@fedify/vocab-runtime 2.3.7 → 2.3.8

package/src/docloader.test.ts

@@ -1,9 +1,11 @@
 import fetchMock from "fetch-mock";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
+import { createServer } from "node:http";
+import { gzipSync } from "node:zlib";
 import preloadedContexts from "./contexts.ts";
 import cidV1Context from "./contexts/cid-v1.json" with { type: "json" };
-import { getDocumentLoader } from "./docloader.ts";
+import { getDocumentLoader, getRemoteDocument } from "./docloader.ts";
 import { FetchError } from "./request.ts";
 import { UrlError } from "./url.ts";
 
@@ -518,3 +520,124 @@ test("getDocumentLoader()", async (t) => {
 
   fetchMock.hardReset();
 });
+
+test("getDocumentLoader() bounds JSON, HTML, and alternate documents", async () => {
+  const url = "https://example.com/bounded";
+  fetchMock.mockGlobal();
+  let oversized = true;
+  try {
+    fetchMock.get(url, () =>
+      new Response('{"name":"hello"}', {
+        headers: {
+          "Content-Type": "application/activity+json",
+          ...(oversized
+            ? { "Content-Length": String(16 * 1024 * 1024 + 1) }
+            : {}),
+        },
+      }));
+    const loader = getDocumentLoader({
+      allowPrivateAddress: true,
+    });
+    await rejects(loader(url), FetchError);
+    oversized = false;
+    deepStrictEqual((await loader(url)).document, { name: "hello" });
+    oversized = true;
+    fetchMock.get(
+      `${url}/html`,
+      () =>
+        new Response(" ".repeat(1024 * 1024 + 1), {
+          headers: { "Content-Type": "text/html" },
+        }),
+    );
+    await rejects(
+      getDocumentLoader({ allowPrivateAddress: true })(`${url}/html`),
+      FetchError,
+    );
+    fetchMock.get(`${url}/alternate`, () =>
+      new Response("", {
+        headers: {
+          "Content-Type": "text/html",
+          Link: `<${url}>; rel="alternate"; type="application/activity+json"`,
+        },
+      }));
+    await rejects(loader(`${url}/alternate`), FetchError);
+    fetchMock.get(`${url}/redirect`, {
+      status: 302,
+      headers: { Location: url },
+    });
+    await rejects(loader(`${url}/redirect`), FetchError);
+  } finally {
+    fetchMock.hardReset();
+  }
+});
+
+test("getDocumentLoader() rejects oversized gzip responses from fetch", async () => {
+  const document = { name: "a".repeat(16 * 1024 * 1024) };
+  const compressed = gzipSync(JSON.stringify(document));
+  ok(compressed.byteLength < 64 * 1024);
+  const server = createServer((request, response) => {
+    const body = request.url === "/small"
+      ? gzipSync('{"name":"hello"}')
+      : compressed;
+    response.writeHead(200, {
+      "Content-Type": "application/activity+json",
+      "Content-Encoding": "gzip",
+      "Content-Length": body.byteLength,
+    });
+    response.end(body);
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  try {
+    const address = server.address();
+    ok(address != null && typeof address !== "string");
+    const url = `http://127.0.0.1:${address.port}/document`;
+    await rejects(
+      getDocumentLoader({
+        allowPrivateAddress: true,
+      })(url),
+      FetchError,
+    );
+    deepStrictEqual(
+      (await getDocumentLoader({
+        allowPrivateAddress: true,
+      })(new URL("/small", url).href)).document,
+      { name: "hello" },
+    );
+  } finally {
+    await new Promise<void>((resolve, reject) => {
+      server.close((error) => error == null ? resolve() : reject(error));
+      server.closeAllConnections();
+    });
+  }
+});
+
+test("getRemoteDocument() bounds JSON by default", async () => {
+  let canceled = false;
+  let pulls = 0;
+  const response = new Response(
+    new ReadableStream({
+      pull(controller) {
+        pulls++;
+        controller.enqueue(new Uint8Array(64 * 1024).fill(32));
+      },
+      cancel() {
+        canceled = true;
+      },
+    }, { highWaterMark: 0 }),
+  );
+  await rejects(
+    getRemoteDocument(
+      "https://example.com/document",
+      response,
+      () => {
+        throw new Error("Unexpected alternate document");
+      },
+    ),
+    FetchError,
+  );
+  deepStrictEqual(canceled, true);
+  deepStrictEqual(pulls, 257);
+});

