Fix lax relevancy check in inbound activity processing (#39892)

app/lib/activitypub/activity/create.rb

@@ -15,7 +15,17 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
   private
 
   def create_status
-    return reject_payload! if unsupported_object_type? || non_matching_uri_hosts?(@account.uri, object_uri) || tombstone_exists? || !related_to_local_activity?
+    return reject_payload! if unsupported_object_type? || non_matching_uri_hosts?(@account.uri, object_uri) || tombstone_exists?
+
+    @status_parser = ActivityPub::Parser::StatusParser.new(
+      @json,
+      followers_collection: @account.followers_url,
+      following_collection: @account.following_url,
+      actor_uri: ActivityPub::TagManager.instance.uri_for(@account),
+      object: @object
+    )
+
+    return reject_payload! unless related_to_local_activity?
 
     with_redis_lock("create:#{object_uri}") do
       Status.uncached do
@@ -34,13 +44,7 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
     @status
   end
 
-  def audience_to
-    as_array(@object['to'] || @json['to']).map { |x| value_or_id(x) }
-  end
-
-  def audience_cc
-    as_array(@object['cc'] || @json['cc']).map { |x| value_or_id(x) }
-  end
+  delegate :audience_to, :audience_cc, to: :@status_parser
 
   def process_status
     @tags                 = []
@@ -91,14 +95,6 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
   end
 
   def process_status_params
-    @status_parser = ActivityPub::Parser::StatusParser.new(
-      @json,
-      followers_collection: @account.followers_url,
-      following_collection: @account.following_url,
-      actor_uri: ActivityPub::TagManager.instance.uri_for(@account),
-      object: @object
-    )
-
     attachment_ids = process_attachments.take(Status::MEDIA_ATTACHMENTS_LIMIT).map(&:id)
 
     @params = {
@@ -454,8 +450,16 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
   end
 
   def related_to_local_activity?
-    fetch? || followed_by_local_accounts? || requested_through_relay? ||
-      responds_to_followed_account? || addresses_local_accounts?
+    return true if fetch?
+
+    case @status_parser.visibility
+    when :public, :unlisted
+      followed_by_local_accounts? || requested_through_relay? || responds_to_followed_account? || addresses_local_accounts?
+    when :private
+      followed_by_local_accounts? || addresses_local_accounts?
+    when :direct
+      addresses_local_accounts?
+    end
   end
 
   def responds_to_followed_account?

app/lib/activitypub/parser/status_parser.rb

@@ -166,6 +166,14 @@ class ActivityPub::Parser::StatusParser
     equals_or_includes_any?(@object['type'], ActivityPub::Activity::CONVERTED_TYPES)
   end
 
+  def audience_to
+    as_array(@object['to'] || @json['to']).map { |x| value_or_id(x) }
+  end
+
+  def audience_cc
+    as_array(@object['cc'] || @json['cc']).map { |x| value_or_id(x) }
+  end
+
   private
 
   def quote_subpolicy(subpolicy)
@@ -197,14 +205,6 @@ class ActivityPub::Parser::StatusParser
     end
   end
 
-  def audience_to
-    as_array(@object['to'] || @json['to']).map { |x| value_or_id(x) }
-  end
-
-  def audience_cc
-    as_array(@object['cc'] || @json['cc']).map { |x| value_or_id(x) }
-  end
-
   def summary_language_map?
     @object['summaryMap'].is_a?(Hash) && !@object['summaryMap'].empty?
   end

spec/lib/activitypub/activity/create_spec.rb

@@ -1284,7 +1284,7 @@ RSpec.describe ActivityPub::Activity::Create do
         subject.perform
       end
 
-      let(:object_json) { build_object }
+      let(:object_json) { build_object(to: 'http://example.com/followers') }
 
       it 'creates status' do
         status = sender.statuses.first
@@ -1300,7 +1300,8 @@ RSpec.describe ActivityPub::Activity::Create do
       let!(:local_status) { Fabricate(:status) }
       let(:object_json) do
         build_object(
-          inReplyTo: ActivityPub::TagManager.instance.uri_for(local_status)
+          inReplyTo: ActivityPub::TagManager.instance.uri_for(local_status),
+          cc: 'https://www.w3.org/ns/activitystreams#Public'
         )
       end