@fedify/vocab-runtime 2.5.0-dev.2424 → 2.5.0-dev.2432

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.5.0-dev.2424+97214632",
+  "version": "2.5.0-dev.2432+f56118e1",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/mod.cjs

@@ -16,7 +16,7 @@ let _multiformats_base_x = require("@multiformats/base-x");
 _multiformats_base_x = require_rolldown_runtime.__toESM(_multiformats_base_x, 1);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.5.0-dev.2424+97214632";
+var version = "2.5.0-dev.2432+f56118e1";
 //#endregion
 //#region src/request.ts
 /**
@@ -774,6 +774,7 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 		options?.signal?.throwIfAborted();
 		const parsedUrl = new URL(url);
 		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new require_url.UrlError(`Unsupported protocol: ${parsedUrl.protocol}`);
+		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new require_url.UrlError("URLs with credentials are not allowed");
 		const currentUrl = parsedUrl.href;
 		if (!skipPreloadedContexts && currentUrl in require_contexts.preloadedContexts) {
 			logger.debug("Using preloaded context: {url}.", { url: currentUrl });

package/dist/mod.js

@@ -12,7 +12,7 @@ import { PublicKeyInfo } from "pkijs";
 import baseX from "@multiformats/base-x";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.5.0-dev.2424+97214632";
+var version = "2.5.0-dev.2432+f56118e1";
 //#endregion
 //#region src/request.ts
 /**
@@ -770,6 +770,7 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 		options?.signal?.throwIfAborted();
 		const parsedUrl = new URL(url);
 		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsedUrl.protocol}`);
+		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new UrlError("URLs with credentials are not allowed");
 		const currentUrl = parsedUrl.href;
 		if (!skipPreloadedContexts && currentUrl in preloadedContexts) {
 			logger.debug("Using preloaded context: {url}.", { url: currentUrl });

package/dist/tests/{body-Djuimvjd.mjs → body-B6FmobUg.mjs}

@@ -1,4 +1,4 @@
-import { t as FetchError } from "./request-BHqGsrJF.mjs";
+import { t as FetchError } from "./request-ClluSsbr.mjs";
 import { getLogger } from "@logtape/logtape";
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */

package/dist/tests/{body-DVcRd85t.cjs → body-DLo6Wfqk.cjs}

@@ -1,4 +1,4 @@
-const require_request = require("./request-3qhu9psJ.cjs");
+const require_request = require("./request-B5PYS32O.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */

package/dist/tests/body.test.cjs

@@ -1,4 +1,4 @@
-const require_body = require("./body-DVcRd85t.cjs");
+const require_body = require("./body-DLo6Wfqk.cjs");
 let node_assert_strict = require("node:assert/strict");
 let node_test = require("node:test");
 let node_zlib = require("node:zlib");

package/dist/tests/body.test.mjs

@@ -1,4 +1,4 @@
-import { i as readBoundedText, t as BodyTooLargeError } from "./body-Djuimvjd.mjs";
+import { i as readBoundedText, t as BodyTooLargeError } from "./body-B6FmobUg.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
 import { test } from "node:test";
 import { gunzipSync, gzipSync } from "node:zlib";

package/dist/tests/decimal.test.cjs

@@ -1,12 +1,12 @@
-require("./request-3qhu9psJ.cjs");
+require("./request-B5PYS32O.cjs");
 require("./url-BNakuZ8k.cjs");
-require("./docloader-DzwnQe1e.cjs");
+require("./docloader-D5A8bwJx.cjs");
 require("./key-C-AYkdJJ.cjs");
 require("./multibase-B5Mea7Ip.cjs");
 require("./digest-3FeH2Y-Q.cjs");
 require("./langtag-DASCPgl3.cjs");
 require("./langstr-h89Kjekh.cjs");
-require("./portable-media-LtEUNA6B.cjs");
+require("./portable-media-BhuGLllk.cjs");
 let node_test = require("node:test");
 let node_assert = require("node:assert");
 //#region src/decimal.ts

package/dist/tests/decimal.test.mjs

@@ -1,12 +1,12 @@
-import "./request-BHqGsrJF.mjs";
+import "./request-ClluSsbr.mjs";
 import "./url-DMxmp7ZG.mjs";
-import "./docloader--jQ3XcCi.mjs";
+import "./docloader-BwMNJWDL.mjs";
 import "./key-C2Db_TAJ.mjs";
 import "./multibase-BPnF_L4e.mjs";
 import "./digest-COC7xDiQ.mjs";
 import "./langtag-CD3zHKPN.mjs";
 import "./langstr-Dw8IBDZl.mjs";
-import "./portable-media-BHBIOsiA.mjs";
+import "./portable-media-DudjnSMO.mjs";
 import { test } from "node:test";
 import { deepStrictEqual, throws } from "node:assert";
 //#region src/decimal.ts

