Fix LDSignature tests (#33705)

mastodon · Jan 23, 2025 · 7261951 · 7261951
1 parent 4b4de02
commit 7261951
Showing 1 changed file with 52 additions and 1 deletion.
diff --git a/spec/lib/activitypub/linked_data_signature_spec.rb b/spec/lib/activitypub/linked_data_signature_spec.rb
@@ -13,10 +13,13 @@
     {
       '@context' => 'https://www.w3.org/ns/activitystreams',
       'id' => 'http://example.com/hello-world',
+      'type' => 'Note',
+      'content' => 'Hello world',
     }
   end
 
-  let(:json) { raw_json.merge('signature' => signature) }
+  let(:signed_json) { raw_json.merge('signature' => signature) }
+  let(:json) { signed_json }
 
   describe '#verify_actor!' do
     context 'when signature matches' do
@@ -90,6 +93,54 @@
         expect(subject.verify_actor!).to be_nil
       end
     end
+
+    context 'when an attribute has been removed from the document' do
+      let(:signature) { raw_signature.merge('type' => 'RsaSignature2017', 'signatureValue' => sign(sender, raw_signature, raw_json)) }
+      let(:json) { signed_json.without('content') }
+
+      let(:raw_signature) do
+        {
+          'creator' => 'http://example.com/alice',
+          'created' => '2017-09-23T20:21:34Z',
+        }
+      end
+
+      it 'returns nil' do
+        expect(subject.verify_actor!).to be_nil
+      end
+    end
+
+    context 'when an attribute has been added to the document' do
+      let(:signature) { raw_signature.merge('type' => 'RsaSignature2017', 'signatureValue' => sign(sender, raw_signature, raw_json)) }
+      let(:json) { signed_json.merge('attributedTo' => 'http://example.com/bob') }
+
+      let(:raw_signature) do
+        {
+          'creator' => 'http://example.com/alice',
+          'created' => '2017-09-23T20:21:34Z',
+        }
+      end
+
+      it 'returns nil' do
+        expect(subject.verify_actor!).to be_nil
+      end
+    end
+
+    context 'when an existing attribute has been changed' do
+      let(:signature) { raw_signature.merge('type' => 'RsaSignature2017', 'signatureValue' => sign(sender, raw_signature, raw_json)) }
+      let(:json) { signed_json.merge('content' => 'oops') }
+
+      let(:raw_signature) do
+        {
+          'creator' => 'http://example.com/alice',
+          'created' => '2017-09-23T20:21:34Z',
+        }
+      end
+
+      it 'returns nil' do
+        expect(subject.verify_actor!).to be_nil
+      end
+    end
   end
 
   describe '#sign!' do