@fedify/vocab-runtime 2.0.22-dev.1565 → 2.0.23-dev.1698

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.0.22-dev.1565+b5a902fa",
+  "version": "2.0.23-dev.1698+43673cbc",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/mod.cjs

@@ -4295,7 +4295,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.22-dev.1565+b5a902fa";
+var version = "2.0.23-dev.1698+43673cbc";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4544,8 +4544,8 @@ function logRequest(logger, request) {
 //#endregion
 //#region src/url.ts
 var UrlError = class extends Error {
-	constructor(message) {
-		super(message);
+	constructor(message, options) {
+		super(message, options);
 		this.name = "UrlError";
 	}
 };
@@ -4573,10 +4573,37 @@ async function validatePublicUrl(url) {
 	let addresses;
 	try {
 		addresses = await (0, node_dns_promises.lookup)(hostname, { all: true });
-	} catch {
-		addresses = [];
+	} catch (error) {
+		throw new UrlError("DNS lookup failed", { cause: error });
 	}
-	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+	validateLookupAddresses(addresses);
+}
+/**
+* Validates the IP addresses returned by `node:dns.lookup()`.
+*
+* Cloudflare Workers' `node:dns` implementation currently maps every record
+* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+* `LookupAddress`, even though Node.js specifies that the `address` field must
+* contain an IPv4 or IPv6 literal.  See:
+* https://github.com/cloudflare/workerd/issues/6886
+*
+* Work around that bug by ignoring non-IP entries only when the lookup also
+* returns at least one actual IP address.  This remains fail-closed: a result
+* containing no IP addresses is rejected, and every returned IP address is
+* still validated and must be public.  This workaround can be revisited once
+* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+*
+* @internal
+*/
+function validateLookupAddresses(addresses) {
+	let ipAddressCount = 0;
+	for (const { address } of addresses) {
+		const family = (0, node_net.isIP)(address);
+		if (family === 0) continue;
+		ipAddressCount++;
+		validatePublicIpAddress(address, family);
+	}
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address");
 }
 function validatePublicIpAddress(address, family) {
 	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;

package/dist/mod.d.cts

@@ -318,7 +318,9 @@ declare function encodingFromBaseData(data: string | Uint8Array): Base;
 //#endregion
 //#region src/url.d.ts
 declare class UrlError extends Error {
-  constructor(message: string);
+  constructor(message: string, options?: {
+    cause?: unknown;
+  });
 }
 /**
 * Validates a URL to prevent SSRF attacks.

package/dist/mod.d.ts

@@ -1,6 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { Logger } from "@logtape/logtape";
-
 //#region src/contexts.d.ts
 declare const preloadedContexts: Record<string, unknown>;
 //#endregion
@@ -318,7 +317,9 @@ declare function encodingFromBaseData(data: string | Uint8Array): Base;
 //#endregion
 //#region src/url.d.ts
 declare class UrlError extends Error {
-  constructor(message: string);
+  constructor(message: string, options?: {
+    cause?: unknown;
+  });
 }
 /**
 * Validates a URL to prevent SSRF attacks.

package/dist/mod.js

@@ -4291,7 +4291,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.22-dev.1565+b5a902fa";
+var version = "2.0.23-dev.1698+43673cbc";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4540,8 +4540,8 @@ function logRequest(logger, request) {
 //#endregion
 //#region src/url.ts
 var UrlError = class extends Error {
-	constructor(message) {
-		super(message);
+	constructor(message, options) {
+		super(message, options);
 		this.name = "UrlError";
 	}
 };
@@ -4569,10 +4569,37 @@ async function validatePublicUrl(url) {
 	let addresses;
 	try {
 		addresses = await lookup(hostname, { all: true });
-	} catch {
-		addresses = [];
+	} catch (error) {
+		throw new UrlError("DNS lookup failed", { cause: error });
 	}
-	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+	validateLookupAddresses(addresses);
+}
+/**
+* Validates the IP addresses returned by `node:dns.lookup()`.
+*
+* Cloudflare Workers' `node:dns` implementation currently maps every record
+* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+* `LookupAddress`, even though Node.js specifies that the `address` field must
+* contain an IPv4 or IPv6 literal.  See:
+* https://github.com/cloudflare/workerd/issues/6886
+*
+* Work around that bug by ignoring non-IP entries only when the lookup also
+* returns at least one actual IP address.  This remains fail-closed: a result
+* containing no IP addresses is rejected, and every returned IP address is
+* still validated and must be public.  This workaround can be revisited once
+* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+*
+* @internal
+*/
+function validateLookupAddresses(addresses) {
+	let ipAddressCount = 0;
+	for (const { address } of addresses) {
+		const family = isIP(address);
+		if (family === 0) continue;
+		ipAddressCount++;
+		validatePublicIpAddress(address, family);
+	}
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address");
 }
 function validatePublicIpAddress(address, family) {
 	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;

