Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bugfix] Fix potential dereference of accounts on own instance #757

Merged
merged 4 commits into from
Aug 20, 2022

Conversation

tsmethurst
Copy link
Contributor

@tsmethurst tsmethurst commented Aug 18, 2022

This PR updates some of the logic in GetRemoteAccount to ensure that accounts from our own instance are never webfingered. This has happened before and causes an issue where the domain of the account is set to AccountDomain or Host, which means that the account in question is no longer picked up correctly by GetLocalAccountByUsername, which causes all sorts of knock-on issues.

Rather than trying to track down + add checks for every instance where callers might be passing a local account into this function, it's easier to just add the logic into GetRemoteAccount instead.

Callers should still try to avoid passing local accounts into GetRemoteAccount because it's confusing, but at least if they do it now it won't break the account that was passed in.

To support this update, this PR also adds another index to the account cache, for username and domain lookups, which replaces the db.Where that was being used before. So, should be a little faster in some places too!

@NyaaaWhatsUpDoc NyaaaWhatsUpDoc merged commit 570fa7c into main Aug 20, 2022
@NyaaaWhatsUpDoc NyaaaWhatsUpDoc deleted the account_self_dereference_fix branch August 20, 2022 20:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants