npm - @fedify/vocab-runtime - Versions diffs - 2.4.0-dev.1567 → 2.4.0-dev.1570 - Mend

@fedify/vocab-runtime 2.4.0-dev.1567 → 2.4.0-dev.1570

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (48) hide show

package/deno.json +1 -2
package/dist/mod.cjs +190 -178
package/dist/mod.d.cts +190 -59
package/dist/mod.d.ts +190 -59
package/dist/mod.js +184 -165
package/dist/tests/decimal.test.cjs +3 -3
package/dist/tests/decimal.test.mjs +3 -3
package/dist/tests/{docloader-D61oV0K1.mjs → docloader-C76ldE5C.mjs} +10 -97
package/dist/tests/{docloader-BcaQHb0Q.cjs → docloader-mvgIWKI7.cjs} +9 -102
package/dist/tests/docloader.test.cjs +6 -58
package/dist/tests/docloader.test.mjs +6 -58
package/dist/tests/{key-CDGDH_vC.mjs → key-CrrK9mYh.mjs} +1 -69
package/dist/tests/{key-_wXwomh_.cjs → key-pMmqUKuo.cjs} +0 -86
package/dist/tests/key.test.cjs +1 -48
package/dist/tests/key.test.mjs +1 -48
package/dist/tests/{request-Cn0vP7Hj.mjs → request-BEXkv1ul.mjs} +1 -1
package/dist/tests/{request-DnNWah97.cjs → request-SworbvLc.cjs} +1 -1
package/dist/tests/request.test.cjs +1 -1
package/dist/tests/request.test.mjs +1 -1
package/dist/tests/{url-2XwVbUS_.cjs → url-C20FhC7p.cjs} +0 -108
package/dist/tests/{url-YWJbnRlf.mjs → url-m9Qzxy-Y.mjs} +1 -85
package/dist/tests/url.test.cjs +1 -104
package/dist/tests/url.test.mjs +2 -105
package/package.json +1 -11
package/src/contexts.ts +0 -2
package/src/docloader.test.ts +6 -102
package/src/docloader.ts +8 -76
package/src/key.test.ts +0 -86
package/src/key.ts +0 -125
package/src/mod.ts +0 -8
package/src/url.test.ts +1 -252
package/src/url.ts +0 -141
package/tsdown.config.ts +1 -6
package/dist/docloader-DnUMWHaJ.d.cts +0 -202
package/dist/docloader-xRGn1azD.d.ts +0 -202
package/dist/internal/jsonld-cache.cjs +0 -279
package/dist/internal/jsonld-cache.d.cts +0 -48
package/dist/internal/jsonld-cache.d.ts +0 -48
package/dist/internal/jsonld-cache.js +0 -275
package/dist/tests/jsonld-cache.test.cjs +0 -652
package/dist/tests/jsonld-cache.test.d.cts +0 -1
package/dist/tests/jsonld-cache.test.d.mts +0 -1
package/dist/tests/jsonld-cache.test.mjs +0 -651
package/dist/url-BAdyyqAa.cjs +0 -315
package/dist/url-BuxPHxK2.js +0 -261
package/src/contexts/fep-7aa9.json +0 -24
package/src/internal/jsonld-cache.ts +0 -538
package/src/jsonld-cache.test.ts +0 -554