package/dist/tests/{docloader--jQ3XcCi.mjs → docloader-BwMNJWDL.mjs}

@@ -1,6 +1,6 @@
-import { a as logRequest, n as createActivityPubRequest, o as name, s as version, t as FetchError } from "./request-BHqGsrJF.mjs";
+import { a as logRequest, n as createActivityPubRequest, o as name, s as version, t as FetchError } from "./request-ClluSsbr.mjs";
 import { n as UrlError, x as validatePublicUrl } from "./url-DMxmp7ZG.mjs";
-import { i as readBoundedText, n as MAX_BODY_SIZE, r as readBoundedBytes, t as BodyTooLargeError } from "./body-Djuimvjd.mjs";
+import { i as readBoundedText, n as MAX_BODY_SIZE, r as readBoundedBytes, t as BodyTooLargeError } from "./body-B6FmobUg.mjs";
 import { t as preloadedContexts } from "./contexts-duRA_dDC.mjs";
 import { t as HttpHeaderLink } from "./link-Cevmc87v.mjs";
 import { getLogger } from "@logtape/logtape";
@@ -293,6 +293,7 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 		options?.signal?.throwIfAborted();
 		const parsedUrl = new URL(url);
 		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsedUrl.protocol}`);
+		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new UrlError("URLs with credentials are not allowed");
 		const currentUrl = parsedUrl.href;
 		if (!skipPreloadedContexts && currentUrl in preloadedContexts) {
 			logger.debug("Using preloaded context: {url}.", { url: currentUrl });

package/dist/tests/{docloader-DzwnQe1e.cjs → docloader-D5A8bwJx.cjs}

@@ -1,6 +1,6 @@
-const require_request = require("./request-3qhu9psJ.cjs");
+const require_request = require("./request-B5PYS32O.cjs");
 const require_url = require("./url-BNakuZ8k.cjs");
-const require_body = require("./body-DVcRd85t.cjs");
+const require_body = require("./body-DLo6Wfqk.cjs");
 const require_contexts = require("./contexts-C9Lj11SC.cjs");
 const require_link = require("./link-DlKm8bEr.cjs");
 let _logtape_logtape = require("@logtape/logtape");
@@ -293,6 +293,7 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 		options?.signal?.throwIfAborted();
 		const parsedUrl = new URL(url);
 		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new require_url.UrlError(`Unsupported protocol: ${parsedUrl.protocol}`);
+		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new require_url.UrlError("URLs with credentials are not allowed");
 		const currentUrl = parsedUrl.href;
 		if (!skipPreloadedContexts && currentUrl in require_contexts.preloadedContexts) {
 			logger.debug("Using preloaded context: {url}.", { url: currentUrl });

