@fedify/vocab-runtime 2.4.0-dev.2149 → 2.4.0-dev.2157

package/src/docloader.ts

@@ -324,6 +324,8 @@ export interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 
 /**
  * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+ * At most 20 HTTP redirects and alternate document links are followed in total
+ * per call.  Revisiting a URL within that chain throws a {@link FetchError}.
  *
  * The created loader preloads the below frequently used contexts by default
  * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -336,6 +338,7 @@ export interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
  * - <https://www.w3.org/ns/cid/v1>
  * - <https://w3id.org/security/multikey/v1>
  * - <https://w3id.org/fep/ef61>
+ * - <https://w3id.org/fep/7aa9>
  * - <https://purl.archive.org/socialweb/webfinger>
  * - <http://schema.org/>
  * @param options Options for the document loader.
@@ -371,13 +374,20 @@ export function getDocumentLoader(
         await validatePublicUrl(currentUrl);
       } catch (error) {
         if (error instanceof UrlError) {
-          logger[options?.suppressError ? "warn" : "error"](
-            "Disallowed private URL: {url}",
-            {
+          if (error.reason === "dns") {
+            logger.debug("DNS lookup failed for {url}", {
               url: currentUrl,
               error,
-            },
-          );
+            });
+          } else {
+            logger[options?.suppressError ? "warn" : "error"](
+              "Disallowed private URL: {url}",
+              {
+                url: currentUrl,
+                error,
+              },
+            );
+          }
         }
         throw error;
       }
@@ -442,7 +452,22 @@ export function getDocumentLoader(
           const result = await getRemoteDocument(
             currentUrl,
             response,
-            load,
+            async (alternateUrl) => {
+              options?.signal?.throwIfAborted();
+              if (redirected >= DEFAULT_MAX_REDIRECTION) {
+                throw new FetchError(
+                  currentUrl,
+                  `Too many redirections (${redirected + 1})`,
+                );
+              }
+              if (visited.has(alternateUrl)) {
+                throw new FetchError(
+                  currentUrl,
+                  `Redirect loop detected: ${alternateUrl}`,
+                );
+              }
+              return await load(alternateUrl, options, redirected + 1, visited);
+            },
             options,
           );
           span.setAttribute("docloader.document_url", result.documentUrl);
@@ -463,5 +488,5 @@ export function getDocumentLoader(
       },
     );
   }
-  return load;
+  return (url, options) => load(url, options);
 }

package/src/url.test.ts

@@ -1,4 +1,4 @@
-import { deepStrictEqual, ok, rejects, throws } from "node:assert";
+import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert";
 import { test } from "node:test";
 import {
   arePortableUrisEqual,
@@ -1023,6 +1023,28 @@ test("compatible identifier conversion round-trips", () => {
   );
 });
 
+test("UrlError reason is independent of its cause", () => {
+  const cause = new Error("Underlying failure");
+  strictEqual(new UrlError("Rejected URL").reason, "disallowed");
+  const disallowedError = new UrlError("Rejected URL", { cause });
+  strictEqual(disallowedError.reason, "disallowed");
+  strictEqual(disallowedError.cause, cause);
+  const dnsError = new UrlError("Lookup failed", { reason: "dns", cause });
+  strictEqual(dnsError.reason, "dns");
+  strictEqual(dnsError.cause, cause);
+});
+
+test("validatePublicUrl() classifies disallowed URLs", async () => {
+  for (
+    const url of ["ftp://example.com", "https://localhost", "https://127.0.0.1"]
+  ) {
+    await rejects(() => validatePublicUrl(url), {
+      name: "UrlError",
+      reason: "disallowed",
+    });
+  }
+});
+
 test("validatePublicUrl()", async () => {
   await rejects(() => validatePublicUrl("ftp://localhost"), UrlError);
   await rejects(
@@ -1095,15 +1117,19 @@ test("validateLookupAddresses() rejects unsafe or CNAME-only Cloudflare Workers
         { address: "private-host.example.net.", family: 4 },
         { address: "127.0.0.1", family: 4 },
       ]),
-    UrlError,
+    { name: "UrlError", reason: "disallowed" },
   );
   throws(
     () =>
       validateLookupAddresses([
         { address: "app-host.example.net.", family: 4 },
       ]),
-    UrlError,
+    { name: "UrlError", reason: "dns" },
   );
+  throws(() => validateLookupAddresses([]), {
+    name: "UrlError",
+    reason: "dns",
+  });
 });
 
