Fix: フレンドサーバー申請時、ドメインを偽装して無関係のInboxを指定できる脆弱性 (#932)

2024-12-04 12:03:18 +09:00 · 2024-12-04 12:03:18 +09:00 · 43819a8c02
commit 43819a8c02
parent 4a3c2d7ed7
4 changed files with 20 additions and 19 deletions
--- a/spec/models/friend_domain_spec.rb
+++ b/spec/models/friend_domain_spec.rb
@ -21,7 +21,6 @@ RSpec.describe FriendDomain do
        type: 'Follow',
        actor: 'https://cb6e6126.ngrok.io/actor',
        object: 'https://www.w3.org/ns/activitystreams#Public',
-        inboxUrl: 'https://cb6e6126.ngrok.io/inbox',
      }))).to have_been_made.once
    end
  end