Enum.all?(urls, &match?({:sfw, _}, check_url_nsfw(&1))) do
       {:sfw, attachment}
@@ -107,6 +112,8 @@ def check_attachment_nsfw(%{"url" => url} = attachment) when is_binary(url) do
     end
   end
 
+  def check_attachment_nsfw(attachment), do: {:sfw, attachment}
+
   def check_object_nsfw(%{"attachment" => attachments} = object) when is_list(attachments) do
     if Enum.all?(attachments, &match?({:sfw, _}, check_attachment_nsfw(&1))) do
       {:sfw, object}

From 9423052e9217aa1358950d37c5c96b11d554b37a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Mon, 25 Apr 2022 12:39:36 +0200
Subject: [PATCH 07/65] Add "status" notification type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 lib/pleroma/notification.ex                   | 38 ++++++++++++--
 .../operations/notification_operation.ex      |  4 +-
 .../controllers/notification_controller.ex    |  1 +
 .../mastodon_api/views/notification_view.ex   |  3 ++
 lib/pleroma/web/push/impl.ex                  |  1 +
 ...00000_add_status_to_notifications_enum.exs | 50 +++++++++++++++++++
 test/pleroma/notification_test.exs            |  1 +
 7 files changed, 92 insertions(+), 6 deletions(-)
 create mode 100644 priv/repo/migrations/20220319000000_add_status_to_notifications_enum.exs

diff --git a/lib/pleroma/notification.ex b/lib/pleroma/notification.ex
index 52fd2656b..d142baa8b 100644
--- a/lib/pleroma/notification.ex
+++ b/lib/pleroma/notification.ex
@@ -73,6 +73,7 @@ def unread_notifications_count(%User{id: user_id}) do
     pleroma:report
     reblog
     poll
+    status
   }
 
   def changeset(%Notification{} = notification, attrs) do
@@ -397,11 +398,18 @@ defp do_create_notifications(%Activity{} = activity, options) do
     {enabled_receivers, disabled_receivers} = get_notified_from_activity(activity)
     potential_receivers = enabled_receivers ++ disabled_receivers
 
+    {enabled_subscribers, disabled_subscribers} = get_notified_subscribers_from_activity(activity)
+    potential_subscribers = (enabled_subscribers ++ disabled_subscribers) -- potential_receivers
+
     notifications =
-      Enum.map(potential_receivers, fn user ->
-        do_send = do_send && user in enabled_receivers
-        create_notification(activity, user, do_send: do_send)
-      end)
+      (Enum.map(potential_receivers, fn user ->
+         do_send = do_send && user in enabled_receivers
+         create_notification(activity, user, do_send: do_send)
+       end) ++
+         Enum.map(potential_subscribers, fn user ->
+           do_send = do_send && user in enabled_subscribers
+           create_notification(activity, user, do_send: do_send, type: "status")
+         end))
       |> Enum.reject(&is_nil/1)
 
     {:ok, notifications}
@@ -533,6 +541,27 @@ def get_notified_from_activity(%Activity{data: %{"type" => type}} = activity, lo
 
   def get_notified_from_activity(_, _local_only), do: {[], []}
 
+  def get_notified_subscribers_from_activity(activity, local_only \\ true)
+
+  def get_notified_subscribers_from_activity(
+        %Activity{data: %{"type" => "Create"}} = activity,
+        local_only
+      ) do
+    notification_enabled_ap_ids =
+      []
+      |> Utils.maybe_notify_subscribers(activity)
+
+    potential_receivers =
+      User.get_users_from_set(notification_enabled_ap_ids, local_only: local_only)
+
+    notification_enabled_users =
+      Enum.filter(potential_receivers, fn u -> u.ap_id in notification_enabled_ap_ids end)
+
+    {notification_enabled_users, potential_receivers -- notification_enabled_users}
+  end
+
+  def get_notified_subscribers_from_activity(_, _), do: {[], []}
+
   # For some activities, only notify the author of the object
   def get_potential_receiver_ap_ids(%{data: %{"type" => type, "object" => object_id}})
       when type in ~w{Like Announce EmojiReact} do
@@ -557,7 +586,6 @@ def get_potential_receiver_ap_ids(activity) do
     []
     |> Utils.maybe_notify_to_recipients(activity)
     |> Utils.maybe_notify_mentioned_recipients(activity)
-    |> Utils.maybe_notify_subscribers(activity)
     |> Utils.maybe_notify_followers(activity)
     |> Enum.uniq()
   end
diff --git a/lib/pleroma/web/api_spec/operations/notification_operation.ex b/lib/pleroma/web/api_spec/operations/notification_operation.ex
index 7f2336ff6..aa965fabb 100644
--- a/lib/pleroma/web/api_spec/operations/notification_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/notification_operation.ex
@@ -196,7 +196,8 @@ defp notification_type do
         "pleroma:report",
         "move",
         "follow_request",
-        "poll"
+        "poll",
+        "status"
       ],
       description: """
       The type of event that resulted in the notification.
@@ -210,6 +211,7 @@ defp notification_type do
       - `pleroma:emoji_reaction` - Someone reacted with emoji to your status
       - `pleroma:chat_mention` - Someone mentioned you in a chat message
       - `pleroma:report` - Someone was reported
+      - `status` - Someone you are subscribed to created a status
       """
     }
   end
diff --git a/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex b/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex
index 932bc6423..9209e8ebd 100644
--- a/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex
@@ -51,6 +51,7 @@ def index(conn, %{account_id: account_id} = params) do
     move
     pleroma:emoji_reaction
     poll
+    status
   }
   def index(%{assigns: %{user: user}} = conn, params) do
     params =
diff --git a/lib/pleroma/web/mastodon_api/views/notification_view.ex b/lib/pleroma/web/mastodon_api/views/notification_view.ex
index 0dc7f3beb..b10b0893c 100644
--- a/lib/pleroma/web/mastodon_api/views/notification_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/notification_view.ex
@@ -103,6 +103,9 @@ def render(
       "mention" ->
         put_status(response, activity, reading_user, status_render_opts)
 
+      "status" ->
+        put_status(response, activity, reading_user, status_render_opts)
+
       "favourite" ->
         put_status(response, parent_activity_fn.(), reading_user, status_render_opts)
 
diff --git a/lib/pleroma/web/push/impl.ex b/lib/pleroma/web/push/impl.ex
index daf3eeb9e..77bc2941d 100644
--- a/lib/pleroma/web/push/impl.ex
+++ b/lib/pleroma/web/push/impl.ex
@@ -183,6 +183,7 @@ def format_title(%{activity: %{data: %{"directMessage" => true}}}, _mastodon_typ
   def format_title(%{type: type}, mastodon_type) do
     case mastodon_type || type do
       "mention" -> "New Mention"
+      "status" -> "New Status"
       "follow" -> "New Follower"
       "follow_request" -> "New Follow Request"
       "reblog" -> "New Repeat"
diff --git a/priv/repo/migrations/20220319000000_add_status_to_notifications_enum.exs b/priv/repo/migrations/20220319000000_add_status_to_notifications_enum.exs
new file mode 100644
index 000000000..62c0afb63
--- /dev/null
+++ b/priv/repo/migrations/20220319000000_add_status_to_notifications_enum.exs
@@ -0,0 +1,50 @@
+defmodule Pleroma.Repo.Migrations.AddStatusToNotificationsEnum do
+  use Ecto.Migration
+
+  @disable_ddl_transaction true
+
+  def up do
+    """
+    alter type notification_type add value 'status'
+    """
+    |> execute()
+  end
+
+  def down do
+    alter table(:notifications) do
+      modify(:type, :string)
+    end
+
+    """
+    delete from notifications where type = 'status'
+    """
+    |> execute()
+
+    """
+    drop type if exists notification_type
+    """
+    |> execute()
+
+    """
+    create type notification_type as enum (
+      'follow',
+      'follow_request',
+      'mention',
+      'move',
+      'pleroma:emoji_reaction',
+      'pleroma:chat_mention',
+      'reblog',
+      'favourite',
+      'pleroma:report',
+      'poll
+    )
+    """
+    |> execute()
+
+    """
+    alter table notifications
+    alter column type type notification_type using (type::notification_type)
+    """
+    |> execute()
+  end
+end
diff --git a/test/pleroma/notification_test.exs b/test/pleroma/notification_test.exs
index 805764ea4..eea2fcb67 100644
--- a/test/pleroma/notification_test.exs
+++ b/test/pleroma/notification_test.exs
@@ -104,6 +104,7 @@ test "it creates a notification for subscribed users" do
       {:ok, [notification]} = Notification.create_notifications(status)
 
       assert notification.user_id == subscriber.id
+      assert notification.type == "status"
     end
 
     test "does not create a notification for subscribed users if status is a reply" do

From fa2a6d5d6b24657ddbda4ef11d2e6dbcb59545d3 Mon Sep 17 00:00:00 2001
From: Claudio Maradonna <penguyman@stronzi.org>
Date: Thu, 7 Apr 2022 18:25:02 +0200
Subject: [PATCH 08/65] feat: simple, but not stupid, uploader for IPFS

fix: format fix with credo
---
 config/config.exs             |  4 +++
 config/description.exs        | 24 +++++++++++++
 config/dev.exs                |  4 +++
 lib/pleroma/upload.ex         | 13 +++++--
 lib/pleroma/uploaders/ipfs.ex | 64 +++++++++++++++++++++++++++++++++++
 5 files changed, 107 insertions(+), 2 deletions(-)
 create mode 100644 lib/pleroma/uploaders/ipfs.ex

diff --git a/config/config.exs b/config/config.exs
index 6a5acda09..7efad0061 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -82,6 +82,10 @@
   # region: "us-east-1", # may be required for Amazon AWS
   scheme: "https://"
 
+config :pleroma, Pleroma.Uploaders.IPFS,
+  post_gateway_url: nil,
+  get_gateway_url: nil
+
 config :pleroma, :emoji,
   shortcode_globs: ["/emoji/custom/**/*.png"],
   pack_extensions: [".png", ".gif"],
diff --git a/config/description.exs b/config/description.exs
index 7caad18b4..d87bbb9b8 100644
--- a/config/description.exs
+++ b/config/description.exs
@@ -136,6 +136,30 @@
       }
     ]
   },
+  %{
+    group: :pleroma,
+    key: Pleroma.Uploaders.IPFS,
+    type: :group,
+    description: "IPFS uploader-related settings",
+    children: [
+      %{
+        key: :get_gateway_url,
+        type: :string,
+        description: "GET Gateway URL",
+        suggestions: [
+          "get_gateway_url"
+        ]
+      },
+      %{
+        key: :post_gateway_url,
+        type: :string,
+        description: "POST Gateway URL",
+        suggestions: [
+          "post_gateway_url"
+        ]
+      }
+    ]
+  },
   %{
     group: :pleroma,
     key: Pleroma.Uploaders.S3,
diff --git a/config/dev.exs b/config/dev.exs
index ab3e83c12..89a84bf05 100644
--- a/config/dev.exs
+++ b/config/dev.exs
@@ -58,6 +58,10 @@
 # https://dashbit.co/blog/speeding-up-re-compilation-of-elixir-projects
 config :phoenix, :plug_init_mode, :runtime
 
+config :pleroma, Pleroma.Uploaders.IPFS,
+  post_gateway_url: nil,
+  get_gateway_url: nil
+
 if File.exists?("./config/dev.secret.exs") do
   import_config "dev.secret.exs"
 else
diff --git a/lib/pleroma/upload.ex b/lib/pleroma/upload.ex
index db2909276..de39bcd6c 100644
--- a/lib/pleroma/upload.ex
+++ b/lib/pleroma/upload.ex
@@ -235,8 +235,14 @@ defp url_from_spec(%__MODULE__{name: name}, base_url, {:file, path}) do
           ""
         end
 
-    [base_url, path]
-    |> Path.join()
+    uploader = Config.get([Pleroma.Upload, :uploader])
+
+    if uploader == Pleroma.Uploaders.IPFS && String.contains?(base_url, "{CID}") do
+      String.replace(base_url, "{CID}", path)
+    else
+      [base_url, path]
+      |> Path.join()
+    end
   end
 
   defp url_from_spec(_upload, _base_url, {:url, url}), do: url
@@ -273,6 +279,9 @@ def base_url do
           Path.join([upload_base_url, bucket_with_namespace])
         end
 
+      Pleroma.Uploaders.IPFS ->
+        Config.get([Pleroma.Uploaders.IPFS, :get_gateway_url])
+
       _ ->
         public_endpoint || upload_base_url || Pleroma.Web.Endpoint.url() <> "/media/"
     end
diff --git a/lib/pleroma/uploaders/ipfs.ex b/lib/pleroma/uploaders/ipfs.ex
new file mode 100644
index 000000000..b46e9322e
--- /dev/null
+++ b/lib/pleroma/uploaders/ipfs.ex
@@ -0,0 +1,64 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Uploaders.IPFS do
+  @behaviour Pleroma.Uploaders.Uploader
+  require Logger
+
+  alias Pleroma.Config
+  alias Tesla.Multipart
+
+  @impl true
+  def get_file(file) do
+    b_url = Pleroma.Upload.base_url()
+
+    if String.contains?(b_url, "{CID}") do
+      {:ok, {:url, String.replace(b_url, "{CID}", URI.decode(file))}}
+    else
+      {:error, "IPFS Get URL doesn't contain '{CID}' placeholder"}
+    end
+  end
+
+  @impl true
+  def put_file(%Pleroma.Upload{} = upload) do
+    config = Config.get([__MODULE__])
+    post_base_url = Keyword.get(config, :post_gateway_url)
+
+    mp =
+      Multipart.new()
+      |> Multipart.add_content_type_param("charset=utf-8")
+      |> Multipart.add_file(upload.tempfile)
+
+    final_url = Path.join([post_base_url, "/api/v0/add"])
+
+    case Pleroma.HTTP.post(final_url, mp, [], params: ["cid-version": "1"]) do
+      {:ok, ret} ->
+        case Jason.decode(ret.body) do
+          {:ok, ret} ->
+            {:ok, {:file, ret["Hash"]}}
+
+          error ->
+            Logger.error("#{__MODULE__}: #{inspect(error)}")
+            {:error, "JSON decode failed"}
+        end
+
+      error ->
+        Logger.error("#{__MODULE__}: #{inspect(error)}")
+        {:error, "IPFS Gateway Upload failed"}
+    end
+  end
+
+  @impl true
+  def delete_file(file) do
+    config = Config.get([__MODULE__])
+    post_base_url = Keyword.get(config, :post_gateway_url)
+
+    final_url = Path.join([post_base_url, "/api/v0/files/rm"])
+
+    case Pleroma.HTTP.post(final_url, "", [], params: [arg: file]) do
+      {:ok, %{status_code: 204}} -> :ok
+      error -> {:error, inspect(error)}
+    end
+  end
+end

From 43dfa58ebda407a0813d398bee8d0ae3e5c9fd5b Mon Sep 17 00:00:00 2001
From: Claudio Maradonna <penguyman@stronzi.org>
Date: Mon, 11 Apr 2022 15:10:01 +0200
Subject: [PATCH 09/65] added tests for ipfs uploader. adapted changelog.md
 accordingly. improved ipfs uploader with external suggestions

fix lint description.exs
---
 CHANGELOG.md                         |  1 +
 config/description.exs               |  5 +-
 config/dev.exs                       |  4 --
 docs/configuration/cheatsheet.md     | 13 ++++
 lib/pleroma/upload.ex                |  6 +-
 lib/pleroma/uploaders/ipfs.ex        | 14 +++--
 test/pleroma/uploaders/ipfs_test.exs | 88 ++++++++++++++++++++++++++++
 7 files changed, 116 insertions(+), 15 deletions(-)
 create mode 100644 test/pleroma/uploaders/ipfs_test.exs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f1beb0cd0..b2185b1ba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,6 +32,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - PleromaAPI: Add `GET /api/v1/pleroma/birthdays` API endpoint
 - Make backend-rendered pages translatable. This includes emails. Pages returned as a HTTP response are translated using the language specified in the `userLanguage` cookie, or the `Accept-Language` header. Emails are translated using the `language` field when registering. This language can be changed by `PATCH /api/v1/accounts/update_credentials` with the `language` field.
 - Uploadfilter `Pleroma.Upload.Filter.Exiftool.ReadDescription` returns description values to the FE so they can pre fill the image description field
+- Uploader: Add support for uploading attachments using IPFS
 
 ### Fixed
 - Subscription(Bell) Notifications: Don't create from Pipeline Ingested replies
diff --git a/config/description.exs b/config/description.exs
index d87bbb9b8..1fe5f01f0 100644
--- a/config/description.exs
+++ b/config/description.exs
@@ -147,7 +147,8 @@
         type: :string,
         description: "GET Gateway URL",
         suggestions: [
-          "get_gateway_url"
+          "https://ipfs.mydomain.com/<%= cid %>",
+          "https://<%= cid %>.ipfs.mydomain.com/"
         ]
       },
       %{
@@ -155,7 +156,7 @@
         type: :string,
         description: "POST Gateway URL",
         suggestions: [
-          "post_gateway_url"
+          "http://localhost:5001/"
         ]
       }
     ]
diff --git a/config/dev.exs b/config/dev.exs
index 89a84bf05..ab3e83c12 100644
--- a/config/dev.exs
+++ b/config/dev.exs
@@ -58,10 +58,6 @@
 # https://dashbit.co/blog/speeding-up-re-compilation-of-elixir-projects
 config :phoenix, :plug_init_mode, :runtime
 
