diff --git a/src/activitypub/helpers.js b/src/activitypub/helpers.js index 9a6577af41..558a4ee8d7 100644 --- a/src/activitypub/helpers.js +++ b/src/activitypub/helpers.js @@ -66,8 +66,15 @@ Helpers.isUri = (value) => { }; Helpers.assertAccept = (accept) => { - if (!accept) return false; - const normalized = accept.split(',').map(s => s.trim().replace(/\s*;\s*/g, ';')).join(','); + if (!accept) { + return false; + } + + const normalized = accept + .split(',') + .map(s => s.trim().replace(/\s*;\s*/g, ';')) // spec allows spaces around semi-colon + .join(','); + return activitypub._constants.acceptableTypes.some(type => normalized.includes(type)); }; diff --git a/src/middleware/activitypub.js b/src/middleware/activitypub.js index 2805801561..9ea81c0035 100644 --- a/src/middleware/activitypub.js +++ b/src/middleware/activitypub.js @@ -19,11 +19,16 @@ middleware.pageview = async (req, res, next) => { middleware.assertS2S = async function (req, res, next) { // For whatever reason, express accepts does not recognize "profile" as a valid differentiator // Therefore, manual header parsing is used here. - const { accept, 'content-type': contentType } = req.headers; + let { accept, 'content-type': contentType } = req.headers; if (!(accept || contentType)) { return next('route'); } + // Normalize content-type + if (contentType) { + contentType = contentType.trim().replace(/\s*;\s*/g, ';'); // spec allows spaces around semi-colon + } + const pass = activitypub.helpers.assertAccept(accept) || (contentType && activitypub._constants.acceptableTypes.includes(contentType));