@evanp/activitypub-bot 0.52.2 → 0.53.1

package/CHANGELOG.md

@@ -9,6 +9,31 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.53.1] - 2026-10-09
+
+### Security
+
+- Update proxy-addr from 2.0.7 to 2.0.8 to address a security vulnerability
+  (Dependabot #284).
+
+## [0.53.0] - 2026-10-08
+
+### Changed
+
+- Upgrade activitypub-webfinger to 0.3.0 and add BotContext tests for forward
+  and reverse discovery with non-ASCII usernames and domains (#282).
+
+### Fixed
+
+- Linkify mentions with non-ASCII usernames and domains or ASCII punctuation
+  in usernames, preserving HTML escaping and URL fragments; add regression
+  tests for Unicode handles and username punctuation (#282).
+- Normalize server origins to support Unicode domains; add regression tests
+  for discovery, actor and collection endpoints, and OKBot replies (#282).
+- Support Unicode local usernames by encoding URL paths and acct: URIs and
+  decoding usernames during URL parsing and WebFinger lookup; return 400 for
+  malformed WebFinger username escapes and add regression tests (#282).
+
 ## [0.52.2] - 2026-10-05
 
 ### Fixed
@@ -1695,7 +1720,9 @@ Hot patch on the `stable` branch.
 - Docker multi-platform build workflow.
 - Dependabot configuration.
 
-[Unreleased]: https://github.com/evanp/activitypub-bot/compare/v0.52.2...HEAD
+[Unreleased]: https://github.com/evanp/activitypub-bot/compare/v0.53.1...HEAD
+[0.53.1]: https://github.com/evanp/activitypub-bot/compare/v0.53.0...v0.53.1
+[0.53.0]: https://github.com/evanp/activitypub-bot/compare/v0.52.2...v0.53.0
 [0.52.2]: https://github.com/evanp/activitypub-bot/compare/v0.52.1...v0.52.2
 [0.52.1]: https://github.com/evanp/activitypub-bot/compare/v0.52.0...v0.52.1
 [0.52.0]: https://github.com/evanp/activitypub-bot/compare/v0.51.4...v0.52.0

package/lib/app.js

@@ -72,6 +72,8 @@ function createWorkers (logger, count, WorkerClass, ...args) {
 }
 
 export async function makeApp ({ databaseUrl, origin, bots, logLevel = 'silent', deliveryWorkerCount = 2, distributionWorkerCount = 8, fanoutWorkerCount = 4, intakeWorkerCount = 2, indexFileName = DEFAULT_INDEX_FILENAME, profileFileName = DEFAULT_PROFILE_FILENAME, allowPrivateNetworkRequests = false, redisUrl, trustProxy, domainBlockFileName }) {
+  // normalize the origin, including Unicode -> punycode
+  origin = (new URL(origin)).origin
   const logger = Logger({
     level: logLevel
   })

package/lib/microsyntax.js

@@ -30,8 +30,8 @@ export class Transformer {
     let html = this.#escape(text)
     let tag = [];
     ({ html, tag } = this.#replaceUrls(html, tag));
-    ({ html, tag } = this.#replaceHashtags(html, tag));
-    ({ html, tag } = await this.#replaceMentions(html, tag))
+    ({ html, tag } = await this.#replaceMentions(html, tag));
+    ({ html, tag } = this.#replaceHashtags(html, tag))
     html = `<p>${html}</p>`
     return { html, tag }
   }
@@ -67,36 +67,19 @@ export class Transformer {
   }
 
   async #replaceMentions (html, tag) {
-    const self = this
-    const webfinger = /@[a-zA-Z0-9_]+([a-zA-Z0-9_.-]+[a-zA-Z0-9_]+)?@[a-zA-Z0-9_.-]+/g
     const segments = this.#segment(html)
     for (const i in segments) {
-      const segment = segments[i]
-      if (this.#isLink(segment)) continue
-      segments[i] = await this.#replaceAsync(segments[i], webfinger, async (match) => {
-        const href = await self.#homePage(match.slice(1))
-        if (!href) return match
-        let url
-        try {
-          url = new URL(href)
-        } catch (err) {
-          return match
-        }
-        if (url.protocol !== 'https:') {
-          return match
-        }
-        tag.push({ type: 'Mention', name: match, href: url.href })
-        const escaped = this.#escape(url.href)
-        const escapedMatch = this.#escape(match)
-        return `<a href="${escaped}">${escapedMatch}</a>`
-      })
+      if (this.#isLink(segments[i])) continue
+      segments[i] = await this.#replaceMention(this.#unescape(segments[i]), tag)
     }
     return { html: segments.join(''), tag }
   }
 