package/dist/tests/docloader.test.cjs

@@ -1,8 +1,8 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_request = require("./request-3qhu9psJ.cjs");
+const require_request = require("./request-B5PYS32O.cjs");
 const require_url = require("./url-BNakuZ8k.cjs");
 const require_contexts = require("./contexts-C9Lj11SC.cjs");
-const require_docloader = require("./docloader-DzwnQe1e.cjs");
+const require_docloader = require("./docloader-D5A8bwJx.cjs");
 const require_jsonld = require("./jsonld-CmDhHNTx.cjs");
 let node_zlib = require("node:zlib");
 let _logtape_logtape = require("@logtape/logtape");
@@ -2376,6 +2376,52 @@ const unsupportedUrls = [
 	"file:///collection",
 	`data:application/ld+json,${encodeURIComponent(JSON.stringify({ id: "https://example.com/data" }))}`
 ];
+function isCredentialUrlError(error) {
+	return error instanceof require_url.UrlError && error.reason === "disallowed" && error.message === "URLs with credentials are not allowed";
+}
+(0, _fedify_fixture.test)("getDocumentLoader() rejects URLs with credentials", async (t) => {
+	const start = "https://8.8.8.8/start";
+	const target = "https://user:pass@8.8.8.8/document";
+	for (const allowPrivateAddress of [false, true]) {
+		const loader = require_docloader.getDocumentLoader({ allowPrivateAddress });
+		for (const path of [
+			"direct",
+			"redirect",
+			"Link",
+			"HTML"
+		]) await t.step(`${path}, allowPrivateAddress=${allowPrivateAddress}`, async () => {
+			await withFetchStub((url) => {
+				if (url !== start) return Response.json({});
+				if (path === "redirect") return Response.redirect(target, 302);
+				if (path === "HTML") return new Response(`<link rel="alternate" type="application/activity+json" href="${target}">`, { headers: { "Content-Type": "text/html" } });
+				return new Response("", { headers: {
+					"Content-Type": "text/plain",
+					Link: `<${target}>; rel="alternate"; type="application/activity+json"`
+				} });
+			}, async (fetched) => {
+				await (0, node_assert.rejects)(loader(path === "direct" ? target : start), isCredentialUrlError);
+				(0, node_assert.deepStrictEqual)(fetched, path === "direct" ? [] : [start]);
+			});
+		});
+		for (const url of [
+			"https://user@8.8.8.8/document",
+			"https://:pass@8.8.8.8/document",
+			"https://%75ser:p%40ss@8.8.8.8/document",
+			"http://user:pass@8.8.8.8/document"
+		]) await t.step(`${url}, allowPrivateAddress=${allowPrivateAddress}`, async () => {
+			await withFetchStub(() => Response.json({}), async (fetched) => {
+				await (0, node_assert.rejects)(loader(url), isCredentialUrlError);
+				(0, node_assert.deepStrictEqual)(fetched, []);
+			});
+		});
+		for (const url of ["https://:@8.8.8.8/document", "https://8.8.8.8/@user?q=@pass"]) await t.step(`allows ${url}, allowPrivateAddress=${allowPrivateAddress}`, async () => {
+			await withFetchStub(() => Response.json({ done: true }), async (fetched) => {
+				(0, node_assert.deepStrictEqual)((await loader(url)).document, { done: true });
+				(0, node_assert.deepStrictEqual)(fetched, [new URL(url).href]);
+			});
+		});
+	}
+});
 function isUnsupportedProtocolError(error, url) {
 	return error instanceof require_url.UrlError && error.message === `Unsupported protocol: ${new URL(url).protocol}` && error.reason === "disallowed";
 }

package/dist/tests/docloader.test.mjs

@@ -1,7 +1,7 @@
-import { t as FetchError } from "./request-BHqGsrJF.mjs";
+import { t as FetchError } from "./request-ClluSsbr.mjs";
 import { n as UrlError } from "./url-DMxmp7ZG.mjs";
 import { n as cid_v1_default, t as preloadedContexts } from "./contexts-duRA_dDC.mjs";
-import { i as withDocumentLoaderTimeout, n as getRemoteDocument, r as resolveDocumentLoaderTimeout, t as getDocumentLoader } from "./docloader--jQ3XcCi.mjs";
+import { i as withDocumentLoaderTimeout, n as getRemoteDocument, r as resolveDocumentLoaderTimeout, t as getDocumentLoader } from "./docloader-BwMNJWDL.mjs";
 import { t as jsonld_default } from "./jsonld-DweIJ07b.mjs";
 import { gzipSync } from "node:zlib";
 import { configure, reset } from "@logtape/logtape";
@@ -2394,6 +2394,52 @@ const unsupportedUrls = [
 	"file:///collection",
 	`data:application/ld+json,${encodeURIComponent(JSON.stringify({ id: "https://example.com/data" }))}`
 ];
+function isCredentialUrlError(error) {
+	return error instanceof UrlError && error.reason === "disallowed" && error.message === "URLs with credentials are not allowed";
+}
+test("getDocumentLoader() rejects URLs with credentials", async (t) => {
+	const start = "https://8.8.8.8/start";
+	const target = "https://user:pass@8.8.8.8/document";
+	for (const allowPrivateAddress of [false, true]) {
+		const loader = getDocumentLoader({ allowPrivateAddress });
+		for (const path of [
+			"direct",
+			"redirect",
+			"Link",
+			"HTML"
+		]) await t.step(`${path}, allowPrivateAddress=${allowPrivateAddress}`, async () => {
+			await withFetchStub((url) => {
+				if (url !== start) return Response.json({});
+				if (path === "redirect") return Response.redirect(target, 302);
+				if (path === "HTML") return new Response(`<link rel="alternate" type="application/activity+json" href="${target}">`, { headers: { "Content-Type": "text/html" } });
+				return new Response("", { headers: {
+					"Content-Type": "text/plain",
+					Link: `<${target}>; rel="alternate"; type="application/activity+json"`
+				} });
+			}, async (fetched) => {
+				await rejects(loader(path === "direct" ? target : start), isCredentialUrlError);
+				deepStrictEqual(fetched, path === "direct" ? [] : [start]);
+			});
+		});
+		for (const url of [
+			"https://user@8.8.8.8/document",
+			"https://:pass@8.8.8.8/document",
+			"https://%75ser:p%40ss@8.8.8.8/document",
+			"http://user:pass@8.8.8.8/document"
+		]) await t.step(`${url}, allowPrivateAddress=${allowPrivateAddress}`, async () => {
+			await withFetchStub(() => Response.json({}), async (fetched) => {
+				await rejects(loader(url), isCredentialUrlError);
+				deepStrictEqual(fetched, []);
+			});
+		});
+		for (const url of ["https://:@8.8.8.8/document", "https://8.8.8.8/@user?q=@pass"]) await t.step(`allows ${url}, allowPrivateAddress=${allowPrivateAddress}`, async () => {
+			await withFetchStub(() => Response.json({ done: true }), async (fetched) => {
+				deepStrictEqual((await loader(url)).document, { done: true });
+				deepStrictEqual(fetched, [new URL(url).href]);
+			});
+		});
+	}
+});
 function isUnsupportedProtocolError(error, url) {
 	return error instanceof UrlError && error.message === `Unsupported protocol: ${new URL(url).protocol}` && error.reason === "disallowed";
 }

