@fedify/vocab-runtime 2.4.0-dev.1668 → 2.4.0-dev.1740

package/dist/tests/url.test.cjs

@@ -1,5 +1,4 @@
-require("./chunk-C2EiDwsr.cjs");
-const require_url = require("./url-CsOV_B_P.cjs");
+const require_url = require("./url-CPfMatUL.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region src/url.test.ts
@@ -271,6 +270,35 @@ let node_test = require("node:test");
 	await require_url.validatePublicUrl("https://[2001:db8::1]");
 	await require_url.validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
+(0, node_test.test)("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
+	require_url.validateLookupAddresses([
+		{
+			address: "app-host.example.net.",
+			family: 4
+		},
+		{
+			address: "93.184.216.34",
+			family: 4
+		},
+		{
+			address: "2606:2800:220:1:248:1893:25c8:1946",
+			family: 6
+		}
+	]);
+});
+(0, node_test.test)("validateLookupAddresses() rejects unsafe or CNAME-only Cloudflare Workers results", () => {
+	(0, node_assert.throws)(() => require_url.validateLookupAddresses([{
+		address: "private-host.example.net.",
+		family: 4
+	}, {
+		address: "127.0.0.1",
+		family: 4
+	}]), require_url.UrlError);
+	(0, node_assert.throws)(() => require_url.validateLookupAddresses([{
+		address: "app-host.example.net.",
+		family: 4
+	}]), require_url.UrlError);
+});
 (0, node_test.test)("isValidPublicIPv4Address()", () => {
 	(0, node_assert.ok)(require_url.isValidPublicIPv4Address("8.8.8.8"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.168.1.1"));

package/dist/tests/url.test.mjs

@@ -1,4 +1,4 @@
-import { a as formatIri, c as haveSameIriOrigin, d as isValidPublicIPv6Address, f as parseGatewayUrl, h as validatePublicUrl, i as expandIPv6Address, l as isGatewayUrl, m as parseJsonLdId, n as arePortableUrisEqual, o as getFe34Origin, p as parseIri, r as canonicalizePortableUri, s as haveSameFe34Origin, t as UrlError, u as isValidPublicIPv4Address } from "./url-Du7RQQgP.mjs";
+import { a as formatIri, c as haveSameIriOrigin, d as isValidPublicIPv6Address, f as parseGatewayUrl, g as validatePublicUrl, h as validateLookupAddresses, i as expandIPv6Address, l as isGatewayUrl, m as parseJsonLdId, n as arePortableUrisEqual, o as getFe34Origin, p as parseIri, r as canonicalizePortableUri, s as haveSameFe34Origin, t as UrlError, u as isValidPublicIPv4Address } from "./url-Basm1L_c.mjs";
 import { deepStrictEqual, ok, rejects, throws } from "node:assert";
 import { test } from "node:test";
 //#region src/url.test.ts
@@ -270,6 +270,35 @@ test("validatePublicUrl()", async () => {
 	await validatePublicUrl("https://[2001:db8::1]");
 	await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
+test("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
+	validateLookupAddresses([
+		{
+			address: "app-host.example.net.",
+			family: 4
+		},
+		{
+			address: "93.184.216.34",
+			family: 4
+		},
+		{
+			address: "2606:2800:220:1:248:1893:25c8:1946",
+			family: 6
+		}
+	]);
+});
+test("validateLookupAddresses() rejects unsafe or CNAME-only Cloudflare Workers results", () => {
+	throws(() => validateLookupAddresses([{
+		address: "private-host.example.net.",
+		family: 4
+	}, {
+		address: "127.0.0.1",
+		family: 4
+	}]), UrlError);
+	throws(() => validateLookupAddresses([{
+		address: "app-host.example.net.",
+		family: 4
+	}]), UrlError);
+});
 test("isValidPublicIPv4Address()", () => {
 	ok(isValidPublicIPv4Address("8.8.8.8"));
 	ok(!isValidPublicIPv4Address("192.168.1.1"));