package/dist/tests/docloader.test.cjs

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-BU9pVpmw.cjs");
+const require_request = require("./request-CB3GJyfx.cjs");
 const require_link = require("./link-B6ZWBZhf.cjs");
-const require_url = require("./url-CjF2c1ff.cjs");
+const require_url = require("./url-CqwkmczT.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 let _logtape_logtape = require("@logtape/logtape");

package/dist/tests/docloader.test.mjs

@@ -1,6 +1,6 @@
-import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-CzycHiJe.mjs";
+import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-jsLl_PUT.mjs";
 import { t as HttpHeaderLink } from "./link-B8JGXSS2.mjs";
-import { a as validatePublicUrl, t as UrlError } from "./url-Cyu1RKqd.mjs";
+import { o as validatePublicUrl, t as UrlError } from "./url-BulORwtj.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 import { getLogger } from "@logtape/logtape";

package/dist/tests/{request-BU9pVpmw.cjs → request-CB3GJyfx.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.22-dev.1565+b5a902fa";
+var version = "2.0.23-dev.1698+43673cbc";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-CzycHiJe.mjs → request-jsLl_PUT.mjs}

@@ -1,7 +1,7 @@
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.22-dev.1565+b5a902fa";
+var version = "2.0.23-dev.1698+43673cbc";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-BU9pVpmw.cjs");
+const require_request = require("./request-CB3GJyfx.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 let node_process = require("node:process");

package/dist/tests/request.test.mjs

@@ -1,4 +1,4 @@
-import { o as version, r as getUserAgent } from "./request-CzycHiJe.mjs";
+import { o as version, r as getUserAgent } from "./request-jsLl_PUT.mjs";
 import { deepStrictEqual } from "node:assert";
 import { test } from "node:test";
 import process from "node:process";

package/dist/tests/{url-Cyu1RKqd.mjs → url-BulORwtj.mjs}

@@ -2,8 +2,8 @@ import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 //#region src/url.ts
 var UrlError = class extends Error {
-	constructor(message) {
-		super(message);
+	constructor(message, options) {
+		super(message, options);
 		this.name = "UrlError";
 	}
 };
@@ -31,10 +31,37 @@ async function validatePublicUrl(url) {
 	let addresses;
 	try {
 		addresses = await lookup(hostname, { all: true });
-	} catch {
-		addresses = [];
+	} catch (error) {
+		throw new UrlError("DNS lookup failed", { cause: error });
 	}
-	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+	validateLookupAddresses(addresses);
+}
+/**
+* Validates the IP addresses returned by `node:dns.lookup()`.
+*
+* Cloudflare Workers' `node:dns` implementation currently maps every record
+* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+* `LookupAddress`, even though Node.js specifies that the `address` field must
+* contain an IPv4 or IPv6 literal.  See:
+* https://github.com/cloudflare/workerd/issues/6886
+*
+* Work around that bug by ignoring non-IP entries only when the lookup also
+* returns at least one actual IP address.  This remains fail-closed: a result
+* containing no IP addresses is rejected, and every returned IP address is
+* still validated and must be public.  This workaround can be revisited once
+* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+*
+* @internal
+*/
+function validateLookupAddresses(addresses) {
+	let ipAddressCount = 0;
+	for (const { address } of addresses) {
+		const family = isIP(address);
+		if (family === 0) continue;
+		ipAddressCount++;
+		validatePublicIpAddress(address, family);
+	}
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address");
 }
 function validatePublicIpAddress(address, family) {
 	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
@@ -173,4 +200,4 @@ function matchesIPv6Prefix(address, prefixWords, prefixLength) {
 	return true;
 }
 //#endregion
-export { validatePublicUrl as a, isValidPublicIPv6Address as i, expandIPv6Address as n, isValidPublicIPv4Address as r, UrlError as t };
+export { validateLookupAddresses as a, isValidPublicIPv6Address as i, expandIPv6Address as n, validatePublicUrl as o, isValidPublicIPv4Address as r, UrlError as t };

