Ensure the request path have enough parts.

activitypub.c

@@ -3884,6 +3884,10 @@ int activitypub_get_handler(const xs_dict *req, const char *q_path,
         return 0;
 
     xs *l = xs_split_n(q_path, "/", 2);
+
+    if (xs_list_len(l) <= 1)
+        return HTTP_STATUS_BAD_REQUEST;
+
     const char *uid;
     const char *p_path;
 
@@ -4071,6 +4075,9 @@ int activitypub_post_handler(const xs_dict *req, const char *q_path,
     /* get the user and path */
     xs *l = xs_split_n(q_path, "/", 2);
 
+    if (xs_list_len(l) <= 1)
+        return HTTP_STATUS_BAD_REQUEST;
+
     if (xs_list_len(l) == 2 && strcmp(xs_list_get(l, 1), "shared-inbox") == 0) {
         enqueue_shared_input(msg, req, 0);
         return HTTP_STATUS_ACCEPTED;