package/dist/{url-DGVbSVVi.js → url-BHAShw9J.js}

@@ -3,8 +3,8 @@ import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 //#region src/url.ts
 var UrlError = class extends Error {
-	constructor(message) {
-		super(message);
+	constructor(message, options) {
+		super(message, options);
 		this.name = "UrlError";
 	}
 };
@@ -248,10 +248,37 @@ async function validatePublicUrl(url) {
 	let addresses;
 	try {
 		addresses = await lookup(hostname, { all: true });
-	} catch {
-		addresses = [];
+	} catch (error) {
+		throw new UrlError("DNS lookup failed", { cause: error });
+	}
+	validateLookupAddresses(addresses);
+}
+/**
+* Validates the IP addresses returned by `node:dns.lookup()`.
+*
+* Cloudflare Workers' `node:dns` implementation currently maps every record
+* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+* `LookupAddress`, even though Node.js specifies that the `address` field must
+* contain an IPv4 or IPv6 literal.  See:
+* https://github.com/cloudflare/workerd/issues/6886
+*
+* Work around that bug by ignoring non-IP entries only when the lookup also
+* returns at least one actual IP address.  This remains fail-closed: a result
+* containing no IP addresses is rejected, and every returned IP address is
+* still validated and must be public.  This workaround can be revisited once
+* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+*
+* @internal
+*/
+function validateLookupAddresses(addresses) {
+	let ipAddressCount = 0;
+	for (const { address } of addresses) {
+		const family = isIP(address);
+		if (family === 0) continue;
+		ipAddressCount++;
+		validatePublicIpAddress(address, family);
 	}
-	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address");
 }
 function validatePublicIpAddress(address, family) {
 	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;

package/dist/{url-DD4F0ULf.cjs → url-i33c0US6.cjs}

@@ -1,11 +1,10 @@
 
-require("./chunk-M78iaK0I.cjs");
 let node_dns_promises = require("node:dns/promises");
 let node_net = require("node:net");
 //#region src/url.ts
 var UrlError = class extends Error {
-	constructor(message) {
-		super(message);
+	constructor(message, options) {
+		super(message, options);
 		this.name = "UrlError";
 	}
 };
@@ -249,10 +248,37 @@ async function validatePublicUrl(url) {
 	let addresses;
 	try {
 		addresses = await (0, node_dns_promises.lookup)(hostname, { all: true });
-	} catch {
-		addresses = [];
+	} catch (error) {
+		throw new UrlError("DNS lookup failed", { cause: error });
+	}
+	validateLookupAddresses(addresses);
+}
+/**
+* Validates the IP addresses returned by `node:dns.lookup()`.
+*
+* Cloudflare Workers' `node:dns` implementation currently maps every record
+* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+* `LookupAddress`, even though Node.js specifies that the `address` field must
+* contain an IPv4 or IPv6 literal.  See:
+* https://github.com/cloudflare/workerd/issues/6886
+*
+* Work around that bug by ignoring non-IP entries only when the lookup also
+* returns at least one actual IP address.  This remains fail-closed: a result
+* containing no IP addresses is rejected, and every returned IP address is
+* still validated and must be public.  This workaround can be revisited once
+* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+*
+* @internal
+*/
+function validateLookupAddresses(addresses) {
+	let ipAddressCount = 0;
+	for (const { address } of addresses) {
+		const family = (0, node_net.isIP)(address);
+		if (family === 0) continue;
+		ipAddressCount++;
+		validatePublicIpAddress(address, family);
 	}
-	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address");
 }
 function validatePublicIpAddress(address, family) {
 	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.1668+90797b01",
+  "version": "2.4.0-dev.1740+32e9952c",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/contexts/miscellany.json

@@ -0,0 +1,19 @@
+{
+  "@context": {
+    "as": "https://www.w3.org/ns/activitystreams#",
+    "xsd": "http://www.w3.org/2001/XMLSchema#",
+    "Hashtag": "as:Hashtag",
+    "manuallyApprovesFollowers": {
+      "@id": "as:manuallyApprovesFollowers",
+      "@type": "xsd:boolean"
+    },
+    "movedTo": {
+      "@id": "as:movedTo",
+      "@type": "@id"
+    },
+    "sensitive": {
+      "@id": "as:sensitive",
+      "@type": "xsd:boolean"
+    }
+  }
+}