-config :pleroma, Pleroma.Uploaders.IPFS,
-  post_gateway_url: nil,
-  get_gateway_url: nil
-
 if File.exists?("./config/dev.secret.exs") do
   import_config "dev.secret.exs"
 else
diff --git a/docs/configuration/cheatsheet.md b/docs/configuration/cheatsheet.md
index 74642397b..7e1f9c934 100644
--- a/docs/configuration/cheatsheet.md
+++ b/docs/configuration/cheatsheet.md
@@ -614,6 +614,19 @@ config :ex_aws, :s3,
   host: "s3.eu-central-1.amazonaws.com"
 ```
 
+#### Pleroma.Uploaders.IPFS
+
+* `post_gateway_url`: URL with port of POST Gateway (unauthenticated)
+* `get_gateway_url`: URL of public GET Gateway
+
+Example:
+
+```elixir
+config :pleroma, Pleroma.Uploaders.IPFS,
+  post_gateway_url: "http://localhost:5001",
+  get_gateway_url: "http://<%= cid %>.ipfs.mydomain.com"
+```
+
 ### Upload filters
 
 #### Pleroma.Upload.Filter.AnonymizeFilename
diff --git a/lib/pleroma/upload.ex b/lib/pleroma/upload.ex
index de39bcd6c..b51d23f9e 100644
--- a/lib/pleroma/upload.ex
+++ b/lib/pleroma/upload.ex
@@ -235,10 +235,8 @@ defp url_from_spec(%__MODULE__{name: name}, base_url, {:file, path}) do
           ""
         end
 
-    uploader = Config.get([Pleroma.Upload, :uploader])
-
-    if uploader == Pleroma.Uploaders.IPFS && String.contains?(base_url, "{CID}") do
-      String.replace(base_url, "{CID}", path)
+    if String.contains?(base_url, "<%= cid %>") do
+      EEx.eval_string(base_url, cid: path)
     else
       [base_url, path]
       |> Path.join()
diff --git a/lib/pleroma/uploaders/ipfs.ex b/lib/pleroma/uploaders/ipfs.ex
index b46e9322e..722c68fa1 100644
--- a/lib/pleroma/uploaders/ipfs.ex
+++ b/lib/pleroma/uploaders/ipfs.ex
@@ -13,10 +13,10 @@ defmodule Pleroma.Uploaders.IPFS do
   def get_file(file) do
     b_url = Pleroma.Upload.base_url()
 
-    if String.contains?(b_url, "{CID}") do
-      {:ok, {:url, String.replace(b_url, "{CID}", URI.decode(file))}}
+    if String.contains?(b_url, "<%= cid %>") do
+      {:ok, {:url, EEx.eval_string(b_url, cid: URI.decode(file))}}
     else
-      {:error, "IPFS Get URL doesn't contain '{CID}' placeholder"}
+      {:error, "IPFS Get URL doesn't contain 'cid' placeholder"}
     end
   end
 
@@ -36,7 +36,11 @@ def put_file(%Pleroma.Upload{} = upload) do
       {:ok, ret} ->
         case Jason.decode(ret.body) do
           {:ok, ret} ->
-            {:ok, {:file, ret["Hash"]}}
+            if Map.has_key?(ret, "Hash") do
+              {:ok, {:file, ret["Hash"]}}
+            else
+              {:error, "JSON doesn't contain Hash value"}
+            end
 
           error ->
             Logger.error("#{__MODULE__}: #{inspect(error)}")
@@ -45,7 +49,7 @@ def put_file(%Pleroma.Upload{} = upload) do
 
       error ->
         Logger.error("#{__MODULE__}: #{inspect(error)}")
-        {:error, "IPFS Gateway Upload failed"}
+        {:error, "IPFS Gateway upload failed"}
     end
   end
 
diff --git a/test/pleroma/uploaders/ipfs_test.exs b/test/pleroma/uploaders/ipfs_test.exs
new file mode 100644
index 000000000..f9ae046cf
--- /dev/null
+++ b/test/pleroma/uploaders/ipfs_test.exs
@@ -0,0 +1,88 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Uploaders.IPFSTest do
+  use Pleroma.DataCase
+
+  alias Pleroma.Uploaders.IPFS
+  alias Tesla.Multipart
+
+  import Mock
+  import ExUnit.CaptureLog
+
+  setup do
+    clear_config([Pleroma.Upload, :uploader], Pleroma.Uploaders.IPFS)
+    clear_config([Pleroma.Uploaders.IPFS])
+
+    clear_config(
+      [Pleroma.Uploaders.IPFS, :get_gateway_url],
+      "https://<%= cid %>.ipfs.mydomain.com"
+    )
+
+    clear_config([Pleroma.Uploaders.IPFS, :post_gateway_url], "http://localhost:5001")
+  end
+
+  describe "get_file/1" do
+    test "it returns path to ipfs file with cid as subdomain" do
+      assert IPFS.get_file("testcid") == {
+               :ok,
+               {:url, "https://testcid.ipfs.mydomain.com"}
+             }
+    end
+
+    test "it returns path to ipfs file with cid as path" do
+      clear_config(
+        [Pleroma.Uploaders.IPFS, :get_gateway_url],
+        "https://ipfs.mydomain.com/ipfs/<%= cid %>"
+      )
+
+      assert IPFS.get_file("testcid") == {
+               :ok,
+               {:url, "https://ipfs.mydomain.com/ipfs/testcid"}
+             }
+    end
+  end
+
+  describe "put_file/1" do
+    setup do
+      file_upload = %Pleroma.Upload{
+        name: "image-tet.jpg",
+        content_type: "image/jpeg",
+        path: "test_folder/image-tet.jpg",
+        tempfile: Path.absname("test/instance_static/add/shortcode.png")
+      }
+
+      [file_upload: file_upload]
+    end
+
+    test "save file", %{file_upload: file_upload} do
+      with_mock Pleroma.HTTP,
+        post: fn _, _, _, _ ->
+          {:ok,
+           %Tesla.Env{
+             status: 200,
+             body: "{\"Hash\":\"bafybeicrh7ltzx52yxcwrvxxckfmwhqdgsb6qym6dxqm2a4ymsakeshwoi\"}"
+           }}
+        end do
+        assert IPFS.put_file(file_upload) ==
+                 {:ok, {:file, "bafybeicrh7ltzx52yxcwrvxxckfmwhqdgsb6qym6dxqm2a4ymsakeshwoi"}}
+      end
+    end
+
+    test "returns error", %{file_upload: file_upload} do
+      with_mock Pleroma.HTTP, post: fn _, _, _, _ -> {:error, "IPFS Gateway upload failed"} end do
+        assert capture_log(fn ->
+                 assert IPFS.put_file(file_upload) == {:error, "IPFS Gateway upload failed"}
+               end) =~ "Elixir.Pleroma.Uploaders.IPFS: {:error, \"IPFS Gateway upload failed\"}"
+      end
+    end
+  end
+
+  describe "delete_file/1" do
+    test_with_mock "deletes file", Pleroma.HTTP,
+      post: fn _, _, _, _ -> {:ok, %{status_code: 204}} end do
+      assert :ok = IPFS.delete_file("image.jpg")
+    end
+  end
+end

From 44659ecd65fb2251f9130fcecf1732b8931104c1 Mon Sep 17 00:00:00 2001
From: Claudio Maradonna <penguyman@stronzi.org>
Date: Sat, 16 Apr 2022 09:38:49 +0200
Subject: [PATCH 10/65] ipfs: revert to String.replace for cid placeholder

ipfs: fix lint
---
 config/description.exs               | 4 ++--
 docs/configuration/cheatsheet.md     | 2 +-
 lib/pleroma/upload.ex                | 4 ++--
 lib/pleroma/uploaders/ipfs.ex        | 7 +++++--
 test/pleroma/uploaders/ipfs_test.exs | 4 ++--
 5 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/config/description.exs b/config/description.exs
index 1fe5f01f0..b180e7308 100644
--- a/config/description.exs
+++ b/config/description.exs
@@ -147,8 +147,8 @@
         type: :string,
         description: "GET Gateway URL",
         suggestions: [
-          "https://ipfs.mydomain.com/<%= cid %>",
-          "https://<%= cid %>.ipfs.mydomain.com/"
+          "https://ipfs.mydomain.com/{CID}",
+          "https://{CID}.ipfs.mydomain.com/"
         ]
       },
       %{
diff --git a/docs/configuration/cheatsheet.md b/docs/configuration/cheatsheet.md
index 7e1f9c934..d35b33574 100644
--- a/docs/configuration/cheatsheet.md
+++ b/docs/configuration/cheatsheet.md
@@ -624,7 +624,7 @@ Example:
 ```elixir
 config :pleroma, Pleroma.Uploaders.IPFS,
   post_gateway_url: "http://localhost:5001",
-  get_gateway_url: "http://<%= cid %>.ipfs.mydomain.com"
+  get_gateway_url: "http://{CID}.ipfs.mydomain.com"
 ```
 
 ### Upload filters
diff --git a/lib/pleroma/upload.ex b/lib/pleroma/upload.ex
index b51d23f9e..8a01cf613 100644
--- a/lib/pleroma/upload.ex
+++ b/lib/pleroma/upload.ex
@@ -235,8 +235,8 @@ defp url_from_spec(%__MODULE__{name: name}, base_url, {:file, path}) do
           ""
         end
 
-    if String.contains?(base_url, "<%= cid %>") do
-      EEx.eval_string(base_url, cid: path)
+    if String.contains?(base_url, Pleroma.Uploaders.IPFS.placeholder()) do
+      String.replace(base_url, Pleroma.Uploaders.IPFS.placeholder(), path)
     else
       [base_url, path]
       |> Path.join()
diff --git a/lib/pleroma/uploaders/ipfs.ex b/lib/pleroma/uploaders/ipfs.ex
index 722c68fa1..dde520d8e 100644
--- a/lib/pleroma/uploaders/ipfs.ex
+++ b/lib/pleroma/uploaders/ipfs.ex
@@ -9,12 +9,15 @@ defmodule Pleroma.Uploaders.IPFS do
   alias Pleroma.Config
   alias Tesla.Multipart
 
+  @placeholder "{CID}"
+  def placeholder, do: @placeholder
+
   @impl true
   def get_file(file) do
     b_url = Pleroma.Upload.base_url()
 
-    if String.contains?(b_url, "<%= cid %>") do
-      {:ok, {:url, EEx.eval_string(b_url, cid: URI.decode(file))}}
+    if String.contains?(b_url, @placeholder) do
+      {:ok, {:url, String.replace(b_url, @placeholder, URI.decode(file))}}
     else
       {:error, "IPFS Get URL doesn't contain 'cid' placeholder"}
     end
diff --git a/test/pleroma/uploaders/ipfs_test.exs b/test/pleroma/uploaders/ipfs_test.exs
index f9ae046cf..fc87fa378 100644
--- a/test/pleroma/uploaders/ipfs_test.exs
+++ b/test/pleroma/uploaders/ipfs_test.exs
@@ -17,7 +17,7 @@ defmodule Pleroma.Uploaders.IPFSTest do
 
     clear_config(
       [Pleroma.Uploaders.IPFS, :get_gateway_url],
-      "https://<%= cid %>.ipfs.mydomain.com"
+      "https://{CID}.ipfs.mydomain.com"
     )
 
     clear_config([Pleroma.Uploaders.IPFS, :post_gateway_url], "http://localhost:5001")
@@ -34,7 +34,7 @@ test "it returns path to ipfs file with cid as subdomain" do
     test "it returns path to ipfs file with cid as path" do
       clear_config(
         [Pleroma.Uploaders.IPFS, :get_gateway_url],
-        "https://ipfs.mydomain.com/ipfs/<%= cid %>"
+        "https://ipfs.mydomain.com/ipfs/{CID}"
       )
 
       assert IPFS.get_file("testcid") == {

From 7c1af86f979ecebcd38995e5278fe2d59a36eda5 Mon Sep 17 00:00:00 2001
From: Claudio Maradonna <penguyman@stronzi.org>
Date: Mon, 9 May 2022 12:15:40 +0200
Subject: [PATCH 11/65] ipfs: refactor final_url generation. add tests for
 final_url

fix lint
---
 lib/pleroma/uploaders/ipfs.ex        | 19 ++++++++++---------
 test/pleroma/uploaders/ipfs_test.exs | 13 ++++++++++++-
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/lib/pleroma/uploaders/ipfs.ex b/lib/pleroma/uploaders/ipfs.ex
index dde520d8e..7a7481d81 100644
--- a/lib/pleroma/uploaders/ipfs.ex
+++ b/lib/pleroma/uploaders/ipfs.ex
@@ -12,6 +12,13 @@ defmodule Pleroma.Uploaders.IPFS do
   @placeholder "{CID}"
   def placeholder, do: @placeholder
 
+  def get_final_url(method) do
+    config = Config.get([__MODULE__])
+    post_base_url = Keyword.get(config, :post_gateway_url)
+
+    Path.join([post_base_url, method])
+  end
+
   @impl true
   def get_file(file) do
     b_url = Pleroma.Upload.base_url()
@@ -25,15 +32,12 @@ def get_file(file) do
 
   @impl true
   def put_file(%Pleroma.Upload{} = upload) do
-    config = Config.get([__MODULE__])
-    post_base_url = Keyword.get(config, :post_gateway_url)
-
     mp =
       Multipart.new()
       |> Multipart.add_content_type_param("charset=utf-8")
       |> Multipart.add_file(upload.tempfile)
 
-    final_url = Path.join([post_base_url, "/api/v0/add"])
+    final_url = get_final_url("/api/v0/add")
 
     case Pleroma.HTTP.post(final_url, mp, [], params: ["cid-version": "1"]) do
       {:ok, ret} ->
@@ -42,7 +46,7 @@ def put_file(%Pleroma.Upload{} = upload) do
             if Map.has_key?(ret, "Hash") do
               {:ok, {:file, ret["Hash"]}}
             else
-              {:error, "JSON doesn't contain Hash value"}
+              {:error, "JSON doesn't contain Hash key"}
             end
 
           error ->
@@ -58,10 +62,7 @@ def put_file(%Pleroma.Upload{} = upload) do
 
   @impl true
   def delete_file(file) do
-    config = Config.get([__MODULE__])
-    post_base_url = Keyword.get(config, :post_gateway_url)
-
-    final_url = Path.join([post_base_url, "/api/v0/files/rm"])
+    final_url = get_final_url("/api/v0/files/rm")
 
     case Pleroma.HTTP.post(final_url, "", [], params: [arg: file]) do
       {:ok, %{status_code: 204}} -> :ok
diff --git a/test/pleroma/uploaders/ipfs_test.exs b/test/pleroma/uploaders/ipfs_test.exs
index fc87fa378..d567272d2 100644
--- a/test/pleroma/uploaders/ipfs_test.exs
+++ b/test/pleroma/uploaders/ipfs_test.exs
@@ -23,6 +23,16 @@ defmodule Pleroma.Uploaders.IPFSTest do
     clear_config([Pleroma.Uploaders.IPFS, :post_gateway_url], "http://localhost:5001")
   end
 
+  describe "get_final_url" do
+    test "it returns the final url for put_file" do
+      assert IPFS.get_final_url("/api/v0/add") == "http://localhost:5001/api/v0/add"
+    end
+
+    test "it returns the final url for delete_file" do
+      assert IPFS.get_final_url("/api/v0/files/rm") == "http://localhost:5001/api/v0/files/rm"
+    end
+  end
+
   describe "get_file/1" do
     test "it returns path to ipfs file with cid as subdomain" do
       assert IPFS.get_file("testcid") == {
@@ -62,7 +72,8 @@ test "save file", %{file_upload: file_upload} do
           {:ok,
            %Tesla.Env{
              status: 200,
-             body: "{\"Hash\":\"bafybeicrh7ltzx52yxcwrvxxckfmwhqdgsb6qym6dxqm2a4ymsakeshwoi\"}"
+             body:
+               "{\"Name\":\"image-tet.jpg\",\"Size\":\"5000\", \"Hash\":\"bafybeicrh7ltzx52yxcwrvxxckfmwhqdgsb6qym6dxqm2a4ymsakeshwoi\"}"
            }}
         end do
         assert IPFS.put_file(file_upload) ==

From 98f268e5ecc5bab98c98270a582f8b3f0e3be4e8 Mon Sep 17 00:00:00 2001
From: Claudio Maradonna <penguyman@stronzi.org>
Date: Thu, 9 Jun 2022 19:24:13 +0200
Subject: [PATCH 12/65] ipfs: small refactor and more tests

---
 lib/pleroma/uploaders/ipfs.ex        | 24 ++++++++++++++----------
 test/pleroma/uploaders/ipfs_test.exs | 24 ++++++++++++++++++++++--
 2 files changed, 36 insertions(+), 12 deletions(-)

diff --git a/lib/pleroma/uploaders/ipfs.ex b/lib/pleroma/uploaders/ipfs.ex
index 7a7481d81..9f6f26e2e 100644
--- a/lib/pleroma/uploaders/ipfs.ex
+++ b/lib/pleroma/uploaders/ipfs.ex
@@ -9,16 +9,24 @@ defmodule Pleroma.Uploaders.IPFS do
   alias Pleroma.Config
   alias Tesla.Multipart
 
-  @placeholder "{CID}"
-  def placeholder, do: @placeholder
-
-  def get_final_url(method) do
+  defp get_final_url(method) do
     config = Config.get([__MODULE__])
     post_base_url = Keyword.get(config, :post_gateway_url)
 
     Path.join([post_base_url, method])
   end
 
+  def put_file_endpoint() do
+    get_final_url("/api/v0/add")
+  end
+
+  def delete_file_endpoint() do
+    get_final_url("/api/v0/files/rm")
+  end
+
+  @placeholder "{CID}"
+  def placeholder, do: @placeholder
+
   @impl true
   def get_file(file) do
     b_url = Pleroma.Upload.base_url()
@@ -37,9 +45,7 @@ def put_file(%Pleroma.Upload{} = upload) do
       |> Multipart.add_content_type_param("charset=utf-8")
       |> Multipart.add_file(upload.tempfile)
 
-    final_url = get_final_url("/api/v0/add")
-
-    case Pleroma.HTTP.post(final_url, mp, [], params: ["cid-version": "1"]) do
+    case Pleroma.HTTP.post(put_file_endpoint(), mp, [], params: ["cid-version": "1"]) do
       {:ok, ret} ->
         case Jason.decode(ret.body) do
           {:ok, ret} ->
@@ -62,9 +68,7 @@ def put_file(%Pleroma.Upload{} = upload) do
 
   @impl true
   def delete_file(file) do
-    final_url = get_final_url("/api/v0/files/rm")
-
-    case Pleroma.HTTP.post(final_url, "", [], params: [arg: file]) do
+    case Pleroma.HTTP.post(delete_file_endpoint(), "", [], params: [arg: file]) do
       {:ok, %{status_code: 204}} -> :ok
       error -> {:error, inspect(error)}
     end
diff --git a/test/pleroma/uploaders/ipfs_test.exs b/test/pleroma/uploaders/ipfs_test.exs
index d567272d2..f2b880d9f 100644
--- a/test/pleroma/uploaders/ipfs_test.exs
+++ b/test/pleroma/uploaders/ipfs_test.exs
@@ -25,11 +25,11 @@ defmodule Pleroma.Uploaders.IPFSTest do
 
   describe "get_final_url" do
     test "it returns the final url for put_file" do
-      assert IPFS.get_final_url("/api/v0/add") == "http://localhost:5001/api/v0/add"
+      assert IPFS.put_file_endpoint() == "http://localhost:5001/api/v0/add"
     end
 
     test "it returns the final url for delete_file" do
-      assert IPFS.get_final_url("/api/v0/files/rm") == "http://localhost:5001/api/v0/files/rm"
+      assert IPFS.delete_file_endpoint() == "http://localhost:5001/api/v0/files/rm"
     end
   end
 
@@ -88,6 +88,26 @@ test "returns error", %{file_upload: file_upload} do
                end) =~ "Elixir.Pleroma.Uploaders.IPFS: {:error, \"IPFS Gateway upload failed\"}"
       end
     end
+
+    test "returns error if JSON decode fails", %{file_upload: file_upload} do
+      with_mocks([
+        {Pleroma.HTTP, [], [post: fn _, _, _, _ -> {:ok, %Tesla.Env{status: 200, body: ''}} end]},
+        {Jason, [], [decode: fn _ -> {:error, "JSON decode failed"} end]}
+      ]) do
+        assert capture_log(fn ->
+                 assert IPFS.put_file(file_upload) == {:error, "JSON decode failed"}
+               end) =~ "Elixir.Pleroma.Uploaders.IPFS: {:error, \"JSON decode failed\"}"
+      end
+    end
+
+    test "returns error if JSON body doesn't contain Hash key", %{file_upload: file_upload} do
+      with_mocks([
+        {Pleroma.HTTP, [], [post: fn _, _, _, _ -> {:ok, %Tesla.Env{status: 200, body: ''}} end]},
+        {Jason, [], [decode: fn _ -> {:ok, %{}} end]}
+      ]) do
+        assert IPFS.put_file(file_upload) == {:error, "JSON doesn't contain Hash key"}
+      end
+    end
   end
 
   describe "delete_file/1" do

From 254f2ea85400ebd692fc4a45f5ac22fedd49ec09 Mon Sep 17 00:00:00 2001
From: Claudio Maradonna <penguyman@stronzi.org>
Date: Thu, 9 Jun 2022 23:38:50 +0200
Subject: [PATCH 13/65] ipfs: remove unused alias

fix analysis job
---
 lib/pleroma/uploaders/ipfs.ex        | 4 ++--
 test/pleroma/uploaders/ipfs_test.exs | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/pleroma/uploaders/ipfs.ex b/lib/pleroma/uploaders/ipfs.ex
index 9f6f26e2e..32e06c5cf 100644
--- a/lib/pleroma/uploaders/ipfs.ex
+++ b/lib/pleroma/uploaders/ipfs.ex
@@ -16,11 +16,11 @@ defp get_final_url(method) do
     Path.join([post_base_url, method])
   end
 
-  def put_file_endpoint() do
+  def put_file_endpoint do
     get_final_url("/api/v0/add")
   end
 
-  def delete_file_endpoint() do
+  def delete_file_endpoint do
     get_final_url("/api/v0/files/rm")
   end
 
diff --git a/test/pleroma/uploaders/ipfs_test.exs b/test/pleroma/uploaders/ipfs_test.exs
index f2b880d9f..5edb6266b 100644
--- a/test/pleroma/uploaders/ipfs_test.exs
+++ b/test/pleroma/uploaders/ipfs_test.exs
@@ -6,7 +6,6 @@ defmodule Pleroma.Uploaders.IPFSTest do
   use Pleroma.DataCase
 
   alias Pleroma.Uploaders.IPFS
-  alias Tesla.Multipart
 
   import Mock
   import ExUnit.CaptureLog

From 5e097eb91def0efd3cd0008309fd524fcfd88e15 Mon Sep 17 00:00:00 2001
From: Claudio Maradonna <penguyman@stronzi.org>
Date: Tue, 28 Jun 2022 17:53:44 +0200
Subject: [PATCH 14/65] ipfs: better tests with @ilja suggestions

---
 test/pleroma/uploaders/ipfs_test.exs | 38 ++++++++++++++++++----------
 1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/test/pleroma/uploaders/ipfs_test.exs b/test/pleroma/uploaders/ipfs_test.exs
index 5edb6266b..9df3f239c 100644
--- a/test/pleroma/uploaders/ipfs_test.exs
+++ b/test/pleroma/uploaders/ipfs_test.exs
@@ -6,6 +6,7 @@ defmodule Pleroma.Uploaders.IPFSTest do
   use Pleroma.DataCase
 
   alias Pleroma.Uploaders.IPFS
+  alias Tesla.Multipart
 
   import Mock
   import ExUnit.CaptureLog
@@ -62,12 +63,17 @@ test "it returns path to ipfs file with cid as path" do
         tempfile: Path.absname("test/instance_static/add/shortcode.png")
       }
 
-      [file_upload: file_upload]
+      mp =
+        Multipart.new()
+        |> Multipart.add_content_type_param("charset=utf-8")
+        |> Multipart.add_file(file_upload.tempfile)
+
+      [file_upload: file_upload, mp: mp]
     end
 
     test "save file", %{file_upload: file_upload} do
       with_mock Pleroma.HTTP,
-        post: fn _, _, _, _ ->
+        post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
           {:ok,
            %Tesla.Env{
              status: 200,
@@ -81,7 +87,10 @@ test "save file", %{file_upload: file_upload} do
     end
 
     test "returns error", %{file_upload: file_upload} do
-      with_mock Pleroma.HTTP, post: fn _, _, _, _ -> {:error, "IPFS Gateway upload failed"} end do
+      with_mock Pleroma.HTTP,
+        post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
+          {:error, "IPFS Gateway upload failed"}
+        end do
         assert capture_log(fn ->
                  assert IPFS.put_file(file_upload) == {:error, "IPFS Gateway upload failed"}
                end) =~ "Elixir.Pleroma.Uploaders.IPFS: {:error, \"IPFS Gateway upload failed\"}"
@@ -89,21 +98,22 @@ test "returns error", %{file_upload: file_upload} do
     end
 
     test "returns error if JSON decode fails", %{file_upload: file_upload} do
-      with_mocks([
-        {Pleroma.HTTP, [], [post: fn _, _, _, _ -> {:ok, %Tesla.Env{status: 200, body: ''}} end]},
-        {Jason, [], [decode: fn _ -> {:error, "JSON decode failed"} end]}
-      ]) do
+      with_mock Pleroma.HTTP, [],
+        post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
+          {:ok, %Tesla.Env{status: 200, body: 'invalid'}}
+        end do
         assert capture_log(fn ->
                  assert IPFS.put_file(file_upload) == {:error, "JSON decode failed"}
-               end) =~ "Elixir.Pleroma.Uploaders.IPFS: {:error, \"JSON decode failed\"}"
+               end) =~
+                 "Elixir.Pleroma.Uploaders.IPFS: {:error, %Jason.DecodeError{data: \"invalid\", position: 0, token: nil}}"
       end
     end
 
     test "returns error if JSON body doesn't contain Hash key", %{file_upload: file_upload} do
-      with_mocks([
-        {Pleroma.HTTP, [], [post: fn _, _, _, _ -> {:ok, %Tesla.Env{status: 200, body: ''}} end]},
-        {Jason, [], [decode: fn _ -> {:ok, %{}} end]}
-      ]) do
+      with_mock Pleroma.HTTP, [],
+        post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
+          {:ok, %Tesla.Env{status: 200, body: '{"key": "value"}'}}
+        end do
         assert IPFS.put_file(file_upload) == {:error, "JSON doesn't contain Hash key"}
       end
     end
@@ -111,7 +121,9 @@ test "returns error if JSON body doesn't contain Hash key", %{file_upload: file_
 
   describe "delete_file/1" do
     test_with_mock "deletes file", Pleroma.HTTP,
-      post: fn _, _, _, _ -> {:ok, %{status_code: 204}} end do
+      post: fn "http://localhost:5001/api/v0/files/rm", "", [], params: [arg: "image.jpg"] ->
+        {:ok, %{status_code: 204}}
+      end do
       assert :ok = IPFS.delete_file("image.jpg")
     end
   end

From 21d9091f5e422493ff69fe59db9c965e0d511369 Mon Sep 17 00:00:00 2001
From: Claudio Maradonna <penguyman@stronzi.org>
Date: Fri, 8 Jul 2022 10:06:46 +0200
Subject: [PATCH 15/65] ipfs: replacing single quotes with double quotes

---
 test/pleroma/uploaders/ipfs_test.exs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/pleroma/uploaders/ipfs_test.exs b/test/pleroma/uploaders/ipfs_test.exs
index 9df3f239c..853d185e5 100644
--- a/test/pleroma/uploaders/ipfs_test.exs
+++ b/test/pleroma/uploaders/ipfs_test.exs
@@ -100,7 +100,7 @@ test "returns error", %{file_upload: file_upload} do
     test "returns error if JSON decode fails", %{file_upload: file_upload} do
       with_mock Pleroma.HTTP, [],
         post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
-          {:ok, %Tesla.Env{status: 200, body: 'invalid'}}
+          {:ok, %Tesla.Env{status: 200, body: "invalid"}}
         end do
         assert capture_log(fn ->
                  assert IPFS.put_file(file_upload) == {:error, "JSON decode failed"}
@@ -112,7 +112,7 @@ test "returns error if JSON decode fails", %{file_upload: file_upload} do
     test "returns error if JSON body doesn't contain Hash key", %{file_upload: file_upload} do
       with_mock Pleroma.HTTP, [],
         post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
-          {:ok, %Tesla.Env{status: 200, body: '{"key": "value"}'}}
+          {:ok, %Tesla.Env{status: 200, body: "{\"key\": \"value\"}"}}
         end do
         assert IPFS.put_file(file_upload) == {:error, "JSON doesn't contain Hash key"}
       end

From 3ed39e310939d90ddbad7bd7ffa1ebd8aca6e74c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Fri, 8 Jul 2022 21:28:23 +0200
Subject: [PATCH 16/65] Add test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 test/pleroma/notification_test.exs | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/test/pleroma/notification_test.exs b/test/pleroma/notification_test.exs
index eea2fcb67..c43502eb5 100644
--- a/test/pleroma/notification_test.exs
+++ b/test/pleroma/notification_test.exs
@@ -128,6 +128,21 @@ test "does not create a notification for subscribed users if status is a reply"
       subscriber_notifications = Notification.for_user(subscriber)
       assert Enum.empty?(subscriber_notifications)
     end
+
+    test "does not create subscriber notification if mentioned" do
+      user = insert(:user)
+      subscriber = insert(:user)
+
+      User.subscribe(subscriber, user)
+
+      {:ok, status} = CommonAPI.post(user, %{status: "mentioning @#{subscriber.nickname}"})
+      {:ok, [notification] = notifications} = Notification.create_notifications(status)
+
+      assert length(notifications) == 1
+
+      assert notification.user_id == subscriber.id
+      assert notification.type == "mention"
+    end
   end
 
   test "create_poll_notifications/1" do

From 78d1105bffee7ece8a2b972d3cb58a6e41d86828 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Sun, 19 Feb 2023 22:02:38 +0100
