@fedify/fedify 2.3.12 → 2.3.14

package/dist/federation/middleware.test.mjs

@@ -3,23 +3,23 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-vrlUxr60.mjs";
 import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
-import { n as assertExists } from "../std__assert-BvGuO4xO.mjs";
-import { r as assertFalse, t as assertRejects } from "../assert_rejects-DN60FHPX.mjs";
-import { n as assertInstanceOf, t as assert } from "../assert-jSdZMYam.mjs";
-import { t as assertThrows } from "../assert_throws-BOkhLGYc.mjs";
+import { n as assertExists } from "../std__assert-BjJn2daJ.mjs";
+import { r as assertFalse, t as assertThrows } from "../assert_throws-BbSMEFKo.mjs";
+import { t as assertRejects } from "../assert_rejects-D1HYAik3.mjs";
+import { n as assertInstanceOf, t as assert } from "../assert-CEO06XCw.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-DkVK8oqV.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-XEgZAlrj.mjs";
-import { g as recordInboxActivity } from "../metrics-cIaMxG0v.mjs";
-import { l as verifyRequest, s as signRequest } from "../http-HjidyDfF.mjs";
+import { g as recordInboxActivity } from "../metrics-DBSl8wEr.mjs";
+import { l as verifyRequest, s as signRequest } from "../http-BCSf1KIY.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-BAK-tUlf.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-NOKfswJV.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-yuyzZC9a.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as compactJsonLd, h as verifyJsonLd, p as signJsonLd, s as detachSignature } from "../ld-C1wveXXf.mjs";
-import { t as doesActorOwnKey } from "../owner-CFKfE85G.mjs";
-import { i as verifyObject, r as signObject } from "../proof-DtpGEj0u.mjs";
-import { g as handleBenchmarkTrigger, i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-I-XlrRVl.mjs";
+import { a as compactJsonLd, h as verifyJsonLd, p as signJsonLd, s as detachSignature } from "../ld-BoLqbDaL.mjs";
+import { t as doesActorOwnKey } from "../owner-DjKvngeb.mjs";
+import { i as verifyObject, r as signObject } from "../proof-D2oFOdNA.mjs";
+import { g as handleBenchmarkTrigger, i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-CZ8tI1qL.mjs";
 import { t as CircuitBreaker } from "../circuit-breaker-D1fxthDI.mjs";
-import { t as markCircuitBreakerLegacySweepDone } from "../circuit-breaker-test-utils-Dm5MM6l9.mjs";
+import { t as markCircuitBreakerLegacySweepDone } from "../circuit-breaker-test-utils-CAdwjgMi.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { RouterError } from "@fedify/uri-template";
 import * as vocab from "@fedify/vocab";
@@ -2916,7 +2916,7 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 			activity: {
 				"@context": "https://www.w3.org/ns/activitystreams",
 				type: "Create",
-				id: "https://example.com/activities/queued-processed",
+				id: "https://remote.example/activities/queued-processed",
 				actor: "https://remote.example/users/alice",
 				object: {
 					type: "Note",
@@ -2934,6 +2934,50 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		assertEquals(inboxLifecycle[0].attributes["activitypub.processing.result"], "processed");
 		assertEquals(inboxLifecycle[0].attributes["activitypub.activity.type"], "https://www.w3.org/ns/activitystreams#Create");
 	});
+	await t.step("records activitypub.inbox.activity rejected for a queued activity whose ID has another origin than its actor", async () => {
+		const kv = new MemoryKvStore();
+		const [meterProvider, recorder] = createTestMeterProvider();
+		const federation = new FederationImpl({
+			kv,
+			meterProvider,
+			queue: {
+				enqueue(_message, _options) {
+					return Promise.resolve();
+				},
+				listen(_handler, _options) {
+					return Promise.resolve();
+				}
+			}
+		});
+		let dispatched = false;
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(vocab.Create, () => {
+			dispatched = true;
+		});
+		await federation.processQueuedTask(void 0, {
+			type: "inbox",
+			id: crypto.randomUUID(),
+			baseUrl: "https://example.com",
+			activity: {
+				"@context": "https://www.w3.org/ns/activitystreams",
+				type: "Create",
+				id: "https://victim.example/activities/queued-forged",
+				actor: "https://remote.example/users/alice",
+				object: {
+					type: "Note",
+					content: "Hello world"
+				}
+			},
+			started: (/* @__PURE__ */ new Date()).toISOString(),
+			attempt: 0,
+			identifier: null,
+			traceContext: {}
+		});
+		assertFalse(dispatched);
+		const inboxLifecycle = recorder.getMeasurements("activitypub.inbox.activity");
+		assertEquals(inboxLifecycle.length, 1);
+		assertEquals(inboxLifecycle[0].attributes["activitypub.processing.result"], "rejected");
+		assertEquals(inboxLifecycle[0].attributes["activitypub.activity.type"], "https://www.w3.org/ns/activitystreams#Create");
+	});
 	await t.step("records activitypub.inbox.activity retried on transient listener failure", async () => {
 		const kv = new MemoryKvStore();
 		const [meterProvider, recorder] = createTestMeterProvider();
@@ -2959,7 +3003,7 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 			activity: {
 				"@context": "https://www.w3.org/ns/activitystreams",
 				type: "Create",
-				id: "https://example.com/activities/queued-retried",
+				id: "https://remote.example/activities/queued-retried",
 				actor: "https://remote.example/users/alice",
 				object: {
 					type: "Note",
@@ -3002,7 +3046,7 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 			activity: {
 				"@context": "https://www.w3.org/ns/activitystreams",
 				type: "Create",
-				id: "https://example.com/activities/queued-abandoned",
+				id: "https://remote.example/activities/queued-abandoned",
 				actor: "https://remote.example/users/alice",
 				object: {
 					type: "Note",
@@ -6938,6 +6982,124 @@ test("ContextImpl.routeActivity() marks queued signed activities as non-LDS", as
 	assertEquals(inboxMessage.ldSignatureVerified, false);
 	assertEquals(inboxMessage.normalizedActivity, void 0);
 });
+for (const queued of [false, true]) test(`ContextImpl.routeActivity() rejects a proof-signed cross-origin ID (queued: ${queued})`, async () => {
+	const messages = [];
+	const queue = {
+		enqueue(message) {
+			messages.push(message);
+			return Promise.resolve();
+		},
+		async listen() {}
+	};
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderFactory: () => mockDocumentLoader,
+		contextLoaderFactory: () => mockDocumentLoader,
+		queue: queued ? {
+			inbox: queue,
+			outbox: queue
+		} : void 0,
+		manuallyStartQueue: true
+	});
+	let listenerCalls = 0;
+	federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, () => {
+		listenerCalls++;
+	});
+	const signed = await signObject(new Create({
+		id: new URL("https://victim.example/activities/1"),
+		actor: ed25519Multikey.controllerId
+	}), ed25519PrivateKey, ed25519Multikey.id, {
+		contextLoader: mockDocumentLoader,
+		documentLoader: mockDocumentLoader
+	});
+	assertFalse(await federation.createContext(new URL("https://local.example/")).routeActivity(null, signed));
+	assertEquals(listenerCalls, 0);
+	assertEquals(messages, []);
+});
+test("ContextImpl.routeActivity() rejects a missing actor before routing", async () => {
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderFactory: () => mockDocumentLoader,
+		contextLoaderFactory: () => mockDocumentLoader
+	});
+	let listenerCalls = 0;
+	federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, () => {
+		listenerCalls++;
+	});
+	assertFalse(await federation.createContext(new URL("https://local.example/")).routeActivity(null, new Create({ id: new URL("https://remote.example/activities/1") })));
+	assertEquals(listenerCalls, 0);
+});
+test("FederationImpl.processQueuedTask() rejects untrusted activity origins before KV access", async () => {
+	class TrackingKvStore extends MemoryKvStore {
+		reads = 0;
+		writes = 0;
+		get(key) {
+			this.reads++;
+			return super.get(key);
+		}
+		set(key, value, options) {
+			this.writes++;
+			return super.set(key, value, options);
+		}
+	}
+	for (const activity of [{
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://victim.example/activities/1",
+		type: "Create",
+		actor: "https://attacker.example/actor"
+	}, {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://victim.example/activities/2",
+		type: "Create"
+	}]) {
+		const kv = new TrackingKvStore();
+		const federation = new FederationImpl({ kv });
+		let listenerCalls = 0;
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, () => {
+			listenerCalls++;
+		});
+		await federation.processQueuedTask(void 0, {
+			type: "inbox",
+			id: crypto.randomUUID(),
+			baseUrl: "https://local.example",
+			activity,
+			started: (/* @__PURE__ */ new Date()).toISOString(),
+			attempt: 0,
+			identifier: null,
+			traceContext: {}
+		});
+		assertEquals(listenerCalls, 0);
+		assertEquals(kv.reads, 0);
+		assertEquals(kv.writes, 0);
+	}
+	const kv = new TrackingKvStore();
+	const federation = new FederationImpl({
+		kv,
+		skipSignatureVerification: true
+	});
+	let listenerCalls = 0;
+	federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, () => {
+		listenerCalls++;
+	});
+	await federation.processQueuedTask(void 0, {
+		type: "inbox",
+		id: crypto.randomUUID(),
+		baseUrl: "https://local.example",
+		activity: {
+			"@context": "https://www.w3.org/ns/activitystreams",
+			id: "https://victim.example/activities/opt-out",
+			type: "Create",
+			actor: "https://attacker.example/actor"
+		},
+		started: (/* @__PURE__ */ new Date()).toISOString(),
+		attempt: 0,
+		identifier: null,
+		traceContext: {}
+	});
+	assertEquals(listenerCalls, 1);
+	assertEquals(kv.reads, 1);
+	assertEquals(kv.writes, 1);
+});
 test("ContextImpl.getCollectionUri()", () => {
 	const federation = new FederationImpl({ kv: new MemoryKvStore() });
 	const base = "https://example.com";

package/dist/federation/mod.cjs

@@ -2,7 +2,7 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../chunk-DDcVe30Y.cjs");
-const require_middleware = require("../middleware-DhOFTXmo.cjs");
+const require_middleware = require("../middleware-BQUQ0pPl.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let es_toolkit = require("es-toolkit");

package/dist/federation/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as SendActivityError, c as buildCollectionSynchronizationHeader, d as normalizeCircuitBreakerOptions, f as parseCircuitBreakerKvState, i as createExponentialBackoffPolicy, l as digest, o as respondWithObject, p as createFederationBuilder, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as CircuitBreaker } from "../middleware-CnrzVu9i.js";
+import { a as SendActivityError, c as buildCollectionSynchronizationHeader, d as normalizeCircuitBreakerOptions, f as parseCircuitBreakerKvState, i as createExponentialBackoffPolicy, l as digest, o as respondWithObject, p as createFederationBuilder, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as CircuitBreaker } from "../middleware-CRd1JmuL.js";
 import { getLogger } from "@logtape/logtape";
 import { Router as Router$1, RouterError as RouterError$1, assertPath, isPath } from "@fedify/uri-template";
 import { isEqual } from "es-toolkit";

package/dist/federation/mq.test.mjs

@@ -2,9 +2,10 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
-import "../std__assert-BvGuO4xO.mjs";
-import { n as assertGreaterOrEqual, r as assertFalse } from "../assert_rejects-DN60FHPX.mjs";
-import { t as assert } from "../assert-jSdZMYam.mjs";
+import "../std__assert-BjJn2daJ.mjs";
+import { r as assertFalse } from "../assert_throws-BbSMEFKo.mjs";
+import { n as assertGreaterOrEqual } from "../assert_rejects-D1HYAik3.mjs";
+import { t as assert } from "../assert-CEO06XCw.mjs";
 import { test } from "@fedify/fixture";
 import { delay } from "es-toolkit";
 //#region src/federation/mq.ts

package/dist/federation/negotiation.test.mjs

@@ -1,10 +1,10 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import "../std__assert-BvGuO4xO.mjs";
-import { r as assertFalse } from "../assert_rejects-DN60FHPX.mjs";
-import { t as assert } from "../assert-jSdZMYam.mjs";
-import { t as acceptsJsonLd } from "../negotiation-CDW-_gUU.mjs";
+import "../std__assert-BjJn2daJ.mjs";
+import { r as assertFalse } from "../assert_throws-BbSMEFKo.mjs";
+import { t as assert } from "../assert-CEO06XCw.mjs";
+import { t as acceptsJsonLd } from "../negotiation-DDstyBvc.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/negotiation.test.ts
 test("acceptsJsonLd()", () => {

package/dist/federation/retry.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { l as AssertionError, t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-DkVK8oqV.mjs";
-import { t as createExponentialBackoffPolicy } from "../retry-_VvV0h9f.mjs";
+import { t as createExponentialBackoffPolicy } from "../retry-CXg_MBI-.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/retry.test.ts
 test("createExponentialBackoffPolicy()", () => {

package/dist/federation/router.test.mjs

@@ -2,10 +2,9 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
-import "../std__assert-BvGuO4xO.mjs";
-import { r as assertFalse } from "../assert_rejects-DN60FHPX.mjs";
-import { t as assert } from "../assert-jSdZMYam.mjs";
-import { t as assertThrows } from "../assert_throws-BOkhLGYc.mjs";
+import "../std__assert-BjJn2daJ.mjs";
+import { r as assertFalse, t as assertThrows } from "../assert_throws-BbSMEFKo.mjs";
+import { t as assert } from "../assert-CEO06XCw.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Router, RouterError, assertPath, isPath } from "@fedify/uri-template";
 import { test } from "@fedify/fixture";

package/dist/federation/send.test.mjs

@@ -3,14 +3,15 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-vrlUxr60.mjs";
 import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
-import "../std__assert-BvGuO4xO.mjs";
-import { n as assertGreaterOrEqual, r as assertFalse, t as assertRejects } from "../assert_rejects-DN60FHPX.mjs";
-import { n as assertInstanceOf, t as assert } from "../assert-jSdZMYam.mjs";
+import "../std__assert-BjJn2daJ.mjs";
+import { r as assertFalse } from "../assert_throws-BbSMEFKo.mjs";
+import { n as assertGreaterOrEqual, t as assertRejects } from "../assert_rejects-D1HYAik3.mjs";
+import { n as assertInstanceOf, t as assert } from "../assert-CEO06XCw.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-DkVK8oqV.mjs";
-import { l as verifyRequest } from "../http-HjidyDfF.mjs";
+import { l as verifyRequest } from "../http-BCSf1KIY.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-BAK-tUlf.mjs";
-import { t as doesActorOwnKey } from "../owner-CFKfE85G.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-CwMea5r6.mjs";
+import { t as doesActorOwnKey } from "../owner-DjKvngeb.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-xDK5UnL-.mjs";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/federation/temporal.test.mjs

@@ -1,10 +1,10 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import "../std__assert-BvGuO4xO.mjs";
-import { r as assertFalse } from "../assert_rejects-DN60FHPX.mjs";
-import { t as assert } from "../assert-jSdZMYam.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-ClSXyHyu.mjs";
+import "../std__assert-BjJn2daJ.mjs";
+import { r as assertFalse } from "../assert_throws-BbSMEFKo.mjs";
+import { t as assert } from "../assert-CEO06XCw.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-C6icc5n9.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -3,10 +3,10 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { r as createRequestContext } from "../context-CxbCIptr.mjs";
 import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
-import "../std__assert-BvGuO4xO.mjs";
+import "../std__assert-BjJn2daJ.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-DkVK8oqV.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-I-XlrRVl.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-CZ8tI1qL.mjs";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 import { createTestMeterProvider, test } from "@fedify/fixture";
 //#region src/federation/webfinger.test.ts

package/dist/{http-HjidyDfF.mjs → http-BCSf1KIY.mjs}

@@ -1,10 +1,10 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D4dcoVfF.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-cIaMxG0v.mjs";
+import { n as version, t as name } from "./deno-y3L4Oa94.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DBSl8wEr.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-Dd__NiUL.mjs";
-import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-Dg-NXm4K.mjs";
+import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-APURZ0ky.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{http-D_Xrr6kp.cjs → http-D77Wjrcg.cjs}

@@ -11,7 +11,7 @@ let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conve
 let byte_encodings_base64 = require("byte-encodings/base64");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.3.12";
+var version = "2.3.14";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -1101,16 +1101,23 @@ async function importJwk(jwk, type) {
 /**
 * Fetches the document that the given actor URI dereferences to, and returns
 * the actor only if the host that served the document is authoritative for
-* the id the document claims.
+* the id the document claims, and that id is the actor that was asked for.
 *
 * Only the origin that serves an actor id can speak for it.  Without that
 * rule any host could serve a document describing somebody else's actor—and
 * listing its own keys as that actor's.
 *
+* The returned actor always has exactly the requested `actorId` as its `id`.
+* A document loader follows redirects and alternate document links, so the
+* document an actor id leads to may describe a different actor altogether,
+* on the same origin or on another; accepting it would attribute that other
+* actor's keys to the requested one.  See GHSA-8863-8468-7hq7.
+*
 * @param actorId The URI of the actor to fetch.
 * @param options Options for fetching the document.
 * @returns The actor, or `null` if the document cannot be fetched, is not an
-*          actor, or belongs to another origin.
+*          actor, belongs to another origin, or describes an actor other
+*          than the requested one.
 * @internal
 */
 async function fetchActorDocument(actorId, options = {}) {
@@ -1165,6 +1172,13 @@ async function fetchActorDocumentInternal(actorId, options, propagateContextFetc
 		});
 		return null;
 	}
+	if (object.id.href !== actorId.href) {
+		logger.debug("The document fetched for the actor {actorId} is the actor {documentActorId} instead; refusing to treat it as the requested actor's document.", {
+			actorId: actorId.href,
+			documentActorId: object.id.href
+		});
+		return null;
+	}
 	return object;
 }
 /**

package/dist/{http-DkyUBs_T.js → http-DNM9KyIO.js}

@@ -10,7 +10,7 @@ import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } fro
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.3.12";
+var version = "2.3.14";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -1100,16 +1100,23 @@ async function importJwk(jwk, type) {
 /**
 * Fetches the document that the given actor URI dereferences to, and returns
 * the actor only if the host that served the document is authoritative for
-* the id the document claims.
+* the id the document claims, and that id is the actor that was asked for.
 *
 * Only the origin that serves an actor id can speak for it.  Without that
 * rule any host could serve a document describing somebody else's actor—and
 * listing its own keys as that actor's.
 *
+* The returned actor always has exactly the requested `actorId` as its `id`.
+* A document loader follows redirects and alternate document links, so the
+* document an actor id leads to may describe a different actor altogether,
+* on the same origin or on another; accepting it would attribute that other
+* actor's keys to the requested one.  See GHSA-8863-8468-7hq7.
+*
 * @param actorId The URI of the actor to fetch.
 * @param options Options for fetching the document.
 * @returns The actor, or `null` if the document cannot be fetched, is not an
-*          actor, or belongs to another origin.
+*          actor, belongs to another origin, or describes an actor other
+*          than the requested one.
 * @internal
 */
 async function fetchActorDocument(actorId, options = {}) {
@@ -1164,6 +1171,13 @@ async function fetchActorDocumentInternal(actorId, options, propagateContextFetc
 		});
 		return null;
 	}
+	if (object.id.href !== actorId.href) {
+		logger.debug("The document fetched for the actor {actorId} is the actor {documentActorId} instead; refusing to treat it as the requested actor's document.", {
+			actorId: actorId.href,
+			documentActorId: object.id.href
+		});
+		return null;
+	}
 	return object;
 }
 /**

package/dist/inbox-NObX26c9.mjs

@@ -0,0 +1,180 @@
+import { Temporal } from "@js-temporal/polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as version, t as name } from "./deno-y3L4Oa94.mjs";
+import { g as recordInboxActivity, n as getDurationMs, r as getFederationMetrics } from "./metrics-DBSl8wEr.mjs";
+import { getLogger } from "@logtape/logtape";
+import { getTypeId } from "@fedify/vocab";
+import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
+//#region src/federation/inbox.ts
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* non-opaque origin.  Activities without an ID have no origin to authenticate.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = activity.id.origin;
+	return origin !== "null" && activity.actorIds.every((actor) => actor.origin === origin);
+}
+async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+		return "missingActor";
+	}
+	let cacheKey = null;
+	if (activity.id != null) {
+		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href);
+		const strategy = idempotencyStrategy ?? "per-inbox";
+		let keyString;
+		if (typeof strategy === "function") keyString = await strategy(inboxContext, activity);
+		else switch (strategy) {
+			case "global":
+				keyString = activity.id.href;
+				break;
+			case "per-origin":
+				keyString = `${ctx.origin}\n${activity.id.href}`;
+				break;
+			case "per-inbox":
+				keyString = `${ctx.origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
+				break;
+			default: keyString = `${ctx.origin}\n${activity.id.href}`;
+		}
+		if (keyString != null) cacheKey = [...kvPrefixes.activityIdempotence, keyString];
+	}
+	if (cacheKey != null) {
+		if (await kv.get(cacheKey) === true) {
+			logger.debug("Activity {activityId} has already been processed.", {
+				activityId: activity.id?.href,
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.UNSET,
+				message: `Activity ${activity.id?.href} has already been processed.`
+			});
+			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+			return "alreadyProcessed";
+		}
+	}
+	span.setAttribute("activitypub.actor.id", activity.actorId.href);
+	if (queue != null) {
+		const carrier = {};
+		propagation.inject(context.active(), carrier);
+		try {
+			await queue.enqueue({
+				type: "inbox",
+				id: crypto.randomUUID(),
+				baseUrl: ctx.origin,
+				activity: originalJson ?? json,
+				...normalizedActivity == null ? {} : { normalizedActivity },
+				...ldSignatureVerified == null ? {} : { ldSignatureVerified },
+				identifier: recipient,
+				attempt: 0,
+				started: (/* @__PURE__ */ new Date()).toISOString(),
+				traceContext: carrier
+			});
+		} catch (error) {
+			logger.error("Failed to enqueue the incoming activity {activityId}:\n{error}", {
+				error,
+				activityId: activity.id?.href,
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: `Failed to enqueue the incoming activity ${activity.id?.href}.`
+			});
+			throw error;
+		}
+		getFederationMetrics(meterProvider).recordQueueTaskEnqueued({
+			role: "inbox",
+			queue,
+			activityType: getTypeId(activity).href
+		}, 0);
+		recordInboxActivity(meterProvider, "queued", getTypeId(activity).href);
+		logger.info("Activity {activityId} is enqueued.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		return "enqueued";
+	}
+	tracerProvider = tracerProvider ?? trace.getTracerProvider();
+	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span) => {
+		const dispatched = inboxListeners?.dispatchWithClass(activity);
+		if (dispatched == null) {
+			logger.error("Unsupported activity type:\n{activity}", {
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.UNSET,
+				message: `Unsupported activity type: ${getTypeId(activity).href}`
+			});
+			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+			span.end();
+			return "unsupportedActivity";
+		}
+		const { class: cls, listener } = dispatched;
+		span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
+		try {
+			const activityType = getTypeId(activity).href;
+			const started = performance.now();
+			try {
+				const contextFactory = listenerInboxContextFactory ?? inboxContextFactory;
+				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType), activity);
+			} finally {
+				getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
+			}
+		} catch (error) {
+			try {
+				await inboxErrorHandler?.(ctx, error);
+			} catch (error) {
+				logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
+					error,
+					activityId: activity.id?.href,
+					activity: json,
+					recipient
+				});
+			}
+			logger.error("Failed to process the incoming activity {activityId}:\n{error}", {
+				error,
+				activityId: activity.id?.href,
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+			span.end();
+			return "error";
+		}
+		recordInboxActivity(meterProvider, "processed", getTypeId(activity).href);
+		if (cacheKey != null) await kv.set(cacheKey, true, { ttl: Temporal.Duration.from({ days: 1 }) });
+		logger.info("Activity {activityId} has been processed.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		span.end();
+		return "success";
+	});
+}
+//#endregion
+export { routeActivity as n, actorsHaveSameOrigin as t };