@fedify/vocab-runtime 2.0.28-dev.1974 → 2.0.28-dev.1982

package/dist/tests/langstr.test.mjs

@@ -1,5 +1,5 @@
-import { deepStrictEqual } from "node:assert";
 import { test } from "node:test";
+import { deepStrictEqual } from "node:assert";
 import util from "node:util";
 //#region src/langstr.ts
 /**

package/dist/tests/link.test.cjs

@@ -1,7 +1,7 @@
 require("./chunk-Do9eywBl.cjs");
-const require_link = require("./link-B6ZWBZhf.cjs");
-let node_assert = require("node:assert");
+const require_link = require("./link-FguCydMA.cjs");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 //#region src/link.test.ts
 (0, node_test.test)("String Good 1", () => {
 	const instance = new require_link.HttpHeaderLink(`<https://example.com>; rel="preconnect"`);

package/dist/tests/link.test.mjs

@@ -1,6 +1,6 @@
-import { t as HttpHeaderLink } from "./link-B8JGXSS2.mjs";
-import { deepStrictEqual, throws } from "node:assert";
+import { t as HttpHeaderLink } from "./link-NUUWCdnK.mjs";
 import { test } from "node:test";
+import { deepStrictEqual, throws } from "node:assert";
 //#region src/link.test.ts
 test("String Good 1", () => {
 	const instance = new HttpHeaderLink(`<https://example.com>; rel="preconnect"`);

package/dist/tests/multibase/multibase.test.cjs

@@ -1,7 +1,7 @@
 require("../chunk-Do9eywBl.cjs");
-const require_multibase = require("../multibase-CgYqpk4Z.cjs");
-let node_assert = require("node:assert");
+const require_multibase = require("../multibase-CnmModw0.cjs");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 //#region src/multibase/multibase.test.ts
 (0, node_test.test)("multibase.encode and decode", async (t) => {
 	const testCases = [

package/dist/tests/multibase/multibase.test.mjs

@@ -1,6 +1,6 @@
-import { a as decodeText, i as names, n as encodeMultibase, o as encodeText, r as codes, t as decodeMultibase } from "../multibase-jcKrOpuU.mjs";
-import { deepStrictEqual } from "node:assert";
+import { a as decodeText, i as names, n as encodeMultibase, o as encodeText, r as codes, t as decodeMultibase } from "../multibase-DLBufb99.mjs";
 import { test } from "node:test";
+import { deepStrictEqual } from "node:assert";
 //#region src/multibase/multibase.test.ts
 test("multibase.encode and decode", async (t) => {
 	const testCases = [

package/dist/tests/{request-C4ZUiyFP.mjs → request-ByxplZyY.mjs}

@@ -1,7 +1,7 @@
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.28-dev.1974+d70e3148";
+var version = "2.0.28-dev.1982+a57dec3f";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-DekYA6RV.cjs → request-Ir4zMwN8.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.28-dev.1974+d70e3148";
+var version = "2.0.28-dev.1982+a57dec3f";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,9 +1,9 @@
 const require_chunk = require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-DekYA6RV.cjs");
-let node_assert = require("node:assert");
+const require_request = require("./request-Ir4zMwN8.cjs");
 let node_test = require("node:test");
 let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process);
+let node_assert = require("node:assert");
 //#region src/request.test.ts
 (0, node_test.test)("getUserAgent()", () => {
 	if ("Deno" in globalThis) {

package/dist/tests/request.test.mjs

@@ -1,7 +1,7 @@
-import { o as version, r as getUserAgent } from "./request-C4ZUiyFP.mjs";
-import { deepStrictEqual } from "node:assert";
+import { o as version, r as getUserAgent } from "./request-ByxplZyY.mjs";
 import { test } from "node:test";
 import process from "node:process";
+import { deepStrictEqual } from "node:assert";
 //#region src/request.test.ts
 test("getUserAgent()", () => {
 	if ("Deno" in globalThis) {

package/dist/tests/temporal.test.cjs

@@ -1,6 +1,6 @@
 require("./chunk-Do9eywBl.cjs");
-let node_assert = require("node:assert");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 let _js_temporal_polyfill = require("@js-temporal/polyfill");
 //#region src/temporal.ts
 /**