Subject: [PATCH 17/65] Fix down migration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 .../20220319000000_add_status_to_notifications_enum.exs        | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/priv/repo/migrations/20220319000000_add_status_to_notifications_enum.exs b/priv/repo/migrations/20220319000000_add_status_to_notifications_enum.exs
index 62c0afb63..c3bc85894 100644
--- a/priv/repo/migrations/20220319000000_add_status_to_notifications_enum.exs
+++ b/priv/repo/migrations/20220319000000_add_status_to_notifications_enum.exs
@@ -36,7 +36,8 @@ def down do
       'reblog',
       'favourite',
       'pleroma:report',
-      'poll
+      'poll',
+      'update'
     )
     """
     |> execute()

From 9363ef53a34c9d96191bccaece76dd4e01f493b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Sun, 14 May 2023 15:02:58 +0200
Subject: [PATCH 18/65] Add test for 'status' notification type for
 NotificationView
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 .../views/notification_view_test.exs          | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/test/pleroma/web/mastodon_api/views/notification_view_test.exs b/test/pleroma/web/mastodon_api/views/notification_view_test.exs
index 6ea894691..92de6c6a7 100644
--- a/test/pleroma/web/mastodon_api/views/notification_view_test.exs
+++ b/test/pleroma/web/mastodon_api/views/notification_view_test.exs
@@ -286,4 +286,31 @@ test "muted notification" do
 
     test_notifications_rendering([notification], user, [expected])
   end
+
+  test "Subscribed status notification" do
+    user = insert(:user)
+    subscriber = insert(:user)
+
+    User.subscribe(subscriber, user)
+
+    {:ok, activity} = CommonAPI.post(user, %{status: "hi"})
+    {:ok, [notification]} = Notification.create_notifications(activity)
+
+    user = User.get_cached_by_id(user.id)
+
+    expected = %{
+      id: to_string(notification.id),
+      pleroma: %{is_seen: false, is_muted: false},
+      type: "status",
+      account:
+        AccountView.render("show.json", %{
+          user: user,
+          for: subscriber
+        }),
+      status: StatusView.render("show.json", %{activity: activity, for: subscriber}),
+      created_at: Utils.to_masto_date(notification.inserted_at)
+    }
+
+    test_notifications_rendering([notification], subscriber, [expected])
+  end
 end

From 7e3bbdded5dea73a0bad3a8905839e42d476e506 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Wed, 20 Dec 2023 23:39:12 +0000
Subject: [PATCH 19/65] Elixir 1.13 is the minimum required version

---
 .gitlab-ci.yml                 | 2 +-
 Dockerfile                     | 6 +++---
 changelog.d/bump-elixir.change | 1 +
 mix.exs                        | 2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)
 create mode 100644 changelog.d/bump-elixir.change

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index eb31a8086..8f10790da 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,7 +2,7 @@ image: git.pleroma.social:5050/pleroma/pleroma/ci-base
 
 variables: &global_variables
   # Only used for the release
-  ELIXIR_VER: 1.12.3
+  ELIXIR_VER: 1.13.4
   POSTGRES_DB: pleroma_test
   POSTGRES_USER: postgres
   POSTGRES_PASSWORD: postgres
diff --git a/Dockerfile b/Dockerfile
index 69c3509de..72461305c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 ARG ELIXIR_IMG=hexpm/elixir
-ARG ELIXIR_VER=1.12.3
-ARG ERLANG_VER=24.2.1
-ARG ALPINE_VER=3.17.0
+ARG ELIXIR_VER=1.13.4
+ARG ERLANG_VER=24.3.4.15
+ARG ALPINE_VER=3.17.5
 
 FROM ${ELIXIR_IMG}:${ELIXIR_VER}-erlang-${ERLANG_VER}-alpine-${ALPINE_VER} as build
 
diff --git a/changelog.d/bump-elixir.change b/changelog.d/bump-elixir.change
new file mode 100644
index 000000000..afb25d4e7
--- /dev/null
+++ b/changelog.d/bump-elixir.change
@@ -0,0 +1 @@
+Elixir 1.13 is the minimum required version.
diff --git a/mix.exs b/mix.exs
index b4b77b161..2056e591d 100644
--- a/mix.exs
+++ b/mix.exs
@@ -5,7 +5,7 @@ def project do
     [
       app: :pleroma,
       version: version("2.6.51"),
-      elixir: "~> 1.11",
+      elixir: "~> 1.13",
       elixirc_paths: elixirc_paths(Mix.env()),
       compilers: Mix.compilers(),
       elixirc_options: [warnings_as_errors: warnings_as_errors()],

From ddb9e90c405369496fdf9e6dfed593eff8d5dc5c Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Thu, 28 Dec 2023 15:59:25 -0500
Subject: [PATCH 20/65] Update minimum elixir version found in various docs

---
 docs/installation/debian_based_jp.md           | 2 +-
 docs/installation/generic_dependencies.include | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/installation/debian_based_jp.md b/docs/installation/debian_based_jp.md
index 1424ad7f4..502eefaf8 100644
--- a/docs/installation/debian_based_jp.md
+++ b/docs/installation/debian_based_jp.md
@@ -14,7 +14,7 @@ Note: This article is potentially outdated because at this time we may not have
 
 - PostgreSQL 9.6以上 (Ubuntu16.04では9.5しか提供されていないので，[](https://www.postgresql.org/download/linux/ubuntu/)こちらから新しいバージョンを入手してください)
 - `postgresql-contrib` 9.6以上 (同上)
-- Elixir 1.8 以上 ([Debianのリポジトリからインストールしないこと！！！ ここからインストールすること！](https://elixir-lang.org/install.html#unix-and-unix-like)。または [asdf](https://github.com/asdf-vm/asdf) をpleromaユーザーでインストールしてください)
+- Elixir 1.13 以上 ([Debianのリポジトリからインストールしないこと！！！ ここからインストールすること！](https://elixir-lang.org/install.html#unix-and-unix-like)。または [asdf](https://github.com/asdf-vm/asdf) をpleromaユーザーでインストールしてください)
 - `erlang-dev`
 - `erlang-nox`
 - `git`
diff --git a/docs/installation/generic_dependencies.include b/docs/installation/generic_dependencies.include
index 3365a36a8..e0cfd3264 100644
--- a/docs/installation/generic_dependencies.include
+++ b/docs/installation/generic_dependencies.include
@@ -1,7 +1,7 @@
 ## Required dependencies
 
 * PostgreSQL >=9.6
-* Elixir >=1.11.0 <1.15
+* Elixir >=1.13.0 <1.15
 * Erlang OTP >=22.2.0 <26
 * git
 * file / libmagic

From 1ed8ae2d8e86ed26d4e21f59e95995795bcb282b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Wed, 31 Jan 2024 22:55:58 +0100
Subject: [PATCH 21/65] Add changelog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 changelog.d/status-notification-type.add | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/status-notification-type.add

diff --git a/changelog.d/status-notification-type.add b/changelog.d/status-notification-type.add
new file mode 100644
index 000000000..a6e94fa87
--- /dev/null
+++ b/changelog.d/status-notification-type.add
@@ -0,0 +1 @@
+Add "status" notification type
\ No newline at end of file

From ac977bdb1c58fac826f6325a3b1550ff389439ca Mon Sep 17 00:00:00 2001
From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Date: Tue, 20 Feb 2024 08:45:48 +0100
Subject: [PATCH 22/65] StealEmojiPolicy: Sanitize shortcodes

Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3245
---
 .../activity_pub/mrf/steal_emoji_policy.ex    |  2 ++
 .../mrf/steal_emoji_policy_test.exs           | 26 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex b/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex
index f66c379b5..12accfadd 100644
--- a/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex
@@ -34,6 +34,7 @@ defp steal_emoji({shortcode, url}, emoji_dir_path) do
           |> Path.basename()
           |> Path.extname()
 
+        shortcode = Path.basename(shortcode)
         file_path = Path.join(emoji_dir_path, shortcode <> (extension || ".png"))
 
         case File.write(file_path, response.body) do
@@ -76,6 +77,7 @@ def filter(%{"object" => %{"emoji" => foreign_emojis, "actor" => actor}} = messa
       new_emojis =
         foreign_emojis
         |> Enum.reject(fn {shortcode, _url} -> shortcode in installed_emoji end)
+        |> Enum.reject(fn {shortcode, _url} -> String.contains?(shortcode, ["/", "\\"]) end)
         |> Enum.filter(fn {shortcode, _url} ->
           reject_emoji? =
             [:mrf_steal_emoji, :rejected_shortcodes]
diff --git a/test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs b/test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs
index 89d32352f..e7fb337ec 100644
--- a/test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs
+++ b/test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs
@@ -60,6 +60,32 @@ test "Steals emoji on unknown shortcode from allowed remote host", %{
            |> File.exists?()
   end
 
+  test "rejects invalid shortcodes", %{path: path} do
+    message = %{
+      "type" => "Create",
+      "object" => %{
+        "emoji" => [{"fired/fox", "https://example.org/emoji/firedfox"}],
+        "actor" => "https://example.org/users/admin"
+      }
+    }
+
+    fullpath = Path.join(path, "fired/fox.png")
+
+    Tesla.Mock.mock(fn %{method: :get, url: "https://example.org/emoji/firedfox"} ->
+      %Tesla.Env{status: 200, body: File.read!("test/fixtures/image.jpg")}
+    end)
+
+    clear_config(:mrf_steal_emoji, hosts: ["example.org"], size_limit: 284_468)
+
+    refute "firedfox" in installed()
+    refute File.exists?(path)
+
+    assert {:ok, _message} = StealEmojiPolicy.filter(message)
+
+    refute "fired/fox" in installed()
+    refute File.exists?(fullpath)
+  end
+
   test "reject regex shortcode", %{message: message} do
     refute "firedfox" in installed()
 

From be075a43363519505dcfe2dba1fbb19e0326b668 Mon Sep 17 00:00:00 2001
From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Date: Tue, 20 Feb 2024 09:16:36 +0100
Subject: [PATCH 23/65] Security release 2.6.2

---
 CHANGELOG.md | 5 +++++
 mix.exs      | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 83b3065ce..92e5e6134 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2.6.2
+
+### Security
+- MRF StealEmojiPolicy: Sanitize shortcodes (thanks to Hazel K for the report
+
 ## 2.6.1
 ### Changed
 - - Document maximum supported version of Erlang & Elixir
diff --git a/mix.exs b/mix.exs
index d420c11e4..c95c2a82f 100644
--- a/mix.exs
+++ b/mix.exs
@@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
   def project do
     [
       app: :pleroma,
-      version: version("2.6.1"),
+      version: version("2.6.2"),
       elixir: "~> 1.11",
       elixirc_paths: elixirc_paths(Mix.env()),
       compilers: [:phoenix] ++ Mix.compilers(),

From 226874c9d603be72699d5aa5434616efffe3f239 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 20 May 2024 13:12:12 +0400
Subject: [PATCH 24/65] CI: Add new builders for base images

---
 .gitlab-ci.yml                         | 6 +++---
 ci/elixir-1.13/Dockerfile              | 8 ++++++++
 ci/elixir-1.13/build_and_push.sh       | 1 +
 ci/elixir-1.15-otp25/build_and_push.sh | 2 +-
 4 files changed, 13 insertions(+), 4 deletions(-)
 create mode 100644 ci/elixir-1.13/Dockerfile
 create mode 100755 ci/elixir-1.13/build_and_push.sh

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2e321c978..eba769af8 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,4 +1,4 @@
-image: git.pleroma.social:5050/pleroma/pleroma/ci-base
+image: git.pleroma.social:5050/pleroma/pleroma/ci-base:1.13.4-otp24
 
 variables: &global_variables
   # Only used for the release
@@ -72,7 +72,7 @@ check-changelog:
   tags:
     - amd64
 
-build-1.12.3:
+build-1.13.4:
   extends:
   - .build_changes_policy
   - .using-ci-base
@@ -85,7 +85,7 @@ build-1.15.7-otp-25:
   - .build_changes_policy
   - .using-ci-base
   stage: build
-  image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.15
+  image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.15-otp25
   allow_failure: true
   script:
   - mix compile --force
diff --git a/ci/elixir-1.13/Dockerfile b/ci/elixir-1.13/Dockerfile
new file mode 100644
index 000000000..b8bceb3d9
--- /dev/null
+++ b/ci/elixir-1.13/Dockerfile
@@ -0,0 +1,8 @@
+FROM elixir:1.13.4-otp-24
+
+# Single RUN statement, otherwise intermediate images are created
+# https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run
+RUN apt-get update &&\
+	apt-get install -y libmagic-dev cmake libimage-exiftool-perl ffmpeg &&\
+	mix local.hex --force &&\
+	mix local.rebar --force
diff --git a/ci/elixir-1.13/build_and_push.sh b/ci/elixir-1.13/build_and_push.sh
new file mode 100755
index 000000000..53af4245f
--- /dev/null
+++ b/ci/elixir-1.13/build_and_push.sh
@@ -0,0 +1 @@
+docker buildx build --platform linux/amd64,linux/arm64 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.13-otp24 --push .
diff --git a/ci/elixir-1.15-otp25/build_and_push.sh b/ci/elixir-1.15-otp25/build_and_push.sh
index 06fe74f34..a28e0d33c 100755
--- a/ci/elixir-1.15-otp25/build_and_push.sh
+++ b/ci/elixir-1.15-otp25/build_and_push.sh
@@ -1 +1 @@
-docker buildx build --platform linux/amd64 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.15-otp25 --push .
+docker buildx build --platform linux/amd64,linux/arm64 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.15-otp25 --push .

From f8411a351de07f14fdc9c9eca30109feaadf6f93 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 20 May 2024 13:30:31 +0400
Subject: [PATCH 25/65] CI: Specify version fully in base image tag

---
 ci/elixir-1.13/build_and_push.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/elixir-1.13/build_and_push.sh b/ci/elixir-1.13/build_and_push.sh
index 53af4245f..d848344a3 100755
--- a/ci/elixir-1.13/build_and_push.sh
+++ b/ci/elixir-1.13/build_and_push.sh
@@ -1 +1 @@
-docker buildx build --platform linux/amd64,linux/arm64 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.13-otp24 --push .
+docker buildx build --platform linux/amd64,linux/arm64 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.13.4-otp24 --push .

From f5c029524752e1820ea29f6557647823ae89ecf1 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 20 May 2024 13:32:25 +0400
Subject: [PATCH 26/65] CI: Specify correct image name.

---
 .gitlab-ci.yml                   | 2 +-
 ci/elixir-1.13/build_and_push.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index eba769af8..21d7b2242 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,4 +1,4 @@
-image: git.pleroma.social:5050/pleroma/pleroma/ci-base:1.13.4-otp24
+image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.13.4-otp-24
 
 variables: &global_variables
   # Only used for the release
diff --git a/ci/elixir-1.13/build_and_push.sh b/ci/elixir-1.13/build_and_push.sh
index d848344a3..64e1856db 100755
--- a/ci/elixir-1.13/build_and_push.sh
+++ b/ci/elixir-1.13/build_and_push.sh
@@ -1 +1 @@
-docker buildx build --platform linux/amd64,linux/arm64 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.13.4-otp24 --push .
+docker buildx build --platform linux/amd64,linux/arm64 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.13.4-otp-24 --push .

From 36fa0debfe66d3b706eeaa09227edd8b82c70aba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Mon, 20 May 2024 23:25:50 +0200
Subject: [PATCH 27/65] Fix `get_notified_from`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 lib/pleroma/notification.ex | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/notification.ex b/lib/pleroma/notification.ex
index 55c47e966..942aa7198 100644
--- a/lib/pleroma/notification.ex
+++ b/lib/pleroma/notification.ex
@@ -526,7 +526,7 @@ def get_notified_from_activity(%Activity{data: %{"type" => type}} = activity, lo
     Enum.filter(potential_receivers, fn u -> u.ap_id in notification_enabled_ap_ids end)
   end
 
-  def get_notified_from_activity(_, _local_only), do: {[], []}
+  def get_notified_from_activity(_, _local_only), do: []
 
   def get_notified_subscribers_from_activity(activity, local_only \\ true)
 
@@ -544,7 +544,7 @@ def get_notified_subscribers_from_activity(
     Enum.filter(potential_receivers, fn u -> u.ap_id in notification_enabled_ap_ids end)
   end
 
-  def get_notified_subscribers_from_activity(_, _), do: {[], []}
+  def get_notified_subscribers_from_activity(_, _), do: []
 
   # For some activities, only notify the author of the object
   def get_potential_receiver_ap_ids(%{data: %{"type" => type, "object" => object_id}})

From d1b053f3ba4170021c511b0d06a41405d3ab07d3 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 12:57:30 +0400
Subject: [PATCH 28/65] Webfinger: Add test showing wrong webfinger behavior

---
 .../webfinger/graf-imposter-webfinger.json    | 41 +++++++++++++++++++
 test/pleroma/web/web_finger_test.exs          | 15 +++++++
 2 files changed, 56 insertions(+)
 create mode 100644 test/fixtures/webfinger/graf-imposter-webfinger.json

diff --git a/test/fixtures/webfinger/graf-imposter-webfinger.json b/test/fixtures/webfinger/graf-imposter-webfinger.json
new file mode 100644
index 000000000..e7010f606
--- /dev/null
+++ b/test/fixtures/webfinger/graf-imposter-webfinger.json
@@ -0,0 +1,41 @@
+{
+    "subject": "acct:graf@poa.st",
+    "aliases": [
+        "https://fba.ryona.agenc/webfingertest"
+    ],
+    "links": [
+        {
+            "rel": "http://webfinger.net/rel/profile-page",
+            "type": "text/html",
+            "href": "https://fba.ryona.agenc/webfingertest"
+        },
+        {
+            "rel": "self",
+            "type": "application/activity+json",
+            "href": "https://fba.ryona.agenc/webfingertest"
+        },
+        {
+            "rel": "http://ostatus.org/schema/1.0/subscribe",
+            "template": "https://fba.ryona.agenc/contact/follow?url={uri}"
+        },
+        {
+            "rel": "http://schemas.google.com/g/2010#updates-from",
+            "type": "application/atom+xml",
+            "href": ""
+        },
+        {
+            "rel": "salmon",
+            "href": "https://fba.ryona.agenc/salmon/friendica"
+        },
+        {
+            "rel": "http://microformats.org/profile/hcard",
+            "type": "text/html",
+            "href": "https://fba.ryona.agenc/hcard/friendica"
+        },
+        {
+            "rel": "http://joindiaspora.com/seed_location",
+            "type": "text/html",
+            "href": "https://fba.ryona.agenc"
+        }
+    ]
+}
diff --git a/test/pleroma/web/web_finger_test.exs b/test/pleroma/web/web_finger_test.exs
index be5e08776..6530fbc56 100644
--- a/test/pleroma/web/web_finger_test.exs
+++ b/test/pleroma/web/web_finger_test.exs
@@ -204,4 +204,19 @@ test "refuses to process XML remote entities" do
       assert :error = WebFinger.finger("pekorino@pawoo.net")
     end
   end
+
+  test "prevents forgeries" do
+    Tesla.Mock.mock(fn
+      %{url: "https://fba.ryona.agency/.well-known/webfinger?resource=acct:graf@fba.ryona.agency"} ->
+        fake_webfinger =
+          File.read!("test/fixtures/webfinger/graf-imposter-webfinger.json") |> Jason.decode!()
+
+        Tesla.Mock.json(fake_webfinger)
+
+      %{url: "https://fba.ryona.agency/.well-known/host-meta"} ->
+        {:ok, %Tesla.Env{status: 404}}
+    end)
+
+    refute {:ok, _} = WebFinger.finger("graf@fba.ryona.agency")
+  end
 end

From b15f8b06425edbfc3a7cef2a55c609b12ee14377 Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Wed, 23 Aug 2023 13:10:19 -0500
Subject: [PATCH 29/65] Prevent webfinger spoofing

---
 lib/pleroma/web/web_finger.ex                 | 16 ++++++++
 .../tesla_mock/gleasonator.com_host_meta      |  4 ++
 test/fixtures/tesla_mock/webfinger_spoof.json | 28 ++++++++++++++
 test/pleroma/web/web_finger_test.exs          | 38 +++++++++++--------
 4 files changed, 71 insertions(+), 15 deletions(-)
 create mode 100644 test/fixtures/tesla_mock/gleasonator.com_host_meta
 create mode 100644 test/fixtures/tesla_mock/webfinger_spoof.json

diff --git a/lib/pleroma/web/web_finger.ex b/lib/pleroma/web/web_finger.ex
index 26fb8af84..a84a4351b 100644
--- a/lib/pleroma/web/web_finger.ex
+++ b/lib/pleroma/web/web_finger.ex
@@ -216,10 +216,26 @@ def finger(account) do
         _ ->
           {:error, {:content_type, nil}}
       end
+      |> case do
+        {:ok, data} -> validate_webfinger(address, data)
+        error -> error
+      end
     else
       error ->
         Logger.debug("Couldn't finger #{account}: #{inspect(error)}")
         error
     end
   end
+
+  defp validate_webfinger(url, %{"subject" => "acct:" <> acct} = data) do
+    with %URI{host: request_host} <- URI.parse(url),
+         [_name, acct_host] <- String.split(acct, "@"),
+         {_, true} <- {:hosts_match, acct_host == request_host} do
+      {:ok, data}
+    else
+      _ -> {:error, {:webfinger_invalid, url, data}}
+    end
+  end
+
+  defp validate_webfinger(url, data), do: {:error, {:webfinger_invalid, url, data}}
 end
diff --git a/test/fixtures/tesla_mock/gleasonator.com_host_meta b/test/fixtures/tesla_mock/gleasonator.com_host_meta
new file mode 100644
index 000000000..c1a432519
--- /dev/null
+++ b/test/fixtures/tesla_mock/gleasonator.com_host_meta
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">
+  <Link rel="lrdd" template="https://gleasonator.com/.well-known/webfinger?resource={uri}" type="application/xrd+xml" />
+</XRD>
\ No newline at end of file
diff --git a/test/fixtures/tesla_mock/webfinger_spoof.json b/test/fixtures/tesla_mock/webfinger_spoof.json
new file mode 100644
index 000000000..7c2a11f69
--- /dev/null
+++ b/test/fixtures/tesla_mock/webfinger_spoof.json
@@ -0,0 +1,28 @@
+{
+  "aliases": [
+    "https://gleasonator.com/users/alex",
+    "https://mitra.social/users/alex"
+  ],
+  "links": [
+    {
+      "href": "https://gleasonator.com/users/alex",
+      "rel": "http://webfinger.net/rel/profile-page",
+      "type": "text/html"
+    },
+    {
+      "href": "https://gleasonator.com/users/alex",
+      "rel": "self",
+      "type": "application/activity+json"
+    },
+    {
+      "href": "https://gleasonator.com/users/alex",
+      "rel": "self",
+      "type": "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
+    },
+    {
+      "rel": "http://ostatus.org/schema/1.0/subscribe",
+      "template": "https://gleasonator.com/ostatus_subscribe?acct={uri}"
+    }
+  ],
+  "subject": "acct:trump@whitehouse.gov"
+}
diff --git a/test/pleroma/web/web_finger_test.exs b/test/pleroma/web/web_finger_test.exs
index 6530fbc56..84a8e19d5 100644
--- a/test/pleroma/web/web_finger_test.exs
+++ b/test/pleroma/web/web_finger_test.exs
@@ -76,15 +76,6 @@ test "returns the ActivityPub actor URI for an ActivityPub user" do
       {:ok, _data} = WebFinger.finger(user)
     end
 
-    test "returns the ActivityPub actor URI and subscribe address for an ActivityPub user with the ld+json mimetype" do
-      user = "kaniini@gerzilla.de"
-
-      {:ok, data} = WebFinger.finger(user)
-
-      assert data["ap_id"] == "https://gerzilla.de/channel/kaniini"
-      assert data["subscribe_address"] == "https://gerzilla.de/follow?f=&url={uri}"
-    end
-
     test "it work for AP-only user" do
       user = "kpherox@mstdn.jp"
 
@@ -99,12 +90,6 @@ test "it work for AP-only user" do
       assert data["subscribe_address"] == "https://mstdn.jp/authorize_interaction?acct={uri}"
     end
 
-    test "it works for friendica" do
-      user = "lain@squeet.me"
-
-      {:ok, _data} = WebFinger.finger(user)
-    end
-
     test "it gets the xrd endpoint" do
       {:ok, template} = WebFinger.find_lrdd_template("social.heldscal.la")
 
@@ -203,6 +188,29 @@ test "refuses to process XML remote entities" do
 
       assert :error = WebFinger.finger("pekorino@pawoo.net")
     end
+
+    test "prevents spoofing" do
+      Tesla.Mock.mock(fn
+        %{
+          url: "https://gleasonator.com/.well-known/webfinger?resource=acct:alex@gleasonator.com"
+        } ->
+          {:ok,
+           %Tesla.Env{
+             status: 200,
+             body: File.read!("test/fixtures/tesla_mock/webfinger_spoof.json"),
+             headers: [{"content-type", "application/jrd+json"}]
+           }}
+
+        %{url: "https://gleasonator.com/.well-known/host-meta"} ->
+          {:ok,
+           %Tesla.Env{
+             status: 200,
+             body: File.read!("test/fixtures/tesla_mock/gleasonator.com_host_meta")
+           }}
+      end)
+
+      {:error, _data} = WebFinger.finger("alex@gleasonator.com")
+    end
   end
 
   test "prevents forgeries" do

From 206ea92837f8016d66a2b87f7f7338d814735a92 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 12:59:10 +0400
Subject: [PATCH 30/65] Webfinger: Fix test

---
 test/pleroma/web/web_finger_test.exs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/pleroma/web/web_finger_test.exs b/test/pleroma/web/web_finger_test.exs
index 84a8e19d5..8a550a6ba 100644
--- a/test/pleroma/web/web_finger_test.exs
+++ b/test/pleroma/web/web_finger_test.exs
@@ -213,6 +213,7 @@ test "prevents spoofing" do
     end
   end
 
+  @tag capture_log: true
   test "prevents forgeries" do
     Tesla.Mock.mock(fn
       %{url: "https://fba.ryona.agency/.well-known/webfinger?resource=acct:graf@fba.ryona.agency"} ->
@@ -225,6 +226,6 @@ test "prevents forgeries" do
         {:ok, %Tesla.Env{status: 404}}
     end)
 
-    refute {:ok, _} = WebFinger.finger("graf@fba.ryona.agency")
+    assert {:error, _} = WebFinger.finger("graf@fba.ryona.agency")
   end
 end

From 4491e8c9a3e2cdeb1b8e9cb98015dc1d0435c65c Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 13:01:23 +0400
Subject: [PATCH 31/65] Add changelog

---
 changelog.d/fix-webfinger-spoofing.fix | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/fix-webfinger-spoofing.fix

diff --git a/changelog.d/fix-webfinger-spoofing.fix b/changelog.d/fix-webfinger-spoofing.fix
