Fix GHSA-vgm8-frgh-rh2v

app/helpers/json_ld_helper.rb

@@ -112,6 +112,30 @@ module JsonLdHelper
     compacted
   end
 
+  # Checks for unsupported JSON-LD features or too many nodes
+  def check_jsonld_limits!(json, budget = 1_000)
+    budget -= 1
+
+    if json.is_a?(Hash)
+      json.each do |key, value|
+        raise Mastodon::InvalidJsonLdError, 'contains unsupported JSON-LD features' if UNSUPPORTED_JSONLD_KEYWORDS.include?(key)
+        raise Mastodon::InvalidJsonLdError, 'has too many nodes' if budget < 1
+
+        budget = check_jsonld_limits!(value, budget)
+      end
+    elsif json.is_a?(Array)
+      json.each do |value|
+        raise Mastodon::InvalidJsonLdError, 'has too many nodes' if budget < 1
+
+        budget = check_jsonld_limits!(value, budget)
+      end
+    end
+
+    raise Mastodon::InvalidJsonLdError, 'has too many nodes' if budget < 0 # rubocop:disable Style/NumericPredicate
+
+    budget
+  end
+
   def unsupported_jsonld_features?(json)
     if json.is_a?(Hash)
       json.any? { |key, value| UNSUPPORTED_JSONLD_KEYWORDS.include?(key) || unsupported_jsonld_features?(value) }

app/services/activitypub/process_collection_service.rb

@@ -13,10 +13,10 @@ class ActivityPub::ProcessCollectionService < BaseService
 
     begin
       @json = compact(@json) if @json['signature'].is_a?(Hash)
-      if unsupported_jsonld_features?(@json)
-        Rails.logger.debug { "JSON-LD document for #{value_or_id(@json['actor'])} contains unsupported JSON-LD features" }
-        @json = original_json.without('signature')
-      end
+      check_jsonld_limits!(@json)
+    rescue Mastodon::InvalidJsonLdError => e
+      Rails.logger.debug { "JSON-LD handling for document from #{value_or_id(@json['actor'])} skipped: #{e.message}" }
+      @json = original_json.without('signature')
     rescue JSON::LD::JsonLdError => e
       Rails.logger.debug { "Error when compacting JSON-LD document for #{value_or_id(@json['actor'])}: #{e.message}" }
       @json = original_json.without('signature')

lib/exceptions.rb

@@ -15,6 +15,7 @@ module Mastodon
   class SignatureVerificationError < Error; end
   class MalformedHeaderError < Error; end
   class RecursionLimitExceededError < Error; end
+  class InvalidJsonLdError < Error; end
 
   class UnexpectedResponseError < Error
     attr_reader :response