@fedify/fedify 1.3.2 → 1.3.4

package/esm/webfinger/lookup.js

@@ -2,7 +2,9 @@ import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace, } from "@opentelemetry/api";
 import metadata from "../deno.js";
 import { getUserAgent, } from "../runtime/docloader.js";
+import { validatePublicUrl } from "../runtime/url.js";
 const logger = getLogger(["fedify", "webfinger", "lookup"]);
+const MAX_REDIRECTION = 5; // TODO: Make this configurable.
 /**
  * Looks up a WebFinger resource.
  * @param resource The resource URL to look up.
@@ -60,9 +62,11 @@ async function lookupWebFingerInternal(resource, options = {}) {
     }
     let url = new URL(`${protocol}//${server}/.well-known/webfinger`);
     url.searchParams.set("resource", resource.href);
+    let redirected = 0;
     while (true) {
         logger.debug("Fetching WebFinger resource descriptor from {url}...", { url: url.href });
         let response;
+        await validatePublicUrl(url.href);
         try {
             response = await fetch(url, {
                 headers: {
@@ -80,7 +84,23 @@ async function lookupWebFingerInternal(resource, options = {}) {
         }
         if (response.status >= 300 && response.status < 400 &&
             response.headers.has("Location")) {
-            url = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? url : response.url);
+            redirected++;
+            if (redirected >= MAX_REDIRECTION) {
+                logger.error("Too many redirections ({redirections}) while fetching WebFinger " +
+                    "resource descriptor.", { redirections: redirected });
+                return null;
+            }
+            const redirectedUrl = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? url : response.url);
+            if (redirectedUrl.protocol !== url.protocol) {
+                logger.error("Redirected to a different protocol ({protocol} to " +
+                    "{redirectedProtocol}) while fetching WebFinger resource " +
+                    "descriptor.", {
+                    protocol: url.protocol,
+                    redirectedProtocol: redirectedUrl.protocol,
+                });
+                return null;
+            }
+            url = redirectedUrl;
             continue;
         }
         if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",

package/types/runtime/contexts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contexts.d.ts","sourceRoot":"","sources":["../../src/runtime/contexts.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAikI9C,CAAC;AAEF,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"contexts.d.ts","sourceRoot":"","sources":["../../src/runtime/contexts.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAkmI9C,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/types/runtime/url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/runtime/url.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqClE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CASjE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,WASvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzD"}
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/runtime/url.ts"],"names":[],"mappings":"AAKA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0ClE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CASjE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,WASvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzD"}

package/types/webfinger/lookup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lookup.d.ts","sourceRoot":"","sources":["../../src/webfinger/lookup.ts"],"names":[],"mappings":";AACA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAInD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAAC;IAEzC;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,GAAG,GAAG,MAAM,EACtB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAmCpC"}
+{"version":3,"file":"lookup.d.ts","sourceRoot":"","sources":["../../src/webfinger/lookup.ts"],"names":[],"mappings":";AACA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAMnD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAAC;IAEzC;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,GAAG,GAAG,MAAM,EACtB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAmCpC"}