「ノート内の最大メンション数」が効かなくなっている

[kleuzjatob]

💡 Summary

タイトルの通りです。
大量のスパムがリモートサーバーから投稿されていたのに気付いて確認した折に発覚しました。
（リモート同士ですがリレーサーバーを経由して受信したと思われます）

🥰 Expected Behavior

設定されたロール「ノート内の最大メンション数」に反するノートが投稿できない

🤬 Actual Behavior

「ノート内の最大メンション数」が設定されてもそれを超えるメンションを付けてノートできる

📝 Steps to Reproduce

1. 「ノート内の最大メンション数」を設定したロールを投稿対象のアカウントに付与する（またはベースロールでもおそらく可能）
2. 対象のアカウントで上記上限を超えるメンション数のノートを投稿する

💻 Frontend Environment

* Model and OS of the device(s): -
* Browser: -
* Server URL: gp.tsukimi.club
* Misskey: 2026.5.4

🛰 Backend Environment (for server admin)

* Installation Method or Hosting Service: systemd
* Misskey: 2026.5.4
* Node: 24.11.1
* PostgreSQL: 17.4 (Ubuntu 17.4-1.pgdg20.04+2)
* Redis: 7.4.3
* OS and Architecture: Ubuntu 22.04.5 LTS x86_64

Do you want to address this bug yourself?

• Yes, I will patch the bug myself and send a pull request

[dosubot]

This looks like a real bug. I investigated the code and found the likely root cause.

The mentionLimit check in NoteCreateService.create() validates against successfully resolved mention users, not the raw mention count from the incoming ActivityPub object [1]. When a remote note is received via relay/federation, ApMentionService.extractApMentions() resolves each mention using resolvePerson().catch(() => null) and then filters out nulls [2].

This means if a spam note contains, say, 50 mentions but many of them fail to resolve (due to unreachable servers, deleted accounts, rate limiting, etc.), the mentionedUsers.length that's actually checked against the limit could be significantly lower than the real mention count — allowing the note through.

The flow:

1. Remote spam note arrives with N mentions in its ActivityPub tag array
2. ApMentionService tries to resolve each mention (with concurrency limit of 2)
3. Failed resolutions become null and are filtered out → only M users remain (M < N)
4. mentionLimit check sees M ≤ limit → note is accepted
5. But the stored note text still contains all N @mentions

A potential fix would be to count the raw Mention-type tags in the ActivityPub object before resolution and check that count against the limit, rather than only checking after resolution failures have reduced the count. This would reject spam notes regardless of whether the mentioned accounts are reachable.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.