new file mode 100644
index 000000000..7b3c9490a
--- /dev/null
+++ b/changelog.d/fix-webfinger-spoofing.fix
@@ -0,0 +1 @@
+Fix webfinger spoofing.

From 91c93ce3cd62a916c7d367979473f94e36cf1873 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 13:14:59 +0400
Subject: [PATCH 32/65] Changelog: Adjust changelog type

---
 ...fix-webfinger-spoofing.fix => fix-webfinger-spoofing.security} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename changelog.d/{fix-webfinger-spoofing.fix => fix-webfinger-spoofing.security} (100%)

diff --git a/changelog.d/fix-webfinger-spoofing.fix b/changelog.d/fix-webfinger-spoofing.security
similarity index 100%
rename from changelog.d/fix-webfinger-spoofing.fix
rename to changelog.d/fix-webfinger-spoofing.security

From 84bb854056e406d5235dd442c28127891a8a8a86 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 15:12:29 +0400
Subject: [PATCH 33/65] Webfinger: Allow managing account for subdomain

---
 lib/pleroma/web/web_finger.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/web/web_finger.ex b/lib/pleroma/web/web_finger.ex
index a84a4351b..e149d9247 100644
--- a/lib/pleroma/web/web_finger.ex
+++ b/lib/pleroma/web/web_finger.ex
@@ -230,7 +230,7 @@ def finger(account) do
   defp validate_webfinger(url, %{"subject" => "acct:" <> acct} = data) do
     with %URI{host: request_host} <- URI.parse(url),
          [_name, acct_host] <- String.split(acct, "@"),
-         {_, true} <- {:hosts_match, acct_host == request_host} do
+         {_, true} <- {:hosts_match_or_subdomain, String.ends_with?(request_host, acct_host)} do
       {:ok, data}
     else
       _ -> {:error, {:webfinger_invalid, url, data}}

From 29b968ce2006de47d8f1dbc161756e35ba5944a1 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 12:57:30 +0400
Subject: [PATCH 34/65] Webfinger: Add test showing wrong webfinger behavior

---
 .../webfinger/graf-imposter-webfinger.json    | 41 +++++++++++++++++++
 test/pleroma/web/web_finger_test.exs          | 15 +++++++
 2 files changed, 56 insertions(+)
 create mode 100644 test/fixtures/webfinger/graf-imposter-webfinger.json

diff --git a/test/fixtures/webfinger/graf-imposter-webfinger.json b/test/fixtures/webfinger/graf-imposter-webfinger.json
new file mode 100644
index 000000000..e7010f606
--- /dev/null
+++ b/test/fixtures/webfinger/graf-imposter-webfinger.json
@@ -0,0 +1,41 @@
+{
+    "subject": "acct:graf@poa.st",
+    "aliases": [
+        "https://fba.ryona.agenc/webfingertest"
+    ],
+    "links": [
+        {
+            "rel": "http://webfinger.net/rel/profile-page",
+            "type": "text/html",
+            "href": "https://fba.ryona.agenc/webfingertest"
+        },
+        {
+            "rel": "self",
+            "type": "application/activity+json",
+            "href": "https://fba.ryona.agenc/webfingertest"
+        },
+        {
+            "rel": "http://ostatus.org/schema/1.0/subscribe",
+            "template": "https://fba.ryona.agenc/contact/follow?url={uri}"
+        },
+        {
+            "rel": "http://schemas.google.com/g/2010#updates-from",
+            "type": "application/atom+xml",
+            "href": ""
+        },
+        {
+            "rel": "salmon",
+            "href": "https://fba.ryona.agenc/salmon/friendica"
+        },
+        {
+            "rel": "http://microformats.org/profile/hcard",
+            "type": "text/html",
+            "href": "https://fba.ryona.agenc/hcard/friendica"
+        },
+        {
+            "rel": "http://joindiaspora.com/seed_location",
+            "type": "text/html",
+            "href": "https://fba.ryona.agenc"
+        }
+    ]
+}
diff --git a/test/pleroma/web/web_finger_test.exs b/test/pleroma/web/web_finger_test.exs
index be5e08776..6530fbc56 100644
--- a/test/pleroma/web/web_finger_test.exs
+++ b/test/pleroma/web/web_finger_test.exs
@@ -204,4 +204,19 @@ test "refuses to process XML remote entities" do
       assert :error = WebFinger.finger("pekorino@pawoo.net")
     end
   end
+
+  test "prevents forgeries" do
+    Tesla.Mock.mock(fn
+      %{url: "https://fba.ryona.agency/.well-known/webfinger?resource=acct:graf@fba.ryona.agency"} ->
+        fake_webfinger =
+          File.read!("test/fixtures/webfinger/graf-imposter-webfinger.json") |> Jason.decode!()
+
+        Tesla.Mock.json(fake_webfinger)
+
+      %{url: "https://fba.ryona.agency/.well-known/host-meta"} ->
+        {:ok, %Tesla.Env{status: 404}}
+    end)
+
+    refute {:ok, _} = WebFinger.finger("graf@fba.ryona.agency")
+  end
 end

From 364f6e1620876dcfc1d228e2db17190d74b6f0ce Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Wed, 23 Aug 2023 13:10:19 -0500
Subject: [PATCH 35/65] Prevent webfinger spoofing

---
 lib/pleroma/web/web_finger.ex                 | 16 ++++++++
 .../tesla_mock/gleasonator.com_host_meta      |  4 ++
 test/fixtures/tesla_mock/webfinger_spoof.json | 28 ++++++++++++++
 test/pleroma/web/web_finger_test.exs          | 38 +++++++++++--------
 4 files changed, 71 insertions(+), 15 deletions(-)
 create mode 100644 test/fixtures/tesla_mock/gleasonator.com_host_meta
 create mode 100644 test/fixtures/tesla_mock/webfinger_spoof.json

diff --git a/lib/pleroma/web/web_finger.ex b/lib/pleroma/web/web_finger.ex
index f95dc2458..0d6a686c3 100644
--- a/lib/pleroma/web/web_finger.ex
+++ b/lib/pleroma/web/web_finger.ex
@@ -216,10 +216,26 @@ def finger(account) do
         _ ->
           {:error, {:content_type, nil}}
       end
+      |> case do
+        {:ok, data} -> validate_webfinger(address, data)
+        error -> error
+      end
     else
       error ->
         Logger.debug("Couldn't finger #{account}: #{inspect(error)}")
         error
     end
   end
+
+  defp validate_webfinger(url, %{"subject" => "acct:" <> acct} = data) do
+    with %URI{host: request_host} <- URI.parse(url),
+         [_name, acct_host] <- String.split(acct, "@"),
+         {_, true} <- {:hosts_match, acct_host == request_host} do
+      {:ok, data}
+    else
+      _ -> {:error, {:webfinger_invalid, url, data}}
+    end
+  end
+
+  defp validate_webfinger(url, data), do: {:error, {:webfinger_invalid, url, data}}
 end
diff --git a/test/fixtures/tesla_mock/gleasonator.com_host_meta b/test/fixtures/tesla_mock/gleasonator.com_host_meta
new file mode 100644
index 000000000..c1a432519
--- /dev/null
+++ b/test/fixtures/tesla_mock/gleasonator.com_host_meta
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">
+  <Link rel="lrdd" template="https://gleasonator.com/.well-known/webfinger?resource={uri}" type="application/xrd+xml" />
+</XRD>
\ No newline at end of file
diff --git a/test/fixtures/tesla_mock/webfinger_spoof.json b/test/fixtures/tesla_mock/webfinger_spoof.json
new file mode 100644
index 000000000..7c2a11f69
--- /dev/null
+++ b/test/fixtures/tesla_mock/webfinger_spoof.json
@@ -0,0 +1,28 @@
+{
+  "aliases": [
+    "https://gleasonator.com/users/alex",
+    "https://mitra.social/users/alex"
+  ],
+  "links": [
+    {
+      "href": "https://gleasonator.com/users/alex",
+      "rel": "http://webfinger.net/rel/profile-page",
+      "type": "text/html"
+    },
+    {
+      "href": "https://gleasonator.com/users/alex",
+      "rel": "self",
+      "type": "application/activity+json"
+    },
+    {
+      "href": "https://gleasonator.com/users/alex",
+      "rel": "self",
+      "type": "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
+    },
+    {
+      "rel": "http://ostatus.org/schema/1.0/subscribe",
+      "template": "https://gleasonator.com/ostatus_subscribe?acct={uri}"
+    }
+  ],
+  "subject": "acct:trump@whitehouse.gov"
+}
diff --git a/test/pleroma/web/web_finger_test.exs b/test/pleroma/web/web_finger_test.exs
index 6530fbc56..84a8e19d5 100644
--- a/test/pleroma/web/web_finger_test.exs
+++ b/test/pleroma/web/web_finger_test.exs
@@ -76,15 +76,6 @@ test "returns the ActivityPub actor URI for an ActivityPub user" do
       {:ok, _data} = WebFinger.finger(user)
     end
 
-    test "returns the ActivityPub actor URI and subscribe address for an ActivityPub user with the ld+json mimetype" do
-      user = "kaniini@gerzilla.de"
-
-      {:ok, data} = WebFinger.finger(user)
-
-      assert data["ap_id"] == "https://gerzilla.de/channel/kaniini"
-      assert data["subscribe_address"] == "https://gerzilla.de/follow?f=&url={uri}"
-    end
-
     test "it work for AP-only user" do
       user = "kpherox@mstdn.jp"
 
@@ -99,12 +90,6 @@ test "it work for AP-only user" do
       assert data["subscribe_address"] == "https://mstdn.jp/authorize_interaction?acct={uri}"
     end
 
-    test "it works for friendica" do
-      user = "lain@squeet.me"
-
-      {:ok, _data} = WebFinger.finger(user)
-    end
-
     test "it gets the xrd endpoint" do
       {:ok, template} = WebFinger.find_lrdd_template("social.heldscal.la")
 
@@ -203,6 +188,29 @@ test "refuses to process XML remote entities" do
 
       assert :error = WebFinger.finger("pekorino@pawoo.net")
     end
+
+    test "prevents spoofing" do
+      Tesla.Mock.mock(fn
+        %{
+          url: "https://gleasonator.com/.well-known/webfinger?resource=acct:alex@gleasonator.com"
+        } ->
+          {:ok,
+           %Tesla.Env{
+             status: 200,
+             body: File.read!("test/fixtures/tesla_mock/webfinger_spoof.json"),
+             headers: [{"content-type", "application/jrd+json"}]
+           }}
+
+        %{url: "https://gleasonator.com/.well-known/host-meta"} ->
+          {:ok,
+           %Tesla.Env{
+             status: 200,
+             body: File.read!("test/fixtures/tesla_mock/gleasonator.com_host_meta")
+           }}
+      end)
+
+      {:error, _data} = WebFinger.finger("alex@gleasonator.com")
+    end
   end
 
   test "prevents forgeries" do

From eafcb7b4ec368038aafa440ea32abe417a805f41 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 12:59:10 +0400
Subject: [PATCH 36/65] Webfinger: Fix test

---
 test/pleroma/web/web_finger_test.exs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/pleroma/web/web_finger_test.exs b/test/pleroma/web/web_finger_test.exs
index 84a8e19d5..8a550a6ba 100644
--- a/test/pleroma/web/web_finger_test.exs
+++ b/test/pleroma/web/web_finger_test.exs
@@ -213,6 +213,7 @@ test "prevents spoofing" do
     end
   end
 
+  @tag capture_log: true
   test "prevents forgeries" do
     Tesla.Mock.mock(fn
       %{url: "https://fba.ryona.agency/.well-known/webfinger?resource=acct:graf@fba.ryona.agency"} ->
@@ -225,6 +226,6 @@ test "prevents forgeries" do
         {:ok, %Tesla.Env{status: 404}}
     end)
 
-    refute {:ok, _} = WebFinger.finger("graf@fba.ryona.agency")
+    assert {:error, _} = WebFinger.finger("graf@fba.ryona.agency")
   end
 end

From 275fdb26c1472d3109721590080dea863c769794 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 13:01:23 +0400
Subject: [PATCH 37/65] Add changelog

---
 changelog.d/fix-webfinger-spoofing.fix | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/fix-webfinger-spoofing.fix

diff --git a/changelog.d/fix-webfinger-spoofing.fix b/changelog.d/fix-webfinger-spoofing.fix
new file mode 100644
index 000000000..7b3c9490a
--- /dev/null
+++ b/changelog.d/fix-webfinger-spoofing.fix
@@ -0,0 +1 @@
+Fix webfinger spoofing.

From 2212287b0047d356592da82b02170b25fa1a4011 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 13:14:59 +0400
Subject: [PATCH 38/65] Changelog: Adjust changelog type

---
 ...fix-webfinger-spoofing.fix => fix-webfinger-spoofing.security} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename changelog.d/{fix-webfinger-spoofing.fix => fix-webfinger-spoofing.security} (100%)

diff --git a/changelog.d/fix-webfinger-spoofing.fix b/changelog.d/fix-webfinger-spoofing.security
similarity index 100%
rename from changelog.d/fix-webfinger-spoofing.fix
rename to changelog.d/fix-webfinger-spoofing.security

From 20fa400082df4c504768190f1ecbd407c9a6376f Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 15:12:29 +0400
Subject: [PATCH 39/65] Webfinger: Allow managing account for subdomain

---
 lib/pleroma/web/web_finger.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/web/web_finger.ex b/lib/pleroma/web/web_finger.ex
index 0d6a686c3..668d7d576 100644
--- a/lib/pleroma/web/web_finger.ex
+++ b/lib/pleroma/web/web_finger.ex
@@ -230,7 +230,7 @@ def finger(account) do
   defp validate_webfinger(url, %{"subject" => "acct:" <> acct} = data) do
     with %URI{host: request_host} <- URI.parse(url),
          [_name, acct_host] <- String.split(acct, "@"),
-         {_, true} <- {:hosts_match, acct_host == request_host} do
+         {_, true} <- {:hosts_match_or_subdomain, String.ends_with?(request_host, acct_host)} do
       {:ok, data}
     else
       _ -> {:error, {:webfinger_invalid, url, data}}

From 239c9c3f1ce60a95b389c2f4ee1e717f4907c381 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 17:40:20 +0400
Subject: [PATCH 40/65] Mix: Update version

---
 mix.exs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mix.exs b/mix.exs
index c95c2a82f..d0ee061c8 100644
--- a/mix.exs
+++ b/mix.exs
@@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
   def project do
     [
       app: :pleroma,
-      version: version("2.6.2"),
+      version: version("2.6.3"),
       elixir: "~> 1.11",
       elixirc_paths: elixirc_paths(Mix.env()),
       compilers: [:phoenix] ++ Mix.compilers(),

From 7b4e6d4c16a246ef4ae958a1536b00320441b63e Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 17:44:10 +0400
Subject: [PATCH 41/65] Collect changelog

---
 CHANGELOG.md                                | 5 +++++
 changelog.d/fix-webfinger-spoofing.security | 1 -
 2 files changed, 5 insertions(+), 1 deletion(-)
 delete mode 100644 changelog.d/fix-webfinger-spoofing.security

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 92e5e6134..75d2aa415 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2.6.3
+
+### Security
+- Fix webfinger spoofing.
+
 ## 2.6.2
 
 ### Security
diff --git a/changelog.d/fix-webfinger-spoofing.security b/changelog.d/fix-webfinger-spoofing.security
deleted file mode 100644
index 7b3c9490a..000000000
--- a/changelog.d/fix-webfinger-spoofing.security
+++ /dev/null
@@ -1 +0,0 @@
-Fix webfinger spoofing.

From 1f2f7e044d1be1e56789ce01ce4e54dd86a74f36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Wed, 22 May 2024 15:52:10 +0200
Subject: [PATCH 42/65] Revert "Webfinger: Allow managing account for
 subdomain"

This reverts commit 84bb854056e406d5235dd442c28127891a8a8a86.
---
 lib/pleroma/web/web_finger.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/web/web_finger.ex b/lib/pleroma/web/web_finger.ex
index e149d9247..a84a4351b 100644
--- a/lib/pleroma/web/web_finger.ex
+++ b/lib/pleroma/web/web_finger.ex
@@ -230,7 +230,7 @@ def finger(account) do
   defp validate_webfinger(url, %{"subject" => "acct:" <> acct} = data) do
     with %URI{host: request_host} <- URI.parse(url),
          [_name, acct_host] <- String.split(acct, "@"),
-         {_, true} <- {:hosts_match_or_subdomain, String.ends_with?(request_host, acct_host)} do
+         {_, true} <- {:hosts_match, acct_host == request_host} do
       {:ok, data}
     else
       _ -> {:error, {:webfinger_invalid, url, data}}

From d0b18e338bfed05c6b2c4a8f5c63d865d9eb669c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Thu, 24 Aug 2023 00:37:39 +0200
Subject: [PATCH 43/65] Fix validate_webfinger when running a different domain
 for Webfinger
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 lib/pleroma/application.ex    |  3 ++-
 lib/pleroma/web/web_finger.ex | 30 ++++++++++++++++++++++--------
 test/pleroma/user_test.exs    |  4 ++--
 3 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/lib/pleroma/application.ex b/lib/pleroma/application.ex
index 75154f94c..649bb11c8 100644
--- a/lib/pleroma/application.ex
+++ b/lib/pleroma/application.ex
@@ -162,7 +162,8 @@ defp cachex_children do
         expiration: chat_message_id_idempotency_key_expiration(),
         limit: 500_000
       ),
-      build_cachex("rel_me", limit: 2500)
+      build_cachex("rel_me", limit: 2500),
+      build_cachex("host_meta", default_ttl: :timer.minutes(120), limit: 5000)
     ]
   end
 
diff --git a/lib/pleroma/web/web_finger.ex b/lib/pleroma/web/web_finger.ex
index a84a4351b..e653b3338 100644
--- a/lib/pleroma/web/web_finger.ex
+++ b/lib/pleroma/web/web_finger.ex
@@ -155,7 +155,16 @@ def get_template_from_xml(body) do
     end
   end
 
+  @cachex Pleroma.Config.get([:cachex, :provider], Cachex)
   def find_lrdd_template(domain) do
+    @cachex.fetch!(:host_meta_cache, domain, fn _ ->
+      {:commit, fetch_lrdd_template(domain)}
+    end)
+  rescue
+    e -> {:error, "Cachex error: #{inspect(e)}"}
+  end
+
+  defp fetch_lrdd_template(domain) do
     # WebFinger is restricted to HTTPS - https://tools.ietf.org/html/rfc7033#section-9.1
     meta_url = "https://#{domain}/.well-known/host-meta"
 
@@ -168,7 +177,7 @@ def find_lrdd_template(domain) do
     end
   end
 
-  defp get_address_from_domain(domain, encoded_account) when is_binary(domain) do
+  defp get_address_from_domain(domain, "acct:" <> _ = encoded_account) when is_binary(domain) do
     case find_lrdd_template(domain) do
       {:ok, template} ->
         String.replace(template, "{uri}", encoded_account)
@@ -178,6 +187,11 @@ defp get_address_from_domain(domain, encoded_account) when is_binary(domain) do
     end
   end
 
+  defp get_address_from_domain(domain, account) when is_binary(domain) do
+    encoded_account = URI.encode("acct:#{account}")
+    get_address_from_domain(domain, encoded_account)
+  end
+
   defp get_address_from_domain(_, _), do: {:error, :webfinger_no_domain}
 
   @spec finger(String.t()) :: {:ok, map()} | {:error, any()}
@@ -192,9 +206,7 @@ def finger(account) do
           URI.parse(account).host
       end
 
-    encoded_account = URI.encode("acct:#{account}")
-
-    with address when is_binary(address) <- get_address_from_domain(domain, encoded_account),
+    with address when is_binary(address) <- get_address_from_domain(domain, account),
          {:ok, %{status: status, body: body, headers: headers}} when status in 200..299 <-
            HTTP.get(
              address,
@@ -227,13 +239,15 @@ def finger(account) do
     end
   end
 
-  defp validate_webfinger(url, %{"subject" => "acct:" <> acct} = data) do
-    with %URI{host: request_host} <- URI.parse(url),
-         [_name, acct_host] <- String.split(acct, "@"),
+  defp validate_webfinger(request_url, %{"subject" => "acct:" <> acct = subject} = data) do
+    with [_name, acct_host] <- String.split(acct, "@"),
+         {_, url} <- {:address, get_address_from_domain(acct_host, subject)},
+         %URI{host: request_host} <- URI.parse(request_url),
+         %URI{host: acct_host} <- URI.parse(url),
          {_, true} <- {:hosts_match, acct_host == request_host} do
       {:ok, data}
     else
-      _ -> {:error, {:webfinger_invalid, url, data}}
+      _ -> {:error, {:webfinger_invalid, request_url, data}}
     end
   end
 
diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs
index 48391d871..7f1a8d893 100644
--- a/test/pleroma/user_test.exs
+++ b/test/pleroma/user_test.exs
@@ -877,7 +877,7 @@ test "gets an existing user by nickname starting with http" do
     setup do: clear_config([Pleroma.Web.WebFinger, :update_nickname_on_user_fetch], true)
 
     test "for mastodon" do
-      Tesla.Mock.mock(fn
+      Tesla.Mock.mock_global(fn
         %{url: "https://example.com/.well-known/host-meta"} ->
           %Tesla.Env{
             status: 302,
@@ -935,7 +935,7 @@ test "for mastodon" do
     end
 
     test "for pleroma" do
-      Tesla.Mock.mock(fn
+      Tesla.Mock.mock_global(fn
         %{url: "https://example.com/.well-known/host-meta"} ->
           %Tesla.Env{
             status: 302,

From 70cabbf6dc2f8440484f1e56d3aa2d27f65ee88f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Thu, 24 Aug 2023 01:09:00 +0200
Subject: [PATCH 44/65] Fix tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 test/pleroma/user_test.exs                    | 102 +---------------
 .../web_finger/web_finger_controller_test.exs |   5 +
 test/support/http_request_mock.ex             | 114 ++++++++++++++++++
 3 files changed, 125 insertions(+), 96 deletions(-)

diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs
index 7f1a8d893..5b7a65658 100644
--- a/test/pleroma/user_test.exs
+++ b/test/pleroma/user_test.exs
@@ -877,109 +877,19 @@ test "gets an existing user by nickname starting with http" do
     setup do: clear_config([Pleroma.Web.WebFinger, :update_nickname_on_user_fetch], true)
 
     test "for mastodon" do
-      Tesla.Mock.mock_global(fn
-        %{url: "https://example.com/.well-known/host-meta"} ->
-          %Tesla.Env{
-            status: 302,
-            headers: [{"location", "https://sub.example.com/.well-known/host-meta"}]
-          }
-
-        %{url: "https://sub.example.com/.well-known/host-meta"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/masto-host-meta.xml"
-              |> File.read!()
-              |> String.replace("{{domain}}", "sub.example.com")
-          }
-
-        %{url: "https://sub.example.com/.well-known/webfinger?resource=acct:a@example.com"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/masto-webfinger.json"
-              |> File.read!()
-              |> String.replace("{{nickname}}", "a")
-              |> String.replace("{{domain}}", "example.com")
-              |> String.replace("{{subdomain}}", "sub.example.com"),
-            headers: [{"content-type", "application/jrd+json"}]
-          }
-
-        %{url: "https://sub.example.com/users/a"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/masto-user.json"
-              |> File.read!()
-              |> String.replace("{{nickname}}", "a")
-              |> String.replace("{{domain}}", "sub.example.com"),
-            headers: [{"content-type", "application/activity+json"}]
-          }
-
-        %{url: "https://sub.example.com/users/a/collections/featured"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              File.read!("test/fixtures/users_mock/masto_featured.json")
-              |> String.replace("{{domain}}", "sub.example.com")
-              |> String.replace("{{nickname}}", "a"),
-            headers: [{"content-type", "application/activity+json"}]
-          }
-      end)
-
-      ap_id = "a@example.com"
+      ap_id = "a@mastodon.example"
       {:ok, fetched_user} = User.get_or_fetch(ap_id)
 
-      assert fetched_user.ap_id == "https://sub.example.com/users/a"
-      assert fetched_user.nickname == "a@example.com"
+      assert fetched_user.ap_id == "https://sub.mastodon.example/users/a"
+      assert fetched_user.nickname == "a@mastodon.example"
     end
 
     test "for pleroma" do
-      Tesla.Mock.mock_global(fn
-        %{url: "https://example.com/.well-known/host-meta"} ->
-          %Tesla.Env{
-            status: 302,
-            headers: [{"location", "https://sub.example.com/.well-known/host-meta"}]
-          }
-
-        %{url: "https://sub.example.com/.well-known/host-meta"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/pleroma-host-meta.xml"
-              |> File.read!()
-              |> String.replace("{{domain}}", "sub.example.com")
-          }
-
-        %{url: "https://sub.example.com/.well-known/webfinger?resource=acct:a@example.com"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/pleroma-webfinger.json"
-              |> File.read!()
-              |> String.replace("{{nickname}}", "a")
-              |> String.replace("{{domain}}", "example.com")
-              |> String.replace("{{subdomain}}", "sub.example.com"),
-            headers: [{"content-type", "application/jrd+json"}]
-          }
-
-        %{url: "https://sub.example.com/users/a"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/pleroma-user.json"
-              |> File.read!()
-              |> String.replace("{{nickname}}", "a")
-              |> String.replace("{{domain}}", "sub.example.com"),
-            headers: [{"content-type", "application/activity+json"}]
-          }
-      end)
-
-      ap_id = "a@example.com"
+      ap_id = "a@pleroma.example"
       {:ok, fetched_user} = User.get_or_fetch(ap_id)
 
-      assert fetched_user.ap_id == "https://sub.example.com/users/a"
-      assert fetched_user.nickname == "a@example.com"
+      assert fetched_user.ap_id == "https://sub.pleroma.example/users/a"
+      assert fetched_user.nickname == "a@pleroma.example"
     end
   end
 
diff --git a/test/pleroma/web/web_finger/web_finger_controller_test.exs b/test/pleroma/web/web_finger/web_finger_controller_test.exs
index 80e072163..f501c6e44 100644
--- a/test/pleroma/web/web_finger/web_finger_controller_test.exs
+++ b/test/pleroma/web/web_finger/web_finger_controller_test.exs
@@ -56,6 +56,11 @@ test "Webfinger JRD" do
   end
 
   test "reach user on tld, while pleroma is running on subdomain" do
+    Pleroma.Web.Endpoint.config_change(
+      [{Pleroma.Web.Endpoint, url: [host: "sub.example.com"]}],
+      []
+    )
+
     clear_config([Pleroma.Web.Endpoint, :url, :host], "sub.example.com")
 
     clear_config([Pleroma.Web.WebFinger, :domain], "example.com")
diff --git a/test/support/http_request_mock.ex b/test/support/http_request_mock.ex
index f656c9412..20e410424 100644