package/src/contexts.ts

@@ -13,6 +13,7 @@ import gotosocial from "./contexts/gotosocial.json" with { type: "json" };
 import identityV1 from "./contexts/identity-v1.json" with { type: "json" };
 import joinLemmyContext from "./contexts/join-lemmy.json" with { type: "json" };
 import joinmastodon from "./contexts/joinmastodon.json" with { type: "json" };
+import miscellany from "./contexts/miscellany.json" with { type: "json" };
 import schemaorg from "./contexts/schemaorg.json" with { type: "json" };
 import securityDataIntegrityV1 from "./contexts/security-data-integrity-v1.json" with {
   type: "json",
@@ -59,6 +60,18 @@ const preloadedContexts: Record<string, unknown> = {
   // See: https://github.com/mastodon/joinmastodon/issues/148
   //      https://github.com/fedify-dev/fedify/issues/630
   "http://joinmastodon.org/ns": joinmastodon,
+
+  // The SWICG "ActivityPub Miscellaneous Terms" context.  Bridgy Fed (via
+  // granary) references this URL in the @context of every activity it sends,
+  // and other implementations use it as the recommended home for widely
+  // deployed extension terms like as:Hashtag and as:sensitive.  It is served
+  // through purl.archive.org (Internet Archive's PURL service), which suffers
+  // recurring outages; while it is unreachable, every activity referencing
+  // this URL fails JSON-LD expansion before application handlers run.  The
+  // document is a deliberately stable, versioned SWICG deliverable, so we
+  // ship a built-in copy.
+  // See: https://swicg.github.io/miscellany/
+  "https://purl.archive.org/miscellany": miscellany,
 };
 
 export default preloadedContexts;

package/src/url.test.ts

@@ -15,6 +15,7 @@ import {
   parseIri,
   parseJsonLdId,
   UrlError,
+  validateLookupAddresses,
   validatePublicUrl,
 } from "./url.ts";
 
@@ -718,6 +719,32 @@ test("validatePublicUrl()", async () => {
   await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
 
+test("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
+  validateLookupAddresses([
+    { address: "app-host.example.net.", family: 4 },
+    { address: "93.184.216.34", family: 4 },
+    { address: "2606:2800:220:1:248:1893:25c8:1946", family: 6 },
+  ]);
+});
+
+test("validateLookupAddresses() rejects unsafe or CNAME-only Cloudflare Workers results", () => {
+  throws(
+    () =>
+      validateLookupAddresses([
+        { address: "private-host.example.net.", family: 4 },
+        { address: "127.0.0.1", family: 4 },
+      ]),
+    UrlError,
+  );
+  throws(
+    () =>
+      validateLookupAddresses([
+        { address: "app-host.example.net.", family: 4 },
+      ]),
+    UrlError,
+  );
+});
+
 test("isValidPublicIPv4Address()", () => {
   ok(isValidPublicIPv4Address("8.8.8.8")); // Google DNS
   ok(!isValidPublicIPv4Address("192.168.1.1")); // private

package/src/url.ts

@@ -3,8 +3,8 @@ import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 
 export class UrlError extends Error {
-  constructor(message: string) {
-    super(message);
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
     this.name = "UrlError";
   }
 }
@@ -388,12 +388,42 @@ export async function validatePublicUrl(url: string): Promise<void> {
   let addresses: LookupAddress[];
   try {
     addresses = await lookup(hostname, { all: true });
-  } catch {
-    addresses = [];
+  } catch (error) {
+    throw new UrlError("DNS lookup failed", { cause: error });
   }
-  for (const { address, family } of addresses) {
+  validateLookupAddresses(addresses);
+}
+
+/**
+ * Validates the IP addresses returned by `node:dns.lookup()`.
+ *
+ * Cloudflare Workers' `node:dns` implementation currently maps every record
+ * in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+ * `LookupAddress`, even though Node.js specifies that the `address` field must
+ * contain an IPv4 or IPv6 literal.  See:
+ * https://github.com/cloudflare/workerd/issues/6886
+ *
+ * Work around that bug by ignoring non-IP entries only when the lookup also
+ * returns at least one actual IP address.  This remains fail-closed: a result
+ * containing no IP addresses is rejected, and every returned IP address is
+ * still validated and must be public.  This workaround can be revisited once
+ * the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+ *
+ * @internal
+ */
+export function validateLookupAddresses(
+  addresses: readonly LookupAddress[],
+): void {
+  let ipAddressCount = 0;
+  for (const { address } of addresses) {
+    const family = isIP(address);
+    if (family === 0) continue;
+    ipAddressCount++;
     validatePublicIpAddress(address, family);
   }
+  if (ipAddressCount === 0) {
+    throw new UrlError("DNS lookup did not return any IP address");
+  }
 }
 
 function validatePublicIpAddress(address: string, family: number): void {