mirror of https://github.com/pixelfed/pixelfed
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
RemoteAuthService::getVerifyCredentials, getFollowing and getToken made outbound HTTP requests to a user-controlled remote instance during the Mastodon login flow with no timeout, no retry and no exception handling. A slow or hostile instance could hang the request or surface an uncaught exception. Wrap all three in timeout(20)->retry(3, 750) with try/catch that returns false on failure, matching the existing pattern in isDomainCompatible(). Callers already treat a falsy return as a failure; add the missing guard at the one verify_credentials call site that accessed the result array without checking it first. Adds RemoteAuthServiceTest covering connection failure, server error and success paths. |
4 weeks ago | |
|---|---|---|
| .. | ||
| Controllers | 4 weeks ago | |
| Middleware | 4 weeks ago | |
| Requests | 4 weeks ago | |
| Resources | 4 weeks ago | |