Information leak in search api #1164

Closed
opened 2019-08-07 19:13:06 +00:00 by tae · 5 comments
Member

Search shows unlisted statuses (for guest). This is not right and causes an information leak.

I think we need to filter out unlisted for all searches. Although search should probably return all statuses that belong to your own user account regardless of scope.

Screenshot_at_Aug_07_15-00-47

Search shows unlisted statuses (for guest). This is not right and causes an information leak. I think we need to filter out unlisted for all searches. Although search should probably return all statuses that belong to your own user account regardless of scope. ![Screenshot_at_Aug_07_15-00-47](/attachments/8edcdec2-cd01-4d19-ade9-8790e26e0e00)

Debatable. Unlisted posts are still public, they just don't show up in public timelines. I think they should be searchable.

Debatable. Unlisted posts are still public, they just don't show up in public timelines. I think they should be searchable.
Member

I agree with lain

I agree with lain
Owner

that's my constant question with scopes - where do "unlisted" actually appear.

from definition "do not appear on public timelines" you can assume two things:

a) doesn't appear on any publicly-accessible timeline, i.e. search, your own profile, tag search, twkn, instance timeline, link to a conversation
b) doesn't appear on public timelines, where "public timelines" is backend slang for "twkn and instance timeline"

that's my constant question with scopes - where do "unlisted" actually appear. from definition "do not appear on public timelines" you can assume two things: a) doesn't appear on any publicly-accessible timeline, i.e. search, your own profile, tag search, twkn, instance timeline, link to a conversation b) doesn't appear on public timelines, where "public timelines" is backend slang for "twkn and instance timeline"
Owner

how it works on mastodon, observation

  1. User timeline: posts are visible on user timeline
  2. Full-text search doesn't allow you to search fediverse, just posts related to you (your own posts, posts you liked and posts mentioning you), at least that's how it is on mastodon.social which is the only masto account i have
  3. Entering post URL (tested on https://bikeshed.party/notice/9lRfe9cNCjuBHe31nM which is the latest post that shows up for that user on mastosoc for some reason, newer posts are not visible and not tested) into search does give you the post
  4. The very same post doesn't show up on #samsung hashtag search
how it works on mastodon, observation 1. User timeline: posts are visible on user timeline 2. Full-text search doesn't allow you to search fediverse, just posts related to you (your own posts, posts you liked and posts mentioning you), at least that's how it is on mastodon.social which is the only masto account i have 3. Entering post URL (tested on https://bikeshed.party/notice/9lRfe9cNCjuBHe31nM which is the latest post that shows up for that user on mastosoc for some reason, newer posts are not visible and not tested) into search does give you the post 4. The very same post doesn't show up on `#samsung` hashtag search
Owner

As long as there's agreement on what the behavior should be. This just seemed undefined.

Can we clarify in a doc somewhere and close this issue?

As long as there's agreement on what the behavior should be. This just seemed undefined. Can we clarify in a doc somewhere and close this issue?
Sign in to join this conversation.
No milestone
No project
No assignees
5 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma#1164
No description provided.