From 4f1687ad0bf86d764077e0266f067ca086580540 Mon Sep 17 00:00:00 2001 From: grunfink Date: Fri, 22 May 2026 17:00:51 +0200 Subject: Ensure the request path have enough parts. --- activitypub.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/activitypub.c b/activitypub.c index 9e49d0d..aeb0967 100644 --- a/activitypub.c +++ b/activitypub.c @@ -3884,6 +3884,10 @@ int activitypub_get_handler(const xs_dict *req, const char *q_path, return 0; xs *l = xs_split_n(q_path, "/", 2); + + if (xs_list_len(l) <= 1) + return HTTP_STATUS_BAD_REQUEST; + const char *uid; const char *p_path; @@ -4071,6 +4075,9 @@ int activitypub_post_handler(const xs_dict *req, const char *q_path, /* get the user and path */ xs *l = xs_split_n(q_path, "/", 2); + if (xs_list_len(l) <= 1) + return HTTP_STATUS_BAD_REQUEST; + if (xs_list_len(l) == 2 && strcmp(xs_list_get(l, 1), "shared-inbox") == 0) { enqueue_shared_input(msg, req, 0); return HTTP_STATUS_ACCEPTED; -- cgit