package/src/docloader.ts

@@ -1,6 +1,7 @@
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import metadata from "../deno.json" with { type: "json" };
+import { MAX_BODY_SIZE, readBoundedText } from "./body.ts";
 import preloadedContexts from "./contexts.ts";
 import { HttpHeaderLink } from "./link.ts";
 import {
@@ -202,55 +203,52 @@ export async function getRemoteDocument(
   ) {
     // Security: Limit HTML response size to mitigate ReDoS attacks
     const MAX_HTML_SIZE = 1024 * 1024; // 1MB
-    const html = await response.text();
-    if (html.length > MAX_HTML_SIZE) {
-      logger.warn(
-        "HTML response too large, skipping alternate link discovery: {url}",
-        { url: documentUrl, size: html.length },
-      );
-      document = JSON.parse(html);
-    } else {
-      // Safe regex patterns without nested quantifiers to prevent ReDoS
-      // (CVE-2025-68475)
-      // Step 1: Extract <a ...> or <link ...> tags
-      const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
-      // Step 2: Parse attributes
-      const attrPattern =
-        /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+    const html = await readBoundedText(
+      response,
+      MAX_HTML_SIZE,
+      documentUrl,
+    );
+    // Safe regex patterns without nested quantifiers to prevent ReDoS
+    // (CVE-2025-68475)
+    // Step 1: Extract <a ...> or <link ...> tags
+    const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
+    // Step 2: Parse attributes
+    const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 
-      let tagMatch: RegExpExecArray | null;
-      while ((tagMatch = tagPattern.exec(html)) !== null) {
-        const tagContent = tagMatch[2];
-        let attrMatch: RegExpExecArray | null;
-        const attribs: Record<string, string> = {};
+    let tagMatch: RegExpExecArray | null;
+    while ((tagMatch = tagPattern.exec(html)) !== null) {
+      const tagContent = tagMatch[2];
+      let attrMatch: RegExpExecArray | null;
+      const attribs: Record<string, string> = {};
 
-        // Reset regex state for attribute parsing
-        attrPattern.lastIndex = 0;
-        while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
-          const key = attrMatch[1].toLowerCase();
-          const value = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
-          attribs[key] = value;
-        }
+      // Reset regex state for attribute parsing
+      attrPattern.lastIndex = 0;
+      while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
+        const key = attrMatch[1].toLowerCase();
+        const value = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
+        attribs[key] = value;
+      }
 
-        if (
-          attribs.rel === "alternate" && "type" in attribs && (
-            attribs.type === "application/activity+json" ||
-            attribs.type === "application/ld+json" ||
-            attribs.type.startsWith("application/ld+json;")
-          ) && "href" in attribs &&
-          new URL(attribs.href, docUrl).href !== docUrl.href
-        ) {
-          logger.debug(
-            "Found alternate document: {alternateUrl} from {url}",
-            { alternateUrl: attribs.href, url: documentUrl },
-          );
-          return await fetch(new URL(attribs.href, docUrl).href);
-        }
+      if (
+        attribs.rel === "alternate" && "type" in attribs && (
+          attribs.type === "application/activity+json" ||
+          attribs.type === "application/ld+json" ||
+          attribs.type.startsWith("application/ld+json;")
+        ) && "href" in attribs &&
+        new URL(attribs.href, docUrl).href !== docUrl.href
+      ) {
+        logger.debug(
+          "Found alternate document: {alternateUrl} from {url}",
+          { alternateUrl: attribs.href, url: documentUrl },
+        );
+        return await fetch(new URL(attribs.href, docUrl).href);
       }
-      document = JSON.parse(html);
     }
+    document = JSON.parse(html);
   } else {
-    document = await response.json();
+    document = JSON.parse(
+      await readBoundedText(response, MAX_BODY_SIZE, documentUrl),
+    );
   }
   logger.debug(
     "Fetched document: {status} {url} {headers}",