@fedify/vocab-runtime 2.2.0 → 2.2.1

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/mod.cjs

@@ -4383,7 +4383,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.2.0";
+var version = "2.2.1";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4650,8 +4650,13 @@ async function validatePublicUrl(url) {
 	const parsed = new URL(url);
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
 	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.substring(1, hostname.length - 2);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
 	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = (0, node_net.isIP)(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
 	if ("Deno" in globalThis && !(0, node_net.isIP)(hostname)) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
@@ -4665,7 +4670,11 @@ async function validatePublicUrl(url) {
 	} catch {
 		addresses = [];
 	}
-	for (const { address, family } of addresses) if (family === 4 && !isValidPublicIPv4Address(address) || family === 6 && !isValidPublicIPv6Address(address) || family < 4 || family === 5 || family > 6) throw new UrlError(`Invalid or private address: ${address}`);
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
 }
 function isValidPublicIPv4Address(address) {
 	const parts = address.split(".");

package/dist/mod.js

@@ -4379,7 +4379,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.2.0";
+var version = "2.2.1";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4646,8 +4646,13 @@ async function validatePublicUrl(url) {
 	const parsed = new URL(url);
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
 	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.substring(1, hostname.length - 2);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
 	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = isIP(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
 	if ("Deno" in globalThis && !isIP(hostname)) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
@@ -4661,7 +4666,11 @@ async function validatePublicUrl(url) {
 	} catch {
 		addresses = [];
 	}
-	for (const { address, family } of addresses) if (family === 4 && !isValidPublicIPv4Address(address) || family === 6 && !isValidPublicIPv6Address(address) || family < 4 || family === 5 || family > 6) throw new UrlError(`Invalid or private address: ${address}`);
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
 }
 function isValidPublicIPv4Address(address) {
 	const parts = address.split(".");

package/dist/tests/decimal.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-require("./docloader-Cm8MkfmU.cjs");
+require("./docloader-ptXlCCN2.cjs");
 require("./key-DTTIntwb.cjs");
 require("./multibase-F7LtMMsK.cjs");
 require("./langstr-CbAxaeEZ.cjs");

package/dist/tests/decimal.test.mjs

@@ -1,4 +1,4 @@
-import "./docloader-0xxbBwa9.mjs";
+import "./docloader-BmzhZFCE.mjs";
 import "./key-BeTHFQJK.mjs";
 import "./multibase-BgU9XRf7.mjs";
 import "./langstr-Di5AvKpB.mjs";

package/dist/tests/{docloader-0xxbBwa9.mjs → docloader-BmzhZFCE.mjs}

@@ -1,6 +1,6 @@
-import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-peBUF_HC.mjs";
+import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-DXYl4T3q.mjs";
 import { t as HttpHeaderLink } from "./link-NUUWCdnK.mjs";
-import { a as validatePublicUrl, t as UrlError } from "./url-BQ_kgmCk.mjs";
+import { a as validatePublicUrl, t as UrlError } from "./url-BzGwIxB4.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region src/contexts/activitystreams.json

package/dist/tests/{docloader-Cm8MkfmU.cjs → docloader-ptXlCCN2.cjs}

@@ -1,7 +1,7 @@
 require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-DLk6MHw1.cjs");
+const require_request = require("./request-CaVQlMm8.cjs");
 const require_link = require("./link-FguCydMA.cjs");
-const require_url = require("./url-pFuSds44.cjs");
+const require_url = require("./url-Cj9-Ycue.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#region src/contexts/activitystreams.json

package/dist/tests/docloader.test.cjs

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Do9eywBl.cjs");
-const require_docloader = require("./docloader-Cm8MkfmU.cjs");
-const require_request = require("./request-DLk6MHw1.cjs");
-const require_url = require("./url-pFuSds44.cjs");
+const require_docloader = require("./docloader-ptXlCCN2.cjs");
+const require_request = require("./request-CaVQlMm8.cjs");
+const require_url = require("./url-Cj9-Ycue.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region ../../node_modules/.pnpm/glob-to-regexp@0.4.1/node_modules/glob-to-regexp/index.js

