@fedify/vocab-runtime 2.1.0 → 2.1.1

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/mod.cjs

@@ -4376,7 +4376,7 @@ var contexts_default = preloadedContexts;
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.1.0";
+var version = "2.1.1";
 var license = "MIT";
 var exports$1 = {
 	".": "./src/mod.ts",
@@ -4735,6 +4735,7 @@ const logger = (0, __logtape_logtape.getLogger)([
 	"runtime",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4853,31 +4854,33 @@ async function getRemoteDocument(url, response, fetch$1) {
 function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAgent } = {}) {
 	const tracerProvider = __opentelemetry_api.trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	async function load(url, options) {
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
-		if (!skipPreloadedContexts && url in contexts_default) {
-			logger.debug("Using preloaded context: {url}.", { url });
+		const currentUrl = new URL(url).href;
+		if (!skipPreloadedContexts && currentUrl in contexts_default) {
+			logger.debug("Using preloaded context: {url}.", { url: currentUrl });
 			return {
 				contextUrl: null,
-				document: contexts_default[url],
-				documentUrl: url
+				document: contexts_default[currentUrl],
+				documentUrl: currentUrl
 			};
 		}
 		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
+			await validatePublicUrl(currentUrl);
 		} catch (error) {
 			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
+				url: currentUrl,
 				error
 			});
 			throw error;
 		}
+		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
 			kind: __opentelemetry_api.SpanKind.CLIENT,
-			attributes: { "url.full": url }
+			attributes: { "url.full": currentUrl }
 		}, async (span) => {
 			try {
-				const request = createActivityPubRequest(url, { userAgent });
+				const request = createActivityPubRequest(currentUrl, { userAgent });
 				logRequest(logger, request);
 				const response = await fetch(request, {
 					redirect: "manual",
@@ -4885,11 +4888,25 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 				});
 				span.setAttribute("http.response.status_code", response.status);
 				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-					const redirectUrl = response.headers.get("Location");
+					if (redirected >= DEFAULT_MAX_REDIRECTION) {
+						logger.error("Too many redirections ({redirections}) while fetching document.", {
+							redirections: redirected + 1,
+							url: currentUrl
+						});
+						throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					}
+					const redirectUrl = new URL(response.headers.get("Location"), response.url === "" ? currentUrl : response.url).href;
 					span.setAttribute("http.redirect.url", redirectUrl);
-					return await load(redirectUrl, options);
+					if (visited.has(redirectUrl)) {
+						logger.error("Detected a redirect loop while fetching document: {url} -> {redirectUrl}", {
+							url: currentUrl,
+							redirectUrl
+						});
+						throw new FetchError(currentUrl, `Redirect loop detected: ${redirectUrl}`);
+					}
+					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(url, response, load);
+				const result = await getRemoteDocument(currentUrl, response, load);
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;

package/dist/mod.js

@@ -4375,7 +4375,7 @@ var contexts_default = preloadedContexts;
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.1.0";
+var version = "2.1.1";
 var license = "MIT";
 var exports = {
 	".": "./src/mod.ts",
@@ -4734,6 +4734,7 @@ const logger = getLogger([
 	"runtime",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4852,31 +4853,33 @@ async function getRemoteDocument(url, response, fetch$1) {
 function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAgent } = {}) {
 	const tracerProvider = trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	async function load(url, options) {
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
-		if (!skipPreloadedContexts && url in contexts_default) {
-			logger.debug("Using preloaded context: {url}.", { url });
+		const currentUrl = new URL(url).href;
+		if (!skipPreloadedContexts && currentUrl in contexts_default) {
+			logger.debug("Using preloaded context: {url}.", { url: currentUrl });
 			return {
 				contextUrl: null,
-				document: contexts_default[url],
-				documentUrl: url
+				document: contexts_default[currentUrl],
+				documentUrl: currentUrl
 			};
 		}
 		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
+			await validatePublicUrl(currentUrl);
 		} catch (error) {
 			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
+				url: currentUrl,
 				error
 			});
 			throw error;
 		}
+		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
 			kind: SpanKind.CLIENT,
-			attributes: { "url.full": url }
+			attributes: { "url.full": currentUrl }
 		}, async (span) => {
 			try {
-				const request = createActivityPubRequest(url, { userAgent });
+				const request = createActivityPubRequest(currentUrl, { userAgent });
 				logRequest(logger, request);
 				const response = await fetch(request, {
 					redirect: "manual",
@@ -4884,11 +4887,25 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 				});
 				span.setAttribute("http.response.status_code", response.status);
 				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-					const redirectUrl = response.headers.get("Location");
+					if (redirected >= DEFAULT_MAX_REDIRECTION) {
+						logger.error("Too many redirections ({redirections}) while fetching document.", {
+							redirections: redirected + 1,
+							url: currentUrl
+						});
+						throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					}
+					const redirectUrl = new URL(response.headers.get("Location"), response.url === "" ? currentUrl : response.url).href;
 					span.setAttribute("http.redirect.url", redirectUrl);
-					return await load(redirectUrl, options);
+					if (visited.has(redirectUrl)) {
+						logger.error("Detected a redirect loop while fetching document: {url} -> {redirectUrl}", {
+							url: currentUrl,
+							redirectUrl
+						});
+						throw new FetchError(currentUrl, `Redirect loop detected: ${redirectUrl}`);
+					}
+					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(url, response, load);
+				const result = await getRemoteDocument(currentUrl, response, load);
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;

