@fedify/webfinger 2.1.23 → 2.1.24

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/webfinger",
-  "version": "2.1.23",
+  "version": "2.1.24",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts"

package/dist/lookup.test.cjs

@@ -1228,7 +1228,81 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.1.23";
+var version = "2.1.24";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends _fedify_vocab_runtime.FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = (0, _logtape_logtape.getLogger)([
@@ -1338,8 +1412,9 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			return null;
 		}
 		try {
-			return await response.json();
+			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return null;
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return null;
@@ -1519,4 +1594,19 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		esm_default.hardReset();
 	}
 });
+(0, _fedify_fixture.test)("lookupWebFinger() bounds resource descriptors", async () => {
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		esm_default.get("begin:https://example.com/.well-known/webfinger?", () => new Response("{\"subject\":\"acct:alice@example.com\"}" + (oversized ? " ".repeat(16 * 1024 * 1024) : ""), { headers: {
+			"Content-Type": "application/jrd+json",
+			"Content-Length": "1"
+		} }));
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), null);
+		oversized = false;
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
+	} finally {
+		esm_default.hardReset();
+	}
+});
 //#endregion

package/dist/lookup.test.js

@@ -1,7 +1,7 @@
 import { test } from "@fedify/fixture";
 import { withTimeout } from "es-toolkit";
 import { deepStrictEqual } from "node:assert/strict";
-import { UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region \0rolldown/runtime.js
@@ -1227,7 +1227,81 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.1.23";
+var version = "2.1.24";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = getLogger([
@@ -1337,8 +1411,9 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			return null;
 		}
 		try {
-			return await response.json();
+			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return null;
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return null;
@@ -1518,5 +1593,20 @@ test({
 		esm_default.hardReset();
 	}
 });
+test("lookupWebFinger() bounds resource descriptors", async () => {
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		esm_default.get("begin:https://example.com/.well-known/webfinger?", () => new Response("{\"subject\":\"acct:alice@example.com\"}" + (oversized ? " ".repeat(16 * 1024 * 1024) : ""), { headers: {
+			"Content-Type": "application/jrd+json",
+			"Content-Length": "1"
+		} }));
+		deepStrictEqual(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), null);
+		oversized = false;
+		deepStrictEqual(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
+	} finally {
+		esm_default.hardReset();
+	}
+});
 //#endregion
 export {};

package/dist/mod.cjs

@@ -4,7 +4,81 @@ let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.1.23";
+var version = "2.1.24";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends _fedify_vocab_runtime.FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = (0, _logtape_logtape.getLogger)([
@@ -114,8 +188,9 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			return null;
 		}
 		try {
-			return await response.json();
+			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return null;
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return null;

package/dist/mod.js

@@ -1,9 +1,83 @@
-import { UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.1.23";
+var version = "2.1.24";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = getLogger([
@@ -113,8 +187,9 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			return null;
 		}
 		try {
-			return await response.json();
+			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return null;
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/webfinger",
-  "version": "2.1.23",
+  "version": "2.1.24",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -60,7 +60,7 @@
     "@logtape/logtape": "^2.0.5",
     "@opentelemetry/api": "^1.9.0",
     "es-toolkit": "1.43.0",
-    "@fedify/vocab-runtime": "2.1.23"
+    "@fedify/vocab-runtime": "2.1.24"
   },
   "scripts": {
     "build:self": "tsdown",

