@fedify/webfinger 2.1.23 → 2.1.25

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/webfinger",
-  "version": "2.1.23",
+  "version": "2.1.25",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts"

package/dist/lookup.test.cjs

@@ -22,10 +22,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 //#endregion
 let _fedify_fixture = require("@fedify/fixture");
-let es_toolkit = require("es-toolkit");
-let node_assert_strict = require("node:assert/strict");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _logtape_logtape = require("@logtape/logtape");
+let es_toolkit = require("es-toolkit");
+let node_assert_strict = require("node:assert/strict");
+let node_dns_promises = require("node:dns/promises");
+node_dns_promises = __toESM(node_dns_promises);
 let _opentelemetry_api = require("@opentelemetry/api");
 //#endregion
 //#region ../../node_modules/.pnpm/regexparam@3.0.0/node_modules/regexparam/dist/index.mjs
@@ -1228,7 +1230,81 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.1.23";
+var version = "2.1.25";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends _fedify_vocab_runtime.FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = (0, _logtape_logtape.getLogger)([
@@ -1290,7 +1366,11 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url.href);
 		} catch (e) {
 			if (e instanceof _fedify_vocab_runtime.UrlError) {
-				logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
+				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url: url.href,
+					error: e
+				});
+				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 				return null;
 			}
 			throw e;
@@ -1338,8 +1418,9 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			return null;
 		}
 		try {
-			return await response.json();
+			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return null;
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return null;
@@ -1519,4 +1600,57 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		esm_default.hardReset();
 	}
 });
+(0, _fedify_fixture.test)("lookupWebFinger() bounds resource descriptors", async () => {
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		esm_default.get("begin:https://example.com/.well-known/webfinger?", () => new Response("{\"subject\":\"acct:alice@example.com\"}" + (oversized ? " ".repeat(16 * 1024 * 1024) : ""), { headers: {
+			"Content-Type": "application/jrd+json",
+			"Content-Length": "1"
+		} }));
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), null);
+		oversized = false;
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
+	} finally {
+		esm_default.hardReset();
+	}
+});
+(0, _fedify_fixture.test)("lookupWebFinger() logs DNS failures as such", async (t) => {
+	if ("Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted") return;
+	for (const result of [
+		"throws",
+		"empty",
+		"private"
+	]) await t.step(result, async () => {
+		const originalLookup = node_dns_promises.default.lookup;
+		node_dns_promises.default.lookup = (() => result === "throws" ? Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")) : Promise.resolve(result === "empty" ? [] : [{
+			address: "127.0.0.1",
+			family: 4
+		}]));
+		const records = [];
+		await (0, _logtape_logtape.configure)({
+			sinks: { buffer: (record) => records.push(record) },
+			loggers: [{
+				category: "fedify",
+				sinks: ["buffer"],
+				lowestLevel: "debug"
+			}, {
+				category: ["logtape", "meta"],
+				sinks: []
+			}],
+			reset: true
+		});
+		try {
+			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@dns-failure.invalid"), null);
+			const failures = records.filter((r) => r.rawMessage !== "Fetching WebFinger resource descriptor from {url}...");
+			(0, node_assert_strict.deepStrictEqual)(failures.map((r) => [r.level, r.rawMessage]), [result === "private" ? ["error", "Invalid URL for WebFinger resource descriptor: {error}"] : ["debug", "DNS lookup failed for {url}"]]);
+			const { error } = failures[0].properties;
+			(0, node_assert_strict.ok)(error instanceof _fedify_vocab_runtime.UrlError);
+			(0, node_assert_strict.deepStrictEqual)(error.reason, result === "private" ? "disallowed" : "dns");
+		} finally {
+			await (0, _logtape_logtape.reset)();
+			node_dns_promises.default.lookup = originalLookup;
+		}
+	});
+});
 //#endregion