package/dist/tests/docloader.test.mjs

@@ -1,6 +1,6 @@
-import { n as preloadedContexts, t as getDocumentLoader } from "./docloader-0xxbBwa9.mjs";
-import { t as FetchError } from "./request-peBUF_HC.mjs";
-import { t as UrlError } from "./url-BQ_kgmCk.mjs";
+import { n as preloadedContexts, t as getDocumentLoader } from "./docloader-BmzhZFCE.mjs";
+import { t as FetchError } from "./request-DXYl4T3q.mjs";
+import { t as UrlError } from "./url-BzGwIxB4.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 //#region \0rolldown/runtime.js

package/dist/tests/{request-DLk6MHw1.cjs → request-CaVQlMm8.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.2.0";
+var version = "2.2.1";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-peBUF_HC.mjs → request-DXYl4T3q.mjs}

@@ -1,7 +1,7 @@
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.2.0";
+var version = "2.2.1";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-DLk6MHw1.cjs");
+const require_request = require("./request-CaVQlMm8.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 let node_process = require("node:process");

package/dist/tests/request.test.mjs

@@ -1,4 +1,4 @@
-import { o as version, r as getUserAgent } from "./request-peBUF_HC.mjs";
+import { o as version, r as getUserAgent } from "./request-DXYl4T3q.mjs";
 import { deepStrictEqual } from "node:assert";
 import { test } from "node:test";
 import process from "node:process";

package/dist/tests/{url-BQ_kgmCk.mjs → url-BzGwIxB4.mjs}

@@ -14,8 +14,13 @@ async function validatePublicUrl(url) {
 	const parsed = new URL(url);
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
 	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.substring(1, hostname.length - 2);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
 	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = isIP(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
 	if ("Deno" in globalThis && !isIP(hostname)) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
@@ -29,7 +34,11 @@ async function validatePublicUrl(url) {
 	} catch {
 		addresses = [];
 	}
-	for (const { address, family } of addresses) if (family === 4 && !isValidPublicIPv4Address(address) || family === 6 && !isValidPublicIPv6Address(address) || family < 4 || family === 5 || family > 6) throw new UrlError(`Invalid or private address: ${address}`);
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
 }
 function isValidPublicIPv4Address(address) {
 	const parts = address.split(".");

package/dist/tests/{url-pFuSds44.cjs → url-Cj9-Ycue.cjs}

@@ -15,8 +15,13 @@ async function validatePublicUrl(url) {
 	const parsed = new URL(url);
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
 	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.substring(1, hostname.length - 2);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
 	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = (0, node_net.isIP)(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
 	if ("Deno" in globalThis && !(0, node_net.isIP)(hostname)) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
@@ -30,7 +35,11 @@ async function validatePublicUrl(url) {
 	} catch {
 		addresses = [];
 	}
-	for (const { address, family } of addresses) if (family === 4 && !isValidPublicIPv4Address(address) || family === 6 && !isValidPublicIPv6Address(address) || family < 4 || family === 5 || family > 6) throw new UrlError(`Invalid or private address: ${address}`);
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
 }
 function isValidPublicIPv4Address(address) {
 	const parts = address.split(".");

package/dist/tests/url.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-const require_url = require("./url-pFuSds44.cjs");
+const require_url = require("./url-Cj9-Ycue.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region src/url.test.ts
@@ -9,6 +9,8 @@ let node_test = require("node:test");
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://localhost"), require_url.UrlError);
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://127.0.0.1"), require_url.UrlError);
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[::1]"), require_url.UrlError);
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("http://[::ffff:7f00:1]/"), require_url.UrlError);
+	await require_url.validatePublicUrl("https://[2001:db8::1]");
 });
 (0, node_test.test)("isValidPublicIPv4Address()", () => {
 	(0, node_assert.ok)(require_url.isValidPublicIPv4Address("8.8.8.8"));
@@ -25,6 +27,7 @@ let node_test = require("node:test");
 	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("fe80::1"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("ff00::1"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("::"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("::ffff:7f00:1"));
 });
 (0, node_test.test)("expandIPv6Address()", () => {
 	(0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");