--- a/test/support/http_request_mock.ex
+++ b/test/support/http_request_mock.ex
@@ -1521,6 +1521,120 @@ def get("https://friends.grishka.me/users/1", _, _, _) do
      }}
   end
 
+  def get("https://mastodon.example/.well-known/host-meta", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 302,
+       headers: [{"location", "https://sub.mastodon.example/.well-known/host-meta"}]
+     }}
+  end
+
+  def get("https://sub.mastodon.example/.well-known/host-meta", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/masto-host-meta.xml"
+         |> File.read!()
+         |> String.replace("{{domain}}", "sub.mastodon.example")
+     }}
+  end
+
+  def get(
+        "https://sub.mastodon.example/.well-known/webfinger?resource=acct:a@mastodon.example",
+        _,
+        _,
+        _
+      ) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/masto-webfinger.json"
+         |> File.read!()
+         |> String.replace("{{nickname}}", "a")
+         |> String.replace("{{domain}}", "mastodon.example")
+         |> String.replace("{{subdomain}}", "sub.mastodon.example"),
+       headers: [{"content-type", "application/jrd+json"}]
+     }}
+  end
+
+  def get("https://sub.mastodon.example/users/a", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/masto-user.json"
+         |> File.read!()
+         |> String.replace("{{nickname}}", "a")
+         |> String.replace("{{domain}}", "sub.mastodon.example"),
+       headers: [{"content-type", "application/activity+json"}]
+     }}
+  end
+
+  def get("https://sub.mastodon.example/users/a/collections/featured", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         File.read!("test/fixtures/users_mock/masto_featured.json")
+         |> String.replace("{{domain}}", "sub.mastodon.example")
+         |> String.replace("{{nickname}}", "a"),
+       headers: [{"content-type", "application/activity+json"}]
+     }}
+  end
+
+  def get("https://pleroma.example/.well-known/host-meta", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 302,
+       headers: [{"location", "https://sub.pleroma.example/.well-known/host-meta"}]
+     }}
+  end
+
+  def get("https://sub.pleroma.example/.well-known/host-meta", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/pleroma-host-meta.xml"
+         |> File.read!()
+         |> String.replace("{{domain}}", "sub.pleroma.example")
+     }}
+  end
+
+  def get(
+        "https://sub.pleroma.example/.well-known/webfinger?resource=acct:a@pleroma.example",
+        _,
+        _,
+        _
+      ) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/pleroma-webfinger.json"
+         |> File.read!()
+         |> String.replace("{{nickname}}", "a")
+         |> String.replace("{{domain}}", "pleroma.example")
+         |> String.replace("{{subdomain}}", "sub.pleroma.example"),
+       headers: [{"content-type", "application/jrd+json"}]
+     }}
+  end
+
+  def get("https://sub.pleroma.example/users/a", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/pleroma-user.json"
+         |> File.read!()
+         |> String.replace("{{nickname}}", "a")
+         |> String.replace("{{domain}}", "sub.pleroma.example"),
+       headers: [{"content-type", "application/activity+json"}]
+     }}
+  end
+
   def get(url, query, body, headers) do
     {:error,
      "Mock response not implemented for GET #{inspect(url)}, #{query}, #{inspect(body)}, #{inspect(headers)}"}

From d536d58080d68598ca282263159f9d565a048642 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Wed, 22 May 2024 15:53:32 +0200
Subject: [PATCH 45/65] changelog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 changelog.d/webfinger-validation.fix | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/webfinger-validation.fix

diff --git a/changelog.d/webfinger-validation.fix b/changelog.d/webfinger-validation.fix
new file mode 100644
index 000000000..e64312666
--- /dev/null
+++ b/changelog.d/webfinger-validation.fix
@@ -0,0 +1 @@
+Fix validate_webfinger when running a different domain for Webfinger
\ No newline at end of file

From 5f1f574f01ea18170a228a8cb273e143d2f05ab4 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 18:45:34 +0400
Subject: [PATCH 46/65] WebFingerControllerTest: Restore host after test.

---
 test/pleroma/web/web_finger/web_finger_controller_test.exs | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/test/pleroma/web/web_finger/web_finger_controller_test.exs b/test/pleroma/web/web_finger/web_finger_controller_test.exs
index f501c6e44..80e072163 100644
--- a/test/pleroma/web/web_finger/web_finger_controller_test.exs
+++ b/test/pleroma/web/web_finger/web_finger_controller_test.exs
@@ -56,11 +56,6 @@ test "Webfinger JRD" do
   end
 
   test "reach user on tld, while pleroma is running on subdomain" do
-    Pleroma.Web.Endpoint.config_change(
-      [{Pleroma.Web.Endpoint, url: [host: "sub.example.com"]}],
-      []
-    )
-
     clear_config([Pleroma.Web.Endpoint, :url, :host], "sub.example.com")
 
     clear_config([Pleroma.Web.WebFinger, :domain], "example.com")

From 50ffbd980e8f9aee48788cea90b723c2dcca017d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Wed, 22 May 2024 15:52:10 +0200
Subject: [PATCH 47/65] Revert "Webfinger: Allow managing account for
 subdomain"

This reverts commit 84bb854056e406d5235dd442c28127891a8a8a86.
---
 lib/pleroma/web/web_finger.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/web/web_finger.ex b/lib/pleroma/web/web_finger.ex
index 668d7d576..0d6a686c3 100644
--- a/lib/pleroma/web/web_finger.ex
+++ b/lib/pleroma/web/web_finger.ex
@@ -230,7 +230,7 @@ def finger(account) do
   defp validate_webfinger(url, %{"subject" => "acct:" <> acct} = data) do
     with %URI{host: request_host} <- URI.parse(url),
          [_name, acct_host] <- String.split(acct, "@"),
-         {_, true} <- {:hosts_match_or_subdomain, String.ends_with?(request_host, acct_host)} do
+         {_, true} <- {:hosts_match, acct_host == request_host} do
       {:ok, data}
     else
       _ -> {:error, {:webfinger_invalid, url, data}}

From b245a5c8c2a554b18f9e22c050abf59e41eda5b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Thu, 24 Aug 2023 00:37:39 +0200
Subject: [PATCH 48/65] Fix validate_webfinger when running a different domain
 for Webfinger
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 lib/pleroma/application.ex    |  3 ++-
 lib/pleroma/web/web_finger.ex | 30 ++++++++++++++++++++++--------
 test/pleroma/user_test.exs    |  4 ++--
 3 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/lib/pleroma/application.ex b/lib/pleroma/application.ex
index e68a3c57e..385e3872d 100644
--- a/lib/pleroma/application.ex
+++ b/lib/pleroma/application.ex
@@ -210,7 +210,8 @@ defp cachex_children do
         expiration: chat_message_id_idempotency_key_expiration(),
         limit: 500_000
       ),
-      build_cachex("rel_me", limit: 2500)
+      build_cachex("rel_me", limit: 2500),
+      build_cachex("host_meta", default_ttl: :timer.minutes(120), limit: 5000)
     ]
   end
 
diff --git a/lib/pleroma/web/web_finger.ex b/lib/pleroma/web/web_finger.ex
index 0d6a686c3..398742200 100644
--- a/lib/pleroma/web/web_finger.ex
+++ b/lib/pleroma/web/web_finger.ex
@@ -155,7 +155,16 @@ def get_template_from_xml(body) do
     end
   end
 
+  @cachex Pleroma.Config.get([:cachex, :provider], Cachex)
   def find_lrdd_template(domain) do
+    @cachex.fetch!(:host_meta_cache, domain, fn _ ->
+      {:commit, fetch_lrdd_template(domain)}
+    end)
+  rescue
+    e -> {:error, "Cachex error: #{inspect(e)}"}
+  end
+
+  defp fetch_lrdd_template(domain) do
     # WebFinger is restricted to HTTPS - https://tools.ietf.org/html/rfc7033#section-9.1
     meta_url = "https://#{domain}/.well-known/host-meta"
 
@@ -168,7 +177,7 @@ def find_lrdd_template(domain) do
     end
   end
 
-  defp get_address_from_domain(domain, encoded_account) when is_binary(domain) do
+  defp get_address_from_domain(domain, "acct:" <> _ = encoded_account) when is_binary(domain) do
     case find_lrdd_template(domain) do
       {:ok, template} ->
         String.replace(template, "{uri}", encoded_account)
@@ -178,6 +187,11 @@ defp get_address_from_domain(domain, encoded_account) when is_binary(domain) do
     end
   end
 
+  defp get_address_from_domain(domain, account) when is_binary(domain) do
+    encoded_account = URI.encode("acct:#{account}")
+    get_address_from_domain(domain, encoded_account)
+  end
+
   defp get_address_from_domain(_, _), do: {:error, :webfinger_no_domain}
 
   @spec finger(String.t()) :: {:ok, map()} | {:error, any()}
@@ -192,9 +206,7 @@ def finger(account) do
           URI.parse(account).host
       end
 
-    encoded_account = URI.encode("acct:#{account}")
-
-    with address when is_binary(address) <- get_address_from_domain(domain, encoded_account),
+    with address when is_binary(address) <- get_address_from_domain(domain, account),
          {:ok, %{status: status, body: body, headers: headers}} when status in 200..299 <-
            HTTP.get(
              address,
@@ -227,13 +239,15 @@ def finger(account) do
     end
   end
 
-  defp validate_webfinger(url, %{"subject" => "acct:" <> acct} = data) do
-    with %URI{host: request_host} <- URI.parse(url),
-         [_name, acct_host] <- String.split(acct, "@"),
+  defp validate_webfinger(request_url, %{"subject" => "acct:" <> acct = subject} = data) do
+    with [_name, acct_host] <- String.split(acct, "@"),
+         {_, url} <- {:address, get_address_from_domain(acct_host, subject)},
+         %URI{host: request_host} <- URI.parse(request_url),
+         %URI{host: acct_host} <- URI.parse(url),
          {_, true} <- {:hosts_match, acct_host == request_host} do
       {:ok, data}
     else
-      _ -> {:error, {:webfinger_invalid, url, data}}
+      _ -> {:error, {:webfinger_invalid, request_url, data}}
     end
   end
 
diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs
index 7f60b959a..f64299370 100644
--- a/test/pleroma/user_test.exs
+++ b/test/pleroma/user_test.exs
@@ -872,7 +872,7 @@ test "gets an existing user by nickname starting with http" do
     setup do: clear_config([Pleroma.Web.WebFinger, :update_nickname_on_user_fetch], true)
 
     test "for mastodon" do
-      Tesla.Mock.mock(fn
+      Tesla.Mock.mock_global(fn
         %{url: "https://example.com/.well-known/host-meta"} ->
           %Tesla.Env{
             status: 302,
@@ -930,7 +930,7 @@ test "for mastodon" do
     end
 
     test "for pleroma" do
-      Tesla.Mock.mock(fn
+      Tesla.Mock.mock_global(fn
         %{url: "https://example.com/.well-known/host-meta"} ->
           %Tesla.Env{
             status: 302,

From 45b5e6ecd8e647026bbdcdb454d75e5e586f5bb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Thu, 24 Aug 2023 01:09:00 +0200
Subject: [PATCH 49/65] Fix tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 test/pleroma/user_test.exs                    | 102 +----------
 .../web_finger/web_finger_controller_test.exs |   2 +-
 test/support/http_request_mock.ex             | 171 ++++++++++++++++++
 3 files changed, 178 insertions(+), 97 deletions(-)

diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs
index f64299370..b1ff52768 100644
--- a/test/pleroma/user_test.exs
+++ b/test/pleroma/user_test.exs
@@ -872,109 +872,19 @@ test "gets an existing user by nickname starting with http" do
     setup do: clear_config([Pleroma.Web.WebFinger, :update_nickname_on_user_fetch], true)
 
     test "for mastodon" do
-      Tesla.Mock.mock_global(fn
-        %{url: "https://example.com/.well-known/host-meta"} ->
-          %Tesla.Env{
-            status: 302,
-            headers: [{"location", "https://sub.example.com/.well-known/host-meta"}]
-          }
-
-        %{url: "https://sub.example.com/.well-known/host-meta"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/masto-host-meta.xml"
-              |> File.read!()
-              |> String.replace("{{domain}}", "sub.example.com")
-          }
-
-        %{url: "https://sub.example.com/.well-known/webfinger?resource=acct:a@example.com"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/masto-webfinger.json"
-              |> File.read!()
-              |> String.replace("{{nickname}}", "a")
-              |> String.replace("{{domain}}", "example.com")
-              |> String.replace("{{subdomain}}", "sub.example.com"),
-            headers: [{"content-type", "application/jrd+json"}]
-          }
-
-        %{url: "https://sub.example.com/users/a"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/masto-user.json"
-              |> File.read!()
-              |> String.replace("{{nickname}}", "a")
-              |> String.replace("{{domain}}", "sub.example.com"),
-            headers: [{"content-type", "application/activity+json"}]
-          }
-
-        %{url: "https://sub.example.com/users/a/collections/featured"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              File.read!("test/fixtures/users_mock/masto_featured.json")
-              |> String.replace("{{domain}}", "sub.example.com")
-              |> String.replace("{{nickname}}", "a"),
-            headers: [{"content-type", "application/activity+json"}]
-          }
-      end)
-
-      ap_id = "a@example.com"
+      ap_id = "a@mastodon.example"
       {:ok, fetched_user} = User.get_or_fetch(ap_id)
 
-      assert fetched_user.ap_id == "https://sub.example.com/users/a"
-      assert fetched_user.nickname == "a@example.com"
+      assert fetched_user.ap_id == "https://sub.mastodon.example/users/a"
+      assert fetched_user.nickname == "a@mastodon.example"
     end
 
     test "for pleroma" do
-      Tesla.Mock.mock_global(fn
-        %{url: "https://example.com/.well-known/host-meta"} ->
-          %Tesla.Env{
-            status: 302,
-            headers: [{"location", "https://sub.example.com/.well-known/host-meta"}]
-          }
-
-        %{url: "https://sub.example.com/.well-known/host-meta"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/pleroma-host-meta.xml"
-              |> File.read!()
-              |> String.replace("{{domain}}", "sub.example.com")
-          }
-
-        %{url: "https://sub.example.com/.well-known/webfinger?resource=acct:a@example.com"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/pleroma-webfinger.json"
-              |> File.read!()
-              |> String.replace("{{nickname}}", "a")
-              |> String.replace("{{domain}}", "example.com")
-              |> String.replace("{{subdomain}}", "sub.example.com"),
-            headers: [{"content-type", "application/jrd+json"}]
-          }
-
-        %{url: "https://sub.example.com/users/a"} ->
-          %Tesla.Env{
-            status: 200,
-            body:
-              "test/fixtures/webfinger/pleroma-user.json"
-              |> File.read!()
-              |> String.replace("{{nickname}}", "a")
-              |> String.replace("{{domain}}", "sub.example.com"),
-            headers: [{"content-type", "application/activity+json"}]
-          }
-      end)
-
-      ap_id = "a@example.com"
+      ap_id = "a@pleroma.example"
       {:ok, fetched_user} = User.get_or_fetch(ap_id)
 
-      assert fetched_user.ap_id == "https://sub.example.com/users/a"
-      assert fetched_user.nickname == "a@example.com"
+      assert fetched_user.ap_id == "https://sub.pleroma.example/users/a"
+      assert fetched_user.nickname == "a@pleroma.example"
     end
   end
 
diff --git a/test/pleroma/web/web_finger/web_finger_controller_test.exs b/test/pleroma/web/web_finger/web_finger_controller_test.exs
index 5e3ac26f9..e01cec5e4 100644
--- a/test/pleroma/web/web_finger/web_finger_controller_test.exs
+++ b/test/pleroma/web/web_finger/web_finger_controller_test.exs
@@ -48,7 +48,7 @@ test "Webfinger JRD" do
            ]
   end
 
-  test "reach user on tld, while pleroma is runned on subdomain" do
+  test "reach user on tld, while pleroma is running on subdomain" do
     Pleroma.Web.Endpoint.config_change(
       [{Pleroma.Web.Endpoint, url: [host: "sub.example.com"]}],
       []
diff --git a/test/support/http_request_mock.ex b/test/support/http_request_mock.ex
index 78a367024..82d8c38d7 100644
--- a/test/support/http_request_mock.ex
+++ b/test/support/http_request_mock.ex
@@ -1464,6 +1464,177 @@ def get("https://misskey.io/notes/8vs6wxufd0", _, _, _) do
      }}
   end
 
+  def get("https://google.com/", _, _, _) do
+    {:ok, %Tesla.Env{status: 200, body: File.read!("test/fixtures/rich_media/google.html")}}
+  end
+
+  def get("https://yahoo.com/", _, _, _) do
+    {:ok, %Tesla.Env{status: 200, body: File.read!("test/fixtures/rich_media/yahoo.html")}}
+  end
+
+  def get("https://example.com/error", _, _, _), do: {:error, :overload}
+
+  def get("https://example.com/ogp-missing-title", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body: File.read!("test/fixtures/rich_media/ogp-missing-title.html")
+     }}
+  end
+
+  def get("https://example.com/oembed", _, _, _) do
+    {:ok, %Tesla.Env{status: 200, body: File.read!("test/fixtures/rich_media/oembed.html")}}
+  end
+
+  def get("https://example.com/oembed.json", _, _, _) do
+    {:ok, %Tesla.Env{status: 200, body: File.read!("test/fixtures/rich_media/oembed.json")}}
+  end
+
+  def get("https://example.com/twitter-card", _, _, _) do
+    {:ok, %Tesla.Env{status: 200, body: File.read!("test/fixtures/rich_media/twitter_card.html")}}
+  end
+
+  def get("https://example.com/non-ogp", _, _, _) do
+    {:ok,
+     %Tesla.Env{status: 200, body: File.read!("test/fixtures/rich_media/non_ogp_embed.html")}}
+  end
+
+  def get("https://example.com/empty", _, _, _) do
+    {:ok, %Tesla.Env{status: 200, body: "hello"}}
+  end
+
+  def get("https://friends.grishka.me/posts/54642", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body: File.read!("test/fixtures/tesla_mock/smithereen_non_anonymous_poll.json"),
+       headers: activitypub_object_headers()
+     }}
+  end
+
+  def get("https://friends.grishka.me/users/1", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body: File.read!("test/fixtures/tesla_mock/smithereen_user.json"),
+       headers: activitypub_object_headers()
+     }}
+  end
+
+  def get("https://mastodon.example/.well-known/host-meta", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 302,
+       headers: [{"location", "https://sub.mastodon.example/.well-known/host-meta"}]
+     }}
+  end
+
+  def get("https://sub.mastodon.example/.well-known/host-meta", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/masto-host-meta.xml"
+         |> File.read!()
+         |> String.replace("{{domain}}", "sub.mastodon.example")
+     }}
+  end
+
+  def get(
+        "https://sub.mastodon.example/.well-known/webfinger?resource=acct:a@mastodon.example",
+        _,
+        _,
+        _
+      ) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/masto-webfinger.json"
+         |> File.read!()
+         |> String.replace("{{nickname}}", "a")
+         |> String.replace("{{domain}}", "mastodon.example")
+         |> String.replace("{{subdomain}}", "sub.mastodon.example"),
+       headers: [{"content-type", "application/jrd+json"}]
+     }}
+  end
+
+  def get("https://sub.mastodon.example/users/a", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/masto-user.json"
+         |> File.read!()
+         |> String.replace("{{nickname}}", "a")
+         |> String.replace("{{domain}}", "sub.mastodon.example"),
+       headers: [{"content-type", "application/activity+json"}]
+     }}
+  end
+
+  def get("https://sub.mastodon.example/users/a/collections/featured", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         File.read!("test/fixtures/users_mock/masto_featured.json")
+         |> String.replace("{{domain}}", "sub.mastodon.example")
+         |> String.replace("{{nickname}}", "a"),
+       headers: [{"content-type", "application/activity+json"}]
+     }}
+  end
+
+  def get("https://pleroma.example/.well-known/host-meta", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 302,
+       headers: [{"location", "https://sub.pleroma.example/.well-known/host-meta"}]
+     }}
+  end
+
+  def get("https://sub.pleroma.example/.well-known/host-meta", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/pleroma-host-meta.xml"
+         |> File.read!()
+         |> String.replace("{{domain}}", "sub.pleroma.example")
+     }}
+  end
+
+  def get(
+        "https://sub.pleroma.example/.well-known/webfinger?resource=acct:a@pleroma.example",
+        _,
+        _,
+        _
+      ) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/pleroma-webfinger.json"
+         |> File.read!()
+         |> String.replace("{{nickname}}", "a")
+         |> String.replace("{{domain}}", "pleroma.example")
+         |> String.replace("{{subdomain}}", "sub.pleroma.example"),
+       headers: [{"content-type", "application/jrd+json"}]
+     }}
+  end
+
+  def get("https://sub.pleroma.example/users/a", _, _, _) do
+    {:ok,
+     %Tesla.Env{
+       status: 200,
+       body:
+         "test/fixtures/webfinger/pleroma-user.json"
+         |> File.read!()
+         |> String.replace("{{nickname}}", "a")
+         |> String.replace("{{domain}}", "sub.pleroma.example"),
+       headers: [{"content-type", "application/activity+json"}]
+     }}
+  end
+
   def get(url, query, body, headers) do
     {:error,
      "Mock response not implemented for GET #{inspect(url)}, #{query}, #{inspect(body)}, #{inspect(headers)}"}

From c42527dc2efe6d25310e44cfec7396c51ced5cec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Wed, 22 May 2024 15:53:32 +0200
Subject: [PATCH 50/65] changelog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 changelog.d/webfinger-validation.fix | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/webfinger-validation.fix

diff --git a/changelog.d/webfinger-validation.fix b/changelog.d/webfinger-validation.fix
new file mode 100644
index 000000000..e64312666
--- /dev/null
+++ b/changelog.d/webfinger-validation.fix
@@ -0,0 +1 @@
+Fix validate_webfinger when running a different domain for Webfinger
\ No newline at end of file

From 53a3176d2414bf4af523f1d9d13fc082fd23ea43 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 22 May 2024 18:45:34 +0400
Subject: [PATCH 51/65] WebFingerControllerTest: Restore host after test.

---
 test/pleroma/web/web_finger/web_finger_controller_test.exs | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/test/pleroma/web/web_finger/web_finger_controller_test.exs b/test/pleroma/web/web_finger/web_finger_controller_test.exs
index e01cec5e4..cc7125ce4 100644
--- a/test/pleroma/web/web_finger/web_finger_controller_test.exs
+++ b/test/pleroma/web/web_finger/web_finger_controller_test.exs
@@ -49,11 +49,6 @@ test "Webfinger JRD" do
   end
 
   test "reach user on tld, while pleroma is running on subdomain" do
-    Pleroma.Web.Endpoint.config_change(
-      [{Pleroma.Web.Endpoint, url: [host: "sub.example.com"]}],
-      []
-    )
-
     clear_config([Pleroma.Web.Endpoint, :url, :host], "sub.example.com")
 
     clear_config([Pleroma.Web.WebFinger, :domain], "example.com")

From 818712f99f165011aaaad5fd82c40304004ace23 Mon Sep 17 00:00:00 2001
From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Date: Thu, 23 May 2024 00:35:38 +0200
Subject: [PATCH 52/65] pleroma_ctl: Use realpath(1) instead of readlink(1)

From realpath(1) in POSIX 202x Draft 4.1:
> If file does not name a symbolic link, readlink shall write a diagnostic
> message to standard error and exit with non-zero status.

Which also doesn't includes `-f`, in preference of `realpath`.
---
 changelog.d/realpath-over-readlink.fix | 1 +
 rel/files/bin/pleroma_ctl              | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/realpath-over-readlink.fix

diff --git a/changelog.d/realpath-over-readlink.fix b/changelog.d/realpath-over-readlink.fix
new file mode 100644
index 000000000..479561b95
--- /dev/null
+++ b/changelog.d/realpath-over-readlink.fix
@@ -0,0 +1 @@
+pleroma_ctl: Use realpath(1) instead of readlink(1)
diff --git a/rel/files/bin/pleroma_ctl b/rel/files/bin/pleroma_ctl
index 87c486514..6f0dba3a8 100755
--- a/rel/files/bin/pleroma_ctl
+++ b/rel/files/bin/pleroma_ctl
@@ -134,7 +134,7 @@ if [ -z "$1" ] || [ "$1" = "help" ]; then
 
 "
 else
-	SCRIPT=$(readlink -f "$0")
+	SCRIPT=$(realpath "$0")
 	SCRIPTPATH=$(dirname "$SCRIPT")
 
 	FULL_ARGS="$*"

From 618b77071afb480b763a493bfcd9b376effedaaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Sat, 25 May 2024 09:10:11 +0200
Subject: [PATCH 53/65] Update pleroma_api.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 changelog.d/api-docs-2.skip         | 0
 docs/development/API/pleroma_api.md | 4 +---
 2 files changed, 1 insertion(+), 3 deletions(-)
 create mode 100644 changelog.d/api-docs-2.skip

diff --git a/changelog.d/api-docs-2.skip b/changelog.d/api-docs-2.skip
new file mode 100644
index 000000000..e69de29bb
diff --git a/docs/development/API/pleroma_api.md b/docs/development/API/pleroma_api.md
index 267dfc1ec..57d333ffe 100644
--- a/docs/development/API/pleroma_api.md
+++ b/docs/development/API/pleroma_api.md
@@ -295,9 +295,7 @@ See [Admin-API](admin_api.md)
         "id": "9umDrYheeY451cQnEe",
         "name": "Read later",
         "emoji": "🕓",
-        "source": {
-          "emoji": "🕓"
-        }
+        "emoji_url": null
     }
 ]
 ```

