RemoteReportPolicy: add reject_third_party option

lib/pleroma/web/activity_pub/mrf/remote_report_policy.ex

@@ -9,6 +9,7 @@ def filter(%{"type" => "Flag"} = object) do
     with {_, false} <- {:local, local?(object)},
          {:ok, _} <- maybe_reject_all(object),
          {:ok, _} <- maybe_reject_anonymous(object),
+         {:ok, _} <- maybe_reject_third_party(object),
          {:ok, _} <- maybe_reject_empty_message(object) do
       {:ok, object}
     else
@@ -37,6 +38,21 @@ defp maybe_reject_anonymous(%{"actor" => actor} = object) do
     end
   end
 
+  defp maybe_reject_third_party(%{"object" => objects} = object) do
+    {_, to} = case objects do
+      [head | tail] when is_binary(head) -> {tail, head}
+      s when is_binary(s) -> {[], s}
+      _ -> {[], ""}
+    end
+
+    with true <- Config.get([:mrf_remote_report, :reject_third_party]),
+         String.starts_with?(to, Pleroma.Web.Endpoint.url()) do
+      {:reject, "[RemoteReportPolicy] Third-party: #{to}"}
+    else
+      _ -> {:ok, object}
+    end
+  end
+
   defp maybe_reject_empty_message(%{"content" => content} = object)
        when is_binary(content) and content != "" do
     {:ok, object}
@@ -83,6 +99,12 @@ def config_description do
           description: "Reject anonymous remote reports?",
           suggestions: [true]
         },
+        %{
+          key: :reject_third_party,
+          type: :boolean,
+          description: "Reject reports on users from third-party instances?",
+          suggestions: [true]
+        },
         %{
           key: :reject_empty_message,
           type: :boolean,

test/pleroma/web/activity_pub/mrf/remote_report_policy_test.exs

@@ -13,7 +13,8 @@ test "doesn't impact local report" do
 
     activity = %{
       "type" => "Flag",
-      "actor" => "http://localhost:4001/actor"
+      "actor" => "http://localhost:4001/actor",
+      "object" => ["https://mastodon.online/users/Gargron"]
     }
 
     assert {:ok, _} = RemoteReportPolicy.filter(activity)
@@ -25,7 +26,8 @@ test "rejects anonymous report if `reject_anonymous: true`" do
 
     activity = %{
       "type" => "Flag",
-      "actor" => "https://mastodon.social/actor"
+      "actor" => "https://mastodon.social/actor",
+      "object" => ["https://mastodon.online/users/Gargron"]
     }
 
     assert {:reject, _} = RemoteReportPolicy.filter(activity)
@@ -37,7 +39,34 @@ test "preserves anonymous report if `reject_anonymous: false`" do
 
     activity = %{
       "type" => "Flag",
-      "actor" => "https://mastodon.social/actor"
+      "actor" => "https://mastodon.social/actor",
+      "object" => ["https://mastodon.online/users/Gargron"]
+    }
+
+    assert {:ok, _} = RemoteReportPolicy.filter(activity)
+  end
+
+  test "rejects report on third-party if `reject_third_party: true`" do
+    clear_config([:mrf_remote_report, :reject_third_party], true)
+    clear_config([:mrf_remote_report, :reject_empty_message], false)
+
+    activity = %{
+      "type" => "Flag",
+      "actor" => "https://mastodon.social/users/Gargron",
+      "object" => ["https://mastodon.online/users/Gargron"]
+    }
+
+    assert {:reject, _} = RemoteReportPolicy.filter(activity)
+  end
+
+  test "preserves report on third party if `reject_third_party: false`" do
+    clear_config([:mrf_remote_report, :reject_third_party], false)
+    clear_config([:mrf_remote_report, :reject_empty_message], false)
+
+    activity = %{
+      "type" => "Flag",
+      "actor" => "https://mastodon.social/users/Gargron",
+      "object" => ["https://mastodon.online/users/Gargron"]
     }
 
     assert {:ok, _} = RemoteReportPolicy.filter(activity)
@@ -49,7 +78,8 @@ test "rejects empty message report if `reject_empty_message: true`" do
 
     activity = %{
       "type" => "Flag",
-      "actor" => "https://mastodon.social/users/Gargron"
+      "actor" => "https://mastodon.social/users/Gargron",
+      "object" => ["https://mastodon.online/users/Gargron"]
     }
 
     assert {:reject, _} = RemoteReportPolicy.filter(activity)
@@ -62,6 +92,7 @@ test "rejects empty message report (\"\") if `reject_empty_message: true`" do
     activity = %{
       "type" => "Flag",
       "actor" => "https://mastodon.social/users/Gargron",
+      "object" => ["https://mastodon.online/users/Gargron"],
       "content" => ""
     }
 
@@ -74,7 +105,8 @@ test "preserves empty message report if `reject_empty_message: false`" do
 
     activity = %{
       "type" => "Flag",
-      "actor" => "https://mastodon.social/users/Gargron"
+      "actor" => "https://mastodon.social/users/Gargron",
+      "object" => ["https://mastodon.online/users/Gargron"]
     }
 
     assert {:ok, _} = RemoteReportPolicy.filter(activity)
@@ -86,7 +118,8 @@ test "preserves anonymous, empty message report with all settings disabled" do
 
     activity = %{
       "type" => "Flag",
-      "actor" => "https://mastodon.social/actor"
+      "actor" => "https://mastodon.social/actor",
+      "object" => ["https://mastodon.online/users/Gargron"]
     }
 
     assert {:ok, _} = RemoteReportPolicy.filter(activity)
@@ -100,7 +133,8 @@ test "reject remote report if `reject_all: true`" do
     activity = %{
       "type" => "Flag",
       "actor" => "https://mastodon.social/users/Gargron",
-      "content" => "Transphobia"
+      "content" => "Transphobia",
+      "object" => ["https://mastodon.online/users/Gargron"]
     }
 
     assert {:reject, _} = RemoteReportPolicy.filter(activity)