Require signed digest when verifying signatures

src/config.rs

@@ -174,11 +174,17 @@ impl<T: Clone> FederationConfig<T> {
     /// Returns true if the url refers to this instance. Handles hostnames like `localhost:8540` for
     /// local debugging.
     pub(crate) fn is_local_url(&self, url: &Url) -> bool {
-        let mut domain = url.host_str().expect("id has domain").to_string();
+        match url.host_str() {
-        if let Some(port) = url.port() {
+            Some(domain) => {
-            domain = format!("{}:{}", domain, port);
+                let domain = if let Some(port) = url.port() {
+                    format!("{}:{}", domain, port)
+                } else {
+                    domain.to_string()
+                };
+                domain == self.domain
+            }
+            None => false,
         }
-        domain == self.domain
     }
 
     /// Returns the local domain
@@ -355,13 +361,17 @@ mod test {
             .await
             .unwrap()
     }
+
     #[tokio::test]
     async fn test_url_is_local() -> Result<(), Error> {
         let config = config().await;
         assert!(config.is_local_url(&Url::parse("http://example.com")?));
         assert!(!config.is_local_url(&Url::parse("http://other.com")?));
+        // ensure that missing domain doesnt cause crash
+        assert!(!config.is_local_url(&Url::parse("http://127.0.0.1")?));
         Ok(())
     }
+
     #[tokio::test]
     async fn test_get_domain() {
         let config = config().await;

src/http_signatures.rs

@@ -189,8 +189,11 @@ fn verify_signature_inner(
     uri: &Uri,
     public_key: &str,
 ) -> Result<(), Error> {
-    static CONFIG: Lazy<http_signature_normalization::Config> =
+    static CONFIG: Lazy<http_signature_normalization::Config> = Lazy::new(|| {
-        Lazy::new(|| http_signature_normalization::Config::new().set_expiration(EXPIRES_AFTER));
+        http_signature_normalization::Config::new()
+            .set_expiration(EXPIRES_AFTER)
+            .require_digest()
+    });
 
     let path_and_query = uri.path_and_query().map(PathAndQuery::as_str).unwrap_or("");