From dd031848112ef812bdb7af9d485360cc4f0ba13a Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Tue, 7 May 2024 11:54:45 -0400
Subject: [PATCH] Strip actor from objects before federating

---
 lib/pleroma/constants.ex                                  | 1 +
 test/fixtures/create-chat-message.json                    | 8 ++++----
 test/pleroma/user/backup_test.exs                         | 2 --
 .../web/activity_pub/transmogrifier/chat_message_test.exs | 2 --
 test/pleroma/web/activity_pub/transmogrifier_test.exs     | 5 +++--
 5 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/lib/pleroma/constants.ex b/lib/pleroma/constants.ex
index d814b4931..4d2cd0b62 100644
--- a/lib/pleroma/constants.ex
+++ b/lib/pleroma/constants.ex
@@ -9,6 +9,7 @@ defmodule Pleroma.Constants do
 
   const(object_internal_fields,
     do: [
+      "actor",
       "reactions",
       "reaction_count",
       "likes",
diff --git a/test/fixtures/create-chat-message.json b/test/fixtures/create-chat-message.json
index 9c23a1c9b..a5e5f559b 100644
--- a/test/fixtures/create-chat-message.json
+++ b/test/fixtures/create-chat-message.json
@@ -1,10 +1,10 @@
 {
-  "actor": "http://2hu.gensokyo/users/raymoo",
-  "id": "http://2hu.gensokyo/objects/1",
+  "actor": "http://mastodon.example.org/users/admin",
+  "id": "http://mastodon.example.org/objects/1",
   "object": {
-    "attributedTo": "http://2hu.gensokyo/users/raymoo",
+    "attributedTo": "http://mastodon.example.org/users/admin",
     "content": "You expected a cute girl? Too bad. <script>alert('XSS')</script>",
-    "id": "http://2hu.gensokyo/objects/2",
+    "id": "http://mastodon.example.org/objects/2",
     "published": "2020-02-12T14:08:20Z",
     "to": [
       "http://2hu.gensokyo/users/marisa"
diff --git a/test/pleroma/user/backup_test.exs b/test/pleroma/user/backup_test.exs
index 5503d15bc..e7187df35 100644
--- a/test/pleroma/user/backup_test.exs
+++ b/test/pleroma/user/backup_test.exs
@@ -221,7 +221,6 @@ test "it creates a zip archive with user data" do
              "orderedItems" => [
                %{
                  "object" => %{
-                   "actor" => "http://cofe.io/users/cofe",
                    "content" => "status1",
                    "type" => "Note"
                  },
@@ -229,7 +228,6 @@ test "it creates a zip archive with user data" do
                },
                %{
                  "object" => %{
-                   "actor" => "http://cofe.io/users/cofe",
                    "content" => "status2"
                  }
                },
diff --git a/test/pleroma/web/activity_pub/transmogrifier/chat_message_test.exs b/test/pleroma/web/activity_pub/transmogrifier/chat_message_test.exs
index c798a0fc9..086641750 100644
--- a/test/pleroma/web/activity_pub/transmogrifier/chat_message_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier/chat_message_test.exs
@@ -116,8 +116,6 @@ test "it fetches the actor if they aren't in our system" do
       data =
         File.read!("test/fixtures/create-chat-message.json")
         |> Jason.decode!()
-        |> Map.put("actor", "http://mastodon.example.org/users/admin")
-        |> put_in(["object", "actor"], "http://mastodon.example.org/users/admin")
 
       _recipient = insert(:user, ap_id: List.first(data["to"]), local: true)
 
diff --git a/test/pleroma/web/activity_pub/transmogrifier_test.exs b/test/pleroma/web/activity_pub/transmogrifier_test.exs
index a49e459a6..5d84b8403 100644
--- a/test/pleroma/web/activity_pub/transmogrifier_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier_test.exs
@@ -169,7 +169,7 @@ test "it inlines private announced objects" do
       {:ok, modified} = Transmogrifier.prepare_outgoing(announce_activity.data)
 
       assert modified["object"]["content"] == "hey"
-      assert modified["object"]["actor"] == modified["object"]["attributedTo"]
+      assert activity.actor == modified["object"]["attributedTo"]
     end
 
     test "it turns mentions into tags" do
@@ -220,7 +220,7 @@ test "it sets the 'attributedTo' property to the actor of the object if it doesn
       {:ok, activity} = CommonAPI.post(user, %{status: "hey"})
       {:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)
 
-      assert modified["object"]["actor"] == modified["object"]["attributedTo"]
+      assert activity.actor == modified["object"]["attributedTo"]
     end
 
     test "it strips internal hashtag data" do
@@ -266,6 +266,7 @@ test "it strips internal fields" do
       assert is_nil(modified["object"]["announcements"])
       assert is_nil(modified["object"]["announcement_count"])
       assert is_nil(modified["object"]["generator"])
+      assert is_nil(modified["object"]["actor"])
     end
 
     test "it strips internal fields of article" do