package/src/body.ts

@@ -0,0 +1,95 @@
+// Kept private in each package to avoid adding public API in a patch release.
+// TODO(Jiwon Kwon): Consolidate the duplicated body helpers in @fedify/vocab-runtime,
+// @fedify/webfinger, and @fedify/fedify into a shared implementation.
+import { FetchError } from "@fedify/vocab-runtime";
+import { getLogger } from "@logtape/logtape";
+
+/** Decoded JSON body limit: 16 MiB.  @internal */
+export const MAX_BODY_SIZE: number = 16 * 1024 * 1024;
+
+/** A body exceeded the byte limit.  @internal */
+export class BodyTooLargeError extends FetchError {
+  /** Creates an error for a body exceeding the given limit. */
+  constructor(url: string | URL, maxBytes: number) {
+    super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+    this.name = "BodyTooLargeError";
+  }
+}
+
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes: number): void {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError(
+      "The body size limit must be a positive safe integer.",
+    );
+  }
+}
+
+/**
+ * Reads UTF-8 text while limiting bytes received from the body stream.
+ * Fetch responses are already decompressed, so the stream count is authoritative.
+ * @param message The response or request to read.
+ * @param maxBytes The maximum number of decoded bytes to read.
+ * @param url The URL to include in errors and logs.
+ * @returns The decoded body text.
+ * @throws {BodyTooLargeError} If the body exceeds the limit.
+ * @internal
+ */
+export async function readBoundedText(
+  message: Pick<Request, "body" | "headers">,
+  maxBytes: number,
+  url: string | URL,
+): Promise<string> {
+  validateBodySizeLimit(maxBytes);
+  const reader = message.body?.getReader();
+  const tooLarge = (): never => {
+    getLogger(["fedify", "runtime", "body"]).warn(
+      "Body from {url} exceeds the limit of {maxBytes} bytes.",
+      { url: url.toString(), maxBytes },
+    );
+    throw new BodyTooLargeError(url, maxBytes);
+  };
+  try {
+    // Content-Length describes the encoded body when compression is used.
+    // Only use it as an early rejection for an unencoded body.
+    const length = message.headers.get("Content-Length");
+    const encoding = message.headers.get("Content-Encoding");
+    if (
+      (encoding == null || encoding.toLowerCase() === "identity") &&
+      length != null && /^\d+$/.test(length) && Number(length) > maxBytes
+    ) tooLarge();
+    if (reader == null) return "";
+    let size = 0;
+    const bounded = new ReadableStream<BufferSource>({
+      async pull(controller) {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          return;
+        }
+        size += value.byteLength;
+        if (size > maxBytes) tooLarge();
+        controller.enqueue(value);
+      },
+    }, { highWaterMark: 0 });
+    const textReader = bounded.pipeThrough(new TextDecoderStream()).getReader();
+    try {
+      const chunks: string[] = [];
+      while (true) {
+        const { done, value } = await textReader.read();
+        if (done) break;
+        chunks.push(value);
+      }
+      return chunks.join("");
+    } finally {
+      textReader.releaseLock();
+    }
+  } catch (error) {
+    // A cloned inbox request is a tee.  Awaiting one branch's cancellation
+    // would deadlock until the other branch is canceled by the inbox handler.
+    if (reader != null) void reader.cancel(error).catch(() => {});
+    throw error;
+  } finally {
+    reader?.releaseLock();
+  }
+}

package/src/lookup.test.ts

@@ -329,3 +329,39 @@ test({
 });
 
 // cSpell: ignore johndoe
+
+test("lookupWebFinger() bounds resource descriptors", async () => {
+  fetchMock.mockGlobal();
+  let oversized = true;
+  try {
+    fetchMock.get(
+      "begin:https://example.com/.well-known/webfinger?",
+      () =>
+        new Response(
+          '{"subject":"acct:alice@example.com"}' +
+            (oversized ? " ".repeat(16 * 1024 * 1024) : ""),
+          {
+            headers: {
+              "Content-Type": "application/jrd+json",
+              "Content-Length": "1",
+            },
+          },
+        ),
+    );
+    deepStrictEqual(
+      await lookupWebFinger("acct:alice@example.com", {
+        allowPrivateAddress: true,
+      }),
+      null,
+    );
+    oversized = false;
+    deepStrictEqual(
+      await lookupWebFinger("acct:alice@example.com", {
+        allowPrivateAddress: true,
+      }),
+      { subject: "acct:alice@example.com" },
+    );
+  } finally {
+    fetchMock.hardReset();
+  }
+});

package/src/lookup.ts

@@ -12,6 +12,7 @@ import {
   type TracerProvider,
 } from "@opentelemetry/api";
 import metadata from "../deno.json" with { type: "json" };
+import { BodyTooLargeError, MAX_BODY_SIZE, readBoundedText } from "./body.ts";
 import type { ResourceDescriptor } from "./jrd.ts";
 
 const logger = getLogger(["fedify", "webfinger", "lookup"]);
@@ -210,8 +211,15 @@ async function lookupWebFingerInternal(
       return null;
     }
     try {
-      return await response.json() as ResourceDescriptor;
+      return JSON.parse(
+        await readBoundedText(
+          response,
+          MAX_BODY_SIZE,
+          url,
+        ),
+      ) as ResourceDescriptor;
     } catch (e) {
+      if (e instanceof BodyTooLargeError) return null;
       if (e instanceof SyntaxError) {
         logger.debug(
           "Failed to parse WebFinger resource descriptor as JSON: {error}",