package/dist/tests/decimal.test.cjs

@@ -1,6 +1,6 @@
 const require_chunk = require('./chunk-DWy1uDak.cjs');
-require('./docloader-D3nu2LmR.cjs');
-require('./request-DyrEDYQ-.cjs');
+require('./docloader-RQoMNF99.cjs');
+require('./request-kJU0S4zp.cjs');
 require('./link-DYNFAdNu.cjs');
 require('./url-DIjOdK8Q.cjs');
 require('./multicodec--6hQ74zI.cjs');

package/dist/tests/decimal.test.js

@@ -1,5 +1,5 @@
-import "./docloader-U31begIa.js";
-import "./request-BH_NlxCL.js";
+import "./docloader-DIUeF-5W.js";
+import "./request-D6fgLaP4.js";
 import "./link-C3q2TC2G.js";
 import "./url-CWEP9Zs9.js";
 import "./multicodec-Dq3IiOV4.js";

package/dist/tests/{docloader-U31begIa.js → docloader-DIUeF-5W.js}

@@ -1,4 +1,4 @@
-import { FetchError, createActivityPubRequest, deno_default, logRequest } from "./request-BH_NlxCL.js";
+import { FetchError, createActivityPubRequest, deno_default, logRequest } from "./request-D6fgLaP4.js";
 import { HttpHeaderLink } from "./link-C3q2TC2G.js";
 import { UrlError, validatePublicUrl } from "./url-CWEP9Zs9.js";
 import { getLogger } from "@logtape/logtape";
@@ -4373,6 +4373,7 @@ const logger = getLogger([
 	"runtime",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4491,31 +4492,33 @@ async function getRemoteDocument(url, response, fetch$1) {
 function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAgent } = {}) {
 	const tracerProvider = trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	async function load(url, options) {
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
-		if (!skipPreloadedContexts && url in contexts_default) {
-			logger.debug("Using preloaded context: {url}.", { url });
+		const currentUrl = new URL(url).href;
+		if (!skipPreloadedContexts && currentUrl in contexts_default) {
+			logger.debug("Using preloaded context: {url}.", { url: currentUrl });
 			return {
 				contextUrl: null,
-				document: contexts_default[url],
-				documentUrl: url
+				document: contexts_default[currentUrl],
+				documentUrl: currentUrl
 			};
 		}
 		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
+			await validatePublicUrl(currentUrl);
 		} catch (error) {
 			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
+				url: currentUrl,
 				error
 			});
 			throw error;
 		}
+		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
 			kind: SpanKind.CLIENT,
-			attributes: { "url.full": url }
+			attributes: { "url.full": currentUrl }
 		}, async (span) => {
 			try {
-				const request = createActivityPubRequest(url, { userAgent });
+				const request = createActivityPubRequest(currentUrl, { userAgent });
 				logRequest(logger, request);
 				const response = await fetch(request, {
 					redirect: "manual",
@@ -4523,11 +4526,25 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 				});
 				span.setAttribute("http.response.status_code", response.status);
 				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-					const redirectUrl = response.headers.get("Location");
+					if (redirected >= DEFAULT_MAX_REDIRECTION) {
+						logger.error("Too many redirections ({redirections}) while fetching document.", {
+							redirections: redirected + 1,
+							url: currentUrl
+						});
+						throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					}
+					const redirectUrl = new URL(response.headers.get("Location"), response.url === "" ? currentUrl : response.url).href;
 					span.setAttribute("http.redirect.url", redirectUrl);
-					return await load(redirectUrl, options);
+					if (visited.has(redirectUrl)) {
+						logger.error("Detected a redirect loop while fetching document: {url} -> {redirectUrl}", {
+							url: currentUrl,
+							redirectUrl
+						});
+						throw new FetchError(currentUrl, `Redirect loop detected: ${redirectUrl}`);
+					}
+					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(url, response, load);
+				const result = await getRemoteDocument(currentUrl, response, load);
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;

