@fedify/vocab-runtime 2.3.0-dev.1190 → 2.3.0-dev.1213

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. package/deno.json +1 -1
  2. package/dist/mod.cjs +121 -13
  3. package/dist/mod.js +121 -13
  4. package/dist/tests/decimal.test.cjs +2 -1
  5. package/dist/tests/decimal.test.mjs +2 -1
  6. package/dist/tests/{docloader-Coqazz9P.mjs → docloader-BooWKCyA.mjs} +2 -2
  7. package/dist/tests/{docloader-aUwU21a6.cjs → docloader-D4EeCNH1.cjs} +2 -2
  8. package/dist/tests/docloader.test.cjs +3 -3
  9. package/dist/tests/docloader.test.mjs +3 -3
  10. package/dist/tests/{request-CNHFDaDL.cjs → request-CiTYNt3o.cjs} +1 -1
  11. package/dist/tests/{request-B7FCvvvv.mjs → request-DgSDl3cq.mjs} +1 -1
  12. package/dist/tests/request.test.cjs +1 -1
  13. package/dist/tests/request.test.mjs +1 -1
  14. package/dist/tests/url-C20FhC7p.cjs +206 -0
  15. package/dist/tests/url-m9Qzxy-Y.mjs +176 -0
  16. package/dist/tests/url.test.cjs +52 -1
  17. package/dist/tests/url.test.mjs +52 -1
  18. package/package.json +1 -1
  19. package/src/url.test.ts +76 -0
  20. package/src/url.ts +182 -16
  21. package/dist/tests/url-BzGwIxB4.mjs +0 -68
  22. package/dist/tests/url-CEmGms8t.cjs +0 -98
package/dist/tests/url-m9Qzxy-Y.mjs ADDED
@@ -0,0 +1,176 @@
1
+ import { lookup } from "node:dns/promises";
2
+ import { isIP } from "node:net";
3
+ //#region src/url.ts
4
+ var UrlError = class extends Error {
5
+ constructor(message) {
6
+ super(message);
7
+ this.name = "UrlError";
8
+ }
9
+ };
10
+ /**
11
+ * Validates a URL to prevent SSRF attacks.
12
+ */
13
+ async function validatePublicUrl(url) {
14
+ const parsed = new URL(url);
15
+ if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
16
+ let hostname = parsed.hostname;
17
+ if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
18
+ if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
19
+ const hostnameFamily = isIP(hostname);
20
+ if (hostnameFamily !== 0) {
21
+ validatePublicIpAddress(hostname, hostnameFamily);
22
+ return;
23
+ }
24
+ if ("Deno" in globalThis && !isIP(hostname)) {
25
+ if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
26
+ }
27
+ if ("Bun" in globalThis) {
28
+ if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
29
+ else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
30
+ }
31
+ let addresses;
32
+ try {
33
+ addresses = await lookup(hostname, { all: true });
34
+ } catch {
35
+ addresses = [];
36
+ }
37
+ for (const { address, family } of addresses) validatePublicIpAddress(address, family);
38
+ }
39
+ function validatePublicIpAddress(address, family) {
40
+ if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
41
+ throw new UrlError(`Invalid or private address: ${address}`);
42
+ }
43
+ function isValidPublicIPv4Address(address) {
44
+ const parts = parseIPv4Address(address);
45
+ if (parts == null) return false;
46
+ const value = ipv4PartsToNumber(parts);
47
+ return !nonPublicIPv4Prefixes.some(({ base, prefix }) => matchesIPv4Prefix(value, base, prefix));
48
+ }
49
+ function isValidPublicIPv6Address(address) {
50
+ const words = parseIPv6Address(address);
51
+ if (words == null) return false;
52
+ if (nonPublicIPv6Prefixes.some(({ words: prefixWords, prefix }) => matchesIPv6Prefix(words, prefixWords, prefix))) return false;
53
+ for (const { extractIPv4, prefix, words: prefixWords } of ipv6WithIPv4Prefixes) {
54
+ if (!matchesIPv6Prefix(words, prefixWords, prefix)) continue;
55
+ const ipv4Address = extractIPv4(words);
56
+ if (ipv4Address != null && !isValidPublicIPv4Address(ipv4Address)) return false;
57
+ }
58
+ return true;
59
+ }
60
+ function expandIPv6Address(address) {
61
+ address = address.toLowerCase();
62
+ const ipv4Delimiter = address.lastIndexOf(":");
63
+ if (address.includes(".") && ipv4Delimiter >= 0) {
64
+ const ipv4Parts = parseIPv4Address(address.substring(ipv4Delimiter + 1));
65
+ if (ipv4Parts == null) return address;
66
+ const high = (ipv4Parts[0] << 8) + ipv4Parts[1];
67
+ const low = (ipv4Parts[2] << 8) + ipv4Parts[3];
