@fedify/vocab-runtime 2.4.0-dev.1567 → 2.4.0-dev.1570

package/deno.json

@@ -1,10 +1,9 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.1567+12e6a3c0",
+  "version": "2.4.0-dev.1570+f1b6aaa3",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",
-    "./internal/jsonld-cache": "./src/internal/jsonld-cache.ts",
     "./jsonld": "./src/jsonld.ts",
     "./temporal": "./src/temporal.ts"
   },

package/dist/mod.cjs

@@ -1,11 +1,12 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-M78iaK0I.cjs");
-const require_url = require("./url-BAdyyqAa.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process, 1);
+let node_dns_promises = require("node:dns/promises");
+let node_net = require("node:net");
 let asn1js = require("asn1js");
 let byte_encodings_base64 = require("byte-encodings/base64");
 let byte_encodings_base64url = require("byte-encodings/base64url");
@@ -4287,28 +4288,6 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
-	"https://w3id.org/fep/7aa9": { "@context": {
-		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
-		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
-		"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
-		"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
-		"topic": {
-			"@id": "https://w3id.org/fep/7aa9#topic",
-			"@type": "@id"
-		},
-		"featuredObject": {
-			"@id": "https://w3id.org/fep/7aa9#featuredObject",
-			"@type": "@id"
-		},
-		"canFeature": {
-			"@id": "https://w3id.org/fep/7aa9#canFeature",
-			"@type": "@id"
-		},
-		"featureAuthorization": {
-			"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
-			"@type": "@id"
-		}
-	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",
@@ -4367,7 +4346,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1567+12e6a3c0";
+var version = "2.4.0-dev.1570+f1b6aaa3";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4620,6 +4599,179 @@ function logRequest(logger, request) {
 	});
 }
 //#endregion
+//#region src/url.ts
+var UrlError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "UrlError";
+	}
+};
+/**
+* Validates a URL to prevent SSRF attacks.
+*/
+async function validatePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = (0, node_net.isIP)(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
+	if ("Deno" in globalThis && !(0, node_net.isIP)(hostname)) {
+		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
+	}
+	if ("Bun" in globalThis) {
+		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
+		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
+	}
+	let addresses;
+	try {
+		addresses = await (0, node_dns_promises.lookup)(hostname, { all: true });
+	} catch {
+		addresses = [];
+	}
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
+}
+function isValidPublicIPv4Address(address) {
+	const parts = parseIPv4Address(address);
+	if (parts == null) return false;
+	const value = ipv4PartsToNumber(parts);
+	return !nonPublicIPv4Prefixes.some(({ base, prefix }) => matchesIPv4Prefix(value, base, prefix));
+}
+function isValidPublicIPv6Address(address) {
+	const words = parseIPv6Address(address);
+	if (words == null) return false;
+	if (nonPublicIPv6Prefixes.some(({ words: prefixWords, prefix }) => matchesIPv6Prefix(words, prefixWords, prefix))) return false;
+	for (const { extractIPv4, prefix, words: prefixWords } of ipv6WithIPv4Prefixes) {
+		if (!matchesIPv6Prefix(words, prefixWords, prefix)) continue;
+		const ipv4Address = extractIPv4(words);
+		if (ipv4Address != null && !isValidPublicIPv4Address(ipv4Address)) return false;
+	}
+	return true;
+}
+function expandIPv6Address(address) {
+	address = address.toLowerCase();
+	const ipv4Delimiter = address.lastIndexOf(":");
+	if (address.includes(".") && ipv4Delimiter >= 0) {
+		const ipv4Parts = parseIPv4Address(address.substring(ipv4Delimiter + 1));
+		if (ipv4Parts == null) return address;
+		const high = (ipv4Parts[0] << 8) + ipv4Parts[1];
+		const low = (ipv4Parts[2] << 8) + ipv4Parts[3];
+		address = address.substring(0, ipv4Delimiter + 1) + high.toString(16) + ":" + low.toString(16);
+	}
+	if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