package/dist/lookup.test.js

@@ -1,8 +1,9 @@
 import { test } from "@fedify/fixture";
+import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { configure, getLogger, reset } from "@logtape/logtape";
 import { withTimeout } from "es-toolkit";
-import { deepStrictEqual } from "node:assert/strict";
-import { UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
-import { getLogger } from "@logtape/logtape";
+import { deepStrictEqual, ok } from "node:assert/strict";
+import dns from "node:dns/promises";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
@@ -1227,7 +1228,81 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.1.23";
+var version = "2.1.25";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = getLogger([
@@ -1289,7 +1364,11 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			await validatePublicUrl(url.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
-				logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
+				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url: url.href,
+					error: e
+				});
+				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 				return null;
 			}
 			throw e;
@@ -1337,8 +1416,9 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			return null;
 		}
 		try {
-			return await response.json();
+			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return null;
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return null;
@@ -1518,5 +1598,58 @@ test({
 		esm_default.hardReset();
 	}
 });
+test("lookupWebFinger() bounds resource descriptors", async () => {
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		esm_default.get("begin:https://example.com/.well-known/webfinger?", () => new Response("{\"subject\":\"acct:alice@example.com\"}" + (oversized ? " ".repeat(16 * 1024 * 1024) : ""), { headers: {
+			"Content-Type": "application/jrd+json",
+			"Content-Length": "1"
+		} }));
+		deepStrictEqual(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), null);
+		oversized = false;
+		deepStrictEqual(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("lookupWebFinger() logs DNS failures as such", async (t) => {
+	if ("Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted") return;
+	for (const result of [
+		"throws",
+		"empty",
+		"private"
+	]) await t.step(result, async () => {
+		const originalLookup = dns.lookup;
+		dns.lookup = (() => result === "throws" ? Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")) : Promise.resolve(result === "empty" ? [] : [{
+			address: "127.0.0.1",
+			family: 4
+		}]));
+		const records = [];
+		await configure({
+			sinks: { buffer: (record) => records.push(record) },
+			loggers: [{
+				category: "fedify",
+				sinks: ["buffer"],
+				lowestLevel: "debug"
+			}, {
+				category: ["logtape", "meta"],
+				sinks: []
+			}],
+			reset: true
+		});
+		try {
+			deepStrictEqual(await lookupWebFinger("acct:alice@dns-failure.invalid"), null);
+			const failures = records.filter((r) => r.rawMessage !== "Fetching WebFinger resource descriptor from {url}...");
+			deepStrictEqual(failures.map((r) => [r.level, r.rawMessage]), [result === "private" ? ["error", "Invalid URL for WebFinger resource descriptor: {error}"] : ["debug", "DNS lookup failed for {url}"]]);
+			const { error } = failures[0].properties;
+			ok(error instanceof UrlError);
+			deepStrictEqual(error.reason, result === "private" ? "disallowed" : "dns");
+		} finally {
+			await reset();
+			dns.lookup = originalLookup;
+		}
+	});
+});
 //#endregion
 export {};

package/dist/mod.cjs

@@ -4,7 +4,81 @@ let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.1.23";
+var version = "2.1.25";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends _fedify_vocab_runtime.FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = (0, _logtape_logtape.getLogger)([
@@ -66,7 +140,11 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url.href);
 		} catch (e) {
 			if (e instanceof _fedify_vocab_runtime.UrlError) {
-				logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
+				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url: url.href,
+					error: e
+				});
+				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 				return null;
 			}
 			throw e;
@@ -114,8 +192,9 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			return null;
 		}
 		try {
-			return await response.json();
+			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return null;
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return null;

package/dist/mod.js

@@ -1,9 +1,83 @@
-import { UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.1.23";
+var version = "2.1.25";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = getLogger([
@@ -65,7 +139,11 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			await validatePublicUrl(url.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
-				logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
+				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url: url.href,
+					error: e
+				});
+				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 				return null;
 			}
 			throw e;
@@ -113,8 +191,9 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			return null;
 		}
 		try {
-			return await response.json();
+			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return null;
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/webfinger",
-  "version": "2.1.23",
+  "version": "2.1.25",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -60,7 +60,7 @@
     "@logtape/logtape": "^2.0.5",
     "@opentelemetry/api": "^1.9.0",
     "es-toolkit": "1.43.0",
-    "@fedify/vocab-runtime": "2.1.23"
+    "@fedify/vocab-runtime": "2.1.25"
   },
   "scripts": {
     "build:self": "tsdown",