   async #homePage (webfinger) {
     if (!this.#client) return null
-    const [username, domain] = webfinger.split('@')
+    const delimiter = webfinger.lastIndexOf('@')
+    const username = webfinger.slice(0, delimiter)
+    const domain = webfinger.slice(delimiter + 1)
     if (domain.toLowerCase() === this.#formatter.hostname) {
       return this.#formatter.format({ username, type: 'profile' })
     }
@@ -136,18 +119,43 @@ export class Transformer {
     return html.split(/(<[^>]+>[^<]+<\/[^>]+>)/)
   }
 
-  async #replaceAsync (str, regex, asyncFn) {
+  async #transformMention (match, tag) {
+    const escapedMatch = this.#escape(match)
+    const href = await this.#homePage(match.slice(1))
+    if (!href) return escapedMatch
+    let url
+    try {
+      url = new URL(href)
+    } catch (err) {
+      return escapedMatch
+    }
+    if (url.protocol !== 'https:') {
+      return escapedMatch
+    }
+    tag.push({ type: 'Mention', name: match, href: url.href })
+    const escaped = this.#escape(url.href)
+    return `<a href="${escaped}">${escapedMatch}</a>`
+  }
+
+  async #replaceMention (str, tag) {
+    const webfinger = /(@[\x21-\x7E\p{L}\p{Nd}\p{M}]+@[\p{L}\p{Nd}](?:[\p{L}\p{Nd}\p{M}-]*[\p{L}\p{Nd}\p{M}])?(?:\.[\p{L}\p{Nd}](?:[\p{L}\p{Nd}\p{M}-]*[\p{L}\p{Nd}\p{M}])?)*)/ug
+
+    const parts = str.split(webfinger)
+
     const promises = []
-    str.replace(regex, (match, ...args) => {
-      // Add a promise for each match
-      promises.push(asyncFn(match, ...args))
-    })
+
+    for (const i in parts) {
+      promises[i] = (i % 2 === 0)
+        ? new Promise((resolve, reject) => {
+          resolve(this.#escape(parts[i]))
+        })
+        : this.#transformMention(parts[i], tag)
+    }
 
     // Wait for all async replacements to resolve
     const replacements = await Promise.all(promises)
 
-    // Replace the matches with their respective replacements
-    return str.replace(regex, () => replacements.shift())
+    return replacements.join('')
   }
 
   #escape (text) {
@@ -158,4 +166,13 @@ export class Transformer {
       .replace(/"/g, '&quot;')
       .replace(/'/g, '&apos;')
   }
+
+  #unescape (text) {
+    return text
+      .replace(/&lt;/g, '<')
+      .replace(/&gt;/g, '>')
+      .replace(/&quot;/g, '"')
+      .replace(/&apos;/g, '\'')
+      .replace(/&amp;/g, '&')
+  }
 }

package/lib/routes/webfinger.js

@@ -70,15 +70,24 @@ async function httpsWebfinger (resource, req, res, next) {
 }
 
 async function acctWebfinger (resource, req, res, next) {
-  const [username, domain] = resource.substring(5).split('@')
-  if (!username || !domain) {
+  const address = resource.substring(5)
+  const delimiter = address.lastIndexOf('@')
+  if (delimiter <= 0 || delimiter === address.length - 1) {
     return next(new ProblemDetailsError(400, `Invalid resource parameter ${resource}`))
   }
+  const username = address.slice(0, delimiter)
+  const domain = address.slice(delimiter + 1)
   const { host } = new URL(req.app.locals.origin)
   if (domain !== host) {
     return next(new ProblemDetailsError(400, `Invalid domain ${domain} in resource parameter`))
   }
-  return await botWebfinger(username, req, res, next)
+  let decoded
+  try {
+    decoded = decodeURIComponent(username)
+  } catch (err) {
+    return next(new ProblemDetailsError(400, `Invalid percent-encoded username ${username} in resource parameter`))
+  }
+  return await botWebfinger(decoded, req, res, next)
 }
 