68
+ address = address.substring(0, ipv4Delimiter + 1) + high.toString(16) + ":" + low.toString(16);
69
+ }
70
+ if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
71
+ if (address.startsWith("::")) address = "0000" + address;
72
+ if (address.endsWith("::")) address = address + "0000";
73
+ address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
74
+ return address.split(":").map((part) => part.padStart(4, "0")).join(":");
75
+ }
76
+ const nonPublicIPv4Prefixes = [
77
+ ipv4Prefix("0.0.0.0/8", "RFC 6890"),
78
+ ipv4Prefix("10.0.0.0/8", "RFC 1918"),
79
+ ipv4Prefix("100.64.0.0/10", "RFC 6598"),
80
+ ipv4Prefix("127.0.0.0/8", "RFC 1122"),
81
+ ipv4Prefix("169.254.0.0/16", "RFC 3927"),
82
+ ipv4Prefix("172.16.0.0/12", "RFC 1918"),
83
+ ipv4Prefix("192.0.0.0/24", "RFC 6890"),
84
+ ipv4Prefix("192.0.2.0/24", "RFC 5737"),
85
+ ipv4Prefix("192.88.99.0/24", "RFC 7526"),
86
+ ipv4Prefix("192.168.0.0/16", "RFC 1918"),
87
+ ipv4Prefix("198.18.0.0/15", "RFC 2544"),
88
+ ipv4Prefix("198.51.100.0/24", "RFC 5737"),
89
+ ipv4Prefix("203.0.113.0/24", "RFC 5737"),
90
+ ipv4Prefix("224.0.0.0/4", "RFC 5771"),
91
+ ipv4Prefix("240.0.0.0/4", "RFC 1112")
92
+ ];
93
+ const nonPublicIPv6Prefixes = [
94
+ ipv6Prefix("::/16", "RFC 4291"),
95
+ ipv6Prefix("2001::/32", "RFC 4380"),
96
+ ipv6Prefix("2002::/16", "RFC 3056"),
97
+ ipv6Prefix("64:ff9b:1::/48", "RFC 8215"),
98
+ ipv6Prefix("fc00::/7", "RFC 4193"),
99
+ ipv6Prefix("fe80::/10", "RFC 4291"),
100
+ ipv6Prefix("ff00::/8", "RFC 4291")
101
+ ];
102
+ const ipv6WithIPv4Prefixes = [{
103
+ ...ipv6Prefix("64:ff9b::/96", "RFC 6052"),
104
+ extractIPv4: (words) => ipv4FromWords(words[6], words[7])
105
+ }];
106
+ function ipv4Prefix(cidr, rfc) {
107
+ const [address, prefixText] = cidr.split("/");
108
+ const prefix = parseInt(prefixText, 10);
109
+ const parts = parseIPv4Address(address);
110
+ if (parts == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) throw new Error(`Invalid IPv4 prefix: ${cidr}`);
111
+ return {
112
+ cidr,
113
+ base: ipv4PartsToNumber(parts),
114
+ prefix,
115
+ rfc
116
+ };
117
+ }
118
+ function ipv6Prefix(cidr, rfc) {
119
+ const [address, prefixText] = cidr.split("/");
120
+ const prefix = parseInt(prefixText, 10);
121
+ const words = parseIPv6Address(address);
122
+ if (words == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 128) throw new Error(`Invalid IPv6 prefix: ${cidr}`);
123
+ return {
124
+ cidr,
125
+ words,
126
+ prefix,
127
+ rfc
128
+ };
129
+ }
130
+ function parseIPv4Address(address) {
131
+ const parts = address.split(".").map((part) => {
132
+ if (!/^\d+$/.test(part)) return NaN;
133
+ return parseInt(part, 10);
134
+ });
135
+ if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
136
+ return parts;
137
+ }
138
+ function parseIPv6Address(address) {
139
+ const parts = expandIPv6Address(address).split(":");
140
+ if (parts.length !== 8) return null;
141
+ const words = parts.map((part) => {
142
+ if (!/^[0-9a-f]{1,4}$/i.test(part)) return NaN;
143
+ return parseInt(part, 16);
144
+ });
145
+ if (words.some((word) => !Number.isInteger(word) || word < 0 || word > 65535)) return null;
146
+ return words;
147
+ }
148
+ function ipv4PartsToNumber(parts) {
149
+ return parts[0] * 2 ** 24 + parts[1] * 2 ** 16 + parts[2] * 2 ** 8 + parts[3];
150
+ }
151
+ function ipv4FromWords(highWord, lowWord) {
152
+ return [
153
+ highWord >> 8,
154
+ highWord & 255,
155
+ lowWord >> 8,
156
+ lowWord & 255
157
+ ].join(".");
158
+ }
159
+ function matchesIPv4Prefix(address, prefixBase, prefixLength) {
160
+ const blockSize = 2 ** (32 - prefixLength);
161
+ return Math.floor(address / blockSize) === Math.floor(prefixBase / blockSize);
162
+ }
163
+ function matchesIPv6Prefix(address, prefixWords, prefixLength) {
164
+ let remaining = prefixLength;
165
+ for (let i = 0; i < 8 && remaining > 0; i++) if (remaining >= 16) {
166
+ if (address[i] !== prefixWords[i]) return false;
167
+ remaining -= 16;
168
+ } else {
169