From 61a3b793165e92d6f23a2e59fb9b95e06737cf25 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sat, 25 May 2024 14:20:47 -0400
Subject: [PATCH 54/65] Search backend healthcheck process

---
 changelog.d/search-healthcheck.add    |  1 +
 config/config.exs                     |  2 +-
 lib/pleroma/application.ex            |  3 +-
 lib/pleroma/search.ex                 |  5 ++
 lib/pleroma/search/database_search.ex |  3 +
 lib/pleroma/search/healthcheck.ex     | 85 +++++++++++++++++++++++++++
 lib/pleroma/search/meilisearch.ex     | 11 ++++
 lib/pleroma/search/search_backend.ex  |  8 +++
 8 files changed, 116 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/search-healthcheck.add
 create mode 100644 lib/pleroma/search/healthcheck.ex

diff --git a/changelog.d/search-healthcheck.add b/changelog.d/search-healthcheck.add
new file mode 100644
index 000000000..4974925e7
--- /dev/null
+++ b/changelog.d/search-healthcheck.add
@@ -0,0 +1 @@
+Monitoring of search backend health to control the processing of jobs in the search indexing Oban queue
diff --git a/config/config.exs b/config/config.exs
index b69044a2b..8b9a588b7 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -579,7 +579,7 @@
     attachments_cleanup: 1,
     new_users_digest: 1,
     mute_expire: 5,
-    search_indexing: 10,
+    search_indexing: [limit: 10, paused: true],
     rich_media_expiration: 2
   ],
   plugins: [Oban.Plugins.Pruner],
diff --git a/lib/pleroma/application.ex b/lib/pleroma/application.ex
index 649bb11c8..d266d1836 100644
--- a/lib/pleroma/application.ex
+++ b/lib/pleroma/application.ex
@@ -109,7 +109,8 @@ def start(_type, _args) do
         streamer_registry() ++
         background_migrators() ++
         shout_child(shout_enabled?()) ++
-        [Pleroma.Gopher.Server]
+        [Pleroma.Gopher.Server] ++
+        [Pleroma.Search.Healthcheck]
 
