Post #2723418

@p@fsebugoutzone.org @relaystalker@mt.watamelon.win @Wiz@tsundere.love @mischievoustomato@tsundere.love Not a Rust programmer so I just used Claude to get the following: When Mitra receives a federated post containing remote media (images, videos, etc.), it doesn't serve those remote URLs directly to clients. Instead, it rewrites them to local proxy URLs that go through its own /api/media_proxy/ endpoint. This keeps client IP addresses private and allows Mitra to enforce content-type and size policies. Configuration >mitra_config/src/config.rs exposes a media_proxy_enabled flag (default: true). The server checks this at startup in mitra_api/src/server.rs line 55 and only registers the proxy routes when it's enabled. URL Rewriting (at serialization time) The rewriting happens inside ClientMediaServer in mitra_api/src/mastodon_api/media_server.rs. Its url_for() method is called whenever an attachment is serialized into an API response. For local files it returns a direct filesystem-backed URL. For remote links it generates a signed proxy URL: >The remote URL is hex-encoded. >An Ed25519 signature is created over the URL bytes using the instance's secret key. >The signature is hex-encoded. >The final URL is: {instance_base}/api/media_proxy/{hex_encoded_url}?signature={hex_signature} >This rewriting is transparent to API consumers. The attachment serialization in mitra_api/src/mastodon_api/media/types.rs line 71 calls media_server.url_for() for every attachment, and status responses in mitra_api/src/mastodon_api/statuses/types.rs line 188 use this path. The Proxy Endpoint >Route: GET /api/media_proxy/{url_encoded}?signature={signature} >Handler: mitra_api/src/mastodon_api/media_proxy/views.rs line 26 When a client fetches a proxy URL, the handler: >Verifies the Ed25519 signature against the encoded URL bytes using the same instance key. If the signature is invalid, it rejects the request. This prevents clients from crafting arbitrary proxy URLs to fetch anything. >Calls stream_media() from apx_sdk (apx_sdk/src/fetch.rs line 349) with the decoded remote URL. >Streams the response back to the client with the correct Content-Type header. The Fetch Layer (stream_media) apx_sdk/src/fetch.rs line 349 handles the actual HTTP fetch. It follows redirects, validates the Content-Type against the configured allowed media types, enforces file_size_limit (default 20 MB from mitra_config/src/limits.rs line 68), and returns a stream rather than buffering the response in memory. Storage Model Remote media URLs are stored as PartialMediaInfo::Link { url, media_type } in mitra_models/src/media/types.rs. The URL stored is the original remote URL. Proxy URL generation only happens at serialization time, not in the database. Security Design Clients can't proxy arbitrary URLs because each proxy URL carries an Ed25519 signature produced by the instance's own key. Only Mitra itself can produce valid proxy URLs, so the endpoint can't be abused as an open proxy by external clients. Large file DoS is prevented by file_size_limit enforced in stream_media. Malicious content types are blocked by an allowlist validated before streaming begins. Memory pressure is avoided because responses are fully streamed, not buffered.