@fedify/vocab-runtime 2.0.35-dev.2480 → 2.0.35

package/dist/tests/{url-Qk1svKZU.cjs → url-DLuSj57U.cjs}

@@ -18,28 +18,65 @@ var UrlError = class extends Error {
 };
 /**
 * Validates a URL to prevent SSRF attacks.
+*
+* This function only checks the addresses that the hostname currently
+* resolves to; it does not pin the connection to those addresses.  A request
+* made after this check resolves the hostname again, so this function alone
+* does not prevent DNS rebinding.
 */
 async function validatePublicUrl(url) {
-	const parsed = new URL(url);
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
-	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
-	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
-	const hostnameFamily = (0, node_net.isIP)(hostname);
-	if (hostnameFamily !== 0) {
-		validatePublicIpAddress(hostname, hostnameFamily);
-		return;
-	}
-	if ("Deno" in globalThis && !(0, node_net.isIP)(hostname)) {
+	const { hostname, family } = parsePublicUrl(url);
+	if (family !== 0) return;
+	if ("Deno" in globalThis) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
 	if ("Bun" in globalThis) {
 		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
 		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
 	}
+	await lookupPublicAddresses(hostname, lookupAllAddresses);
+}
+/**
+* Resolves all addresses of the given hostname through `node:dns/promises`.
+* The default `dns` object is looked up on every call so that tests can still
+* stub `dns.lookup()`.
+* @internal
+*/
+function lookupAllAddresses(hostname) {
+	return node_dns_promises.default.lookup(hostname, { all: true });
+}
+/**
+* Checks the parts of a URL that can be validated without resolving it:
+* the protocol, the `localhost` hostname, and IP literal hostnames.
+* @throws {UrlError} If the URL is not allowed.
+* @internal
+*/
+function parsePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const family = (0, node_net.isIP)(hostname);
+	if (family !== 0) validatePublicIpAddress(hostname, family);
+	return {
+		url: parsed,
+		hostname,
+		family
+	};
+}
+/**
+* Resolves the given hostname and checks that every returned IP address is
+* public.
+* @returns The IP addresses of the hostname, without non-IP entries.
+* @throws {UrlError} If the lookup fails, returns no IP address, or returns
+*                    any non-public address.
+* @internal
+*/
+async function lookupPublicAddresses(hostname, lookup) {
 	let addresses;
 	try {
-		addresses = await node_dns_promises.default.lookup(hostname, { all: true });
+		addresses = await lookup(hostname);
 	} catch (error) {
 		throw new UrlError("DNS lookup failed", {
 			cause: error,
@@ -47,6 +84,21 @@ async function validatePublicUrl(url) {
 		});
 	}
 	validateLookupAddresses(addresses);
+	return addresses.filter(({ address }) => (0, node_net.isIP)(address) !== 0).map(({ address }) => ({
+		address,
+		family: (0, node_net.isIP)(address)
+	}));
+}
+/**
+* Checks that the given IP address is public.  This is used right before
+* connecting to an address that passed {@link lookupPublicAddresses}.
+* @throws {UrlError} If the address is not a public IP address.
+* @internal
+*/
+function assertPublicAddress(address) {
+	const family = (0, node_net.isIP)(address.address);
+	if (family === 0 || family !== address.family) throw new UrlError(`Invalid or private address: ${address.address}`);
+	validatePublicIpAddress(address.address, family);
 }
 /**
 * Validates the IP addresses returned by `node:dns.lookup()`.
@@ -218,6 +270,12 @@ Object.defineProperty(exports, "UrlError", {
 		return UrlError;
 	}
 });
+Object.defineProperty(exports, "assertPublicAddress", {
+	enumerable: true,
+	get: function() {
+		return assertPublicAddress;
+	}
+});
 Object.defineProperty(exports, "expandIPv6Address", {
 	enumerable: true,
 	get: function() {
@@ -236,6 +294,24 @@ Object.defineProperty(exports, "isValidPublicIPv6Address", {
 		return isValidPublicIPv6Address;
 	}
 });
+Object.defineProperty(exports, "lookupAllAddresses", {
+	enumerable: true,
+	get: function() {
+		return lookupAllAddresses;
+	}
+});
+Object.defineProperty(exports, "lookupPublicAddresses", {
+	enumerable: true,
+	get: function() {
+		return lookupPublicAddresses;
+	}
+});
+Object.defineProperty(exports, "parsePublicUrl", {
+	enumerable: true,
+	get: function() {
+		return parsePublicUrl;
+	}
+});
 Object.defineProperty(exports, "validateLookupAddresses", {
 	enumerable: true,
 	get: function() {

