@evanp/activitypub-bot 0.28.4 → 0.28.6

package/lib/activitypubclient.js

@@ -103,8 +103,26 @@ export class ActivityPubClient {
     if (res.status < 200 || res.status > 299) {
       throw createHttpError(res.status, `Could not fetch ${url}`)
     }
-    const json = await res.json()
-    const obj = await as2.import(json)
+    const contentType = res.headers.get('content-type')
+    const mimeType = contentType?.split(';')[0].trim()
+    if (mimeType !== 'application/json' && !mimeType.endsWith('+json')) {
+      this.#logger.warn({ mimeType, url }, 'Unexpected mime type')
+      throw new Error(`Got unexpected mime type ${mimeType} for URL ${url}`)
+    }
+    let json
+    try {
+      json = await res.json()
+    } catch (err) {
+      this.#logger.warn({ url }, 'Error parsing fetch results')
+      throw err
+    }
+    let obj
+    try {
+      obj = await as2.import(json)
+    } catch (err) {
+      this.#logger.warn({ url, json }, 'Error importing JSON as AS2')
+      throw err
+    }
     const resolved = (URL.parse(url).hash)
       ? this.#resolveObject(obj, url)
       : obj

package/lib/httpsignature.js

@@ -176,11 +176,13 @@ export class HTTPSignature {
   }
 
   #parseSignatureHeader (signature) {
-    const parts = signature.split(',')
+    const parts = signature.match(/\w+="[^"]*"/g)
     const params = {}
     for (const part of parts) {
-      const [key, value] = part.split('=')
-      params[key] = value.replace(/"/g, '')
+      const eq = part.indexOf('=')
+      const key = part.slice(0, eq)
+      const value = part.slice(eq + 2, -1)
+      params[key] = value
     }
     return params
   }

package/lib/httpsignatureauthenticator.js

@@ -19,6 +19,7 @@ export class HTTPSignatureAuthenticator {
       // Just continue
       return next()
     }
+    this.#logger.debug({ signature }, 'Got signed request')
     const date = req.get('Date')
     if (!date) {
       return next(createHttpError(400, 'No date provided'))
@@ -48,6 +49,7 @@ export class HTTPSignatureAuthenticator {
     this.#logger.debug({ originalUrl }, 'original URL')
     try {
       const keyId = this.#signer.keyId(signature)
+      this.#logger.debug({ keyId }, 'Signed with keyId')
       const ok = await this.#remoteKeyStorage.getPublicKey(keyId)
       if (!ok) {
         throw createHttpError(400, 'public key not found')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.28.4",
+  "version": "0.28.6",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",