package/src/docloader.test.ts CHANGED Viewed

@@ -2,7 +2,7 @@ import fetchMock from "fetch-mock";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 import preloadedContexts from "./contexts.ts";
-import { getDocumentLoader, getRemoteDocument } from "./docloader.ts";
+import { getDocumentLoader } from "./docloader.ts";
 import { FetchError } from "./request.ts";
 import { UrlError } from "./url.ts";
@@ -90,7 +90,7 @@ test("getDocumentLoader()", async (t) => {
       type: "Object",
     },
     headers: {
-      "Content-Type": "application/activity+json",
+      "Content-Type": "text/html; charset=utf-8",
       Link: '<https://example.com/object>; rel="alternate"; ' +
         'type="application/ld+json; profile="https://www.w3.org/ns/activitystreams""',
     },
@@ -247,44 +247,6 @@ test("getDocumentLoader()", async (t) => {
     });
   });
-  fetchMock.get("https://example.com/html-no-alternate", {
-    body: `<!DOCTYPE html>
-      <html>
-        <head>
-          <title>Not an ActivityPub document</title>
-        </head>
-        <body>Not found</body>
-      </html>`,
-    headers: { "Content-Type": "text/html; charset=utf-8" },
-  });
-  await t.test("HTML without ActivityPub alternate link", async () => {
-    await rejects(
-      () => fetchDocumentLoader("https://example.com/html-no-alternate"),
-      (error) => {
-        ok(error instanceof FetchError);
-        ok(
-          error.message.includes(
-            "HTML document has no ActivityPub alternate link",
-          ),
-        );
-        ok(
-          error.message.includes("Content-Type: text/html; charset=utf-8"),
-        );
-        deepStrictEqual(
-          error.url,
-          new URL("https://example.com/html-no-alternate"),
-        );
-        ok(error.response != null);
-        deepStrictEqual(
-          error.response.headers.get("Content-Type"),
-          "text/html; charset=utf-8",
-        );
-        return true;
-      },
-    );
-  });
   fetchMock.get("https://example.com/wrong-content-type", {
     body: {
       "@context": "https://www.w3.org/ns/activitystreams",
@@ -295,7 +257,7 @@ test("getDocumentLoader()", async (t) => {
     headers: { "Content-Type": "text/html; charset=utf-8" },
   });
-  await t.test("wrong Content-Type with JSON body", async () => {
+  await t.test("Wrong Content-Type", async () => {
     deepStrictEqual(
       await fetchDocumentLoader("https://example.com/wrong-content-type"),
       {
@@ -311,64 +273,6 @@ test("getDocumentLoader()", async (t) => {
     );
   });
-  fetchMock.get("https://example.com/large-html", {
-    body: "<!DOCTYPE html>",
-    headers: {
-      "Content-Length": String(1024 * 1024 + 1),
-      "Content-Type": "text/html; charset=utf-8",
-    },
-  });
-  await t.test("HTML Content-Length over limit", async () => {
-    await rejects(
-      () => fetchDocumentLoader("https://example.com/large-html"),
-      (error) => {
-        ok(error instanceof FetchError);
-        ok(
-          error.message.includes(
-            "HTML document is too large to scan for an ActivityPub alternate link",
-          ),
-        );
-        ok(error.response != null);
-        deepStrictEqual(error.response.status, 200);
-        deepStrictEqual(
-          error.response.headers.get("Content-Type"),
-          "text/html; charset=utf-8",
-        );
-        return true;
-      },
-    );
-  });
-  await t.test("HTML Content-Length over limit cancels body", async () => {
-    let canceled = false;
-    const response = new Response("<!DOCTYPE html>", {
-      headers: {
-        "Content-Length": String(1024 * 1024 + 1),
-        "Content-Type": "text/html; charset=utf-8",
-      },
-    });
-    Object.defineProperty(response, "body", {
-      value: {
-        cancel: () => {
-          canceled = true;
-        },
-      },
-    });
-    await rejects(
-      () =>
-        getRemoteDocument(
-          "https://example.com/large-html-cancel",
-          response,
-          () => {
-            throw new Error("unexpected alternate fetch");
-          },
-        ),
-      FetchError,
-    );
-    deepStrictEqual(canceled, true);
-  });
   fetchMock.get("https://example.com/404", { status: 404 });
   await t.test("not ok", async () => {
@@ -555,11 +459,11 @@ test("getDocumentLoader()", async (t) => {
   await t.test("ReDoS resistance (CVE-2025-68475)", async () => {
     const start = performance.now();
-    // The malicious HTML will fail alternate discovery, but the important
-    // thing is that it should complete quickly (not hang due to ReDoS).
+    // The malicious HTML will fail JSON parsing, but the important thing is
+    // that it should complete quickly (not hang due to ReDoS)
     await rejects(
       () => fetchDocumentLoader("https://example.com/redos"),
-      FetchError,
+      SyntaxError,
     );
     const elapsed = performance.now() - start;

package/src/docloader.ts CHANGED Viewed

@@ -13,7 +13,6 @@ import { UrlError, validatePublicUrl } from "./url.ts";
 const logger = getLogger(["fedify", "runtime", "docloader"]);
 const DEFAULT_MAX_REDIRECTION = 20;
-const MAX_HTML_SIZE = 1024 * 1024; // 1MB
 /**
  * A remote JSON-LD document and its context fetched by
@@ -113,59 +112,6 @@ export type AuthenticatedDocumentLoaderFactory = (
   options?: DocumentLoaderFactoryOptions,
 ) => DocumentLoader;
-function createResponseMetadata(response: Response): Response {
-  return new Response(null, {
-    headers: response.headers,
-    status: response.status,
-    statusText: response.statusText,
-  });
-}
-async function cancelResponseBody(response: Response): Promise<void> {
-  if (response.body != null) {
-    await response.body.cancel();
-  }
-}
-async function readBoundedText(
-  response: Response,
-  maxBytes: number,
-): Promise<{ text: string; size: number; tooLarge: boolean }> {
-  const contentLength = response.headers.get("Content-Length");
-  if (contentLength != null) {
-    const size = Number(contentLength);
-    if (size > maxBytes) {
-      await cancelResponseBody(response);
-      return { text: "", size, tooLarge: true };
-    }
-  }
-  if (response.body == null) return { text: "", size: 0, tooLarge: false };
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder();
-  let text = "";
-  let size = 0;
-  try {
-    while (true) {
-      const result = await reader.read();
-      if (result.done) break;
-      const chunkSize = result.value.byteLength;
-      if (size + chunkSize > maxBytes) {
-        size += chunkSize;
-        await reader.cancel();
-        return { text: "", size, tooLarge: true };
-      }
-      size += chunkSize;
-      text += decoder.decode(result.value, { stream: true });
-    }
-    text += decoder.decode();
-    return { text, size, tooLarge: false };
-  } finally {
-    reader.releaseLock();
-  }
-}
 /**
  * Gets a {@link RemoteDocument} from the given response.
  * @param url The URL of the document to load.
@@ -254,19 +200,15 @@ export async function getRemoteDocument(
       contentType === "application/xhtml+xml" ||
       contentType?.startsWith("application/xhtml+xml;"))
   ) {
-    const errorResponse = createResponseMetadata(response);
-    const html = await readBoundedText(response, MAX_HTML_SIZE);
-    if (html.tooLarge) {
+    // Security: Limit HTML response size to mitigate ReDoS attacks
+    const MAX_HTML_SIZE = 1024 * 1024; // 1MB
+    const html = await response.text();
+    if (html.length > MAX_HTML_SIZE) {
       logger.warn(
         "HTML response too large, skipping alternate link discovery: {url}",
-        { url: documentUrl, size: html.size },
-      );
-      throw new FetchError(
-        documentUrl,
-        `HTML document is too large to scan for an ActivityPub alternate link ` +
-          `(Content-Type: ${contentType})`,
-        errorResponse,
+        { url: documentUrl, size: html.length },
       );
+      document = JSON.parse(html);
     } else {
       // Safe regex patterns without nested quantifiers to prevent ReDoS
       // (CVE-2025-68475)
@@ -277,7 +219,7 @@ export async function getRemoteDocument(
         /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
       let tagMatch: RegExpExecArray | null;
-      while ((tagMatch = tagPattern.exec(html.text)) !== null) {
+      while ((tagMatch = tagPattern.exec(html)) !== null) {
         const tagContent = tagMatch[2];
         let attrMatch: RegExpExecArray | null;
         const attribs: Record<string, string> = {};
@@ -305,17 +247,7 @@ export async function getRemoteDocument(
           return await fetch(new URL(attribs.href, docUrl).href);
         }
       }
-      try {
-        document = JSON.parse(html.text);
-      } catch (error) {
-        if (!(error instanceof SyntaxError)) throw error;
-        throw new FetchError(
-          documentUrl,
-          `HTML document has no ActivityPub alternate link ` +
-            `(Content-Type: ${contentType})`,
-          errorResponse,
-        );
-      }
+      document = JSON.parse(html);
     }
   } else {
     document = await response.json();

package/src/key.test.ts CHANGED Viewed

@@ -2,17 +2,13 @@ import { deepStrictEqual, rejects } from "node:assert";
 import { test } from "node:test";
 import { exportJwk, importJwk } from "./jwk.ts";
 import {
-  exportDidKey,
   exportMultibaseKey,
   exportSpki,
-  importDidKey,
   importMultibaseKey,
   importPem,
   importPkcs1,
   importSpki,
-  parseDidKeyVerificationMethod,
 } from "./key.ts";
-import { addMulticodecPrefix } from "./internal/multicodec.ts";
 import { encodeMultibase } from "./multibase/mod.ts";
 // cSpell: disable
@@ -202,85 +198,3 @@ test("exportMultibaseKey()", async () => {
     // cSpell: enable
   );
 });
-test("exportDidKey() and importDidKey()", async () => {
-  const ed25519Key = await importJwk(ed25519Jwk, "public");
-  const did = await exportDidKey(ed25519Key);
-  deepStrictEqual(did, `did:key:${ed25519Multibase}`);
-  deepStrictEqual(await exportJwk(await importDidKey(did)), ed25519Jwk);
-  deepStrictEqual(
-    await exportJwk(await importDidKey(new URL(did))),
-    ed25519Jwk,
-  );
-  const rsaKey = await importJwk(rsaJwk, "public");
-  await rejects(
-    () => exportDidKey(rsaKey),
-    TypeError,
-  );
-  await rejects(
-    () => importDidKey(`did:key:${rsaMultibase}`),
-    new TypeError("Unsupported did:key type: 0x1205"),
-  );
-});
-test("parseDidKeyVerificationMethod()", async () => {
-  const verificationMethod = `did:key:${ed25519Multibase}#${ed25519Multibase}`;
-  const parsed = await parseDidKeyVerificationMethod(verificationMethod);
-  deepStrictEqual(parsed.id, new URL(verificationMethod));
-  deepStrictEqual(parsed.controller, new URL(`did:key:${ed25519Multibase}`));
-  deepStrictEqual(parsed.publicKeyMultibase, ed25519Multibase);
-  deepStrictEqual(await exportJwk(parsed.publicKey), ed25519Jwk);
-});
-test("did:key helpers reject malformed values", async () => {
-  const ed25519Key = await importJwk(ed25519Jwk, "public");
-  const raw = new Uint8Array(await crypto.subtle.exportKey("raw", ed25519Key));
-  const shortEd25519 = new TextDecoder().decode(
-    encodeMultibase(
-      "base58btc",
-      addMulticodecPrefix(0xed, raw.slice(0, 31)),
-    ),
-  );
-  const base64UrlEd25519 = new TextDecoder().decode(
-    encodeMultibase(
-      "base64url",
-      addMulticodecPrefix(0xed, raw),
-    ),
-  );
-  const malformedMulticodec = new TextDecoder().decode(
-    encodeMultibase("base58btc", Uint8Array.from([0x80])),
-  );
-  for (
-    const value of [
-      "did:web:example.com",
-      "did:key:",
-      `did:key:${ed25519Multibase}/path`,
-      `did:key:${ed25519Multibase}?query`,
-      `did:key:${ed25519Multibase}#${ed25519Multibase}`,
-      "did:key:z0",
-      `did:key:${base64UrlEd25519}`,
-      `did:key:${shortEd25519}`,
-      `did:key:${malformedMulticodec}`,
-    ]
-  ) {
-    await rejects(() => importDidKey(value), TypeError);
-  }
-  for (
-    const value of [
-      `did:key:${ed25519Multibase}`,
-      `did:key:${ed25519Multibase}#`,
-      `did:key:${ed25519Multibase}#z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK`,
-      `did:key:${ed25519Multibase}#${base64UrlEd25519}`,
-      "did:key:z0#z0",
-      `did:key:${rsaMultibase}#${rsaMultibase}`,
-      `did:key:${shortEd25519}#${shortEd25519}`,
-      `did:key:${malformedMulticodec}#${malformedMulticodec}`,
-      "https://example.com/key",
-    ]
-  ) {
-    await rejects(() => parseDidKeyVerificationMethod(value), TypeError);
-  }
-});

package/src/key.ts CHANGED Viewed

@@ -22,39 +22,6 @@ const algorithms: Record<
   "1.3.101.112": "Ed25519",
 };
-const DID_KEY_PREFIX = "did:key:";
-const ED25519_PUBLIC_KEY_MULTICODEC = 0xed;
-const ED25519_PUBLIC_KEY_LENGTH = 32;
-const DID_KEY_PATTERN = /^did:key:([^/?#]+)$/;
-const DID_KEY_VERIFICATION_METHOD_PATTERN = /^did:key:([^/?#]+)#([^/?#]+)$/;
-/**
- * Parsed `did:key` verification method.
- *
- * @since 2.4.0
- */
-export interface DidKeyVerificationMethod {
-  /**
-   * The DID URL identifying the verification method.
-   */
-  readonly id: URL;
-  /**
-   * The controller DID.
-   */
-  readonly controller: URL;
-  /**
-   * The Ed25519 public key encoded as a Multibase Multikey value.
-   */
-  readonly publicKeyMultibase: string;
-  /**
-   * The Ed25519 public key.
-   */
-  readonly publicKey: CryptoKey;
-}
 /**
  * Imports a PEM-SPKI formatted public key.
  * @param pem The PEM-SPKI formatted public key.
@@ -126,98 +93,6 @@ export function importPem(pem: string): Promise<CryptoKey> {
   return PKCS1_HEADER.test(pem) ? importPkcs1(pem) : importSpki(pem);
 }
-function decodeEd25519DidKeyMultibase(multibaseKey: string): Uint8Array {
-  if (!multibaseKey.startsWith("z")) {
-    throw new TypeError("did:key must use base58-btc Multibase encoding.");
-  }
-  let decoded: Uint8Array;
-  try {
-    decoded = decodeMultibase(multibaseKey);
-  } catch (error) {
-    throw new TypeError("Invalid did:key Multibase encoding.", {
-      cause: error,
-    });
-  }
-  const { code } = getMulticodecPrefix(decoded);
-  if (code !== ED25519_PUBLIC_KEY_MULTICODEC) {
-    throw new TypeError("Unsupported did:key type: 0x" + code.toString(16));
-  }
-  const content = removeMulticodecPrefix(decoded);
-  if (content.length !== ED25519_PUBLIC_KEY_LENGTH) {
-    throw new TypeError("Invalid Ed25519 did:key length.");
-  }
-  return content;
-}
-/**
- * Imports an Ed25519 `did:key` DID.
- *
- * @param did The `did:key` DID.
- * @returns The imported Ed25519 public key.
- * @throws {TypeError} If the DID is malformed or uses an unsupported key type.
- * @since 2.4.0
- */
-export async function importDidKey(did: string | URL): Promise<CryptoKey> {
-  const didString = did instanceof URL ? did.href : did;
-  const match = didString.match(DID_KEY_PATTERN);
-  if (match == null) throw new TypeError("Invalid did:key DID.");
-  const content = decodeEd25519DidKeyMultibase(match[1]);
-  return await crypto.subtle.importKey(
-    "raw",
-    content.slice(),
-    "Ed25519",
-    true,
-    ["verify"],
-  );
-}
-/**
- * Exports an Ed25519 public key as a `did:key` DID.
- *
- * @param key The Ed25519 public key.
- * @returns The `did:key` DID.
- * @throws {TypeError} If the key is invalid or unsupported.
- * @since 2.4.0
- */
-export async function exportDidKey(key: CryptoKey): Promise<string> {
-  if (key.algorithm.name !== "Ed25519") {
-    throw new TypeError(
-      "Unsupported key type: " + JSON.stringify(key.algorithm),
-    );
-  }
-  return DID_KEY_PREFIX + await exportMultibaseKey(key);
-}
-/**
- * Parses an Ed25519 `did:key` verification method DID URL.
- *
- * @param didUrl The `did:key` DID URL.
- * @returns The parsed verification method.
- * @throws {TypeError} If the DID URL is malformed, unsupported, or its
- *                     fragment does not identify the same key as the DID.
- * @since 2.4.0
- */
-export async function parseDidKeyVerificationMethod(
-  didUrl: string | URL,
-): Promise<DidKeyVerificationMethod> {
-  const didUrlString = didUrl instanceof URL ? didUrl.href : didUrl;
-  const match = didUrlString.match(DID_KEY_VERIFICATION_METHOD_PATTERN);
-  if (match == null) {
-    throw new TypeError("Invalid did:key verification method.");
-  }
-  const [, publicKeyMultibase, fragment] = match;
-  if (publicKeyMultibase !== fragment) {
-    throw new TypeError("Invalid did:key verification method fragment.");
-  }
-  const publicKey = await importDidKey(DID_KEY_PREFIX + publicKeyMultibase);
-  return {
-    id: new URL(didUrlString),
-    controller: new URL(DID_KEY_PREFIX + publicKeyMultibase),
-    publicKeyMultibase,
-    publicKey,
-  };
-}
 /**
  * Imports a [Multibase]-encoded public key.
  *

package/src/mod.ts CHANGED Viewed

@@ -17,16 +17,12 @@ export {
   type RemoteDocument,
 } from "./docloader.ts";
 export {
-  type DidKeyVerificationMethod,
-  exportDidKey,
   exportMultibaseKey,
   exportSpki,
-  importDidKey,
   importMultibaseKey,
   importPem,
   importPkcs1,
   importSpki,
-  parseDidKeyVerificationMethod,
 } from "./key.ts";
 export {
   canParseDecimal,
@@ -55,12 +51,8 @@ export {
 } from "./preprocessor.ts";
 export {
   expandIPv6Address,
-  formatIri,
-  haveSameIriOrigin,
   isValidPublicIPv4Address,
   isValidPublicIPv6Address,
-  parseIri,
-  parseJsonLdId,
   UrlError,
   validatePublicUrl,
 } from "./url.ts";