package/dist/tests/{url-CjF2c1ff.cjs → url-CqwkmczT.cjs}

@@ -3,8 +3,8 @@ let node_dns_promises = require("node:dns/promises");
 let node_net = require("node:net");
 //#region src/url.ts
 var UrlError = class extends Error {
-	constructor(message) {
-		super(message);
+	constructor(message, options) {
+		super(message, options);
 		this.name = "UrlError";
 	}
 };
@@ -32,10 +32,37 @@ async function validatePublicUrl(url) {
 	let addresses;
 	try {
 		addresses = await (0, node_dns_promises.lookup)(hostname, { all: true });
-	} catch {
-		addresses = [];
+	} catch (error) {
+		throw new UrlError("DNS lookup failed", { cause: error });
 	}
-	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+	validateLookupAddresses(addresses);
+}
+/**
+* Validates the IP addresses returned by `node:dns.lookup()`.
+*
+* Cloudflare Workers' `node:dns` implementation currently maps every record
+* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+* `LookupAddress`, even though Node.js specifies that the `address` field must
+* contain an IPv4 or IPv6 literal.  See:
+* https://github.com/cloudflare/workerd/issues/6886
+*
+* Work around that bug by ignoring non-IP entries only when the lookup also
+* returns at least one actual IP address.  This remains fail-closed: a result
+* containing no IP addresses is rejected, and every returned IP address is
+* still validated and must be public.  This workaround can be revisited once
+* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+*
+* @internal
+*/
+function validateLookupAddresses(addresses) {
+	let ipAddressCount = 0;
+	for (const { address } of addresses) {
+		const family = (0, node_net.isIP)(address);
+		if (family === 0) continue;
+		ipAddressCount++;
+		validatePublicIpAddress(address, family);
+	}
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address");
 }
 function validatePublicIpAddress(address, family) {
 	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
@@ -198,6 +225,12 @@ Object.defineProperty(exports, "isValidPublicIPv6Address", {
 		return isValidPublicIPv6Address;
 	}
 });
+Object.defineProperty(exports, "validateLookupAddresses", {
+	enumerable: true,
+	get: function() {
+		return validateLookupAddresses;
+	}
+});
 Object.defineProperty(exports, "validatePublicUrl", {
 	enumerable: true,
 	get: function() {

package/dist/tests/url.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-const require_url = require("./url-CjF2c1ff.cjs");
+const require_url = require("./url-CqwkmczT.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region src/url.test.ts
@@ -29,6 +29,35 @@ let node_test = require("node:test");
 	await require_url.validatePublicUrl("https://[2001:db8::1]");
 	await require_url.validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
+(0, node_test.test)("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
+	require_url.validateLookupAddresses([
+		{
+			address: "app-host.example.net.",
+			family: 4
+		},
+		{
+			address: "93.184.216.34",
+			family: 4
+		},
+		{
+			address: "2606:2800:220:1:248:1893:25c8:1946",
+			family: 6
+		}
+	]);
+});
+(0, node_test.test)("validateLookupAddresses() rejects unsafe or CNAME-only Cloudflare Workers results", () => {
+	(0, node_assert.throws)(() => require_url.validateLookupAddresses([{
+		address: "private-host.example.net.",
+		family: 4
+	}, {
+		address: "127.0.0.1",
+		family: 4
+	}]), require_url.UrlError);
+	(0, node_assert.throws)(() => require_url.validateLookupAddresses([{
+		address: "app-host.example.net.",
+		family: 4
+	}]), require_url.UrlError);
+});
 (0, node_test.test)("isValidPublicIPv4Address()", () => {
 	(0, node_assert.ok)(require_url.isValidPublicIPv4Address("8.8.8.8"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.168.1.1"));