package/dist/tests/{docloader-D3nu2LmR.cjs → docloader-RQoMNF99.cjs}

@@ -1,5 +1,5 @@
 const require_chunk = require('./chunk-DWy1uDak.cjs');
-const require_request = require('./request-DyrEDYQ-.cjs');
+const require_request = require('./request-kJU0S4zp.cjs');
 const require_link = require('./link-DYNFAdNu.cjs');
 const require_url = require('./url-DIjOdK8Q.cjs');
 const __logtape_logtape = require_chunk.__toESM(require("@logtape/logtape"));
@@ -4374,6 +4374,7 @@ const logger = (0, __logtape_logtape.getLogger)([
 	"runtime",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4492,31 +4493,33 @@ async function getRemoteDocument(url, response, fetch$1) {
 function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAgent } = {}) {
 	const tracerProvider = __opentelemetry_api.trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(require_request.deno_default.name, require_request.deno_default.version);
-	async function load(url, options) {
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
-		if (!skipPreloadedContexts && url in contexts_default) {
-			logger.debug("Using preloaded context: {url}.", { url });
+		const currentUrl = new URL(url).href;
+		if (!skipPreloadedContexts && currentUrl in contexts_default) {
+			logger.debug("Using preloaded context: {url}.", { url: currentUrl });
 			return {
 				contextUrl: null,
-				document: contexts_default[url],
-				documentUrl: url
+				document: contexts_default[currentUrl],
+				documentUrl: currentUrl
 			};
 		}
 		if (!allowPrivateAddress) try {
-			await require_url.validatePublicUrl(url);
+			await require_url.validatePublicUrl(currentUrl);
 		} catch (error) {
 			if (error instanceof require_url.UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
+				url: currentUrl,
 				error
 			});
 			throw error;
 		}
+		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
 			kind: __opentelemetry_api.SpanKind.CLIENT,
-			attributes: { "url.full": url }
+			attributes: { "url.full": currentUrl }
 		}, async (span) => {
 			try {
-				const request = require_request.createActivityPubRequest(url, { userAgent });
+				const request = require_request.createActivityPubRequest(currentUrl, { userAgent });
 				require_request.logRequest(logger, request);
 				const response = await fetch(request, {
 					redirect: "manual",
@@ -4524,11 +4527,25 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 				});
 				span.setAttribute("http.response.status_code", response.status);
 				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-					const redirectUrl = response.headers.get("Location");
+					if (redirected >= DEFAULT_MAX_REDIRECTION) {
+						logger.error("Too many redirections ({redirections}) while fetching document.", {
+							redirections: redirected + 1,
+							url: currentUrl
+						});
+						throw new require_request.FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					}
+					const redirectUrl = new URL(response.headers.get("Location"), response.url === "" ? currentUrl : response.url).href;
 					span.setAttribute("http.redirect.url", redirectUrl);
-					return await load(redirectUrl, options);
+					if (visited.has(redirectUrl)) {
+						logger.error("Detected a redirect loop while fetching document: {url} -> {redirectUrl}", {
+							url: currentUrl,
+							redirectUrl
+						});
+						throw new require_request.FetchError(currentUrl, `Redirect loop detected: ${redirectUrl}`);
+					}
+					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(url, response, load);
+				const result = await getRemoteDocument(currentUrl, response, load);
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;

