@fedify/fedify 0.9.2 → 0.9.3

package/CHANGES.md

@@ -3,6 +3,21 @@
 Fedify changelog
 ================
 
+Version 0.9.3
+-------------
+
+Released on July 9, 2024.
+
+ -  Fixed a vulnerability of SSRF via DNS rebinding in the built-in document
+    loader.  [[CVE-2024-39687]]
+
+     -  The `fetchDocumentLoader()` function now throws an error when the given
+        domain name has any records referring to a private network address.
+     -  The `getAuthenticatedDocumentLoader()` function now returns a document
+        loader that throws an error when the given domain name has any records
+        referring to a private network address.
+
+
 Version 0.9.2
 -------------
 

package/esm/runtime/url.js

@@ -30,11 +30,15 @@ export async function validatePublicUrl(url) {
         if (netPermission.state !== "granted")
             return;
     }
-    const { address, family } = await lookup(hostname);
-    if (family === 4 && !isValidPublicIPv4Address(address) ||
-        family === 6 && !isValidPublicIPv6Address(address) ||
-        family < 4 || family === 5 || family > 6) {
-        throw new UrlError(`Invalid or private address: ${address}`);
+    // To prevent SSRF via DNS rebinding, we need to resolve all IP addresses
+    // and ensure that they are all public:
+    const addresses = await lookup(hostname, { all: true });
+    for (const { address, family } of addresses) {
+        if (family === 4 && !isValidPublicIPv4Address(address) ||
+            family === 6 && !isValidPublicIPv6Address(address) ||
+            family < 4 || family === 5 || family > 6) {
+            throw new UrlError(`Invalid or private address: ${address}`);
+        }
     }
 }
 export function isValidPublicIPv4Address(address) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",

package/types/runtime/url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/runtime/url.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BlE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CASjE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,WASvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzD"}
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/runtime/url.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BlE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CASjE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,WASvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzD"}