Merge pull request #2461 from nextcloud/backport/2460/stable31

[stable31] fix(federation): check if app is enabled

Author: miaulalala

lib/Controller/RemoteActivityController.php

@@ -7,12 +7,18 @@
 
 namespace OCA\Activity\Controller;
 
+use DateTimeInterface;
+use OC\Files\Storage\Wrapper\Wrapper;
 use OCA\Activity\Extension\Files;
+use OCA\Files_Sharing\External\Storage as ExternalStorage;
 use OCP\Activity\IManager as IActivityManager;
 use OCP\App\IAppManager;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCSController;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\Federation\ICloudIdManager;
 use OCP\Files\InvalidPathException;
 use OCP\Files\IRootFolder;
 use OCP\Files\NotFoundException;
@@ -30,6 +36,8 @@ public function __construct(
 		protected IAppManager $appManager,
 		protected IRootFolder $rootFolder,
 		protected IActivityManager $activityManager,
+		protected ICloudIdManager $cloudIdManager,
+		protected ITimeFactory $timeFactory,
 	) {
 		parent::__construct($appName, $request);
 	}
@@ -48,20 +56,26 @@ public function __construct(
 	 * @param string[] $origin
 	 * @return DataResponse
 	 */
-	public function receiveActivity($token, array $to, array $actor, $type, $updated, array $object = [], array $target = [], array $origin = []) {
-		$date = \DateTime::createFromFormat(\DateTime::W3C, $updated);
-		if ($date === false) {
+	#[BruteForceProtection(action: 'receiveActivity')]
+	public function receiveActivity($token, array $to, array $actor, $type, $updated, array $object = [], array $target = [], array $origin = []): DataResponse {
+		if (!$this->appManager->isInstalled('federatedfilesharing')) {
+			return new DataResponse([], Http::STATUS_NOT_FOUND);
+		}
+
+		$date = \DateTime::createFromFormat(DateTimeInterface::W3C, $updated);
+		if ($date === false || abs($date->getTimestamp() - $this->timeFactory->getTime()) > 600) {
 			return new DataResponse([], Http::STATUS_BAD_REQUEST);
 		}
-		$time = $date->getTimestamp();
 
 		if (!isset($to['type'], $to['name']) || $to['type'] !== 'Person') {
 			return new DataResponse([], Http::STATUS_BAD_REQUEST);
 		}
 
 		$user = $this->userManager->get($to['name']);
 		if (!$user instanceof IUser) {
-			return new DataResponse([], Http::STATUS_NOT_FOUND);
+			$response = new DataResponse([], Http::STATUS_NOT_FOUND);
+			$response->throttle();
+			return $response;
 		}
 
 		if (!isset($actor['type'], $actor['name']) || $actor['type'] !== 'Person') {
@@ -72,27 +86,44 @@ public function receiveActivity($token, array $to, array $actor, $type, $updated
 			return new DataResponse([], Http::STATUS_BAD_REQUEST);
 		}
 
-		if (!$this->appManager->isInstalled('federatedfilesharing')) {
-			return new DataResponse([], Http::STATUS_NOT_FOUND);
+		if (isset($object['name']) && preg_match('/(^|\/)\.\.(\/|$)/', $object['name'])) {
+			return new DataResponse([], Http::STATUS_BAD_REQUEST);
+		}
+
+		try {
+			$resolved = $this->cloudIdManager->resolveCloudId($actor['name']);
+			$actorServer = $resolved->getRemote();
+			$actorUser = $resolved->getUser();
+		} catch (\InvalidArgumentException) {
+			return new DataResponse([], Http::STATUS_BAD_REQUEST);
+		}
+
+		$internalType = $this->translateType($type);
+		if ($internalType === '') {
+			return new DataResponse([], Http::STATUS_BAD_REQUEST);
 		}
 
 		$query = $this->db->getQueryBuilder();
 		$query->select('*')
 			->from('share_external')
 			->where($query->expr()->eq('share_token', $query->createNamedParameter($token)))
-			->andWhere($query->expr()->eq('user', $query->createNamedParameter($user->getUID())));
+			->andWhere($query->expr()->eq('user', $query->createNamedParameter($user->getUID())))
+			->andWhere($query->expr()->eq('owner', $query->createNamedParameter($actorUser)));
 
