NodeBB / NodeBB / 30007290882

85%

Build Type

push

github

Committed by web-flow

Commit Message

fix(activitypub): use absolute avatar/cover URLs as-is in user actor (#14447)

* fix(activitypub): use absolute avatar/cover URLs as-is in user actor

Mocks.actors.user unconditionally prepended the forum url to the
avatar (icon) and cover (image) URLs. When a user's avatar is an
external absolute URL (e.g. a Google avatar obtained via SSO login),
this produced a malformed URL such as
`https://forum.example.comhttps://lh3.googleusercontent.com/...`,
so remote instances could not load the avatar over federation.

Only prepend the base url for relative paths, matching the existing
convention in src/socket.io/user/picture.js.

* fix(activitypub): resolve avatar/cover URLs via new URL(), unset on malformed values

* fix(activitypub): preserve base path for relative avatar/cover urls

new URL(input, base) discards the base pathname for root-relative
inputs, breaking subfolder (relative_path) installs. Prepend the base
via concatenation for relative paths and use new URL only to validate
and unset malformed values.

Coverage Stats

14202 of 19341 branches covered (73.43%)

6 of 8 new or added lines in 1 file covered. (75.0%)

10 existing lines in 1 file now uncovered.

29449 of 34470 relevant lines covered (85.43%)

3341.55 hits per line