+ const mask = 65535 << 16 - remaining & 65535;
170
+ if ((address[i] & mask) !== (prefixWords[i] & mask)) return false;
171
+ remaining = 0;
172
+ }
173
+ return true;
174
+ }
175
+ //#endregion
176
+ export { validatePublicUrl as a, isValidPublicIPv6Address as i, expandIPv6Address as n, isValidPublicIPv4Address as r, UrlError as t };
package/dist/tests/url.test.cjs CHANGED
@@ -1,5 +1,5 @@
1
1
  require("./chunk-C2EiDwsr.cjs");
2
- const require_url = require("./url-CEmGms8t.cjs");
2
+ const require_url = require("./url-C20FhC7p.cjs");
3
3
  let node_assert = require("node:assert");
4
4
  let node_test = require("node:test");
5
5
  //#region src/url.test.ts
@@ -10,7 +10,24 @@ let node_test = require("node:test");
10
10
  await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://127.0.0.1"), require_url.UrlError);
11
11
  await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[::1]"), require_url.UrlError);
12
12
  await (0, node_assert.rejects)(() => require_url.validatePublicUrl("http://[::ffff:7f00:1]/"), require_url.UrlError);
13
+ await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[64:ff9b::7f00:1]/"), require_url.UrlError);
14
+ await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[64:ff9b::a00:1]/"), require_url.UrlError);
15
+ await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[64:ff9b:1::a00:1]/"), require_url.UrlError);
16
+ await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[64:ff9b:1::808:808]/"), require_url.UrlError);
17
+ await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[2001::]/"), require_url.UrlError);
18
+ await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[2002:a00:1::]/"), require_url.UrlError);
19
+ for (const url of [
20
+ "https://100.64.0.1",
21
+ "https://198.18.0.1",
22
+ "https://224.0.0.1",
23
+ "https://240.0.0.1",
24
+ "https://192.0.2.1",
25
+ "https://192.88.99.1",
26
+ "https://198.51.100.1",
27
+ "https://203.0.113.1"
28
+ ]) await (0, node_assert.rejects)(() => require_url.validatePublicUrl(url), require_url.UrlError);
13
29
  await require_url.validatePublicUrl("https://[2001:db8::1]");
30
+ await require_url.validatePublicUrl("https://[64:ff9b::8.8.8.8]");
14
31
  });
15
32
  (0, node_test.test)("isValidPublicIPv4Address()", () => {
16
33
  (0, node_assert.ok)(require_url.isValidPublicIPv4Address("8.8.8.8"));
@@ -19,6 +36,24 @@ let node_test = require("node:test");
19
36
  (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("10.0.0.1"));
20
37
  (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("127.16.0.1"));
21
38
  (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("169.254.0.1"));
39
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("100.64.0.1"));
40
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("100.127.255.255"));
41
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.0.0.1"));
42
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.0.2.1"));
43
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.88.99.0"));
44
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.88.99.1"));
45
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.88.99.2"));
46
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.88.99.255"));
47
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("198.18.0.1"));
48
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("198.19.255.255"));
49
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("198.51.100.1"));
50
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("203.0.113.1"));
51
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("224.0.0.1"));
52
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("239.255.255.255"));
53
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("240.0.0.1"));
54
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("255.255.255.255"));
55
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("1.2.3"));
56
+ (0, node_assert.ok)(!require_url.isValidPublicIPv4Address("999.1.1.1"));
22
57
  });
23
58
  (0, node_test.test)("isValidPublicIPv6Address()", () => {