package/dist/tests/temporal.test.mjs

@@ -1,5 +1,5 @@
-import { strictEqual } from "node:assert";
 import { test } from "node:test";
+import { strictEqual } from "node:assert";
 import { Temporal } from "@js-temporal/polyfill";
 //#region src/temporal.ts
 /**

package/dist/tests/url.test.cjs

@@ -1,7 +1,7 @@
 require("./chunk-Do9eywBl.cjs");
-const require_url = require("./url-CqwkmczT.cjs");
-let node_assert = require("node:assert");
+const require_url = require("./url-CWU5HT3Y.cjs");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 //#region src/url.test.ts
 (0, node_test.test)("validatePublicUrl()", async () => {
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("ftp://localhost"), require_url.UrlError);

package/dist/tests/url.test.mjs

@@ -1,6 +1,6 @@
-import { a as validateLookupAddresses, i as isValidPublicIPv6Address, n as expandIPv6Address, o as validatePublicUrl, r as isValidPublicIPv4Address, t as UrlError } from "./url-BulORwtj.mjs";
-import { deepStrictEqual, ok, rejects, throws } from "node:assert";
+import { a as validateLookupAddresses, i as isValidPublicIPv6Address, n as expandIPv6Address, o as validatePublicUrl, r as isValidPublicIPv4Address, t as UrlError } from "./url-o0e-aXQY.mjs";
 import { test } from "node:test";
+import { deepStrictEqual, ok, rejects, throws } from "node:assert";
 //#region src/url.test.ts
 test("validatePublicUrl()", async () => {
 	await rejects(() => validatePublicUrl("ftp://localhost"), UrlError);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.0.28-dev.1974+d70e3148",
+  "version": "2.0.28-dev.1982+a57dec3f",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/body.test.ts

@@ -0,0 +1,125 @@
+import { deepStrictEqual, ok, rejects } from "node:assert/strict";
+import { test } from "node:test";
+import { gunzipSync, gzipSync } from "node:zlib";
+import { BodyTooLargeError, readBoundedText } from "./body.ts";
+
+const url = "https://example.com/document";
+
+test("readBoundedText handles empty bodies and flushes incomplete UTF-8", async () => {
+  deepStrictEqual(await readBoundedText(new Response(null), 1, url), "");
+  deepStrictEqual(await readBoundedText(new Response(""), 1, url), "");
+  deepStrictEqual(
+    await readBoundedText(new Response(new Uint8Array([0xe2, 0x82])), 2, url),
+    "\ufffd",
+  );
+});
+
+test("readBoundedText counts bytes and preserves split UTF-8", async () => {
+  const bytes = new TextEncoder().encode('"안녕"');
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const byte of bytes) controller.enqueue(new Uint8Array([byte]));
+      controller.close();
+    },
+  });
+  deepStrictEqual(
+    await readBoundedText(new Response(stream), bytes.length, url),
+    '"안녕"',
+  );
+  await rejects(
+    readBoundedText(new Response(bytes), bytes.length - 1, url),
+    BodyTooLargeError,
+  );
+});
+
+test("readBoundedText rejects a declared oversized body without pulling", async () => {
+  let pulled = false;
+  let canceled = false;
+  const response = new Response(
+    new ReadableStream({
+      pull() {
+        pulled = true;
+      },
+      cancel() {
+        canceled = true;
+      },
+    }, { highWaterMark: 0 }),
+    { headers: { "Content-Length": "100" } },
+  );
+  await rejects(readBoundedText(response, 10, url), BodyTooLargeError);
+  deepStrictEqual(pulled, false);
+  deepStrictEqual(canceled, true);
+  deepStrictEqual(response.body?.locked, false);
+});
+
+test("readBoundedText cancels chunked bodies despite absent or false lengths", async () => {
+  for (const length of [undefined, "1", "invalid"]) {
+    let pulls = 0;
+    let canceled = false;
+    const stream = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        pulls++;
+        controller.enqueue(new Uint8Array(4));
+      },
+      cancel() {
+        canceled = true;
+      },
+    }, { highWaterMark: 0 });
+    const response = new Response(stream, {
+      headers: length == null ? {} : { "Content-Length": length },
+    });
+    await rejects(readBoundedText(response, 8, url), BodyTooLargeError);
+    deepStrictEqual(pulls, 3);
+    deepStrictEqual(canceled, true);
+    deepStrictEqual(response.body?.locked, false);
+  }
+});
+
+test("readBoundedText limits decoded gzip bytes, not the compressed length", async () => {
+  const compressed = gzipSync('"' + "a".repeat(4096) + '"');
+  ok(compressed.length < 128);
+  const decoded = gunzipSync(compressed);
+  await rejects(
+    readBoundedText(
+      new Response(decoded, {
+        headers: {
+          "Content-Encoding": "gzip",
+          "Content-Length": String(compressed.length),
+        },
+      }),
+      128,
+      url,
+    ),
+    BodyTooLargeError,
+  );
+  // The encoded representation can also be larger than a valid decoded body.
+  deepStrictEqual(
+    await readBoundedText(
+      new Response("{}", {
+        headers: { "Content-Encoding": "gzip", "Content-Length": "22" },
+      }),
+      2,
+      url,
+    ),
+    "{}",
+  );
+});
+
+test("readBoundedText rejects invalid limits and releases failed streams", async () => {
+  for (const limit of [0, -1, NaN, Infinity, 1.5]) {
+    await rejects(readBoundedText(new Response("{}"), limit, url), RangeError);
+  }
+  const failure = new Error("broken stream");
+  const response = new Response(
+    new ReadableStream({
+      pull(controller) {
+        controller.error(failure);
+      },
+    }),
+  );
+  await rejects(
+    readBoundedText(response, 10, url),
+    (error) => error === failure,
+  );
+  deepStrictEqual(response.body?.locked, false);
+});