+	if (address.startsWith("::")) address = "0000" + address;
+	if (address.endsWith("::")) address = address + "0000";
+	address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
+	return address.split(":").map((part) => part.padStart(4, "0")).join(":");
+}
+const nonPublicIPv4Prefixes = [
+	ipv4Prefix("0.0.0.0/8", "RFC 6890"),
+	ipv4Prefix("10.0.0.0/8", "RFC 1918"),
+	ipv4Prefix("100.64.0.0/10", "RFC 6598"),
+	ipv4Prefix("127.0.0.0/8", "RFC 1122"),
+	ipv4Prefix("169.254.0.0/16", "RFC 3927"),
+	ipv4Prefix("172.16.0.0/12", "RFC 1918"),
+	ipv4Prefix("192.0.0.0/24", "RFC 6890"),
+	ipv4Prefix("192.0.2.0/24", "RFC 5737"),
+	ipv4Prefix("192.88.99.0/24", "RFC 7526"),
+	ipv4Prefix("192.168.0.0/16", "RFC 1918"),
+	ipv4Prefix("198.18.0.0/15", "RFC 2544"),
+	ipv4Prefix("198.51.100.0/24", "RFC 5737"),
+	ipv4Prefix("203.0.113.0/24", "RFC 5737"),
+	ipv4Prefix("224.0.0.0/4", "RFC 5771"),
+	ipv4Prefix("240.0.0.0/4", "RFC 1112")
+];
+const nonPublicIPv6Prefixes = [
+	ipv6Prefix("::/16", "RFC 4291"),
+	ipv6Prefix("2001::/32", "RFC 4380"),
+	ipv6Prefix("2002::/16", "RFC 3056"),
+	ipv6Prefix("64:ff9b:1::/48", "RFC 8215"),
+	ipv6Prefix("fc00::/7", "RFC 4193"),
+	ipv6Prefix("fe80::/10", "RFC 4291"),
+	ipv6Prefix("ff00::/8", "RFC 4291")
+];
+const ipv6WithIPv4Prefixes = [{
+	...ipv6Prefix("64:ff9b::/96", "RFC 6052"),
+	extractIPv4: (words) => ipv4FromWords(words[6], words[7])
+}];
+function ipv4Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const parts = parseIPv4Address(address);
+	if (parts == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) throw new Error(`Invalid IPv4 prefix: ${cidr}`);
+	return {
+		cidr,
+		base: ipv4PartsToNumber(parts),
+		prefix,
+		rfc
+	};
+}
+function ipv6Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const words = parseIPv6Address(address);
+	if (words == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 128) throw new Error(`Invalid IPv6 prefix: ${cidr}`);
+	return {
+		cidr,
+		words,
+		prefix,
+		rfc
+	};
+}
+function parseIPv4Address(address) {
+	const parts = address.split(".").map((part) => {
+		if (!/^\d+$/.test(part)) return NaN;
+		return parseInt(part, 10);
+	});
+	if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
+	return parts;
+}
+function parseIPv6Address(address) {
+	const parts = expandIPv6Address(address).split(":");
+	if (parts.length !== 8) return null;
+	const words = parts.map((part) => {
+		if (!/^[0-9a-f]{1,4}$/i.test(part)) return NaN;
+		return parseInt(part, 16);
+	});
+	if (words.some((word) => !Number.isInteger(word) || word < 0 || word > 65535)) return null;
+	return words;
+}
+function ipv4PartsToNumber(parts) {
+	return parts[0] * 2 ** 24 + parts[1] * 2 ** 16 + parts[2] * 2 ** 8 + parts[3];
+}
+function ipv4FromWords(highWord, lowWord) {
+	return [
+		highWord >> 8,
+		highWord & 255,
+		lowWord >> 8,
+		lowWord & 255
+	].join(".");
+}
+function matchesIPv4Prefix(address, prefixBase, prefixLength) {
+	const blockSize = 2 ** (32 - prefixLength);
+	return Math.floor(address / blockSize) === Math.floor(prefixBase / blockSize);
+}
+function matchesIPv6Prefix(address, prefixWords, prefixLength) {
+	let remaining = prefixLength;
+	for (let i = 0; i < 8 && remaining > 0; i++) if (remaining >= 16) {
+		if (address[i] !== prefixWords[i]) return false;
+		remaining -= 16;
+	} else {
+		const mask = 65535 << 16 - remaining & 65535;
+		if ((address[i] & mask) !== (prefixWords[i] & mask)) return false;
+		remaining = 0;
+	}
+	return true;
+}
+//#endregion
 //#region src/docloader.ts
 const logger = (0, _logtape_logtape.getLogger)([
 	"fedify",
@@ -4627,66 +4779,6 @@ const logger = (0, _logtape_logtape.getLogger)([
 	"docloader"
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
-const MAX_HTML_SIZE = 1024 * 1024;
-function createResponseMetadata(response) {
-	return new Response(null, {
-		headers: response.headers,
-		status: response.status,
-		statusText: response.statusText
-	});
-}
-async function cancelResponseBody(response) {
-	if (response.body != null) await response.body.cancel();
-}
-async function readBoundedText(response, maxBytes) {