24
59
  (0, node_assert.ok)(require_url.isValidPublicIPv6Address("2001:db8::1"));
@@ -28,11 +63,27 @@ let node_test = require("node:test");
28
63
  (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("ff00::1"));
29
64
  (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("::"));
30
65
  (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("::ffff:7f00:1"));
66
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b::7f00:1"));
67
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b::127.0.0.1"));
68
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b::a00:1"));
69
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b::10.0.0.1"));
70
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b:1::"));
71
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b:1::a00:1"));
72
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b:1::10.0.0.1"));
73
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2001::"));
74
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2001:0:4136:e378:8000:63bf:3fff:fdd2"));
75
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2002:a00:1::"));
76
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2002:7f00:1::"));
77
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2002:c0a8:1::"));
78
+ (0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2002:a9fe:1::"));
79
+ (0, node_assert.ok)(require_url.isValidPublicIPv6Address("64:ff9b::808:808"));
80
+ (0, node_assert.ok)(require_url.isValidPublicIPv6Address("64:ff9b::8.8.8.8"));
31
81
  });
32
82
  (0, node_test.test)("expandIPv6Address()", () => {
33
83
  (0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");
34
84
  (0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("::1"), "0000:0000:0000:0000:0000:0000:0000:0001");
35
85
  (0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("2001:db8::"), "2001:0db8:0000:0000:0000:0000:0000:0000");
36
86
  (0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("2001:db8::1"), "2001:0db8:0000:0000:0000:0000:0000:0001");
87
+ (0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("64:ff9b::8.8.8.8"), "0064:ff9b:0000:0000:0000:0000:0808:0808");
37
88
  });
38
89
  //#endregion
package/dist/tests/url.test.mjs CHANGED
@@ -1,4 +1,4 @@
1
- import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-BzGwIxB4.mjs";
1
+ import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-m9Qzxy-Y.mjs";
2
2
  import { deepStrictEqual, ok, rejects } from "node:assert";
3
3
  import { test } from "node:test";
4
4
  //#region src/url.test.ts
@@ -9,7 +9,24 @@ test("validatePublicUrl()", async () => {
9
9
  await rejects(() => validatePublicUrl("https://127.0.0.1"), UrlError);
10
10
  await rejects(() => validatePublicUrl("https://[::1]"), UrlError);
11
11
  await rejects(() => validatePublicUrl("http://[::ffff:7f00:1]/"), UrlError);
12
+ await rejects(() => validatePublicUrl("https://[64:ff9b::7f00:1]/"), UrlError);
13
+ await rejects(() => validatePublicUrl("https://[64:ff9b::a00:1]/"), UrlError);
14
+ await rejects(() => validatePublicUrl("https://[64:ff9b:1::a00:1]/"), UrlError);
15
+ await rejects(() => validatePublicUrl("https://[64:ff9b:1::808:808]/"), UrlError);
16
+ await rejects(() => validatePublicUrl("https://[2001::]/"), UrlError);
17
+ await rejects(() => validatePublicUrl("https://[2002:a00:1::]/"), UrlError);
18
+ for (const url of [
19
+ "https://100.64.0.1",
20
+ "https://198.18.0.1",
21
+ "https://224.0.0.1",
22
+ "https://240.0.0.1",
23
+ "https://192.0.2.1",
24
+ "https://192.88.99.1",
25
+ "https://198.51.100.1",
26
+ "https://203.0.113.1"
27
+ ]) await rejects(() => validatePublicUrl(url), UrlError);
12
28
  await validatePublicUrl("https://[2001:db8::1]");
29
+ await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
13
30
  });
14
31
  test("isValidPublicIPv4Address()", () => {
15
32
  ok(isValidPublicIPv4Address("8.8.8.8"));
@@ -18,6 +35,24 @@ test("isValidPublicIPv4Address()", () => {
18
35
  ok(!isValidPublicIPv4Address("10.0.0.1"));
19
36
  ok(!isValidPublicIPv4Address("127.16.0.1"));
