Update InboxPipeline, fail earlier for invalid public keys. Fixes #2648

4 years ago · d1c5e9b867
parent 40db9a1296
commit d1c5e9b867
2 changed files with 6 additions and 0 deletions
--- a/app/Jobs/InboxPipeline/InboxValidator.php
+++ b/app/Jobs/InboxPipeline/InboxValidator.php
@ -173,6 +173,9 @@ class InboxValidator implements ShouldQueue
            return;
        }
        $pkey = openssl_pkey_get_public($actor->public_key);
+        if(!$pkey) {
+            return 0;
+        }
        $inboxPath = "/users/{$profile->username}/inbox";
        list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body);
        if($verified == 1) { 
--- a/app/Jobs/InboxPipeline/InboxWorker.php
+++ b/app/Jobs/InboxPipeline/InboxWorker.php
@ -161,6 +161,9 @@ class InboxWorker implements ShouldQueue
            return;
        }
        $pkey = openssl_pkey_get_public($actor->public_key);
+        if(!$pkey) {
+            return 0;
+        }
        $inboxPath = "/f/inbox";
        list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body);
        if($verified == 1) {