NodeBB / NodeBB / 30007290882 / 4

85%

master: 85%

push

github

fix(activitypub): use absolute avatar/cover URLs as-is in user actor (#14447)

* fix(activitypub): use absolute avatar/cover URLs as-is in user actor

Mocks.actors.user unconditionally prepended the forum url to the
avatar (icon) and cover (image) URLs. When a user's avatar is an
external absolute URL (e.g. a Google avatar obtained via SSO login),
this produced a malformed URL such as
`https://forum.example.comhttps://lh3.googleusercontent.com/...`,
so remote instances could not load the avatar over federation.

Only prepend the base url for relative paths, matching the existing
convention in src/socket.io/user/picture.js.

* fix(activitypub): resolve avatar/cover URLs via new URL(), unset on malformed values

* fix(activitypub): preserve base path for relative avatar/cover urls

new URL(input, base) discards the base pathname for root-relative
inputs, breaking subfolder (relative_path) installs. Prepend the base
via concatenation for relative paths and use new URL only to validate
and unset malformed values.

13221 of 18297 branches covered (72.26%)

27752 of 32702 relevant lines covered (84.86%)

700.75 hits per line