-	const contentLength = response.headers.get("Content-Length");
-	if (contentLength != null) {
-		const size = Number(contentLength);
-		if (size > maxBytes) {
-			await cancelResponseBody(response);
-			return {
-				text: "",
-				size,
-				tooLarge: true
-			};
-		}
-	}
-	if (response.body == null) return {
-		text: "",
-		size: 0,
-		tooLarge: false
-	};
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	let text = "";
-	let size = 0;
-	try {
-		while (true) {
-			const result = await reader.read();
-			if (result.done) break;
-			const chunkSize = result.value.byteLength;
-			if (size + chunkSize > maxBytes) {
-				size += chunkSize;
-				await reader.cancel();
-				return {
-					text: "",
-					size,
-					tooLarge: true
-				};
-			}
-			size += chunkSize;
-			text += decoder.decode(result.value, { stream: true });
-		}
-		text += decoder.decode();
-		return {
-			text,
-			size,
-			tooLarge: false
-		};
-	} finally {
-		reader.releaseLock();
-	}
-}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4741,19 +4833,19 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const errorResponse = createResponseMetadata(response);
-		const html = await readBoundedText(response, MAX_HTML_SIZE);
-		if (html.tooLarge) {
+		const MAX_HTML_SIZE = 1024 * 1024;
+		const html = await response.text();
+		if (html.length > MAX_HTML_SIZE) {
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.size
+				size: html.length
 			});
-			throw new FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+			document = JSON.parse(html);
 		} else {
 			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
 			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
+			while ((tagMatch = tagPattern.exec(html)) !== null) {
 				const tagContent = tagMatch[2];
 				let attrMatch;
 				const attribs = {};
@@ -4770,12 +4862,7 @@ async function getRemoteDocument(url, response, fetch) {
 					return await fetch(new URL(attribs.href, docUrl).href);
 				}
 			}
-			try {
-				document = JSON.parse(html.text);
-			} catch (error) {
-				if (!(error instanceof SyntaxError)) throw error;
-				throw new FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
-			}
+			document = JSON.parse(html);
 		}
 	} else document = await response.json();
 	logger.debug("Fetched document: {status} {url} {headers}", {
@@ -4821,9 +4908,9 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 			};
 		}
 		if (!allowPrivateAddress) try {
-			await require_url.validatePublicUrl(currentUrl);
+			await validatePublicUrl(currentUrl);
 		} catch (error) {
-			if (error instanceof require_url.UrlError) logger.error("Disallowed private URL: {url}", {
+			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
 				url: currentUrl,
 				error
 			});
@@ -5253,11 +5340,6 @@ const algorithms = {
 	},
 	"1.3.101.112": "Ed25519"
 };
-const DID_KEY_PREFIX = "did:key:";
-const ED25519_PUBLIC_KEY_MULTICODEC = 237;
-const ED25519_PUBLIC_KEY_LENGTH = 32;
-const DID_KEY_PATTERN = /^did:key:([^/?#]+)$/;
-const DID_KEY_VERIFICATION_METHOD_PATTERN = /^did:key:([^/?#]+)#([^/?#]+)$/;
 /**
 * Imports a PEM-SPKI formatted public key.
 * @param pem The PEM-SPKI formatted public key.
@@ -5319,69 +5401,6 @@ const PKCS1_HEADER = /^\s*-----BEGIN\s+RSA\s+PUBLIC\s+KEY-----\s*\n/;
 function importPem(pem) {
 	return PKCS1_HEADER.test(pem) ? importPkcs1(pem) : importSpki(pem);
 }
-function decodeEd25519DidKeyMultibase(multibaseKey) {
-	if (!multibaseKey.startsWith("z")) throw new TypeError("did:key must use base58-btc Multibase encoding.");
-	let decoded;
-	try {
-		decoded = decodeMultibase(multibaseKey);
-	} catch (error) {
-		throw new TypeError("Invalid did:key Multibase encoding.", { cause: error });
-	}
-	const { code } = getMulticodecPrefix(decoded);
-	if (code !== ED25519_PUBLIC_KEY_MULTICODEC) throw new TypeError("Unsupported did:key type: 0x" + code.toString(16));
-	const content = removeMulticodecPrefix(decoded);
-	if (content.length !== ED25519_PUBLIC_KEY_LENGTH) throw new TypeError("Invalid Ed25519 did:key length.");
-	return content;
-}
-/**
-* Imports an Ed25519 `did:key` DID.
-*
-* @param did The `did:key` DID.
-* @returns The imported Ed25519 public key.
-* @throws {TypeError} If the DID is malformed or uses an unsupported key type.
-* @since 2.4.0
-*/
-async function importDidKey(did) {
-	const match = (did instanceof URL ? did.href : did).match(DID_KEY_PATTERN);
-	if (match == null) throw new TypeError("Invalid did:key DID.");
-	const content = decodeEd25519DidKeyMultibase(match[1]);
-	return await crypto.subtle.importKey("raw", content.slice(), "Ed25519", true, ["verify"]);
-}
-/**
-* Exports an Ed25519 public key as a `did:key` DID.
-*
-* @param key The Ed25519 public key.
-* @returns The `did:key` DID.
-* @throws {TypeError} If the key is invalid or unsupported.
-* @since 2.4.0
-*/
-async function exportDidKey(key) {
-	if (key.algorithm.name !== "Ed25519") throw new TypeError("Unsupported key type: " + JSON.stringify(key.algorithm));
-	return DID_KEY_PREFIX + await exportMultibaseKey(key);
-}
-/**
-* Parses an Ed25519 `did:key` verification method DID URL.
-*
-* @param didUrl The `did:key` DID URL.
-* @returns The parsed verification method.
-* @throws {TypeError} If the DID URL is malformed, unsupported, or its
-*                     fragment does not identify the same key as the DID.
-* @since 2.4.0
-*/
-async function parseDidKeyVerificationMethod(didUrl) {
-	const didUrlString = didUrl instanceof URL ? didUrl.href : didUrl;
-	const match = didUrlString.match(DID_KEY_VERIFICATION_METHOD_PATTERN);
-	if (match == null) throw new TypeError("Invalid did:key verification method.");
-	const [, publicKeyMultibase, fragment] = match;
-	if (publicKeyMultibase !== fragment) throw new TypeError("Invalid did:key verification method fragment.");
-	const publicKey = await importDidKey(DID_KEY_PREFIX + publicKeyMultibase);
-	return {
-		id: new URL(didUrlString),
-		controller: new URL(DID_KEY_PREFIX + publicKeyMultibase),
-		publicKeyMultibase,
-		publicKey
-	};
-}
 /**
 * Imports a [Multibase]-encoded public key.
 *
@@ -5550,33 +5569,26 @@ LanguageString.prototype[Symbol.for("nodejs.util.inspect.custom")] = function(_d
 //#endregion
 exports.FetchError = FetchError;
 exports.LanguageString = LanguageString;
-exports.UrlError = require_url.UrlError;
+exports.UrlError = UrlError;
 exports.canParseDecimal = canParseDecimal;
 exports.createActivityPubRequest = createActivityPubRequest;
 exports.decodeMultibase = decodeMultibase;
 exports.encodeMultibase = encodeMultibase;
 exports.encodingFromBaseData = encodingFromBaseData;
-exports.expandIPv6Address = require_url.expandIPv6Address;
-exports.exportDidKey = exportDidKey;
+exports.expandIPv6Address = expandIPv6Address;
 exports.exportMultibaseKey = exportMultibaseKey;
 exports.exportSpki = exportSpki;
-exports.formatIri = require_url.formatIri;
 exports.getDocumentLoader = getDocumentLoader;
 exports.getRemoteDocument = getRemoteDocument;
 exports.getUserAgent = getUserAgent;
-exports.haveSameIriOrigin = require_url.haveSameIriOrigin;
-exports.importDidKey = importDidKey;
 exports.importMultibaseKey = importMultibaseKey;
 exports.importPem = importPem;
 exports.importPkcs1 = importPkcs1;
 exports.importSpki = importSpki;
 exports.isDecimal = isDecimal;
-exports.isValidPublicIPv4Address = require_url.isValidPublicIPv4Address;
-exports.isValidPublicIPv6Address = require_url.isValidPublicIPv6Address;
+exports.isValidPublicIPv4Address = isValidPublicIPv4Address;
+exports.isValidPublicIPv6Address = isValidPublicIPv6Address;
 exports.logRequest = logRequest;
 exports.parseDecimal = parseDecimal;
-exports.parseDidKeyVerificationMethod = parseDidKeyVerificationMethod;
-exports.parseIri = require_url.parseIri;
-exports.parseJsonLdId = require_url.parseJsonLdId;
 exports.preloadedContexts = preloadedContexts;
-exports.validatePublicUrl = require_url.validatePublicUrl;
+exports.validatePublicUrl = validatePublicUrl;