NodeBB / NodeBB / 29754397185

85%

push

github

fix(activitypub): don't double-encode non-ASCII handles in webfinger query

new URL('acct:...') percent-encodes non-ASCII characters during
serialization, and URLSearchParams then encodes the percent signs a
second time. The remote server decodes once and looks up a literal
'user-%C3%B6' handle, so webfinger returns 404 for any user whose
slug contains non-ASCII characters (e.g. Turkish ö/ü/ğ/ş/ç/ı).

Since actors.assert() verifies the webfinger backreference, the 404
causes actor assertion to fail and federated posts from such users
render as guests.

14193 of 19329 branches covered (73.43%)

1 of 1 new or added line in 1 file covered. (100.0%)

29435 of 34456 relevant lines covered (85.43%)

3359.12 hits per line