From d8e613a35ca652c7684f5210a184bf92919d6bdd Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Fri, 28 Aug 2026 16:15:59 +0200
Subject: [PATCH] Fix GHSA-vgm8-frgh-rh2v

---
 app/helpers/json_ld_helper.rb                 | 24 +++++++++++++++++++
 .../activitypub/process_collection_service.rb |  8 +++----
 lib/exceptions.rb                             |  1 +
 3 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/app/helpers/json_ld_helper.rb b/app/helpers/json_ld_helper.rb
index 03809a166c2..ad765e7e1a7 100644
--- a/app/helpers/json_ld_helper.rb
+++ b/app/helpers/json_ld_helper.rb
@@ -112,6 +112,30 @@ module JsonLdHelper
     compacted
   end
 
+  # Checks for unsupported JSON-LD features or too many nodes
+  def check_jsonld_limits!(json, budget = 1_000)
+    budget -= 1
+
+    if json.is_a?(Hash)
+      json.each do |key, value|
+        raise Mastodon::InvalidJsonLdError, 'contains unsupported JSON-LD features' if UNSUPPORTED_JSONLD_KEYWORDS.include?(key)
+        raise Mastodon::InvalidJsonLdError, 'has too many nodes' if budget < 1
+
+        budget = check_jsonld_limits!(value, budget)
+      end
+    elsif json.is_a?(Array)
+      json.each do |value|
+        raise Mastodon::InvalidJsonLdError, 'has too many nodes' if budget < 1
+
+        budget = check_jsonld_limits!(value, budget)
+      end
+    end
+
+    raise Mastodon::InvalidJsonLdError, 'has too many nodes' if budget < 0 # rubocop:disable Style/NumericPredicate
+
+    budget
+  end
+
   def unsupported_jsonld_features?(json)
     if json.is_a?(Hash)
       json.any? { |key, value| UNSUPPORTED_JSONLD_KEYWORDS.include?(key) || unsupported_jsonld_features?(value) }
diff --git a/app/services/activitypub/process_collection_service.rb b/app/services/activitypub/process_collection_service.rb
index 4a25b583dba..008c6fee75b 100644
--- a/app/services/activitypub/process_collection_service.rb
+++ b/app/services/activitypub/process_collection_service.rb
@@ -13,10 +13,10 @@ class ActivityPub::ProcessCollectionService < BaseService
 
     begin
       @json = compact(@json) if @json['signature'].is_a?(Hash)
-      if unsupported_jsonld_features?(@json)
-        Rails.logger.debug { "JSON-LD document for #{value_or_id(@json['actor'])} contains unsupported JSON-LD features" }
-        @json = original_json.without('signature')
-      end
+      check_jsonld_limits!(@json)
+    rescue Mastodon::InvalidJsonLdError => e
+      Rails.logger.debug { "JSON-LD handling for document from #{value_or_id(@json['actor'])} skipped: #{e.message}" }
+      @json = original_json.without('signature')
     rescue JSON::LD::JsonLdError => e
       Rails.logger.debug { "Error when compacting JSON-LD document for #{value_or_id(@json['actor'])}: #{e.message}" }
       @json = original_json.without('signature')
diff --git a/lib/exceptions.rb b/lib/exceptions.rb
index 18a99ace2a4..f938306cb12 100644
--- a/lib/exceptions.rb
+++ b/lib/exceptions.rb
@@ -15,6 +15,7 @@ module Mastodon
   class SignatureVerificationError < Error; end
   class MalformedHeaderError < Error; end
   class RecursionLimitExceededError < Error; end
+  class InvalidJsonLdError < Error; end
 
   class UnexpectedResponseError < Error
     attr_reader :response