20
37
  ok(!isValidPublicIPv4Address("169.254.0.1"));
38
+ ok(!isValidPublicIPv4Address("100.64.0.1"));
39
+ ok(!isValidPublicIPv4Address("100.127.255.255"));
40
+ ok(!isValidPublicIPv4Address("192.0.0.1"));
41
+ ok(!isValidPublicIPv4Address("192.0.2.1"));
42
+ ok(!isValidPublicIPv4Address("192.88.99.0"));
43
+ ok(!isValidPublicIPv4Address("192.88.99.1"));
44
+ ok(!isValidPublicIPv4Address("192.88.99.2"));
45
+ ok(!isValidPublicIPv4Address("192.88.99.255"));
46
+ ok(!isValidPublicIPv4Address("198.18.0.1"));
47
+ ok(!isValidPublicIPv4Address("198.19.255.255"));
48
+ ok(!isValidPublicIPv4Address("198.51.100.1"));
49
+ ok(!isValidPublicIPv4Address("203.0.113.1"));
50
+ ok(!isValidPublicIPv4Address("224.0.0.1"));
51
+ ok(!isValidPublicIPv4Address("239.255.255.255"));
52
+ ok(!isValidPublicIPv4Address("240.0.0.1"));
53
+ ok(!isValidPublicIPv4Address("255.255.255.255"));
54
+ ok(!isValidPublicIPv4Address("1.2.3"));
55
+ ok(!isValidPublicIPv4Address("999.1.1.1"));
21
56
  });
22
57
  test("isValidPublicIPv6Address()", () => {
23
58
  ok(isValidPublicIPv6Address("2001:db8::1"));
@@ -27,12 +62,28 @@ test("isValidPublicIPv6Address()", () => {
27
62
  ok(!isValidPublicIPv6Address("ff00::1"));
28
63
  ok(!isValidPublicIPv6Address("::"));
29
64
  ok(!isValidPublicIPv6Address("::ffff:7f00:1"));
65
+ ok(!isValidPublicIPv6Address("64:ff9b::7f00:1"));
66
+ ok(!isValidPublicIPv6Address("64:ff9b::127.0.0.1"));
67
+ ok(!isValidPublicIPv6Address("64:ff9b::a00:1"));
68
+ ok(!isValidPublicIPv6Address("64:ff9b::10.0.0.1"));
69
+ ok(!isValidPublicIPv6Address("64:ff9b:1::"));
70
+ ok(!isValidPublicIPv6Address("64:ff9b:1::a00:1"));
71
+ ok(!isValidPublicIPv6Address("64:ff9b:1::10.0.0.1"));
72
+ ok(!isValidPublicIPv6Address("2001::"));
73
+ ok(!isValidPublicIPv6Address("2001:0:4136:e378:8000:63bf:3fff:fdd2"));
74
+ ok(!isValidPublicIPv6Address("2002:a00:1::"));
75
+ ok(!isValidPublicIPv6Address("2002:7f00:1::"));
76
+ ok(!isValidPublicIPv6Address("2002:c0a8:1::"));
77
+ ok(!isValidPublicIPv6Address("2002:a9fe:1::"));
78
+ ok(isValidPublicIPv6Address("64:ff9b::808:808"));
79
+ ok(isValidPublicIPv6Address("64:ff9b::8.8.8.8"));
30
80
  });
31
81
  test("expandIPv6Address()", () => {
32
82
  deepStrictEqual(expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");
33
83
  deepStrictEqual(expandIPv6Address("::1"), "0000:0000:0000:0000:0000:0000:0000:0001");
34
84
  deepStrictEqual(expandIPv6Address("2001:db8::"), "2001:0db8:0000:0000:0000:0000:0000:0000");
35
85
  deepStrictEqual(expandIPv6Address("2001:db8::1"), "2001:0db8:0000:0000:0000:0000:0000:0001");
86
+ deepStrictEqual(expandIPv6Address("64:ff9b::8.8.8.8"), "0064:ff9b:0000:0000:0000:0000:0808:0808");
36
87
  });
37
88
  //#endregion
38
89
  export {};
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@fedify/vocab-runtime",
3
- "version": "2.3.0-dev.1190+2dfa46e0",
3
+ "version": "2.3.0-dev.1213+8ffffeb8",
4
4
  "homepage": "https://fedify.dev/",
5
5
  "repository": {
6
6
  "type": "git",
package/src/url.test.ts CHANGED
@@ -23,7 +23,46 @@ test("validatePublicUrl()", async () => {
23
23
  () => validatePublicUrl("http://[::ffff:7f00:1]/"),
24
24
  UrlError,
25
25
  );
26
+ await rejects(
27
+ () => validatePublicUrl("https://[64:ff9b::7f00:1]/"),
28
+ UrlError,
29
+ );
30
+ await rejects(
31
+ () => validatePublicUrl("https://[64:ff9b::a00:1]/"),
32
+ UrlError,
33
+ );
34
+ await rejects(
35
+ () => validatePublicUrl("https://[64:ff9b:1::a00:1]/"),
36
+ UrlError,
37
+ );
38
+ await rejects(
39
+ () => validatePublicUrl("https://[64:ff9b:1::808:808]/"),
40
+ UrlError,
41
+ );
42
+ await rejects(
43
+ () => validatePublicUrl("https://[2001::]/"),
44
+ UrlError,
45
+ );
46
+ await rejects(
47
+ () => validatePublicUrl("https://[2002:a00:1::]/"),
48
+ UrlError,
49
+ );
50
+ for (
51
+ const url of [
52
+ "https://100.64.0.1",
53
+ "https://198.18.0.1",
54
+ "https://224.0.0.1",
55
+ "https://240.0.0.1",
56
+ "https://192.0.2.1",
57
+ "https://192.88.99.1",
58
+ "https://198.51.100.1",
