commit 662ec9733f1620bf3657cc08bf574d45f7ca1de9
from: Oliver Lowe <o@olowe.co>
date: Thu Mar 14 23:27:55 2024 UTC

apub: guard against content we cannot unmarshal activity from

Yet! Decoding shouldn't be too hard. But for now it's a TODO.
At least error out so we don't send out crazy messages.

commit - b0c99ab8bd8266f1b53a47220d7b9c3c81d4fbec
commit + 662ec9733f1620bf3657cc08bf574d45f7ca1de9
blob - 987fe41861005415060cbedec17837b1a16591b5
blob + 4948c36d47177385965204af8e12e103b013082e
--- mail.go
+++ mail.go
@@ -76,6 +76,15 @@ func MarshalMail(activity *Activity) ([]byte, error) {
 }
 
 func UnmarshalMail(msg *mail.Message) (*Activity, error) {
+	ct := msg.Header.Get("Content-Type")
+	if strings.HasPrefix(ct, "multipart") {
+		return nil, fmt.Errorf("cannot unmarshal from multipart message")
+	}
+	enc := msg.Header.Get("Content-Transfer-Encoding")
+	if enc == "quoted-printable" {
+		return nil, fmt.Errorf("cannot decode message with transfer encoding: %s", enc)
+	}
+
 	date, err := msg.Header.Date()
 	if err != nil {
 		return nil, fmt.Errorf("parse message date: %w", err)