 router.get('/.well-known/webfinger', async (req, res, next) => {

package/lib/urlformatter.js

@@ -16,9 +16,9 @@ export class UrlFormatter {
     if (server) {
       return this.format({ username: this.#hostname, type, nanoid, collection, page, server: false })
     } else if (username && type && type === 'profile') {
-      return `${this.#origin}/profile/${username}`
+      return `${this.#origin}/profile/${encodeURIComponent(username)}`
     } else if (username) {
-      base = `${this.#origin}/user/${username}`
+      base = `${this.#origin}/user/${encodeURIComponent(username)}`
     } else {
       throw new Error('Cannot format URL without username or server')
     }
@@ -67,11 +67,11 @@ export class UrlFormatter {
     }
     let pathParts = parsed.pathname.slice(1).split('/')
     if (pathParts.length > 0 && pathParts[0] === 'user') {
-      parts.username = pathParts[1]
+      parts.username = decodeURIComponent(pathParts[1])
       pathParts = pathParts.slice(2)
       parts.server = (parts.username === this.#hostname)
     } else if (pathParts.length > 0 && pathParts[0] === 'profile') {
-      parts.username = pathParts[1]
+      parts.username = decodeURIComponent(pathParts[1])
       parts.type = 'profile'
       return parts
     }
@@ -108,7 +108,7 @@ export class UrlFormatter {
 
   acct (username = null) {
     return (username)
-      ? `acct:${username}@${this.#hostname}`
+      ? `acct:${encodeURIComponent(username)}@${this.#hostname}`
       : `acct:${this.#hostname}@${this.#hostname}`
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.52.2",
+  "version": "0.53.1",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -32,7 +32,7 @@
   "dependencies": {
     "@isaacs/ttlcache": "^2.1.4",
     "@socialwebfoundation/ap-components": "^1.4.2",
-    "activitypub-webfinger": "^0.2.1",
+    "activitypub-webfinger": "^0.3.0",
     "activitystrea.ms": "^4.0.1",
     "csv-parse": "^7.0.0",
     "express": "^5.2.1",

package/.cache/standard/v17/.cache_1b54s7r

@@ -1 +0,0 @@
-[{"/Users/evanp/Documents/Code/activitypub-bot/tests/activitydeliverer.test.js":"1"},{"size":1743,"mtime":1770107423341,"results":"2","hashOfConfig":"3"},{"filePath":"4","messages":"5","suppressedMessages":"6","errorCount":18,"fatalErrorCount":0,"warningCount":0,"fixableErrorCount":0,"fixableWarningCount":0,"source":null},"eeiv40","/Users/evanp/Documents/Code/activitypub-bot/tests/activitydeliverer.test.js",["7","8","9","10","11","12","13","14","15","16","17","18","19","20","21","22","23","24"],[],{"ruleId":"25","severity":2,"message":"26","line":20,"column":14,"nodeType":"27","messageId":"28","endLine":20,"endColumn":20},{"ruleId":"25","severity":2,"message":"29","line":22,"column":5,"nodeType":"27","messageId":"28","endLine":22,"endColumn":15},{"ruleId":"25","severity":2,"message":"29","line":23,"column":11,"nodeType":"27","messageId":"28","endLine":23,"endColumn":21},{"ruleId":"25","severity":2,"message":"30","line":24,"column":11,"nodeType":"27","messageId":"28","endLine":24,"endColumn":24},{"ruleId":"25","severity":2,"message":"29","line":24,"column":25,"nodeType":"27","messageId":"28","endLine":24,"endColumn":35},{"ruleId":"25","severity":2,"message":"31","line":25,"column":24,"nodeType":"27","messageId":"28","endLine":25,"endColumn":36},{"ruleId":"25","severity":2,"message":"29","line":25,"column":37,"nodeType":"27","messageId":"28","endLine":25,"endColumn":47},{"ruleId":"25","severity":2,"message":"32","line":26,"column":5,"nodeType":"27","messageId":"28","endLine":26,"endColumn":18},{"ruleId":"25","severity":2,"message":"29","line":26,"column":39,"nodeType":"27","messageId":"28","endLine":26,"endColumn":49},{"ruleId":"25","severity":2,"message":"33","line":27,"column":5,"nodeType":"27","messageId":"28","endLine":27,"endColumn":15},{"ruleId":"25","severity":2,"message":"29","line":27,"column":33,"nodeType":"27","messageId":"28","endLine":27,"endColumn":43},{"ruleId":"25","severity":2,"message":"34","line":28,"column":24,"nodeType":"27","messageId":"28","endLine":28,"endColumn":37},{"ruleId":"25","severity":2,"message":"35","line":29,"column":26,"nodeType":"27","messageId":"28","endLine":29,"endColumn":34},{"ruleId":"25","severity":2,"message":"33","line":30,"column":36,"nodeType":"27","messageId":"28","endLine":30,"endColumn":46},{"ruleId":"25","severity":2,"message":"32","line":33,"column":7,"nodeType":"27","messageId":"28","endLine":33,"endColumn":20},{"ruleId":"25","severity":2,"message":"36","line":34,"column":7,"nodeType":"27","messageId":"28","endLine":34,"endColumn":18},{"ruleId":"25","severity":2,"message":"37","line":36,"column":7,"nodeType":"27","messageId":"28","endLine":36,"endColumn":12},{"ruleId":"25","severity":2,"message":"38","line":37,"column":7,"nodeType":"27","messageId":"28","endLine":37,"endColumn":12},"no-undef","'Logger' is not defined.","Identifier","undef","'connection' is not defined.","'runMigrations' is not defined.","'ActorStorage' is not defined.","'objectStorage' is not defined.","'keyStorage' is not defined.","'HTTPSignature' is not defined.","'Digester' is not defined.","'distributor' is not defined.","'cache' is not defined.","'authz' is not defined."]