59
+ "https://203.0.113.1",
60
+ ]
61
+ ) {
62
+ await rejects(() => validatePublicUrl(url), UrlError);
63
+ }
26
64
  await validatePublicUrl("https://[2001:db8::1]");
65
+ await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
27
66
  });
28
67
 
29
68
  test("isValidPublicIPv4Address()", () => {
@@ -33,6 +72,24 @@ test("isValidPublicIPv4Address()", () => {
33
72
  ok(!isValidPublicIPv4Address("10.0.0.1")); // private
34
73
  ok(!isValidPublicIPv4Address("127.16.0.1")); // private
35
74
  ok(!isValidPublicIPv4Address("169.254.0.1")); // link-local
75
+ ok(!isValidPublicIPv4Address("100.64.0.1")); // shared address space
76
+ ok(!isValidPublicIPv4Address("100.127.255.255"));
77
+ ok(!isValidPublicIPv4Address("192.0.0.1")); // IETF protocol
78
+ ok(!isValidPublicIPv4Address("192.0.2.1")); // documentation
79
+ ok(!isValidPublicIPv4Address("192.88.99.0")); // 6to4 relay anycast
80
+ ok(!isValidPublicIPv4Address("192.88.99.1"));
81
+ ok(!isValidPublicIPv4Address("192.88.99.2")); // 6a44 relay anycast
82
+ ok(!isValidPublicIPv4Address("192.88.99.255"));
83
+ ok(!isValidPublicIPv4Address("198.18.0.1")); // benchmarking
84
+ ok(!isValidPublicIPv4Address("198.19.255.255"));
85
+ ok(!isValidPublicIPv4Address("198.51.100.1")); // documentation
86
+ ok(!isValidPublicIPv4Address("203.0.113.1")); // documentation
87
+ ok(!isValidPublicIPv4Address("224.0.0.1")); // multicast
88
+ ok(!isValidPublicIPv4Address("239.255.255.255"));
89
+ ok(!isValidPublicIPv4Address("240.0.0.1")); // reserved
90
+ ok(!isValidPublicIPv4Address("255.255.255.255")); // broadcast
91
+ ok(!isValidPublicIPv4Address("1.2.3"));
92
+ ok(!isValidPublicIPv4Address("999.1.1.1"));
36
93
  });
37
94
 
38
95
  test("isValidPublicIPv6Address()", () => {
@@ -43,6 +100,21 @@ test("isValidPublicIPv6Address()", () => {
43
100
  ok(!isValidPublicIPv6Address("ff00::1")); // multicast
44
101
  ok(!isValidPublicIPv6Address("::")); // unspecified
45
102
  ok(!isValidPublicIPv6Address("::ffff:7f00:1")); // IPv4-mapped
103
+ ok(!isValidPublicIPv6Address("64:ff9b::7f00:1")); // NAT64 localhost
104
+ ok(!isValidPublicIPv6Address("64:ff9b::127.0.0.1"));
105
+ ok(!isValidPublicIPv6Address("64:ff9b::a00:1")); // NAT64 private
106
+ ok(!isValidPublicIPv6Address("64:ff9b::10.0.0.1"));
107
+ ok(!isValidPublicIPv6Address("64:ff9b:1::")); // local-use NAT64
108
+ ok(!isValidPublicIPv6Address("64:ff9b:1::a00:1"));
109
+ ok(!isValidPublicIPv6Address("64:ff9b:1::10.0.0.1"));
110
+ ok(!isValidPublicIPv6Address("2001::")); // Teredo
111
+ ok(!isValidPublicIPv6Address("2001:0:4136:e378:8000:63bf:3fff:fdd2"));
112
+ ok(!isValidPublicIPv6Address("2002:a00:1::")); // 6to4
113
+ ok(!isValidPublicIPv6Address("2002:7f00:1::"));
114
+ ok(!isValidPublicIPv6Address("2002:c0a8:1::"));
115
+ ok(!isValidPublicIPv6Address("2002:a9fe:1::"));
116
+ ok(isValidPublicIPv6Address("64:ff9b::808:808")); // NAT64 public
117
+ ok(isValidPublicIPv6Address("64:ff9b::8.8.8.8"));
46
118
  });
47
119
 
48
120
  test("expandIPv6Address()", () => {
@@ -62,4 +134,8 @@ test("expandIPv6Address()", () => {
62
134
  expandIPv6Address("2001:db8::1"),
63
135
  "2001:0db8:0000:0000:0000:0000:0000:0001",
64
136
  );
137
+ deepStrictEqual(
138
+ expandIPv6Address("64:ff9b::8.8.8.8"),
139
+ "0064:ff9b:0000:0000:0000:0000:0808:0808",
140
+ );
65
141
  });
package/src/url.ts CHANGED
@@ -70,29 +70,45 @@ function validatePublicIpAddress(address: string, family: number): void {
70
70
  }
71
71
 
72
72
  export function isValidPublicIPv4Address(address: string): boolean {
73
- const parts = address.split(".");
74
- const first = parseInt(parts[0]);
75
- if (first === 0 || first === 10 || first === 127) return false;
76
- const second = parseInt(parts[1]);
77
- if (first === 169 && second === 254) return false;
78
- if (first === 172 && second >= 16 && second <= 31) return false;
79
- if (first === 192 && second === 168) return false;
80
- return true;
73
+ const parts = parseIPv4Address(address);
74
+ if (parts == null) return false;
