notfire/Iceshrimp.NET
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[backend/libmfm] Wrap MFM payloads that cause the parser to time out in a MfmPlainNode

Browse source
This commit is contained in:
Laura Hausmann 2024-11-27 04:49:17 +01:00
parent 556ada822f
commit d6f4f5bd51
No known key found for this signature in database
GPG key ID: D044E84C5BE01605
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
Iceshrimp.Backend/Core/Helpers/LibMfm/Serialization/MfmSerializer.cs
View file

@ -138,6 +138,16 @@ public static class MfmSerializer
result.Append(end); result.Append(end);
break; break;
} }
case MfmTimeoutTextNode mfmTimeoutTextNode:
{
// This mitigates MFM DoS payloads, since every incoming note is parsed & reserialized.
// We need to remove all </plain> tags to make sure that the mitigation can't be bypassed by adding </plain> to the payload.
// Opening <plain> tags are removed because they are now unnecessary.
result.Append("<plain>");
result.Append(mfmTimeoutTextNode.Text.Replace("<plain>", "").Replace("</plain>", ""));
result.Append("</plain>");
break;
}
case MfmTextNode mfmTextNode: case MfmTextNode mfmTextNode:
{ {
result.Append(mfmTextNode.Text); result.Append(mfmTextNode.Text);