verify_link_service_spec.rb 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177
  1. require 'rails_helper'
  2. RSpec.describe VerifyLinkService, type: :service do
  3. subject { described_class.new }
  4. context 'given a local account' do
  5. let(:account) { Fabricate(:account, username: 'alice') }
  6. let(:field) { Account::Field.new(account, 'name' => 'Website', 'value' => 'http://example.com') }
  7. before do
  8. stub_request(:head, 'https://redirect.me/abc').to_return(status: 301, headers: { 'Location' => ActivityPub::TagManager.instance.url_for(account) })
  9. stub_request(:get, 'http://example.com').to_return(status: 200, body: html)
  10. subject.call(field)
  11. end
  12. context 'when a link contains an <a> back' do
  13. let(:html) do
  14. <<-HTML
  15. <!doctype html>
  16. <body>
  17. <a href="#{ActivityPub::TagManager.instance.url_for(account)}" rel="me">Follow me on Mastodon</a>
  18. </body>
  19. HTML
  20. end
  21. it 'marks the field as verified' do
  22. expect(field.verified?).to be true
  23. end
  24. end
  25. context 'when a link contains an <a rel="noopener noreferrer"> back' do
  26. let(:html) do
  27. <<-HTML
  28. <!doctype html>
  29. <body>
  30. <a href="#{ActivityPub::TagManager.instance.url_for(account)}" rel="me noopener noreferrer" target="_blank">Follow me on Mastodon</a>
  31. </body>
  32. HTML
  33. end
  34. it 'marks the field as verified' do
  35. expect(field.verified?).to be true
  36. end
  37. end
  38. context 'when a link contains a <link> back' do
  39. let(:html) do
  40. <<-HTML
  41. <!doctype html>
  42. <head>
  43. <link type="text/html" href="#{ActivityPub::TagManager.instance.url_for(account)}" rel="me" />
  44. </head>
  45. HTML
  46. end
  47. it 'marks the field as verified' do
  48. expect(field.verified?).to be true
  49. end
  50. end
  51. context 'when a link goes through a redirect back' do
  52. let(:html) do
  53. <<-HTML
  54. <!doctype html>
  55. <head>
  56. <link type="text/html" href="https://redirect.me/abc" rel="me" />
  57. </head>
  58. HTML
  59. end
  60. it 'marks the field as verified' do
  61. expect(field.verified?).to be true
  62. end
  63. end
  64. context 'when a document is truncated but the link back is valid' do
  65. let(:html) do
  66. "
  67. <!doctype html>
  68. <body>
  69. <a rel=\"me\" href=\"#{ActivityPub::TagManager.instance.url_for(account)}\">
  70. "
  71. end
  72. it 'marks the field as verified' do
  73. expect(field.verified?).to be true
  74. end
  75. end
  76. context 'when a link tag might be truncated' do
  77. let(:html) do
  78. "
  79. <!doctype html>
  80. <body>
  81. <a rel=\"me\" href=\"#{ActivityPub::TagManager.instance.url_for(account)}\"
  82. "
  83. end
  84. it 'marks the field as not verified' do
  85. expect(field.verified?).to be false
  86. end
  87. end
  88. context 'when a link does not contain a link back' do
  89. let(:html) { '' }
  90. it 'does not mark the field as verified' do
  91. expect(field.verified?).to be false
  92. end
  93. end
  94. context 'when link has no `href` attribute' do
  95. let(:html) do
  96. <<-HTML
  97. <!doctype html>
  98. <head>
  99. <link type="text/html" rel="me" />
  100. </head>
  101. <body>
  102. <a rel="me" target="_blank">Follow me on Mastodon</a>
  103. </body>
  104. HTML
  105. end
  106. it 'does not mark the field as verified' do
  107. expect(field.verified?).to be false
  108. end
  109. end
  110. end
  111. context 'given a remote account' do
  112. let(:account) { Fabricate(:account, username: 'alice', domain: 'example.com', url: 'https://profile.example.com/alice') }
  113. let(:field) { Account::Field.new(account, 'name' => 'Website', 'value' => '<a href="http://example.com" rel="me"><span class="invisible">http://</span><span class="">example.com</span><span class="invisible"></span></a>') }
  114. before do
  115. stub_request(:get, 'http://example.com').to_return(status: 200, body: html)
  116. subject.call(field)
  117. end
  118. context 'when a link contains an <a> back' do
  119. let(:html) do
  120. <<-HTML
  121. <!doctype html>
  122. <body>
  123. <a href="https://profile.example.com/alice" rel="me">Follow me on Mastodon</a>
  124. </body>
  125. HTML
  126. end
  127. it 'marks the field as verified' do
  128. expect(field.verified?).to be true
  129. end
  130. end
  131. context 'when the link contains a link with a missing protocol slash' do
  132. # This was seen in the wild where a user had three pages:
  133. # 1. their mastodon profile, which linked to github and the personal website
  134. # 2. their personal website correctly linking back to mastodon
  135. # 3. a github profile that was linking to the personal website, but with
  136. # a malformed protocol of http:/
  137. #
  138. # This caused link verification between the mastodon profile and the
  139. # website to fail.
  140. #
  141. # apparently github allows the user to enter website URLs with a single
  142. # slash and makes no attempts to correct that.
  143. let(:html) { '<a href="http:/unrelated.example">Hello</a>' }
  144. it 'does not crash' do
  145. # We could probably put more effort into perhaps auto-correcting the
  146. # link and following it anyway, but at the very least we shouldn't let
  147. # exceptions bubble up
  148. expect(field.verified?).to be false
  149. end
  150. end
  151. end
  152. end