package/dist/tests/docloader.test.cjs

@@ -1,6 +1,6 @@
 const require_chunk = require('./chunk-DWy1uDak.cjs');
-const require_docloader = require('./docloader-D3nu2LmR.cjs');
-const require_request = require('./request-DyrEDYQ-.cjs');
+const require_docloader = require('./docloader-RQoMNF99.cjs');
+const require_request = require('./request-kJU0S4zp.cjs');
 require('./link-DYNFAdNu.cjs');
 const require_url = require('./url-DIjOdK8Q.cjs');
 const node_assert = require_chunk.__toESM(require("node:assert"));
@@ -1512,6 +1512,53 @@ var esm_default = FetchMock_default;
 		(0, node_assert.deepStrictEqual)(await fetchDocumentLoader2("https://example.com/localhost-redirect"), expected);
 		(0, node_assert.deepStrictEqual)(await fetchDocumentLoader2("https://example.com/localhost-link"), expected);
 	});
+	let redirectAttempts = 0;
+	esm_default.get("begin:https://example.com/too-many-redirects/", (cl) => {
+		redirectAttempts++;
+		const index = Number(cl.url.split("/").at(-1));
+		return {
+			status: 302,
+			headers: { Location: `https://example.com/too-many-redirects/${index + 1}` }
+		};
+	});
+	await t.test("too many redirects", async () => {
+		redirectAttempts = 0;
+		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/too-many-redirects/0"), require_request.FetchError, "Too many redirections");
+		(0, node_assert.deepStrictEqual)(redirectAttempts, 21);
+	});
+	let loopAttempts = 0;
+	esm_default.get("https://example.com/redirect-loop-a", () => {
+		loopAttempts++;
+		return {
+			status: 302,
+			headers: { Location: "https://example.com/redirect-loop-b" }
+		};
+	});
+	esm_default.get("https://example.com/redirect-loop-b", () => {
+		loopAttempts++;
+		return {
+			status: 302,
+			headers: { Location: "https://example.com/redirect-loop-a" }
+		};
+	});
+	await t.test("redirect loop", async () => {
+		loopAttempts = 0;
+		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/redirect-loop-a"), require_request.FetchError, "Redirect loop detected");
+		(0, node_assert.deepStrictEqual)(loopAttempts, 2);
+	});
+	let relativeLoopAttempts = 0;
+	esm_default.get("https://example.com/redirect-loop-relative", () => {
+		relativeLoopAttempts++;
+		return {
+			status: 302,
+			headers: { Location: "/redirect-loop-relative" }
+		};
+	});
+	await t.test("redirect loop with relative location", async () => {
+		relativeLoopAttempts = 0;
+		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/redirect-loop-relative"), require_request.FetchError, "Redirect loop detected");
+		(0, node_assert.deepStrictEqual)(relativeLoopAttempts, 1);
+	});
 	const maliciousPayload = "<a" + " a=\"b\"".repeat(30) + " ";
 	esm_default.get("https://example.com/redos", {
 		body: maliciousPayload,

package/dist/tests/docloader.test.js

@@ -1,5 +1,5 @@
-import { contexts_default, getDocumentLoader } from "./docloader-U31begIa.js";
-import { FetchError } from "./request-BH_NlxCL.js";
+import { contexts_default, getDocumentLoader } from "./docloader-DIUeF-5W.js";
+import { FetchError } from "./request-D6fgLaP4.js";
 import "./link-C3q2TC2G.js";
 import { UrlError } from "./url-CWEP9Zs9.js";
 import "node:module";
@@ -1538,6 +1538,53 @@ test("getDocumentLoader()", async (t) => {
 		deepStrictEqual(await fetchDocumentLoader2("https://example.com/localhost-redirect"), expected);
 		deepStrictEqual(await fetchDocumentLoader2("https://example.com/localhost-link"), expected);
 	});
+	let redirectAttempts = 0;
+	esm_default.get("begin:https://example.com/too-many-redirects/", (cl) => {
+		redirectAttempts++;
+		const index = Number(cl.url.split("/").at(-1));
+		return {
+			status: 302,
+			headers: { Location: `https://example.com/too-many-redirects/${index + 1}` }
+		};
+	});
+	await t.test("too many redirects", async () => {
+		redirectAttempts = 0;
+		await rejects(() => fetchDocumentLoader("https://example.com/too-many-redirects/0"), FetchError, "Too many redirections");
+		deepStrictEqual(redirectAttempts, 21);
+	});
+	let loopAttempts = 0;
+	esm_default.get("https://example.com/redirect-loop-a", () => {
+		loopAttempts++;
+		return {
+			status: 302,
+			headers: { Location: "https://example.com/redirect-loop-b" }
+		};
+	});
+	esm_default.get("https://example.com/redirect-loop-b", () => {
+		loopAttempts++;
+		return {
+			status: 302,
+			headers: { Location: "https://example.com/redirect-loop-a" }
+		};
+	});
+	await t.test("redirect loop", async () => {
+		loopAttempts = 0;
+		await rejects(() => fetchDocumentLoader("https://example.com/redirect-loop-a"), FetchError, "Redirect loop detected");
+		deepStrictEqual(loopAttempts, 2);
+	});
+	let relativeLoopAttempts = 0;
+	esm_default.get("https://example.com/redirect-loop-relative", () => {
+		relativeLoopAttempts++;
+		return {
+			status: 302,
+			headers: { Location: "/redirect-loop-relative" }
+		};
+	});
+	await t.test("redirect loop with relative location", async () => {
+		relativeLoopAttempts = 0;
+		await rejects(() => fetchDocumentLoader("https://example.com/redirect-loop-relative"), FetchError, "Redirect loop detected");
+		deepStrictEqual(relativeLoopAttempts, 1);
+	});
 	const maliciousPayload = "<a" + " a=\"b\"".repeat(30) + " ";
 	esm_default.get("https://example.com/redos", {
 		body: maliciousPayload,