 test("isValidPublicIPv4Address()", () => {

package/src/url.ts

@@ -1,11 +1,25 @@
 import type { LookupAddress } from "node:dns";
-import { lookup } from "node:dns/promises";
+// FIXME: the default dns import exists since tests can stub `dns.lookup()`.
+// This should be replaced by injecting the lookup function such as an internal
+// option on `validatePublicUrl()`
+import dns from "node:dns/promises";
 import { isIP } from "node:net";
 
 export class UrlError extends Error {
-  constructor(message: string, options?: { cause?: unknown }) {
+  /**
+   * The failure category. Defaults to `"disallowed"`.
+   * `"dns"` includes lookup errors and results with no usable IP addresses.
+   * @since 2.0.29
+   */
+  readonly reason: "dns" | "disallowed";
+
+  constructor(
+    message: string,
+    options?: { cause?: unknown; reason?: "dns" | "disallowed" },
+  ) {
     super(message, options);
     this.name = "UrlError";
+    this.reason = options?.reason ?? "disallowed";
   }
 }
 
@@ -622,9 +636,9 @@ export async function validatePublicUrl(url: string): Promise<void> {
   // and ensure that they are all public:
   let addresses: LookupAddress[];
   try {
-    addresses = await lookup(hostname, { all: true });
+    addresses = await dns.lookup(hostname, { all: true });
   } catch (error) {
-    throw new UrlError("DNS lookup failed", { cause: error });
+    throw new UrlError("DNS lookup failed", { cause: error, reason: "dns" });
   }
   validateLookupAddresses(addresses);
 }
@@ -657,7 +671,9 @@ export function validateLookupAddresses(
     validatePublicIpAddress(address, family);
   }
   if (ipAddressCount === 0) {
-    throw new UrlError("DNS lookup did not return any IP address");
+    throw new UrlError("DNS lookup did not return any IP address", {
+      reason: "dns",
+    });
   }
 }
 

package/dist/{contexts-2hEbs3Qk.cjs → contexts-BK1CqBR5.cjs}

@@ -4297,28 +4297,6 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
-	"https://w3id.org/fep/7aa9": { "@context": {
-		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
-		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
-		"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
-		"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
-		"topic": {
-			"@id": "https://w3id.org/fep/7aa9#topic",
-			"@type": "@id"
-		},
-		"featuredObject": {
-			"@id": "https://w3id.org/fep/7aa9#featuredObject",
-			"@type": "@id"
-		},
-		"canFeature": {
-			"@id": "https://w3id.org/fep/7aa9#canFeature",
-			"@type": "@id"
-		},
-		"featureAuthorization": {
-			"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
-			"@type": "@id"
-		}
-	} },
 	"https://www.w3.org/ns/cid/v1": { "@context": {
 		"@protected": true,
 		"id": "@id",
@@ -4438,6 +4416,28 @@ const preloadedContexts = {
 		},
 		"digestMultibase": "https://www.w3.org/ns/credentials/v2#digestMultibase"
 	} },
+	"https://w3id.org/fep/7aa9": { "@context": {
+		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
+		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
+		"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
+		"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
+		"topic": {
+			"@id": "https://w3id.org/fep/7aa9#topic",
+			"@type": "@id"
+		},
+		"featuredObject": {
+			"@id": "https://w3id.org/fep/7aa9#featuredObject",
+			"@type": "@id"
+		},
+		"canFeature": {
+			"@id": "https://w3id.org/fep/7aa9#canFeature",
+			"@type": "@id"
+		},
+		"featureAuthorization": {
+			"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
+			"@type": "@id"
+		}
+	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",

