@fedify/fedify 0.12.0-dev.268 → 0.12.0-dev.273

package/CHANGES.md

@@ -54,6 +54,15 @@ To be released.
  -  The last parameter of `Federation.sendActivity()` method is no longer
     optional.  Also, it now takes the required `contextData` option.
 
+ -  Fixed a SSRF vulnerability in the built-in document loader.
+    [[CVE-2024-39687]]
+
+     -  The `fetchDocumentLoader()` function now throws an error when the given
+        URL is not an HTTP or HTTPS URL or refers to a private network address.
+     -  The `getAuthenticatedDocumentLoader()` function now returns a document
+        loader that throws an error when the given URL is not an HTTP or HTTPS
+        URL or refers to a private network address.
+
  -  Added more log messages using the [LogTape] library.  Currently the below
     logger categories are used:
 
@@ -65,6 +74,21 @@ To be released.
 [#85]: https://github.com/dahlia/fedify/issues/85
 
 
+Version 0.11.1
+--------------
+
+Released on July 5, 2024.
+
+ -  Fixed a SSRF vulnerability in the built-in document loader.
+    [[CVE-2024-39687]]
+
+     -  The `fetchDocumentLoader()` function now throws an error when the given
+        URL is not an HTTP or HTTPS URL or refers to a private network address.
+     -  The `getAuthenticatedDocumentLoader()` function now returns a document
+        loader that throws an error when the given URL is not an HTTP or HTTPS
+        URL or refers to a private network address.
+
+
 Version 0.11.0
 --------------
 
@@ -248,6 +272,21 @@ Released on June 29, 2024.
 [#80]: https://github.com/dahlia/fedify/pull/80
 
 
+Version 0.10.1
+--------------
+
+Released on July 5, 2024.
+
+ -  Fixed a SSRF vulnerability in the built-in document loader.
+    [[CVE-2024-39687]]
+
+     -  The `fetchDocumentLoader()` function now throws an error when the given
+        URL is not an HTTP or HTTPS URL or refers to a private network address.
+     -  The `getAuthenticatedDocumentLoader()` function now returns a document
+        loader that throws an error when the given URL is not an HTTP or HTTPS
+        URL or refers to a private network address.
+
+
 Version 0.10.0
 --------------
 
@@ -409,6 +448,23 @@ is now distributed under the [MIT License] to encourage wider adoption.
 [x-forwarded-fetch]: https://github.com/dahlia/x-forwarded-fetch
 
 
+Version 0.9.2
+-------------
+
+Released on July 5, 2024.
+
+ -  Fixed a SSRF vulnerability in the built-in document loader.
+    [[CVE-2024-39687]]
+
+     -  The `fetchDocumentLoader()` function now throws an error when the given
+        URL is not an HTTP or HTTPS URL or refers to a private network address.
+     -  The `getAuthenticatedDocumentLoader()` function now returns a document
+        loader that throws an error when the given URL is not an HTTP or HTTPS
+        URL or refers to a private network address.
+
+[CVE-2024-39687]: https://github.com/dahlia/fedify/security/advisories/GHSA-p9cg-vqcc-grcx
+
+
 Version 0.9.1
 -------------
 

package/esm/runtime/docloader.js

@@ -3,6 +3,7 @@ import { getLogger } from "@logtape/logtape";
 import { signRequest } from "../sig/http.js";
 import { validateCryptoKey } from "../sig/key.js";
 import preloadedContexts from "./contexts.js";
+import { validatePublicUrl } from "./url.js";
 const logger = getLogger(["fedify", "runtime", "docloader"]);
 /**
  * Error thrown when fetching a JSON-LD document failed.
@@ -82,6 +83,7 @@ export async function fetchDocumentLoader(url) {
             documentUrl: url,
         };
     }
+    await validatePublicUrl(url);
     const request = createRequest(url);
     logRequest(request);
     const response = await fetch(request, {
@@ -110,6 +112,7 @@ export async function fetchDocumentLoader(url) {
 export function getAuthenticatedDocumentLoader(identity) {
     validateCryptoKey(identity.privateKey);
     async function load(url) {
+        await validatePublicUrl(url);
         let request = createRequest(url);
         request = await signRequest(request, identity.privateKey, identity.keyId);
         logRequest(request);