package/dist/tests/{request-BH_NlxCL.js → request-D6fgLaP4.js}

@@ -2,7 +2,7 @@ import process from "node:process";
 
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.1.0";
+var version = "2.1.1";
 var license = "MIT";
 var exports = {
 	".": "./src/mod.ts",

package/dist/tests/{request-DyrEDYQ-.cjs → request-kJU0S4zp.cjs}

@@ -3,7 +3,7 @@ const node_process = require_chunk.__toESM(require("node:process"));
 
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.1.0";
+var version = "2.1.1";
 var license = "MIT";
 var exports$1 = {
 	".": "./src/mod.ts",

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_chunk = require('./chunk-DWy1uDak.cjs');
-const require_request = require('./request-DyrEDYQ-.cjs');
+const require_request = require('./request-kJU0S4zp.cjs');
 const node_assert = require_chunk.__toESM(require("node:assert"));
 const node_test = require_chunk.__toESM(require("node:test"));
 const node_process = require_chunk.__toESM(require("node:process"));

package/dist/tests/request.test.js

@@ -1,4 +1,4 @@
-import { deno_default, getUserAgent } from "./request-BH_NlxCL.js";
+import { deno_default, getUserAgent } from "./request-D6fgLaP4.js";
 import { deepStrictEqual } from "node:assert";
 import { test } from "node:test";
 import process from "node:process";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/docloader.test.ts

@@ -369,6 +369,73 @@ test("getDocumentLoader()", async (t) => {
     );
   });
 
+  let redirectAttempts = 0;
+  fetchMock.get("begin:https://example.com/too-many-redirects/", (cl) => {
+    redirectAttempts++;
+    const index = Number(cl.url.split("/").at(-1));
+    return {
+      status: 302,
+      headers: {
+        Location: `https://example.com/too-many-redirects/${index + 1}`,
+      },
+    };
+  });
+
+  await t.test("too many redirects", async () => {
+    redirectAttempts = 0;
+    await rejects(
+      () => fetchDocumentLoader("https://example.com/too-many-redirects/0"),
+      FetchError,
+      "Too many redirections",
+    );
+    deepStrictEqual(redirectAttempts, 21);
+  });
+
+  let loopAttempts = 0;
+  fetchMock.get("https://example.com/redirect-loop-a", () => {
+    loopAttempts++;
+    return {
+      status: 302,
+      headers: { Location: "https://example.com/redirect-loop-b" },
+    };
+  });
+  fetchMock.get("https://example.com/redirect-loop-b", () => {
+    loopAttempts++;
+    return {
+      status: 302,
+      headers: { Location: "https://example.com/redirect-loop-a" },
+    };
+  });
+
+  await t.test("redirect loop", async () => {
+    loopAttempts = 0;
+    await rejects(
+      () => fetchDocumentLoader("https://example.com/redirect-loop-a"),
+      FetchError,
+      "Redirect loop detected",
+    );
+    deepStrictEqual(loopAttempts, 2);
+  });
+
+  let relativeLoopAttempts = 0;
+  fetchMock.get("https://example.com/redirect-loop-relative", () => {
+    relativeLoopAttempts++;
+    return {
+      status: 302,
+      headers: { Location: "/redirect-loop-relative" },
+    };
+  });
+
+  await t.test("redirect loop with relative location", async () => {
+    relativeLoopAttempts = 0;
+    await rejects(
+      () => fetchDocumentLoader("https://example.com/redirect-loop-relative"),
+      FetchError,
+      "Redirect loop detected",
+    );
+    deepStrictEqual(relativeLoopAttempts, 1);
+  });
+
   // Regression test for ReDoS vulnerability (CVE-2025-68475)
   // Malicious HTML payload: <a a="b" a="b" ... (unclosed tag)
   // With the vulnerable regex, this causes catastrophic backtracking

