From 6bb81d96574acac4e2a1453173bdccd8df4e89dd Mon Sep 17 00:00:00 2001
From: Jeremy Dormitzer <jeremy.dormitzer@gmail.com>
Date: Sun, 14 Apr 2019 12:55:01 -0400
Subject: [PATCH] Limit recursive collection unpacking

---
 src/ActivityEventHandlers/DeliveryHandler.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/ActivityEventHandlers/DeliveryHandler.php b/src/ActivityEventHandlers/DeliveryHandler.php
index c7cad53..08daedb 100644
--- a/src/ActivityEventHandlers/DeliveryHandler.php
+++ b/src/ActivityEventHandlers/DeliveryHandler.php
@@ -138,10 +138,14 @@ class DeliveryHandler implements EventSubscriberInterface
     /**
      * Given an ActivityPubObject to deliver to, returns an array of inbox URLs
      * @param ActivityPubObject $recipient
+     * @param int $depth The depth to which we will unpack nested collection references
      * @return array
      */
-    private function resolveRecipient( ActivityPubObject $recipient )
+    private function resolveRecipient( ActivityPubObject $recipient, $depth = 5 )
     {
+        if ( $depth < 0 ) {
+            return array();
+        }
         if ( $recipient && $recipient->hasField( 'inbox' ) ) {
             $inbox = $recipient['inbox'];
             if ( $inbox instanceof ActivityPubObject && $inbox->hasField( 'id' ) ) {
@@ -158,7 +162,7 @@ class DeliveryHandler implements EventSubscriberInterface
             $inboxes = array();
             foreach ( CollectionIterator::iterateCollection( $recipient ) as $item ) {
                 if ( $item instanceof ActivityPubObject ) {
-                    $inboxes = array_unique( array_merge( $inboxes, $this->resolveRecipient( $item ) ) );
+                    $inboxes = array_unique( array_merge( $inboxes, $this->resolveRecipient( $item, $depth - 1 ) ) );
                 }
             }
             return $inboxes;