package/dist/tests/url.test.mjs

@@ -1,4 +1,4 @@
-import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-BQ_kgmCk.mjs";
+import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-BzGwIxB4.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 //#region src/url.test.ts
@@ -8,6 +8,8 @@ test("validatePublicUrl()", async () => {
 	await rejects(() => validatePublicUrl("https://localhost"), UrlError);
 	await rejects(() => validatePublicUrl("https://127.0.0.1"), UrlError);
 	await rejects(() => validatePublicUrl("https://[::1]"), UrlError);
+	await rejects(() => validatePublicUrl("http://[::ffff:7f00:1]/"), UrlError);
+	await validatePublicUrl("https://[2001:db8::1]");
 });
 test("isValidPublicIPv4Address()", () => {
 	ok(isValidPublicIPv4Address("8.8.8.8"));
@@ -24,6 +26,7 @@ test("isValidPublicIPv6Address()", () => {
 	ok(!isValidPublicIPv6Address("fe80::1"));
 	ok(!isValidPublicIPv6Address("ff00::1"));
 	ok(!isValidPublicIPv6Address("::"));
+	ok(!isValidPublicIPv6Address("::ffff:7f00:1"));
 });
 test("expandIPv6Address()", () => {
 	deepStrictEqual(expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/url.test.ts

@@ -19,6 +19,11 @@ test("validatePublicUrl()", async () => {
   await rejects(() => validatePublicUrl("https://localhost"), UrlError);
   await rejects(() => validatePublicUrl("https://127.0.0.1"), UrlError);
   await rejects(() => validatePublicUrl("https://[::1]"), UrlError);
+  await rejects(
+    () => validatePublicUrl("http://[::ffff:7f00:1]/"),
+    UrlError,
+  );
+  await validatePublicUrl("https://[2001:db8::1]");
 });
 
 test("isValidPublicIPv4Address()", () => {
@@ -37,6 +42,7 @@ test("isValidPublicIPv6Address()", () => {
   ok(!isValidPublicIPv6Address("fe80::1")); // link-local
   ok(!isValidPublicIPv6Address("ff00::1")); // multicast
   ok(!isValidPublicIPv6Address("::")); // unspecified
+  ok(!isValidPublicIPv6Address("::ffff:7f00:1")); // IPv4-mapped
 });
 
 test("expandIPv6Address()", () => {

package/src/url.ts

@@ -19,11 +19,16 @@ export async function validatePublicUrl(url: string): Promise<void> {
   }
   let hostname = parsed.hostname;
   if (hostname.startsWith("[") && hostname.endsWith("]")) {
-    hostname = hostname.substring(1, hostname.length - 2);
+    hostname = hostname.slice(1, -1);
   }
   if (hostname === "localhost") {
     throw new UrlError("Localhost is not allowed");
   }
+  const hostnameFamily = isIP(hostname);
+  if (hostnameFamily !== 0) {
+    validatePublicIpAddress(hostname, hostnameFamily);
+    return;
+  }
   if ("Deno" in globalThis && !isIP(hostname)) {
     // If the `net` permission is not granted, we can't resolve the hostname.
     // However, we can safely assume that it cannot gain access to private
@@ -50,14 +55,18 @@ export async function validatePublicUrl(url: string): Promise<void> {
     addresses = [];
   }
   for (const { address, family } of addresses) {
-    if (
-      family === 4 && !isValidPublicIPv4Address(address) ||
-      family === 6 && !isValidPublicIPv6Address(address) ||
-      family < 4 || family === 5 || family > 6
-    ) {
-      throw new UrlError(`Invalid or private address: ${address}`);
-    }
+    validatePublicIpAddress(address, family);
+  }
+}
+
+function validatePublicIpAddress(address: string, family: number): void {
+  if (
+    family === 4 && isValidPublicIPv4Address(address) ||
+    family === 6 && isValidPublicIPv6Address(address)
+  ) {
+    return;
   }
+  throw new UrlError(`Invalid or private address: ${address}`);
 }
 
 export function isValidPublicIPv4Address(address: string): boolean {