     # See http://elixir-lang.org/docs/stable/elixir/Supervisor.html
     # for other strategies and supported options
diff --git a/lib/pleroma/search.ex b/lib/pleroma/search.ex
index 3b266e59b..e8dbcca1f 100644
--- a/lib/pleroma/search.ex
+++ b/lib/pleroma/search.ex
@@ -14,4 +14,9 @@ def search(query, options) do
 
     search_module.search(options[:for_user], query, options)
   end
+
+  def healthcheck_endpoints do
+    search_module = Pleroma.Config.get([Pleroma.Search, :module], Pleroma.Activity)
+    search_module.healthcheck_endpoints
+  end
 end
diff --git a/lib/pleroma/search/database_search.ex b/lib/pleroma/search/database_search.ex
index 31bfc7e33..11e99e7f1 100644
--- a/lib/pleroma/search/database_search.ex
+++ b/lib/pleroma/search/database_search.ex
@@ -48,6 +48,9 @@ def add_to_index(_activity), do: :ok
   @impl true
   def remove_from_index(_object), do: :ok
 
+  @impl true
+  def healthcheck_endpoints, do: nil
+
   def maybe_restrict_author(query, %User{} = author) do
     Activity.Queries.by_author(query, author)
   end
diff --git a/lib/pleroma/search/healthcheck.ex b/lib/pleroma/search/healthcheck.ex
new file mode 100644
index 000000000..495aee930
--- /dev/null
+++ b/lib/pleroma/search/healthcheck.ex
@@ -0,0 +1,85 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2024 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+defmodule Pleroma.Search.Healthcheck do
+  @doc """
+  Monitors health of search backend to control processing of events based on health and availability.
+  """
+  use GenServer
+  require Logger
+
+  @tick :timer.seconds(60)
+  @queue :search_indexing
+
+  def start_link(_) do
+    GenServer.start_link(__MODULE__, [], name: __MODULE__)
+  end
+
+  @impl true
+  def init(_) do
+    state = %{healthy: false}
+    {:ok, state, {:continue, :start}}
+  end
+
+  @impl true
+  def handle_continue(:start, state) do
+    tick()
+    {:noreply, state}
+  end
+
+  @impl true
+  def handle_info(:check, state) do
+    urls = Pleroma.Search.healthcheck_endpoints()
+
+    new_state =
+      if healthy?(urls) do
+        Oban.resume_queue(queue: @queue)
+        Map.put(state, :healthy, true)
+      else
+        Oban.pause_queue(queue: @queue)
+        Map.put(state, :healthy, false)
+      end
+
+    maybe_log_state_change(state, new_state)
+
+    tick()
+    {:noreply, new_state}
+  end
+
+  @impl true
+  def handle_call(:check, _from, state) do
+    status = Map.get(state, :healthy)
+
+    {:reply, status, state, :hibernate}
+  end
+
+  defp healthy?([]), do: true
+
+  defp healthy?(urls) when is_list(urls) do
+    Enum.all?(
+      urls,
+      fn url ->
+        case Pleroma.HTTP.get(url) do
+          {:ok, %{status: 200}} -> true
+          _ -> false
+        end
+      end
+    )
+  end
+
+  defp healthy?(_), do: true
+
+  defp tick do
+    Process.send_after(self(), :check, @tick)
+  end
+
+  defp maybe_log_state_change(%{healthy: true}, %{healthy: false}) do
+    Logger.error("Pausing Oban queue #{@queue} due to search backend healthcheck failure")
+  end
+
+  defp maybe_log_state_change(%{healthy: false}, %{healthy: true}) do
+    Logger.info("Resuming Oban queue #{@queue} due to search backend healthcheck pass")
+  end
+
+  defp maybe_log_state_change(_, _), do: :ok
+end
diff --git a/lib/pleroma/search/meilisearch.ex b/lib/pleroma/search/meilisearch.ex
index 2bff663e8..08c2f3d86 100644
--- a/lib/pleroma/search/meilisearch.ex
+++ b/lib/pleroma/search/meilisearch.ex
@@ -178,4 +178,15 @@ def add_to_index(activity) do
   def remove_from_index(object) do
     meili_delete("/indexes/objects/documents/#{object.id}")
   end
+
+  @impl true
+  def healthcheck_endpoints do
+    endpoint =
+      Config.get([Pleroma.Search.Meilisearch, :url])
+      |> URI.parse()
+      |> Map.put(:path, "/health")
+      |> URI.to_string()
+
+    [endpoint]
+  end
 end
diff --git a/lib/pleroma/search/search_backend.ex b/lib/pleroma/search/search_backend.ex
index 68bc48cec..13c887bc2 100644
--- a/lib/pleroma/search/search_backend.ex
+++ b/lib/pleroma/search/search_backend.ex
@@ -21,4 +21,12 @@ defmodule Pleroma.Search.SearchBackend do
   from index.
   """
   @callback remove_from_index(object :: Pleroma.Object.t()) :: :ok | {:error, any()}
+
+  @doc """
+  Healthcheck endpoints of search backend infrastructure to monitor for controlling
+  processing of jobs in the Oban queue.
+
+  It is expected a 200 response is healthy and other responses are unhealthy.
+  """
+  @callback healthcheck_endpoints :: list() | nil
 end

From 3474b42ce396150b21f26ed35bea46ad61f57d5f Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sat, 25 May 2024 16:55:29 -0400
Subject: [PATCH 55/65] Drop TTL to 5 seconds

---
 lib/pleroma/search/healthcheck.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/search/healthcheck.ex b/lib/pleroma/search/healthcheck.ex
index 495aee930..9a2d9fdd6 100644
--- a/lib/pleroma/search/healthcheck.ex
+++ b/lib/pleroma/search/healthcheck.ex
@@ -8,7 +8,7 @@ defmodule Pleroma.Search.Healthcheck do
   use GenServer
   require Logger
 
-  @tick :timer.seconds(60)
+  @tick :timer.seconds(5)
   @queue :search_indexing
 
   def start_link(_) do

From 354b700bedf8ad6e9187245977165ebd7bc2fa1c Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sun, 26 May 2024 14:01:00 -0400
Subject: [PATCH 56/65] Assert that AWS URLs without query parameters do not
 crash

---
 .../web/rich_media/parser/ttl/aws_signed_url_test.exs      | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/test/pleroma/web/rich_media/parser/ttl/aws_signed_url_test.exs b/test/pleroma/web/rich_media/parser/ttl/aws_signed_url_test.exs
index cd8be8675..cc28aa7f3 100644
--- a/test/pleroma/web/rich_media/parser/ttl/aws_signed_url_test.exs
+++ b/test/pleroma/web/rich_media/parser/ttl/aws_signed_url_test.exs
@@ -10,6 +10,7 @@ defmodule Pleroma.Web.RichMedia.Parser.TTL.AwsSignedUrlTest do
 
   alias Pleroma.UnstubbedConfigMock, as: ConfigMock
   alias Pleroma.Web.RichMedia.Card
+  alias Pleroma.Web.RichMedia.Parser.TTL.AwsSignedUrl
 
   setup do
     ConfigMock
@@ -82,6 +83,12 @@ test "s3 signed url is parsed and correct ttl is set for rich media" do
     assert DateTime.diff(scheduled_at, timestamp_dt) == valid_till
   end
 
+  test "AWS URL for an image without expiration works" do
+    og_data = %{"image" => "https://amazonaws.com/image.png"}
+
+    assert is_nil(AwsSignedUrl.ttl(og_data, ""))
+  end
+
   defp construct_s3_url(timestamp, valid_till) do
     "https://pleroma.s3.ap-southeast-1.amazonaws.com/sachin%20%281%29%20_a%20-%25%2Aasdasd%20BNN%20bnnn%20.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIBLWWK6RGDQXDLJQ%2F20190716%2Fap-southeast-1%2Fs3%2Faws4_request&X-Amz-Date=#{timestamp}&X-Amz-Expires=#{valid_till}&X-Amz-Signature=04ffd6b98634f4b1bbabc62e0fac4879093cd54a6eed24fe8eb38e8369526bbf&X-Amz-SignedHeaders=host"
   end

From 807782b7f96ee0e053ad59b464766d750f8a8800 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sat, 25 May 2024 16:27:59 -0400
Subject: [PATCH 57/65] Fix rich media parsing some Amazon URLs

---
 changelog.d/richmediattl.fix                            | 1 +
 lib/pleroma/web/rich_media/parser/ttl/aws_signed_url.ex | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/richmediattl.fix

diff --git a/changelog.d/richmediattl.fix b/changelog.d/richmediattl.fix
new file mode 100644
index 000000000..98de63015
--- /dev/null
+++ b/changelog.d/richmediattl.fix
@@ -0,0 +1 @@
+Parsing of RichMedia TTLs for Amazon URLs when query parameters are nil
diff --git a/lib/pleroma/web/rich_media/parser/ttl/aws_signed_url.ex b/lib/pleroma/web/rich_media/parser/ttl/aws_signed_url.ex
index 948c727e1..1172a120a 100644
--- a/lib/pleroma/web/rich_media/parser/ttl/aws_signed_url.ex
+++ b/lib/pleroma/web/rich_media/parser/ttl/aws_signed_url.ex
@@ -23,7 +23,7 @@ defp aws_signed_url?(image) when is_binary(image) and image != "" do
     %URI{host: host, query: query} = URI.parse(image)
 
     is_binary(host) and String.contains?(host, "amazonaws.com") and
-      String.contains?(query, "X-Amz-Expires")
+      is_binary(query) and String.contains?(query, "X-Amz-Expires")
   end
 
   defp aws_signed_url?(_), do: nil

From f2b0d5f1d02e243a7a1a6f339b59e5abcb8e1bd8 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sun, 26 May 2024 14:11:41 -0400
Subject: [PATCH 58/65] Make it easier to read the state for debugging purposes
 and expose functions for testing

