activitypub: fix possibility of spoofing by containing remote objects to the same domain as their actor

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -747,6 +747,7 @@ def fetch_object_from_id(id) do
              "actor" => data["attributedTo"],
              "object" => data
            },
+           :ok <- Transmogrifier.contain_origin(id, params),
            {:ok, activity} <- Transmogrifier.handle_incoming(params) do
         {:ok, Object.normalize(activity.data["object"])}
       else

lib/pleroma/web/activity_pub/transmogrifier.ex

@@ -30,6 +30,20 @@ def get_actor(%{"actor" => actor}) when is_map(actor) do
     actor["id"]
   end
 
+  @doc """
+  Checks that an imported AP object's actor matches the domain it came from.
+  """
+  def contain_origin(id, %{"actor" => actor}) do
+    id_uri = URI.parse(id)
+    actor_uri = URI.parse(actor)
+
+    if id_uri.host == actor_uri.host do
+      :ok
+    else
+      :error
+    end
+  end
+
   @doc """
   Modifies an incoming AP object (mastodon format) to our internal format.
   """