package/dist/tests/{portable-media-LtEUNA6B.cjs → portable-media-BhuGLllk.cjs}

@@ -1,6 +1,6 @@
-const require_request = require("./request-3qhu9psJ.cjs");
+const require_request = require("./request-B5PYS32O.cjs");
 const require_url = require("./url-BNakuZ8k.cjs");
-const require_body = require("./body-DVcRd85t.cjs");
+const require_body = require("./body-DLo6Wfqk.cjs");
 const require_digest = require("./digest-3FeH2Y-Q.cjs");
 //#region src/portable-media.ts
 function resolveTimeout(value, fallback) {

package/dist/tests/{portable-media-BHBIOsiA.mjs → portable-media-DudjnSMO.mjs}

@@ -1,6 +1,6 @@
-import { r as getUserAgent } from "./request-BHqGsrJF.mjs";
+import { r as getUserAgent } from "./request-ClluSsbr.mjs";
 import { g as parseGatewayUrl, x as validatePublicUrl } from "./url-DMxmp7ZG.mjs";
-import { r as readBoundedBytes } from "./body-Djuimvjd.mjs";
+import { r as readBoundedBytes } from "./body-B6FmobUg.mjs";
 import { a as verifyDigestMultibase, i as parseHashlink, r as parseDigestMultibase } from "./digest-COC7xDiQ.mjs";
 //#region src/portable-media.ts
 function resolveTimeout(value, fallback) {

package/dist/tests/portable-media.test.cjs

@@ -1,5 +1,5 @@
 const require_digest = require("./digest-3FeH2Y-Q.cjs");
-const require_portable_media = require("./portable-media-LtEUNA6B.cjs");
+const require_portable_media = require("./portable-media-BhuGLllk.cjs");
 let node_assert_strict = require("node:assert/strict");
 let node_test = require("node:test");
 let node_http = require("node:http");

package/dist/tests/portable-media.test.mjs

@@ -1,5 +1,5 @@
 import { n as createHashlink, t as computeDigestMultibase } from "./digest-COC7xDiQ.mjs";
-import { t as fetchPortableMedia } from "./portable-media-BHBIOsiA.mjs";
+import { t as fetchPortableMedia } from "./portable-media-DudjnSMO.mjs";
 import { deepStrictEqual, equal, rejects } from "node:assert/strict";
 import { test } from "node:test";
 import { createServer } from "node:http";

package/dist/tests/{request-3qhu9psJ.cjs → request-B5PYS32O.cjs}

@@ -4,7 +4,7 @@ let node_process = require("node:process");
 node_process = require_rolldown_runtime.__toESM(node_process, 1);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.5.0-dev.2424+97214632";
+var version = "2.5.0-dev.2432+f56118e1";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-BHqGsrJF.mjs → request-ClluSsbr.mjs}