75
+ const value = ipv4PartsToNumber(parts);
76
+ return !nonPublicIPv4Prefixes.some(({ base, prefix }) =>
77
+ matchesIPv4Prefix(value, base, prefix)
78
+ );
81
79
  }
82
80
 
83
81
  export function isValidPublicIPv6Address(address: string): boolean {
84
- address = expandIPv6Address(address);
85
- if (address.at(4) !== ":") return false;
86
- const firstWord = parseInt(address.substring(0, 4), 16);
87
- return !(
88
- (firstWord >= 0xfc00 && firstWord <= 0xfdff) || // ULA
89
- (firstWord >= 0xfe80 && firstWord <= 0xfebf) || // Link-local
90
- firstWord === 0 || firstWord >= 0xff00 // Multicast
91
- );
82
+ const words = parseIPv6Address(address);
83
+ if (words == null) return false;
84
+ if (
85
+ nonPublicIPv6Prefixes.some(({ words: prefixWords, prefix }) =>
86
+ matchesIPv6Prefix(words, prefixWords, prefix)
87
+ )
88
+ ) return false;
89
+ for (
90
+ const { extractIPv4, prefix, words: prefixWords } of ipv6WithIPv4Prefixes
91
+ ) {
92
+ if (!matchesIPv6Prefix(words, prefixWords, prefix)) continue;
93
+ const ipv4Address = extractIPv4(words);
94
+ if (ipv4Address != null && !isValidPublicIPv4Address(ipv4Address)) {
95
+ return false;
96
+ }
97
+ }
98
+ return true;
92
99
  }
93
100
 
94
101
  export function expandIPv6Address(address: string): string {
95
102
  address = address.toLowerCase();
103
+ const ipv4Delimiter = address.lastIndexOf(":");
104
+ if (address.includes(".") && ipv4Delimiter >= 0) {
105
+ const ipv4Parts = parseIPv4Address(address.substring(ipv4Delimiter + 1));
106
+ if (ipv4Parts == null) return address;
107
+ const high = (ipv4Parts[0] << 8) + ipv4Parts[1];
108
+ const low = (ipv4Parts[2] << 8) + ipv4Parts[3];
109
+ address = address.substring(0, ipv4Delimiter + 1) +
110
+ high.toString(16) + ":" + low.toString(16);
111
+ }
96
112
  if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
97
113
  if (address.startsWith("::")) address = "0000" + address;
98
114
  if (address.endsWith("::")) address = address + "0000";
@@ -103,3 +119,153 @@ export function expandIPv6Address(address: string): string {
103
119
  const parts = address.split(":");
104
120
  return parts.map((part) => part.padStart(4, "0")).join(":");
105
121
  }
122
+
123
+ type IPv4Prefix = {
124
+ cidr: string;
125
+ base: number;
126
+ prefix: number;
127
+ rfc: string;
128
+ };
129
+
130
+ // Keep CIDR and RFC metadata in the table instead of row comments so security
131
+ // reviewers can audit each blocked range without duplicating source text.
132
+ const nonPublicIPv4Prefixes = [
133
+ ipv4Prefix("0.0.0.0/8", "RFC 6890"),
134
+ ipv4Prefix("10.0.0.0/8", "RFC 1918"),
135
+ ipv4Prefix("100.64.0.0/10", "RFC 6598"),
136
+ ipv4Prefix("127.0.0.0/8", "RFC 1122"),
137
+ ipv4Prefix("169.254.0.0/16", "RFC 3927"),
138
+ ipv4Prefix("172.16.0.0/12", "RFC 1918"),
139
+ ipv4Prefix("192.0.0.0/24", "RFC 6890"),
140
+ ipv4Prefix("192.0.2.0/24", "RFC 5737"),
141
+ ipv4Prefix("192.88.99.0/24", "RFC 7526"),
142
+ ipv4Prefix("192.168.0.0/16", "RFC 1918"),
143
+ ipv4Prefix("198.18.0.0/15", "RFC 2544"),
144
+ ipv4Prefix("198.51.100.0/24", "RFC 5737"),
145
+ ipv4Prefix("203.0.113.0/24", "RFC 5737"),
146
+ ipv4Prefix("224.0.0.0/4", "RFC 5771"),
147
+ ipv4Prefix("240.0.0.0/4", "RFC 1112"),
148
+ ];
149
+
150
+ type IPv6Prefix = {
151
+ cidr: string;
152
+ words: number[];
153
+ prefix: number;
154
+ rfc: string;
155
+ };
156
+
157
+ const nonPublicIPv6Prefixes = [
158
+ ipv6Prefix("::/16", "RFC 4291"),
159
+ ipv6Prefix("2001::/32", "RFC 4380"),
160
+ ipv6Prefix("2002::/16", "RFC 3056"),
161
+ ipv6Prefix("64:ff9b:1::/48", "RFC 8215"),
162
+ ipv6Prefix("fc00::/7", "RFC 4193"),
163
+ ipv6Prefix("fe80::/10", "RFC 4291"),
164
+ ipv6Prefix("ff00::/8", "RFC 4291"),
165
+ ];
166
+
167
+ type IPv6WithIPv4Prefix = IPv6Prefix & {
168
+ extractIPv4: (words: number[]) => string | null;
169
+ };
170
+
171
+ // This table has one entry for now, but keeps embedded IPv4 extraction aligned
172
+ // with the CIDR metadata above if another translation prefix needs it later.