 		$result = $query->executeQuery();
 		$share = $result->fetch();
 		$result->closeCursor();
 
-		if (!is_array($share) || strpos($share['mountpoint'], '{{TemporaryMountPointName#') === 0) {
-			return new DataResponse([], Http::STATUS_NOT_FOUND);
+		if (!is_array($share) || str_starts_with($share['mountpoint'], '{{TemporaryMountPointName#')) {
+			$response = new DataResponse([], Http::STATUS_NOT_FOUND);
+			$response->throttle();
+			return $response;
 		}
 
-		$internalType = $this->translateType($type);
-		if ($internalType === '') {
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
+		$normalizedActorServer = rtrim(strtolower(preg_replace('/^https?:\/\//', '', $actorServer)), '/');
+		$normalizedShareRemote = rtrim(strtolower(preg_replace('/^https?:\/\//', '', $share['remote'])), '/');
+		if ($normalizedActorServer !== $normalizedShareRemote) {
+			return new DataResponse([], Http::STATUS_FORBIDDEN);
 		}
 
 		$path2 = null;
@@ -111,7 +142,6 @@ public function receiveActivity($token, array $to, array $actor, $type, $updated
 			if (!isset($object['type'], $object['name']) || $object['type'] !== 'Document') {
 				return new DataResponse([], Http::STATUS_BAD_REQUEST);
 			}
-
 			$path = $share['mountpoint'] . $object['name'];
 		}
 
@@ -124,10 +154,25 @@ public function receiveActivity($token, array $to, array $actor, $type, $updated
 		try {
 			$node = $userFolder->get($path);
 			$fileId = $node->getId();
-		} catch (NotFoundException $e) {
-			return new DataResponse([], Http::STATUS_NOT_FOUND);
-		} catch (InvalidPathException $e) {
-			return new DataResponse([], Http::STATUS_NOT_FOUND);
+
+			$storage = $node->getStorage();
+			if (!$storage->instanceOfStorage(ExternalStorage::class)) {
+				$response = new DataResponse([], Http::STATUS_FORBIDDEN);
+				$response->throttle();
+				return $response;
+			}
+			while ($storage instanceof Wrapper) {
+				$storage = $storage->getWrapperStorage();
+			}
+			if (!($storage instanceof ExternalStorage) || $storage->getToken() !== $token) {
+				$response = new DataResponse([], Http::STATUS_FORBIDDEN);
+				$response->throttle();
+				return $response;
+			}
+		} catch (NotFoundException|InvalidPathException) {
+			$response = new DataResponse([], Http::STATUS_NOT_FOUND);
+			$response->throttle();
+			return $response;
 		}
 
 		if ($path2 !== null) {
@@ -136,8 +181,7 @@ public function receiveActivity($token, array $to, array $actor, $type, $updated
 				try {
 					$parent = $node->getParent();
 					$secondPath = [$parent->getId() => dirname($path2)];
-				} catch (NotFoundException $e) {
-				} catch (InvalidPathException $e) {
+				} catch (NotFoundException|InvalidPathException) {
 				}
 			}
 			$subjectParams = [$secondPath, $actor['name'], [$fileId => $path]];
@@ -153,11 +197,11 @@ public function receiveActivity($token, array $to, array $actor, $type, $updated
 				->setAuthor($actor['name'])
 				->setObject('files', $fileId, $path)
 				->setSubject($subject, $subjectParams)
-				->setTimestamp($time);
+				->setTimestamp($date->getTimestamp());
 			$this->activityManager->publish($event);
-		} catch (\InvalidArgumentException $e) {
+		} catch (\InvalidArgumentException) {
 			return new DataResponse(['activity'], Http::STATUS_BAD_REQUEST);
-		} catch (\BadMethodCallException $e) {
+		} catch (\BadMethodCallException) {
 			return new DataResponse(['sending'], Http::STATUS_BAD_REQUEST);
 		}