package/esm/runtime/url.js

@@ -0,0 +1,75 @@
+import * as dntShim from "../_dnt.shims.js";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+export class UrlError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UrlError";
+    }
+}
+/**
+ * Validates a URL to prevent SSRF attacks.
+ */
+export async function validatePublicUrl(url) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+    }
+    let hostname = parsed.hostname;
+    if (hostname.startsWith("[") && hostname.endsWith("]")) {
+        hostname = hostname.substring(1, hostname.length - 2);
+    }
+    if (hostname === "localhost") {
+        throw new UrlError("Localhost is not allowed");
+    }
+    if ("Deno" in dntShim.dntGlobalThis && !isIP(hostname)) {
+        // If the `net` permission is not granted, we can't resolve the hostname.
+        // However, we can safely assume that it cannot gain access to private
+        // resources.
+        const netPermission = await dntShim.Deno.permissions.query({ name: "net" });
+        if (netPermission.state !== "granted")
+            return;
+    }
+    const { address, family } = await lookup(hostname);
+    if (family === 4 && !isValidPublicIPv4Address(address) ||
+        family === 6 && !isValidPublicIPv6Address(address) ||
+        family < 4 || family === 5 || family > 6) {
+        throw new UrlError(`Invalid or private address: ${address}`);
+    }
+}
+export function isValidPublicIPv4Address(address) {
+    const parts = address.split(".");
+    const first = parseInt(parts[0]);
+    if (first === 0 || first === 10 || first === 127)
+        return false;
+    const second = parseInt(parts[1]);
+    if (first === 169 && second === 254)
+        return false;
+    if (first === 172 && second >= 16 && second <= 31)
+        return false;
+    if (first === 192 && second === 168)
+        return false;
+    return true;
+}
+export function isValidPublicIPv6Address(address) {
+    address = expandIPv6Address(address);
+    if (address.at(4) !== ":")
+        return false;
+    const firstWord = parseInt(address.substring(0, 4), 16);
+    return !((firstWord >= 0xfc00 && firstWord <= 0xfdff) || // ULA
+        (firstWord >= 0xfe80 && firstWord <= 0xfebf) || // Link-local
+        firstWord === 0 || firstWord >= 0xff00 // Multicast
+    );
+}
+export function expandIPv6Address(address) {
+    address = address.toLowerCase();
+    if (address === "::")
+        return "0000:0000:0000:0000:0000:0000:0000:0000";
+    if (address.startsWith("::"))
+        address = "0000" + address;
+    if (address.endsWith("::"))
+        address = address + "0000";
+    address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
+    const parts = address.split(":");
+    return parts.map((part) => part.padStart(4, "0")).join(":");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "0.12.0-dev.268+99d302f3",
+  "version": "0.12.0-dev.273+75036491",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",

package/types/runtime/docloader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docloader.d.ts","sourceRoot":"","sources":["../../src/runtime/docloader.ts"],"names":[],"mappings":";AAAA,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAE5C,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAO1D;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,MAAM,kCAAkC,GAAG,CAC/C,QAAQ,EAAE;IAAE,KAAK,EAAE,GAAG,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAA;CAAE,KACpD,cAAc,CAAC;AAEpB;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC;;OAEG;IACH,GAAG,EAAE,GAAG,CAAC;IAET;;;;;OAKG;gBACS,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAKhD;AAwDD;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,cAAc,CAAC,CAyBzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE;IAAE,KAAK,EAAE,GAAG,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAA;CAAE,GACtD,cAAc,CAsBhB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,MAAM,EAAE,cAAc,CAAC;IAEvB;;OAEG;IACH,EAAE,EAAE,OAAO,CAAC;IAEZ;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;IAEf;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;CAC1E;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,iBAAiB,GAC/C,cAAc,CA2ChB"}
+{"version":3,"file":"docloader.d.ts","sourceRoot":"","sources":["../../src/runtime/docloader.ts"],"names":[],"mappings":";AAAA,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAE5C,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAQ1D;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,MAAM,kCAAkC,GAAG,CAC/C,QAAQ,EAAE;IAAE,KAAK,EAAE,GAAG,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAA;CAAE,KACpD,cAAc,CAAC;AAEpB;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC;;OAEG;IACH,GAAG,EAAE,GAAG,CAAC;IAET;;;;;OAKG;gBACS,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAKhD;AAwDD;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,cAAc,CAAC,CA0BzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE;IAAE,KAAK,EAAE,GAAG,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAA;CAAE,GACtD,cAAc,CAuBhB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,MAAM,EAAE,cAAc,CAAC;IAEvB;;OAEG;IACH,EAAE,EAAE,OAAO,CAAC;IAEZ;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;IAEf;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;CAC1E;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,iBAAiB,GAC/C,cAAc,CA2ChB"}

package/types/runtime/url.d.ts

@@ -0,0 +1,11 @@
+export declare class UrlError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validates a URL to prevent SSRF attacks.
+ */
+export declare function validatePublicUrl(url: string): Promise<void>;
+export declare function isValidPublicIPv4Address(address: string): boolean;
+export declare function isValidPublicIPv6Address(address: string): boolean;
+export declare function expandIPv6Address(address: string): string;
+//# sourceMappingURL=url.d.ts.map

package/types/runtime/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/runtime/url.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BlE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CASjE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,WASvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzD"}

package/types/runtime/url.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.test.d.ts","sourceRoot":"","sources":["../../src/runtime/url.test.ts"],"names":[],"mappings":"AAAA,OAAO,2BAA2B,CAAC"}