173
+ const ipv6WithIPv4Prefixes: IPv6WithIPv4Prefix[] = [
174
+ {
175
+ ...ipv6Prefix("64:ff9b::/96", "RFC 6052"),
176
+ extractIPv4: (words) => ipv4FromWords(words[6], words[7]),
177
+ },
178
+ ];
179
+
180
+ function ipv4Prefix(cidr: string, rfc: string): IPv4Prefix {
181
+ const [address, prefixText] = cidr.split("/");
182
+ const prefix = parseInt(prefixText, 10);
183
+ const parts = parseIPv4Address(address);
184
+ if (parts == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) {
185
+ throw new Error(`Invalid IPv4 prefix: ${cidr}`);
186
+ }
187
+ return { cidr, base: ipv4PartsToNumber(parts), prefix, rfc };
188
+ }
189
+
190
+ function ipv6Prefix(cidr: string, rfc: string): IPv6Prefix {
191
+ const [address, prefixText] = cidr.split("/");
192
+ const prefix = parseInt(prefixText, 10);
193
+ const words = parseIPv6Address(address);
194
+ if (
195
+ words == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 128
196
+ ) {
197
+ throw new Error(`Invalid IPv6 prefix: ${cidr}`);
198
+ }
199
+ return { cidr, words, prefix, rfc };
200
+ }
201
+
202
+ function parseIPv4Address(address: string): number[] | null {
203
+ const parts = address.split(".").map((part) => {
204
+ if (!/^\d+$/.test(part)) return NaN;
205
+ return parseInt(part, 10);
206
+ });
207
+ // Keep explicit bounds checks even though the regex narrows today's parser;
208
+ // they make future parser changes fail closed.
209
+ if (
210
+ parts.length !== 4 ||
211
+ parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)
212
+ ) return null;
213
+ return parts;
214
+ }
215
+
216
+ function parseIPv6Address(address: string): number[] | null {
217
+ const parts = expandIPv6Address(address).split(":");
218
+ if (parts.length !== 8) return null;
219
+ const words = parts.map((part) => {
220
+ if (!/^[0-9a-f]{1,4}$/i.test(part)) return NaN;
221
+ return parseInt(part, 16);
222
+ });
223
+ // Keep explicit bounds checks even though the regex narrows today's parser;
224
+ // they make future parser changes fail closed.
225
+ if (
226
+ words.some((word) => !Number.isInteger(word) || word < 0 || word > 0xffff)
227
+ ) return null;
228
+ return words;
229
+ }
230
+
231
+ function ipv4PartsToNumber(parts: number[]): number {
232
+ return parts[0] * 2 ** 24 + parts[1] * 2 ** 16 + parts[2] * 2 ** 8 +
233
+ parts[3];
234
+ }
235
+
236
+ function ipv4FromWords(highWord: number, lowWord: number): string {
237
+ return [
238
+ highWord >> 8,
239
+ highWord & 0xff,
240
+ lowWord >> 8,
241
+ lowWord & 0xff,
242
+ ].join(".");
243
+ }
244
+
245
+ function matchesIPv4Prefix(
246
+ address: number,
247
+ prefixBase: number,
248
+ prefixLength: number,
249
+ ): boolean {
250
+ const blockSize = 2 ** (32 - prefixLength);
251
+ return Math.floor(address / blockSize) === Math.floor(prefixBase / blockSize);
252
+ }
253
+
254
+ function matchesIPv6Prefix(
255
+ address: number[],
256
+ prefixWords: number[],
257
+ prefixLength: number,
258
+ ): boolean {
259
+ let remaining = prefixLength;
260
+ for (let i = 0; i < 8 && remaining > 0; i++) {
261
+ if (remaining >= 16) {
262
+ if (address[i] !== prefixWords[i]) return false;
263
+ remaining -= 16;
264
+ } else {
265
+ const mask = (0xffff << (16 - remaining)) & 0xffff;
266
+ if ((address[i] & mask) !== (prefixWords[i] & mask)) return false;
267
+ remaining = 0;
268
+ }
269
+ }
270
+ return true;
271
+ }