Skip to content

security: activitypub: reject activities with bogus ids

kaniini requested to merge kaniini/pleroma:security/activitypub-reject-bogus-ids into develop

An attacker can damage Pleroma's object graph in some limited cases by sending activities with an invalid ID. This can lead to a denial of service (DoS) condition.

We mitigate this possibility by validating object IDs. Any objects with an invalid ID will be dropped due to the new guards placed on the Transmogrifier.handle_incoming routine.

Edited by kaniini

Merge request reports