Change mentions of blocked users to not be processed (#19725)

Fixes #19698

app/services/process_mentions_service.rb

@@ -66,6 +66,16 @@ class ProcessMentionsService < BaseService
   end
 
   def assign_mentions!
+    # Make sure we never mention blocked accounts
+    unless @current_mentions.empty?
+      mentioned_domains = @current_mentions.map { |m| m.account.domain }.compact.uniq
+      blocked_domains   = Set.new(mentioned_domains.empty? ? [] : AccountDomainBlock.where(account_id: @status.account_id, domain: mentioned_domains))
+      mentioned_account_ids = @current_mentions.map(&:account_id)
+      blocked_account_ids = Set.new(@status.account.block_relationships.where(target_account_id: mentioned_account_ids).pluck(:target_account_id))
+
+      @current_mentions.select! { |mention| !(blocked_account_ids.include?(mention.account_id) || blocked_domains.include?(mention.account.domain)) }
+    end
+
     @current_mentions.each do |mention|
       mention.save if mention.new_record?
     end

spec/services/process_mentions_service_spec.rb

@@ -2,11 +2,38 @@ require 'rails_helper'
 
 RSpec.describe ProcessMentionsService, type: :service do
   let(:account) { Fabricate(:account, username: 'alice') }
-  let(:visibility) { :public }
-  let(:status)     { Fabricate(:status, account: account, text: "Hello @#{remote_user.acct}", visibility: visibility) }
 
   subject { ProcessMentionsService.new }
 
+  context 'when mentions contain blocked accounts' do
+    let(:non_blocked_account)          { Fabricate(:account) }
+    let(:individually_blocked_account) { Fabricate(:account) }
+    let(:domain_blocked_account)       { Fabricate(:account, domain: 'evil.com') }
+    let(:status) { Fabricate(:status, account: account, text: "Hello @#{non_blocked_account.acct} @#{individually_blocked_account.acct} @#{domain_blocked_account.acct}", visibility: :public) }
+
+    before do
+      account.block!(individually_blocked_account)
+      account.domain_blocks.create!(domain: domain_blocked_account.domain)
+
+      subject.call(status)
+    end
+
+    it 'creates a mention to the non-blocked account' do
+      expect(non_blocked_account.mentions.where(status: status).count).to eq 1
+    end
+
+    it 'does not create a mention to the individually blocked account' do
+      expect(individually_blocked_account.mentions.where(status: status).count).to eq 0
+    end
+
+    it 'does not create a mention to the domain-blocked account' do
+      expect(domain_blocked_account.mentions.where(status: status).count).to eq 0
+    end
+  end
+
+  context 'resolving a mention to a remote account' do
+    let(:status) { Fabricate(:status, account: account, text: "Hello @#{remote_user.acct}", visibility: :public) }
+
     context 'ActivityPub' do
       context do
         let!(:remote_user) { Fabricate(:account, username: 'remote_user', protocol: :activitypub, domain: 'example.com', inbox_url: 'http://example.com/inbox') }
@@ -61,3 +88,4 @@ RSpec.describe ProcessMentionsService, type: :service do
       end
     end
   end
+end