@@ -2,7 +2,7 @@ import { n as UrlError } from "./url-DMxmp7ZG.mjs";
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.5.0-dev.2424+97214632";
+var version = "2.5.0-dev.2432+f56118e1";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_request = require("./request-3qhu9psJ.cjs");
+const require_request = require("./request-B5PYS32O.cjs");
 const require_url = require("./url-BNakuZ8k.cjs");
 let node_test = require("node:test");
 let node_process = require("node:process");

package/dist/tests/request.test.mjs

@@ -1,4 +1,4 @@
-import { i as isTransientFetchError, n as createActivityPubRequest, r as getUserAgent, s as version, t as FetchError } from "./request-BHqGsrJF.mjs";
+import { i as isTransientFetchError, n as createActivityPubRequest, r as getUserAgent, s as version, t as FetchError } from "./request-ClluSsbr.mjs";
 import { n as UrlError } from "./url-DMxmp7ZG.mjs";
 import { test } from "node:test";
 import process from "node:process";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.5.0-dev.2424+97214632",
+  "version": "2.5.0-dev.2432+f56118e1",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/docloader.test.ts

@@ -1621,6 +1621,90 @@ const unsupportedUrls = [
   }`,
 ];
 
+function isCredentialUrlError(error: unknown): boolean {
+  return error instanceof UrlError && error.reason === "disallowed" &&
+    error.message === "URLs with credentials are not allowed";
+}
+
+test("getDocumentLoader() rejects URLs with credentials", async (t) => {
+  const start = "https://8.8.8.8/start";
+  const target = "https://user:pass@8.8.8.8/document";
+  for (const allowPrivateAddress of [false, true]) {
+    const loader = getDocumentLoader({ allowPrivateAddress });
+    for (const path of ["direct", "redirect", "Link", "HTML"]) {
+      await t.step(
+        `${path}, allowPrivateAddress=${allowPrivateAddress}`,
+        async () => {
+          await withFetchStub(
+            (url) => {
+              if (url !== start) return Response.json({});
+              if (path === "redirect") return Response.redirect(target, 302);
+              if (path === "HTML") {
+                return new Response(
+                  `<link rel="alternate" type="application/activity+json" href="${target}">`,
+                  { headers: { "Content-Type": "text/html" } },
+                );
+              }
+              return new Response("", {
+                headers: {
+                  "Content-Type": "text/plain",
+                  Link:
+                    `<${target}>; rel="alternate"; type="application/activity+json"`,
+                },
+              });
+            },
+            async (fetched) => {
+              await rejects(
+                loader(path === "direct" ? target : start),
+                isCredentialUrlError,
+              );
+              deepStrictEqual(fetched, path === "direct" ? [] : [start]);
+            },
+          );
+        },
+      );
+    }
+    for (
+      const url of [
+        "https://user@8.8.8.8/document",
+        "https://:pass@8.8.8.8/document",
+        "https://%75ser:p%40ss@8.8.8.8/document",
+        "http://user:pass@8.8.8.8/document",
+      ]
+    ) {
+      await t.step(
+        `${url}, allowPrivateAddress=${allowPrivateAddress}`,
+        async () => {
+          await withFetchStub(() => Response.json({}), async (fetched) => {
+            await rejects(loader(url), isCredentialUrlError);
+            deepStrictEqual(fetched, []);
+          });
+        },
+      );
+    }
+    for (
+      const url of [
+        "https://:@8.8.8.8/document",
+        "https://8.8.8.8/@user?q=@pass",
+      ]
+    ) {
+      await t.step(
+        `allows ${url}, allowPrivateAddress=${allowPrivateAddress}`,
+        async () => {
+          await withFetchStub(
+            () => Response.json({ done: true }),
+            async (fetched) => {
+              const document = await loader(url);
+              deepStrictEqual(document.document, { done: true });
+              deepStrictEqual(fetched, [new URL(url).href]);
+            },
+          );
+        },
+      );
+    }
+  }
+});
+
 function isUnsupportedProtocolError(error: unknown, url: string): boolean {
   return error instanceof UrlError &&
     error.message === `Unsupported protocol: ${new URL(url).protocol}` &&

package/src/docloader.ts

@@ -561,6 +561,11 @@ export function getDocumentLoader(
     if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
       throw new UrlError(`Unsupported protocol: ${parsedUrl.protocol}`);
     }
+    // When merging forward, keep this guard independent of allowPrivateAddress:
+    // private-address opt-in must not permit credentials on any followed URL.
+    if (parsedUrl.username !== "" || parsedUrl.password !== "") {
+      throw new UrlError("URLs with credentials are not allowed");
+    }
     const currentUrl = parsedUrl.href;
     if (!skipPreloadedContexts && currentUrl in preloadedContexts) {
       logger.debug("Using preloaded context: {url}.", { url: currentUrl });