Merge pull request from GHSA-c7p6-c688-fhgp

* FixSec: スタンプを経由してカスタム絵文字のデータを改竄できる問題

* Fix: 相乗り絵文字が受け取れない問題とテスト

* Change: 相乗りスタンプは常にオリジナルの情報を参照

* Fix: uriまで偽装した場合に対応

spec/lib/activitypub/activity/like_spec.rb

@@ -16,6 +16,28 @@ RSpec.describe ActivityPub::Activity::Like do
       object: ActivityPub::TagManager.instance.uri_for(status),
     }.with_indifferent_access
   end
+  let(:original_emoji) do
+    {
+      id: 'https://example.com/aaa',
+      type: 'Emoji',
+      icon: {
+        url: 'http://example.com/emoji.png',
+      },
+      name: 'tinking',
+      license: 'This is ohagi',
+    }
+  end
+  let(:original_invalid_emoji) do
+    {
+      id: 'https://example.com/invalid',
+      type: 'Emoji',
+      icon: {
+        url: 'http://example.com/emoji.png',
+      },
+      name: 'other',
+      license: 'This is other ohagi',
+    }
+  end
 
   describe '#perform' do
     subject { described_class.new(json, sender) }
@@ -37,6 +59,9 @@ RSpec.describe ActivityPub::Activity::Like do
 
     before do
       stub_request(:get, 'http://example.com/emoji.png').to_return(body: attachment_fixture('emojo.png'))
+      stub_request(:get, 'http://foo.bar/emoji2.png').to_return(body: attachment_fixture('emojo.png'))
+      stub_request(:get, 'https://example.com/aaa').to_return(status: 200, body: Oj.dump(original_emoji))
+      stub_request(:get, 'https://example.com/invalid').to_return(status: 200, body: Oj.dump(original_invalid_emoji))
     end
 
     let(:json) do
@@ -122,13 +147,12 @@ RSpec.describe ActivityPub::Activity::Like do
       end
     end
 
-    context 'with custom emoji and custom domain' do
+    context 'with custom emoji from non-original server account' do
       let(:content) { ':tinking:' }
       let(:tag) do
         {
           id: 'https://example.com/aaa',
           type: 'Emoji',
-          domain: 'post.kmycode.net',
           icon: {
             url: 'http://example.com/emoji.png',
           },
@@ -136,17 +160,98 @@ RSpec.describe ActivityPub::Activity::Like do
         }
       end
 
+      before do
+        sender.update(domain: 'ohagi.com')
+        Fabricate(:custom_emoji, domain: 'example.com', uri: 'https://example.com/aaa', shortcode: 'tinking')
+      end
+
       it 'create emoji reaction' do
         expect(subject.count).to eq 1
         expect(subject.first.name).to eq 'tinking'
         expect(subject.first.account).to eq sender
         expect(subject.first.custom_emoji).to_not be_nil
         expect(subject.first.custom_emoji.shortcode).to eq 'tinking'
-        expect(subject.first.custom_emoji.domain).to eq 'post.kmycode.net'
+        expect(subject.first.custom_emoji.domain).to eq 'example.com'
         expect(sender.favourited?(status)).to be false
       end
     end
 
+    context 'with custom emoji and update license from non-original server account' do
+      let(:content) { ':tinking:' }
+      let(:tag) do
+        {
+          id: 'https://example.com/aaa',
+          type: 'Emoji',
+          icon: {
+            url: 'http://example.com/emoji.png',
+          },
+          name: 'tinking',
+          license: 'Old license',
+        }
+      end
+
+      before do
+        sender.update(domain: 'ohagi.com')
+        Fabricate(:custom_emoji, domain: 'example.com', uri: 'https://example.com/aaa', shortcode: 'tinking')
+      end
+
+      it 'create emoji reaction' do
+        expect(subject.count).to eq 1
+        expect(subject.first.custom_emoji.license).to eq 'This is ohagi'
+        expect(sender.favourited?(status)).to be false
+      end
+    end
+
+    context 'with custom emoji but icon url is not valid' do
+      let(:content) { ':tinking:' }
+      let(:tag) do
+        {
+          id: 'https://example.com/aaa',
+          type: 'Emoji',
+          icon: {
+            url: 'http://foo.bar/emoji.png',
+          },
+          name: 'tinking',
+          license: 'Good for using darwin',
+        }
+      end
+
+      before do
+        sender.update(domain: 'ohagi.com')
+        Fabricate(:custom_emoji, domain: 'example.com', uri: 'https://example.com/aaa', shortcode: 'tinking', image_remote_url: 'http://example.com/emoji.png')
+      end
+
+      it 'create emoji reaction' do
+        expect(subject.count).to eq 1
+        expect(subject.first.custom_emoji.reload.license).to eq 'This is ohagi'
+        expect(subject.first.custom_emoji.image_remote_url).to eq 'http://example.com/emoji.png'
+      end
+    end
+
+    context 'with custom emoji but uri is not valid' do
+      let(:content) { ':tinking:' }
+      let(:tag) do
+        {
+          id: 'https://example.com/invalid',
+          type: 'Emoji',
+          icon: {
+            url: 'http://foo.bar/emoji2.png',
+          },
+          name: 'tinking',
+          license: 'Good for using darwin',
+        }
+      end
+
+      before do
+        sender.update(domain: 'ohagi.com')
+        Fabricate(:custom_emoji, domain: 'example.com', uri: 'https://example.com/aaa', shortcode: 'tinking', image_remote_url: 'http://example.com/emoji.png')
+      end
+
+      it 'create emoji reaction' do
+        expect(subject.count).to eq 0
+      end
+    end
+
     context 'with custom emoji but invalid id' do
       let(:content) { ':tinking:' }
       let(:tag) do
@@ -175,7 +280,7 @@ RSpec.describe ActivityPub::Activity::Like do
       let(:content) { ':tinking:' }
       let(:tag) do
         {
-          id: 'aaa',
+          id: 'https://cb6e6126.ngrok.io/aaa',
           type: 'Emoji',
           domain: Rails.configuration.x.local_domain,
           icon: {
@@ -197,6 +302,7 @@ RSpec.describe ActivityPub::Activity::Like do
         expect(subject.first.custom_emoji).to_not be_nil
         expect(subject.first.custom_emoji.shortcode).to eq 'tinking'
         expect(subject.first.custom_emoji.domain).to be_nil
+        expect(subject.first.custom_emoji.license).to eq 'Everyone but Ohagi'
         expect(sender.favourited?(status)).to be false
       end