package/src/body.ts

@@ -0,0 +1,95 @@
+// Kept private in each package to avoid adding public API in a patch release.
+// TODO(Jiwon Kwon): Consolidate the duplicated body helpers in @fedify/vocab-runtime,
+// @fedify/webfinger, and @fedify/fedify into a shared implementation.
+import { getLogger } from "@logtape/logtape";
+import { FetchError } from "./request.ts";
+
+/** Decoded JSON body limit: 16 MiB.  @internal */
+export const MAX_BODY_SIZE: number = 16 * 1024 * 1024;
+
+/** A body exceeded the byte limit.  @internal */
+export class BodyTooLargeError extends FetchError {
+  /** Creates an error for a body exceeding the given limit. */
+  constructor(url: string | URL, maxBytes: number) {
+    super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+    this.name = "BodyTooLargeError";
+  }
+}
+
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes: number): void {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError(
+      "The body size limit must be a positive safe integer.",
+    );
+  }
+}
+
+/**
+ * Reads UTF-8 text while limiting bytes received from the body stream.
+ * Fetch responses are already decompressed, so the stream count is authoritative.
+ * @param message The response or request to read.
+ * @param maxBytes The maximum number of decoded bytes to read.
+ * @param url The URL to include in errors and logs.
+ * @returns The decoded body text.
+ * @throws {BodyTooLargeError} If the body exceeds the limit.
+ * @internal
+ */
+export async function readBoundedText(
+  message: Pick<Request, "body" | "headers">,
+  maxBytes: number,
+  url: string | URL,
+): Promise<string> {
+  validateBodySizeLimit(maxBytes);
+  const reader = message.body?.getReader();
+  const tooLarge = (): never => {
+    getLogger(["fedify", "runtime", "body"]).warn(
+      "Body from {url} exceeds the limit of {maxBytes} bytes.",
+      { url: url.toString(), maxBytes },
+    );
+    throw new BodyTooLargeError(url, maxBytes);
+  };
+  try {
+    // Content-Length describes the encoded body when compression is used.
+    // Only use it as an early rejection for an unencoded body.
+    const length = message.headers.get("Content-Length");
+    const encoding = message.headers.get("Content-Encoding");
+    if (
+      (encoding == null || encoding.toLowerCase() === "identity") &&
+      length != null && /^\d+$/.test(length) && Number(length) > maxBytes
+    ) tooLarge();
+    if (reader == null) return "";
+    let size = 0;
+    const bounded = new ReadableStream<BufferSource>({
+      async pull(controller) {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          return;
+        }
+        size += value.byteLength;
+        if (size > maxBytes) tooLarge();
+        controller.enqueue(value);
+      },
+    }, { highWaterMark: 0 });
+    const textReader = bounded.pipeThrough(new TextDecoderStream()).getReader();
+    try {
+      const chunks: string[] = [];
+      while (true) {
+        const { done, value } = await textReader.read();
+        if (done) break;
+        chunks.push(value);
+      }
+      return chunks.join("");
+    } finally {
+      textReader.releaseLock();
+    }
+  } catch (error) {
+    // A cloned inbox request is a tee.  Awaiting one branch's cancellation
+    // would deadlock until the other branch is canceled by the inbox handler.
+    if (reader != null) void reader.cancel(error).catch(() => {});
+    throw error;
+  } finally {
+    reader?.releaseLock();
+  }
+}