package/src/body.ts

@@ -0,0 +1,95 @@
+// Kept private in each package to avoid adding public API in a patch release.
+// TODO(Jiwon Kwon): Consolidate the duplicated body helpers in @fedify/vocab-runtime,
+// @fedify/webfinger, and @fedify/fedify into a shared implementation.
+import { FetchError } from "@fedify/vocab-runtime";
+import { getLogger } from "@logtape/logtape";
+
+/** Decoded JSON body limit: 16 MiB.  @internal */
+export const MAX_BODY_SIZE: number = 16 * 1024 * 1024;
+
+/** A body exceeded the byte limit.  @internal */
+export class BodyTooLargeError extends FetchError {
+  /** Creates an error for a body exceeding the given limit. */
+  constructor(url: string | URL, maxBytes: number) {
+    super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+    this.name = "BodyTooLargeError";
+  }
+}
+
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes: number): void {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError(
+      "The body size limit must be a positive safe integer.",
+    );
+  }
+}
+
+/**
+ * Reads UTF-8 text while limiting bytes received from the body stream.
+ * Fetch responses are already decompressed, so the stream count is authoritative.
+ * @param message The response or request to read.
+ * @param maxBytes The maximum number of decoded bytes to read.
+ * @param url The URL to include in errors and logs.
+ * @returns The decoded body text.
+ * @throws {BodyTooLargeError} If the body exceeds the limit.
+ * @internal
+ */
+export async function readBoundedText(
+  message: Pick<Request, "body" | "headers">,
+  maxBytes: number,
+  url: string | URL,
+): Promise<string> {
+  validateBodySizeLimit(maxBytes);
+  const reader = message.body?.getReader();
+  const tooLarge = (): never => {
+    getLogger(["fedify", "runtime", "body"]).warn(
+      "Body from {url} exceeds the limit of {maxBytes} bytes.",
+      { url: url.toString(), maxBytes },
+    );
+    throw new BodyTooLargeError(url, maxBytes);
+  };
+  try {
+    // Content-Length describes the encoded body when compression is used.
+    // Only use it as an early rejection for an unencoded body.
+    const length = message.headers.get("Content-Length");
+    const encoding = message.headers.get("Content-Encoding");
+    if (
+      (encoding == null || encoding.toLowerCase() === "identity") &&
+      length != null && /^\d+$/.test(length) && Number(length) > maxBytes
+    ) tooLarge();
+    if (reader == null) return "";
+    let size = 0;
+    const bounded = new ReadableStream<BufferSource>({
+      async pull(controller) {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          return;
+        }
+        size += value.byteLength;
+        if (size > maxBytes) tooLarge();
+        controller.enqueue(value);
+      },
+    }, { highWaterMark: 0 });
+    const textReader = bounded.pipeThrough(new TextDecoderStream()).getReader();
+    try {
+      const chunks: string[] = [];
+      while (true) {
+        const { done, value } = await textReader.read();
+        if (done) break;
+        chunks.push(value);
+      }
+      return chunks.join("");
+    } finally {
+      textReader.releaseLock();
+    }
+  } catch (error) {
+    // A cloned inbox request is a tee.  Awaiting one branch's cancellation
+    // would deadlock until the other branch is canceled by the inbox handler.
+    if (reader != null) void reader.cancel(error).catch(() => {});
+    throw error;
+  } finally {
+    reader?.releaseLock();
+  }
+}

package/src/lookup.test.ts

@@ -1,7 +1,10 @@
 import { test } from "@fedify/fixture";
+import { UrlError } from "@fedify/vocab-runtime";
+import { configure, type LogRecord, reset } from "@logtape/logtape";
 import { withTimeout } from "es-toolkit";
 import fetchMock from "fetch-mock";
-import { deepStrictEqual } from "node:assert/strict";
+import { deepStrictEqual, ok } from "node:assert/strict";
+import dns from "node:dns/promises";
 import type { ResourceDescriptor } from "./jrd.ts";
 import { lookupWebFinger } from "./lookup.ts";
 
@@ -329,3 +332,103 @@ test({
 });
 