package/dist/{contexts-DoZUIW7y.js → contexts-DPuJ4UYL.js}

@@ -4297,28 +4297,6 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
-	"https://w3id.org/fep/7aa9": { "@context": {
-		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
-		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
-		"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
-		"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
-		"topic": {
-			"@id": "https://w3id.org/fep/7aa9#topic",
-			"@type": "@id"
-		},
-		"featuredObject": {
-			"@id": "https://w3id.org/fep/7aa9#featuredObject",
-			"@type": "@id"
-		},
-		"canFeature": {
-			"@id": "https://w3id.org/fep/7aa9#canFeature",
-			"@type": "@id"
-		},
-		"featureAuthorization": {
-			"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
-			"@type": "@id"
-		}
-	} },
 	"https://www.w3.org/ns/cid/v1": { "@context": {
 		"@protected": true,
 		"id": "@id",
@@ -4438,6 +4416,28 @@ const preloadedContexts = {
 		},
 		"digestMultibase": "https://www.w3.org/ns/credentials/v2#digestMultibase"
 	} },
+	"https://w3id.org/fep/7aa9": { "@context": {
+		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
+		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
+		"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
+		"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
+		"topic": {
+			"@id": "https://w3id.org/fep/7aa9#topic",
+			"@type": "@id"
+		},
+		"featuredObject": {
+			"@id": "https://w3id.org/fep/7aa9#featuredObject",
+			"@type": "@id"
+		},
+		"canFeature": {
+			"@id": "https://w3id.org/fep/7aa9#canFeature",
+			"@type": "@id"
+		},
+		"featureAuthorization": {
+			"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
+			"@type": "@id"
+		}
+	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",

package/dist/tests/{contexts-BBX_qhBL.mjs → contexts-CIKsin4e.mjs}

@@ -4411,6 +4411,15 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
+	"https://www.w3.org/ns/cid/v1": cid_v1_default,
+	"https://w3id.org/fep/ef61": { "@context": {
+		"gateways": {
+			"@id": "https://w3id.org/fep/ef61/gateways",
+			"@type": "@id",
+			"@container": "@list"
+		},
+		"digestMultibase": "https://www.w3.org/ns/credentials/v2#digestMultibase"
+	} },
 	"https://w3id.org/fep/7aa9": { "@context": {
 		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
 		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
@@ -4433,15 +4442,6 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
-	"https://www.w3.org/ns/cid/v1": cid_v1_default,
-	"https://w3id.org/fep/ef61": { "@context": {
-		"gateways": {
-			"@id": "https://w3id.org/fep/ef61/gateways",
-			"@type": "@id",
-			"@container": "@list"
-		},
-		"digestMultibase": "https://www.w3.org/ns/credentials/v2#digestMultibase"
-	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",

package/dist/tests/{contexts-Ch3v2Cgu.cjs → contexts-DizzBjz4.cjs}

@@ -4411,6 +4411,15 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
+	"https://www.w3.org/ns/cid/v1": cid_v1_default,
+	"https://w3id.org/fep/ef61": { "@context": {
+		"gateways": {
+			"@id": "https://w3id.org/fep/ef61/gateways",
+			"@type": "@id",
+			"@container": "@list"
+		},
+		"digestMultibase": "https://www.w3.org/ns/credentials/v2#digestMultibase"
+	} },
 	"https://w3id.org/fep/7aa9": { "@context": {
 		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
 		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
@@ -4433,15 +4442,6 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
-	"https://www.w3.org/ns/cid/v1": cid_v1_default,
-	"https://w3id.org/fep/ef61": { "@context": {
-		"gateways": {
-			"@id": "https://w3id.org/fep/ef61/gateways",
-			"@type": "@id",
-			"@container": "@list"
-		},
-		"digestMultibase": "https://www.w3.org/ns/credentials/v2#digestMultibase"
-	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",