@fedify/vocab-runtime 2.4.0-dev.1570 → 2.4.0-dev.1571

package/dist/tests/{docloader-mvgIWKI7.cjs → docloader-DkiPIIAk.cjs}

@@ -1,7 +1,7 @@
 require("./chunk-C2EiDwsr.cjs");
-const require_request = require("./request-SworbvLc.cjs");
+const require_request = require("./request-D3H8nWtX.cjs");
 const require_link = require("./link-FguCydMA.cjs");
-const require_url = require("./url-C20FhC7p.cjs");
+const require_url = require("./url-2XwVbUS_.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#endregion
@@ -4278,6 +4278,28 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
+	"https://w3id.org/fep/7aa9": { "@context": {
+		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
+		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
+		"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
+		"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
+		"topic": {
+			"@id": "https://w3id.org/fep/7aa9#topic",
+			"@type": "@id"
+		},
+		"featuredObject": {
+			"@id": "https://w3id.org/fep/7aa9#featuredObject",
+			"@type": "@id"
+		},
+		"canFeature": {
+			"@id": "https://w3id.org/fep/7aa9#canFeature",
+			"@type": "@id"
+		},
+		"featureAuthorization": {
+			"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
+			"@type": "@id"
+		}
+	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",
@@ -4341,6 +4363,66 @@ const logger = (0, _logtape_logtape.getLogger)([
 	"docloader"
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
+const MAX_HTML_SIZE = 1024 * 1024;
+function createResponseMetadata(response) {
+	return new Response(null, {
+		headers: response.headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
+async function cancelResponseBody(response) {
+	if (response.body != null) await response.body.cancel();
+}
+async function readBoundedText(response, maxBytes) {
+	const contentLength = response.headers.get("Content-Length");
+	if (contentLength != null) {
+		const size = Number(contentLength);
+		if (size > maxBytes) {
+			await cancelResponseBody(response);
+			return {
+				text: "",
+				size,
+				tooLarge: true
+			};
+		}
+	}
+	if (response.body == null) return {
+		text: "",
+		size: 0,
+		tooLarge: false
+	};
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let size = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			const chunkSize = result.value.byteLength;
+			if (size + chunkSize > maxBytes) {
+				size += chunkSize;
+				await reader.cancel();
+				return {
+					text: "",
+					size,
+					tooLarge: true
+				};
+			}
+			size += chunkSize;
+			text += decoder.decode(result.value, { stream: true });
+		}
+		text += decoder.decode();
+		return {
+			text,
+			size,
+			tooLarge: false
+		};
+	} finally {
+		reader.releaseLock();
+	}
+}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4395,19 +4477,19 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const MAX_HTML_SIZE = 1024 * 1024;
-		const html = await response.text();
-		if (html.length > MAX_HTML_SIZE) {
+		const errorResponse = createResponseMetadata(response);
+		const html = await readBoundedText(response, MAX_HTML_SIZE);
+		if (html.tooLarge) {
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.length
+				size: html.size
 			});
-			document = JSON.parse(html);
+			throw new require_request.FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
 		} else {
 			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
 			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html)) !== null) {
+			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
 				const tagContent = tagMatch[2];
 				let attrMatch;
 				const attribs = {};
@@ -4424,7 +4506,12 @@ async function getRemoteDocument(url, response, fetch) {
 					return await fetch(new URL(attribs.href, docUrl).href);
 				}
 			}
-			document = JSON.parse(html);
+			try {
+				document = JSON.parse(html.text);
+			} catch (error) {
+				if (!(error instanceof SyntaxError)) throw error;
+				throw new require_request.FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+			}
 		}
 	} else document = await response.json();
 	logger.debug("Fetched document: {status} {url} {headers}", {
@@ -4535,6 +4622,12 @@ Object.defineProperty(exports, "getDocumentLoader", {
 		return getDocumentLoader;
 	}
 });
+Object.defineProperty(exports, "getRemoteDocument", {
+	enumerable: true,
+	get: function() {
+		return getRemoteDocument;
+	}
+});
 Object.defineProperty(exports, "preloadedContexts", {
 	enumerable: true,
 	get: function() {