package/src/docloader.test.ts

@@ -1,9 +1,11 @@
 import fetchMock from "fetch-mock";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
+import { createServer } from "node:http";
+import { gzipSync } from "node:zlib";
 import preloadedContexts from "./contexts.ts";
 import cidV1Context from "./contexts/cid-v1.json" with { type: "json" };
-import { getDocumentLoader } from "./docloader.ts";
+import { getDocumentLoader, getRemoteDocument } from "./docloader.ts";
 import { FetchError } from "./request.ts";
 import { UrlError } from "./url.ts";
 
@@ -499,3 +501,124 @@ test("getDocumentLoader()", async (t) => {
 
   fetchMock.hardReset();
 });
+
+test("getDocumentLoader() bounds JSON, HTML, and alternate documents", async () => {
+  const url = "https://example.com/bounded";
+  fetchMock.mockGlobal();
+  let oversized = true;
+  try {
+    fetchMock.get(url, () =>
+      new Response('{"name":"hello"}', {
+        headers: {
+          "Content-Type": "application/activity+json",
+          ...(oversized
+            ? { "Content-Length": String(16 * 1024 * 1024 + 1) }
+            : {}),
+        },
+      }));
+    const loader = getDocumentLoader({
+      allowPrivateAddress: true,
+    });
+    await rejects(loader(url), FetchError);
+    oversized = false;
+    deepStrictEqual((await loader(url)).document, { name: "hello" });
+    oversized = true;
+    fetchMock.get(
+      `${url}/html`,
+      () =>
+        new Response(" ".repeat(1024 * 1024 + 1), {
+          headers: { "Content-Type": "text/html" },
+        }),
+    );
+    await rejects(
+      getDocumentLoader({ allowPrivateAddress: true })(`${url}/html`),
+      FetchError,
+    );
+    fetchMock.get(`${url}/alternate`, () =>
+      new Response("", {
+        headers: {
+          "Content-Type": "text/html",
+          Link: `<${url}>; rel="alternate"; type="application/activity+json"`,
+        },
+      }));
+    await rejects(loader(`${url}/alternate`), FetchError);
+    fetchMock.get(`${url}/redirect`, {
+      status: 302,
+      headers: { Location: url },
+    });
+    await rejects(loader(`${url}/redirect`), FetchError);
+  } finally {
+    fetchMock.hardReset();
+  }
+});
+
+test("getDocumentLoader() rejects oversized gzip responses from fetch", async () => {
+  const document = { name: "a".repeat(16 * 1024 * 1024) };
+  const compressed = gzipSync(JSON.stringify(document));
+  ok(compressed.byteLength < 64 * 1024);
+  const server = createServer((request, response) => {
+    const body = request.url === "/small"
+      ? gzipSync('{"name":"hello"}')
+      : compressed;
+    response.writeHead(200, {
+      "Content-Type": "application/activity+json",
+      "Content-Encoding": "gzip",
+      "Content-Length": body.byteLength,
+    });
+    response.end(body);
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  try {
+    const address = server.address();
+    ok(address != null && typeof address !== "string");
+    const url = `http://127.0.0.1:${address.port}/document`;
+    await rejects(
+      getDocumentLoader({
+        allowPrivateAddress: true,
+      })(url),
+      FetchError,
+    );
+    deepStrictEqual(
+      (await getDocumentLoader({
+        allowPrivateAddress: true,
+      })(new URL("/small", url).href)).document,
+      { name: "hello" },
+    );
+  } finally {
+    await new Promise<void>((resolve, reject) => {
+      server.close((error) => error == null ? resolve() : reject(error));
+      server.closeAllConnections();
+    });
+  }
+});
+
+test("getRemoteDocument() bounds JSON by default", async () => {
+  let canceled = false;
+  let pulls = 0;
+  const response = new Response(
+    new ReadableStream({
+      pull(controller) {
+        pulls++;
+        controller.enqueue(new Uint8Array(64 * 1024).fill(32));
+      },
+      cancel() {
+        canceled = true;
+      },
+    }, { highWaterMark: 0 }),
+  );
+  await rejects(
+    getRemoteDocument(
+      "https://example.com/document",
+      response,
+      () => {
+        throw new Error("Unexpected alternate document");
+      },
+    ),
+    FetchError,
+  );
+  deepStrictEqual(canceled, true);
+  deepStrictEqual(pulls, 257);
+});

