Validate object data for incoming Update activities

In Create validator we do not validate the object data,
but that is because the object itself will go through the
pipeline again, which is not the case for Update. Thus,
we added validation for objects in Update activities.

1 files changed, 5 insertions, 2 deletions

diff --git a/lib/pleroma/web/activity_pub/object_validator.ex b/lib/pleroma/web/activity_pub/object_validator.ex
index 12278a46b..3ccb4a3d6 100644
--- a/lib/pleroma/web/activity_pub/object_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validator.ex
@@ -152,8 +152,8 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
       )
       when objtype in ~w[Question Answer Audio Video Event Article Note Page] do
     with {_, false} <- {:local, Access.get(meta, :local, false)},
-         {:ok, object_data} <- cast_and_apply(object),
-         meta = Keyword.put(meta, :object_data, object_data |> stringify_keys),
+         {_, {:ok, object_data, _}} <- {:object_validation, validate(object, meta)},
+         meta = Keyword.put(meta, :object_data, object_data),
          {:ok, update_activity} <-
            update_activity
            |> UpdateValidator.cast_and_validate()
@@ -169,6 +169,9 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
           object = stringify_keys(object)
           {:ok, object, meta}
         end
+
+      {:object_validation, e} ->
+        e
     end
   end