sec: Reject contents from invalid origins

Author: marienfressinaud

src/controllers/Requests.php

@@ -187,6 +187,12 @@ public function publish(Request $request): Response
 
         $content = new models\Content($url);
 
+        if (!$content->isAllowed()) {
+            return Response::badRequest('requests/error.txt', [
+                'errors' => ["url \"{$url}\" is not authorized"],
+            ]);
+        }
+
         $errors = $content->validate();
         if ($errors) {
             return Response::badRequest('requests/error.txt', [

src/models/Content.php

@@ -4,6 +4,7 @@
 
 use Minz\Database;
 use Minz\Validable;
+use Webubbub\utils;
 
 /**
  * Represent a content created by publishers, it is delivered to subscribers.
@@ -85,6 +86,14 @@ public function deliver(): void
         $this->status = 'delivered';
     }
 
+    /**
+     * Return wheter a content is allowed on the hub or not.
+     */
+    public function isAllowed(): bool
+    {
+        return utils\AllowedOriginHelper::isOriginAllowed($this->url);
+    }
+
     /**
      * Delete the Contents that can be deleted and return the number of
      * deletions.

tests/cli/RequestsTest.php

@@ -251,6 +251,22 @@ public function testPublishWithSameUrlAndFetchedStatus(): void
         $this->assertSame(2, models\Content::count());
     }
 
+    public function testPublishFailsIfUrlIsNotAuthorized(): void
+    {
+        \Webubbub\Configuration::$application['allowed_topic_origins'] = 'https://allowed.1.com,https://allowed.2.com';
+
+        $response = $this->appRun('CLI', '/requests/publish', [
+            'hub_url' => 'https://not.allowed.com',
+        ]);
+
+        \Webubbub\Configuration::$application['allowed_topic_origins'] = '';
+
+        $this->assertResponseCode($response, 400);
+        $this->assertResponseContains($response, 'url "https://not.allowed.com" is not authorized');
+        $this->assertResponseHeaders($response, ['Content-Type' => 'text/plain']);
+        $this->assertSame(0, models\Content::count());
+    }
+
     #[\PHPUnit\Framework\Attributes\DataProvider('invalidUrlProvider')]
     public function testPublishFailsIfUrlIsInvalid(string $invalid_url): void
     {