package/src/docloader.ts

@@ -12,6 +12,7 @@ import {
 import { UrlError, validatePublicUrl } from "./url.ts";
 
 const logger = getLogger(["fedify", "runtime", "docloader"]);
+const DEFAULT_MAX_REDIRECTION = 20;
 
 /**
  * A remote JSON-LD document and its context fetched by
@@ -293,38 +294,45 @@ export function getDocumentLoader(
   async function load(
     url: string,
     options?: DocumentLoaderOptions,
+    redirected = 0,
+    visited = new Set<string>(),
   ): Promise<RemoteDocument> {
     options?.signal?.throwIfAborted();
-    if (!skipPreloadedContexts && url in preloadedContexts) {
-      logger.debug("Using preloaded context: {url}.", { url });
+    const currentUrl = new URL(url).href;
+    if (!skipPreloadedContexts && currentUrl in preloadedContexts) {
+      logger.debug("Using preloaded context: {url}.", { url: currentUrl });
       return {
         contextUrl: null,
-        document: preloadedContexts[url],
-        documentUrl: url,
+        document: preloadedContexts[currentUrl],
+        documentUrl: currentUrl,
       };
     }
     if (!allowPrivateAddress) {
       try {
-        await validatePublicUrl(url);
+        await validatePublicUrl(currentUrl);
       } catch (error) {
         if (error instanceof UrlError) {
-          logger.error("Disallowed private URL: {url}", { url, error });
+          logger.error("Disallowed private URL: {url}", {
+            url: currentUrl,
+            error,
+          });
         }
         throw error;
       }
     }
+    visited.add(currentUrl);
 
     return await tracer.startActiveSpan(
       "activitypub.fetch_document",
       {
         kind: SpanKind.CLIENT,
         attributes: {
-          "url.full": url,
+          "url.full": currentUrl,
         },
       },
       async (span) => {
         try {
-          const request = createActivityPubRequest(url, { userAgent });
+          const request = createActivityPubRequest(currentUrl, { userAgent });
           logRequest(logger, request);
           const response = await fetch(request, {
             // Since Bun has a bug that ignores the `Request.redirect` option,
@@ -340,12 +348,36 @@ export function getDocumentLoader(
             response.status >= 300 && response.status < 400 &&
             response.headers.has("Location")
           ) {
-            const redirectUrl = response.headers.get("Location")!;
+            if (redirected >= DEFAULT_MAX_REDIRECTION) {
+              logger.error(
+                "Too many redirections ({redirections}) while fetching document.",
+                { redirections: redirected + 1, url: currentUrl },
+              );
+              throw new FetchError(
+                currentUrl,
+                `Too many redirections (${redirected + 1})`,
+              );
+            }
+            const redirectUrl = new URL(
+              response.headers.get("Location")!,
+              response.url === "" ? currentUrl : response.url,
+            ).href;
             span.setAttribute("http.redirect.url", redirectUrl);
-            return await load(redirectUrl, options);
+            if (visited.has(redirectUrl)) {
+              logger.error(
+                "Detected a redirect loop while fetching document: {url} -> " +
+                  "{redirectUrl}",
+                { url: currentUrl, redirectUrl },
+              );
+              throw new FetchError(
+                currentUrl,
+                `Redirect loop detected: ${redirectUrl}`,
+              );
+            }
+            return await load(redirectUrl, options, redirected + 1, visited);
           }
 
-          const result = await getRemoteDocument(url, response, load);
+          const result = await getRemoteDocument(currentUrl, response, load);
           span.setAttribute("docloader.document_url", result.documentUrl);
           if (result.contextUrl != null) {
             span.setAttribute("docloader.context_url", result.contextUrl);