package/dist/tests/url.test.mjs

@@ -1,5 +1,5 @@
-import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-Cyu1RKqd.mjs";
-import { deepStrictEqual, ok, rejects } from "node:assert";
+import { a as validateLookupAddresses, i as isValidPublicIPv6Address, n as expandIPv6Address, o as validatePublicUrl, r as isValidPublicIPv4Address, t as UrlError } from "./url-BulORwtj.mjs";
+import { deepStrictEqual, ok, rejects, throws } from "node:assert";
 import { test } from "node:test";
 //#region src/url.test.ts
 test("validatePublicUrl()", async () => {
@@ -28,6 +28,35 @@ test("validatePublicUrl()", async () => {
 	await validatePublicUrl("https://[2001:db8::1]");
 	await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
+test("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
+	validateLookupAddresses([
+		{
+			address: "app-host.example.net.",
+			family: 4
+		},
+		{
+			address: "93.184.216.34",
+			family: 4
+		},
+		{
+			address: "2606:2800:220:1:248:1893:25c8:1946",
+			family: 6
+		}
+	]);
+});
+test("validateLookupAddresses() rejects unsafe or CNAME-only Cloudflare Workers results", () => {
+	throws(() => validateLookupAddresses([{
+		address: "private-host.example.net.",
+		family: 4
+	}, {
+		address: "127.0.0.1",
+		family: 4
+	}]), UrlError);
+	throws(() => validateLookupAddresses([{
+		address: "app-host.example.net.",
+		family: 4
+	}]), UrlError);
+});
 test("isValidPublicIPv4Address()", () => {
 	ok(isValidPublicIPv4Address("8.8.8.8"));
 	ok(!isValidPublicIPv4Address("192.168.1.1"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.0.22-dev.1565+b5a902fa",
+  "version": "2.0.23-dev.1698+43673cbc",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/url.test.ts

@@ -1,10 +1,11 @@
-import { deepStrictEqual, ok, rejects } from "node:assert";
+import { deepStrictEqual, ok, rejects, throws } from "node:assert";
 import { test } from "node:test";
 import {
   expandIPv6Address,
   isValidPublicIPv4Address,
   isValidPublicIPv6Address,
   UrlError,
+  validateLookupAddresses,
   validatePublicUrl,
 } from "./url.ts";
 
@@ -65,6 +66,32 @@ test("validatePublicUrl()", async () => {
   await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
 
+test("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
+  validateLookupAddresses([
+    { address: "app-host.example.net.", family: 4 },
+    { address: "93.184.216.34", family: 4 },
+    { address: "2606:2800:220:1:248:1893:25c8:1946", family: 6 },
+  ]);
+});
+
+test("validateLookupAddresses() rejects unsafe or CNAME-only Cloudflare Workers results", () => {
+  throws(
+    () =>
+      validateLookupAddresses([
+        { address: "private-host.example.net.", family: 4 },
+        { address: "127.0.0.1", family: 4 },
+      ]),
+    UrlError,
+  );
+  throws(
+    () =>
+      validateLookupAddresses([
+        { address: "app-host.example.net.", family: 4 },
+      ]),
+    UrlError,
+  );
+});
+
 test("isValidPublicIPv4Address()", () => {
   ok(isValidPublicIPv4Address("8.8.8.8")); // Google DNS
   ok(!isValidPublicIPv4Address("192.168.1.1")); // private

package/src/url.ts

@@ -3,8 +3,8 @@ import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 
 export class UrlError extends Error {
-  constructor(message: string) {
-    super(message);
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
     this.name = "UrlError";
   }
 }
@@ -51,12 +51,42 @@ export async function validatePublicUrl(url: string): Promise<void> {
   let addresses: LookupAddress[];
   try {
     addresses = await lookup(hostname, { all: true });
-  } catch {
-    addresses = [];
+  } catch (error) {
+    throw new UrlError("DNS lookup failed", { cause: error });
   }
-  for (const { address, family } of addresses) {
+  validateLookupAddresses(addresses);
+}
+
+/**
+ * Validates the IP addresses returned by `node:dns.lookup()`.
+ *
+ * Cloudflare Workers' `node:dns` implementation currently maps every record
+ * in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+ * `LookupAddress`, even though Node.js specifies that the `address` field must
+ * contain an IPv4 or IPv6 literal.  See:
+ * https://github.com/cloudflare/workerd/issues/6886
+ *
+ * Work around that bug by ignoring non-IP entries only when the lookup also
+ * returns at least one actual IP address.  This remains fail-closed: a result
+ * containing no IP addresses is rejected, and every returned IP address is
+ * still validated and must be public.  This workaround can be revisited once
+ * the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+ *
+ * @internal
+ */
+export function validateLookupAddresses(
+  addresses: readonly LookupAddress[],
+): void {
+  let ipAddressCount = 0;
+  for (const { address } of addresses) {
+    const family = isIP(address);
+    if (family === 0) continue;
+    ipAddressCount++;
     validatePublicIpAddress(address, family);
   }
+  if (ipAddressCount === 0) {
+    throw new UrlError("DNS lookup did not return any IP address");
+  }
 }
 
 function validatePublicIpAddress(address: string, family: number): void {