---
 lib/pleroma/search/healthcheck.ex | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/pleroma/search/healthcheck.ex b/lib/pleroma/search/healthcheck.ex
index 9a2d9fdd6..170f29344 100644
--- a/lib/pleroma/search/healthcheck.ex
+++ b/lib/pleroma/search/healthcheck.ex
@@ -32,7 +32,7 @@ def handle_info(:check, state) do
     urls = Pleroma.Search.healthcheck_endpoints()
 
     new_state =
-      if healthy?(urls) do
+      if check(urls) do
         Oban.resume_queue(queue: @queue)
         Map.put(state, :healthy, true)
       else
@@ -47,15 +47,15 @@ def handle_info(:check, state) do
   end
 
   @impl true
-  def handle_call(:check, _from, state) do
-    status = Map.get(state, :healthy)
-
-    {:reply, status, state, :hibernate}
+  def handle_call(:state, _from, state) do
+    {:reply, state, state, :hibernate}
   end
 
-  defp healthy?([]), do: true
+  def state, do: GenServer.call(__MODULE__, :state)
 
-  defp healthy?(urls) when is_list(urls) do
+  def check([]), do: true
+
+  def check(urls) when is_list(urls) do
     Enum.all?(
       urls,
       fn url ->
@@ -67,7 +67,7 @@ defp healthy?(urls) when is_list(urls) do
     )
   end
 
-  defp healthy?(_), do: true
+  def check(_), do: true
 
   defp tick do
     Process.send_after(self(), :check, @tick)

From 03f4b461895802259c895c81462a3e9d0d31c1e5 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sun, 26 May 2024 14:21:24 -0400
Subject: [PATCH 59/65] Test that healthchecks behave correctly for the
 expected HTTP responses

---
 test/pleroma/search/healthcheck_test.exs | 49 ++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 test/pleroma/search/healthcheck_test.exs

diff --git a/test/pleroma/search/healthcheck_test.exs b/test/pleroma/search/healthcheck_test.exs
new file mode 100644
index 000000000..e7649d949
--- /dev/null
+++ b/test/pleroma/search/healthcheck_test.exs
@@ -0,0 +1,49 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2024 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Search.HealthcheckTest do
+  use Pleroma.DataCase
+
+  import Tesla.Mock
+
+  alias Pleroma.Search.Healthcheck
+
+  @good1 "http://good1.example.com/healthz"
+  @good2 "http://good2.example.com/health"
+  @bad "http://bad.example.com/healthy"
+
+  setup do
+    mock(fn
+      %{method: :get, url: @good1} ->
+        %Tesla.Env{
+          status: 200,
+          body: ""
+        }
+
+      %{method: :get, url: @good2} ->
+        %Tesla.Env{
+          status: 200,
+          body: ""
+        }
+
+      %{method: :get, url: @bad} ->
+        %Tesla.Env{
+          status: 503,
+          body: ""
+        }
+    end)
+
+    :ok
+  end
+
+  test "true for 200 responses" do
+    assert Healthcheck.check([@good1])
+    assert Healthcheck.check([@good1, @good2])
+  end
+
+  test "false if any response is not a 200" do
+    refute Healthcheck.check([@bad])
+    refute Healthcheck.check([@good1, @bad])
+  end
+end

From d4769b076a95ce2281dba5673c410eb098445bba Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sun, 26 May 2024 15:13:59 -0400
Subject: [PATCH 60/65] Return a 422 when trying to reply to a deleted status

---
 changelog.d/reply-to-deleted.change            |  1 +
 lib/pleroma/web/common_api/activity_draft.ex   | 18 ++++++++++++++++--
 .../controllers/status_controller_test.exs     | 10 ++++++++++
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/reply-to-deleted.change

diff --git a/changelog.d/reply-to-deleted.change b/changelog.d/reply-to-deleted.change
new file mode 100644
index 000000000..8b952ee7a
--- /dev/null
+++ b/changelog.d/reply-to-deleted.change
@@ -0,0 +1 @@
+A 422 error is returned when attempting to reply to a deleted status
diff --git a/lib/pleroma/web/common_api/activity_draft.ex b/lib/pleroma/web/common_api/activity_draft.ex
index bc46a8a36..8aa1e258d 100644
--- a/lib/pleroma/web/common_api/activity_draft.ex
+++ b/lib/pleroma/web/common_api/activity_draft.ex
@@ -129,8 +129,22 @@ defp attachments(%{params: params} = draft) do
 
   defp in_reply_to(%{params: %{in_reply_to_status_id: ""}} = draft), do: draft
 
-  defp in_reply_to(%{params: %{in_reply_to_status_id: id}} = draft) when is_binary(id) do
-    %__MODULE__{draft | in_reply_to: Activity.get_by_id(id)}
+  defp in_reply_to(%{params: %{in_reply_to_status_id: :deleted}} = draft) do
+    add_error(draft, dgettext("errors", "Cannot reply to a deleted status"))
+  end
+
+  defp in_reply_to(%{params: %{in_reply_to_status_id: id} = params} = draft) when is_binary(id) do
+    activity = Activity.get_by_id(id)
+
+    params =
+      if is_nil(activity) do
+        # Deleted activities are returned as nil
+        Map.put(params, :in_reply_to_status_id, :deleted)
+      else
+        Map.put(params, :in_reply_to_status_id, activity)
+      end
+
+    in_reply_to(%{draft | params: params})
   end
 
   defp in_reply_to(%{params: %{in_reply_to_status_id: %Activity{} = in_reply_to}} = draft) do
diff --git a/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs b/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs
index 80c1ed099..f34911e5b 100644
--- a/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs
+++ b/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs
@@ -235,6 +235,16 @@ test "replying to a status", %{user: user, conn: conn} do
       assert Activity.get_in_reply_to_activity(activity).id == replied_to.id
     end
 
+    test "replying to a deleted status", %{user: user, conn: conn} do
+      {:ok, status} = CommonAPI.post(user, %{status: "cofe"})
+      {:ok, _deleted_status} = CommonAPI.delete(status.id, user)
+
+      conn
+      |> put_req_header("content-type", "application/json")
+      |> post("/api/v1/statuses", %{"status" => "xD", "in_reply_to_id" => status.id})
+      |> json_response_and_validate_schema(422)
+    end
+
     test "replying to a direct message with visibility other than direct", %{
       user: user,
       conn: conn

From d9b82255b9cf49176f8ef1d5a87abf7d80769a47 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sun, 26 May 2024 15:23:12 -0400
Subject: [PATCH 61/65] Add an HTTP timeout for the healthcheck

---
 lib/pleroma/search/healthcheck.ex | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/search/healthcheck.ex b/lib/pleroma/search/healthcheck.ex
index 170f29344..e562c8478 100644
--- a/lib/pleroma/search/healthcheck.ex
+++ b/lib/pleroma/search/healthcheck.ex
@@ -8,8 +8,9 @@ defmodule Pleroma.Search.Healthcheck do
   use GenServer
   require Logger
 
-  @tick :timer.seconds(5)
   @queue :search_indexing
+  @tick :timer.seconds(5)
+  @timeout :timer.seconds(2)
 
   def start_link(_) do
     GenServer.start_link(__MODULE__, [], name: __MODULE__)
@@ -59,7 +60,7 @@ def check(urls) when is_list(urls) do
     Enum.all?(
       urls,
       fn url ->
-        case Pleroma.HTTP.get(url) do
+        case Pleroma.HTTP.get(url, [], recv_timeout: @timeout) do
           {:ok, %{status: 200}} -> true
           _ -> false
         end

From d35b69d2686e62cc5076bd7a33449f98f8a11a85 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 27 May 2024 13:18:02 +0400
Subject: [PATCH 62/65] Pleroma.Search: Remove wrong (but irrelevant) results

---
 lib/pleroma/search.ex | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/pleroma/search.ex b/lib/pleroma/search.ex
index e8dbcca1f..fd0218cb8 100644
--- a/lib/pleroma/search.ex
+++ b/lib/pleroma/search.ex
@@ -10,13 +10,12 @@ def remove_from_index(%Pleroma.Object{id: object_id}) do
   end
 
   def search(query, options) do
-    search_module = Pleroma.Config.get([Pleroma.Search, :module], Pleroma.Activity)
-
+    search_module = Pleroma.Config.get([Pleroma.Search, :module])
     search_module.search(options[:for_user], query, options)
   end
 
   def healthcheck_endpoints do
-    search_module = Pleroma.Config.get([Pleroma.Search, :module], Pleroma.Activity)
+    search_module = Pleroma.Config.get([Pleroma.Search, :module])
     search_module.healthcheck_endpoints
   end
 end

From f214c2cdac4a94fae51e7679223df9557c6a1827 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 27 May 2024 15:23:33 +0400
Subject: [PATCH 63/65] NotificationTest: Remove impossible case.

---
 test/pleroma/notification_test.exs | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/test/pleroma/notification_test.exs b/test/pleroma/notification_test.exs
index ecdb32e32..2c582c708 100644
--- a/test/pleroma/notification_test.exs
+++ b/test/pleroma/notification_test.exs
@@ -859,22 +859,6 @@ test "repeating an activity which is already deleted does not generate a notific
       assert Enum.empty?(Notification.for_user(user))
     end
 
-    test "replying to a deleted post without tagging does not generate a notification" do
-      user = insert(:user)
-      other_user = insert(:user)
-
-      {:ok, activity} = CommonAPI.post(user, %{status: "test post"})
-      {:ok, _deletion_activity} = CommonAPI.delete(activity.id, user)
-
-      {:ok, _reply_activity} =
-        CommonAPI.post(other_user, %{
-          status: "test reply",
-          in_reply_to_status_id: activity.id
-        })
-
-      assert Enum.empty?(Notification.for_user(user))
-    end
-
     test "notifications are deleted if a local user is deleted" do
       user = insert(:user)
       other_user = insert(:user)

From 3055c1598b43ee9460b88880e2752c68e9cf6edb Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 27 May 2024 17:22:18 +0400
Subject: [PATCH 64/65] IPFSTest: Fix configuration mocking

---
 config/test.exs                      |  1 +
 lib/pleroma/upload.ex                |  2 +-
 lib/pleroma/uploaders/ipfs.ex        |  7 +--
 test/pleroma/uploaders/ipfs_test.exs | 70 +++++++++++++++++++---------
 4 files changed, 55 insertions(+), 25 deletions(-)

diff --git a/config/test.exs b/config/test.exs
index 9b4113dd5..3345bb3a9 100644
--- a/config/test.exs
+++ b/config/test.exs
@@ -153,6 +153,7 @@
 config :pleroma, Pleroma.Upload, config_impl: Pleroma.UnstubbedConfigMock
 config :pleroma, Pleroma.ScheduledActivity, config_impl: Pleroma.UnstubbedConfigMock
 config :pleroma, Pleroma.Web.RichMedia.Helpers, config_impl: Pleroma.StaticStubbedConfigMock
+config :pleroma, Pleroma.Uploaders.IPFS, config_impl: Pleroma.UnstubbedConfigMock
 
 peer_module =
   if String.to_integer(System.otp_release()) >= 25 do
diff --git a/lib/pleroma/upload.ex b/lib/pleroma/upload.ex
index 2c6b23c39..35c7c02a5 100644
--- a/lib/pleroma/upload.ex
+++ b/lib/pleroma/upload.ex
@@ -282,7 +282,7 @@ def base_url do
         end
 
       Pleroma.Uploaders.IPFS ->
-        Config.get([Pleroma.Uploaders.IPFS, :get_gateway_url])
+        @config_impl.get([Pleroma.Uploaders.IPFS, :get_gateway_url])
 
       _ ->
         public_endpoint || upload_base_url || Pleroma.Web.Endpoint.url() <> "/media/"
diff --git a/lib/pleroma/uploaders/ipfs.ex b/lib/pleroma/uploaders/ipfs.ex
index 32e06c5cf..d171e4652 100644
--- a/lib/pleroma/uploaders/ipfs.ex
+++ b/lib/pleroma/uploaders/ipfs.ex
@@ -6,11 +6,12 @@ defmodule Pleroma.Uploaders.IPFS do
   @behaviour Pleroma.Uploaders.Uploader
   require Logger
 
-  alias Pleroma.Config
   alias Tesla.Multipart
 
+  @config_impl Application.compile_env(:pleroma, [__MODULE__, :config_impl], Pleroma.Config)
+
   defp get_final_url(method) do
-    config = Config.get([__MODULE__])
+    config = @config_impl.get([__MODULE__])
     post_base_url = Keyword.get(config, :post_gateway_url)
 
     Path.join([post_base_url, method])
@@ -69,7 +70,7 @@ def put_file(%Pleroma.Upload{} = upload) do
   @impl true
   def delete_file(file) do
     case Pleroma.HTTP.post(delete_file_endpoint(), "", [], params: [arg: file]) do
-      {:ok, %{status_code: 204}} -> :ok
+      {:ok, %{status: 204}} -> :ok
       error -> {:error, inspect(error)}
     end
   end
diff --git a/test/pleroma/uploaders/ipfs_test.exs b/test/pleroma/uploaders/ipfs_test.exs
index 853d185e5..cf325b54f 100644
--- a/test/pleroma/uploaders/ipfs_test.exs
+++ b/test/pleroma/uploaders/ipfs_test.exs
@@ -8,22 +8,22 @@ defmodule Pleroma.Uploaders.IPFSTest do
   alias Pleroma.Uploaders.IPFS
   alias Tesla.Multipart
 
-  import Mock
   import ExUnit.CaptureLog
+  import Mock
+  import Mox
 
-  setup do
-    clear_config([Pleroma.Upload, :uploader], Pleroma.Uploaders.IPFS)
-    clear_config([Pleroma.Uploaders.IPFS])
-
-    clear_config(
-      [Pleroma.Uploaders.IPFS, :get_gateway_url],
-      "https://{CID}.ipfs.mydomain.com"
-    )
-
-    clear_config([Pleroma.Uploaders.IPFS, :post_gateway_url], "http://localhost:5001")
-  end
+  alias Pleroma.UnstubbedConfigMock, as: Config
 
   describe "get_final_url" do
+    setup do
+      Config
+      |> expect(:get, fn [Pleroma.Uploaders.IPFS] ->
+        [post_gateway_url: "http://localhost:5001"]
+      end)
+
+      :ok
+    end
+
     test "it returns the final url for put_file" do
       assert IPFS.put_file_endpoint() == "http://localhost:5001/api/v0/add"
     end
@@ -34,7 +34,21 @@ test "it returns the final url for delete_file" do
   end
 
   describe "get_file/1" do
+    setup do
+      Config
+      |> expect(:get, fn [Pleroma.Upload, :uploader] -> Pleroma.Uploaders.IPFS end)
+      |> expect(:get, fn [Pleroma.Upload, :base_url] -> nil end)
+      |> expect(:get, fn [Pleroma.Uploaders.IPFS, :public_endpoint] -> nil end)
+
+      :ok
+    end
+
     test "it returns path to ipfs file with cid as subdomain" do
+      Config
+      |> expect(:get, fn [Pleroma.Uploaders.IPFS, :get_gateway_url] ->
+        "https://{CID}.ipfs.mydomain.com"
+      end)
+
       assert IPFS.get_file("testcid") == {
                :ok,
                {:url, "https://testcid.ipfs.mydomain.com"}
@@ -42,10 +56,10 @@ test "it returns path to ipfs file with cid as subdomain" do
     end
 
     test "it returns path to ipfs file with cid as path" do
-      clear_config(
-        [Pleroma.Uploaders.IPFS, :get_gateway_url],
+      Config
+      |> expect(:get, fn [Pleroma.Uploaders.IPFS, :get_gateway_url] ->
         "https://ipfs.mydomain.com/ipfs/{CID}"
-      )
+      end)
 
       assert IPFS.get_file("testcid") == {
                :ok,
@@ -56,6 +70,11 @@ test "it returns path to ipfs file with cid as path" do
 
   describe "put_file/1" do
     setup do
+      Config
+      |> expect(:get, fn [Pleroma.Uploaders.IPFS] ->
+        [post_gateway_url: "http://localhost:5001"]
+      end)
+
       file_upload = %Pleroma.Upload{
         name: "image-tet.jpg",
         content_type: "image/jpeg",
@@ -73,7 +92,7 @@ test "it returns path to ipfs file with cid as path" do
 
     test "save file", %{file_upload: file_upload} do
       with_mock Pleroma.HTTP,
-        post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
+        post: fn "http://localhost:5001/api/v0/add", _mp, [], params: ["cid-version": "1"] ->
           {:ok,
            %Tesla.Env{
              status: 200,
@@ -88,7 +107,7 @@ test "save file", %{file_upload: file_upload} do
 
     test "returns error", %{file_upload: file_upload} do
       with_mock Pleroma.HTTP,
-        post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
+        post: fn "http://localhost:5001/api/v0/add", _mp, [], params: ["cid-version": "1"] ->
           {:error, "IPFS Gateway upload failed"}
         end do
         assert capture_log(fn ->
@@ -99,19 +118,19 @@ test "returns error", %{file_upload: file_upload} do
 
     test "returns error if JSON decode fails", %{file_upload: file_upload} do
       with_mock Pleroma.HTTP, [],
-        post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
+        post: fn "http://localhost:5001/api/v0/add", _mp, [], params: ["cid-version": "1"] ->
           {:ok, %Tesla.Env{status: 200, body: "invalid"}}
         end do
         assert capture_log(fn ->
                  assert IPFS.put_file(file_upload) == {:error, "JSON decode failed"}
                end) =~
-                 "Elixir.Pleroma.Uploaders.IPFS: {:error, %Jason.DecodeError{data: \"invalid\", position: 0, token: nil}}"
+                 "Elixir.Pleroma.Uploaders.IPFS: {:error, %Jason.DecodeError"
       end
     end
 
     test "returns error if JSON body doesn't contain Hash key", %{file_upload: file_upload} do
       with_mock Pleroma.HTTP, [],
-        post: fn "http://localhost:5001/api/v0/add", mp, [], params: ["cid-version": "1"] ->
+        post: fn "http://localhost:5001/api/v0/add", _mp, [], params: ["cid-version": "1"] ->
           {:ok, %Tesla.Env{status: 200, body: "{\"key\": \"value\"}"}}
         end do
         assert IPFS.put_file(file_upload) == {:error, "JSON doesn't contain Hash key"}
@@ -120,9 +139,18 @@ test "returns error if JSON body doesn't contain Hash key", %{file_upload: file_
   end
 
   describe "delete_file/1" do
+    setup do
+      Config
+      |> expect(:get, fn [Pleroma.Uploaders.IPFS] ->
+        [post_gateway_url: "http://localhost:5001"]
+      end)
+
+      :ok
+    end
+
     test_with_mock "deletes file", Pleroma.HTTP,
       post: fn "http://localhost:5001/api/v0/files/rm", "", [], params: [arg: "image.jpg"] ->
-        {:ok, %{status_code: 204}}
+        {:ok, %{status: 204}}
       end do
       assert :ok = IPFS.delete_file("image.jpg")
     end

From ed93af64e14e1e82cf4840b1a160df8eddecc55c Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 27 May 2024 17:50:34 +0400
Subject: [PATCH 65/65] Add changelog

---
 changelog.d/add-nsfw-mrf.add | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/add-nsfw-mrf.add

diff --git a/changelog.d/add-nsfw-mrf.add b/changelog.d/add-nsfw-mrf.add
new file mode 100644
index 000000000..ce62c7ed0
--- /dev/null
+++ b/changelog.d/add-nsfw-mrf.add
@@ -0,0 +1 @@
+Add NSFW-detecting MRF