NodeBB / NodeBB / 30007290882 / 3

85%

master: 85%

push

github

fix(activitypub): use absolute avatar/cover URLs as-is in user actor (#14447)

* fix(activitypub): use absolute avatar/cover URLs as-is in user actor

Mocks.actors.user unconditionally prepended the forum url to the
avatar (icon) and cover (image) URLs. When a user's avatar is an
external absolute URL (e.g. a Google avatar obtained via SSO login),
this produced a malformed URL such as
`https://forum.example.comhttps://lh3.googleusercontent.com/...`,
so remote instances could not load the avatar over federation.

Only prepend the base url for relative paths, matching the existing
convention in src/socket.io/user/picture.js.

* fix(activitypub): resolve avatar/cover URLs via new URL(), unset on malformed values

* fix(activitypub): preserve base path for relative avatar/cover urls

new URL(input, base) discards the base pathname for root-relative
inputs, breaking subfolder (relative_path) installs. Prepend the base
via concatenation for relative paths and use new URL only to validate
and unset malformed values.

13234 of 18295 branches covered (72.34%)

27742 of 32683 relevant lines covered (84.88%)

696.65 hits per line