 // cSpell: ignore johndoe
+
+test("lookupWebFinger() bounds resource descriptors", async () => {
+  fetchMock.mockGlobal();
+  let oversized = true;
+  try {
+    fetchMock.get(
+      "begin:https://example.com/.well-known/webfinger?",
+      () =>
+        new Response(
+          '{"subject":"acct:alice@example.com"}' +
+            (oversized ? " ".repeat(16 * 1024 * 1024) : ""),
+          {
+            headers: {
+              "Content-Type": "application/jrd+json",
+              "Content-Length": "1",
+            },
+          },
+        ),
+    );
+    deepStrictEqual(
+      await lookupWebFinger("acct:alice@example.com", {
+        allowPrivateAddress: true,
+      }),
+      null,
+    );
+    oversized = false;
+    deepStrictEqual(
+      await lookupWebFinger("acct:alice@example.com", {
+        allowPrivateAddress: true,
+      }),
+      { subject: "acct:alice@example.com" },
+    );
+  } finally {
+    fetchMock.hardReset();
+  }
+});
+
+test("lookupWebFinger() logs DNS failures as such", async (t) => {
+  // The validator skips DNS when Deno has no network permission.  Checked
+  // here rather than with top-level await, which the CommonJS build rejects.
+  if (
+    "Deno" in globalThis &&
+    (await Deno.permissions.query({ name: "net" })).state !== "granted"
+  ) return;
+  for (const result of ["throws", "empty", "private"] as const) {
+    await t.step(result, async () => {
+      // Stubbing works only because vocab-runtime's url.ts uses the default
+      // node:dns/promises import; see the FIXME there.
+      const originalLookup = dns.lookup;
+      dns.lookup = (() =>
+        result === "throws"
+          ? Promise.reject(new Error("Resolver unavailable"))
+          : Promise.resolve(
+            result === "empty" ? [] : [{ address: "127.0.0.1", family: 4 }],
+          )) as typeof dns.lookup;
+      const records: LogRecord[] = [];
+      await configure({
+        sinks: {
+          buffer: (record) =>
+            records.push(record),
+        },
+        loggers: [
+          { category: "fedify", sinks: ["buffer"], lowestLevel: "debug" },
+          { category: ["logtape", "meta"], sinks: [] },
+        ],
+        reset: true,
+      });
+      try {
+        deepStrictEqual(
+          await lookupWebFinger("acct:alice@dns-failure.invalid"),
+          null,
+        );
+        const failures = records.filter((r) =>
+          r.rawMessage !==
+            "Fetching WebFinger resource descriptor from {url}..."
+        );
+        deepStrictEqual(
+          failures.map((r) => [r.level, r.rawMessage]),
+          [
+            result === "private"
+              ? [
+                "error",
+                "Invalid URL for WebFinger resource descriptor: {error}",
+              ]
+              : ["debug", "DNS lookup failed for {url}"],
+          ],
+        );
+        const { error } = failures[0].properties;
+        ok(error instanceof UrlError);
+        deepStrictEqual(
+          error.reason,
+          result === "private" ? "disallowed" : "dns",
+        );
+      } finally {
+        await reset();
+        dns.lookup = originalLookup;
+      }
+    });
+  }
+});

package/src/lookup.ts

@@ -12,6 +12,7 @@ import {
   type TracerProvider,
 } from "@opentelemetry/api";
 import metadata from "../deno.json" with { type: "json" };
+import { BodyTooLargeError, MAX_BODY_SIZE, readBoundedText } from "./body.ts";
 import type { ResourceDescriptor } from "./jrd.ts";
 
 const logger = getLogger(["fedify", "webfinger", "lookup"]);
@@ -138,10 +139,20 @@ async function lookupWebFingerInternal(
         await validatePublicUrl(url.href);
       } catch (e) {
         if (e instanceof UrlError) {
-          logger.error(
-            "Invalid URL for WebFinger resource descriptor: {error}",
-            { error: e },
-          );
+          if (e.reason === "dns") {
+            logger.debug("DNS lookup failed for {url}", {
+              url: url.href,
+              error: e,
+            });
+          } else {
+            logger.error(
+              "Invalid URL for WebFinger resource descriptor: {error}",
+              { error: e },
+            );
+          }
+          // TODO: When merging forward into 2.3-maintenance and later, where
+          // this returns { resource: null, result: "network_error", remoteHost }
+          // instead of null, keep that return value for both reasons.
           return null;
         }
         throw e;
@@ -210,8 +221,15 @@ async function lookupWebFingerInternal(
       return null;
     }
     try {
-      return await response.json() as ResourceDescriptor;
+      return JSON.parse(
+        await readBoundedText(
+          response,
+          MAX_BODY_SIZE,
+          url,
+        ),
+      ) as ResourceDescriptor;
     } catch (e) {
+      if (e instanceof BodyTooLargeError) return null;
       if (e instanceof SyntaxError) {
         logger.debug(
           "Failed to parse WebFinger resource descriptor as JSON: {error}",