package/dist/tests/docloader.test.cjs

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-C2EiDwsr.cjs");
-const require_docloader = require("./docloader-mvgIWKI7.cjs");
-const require_request = require("./request-SworbvLc.cjs");
-const require_url = require("./url-C20FhC7p.cjs");
+const require_docloader = require("./docloader-DkiPIIAk.cjs");
+const require_request = require("./request-D3H8nWtX.cjs");
+const require_url = require("./url-2XwVbUS_.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region ../../node_modules/.pnpm/glob-to-regexp@0.4.1/node_modules/glob-to-regexp/index.js
@@ -1267,7 +1267,7 @@ var esm_default = new class FetchMock {
 			type: "Object"
 		},
 		headers: {
-			"Content-Type": "text/html; charset=utf-8",
+			"Content-Type": "application/activity+json",
 			Link: "<https://example.com/object>; rel=\"alternate\"; type=\"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"\""
 		}
 	});
@@ -1399,6 +1399,27 @@ var esm_default = new class FetchMock {
 			}
 		});
 	});
+	esm_default.get("https://example.com/html-no-alternate", {
+		body: `<!DOCTYPE html>
+      <html>
+        <head>
+          <title>Not an ActivityPub document</title>
+        </head>
+        <body>Not found</body>
+      </html>`,
+		headers: { "Content-Type": "text/html; charset=utf-8" }
+	});
+	await t.test("HTML without ActivityPub alternate link", async () => {
+		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/html-no-alternate"), (error) => {
+			(0, node_assert.ok)(error instanceof require_request.FetchError);
+			(0, node_assert.ok)(error.message.includes("HTML document has no ActivityPub alternate link"));
+			(0, node_assert.ok)(error.message.includes("Content-Type: text/html; charset=utf-8"));
+			(0, node_assert.deepStrictEqual)(error.url, new URL("https://example.com/html-no-alternate"));
+			(0, node_assert.ok)(error.response != null);
+			(0, node_assert.deepStrictEqual)(error.response.headers.get("Content-Type"), "text/html; charset=utf-8");
+			return true;
+		});
+	});
 	esm_default.get("https://example.com/wrong-content-type", {
 		body: {
 			"@context": "https://www.w3.org/ns/activitystreams",
@@ -1408,7 +1429,7 @@ var esm_default = new class FetchMock {
 		},
 		headers: { "Content-Type": "text/html; charset=utf-8" }
 	});
-	await t.test("Wrong Content-Type", async () => {
+	await t.test("wrong Content-Type with JSON body", async () => {
 		(0, node_assert.deepStrictEqual)(await fetchDocumentLoader("https://example.com/wrong-content-type"), {
 			contextUrl: null,
 			documentUrl: "https://example.com/wrong-content-type",
@@ -1420,6 +1441,37 @@ var esm_default = new class FetchMock {
 			}
 		});
 	});
+	esm_default.get("https://example.com/large-html", {
+		body: "<!DOCTYPE html>",
+		headers: {
+			"Content-Length": String(1048577),
+			"Content-Type": "text/html; charset=utf-8"
+		}
+	});
+	await t.test("HTML Content-Length over limit", async () => {
+		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/large-html"), (error) => {
+			(0, node_assert.ok)(error instanceof require_request.FetchError);
+			(0, node_assert.ok)(error.message.includes("HTML document is too large to scan for an ActivityPub alternate link"));
+			(0, node_assert.ok)(error.response != null);
+			(0, node_assert.deepStrictEqual)(error.response.status, 200);
+			(0, node_assert.deepStrictEqual)(error.response.headers.get("Content-Type"), "text/html; charset=utf-8");
+			return true;
+		});
+	});
+	await t.test("HTML Content-Length over limit cancels body", async () => {
+		let canceled = false;
+		const response = new Response("<!DOCTYPE html>", { headers: {
+			"Content-Length": String(1048577),
+			"Content-Type": "text/html; charset=utf-8"
+		} });
+		Object.defineProperty(response, "body", { value: { cancel: () => {
+			canceled = true;
+		} } });
+		await (0, node_assert.rejects)(() => require_docloader.getRemoteDocument("https://example.com/large-html-cancel", response, () => {
+			throw new Error("unexpected alternate fetch");
+		}), require_request.FetchError);
+		(0, node_assert.deepStrictEqual)(canceled, true);
+	});
 	esm_default.get("https://example.com/404", { status: 404 });
 	await t.test("not ok", async () => {
 		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/404"), require_request.FetchError, "HTTP 404: https://example.com/404");
@@ -1536,7 +1588,7 @@ var esm_default = new class FetchMock {
 	});
 	await t.test("ReDoS resistance (CVE-2025-68475)", async () => {
 		const start = performance.now();
-		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/redos"), SyntaxError);
+		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/redos"), require_request.FetchError);
 		const elapsed = performance.now() - start;
 		(0, node_assert.ok)(elapsed < 1e3, `Potential ReDoS vulnerability detected: ${elapsed}ms (expected < 1000ms)`);
 	});

package/dist/tests/docloader.test.mjs

@@ -1,6 +1,6 @@
-import { n as preloadedContexts, t as getDocumentLoader } from "./docloader-C76ldE5C.mjs";
-import { t as FetchError } from "./request-BEXkv1ul.mjs";
-import { t as UrlError } from "./url-m9Qzxy-Y.mjs";
+import { n as getRemoteDocument, r as preloadedContexts, t as getDocumentLoader } from "./docloader-DHSAmRW2.mjs";
+import { t as FetchError } from "./request-CYFeP37O.mjs";
+import { t as UrlError } from "./url-YWJbnRlf.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 //#region \0rolldown/runtime.js
@@ -1286,7 +1286,7 @@ test("getDocumentLoader()", async (t) => {
 			type: "Object"
 		},
 		headers: {
-			"Content-Type": "text/html; charset=utf-8",
+			"Content-Type": "application/activity+json",
 			Link: "<https://example.com/object>; rel=\"alternate\"; type=\"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"\""
 		}
 	});
@@ -1418,6 +1418,27 @@ test("getDocumentLoader()", async (t) => {
 			}
 		});
 	});
+	esm_default.get("https://example.com/html-no-alternate", {
+		body: `<!DOCTYPE html>
+      <html>
+        <head>
+          <title>Not an ActivityPub document</title>
+        </head>
+        <body>Not found</body>
+      </html>`,
+		headers: { "Content-Type": "text/html; charset=utf-8" }
+	});
+	await t.test("HTML without ActivityPub alternate link", async () => {
+		await rejects(() => fetchDocumentLoader("https://example.com/html-no-alternate"), (error) => {
+			ok(error instanceof FetchError);
+			ok(error.message.includes("HTML document has no ActivityPub alternate link"));
+			ok(error.message.includes("Content-Type: text/html; charset=utf-8"));
+			deepStrictEqual(error.url, new URL("https://example.com/html-no-alternate"));
+			ok(error.response != null);
+			deepStrictEqual(error.response.headers.get("Content-Type"), "text/html; charset=utf-8");
+			return true;
+		});
+	});
 	esm_default.get("https://example.com/wrong-content-type", {
 		body: {
 			"@context": "https://www.w3.org/ns/activitystreams",
@@ -1427,7 +1448,7 @@ test("getDocumentLoader()", async (t) => {
 		},
 		headers: { "Content-Type": "text/html; charset=utf-8" }
 	});
-	await t.test("Wrong Content-Type", async () => {
+	await t.test("wrong Content-Type with JSON body", async () => {
 		deepStrictEqual(await fetchDocumentLoader("https://example.com/wrong-content-type"), {
 			contextUrl: null,
 			documentUrl: "https://example.com/wrong-content-type",
@@ -1439,6 +1460,37 @@ test("getDocumentLoader()", async (t) => {
 			}
 		});
 	});
+	esm_default.get("https://example.com/large-html", {
+		body: "<!DOCTYPE html>",
+		headers: {
+			"Content-Length": String(1048577),
+			"Content-Type": "text/html; charset=utf-8"
+		}
+	});
+	await t.test("HTML Content-Length over limit", async () => {
+		await rejects(() => fetchDocumentLoader("https://example.com/large-html"), (error) => {
+			ok(error instanceof FetchError);
+			ok(error.message.includes("HTML document is too large to scan for an ActivityPub alternate link"));
+			ok(error.response != null);
+			deepStrictEqual(error.response.status, 200);
+			deepStrictEqual(error.response.headers.get("Content-Type"), "text/html; charset=utf-8");
+			return true;
+		});
+	});
+	await t.test("HTML Content-Length over limit cancels body", async () => {
+		let canceled = false;
+		const response = new Response("<!DOCTYPE html>", { headers: {
+			"Content-Length": String(1048577),
+			"Content-Type": "text/html; charset=utf-8"
+		} });
+		Object.defineProperty(response, "body", { value: { cancel: () => {
+			canceled = true;
+		} } });
+		await rejects(() => getRemoteDocument("https://example.com/large-html-cancel", response, () => {
+			throw new Error("unexpected alternate fetch");
+		}), FetchError);
+		deepStrictEqual(canceled, true);
+	});
 	esm_default.get("https://example.com/404", { status: 404 });
 	await t.test("not ok", async () => {
 		await rejects(() => fetchDocumentLoader("https://example.com/404"), FetchError, "HTTP 404: https://example.com/404");
@@ -1555,7 +1607,7 @@ test("getDocumentLoader()", async (t) => {
 	});
 	await t.test("ReDoS resistance (CVE-2025-68475)", async () => {
 		const start = performance.now();
-		await rejects(() => fetchDocumentLoader("https://example.com/redos"), SyntaxError);
+		await rejects(() => fetchDocumentLoader("https://example.com/redos"), FetchError);
 		const elapsed = performance.now() - start;
 		ok(elapsed < 1e3, `Potential ReDoS vulnerability detected: ${elapsed}ms (expected < 1000ms)`);
 	});