Fix invalid blurhash handling in Create activity (#16583)

3 years ago · 709876bd6c
parent 590e1578bf
commit 709876bd6c
1 changed files with 5 additions and 1 deletions
--- a/app/lib/activitypub/activity/create.rb
+++ b/app/lib/activitypub/activity/create.rb
@ -446,10 +446,14 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
  end

  def supported_blurhash?(blurhash)
-    components = blurhash.blank? ? nil : Blurhash.components(blurhash)
+    components = blurhash.blank? || !blurhash_valid_chars?(blurhash) ? nil : Blurhash.components(blurhash)
    components.present? && components.none? { |comp| comp > 5 }
  end

+  def blurhash_valid_chars?(blurhash)
+    /^[\w#$%*+-.:;=?@\[\]^{|}~]+$/.match?(blurhash)
+  end
+
  def skip_download?
    return @skip_download if defined?(@skip_download)