Repository navigation
fix(security): フォロワー限定・ダイレクト投稿の公開範囲を全取得経路で適用 - #294
Merged
Merged
Conversation
…ed notes Followers-only and specified (DM) notes were readable by anyone through several endpoints. Introduce Misskey-compatible visibility rules and apply them everywhere notes are returned. - Add lib/noteVisibility.ts (canViewNote, isNoteVisibleTo, isPubliclyVisible) - Add optional TimelineOptions.visibleTo filter to INoteRepository, implemented in pg, mysql and sqlite repositories (EXISTS on follows, mentions match, reply-target author) - /api/notes/show, /user-notes, /replies: viewer-aware filtering (404 / empty) - Home, social and list timelines: filter non-visible notes (list membership does not imply following); hydrated reply/renote targets are filtered too - /api/mentions: apply viewer filter - AP /notes/:id and outbox: serve only public/home, non-local-only notes with correct addressing for home (unlisted) - oEmbed and reaction endpoints: hide non-public / non-visible notes - Reject replies to invisible notes and renotes of others' non-public notes - Stream pushes no longer embed non-public reply/renote targets; list notifications skip owners who cannot see the note - Tests: unit tests for visibility rules, route-level tests, sqlite integration tests for the repository filter Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 19 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Oct 14, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
変更
lib/noteVisibility.ts(新規):canViewNote/isNoteVisibleTo(Misskey 互換: public/home は誰でも、followers は作者・フォロワー・メンション先・リプライ先作者、specified は作者と宛先)INoteRepositoryに任意のvisibleTo: { viewerId }を追加し、pg / mysql / sqlite のgetTimeline/getSocialTimeline/findByUserId/findReplies/findRenotes/findMentionsAndRepliesで適用(フォロー判定は相関 EXISTS)NoteService:findById/ ユーザータイムライン / リプライに閲覧者を適用、埋め込みのリプライ先・リノート先も閲覧者でフィルタ、見えないノートへのリプライと他人の非公開ノートのリノートを拒否、ストリーミングとリスト通知でも非公開ノートを流さない/api/notes/show・user-notes・replies・timeline・social-timeline、リストタイムライン、/api/mentions、AP/notes/:id・outbox(public/home かつ非ローカル限定のみ、宛先も修正)、oEmbed、リアクション系挙動の変化
確認
findByUserId/findReplies/getTimeline/getSocialTimeline/findMentionsAndRepliesの結果が期待通りであることを確認https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv