@fedify/relay 2.0.7 → 2.0.8

package/dist/litepub.test.js

@@ -3,7 +3,7 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { exportSpki, getDocumentLoader, isRelayFollowerData } from "./types-BEbHsZHq.js";
+import { exportSpki, getDocumentLoader, isRelayFollowerData } from "./types-B3gny4_t.js";
 import { MemoryKvStore, signRequest } from "@fedify/fedify";
 import { createRelay } from "@fedify/relay";
 import { Accept, Announce, Create, Delete, Follow, Move, Note, Person, Undo, Update } from "@fedify/vocab";

package/dist/mastodon.test.js

@@ -3,7 +3,7 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { exportSpki, getDocumentLoader, isRelayFollowerData } from "./types-BEbHsZHq.js";
+import { exportSpki, getDocumentLoader, isRelayFollowerData } from "./types-B3gny4_t.js";
 import { MemoryKvStore, signRequest } from "@fedify/fedify";
 import { createRelay } from "@fedify/relay";
 import { Create, Delete, Follow, Move, Note, Person, Undo, Update } from "@fedify/vocab";

package/dist/{types-BEbHsZHq.js → types-B3gny4_t.js}

@@ -25600,7 +25600,7 @@ const preloadedContexts = {
 };
 var contexts_default = preloadedContexts;
 var name = "@fedify/vocab-runtime";
-var version = "2.0.7";
+var version = "2.0.8";
 var license = "MIT";
 var exports$1 = {
 	".": "./src/mod.ts",
@@ -25941,6 +25941,7 @@ const logger = getLogger([
 	"runtime",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -26059,31 +26060,33 @@ async function getRemoteDocument(url, response, fetch$1) {
 function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAgent } = {}) {
 	const tracerProvider = trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	async function load(url, options) {
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
-		if (!skipPreloadedContexts && url in contexts_default) {
-			logger.debug("Using preloaded context: {url}.", { url });
+		const currentUrl = new URL(url).href;
+		if (!skipPreloadedContexts && currentUrl in contexts_default) {
+			logger.debug("Using preloaded context: {url}.", { url: currentUrl });
 			return {
 				contextUrl: null,
-				document: contexts_default[url],
-				documentUrl: url
+				document: contexts_default[currentUrl],
+				documentUrl: currentUrl
 			};
 		}
 		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
+			await validatePublicUrl(currentUrl);
 		} catch (error) {
 			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
+				url: currentUrl,
 				error
 			});
 			throw error;
 		}
+		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
 			kind: SpanKind.CLIENT,
-			attributes: { "url.full": url }
+			attributes: { "url.full": currentUrl }
 		}, async (span) => {
 			try {
-				const request = createActivityPubRequest(url, { userAgent });
+				const request = createActivityPubRequest(currentUrl, { userAgent });
 				logRequest(logger, request);
 				const response = await fetch(request, {
 					redirect: "manual",
@@ -26091,11 +26094,25 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 				});
 				span.setAttribute("http.response.status_code", response.status);
 				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-					const redirectUrl = response.headers.get("Location");
+					if (redirected >= DEFAULT_MAX_REDIRECTION) {
+						logger.error("Too many redirections ({redirections}) while fetching document.", {
+							redirections: redirected + 1,
+							url: currentUrl
+						});
+						throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					}
+					const redirectUrl = new URL(response.headers.get("Location"), response.url === "" ? currentUrl : response.url).href;
 					span.setAttribute("http.redirect.url", redirectUrl);
-					return await load(redirectUrl, options);
+					if (visited.has(redirectUrl)) {
+						logger.error("Detected a redirect loop while fetching document: {url} -> {redirectUrl}", {
+							url: currentUrl,
+							redirectUrl
+						});
+						throw new FetchError(currentUrl, `Redirect loop detected: ${redirectUrl}`);
+					}
+					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(url, response, load);
+				const result = await getRemoteDocument(currentUrl, response, load);
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/relay",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": "ActivityPub relay support for Fedify",
   "keywords": [
     "Fedify",
@@ -50,14 +50,14 @@
   "dependencies": {
     "@js-temporal/polyfill": "^0.5.1",
     "@logtape/logtape": "^2.0.0",
-    "@fedify/fedify": "^2.0.7",
-    "@fedify/vocab": "2.0.7"
+    "@fedify/fedify": "^2.0.8",
+    "@fedify/vocab": "2.0.8"
   },
   "devDependencies": {
     "tsdown": "^0.12.9",
     "typescript": "^5.9.3",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/vocab-runtime": "^2.0.7"
+    "@fedify/vocab-runtime": "^2.0.8"
   },
   "scripts": {
     "build:self": "tsdown",