fix: actors.assert attempting to process things that aren't actors, #12809

src/activitypub/actors.js

@@ -20,6 +20,16 @@ const activitypub = module.parent.exports;
 const Actors = module.exports;
 
 Actors.assert = async (ids, options = {}) => {
+	/**
+	 * Ensures that the passed in ids or webfinger handles are stored in database.
+	 * Options:
+	 *   - update: boolean, forces re-fetch/process of the resolved id
+	 * Return one of:
+	 *   - An array of newly processed ids
+	 *   - false: if input incorrect (or webfinger handle cannot resolve)
+	 *   - true: no new IDs processed; all passed-in IDs present.
+	 */
+
 	// Handle single values
 	if (!Array.isArray(ids)) {
 		ids = [ids];
@@ -89,6 +99,12 @@ Actors.assert = async (ids, options = {}) => {
 		try {
 			// winston.verbose(`[activitypub/actors] Processing ${id}`);
 			const actor = (typeof id === 'object' && id.hasOwnProperty('id')) ? id : await activitypub.get('uid', 0, id, { cache: process.env.CI === 'true' });
+			if (
+				!activitypub._constants.acceptableActorTypes.has(actor.type) ||
+				!activitypub._constants.requiredActorProps.every(prop => actor.hasOwnProperty(prop))
+			) {
+				return null;
+			}
 
 			// Follow counts
 			try {

src/activitypub/index.js

@@ -33,6 +33,8 @@ ActivityPub._constants = Object.freeze({
 	acceptedPostTypes: [
 		'Note', 'Page', 'Article', 'Question',
 	],
+	acceptableActorTypes: new Set(['Application', 'Group', 'Organization', 'Person', 'Service']),
+	requiredActorProps: ['inbox', 'outbox'],
 	acceptedProtocols: ['https', ...(process.env.CI === 'true' ? ['http'] : [])],
 });
 ActivityPub._cache = requestCache;