package/dist/tests/{url-DzlMS01z.mjs → url-DjsVF44Q.mjs}

@@ -16,28 +16,65 @@ var UrlError = class extends Error {
 };
 /**
 * Validates a URL to prevent SSRF attacks.
+*
+* This function only checks the addresses that the hostname currently
+* resolves to; it does not pin the connection to those addresses.  A request
+* made after this check resolves the hostname again, so this function alone
+* does not prevent DNS rebinding.
 */
 async function validatePublicUrl(url) {
-	const parsed = new URL(url);
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
-	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
-	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
-	const hostnameFamily = isIP(hostname);
-	if (hostnameFamily !== 0) {
-		validatePublicIpAddress(hostname, hostnameFamily);
-		return;
-	}
-	if ("Deno" in globalThis && !isIP(hostname)) {
+	const { hostname, family } = parsePublicUrl(url);
+	if (family !== 0) return;
+	if ("Deno" in globalThis) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
 	if ("Bun" in globalThis) {
 		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
 		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
 	}
+	await lookupPublicAddresses(hostname, lookupAllAddresses);
+}
+/**
+* Resolves all addresses of the given hostname through `node:dns/promises`.
+* The default `dns` object is looked up on every call so that tests can still
+* stub `dns.lookup()`.
+* @internal
+*/
+function lookupAllAddresses(hostname) {
+	return dns.lookup(hostname, { all: true });
+}
+/**
+* Checks the parts of a URL that can be validated without resolving it:
+* the protocol, the `localhost` hostname, and IP literal hostnames.
+* @throws {UrlError} If the URL is not allowed.
+* @internal
+*/
+function parsePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const family = isIP(hostname);
+	if (family !== 0) validatePublicIpAddress(hostname, family);
+	return {
+		url: parsed,
+		hostname,
+		family
+	};
+}
+/**
+* Resolves the given hostname and checks that every returned IP address is
+* public.
+* @returns The IP addresses of the hostname, without non-IP entries.
+* @throws {UrlError} If the lookup fails, returns no IP address, or returns
+*                    any non-public address.
+* @internal
+*/
+async function lookupPublicAddresses(hostname, lookup) {
 	let addresses;
 	try {
-		addresses = await dns.lookup(hostname, { all: true });
+		addresses = await lookup(hostname);
 	} catch (error) {
 		throw new UrlError("DNS lookup failed", {
 			cause: error,
@@ -45,6 +82,21 @@ async function validatePublicUrl(url) {
 		});
 	}
 	validateLookupAddresses(addresses);
+	return addresses.filter(({ address }) => isIP(address) !== 0).map(({ address }) => ({
+		address,
+		family: isIP(address)
+	}));
+}
+/**
+* Checks that the given IP address is public.  This is used right before
+* connecting to an address that passed {@link lookupPublicAddresses}.
+* @throws {UrlError} If the address is not a public IP address.
+* @internal
+*/
+function assertPublicAddress(address) {
+	const family = isIP(address.address);
+	if (family === 0 || family !== address.family) throw new UrlError(`Invalid or private address: ${address.address}`);
+	validatePublicIpAddress(address.address, family);
 }
 /**
 * Validates the IP addresses returned by `node:dns.lookup()`.
@@ -210,4 +262,4 @@ function matchesIPv6Prefix(address, prefixWords, prefixLength) {
 	return true;
 }
 //#endregion
-export { validateLookupAddresses as a, isValidPublicIPv6Address as i, expandIPv6Address as n, validatePublicUrl as o, isValidPublicIPv4Address as r, UrlError as t };
+export { isValidPublicIPv6Address as a, parsePublicUrl as c, isValidPublicIPv4Address as i, validateLookupAddresses as l, assertPublicAddress as n, lookupAllAddresses as o, expandIPv6Address as r, lookupPublicAddresses as s, UrlError as t, validatePublicUrl as u };

package/dist/tests/url.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-const require_url = require("./url-Qk1svKZU.cjs");
+const require_url = require("./url-DLuSj57U.cjs");
 let node_test = require("node:test");
 let node_assert = require("node:assert");
 //#region src/url.test.ts
@@ -52,6 +52,9 @@ let node_assert = require("node:assert");
 	await require_url.validatePublicUrl("https://[2001:db8::1]");
 	await require_url.validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
+(0, node_test.test)("validatePublicUrl() keeps rejecting fedify-test.internal on Bun", { skip: !("Bun" in globalThis) }, async () => {
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://fedify-test.internal/"), (error) => error instanceof require_url.UrlError && error.reason === "disallowed");
+});
 (0, node_test.test)("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
 	require_url.validateLookupAddresses([
 		{

package/dist/tests/url.test.mjs

@@ -1,4 +1,4 @@
-import { a as validateLookupAddresses, i as isValidPublicIPv6Address, n as expandIPv6Address, o as validatePublicUrl, r as isValidPublicIPv4Address, t as UrlError } from "./url-DzlMS01z.mjs";
+import { a as isValidPublicIPv6Address, i as isValidPublicIPv4Address, l as validateLookupAddresses, r as expandIPv6Address, t as UrlError, u as validatePublicUrl } from "./url-DjsVF44Q.mjs";
 import { test } from "node:test";
 import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert";
 //#region src/url.test.ts
@@ -51,6 +51,9 @@ test("validatePublicUrl()", async () => {
 	await validatePublicUrl("https://[2001:db8::1]");
 	await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
+test("validatePublicUrl() keeps rejecting fedify-test.internal on Bun", { skip: !("Bun" in globalThis) }, async () => {
+	await rejects(() => validatePublicUrl("https://fedify-test.internal/"), (error) => error instanceof UrlError && error.reason === "disallowed");
+});
 test("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
 	validateLookupAddresses([
 		{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.0.35-dev.2480+2330a2e7",
+  "version": "2.0.35",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -35,6 +35,16 @@
       "require": "./dist/mod.cjs",
       "default": "./dist/mod.js"
     },
+    "./internal": {
+      "types": {
+        "import": "./dist/internal.d.ts",
+        "require": "./dist/internal.d.cts",
+        "default": "./dist/internal.d.ts"
+      },
+      "import": "./dist/internal.js",
+      "require": "./dist/internal.cjs",
+      "default": "./dist/internal.js"
+    },
     "./jsonld": {
       "types": {
         "import": "./dist/jsonld.d.ts",
@@ -83,7 +93,8 @@
     "asn1js": "^3.0.6",
     "byte-encodings": "^1.0.11",
     "jsonld": "^9.0.0",
-    "pkijs": "^3.3.3"
+    "pkijs": "^3.3.3",
+    "undici": "^7.30.1"
   },
   "scripts": {
     "build:self": "tsdown",