Open Johann150 opened 5 months ago
This is an issue with user-uploaded data. Here are some ways to mitigate:
text/plain
as AP, maybe application/json
.I believe this solution requires at least these fixes:
This issue has been mentioned on SocialHub. There might be relevant details there:
https://socialhub.activitypub.rocks/t/fep-0391-special-collection-proofs/4165/4
As a thought after Mastodon's GHSA-jhrq-qvrm-qr36 it might be a good idea to extend the security consideration B.2 with a bit of wording about what kind of user submitted content is meant, and what relevance the
Content-Type
and perhaps Content Type Negotiation has in that context.Especially when reading the 2nd paragraph the focus seems to me to be on ActivityPub Content, perhaps not taking into account that attached files/media may be hosted on the same host(-name).
In particular I'm thinking of wording like this:
And perhaps inserting another paragraph like this at the end of the section: