@fedify/vocab-runtime 2.4.0-dev.1668 → 2.4.0-dev.1727

package/dist/{url-DGVbSVVi.js → url-BHAShw9J.js}

@@ -3,8 +3,8 @@ import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 //#region src/url.ts
 var UrlError = class extends Error {
-	constructor(message) {
-		super(message);
+	constructor(message, options) {
+		super(message, options);
 		this.name = "UrlError";
 	}
 };
@@ -248,10 +248,37 @@ async function validatePublicUrl(url) {
 	let addresses;
 	try {
 		addresses = await lookup(hostname, { all: true });
-	} catch {
-		addresses = [];
+	} catch (error) {
+		throw new UrlError("DNS lookup failed", { cause: error });
+	}
+	validateLookupAddresses(addresses);
+}
+/**
+* Validates the IP addresses returned by `node:dns.lookup()`.
+*
+* Cloudflare Workers' `node:dns` implementation currently maps every record
+* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+* `LookupAddress`, even though Node.js specifies that the `address` field must
+* contain an IPv4 or IPv6 literal.  See:
+* https://github.com/cloudflare/workerd/issues/6886
+*
+* Work around that bug by ignoring non-IP entries only when the lookup also
+* returns at least one actual IP address.  This remains fail-closed: a result
+* containing no IP addresses is rejected, and every returned IP address is
+* still validated and must be public.  This workaround can be revisited once
+* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+*
+* @internal
+*/
+function validateLookupAddresses(addresses) {
+	let ipAddressCount = 0;
+	for (const { address } of addresses) {
+		const family = isIP(address);
+		if (family === 0) continue;
+		ipAddressCount++;
+		validatePublicIpAddress(address, family);
 	}
-	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address");
 }
 function validatePublicIpAddress(address, family) {
 	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;

package/dist/{url-DD4F0ULf.cjs → url-i33c0US6.cjs}

@@ -1,11 +1,10 @@
 
-require("./chunk-M78iaK0I.cjs");
 let node_dns_promises = require("node:dns/promises");
 let node_net = require("node:net");
 //#region src/url.ts
 var UrlError = class extends Error {
-	constructor(message) {
-		super(message);
+	constructor(message, options) {
+		super(message, options);
 		this.name = "UrlError";
 	}
 };
@@ -249,10 +248,37 @@ async function validatePublicUrl(url) {
 	let addresses;
 	try {
 		addresses = await (0, node_dns_promises.lookup)(hostname, { all: true });
-	} catch {
-		addresses = [];
+	} catch (error) {
+		throw new UrlError("DNS lookup failed", { cause: error });
+	}
+	validateLookupAddresses(addresses);
+}
+/**
+* Validates the IP addresses returned by `node:dns.lookup()`.
+*
+* Cloudflare Workers' `node:dns` implementation currently maps every record
+* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+* `LookupAddress`, even though Node.js specifies that the `address` field must
+* contain an IPv4 or IPv6 literal.  See:
+* https://github.com/cloudflare/workerd/issues/6886
+*
+* Work around that bug by ignoring non-IP entries only when the lookup also
+* returns at least one actual IP address.  This remains fail-closed: a result
+* containing no IP addresses is rejected, and every returned IP address is
+* still validated and must be public.  This workaround can be revisited once
+* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+*
+* @internal
+*/
+function validateLookupAddresses(addresses) {
+	let ipAddressCount = 0;
+	for (const { address } of addresses) {
+		const family = (0, node_net.isIP)(address);
+		if (family === 0) continue;
+		ipAddressCount++;
+		validatePublicIpAddress(address, family);
 	}
-	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address");
 }
 function validatePublicIpAddress(address, family) {
 	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.1668+90797b01",
+  "version": "2.4.0-dev.1727+1eadcb04",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/url.test.ts

@@ -15,6 +15,7 @@ import {
   parseIri,
   parseJsonLdId,
   UrlError,
+  validateLookupAddresses,
   validatePublicUrl,
 } from "./url.ts";
 
@@ -718,6 +719,32 @@ test("validatePublicUrl()", async () => {
   await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
 
+test("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
+  validateLookupAddresses([
+    { address: "app-host.example.net.", family: 4 },
+    { address: "93.184.216.34", family: 4 },
+    { address: "2606:2800:220:1:248:1893:25c8:1946", family: 6 },
+  ]);
+});
+
+test("validateLookupAddresses() rejects unsafe or CNAME-only Cloudflare Workers results", () => {
+  throws(
+    () =>
+      validateLookupAddresses([
+        { address: "private-host.example.net.", family: 4 },
+        { address: "127.0.0.1", family: 4 },
+      ]),
+    UrlError,
+  );
+  throws(
+    () =>
+      validateLookupAddresses([
+        { address: "app-host.example.net.", family: 4 },
+      ]),
+    UrlError,
+  );
+});
+
 test("isValidPublicIPv4Address()", () => {
   ok(isValidPublicIPv4Address("8.8.8.8")); // Google DNS
   ok(!isValidPublicIPv4Address("192.168.1.1")); // private

package/src/url.ts

@@ -3,8 +3,8 @@ import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 
 export class UrlError extends Error {
-  constructor(message: string) {
-    super(message);
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
     this.name = "UrlError";
   }
 }
@@ -388,12 +388,42 @@ export async function validatePublicUrl(url: string): Promise<void> {
   let addresses: LookupAddress[];
   try {
     addresses = await lookup(hostname, { all: true });
-  } catch {
-    addresses = [];
+  } catch (error) {
+    throw new UrlError("DNS lookup failed", { cause: error });
   }
-  for (const { address, family } of addresses) {
+  validateLookupAddresses(addresses);
+}
+
+/**
+ * Validates the IP addresses returned by `node:dns.lookup()`.
+ *
+ * Cloudflare Workers' `node:dns` implementation currently maps every record
+ * in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+ * `LookupAddress`, even though Node.js specifies that the `address` field must
+ * contain an IPv4 or IPv6 literal.  See:
+ * https://github.com/cloudflare/workerd/issues/6886
+ *
+ * Work around that bug by ignoring non-IP entries only when the lookup also
+ * returns at least one actual IP address.  This remains fail-closed: a result
+ * containing no IP addresses is rejected, and every returned IP address is
+ * still validated and must be public.  This workaround can be revisited once
+ * the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+ *
+ * @internal
+ */
+export function validateLookupAddresses(
+  addresses: readonly LookupAddress[],
+): void {
+  let ipAddressCount = 0;
+  for (const { address } of addresses) {
+    const family = isIP(address);
+    if (family === 0) continue;
+    ipAddressCount++;
     validatePublicIpAddress(address, family);
   }
+  if (ipAddressCount === 0) {
+    throw new UrlError("DNS lookup did not return any IP address");
+  }
 }
 
 function validatePublicIpAddress(address: string, family: number): void {