package/src/docloader.ts

@@ -1,6 +1,7 @@
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import metadata from "../deno.json" with { type: "json" };
+import { MAX_BODY_SIZE, readBoundedText } from "./body.ts";
 import preloadedContexts from "./contexts.ts";
 import { HttpHeaderLink } from "./link.ts";
 import {
@@ -194,55 +195,52 @@ export async function getRemoteDocument(
   ) {
     // Security: Limit HTML response size to mitigate ReDoS attacks
     const MAX_HTML_SIZE = 1024 * 1024; // 1MB
-    const html = await response.text();
-    if (html.length > MAX_HTML_SIZE) {
-      logger.warn(
-        "HTML response too large, skipping alternate link discovery: {url}",
-        { url: documentUrl, size: html.length },
-      );
-      document = JSON.parse(html);
-    } else {
-      // Safe regex patterns without nested quantifiers to prevent ReDoS
-      // (CVE-2025-68475)
-      // Step 1: Extract <a ...> or <link ...> tags
-      const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
-      // Step 2: Parse attributes
-      const attrPattern =
-        /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+    const html = await readBoundedText(
+      response,
+      MAX_HTML_SIZE,
+      documentUrl,
+    );
+    // Safe regex patterns without nested quantifiers to prevent ReDoS
+    // (CVE-2025-68475)
+    // Step 1: Extract <a ...> or <link ...> tags
+    const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
+    // Step 2: Parse attributes
+    const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 
-      let tagMatch: RegExpExecArray | null;
-      while ((tagMatch = tagPattern.exec(html)) !== null) {
-        const tagContent = tagMatch[2];
-        let attrMatch: RegExpExecArray | null;
-        const attribs: Record<string, string> = {};
+    let tagMatch: RegExpExecArray | null;
+    while ((tagMatch = tagPattern.exec(html)) !== null) {
+      const tagContent = tagMatch[2];
+      let attrMatch: RegExpExecArray | null;
+      const attribs: Record<string, string> = {};
 
-        // Reset regex state for attribute parsing
-        attrPattern.lastIndex = 0;
-        while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
-          const key = attrMatch[1].toLowerCase();
-          const value = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
-          attribs[key] = value;
-        }
+      // Reset regex state for attribute parsing
+      attrPattern.lastIndex = 0;
+      while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
+        const key = attrMatch[1].toLowerCase();
+        const value = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
+        attribs[key] = value;
+      }
 
-        if (
-          attribs.rel === "alternate" && "type" in attribs && (
-            attribs.type === "application/activity+json" ||
-            attribs.type === "application/ld+json" ||
-            attribs.type.startsWith("application/ld+json;")
-          ) && "href" in attribs &&
-          new URL(attribs.href, docUrl).href !== docUrl.href
-        ) {
-          logger.debug(
-            "Found alternate document: {alternateUrl} from {url}",
-            { alternateUrl: attribs.href, url: documentUrl },
-          );
-          return await fetch(new URL(attribs.href, docUrl).href);
-        }
+      if (
+        attribs.rel === "alternate" && "type" in attribs && (
+          attribs.type === "application/activity+json" ||
+          attribs.type === "application/ld+json" ||
+          attribs.type.startsWith("application/ld+json;")
+        ) && "href" in attribs &&
+        new URL(attribs.href, docUrl).href !== docUrl.href
+      ) {
+        logger.debug(
+          "Found alternate document: {alternateUrl} from {url}",
+          { alternateUrl: attribs.href, url: documentUrl },
+        );
+        return await fetch(new URL(attribs.href, docUrl).href);
       }
-      document = JSON.parse(html);
     }
+    document = JSON.parse(html);
   } else {
-    document = await response.json();
+    document = JSON.parse(
+      await readBoundedText(response, MAX_BODY_SIZE, documentUrl),
+    );
   }
   logger.debug(
     "Fetched document: {status} {url} {headers}",