package/.claude/settings.json

@@ -1,25 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(kubectl get *)",
-      "Bash(kubectl top *)",
-      "Read(//private/tmp/heap-snapshots/**)",
-      "Bash(node --max-old-space-size=8192 analyze.mjs snap1-30min-mppzz.heapsnapshot)",
-      "Bash(tee analyze1.out)",
-      "Bash(node --max-old-space-size=8192 fr-owners.mjs snap1-30min-mppzz.heapsnapshot)",
-      "Bash(node --max-old-space-size=8192 fr-trace.mjs snap1-30min-mppzz.heapsnapshot 123343)",
-      "Bash(node --max-old-space-size=10240 diff.mjs snap1-30min-mppzz.heapsnapshot snap2-92min-mppzz.heapsnapshot)",
-      "Bash(tee diff.out)",
-      "Bash(mkdir -p /Users/evanp/Documents/Code/aode-relay-test/relay /Users/evanp/Documents/Code/aode-relay-test/bots && ls /Users/evanp/Documents/Code/aode-relay-test/)",
-      "Bash(docker builder *)",
-      "Bash(docker image *)",
-      "Bash(docker container *)",
-      "Bash(docker run *)"
-    ],
-    "additionalDirectories": [
-      "/tmp/heap-snapshots",
-      "/private/tmp/heap-snapshots",
-      "/Users/evanp/Documents/Code/aode-relay-test"
-    ]
-  }
-}

package/.claude/settings.local.json

@@ -1,10 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(docker compose *)",
-      "Bash(grep -E \"test$|elk|gotosocial|tags\" /etc/hosts 2>&1 | head -20)",
-      "Read(//private/etc/**)",
-      "Bash(kubectl exec *)"
-    ]
-  }
-}

package/.vscode/settings.json

@@ -1,17 +0,0 @@
-{
-  "editor.formatOnSave": false,
-  "editor.formatOnSaveMode": "modificationsIfAvailable",
-  "editor.codeActionsOnSave": {
-    "source.fixAll.eslint": "explicit"
-  },
-  "javascript.format.enable": false,
-  "standard.enable": false,
-  "standard.autoFixOnSave": false,
-  "eslint.format.enable": true,
-  "eslint.validate": [
-    "javascript"
-  ],
-  "[javascript]": {
-    "editor.defaultFormatter": "dbaeumer.vscode-eslint"
-  }
-}

package/.vscode/tasks.json

@@ -1,13 +0,0 @@
-{
-	"version": "2.0.0",
-	"tasks": [
-		{
-			"type": "npm",
-			"script": "test",
-			"group": "test",
-			"problemMatcher": [],
-			"label": "npm: test",
-			"detail": "NODE_ENV=test node --test"
-		}
-	]
-}