@fedify/webfinger 2.4.0-dev.1964 → 2.4.0-dev.1995

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/webfinger",
-  "version": "2.4.0-dev.1964+1d28dc03",
+  "version": "2.4.0-dev.1995+618fd4e7",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts"

package/dist/lookup.test.cjs

@@ -1235,7 +1235,81 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.4.0-dev.1964+1d28dc03";
+var version = "2.4.0-dev.1995+618fd4e7";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends _fedify_vocab_runtime.FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = (0, _logtape_logtape.getLogger)([
@@ -1466,12 +1540,18 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		}
 		try {
 			return {
-				resource: await response.json(),
+				resource: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)),
 				result: "found",
 				statusCode: response.status,
 				remoteHost
 			};
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return {
+				resource: null,
+				result: "invalid",
+				statusCode: response.status,
+				remoteHost
+			};
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return {
@@ -1901,4 +1981,19 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		esm_default.hardReset();
 	}
 });
+(0, _fedify_fixture.test)("lookupWebFinger() bounds resource descriptors", async () => {
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		esm_default.get("begin:https://example.com/.well-known/webfinger?", () => new Response("{\"subject\":\"acct:alice@example.com\"}" + (oversized ? " ".repeat(16 * 1024 * 1024) : ""), { headers: {
+			"Content-Type": "application/jrd+json",
+			"Content-Length": "1"
+		} }));
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), null);
+		oversized = false;
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
+	} finally {
+		esm_default.hardReset();
+	}
+});
 //#endregion

package/dist/lookup.test.js

@@ -1,7 +1,7 @@
 import { createTestMeterProvider, test } from "@fedify/fixture";
 import { withTimeout } from "es-toolkit";
 import { deepStrictEqual, ok } from "node:assert/strict";
-import { UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region \0rolldown/runtime.js
@@ -1234,7 +1234,81 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.4.0-dev.1964+1d28dc03";
+var version = "2.4.0-dev.1995+618fd4e7";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = getLogger([
@@ -1465,12 +1539,18 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		}
 		try {
 			return {
-				resource: await response.json(),
+				resource: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)),
 				result: "found",
 				statusCode: response.status,
 				remoteHost
 			};
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return {
+				resource: null,
+				result: "invalid",
+				statusCode: response.status,
+				remoteHost
+			};
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return {
@@ -1900,5 +1980,20 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
 		esm_default.hardReset();
 	}
 });
+test("lookupWebFinger() bounds resource descriptors", async () => {
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		esm_default.get("begin:https://example.com/.well-known/webfinger?", () => new Response("{\"subject\":\"acct:alice@example.com\"}" + (oversized ? " ".repeat(16 * 1024 * 1024) : ""), { headers: {
+			"Content-Type": "application/jrd+json",
+			"Content-Length": "1"
+		} }));
+		deepStrictEqual(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), null);
+		oversized = false;
+		deepStrictEqual(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
+	} finally {
+		esm_default.hardReset();
+	}
+});
 //#endregion
 export {};

package/dist/mod.cjs

@@ -4,7 +4,81 @@ let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.4.0-dev.1964+1d28dc03";
+var version = "2.4.0-dev.1995+618fd4e7";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends _fedify_vocab_runtime.FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = (0, _logtape_logtape.getLogger)([
@@ -235,12 +309,18 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		}
 		try {
 			return {
-				resource: await response.json(),
+				resource: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)),
 				result: "found",
 				statusCode: response.status,
 				remoteHost
 			};
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return {
+				resource: null,
+				result: "invalid",
+				statusCode: response.status,
+				remoteHost
+			};
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return {

package/dist/mod.d.cts

@@ -71,10 +71,10 @@ interface Link {
 *  -  `not_found`: the remote responded with HTTP `404 Not Found` or
 *     `410 Gone`.  Recorded together with `http.response.status_code`.
 *  -  `invalid`: the remote responded with content Fedify could not parse
-*     into a {@link ResourceDescriptor} (JSON parse failure), the
-*     redirect chain exceeded `maxRedirection`, the remote redirected to
-*     a different protocol, or the queried `acct:` resource itself was
-*     malformed.
+*     into a {@link ResourceDescriptor} (JSON parse failure or a body over
+*     the size limit), the redirect chain exceeded `maxRedirection`, the
+*     remote redirected to a different protocol, or the queried `acct:`
+*     resource itself was malformed.
 *  -  `network_error`: no HTTP response was received (the URL was
 *     rejected as a private address, `fetch()` threw, or an `AbortError`
 *     cancelled the request).

package/dist/mod.d.ts

@@ -71,10 +71,10 @@ interface Link {
 *  -  `not_found`: the remote responded with HTTP `404 Not Found` or
 *     `410 Gone`.  Recorded together with `http.response.status_code`.
 *  -  `invalid`: the remote responded with content Fedify could not parse
-*     into a {@link ResourceDescriptor} (JSON parse failure), the
-*     redirect chain exceeded `maxRedirection`, the remote redirected to
-*     a different protocol, or the queried `acct:` resource itself was
-*     malformed.
+*     into a {@link ResourceDescriptor} (JSON parse failure or a body over
+*     the size limit), the redirect chain exceeded `maxRedirection`, the
+*     remote redirected to a different protocol, or the queried `acct:`
+*     resource itself was malformed.
 *  -  `network_error`: no HTTP response was received (the URL was
 *     rejected as a private address, `fetch()` threw, or an `AbortError`
 *     cancelled the request).

package/dist/mod.js

@@ -1,9 +1,83 @@
-import { UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.4.0-dev.1964+1d28dc03";
+var version = "2.4.0-dev.1995+618fd4e7";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = getLogger([
@@ -234,12 +308,18 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		}
 		try {
 			return {
-				resource: await response.json(),
+				resource: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)),
 				result: "found",
 				statusCode: response.status,
 				remoteHost
 			};
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return {
+				resource: null,
+				result: "invalid",
+				statusCode: response.status,
+				remoteHost
+			};
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/webfinger",
-  "version": "2.4.0-dev.1964+1d28dc03",
+  "version": "2.4.0-dev.1995+618fd4e7",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -57,7 +57,7 @@
     "@logtape/logtape": "^2.2.0",
     "@opentelemetry/api": "^1.9.1",
     "es-toolkit": "1.46.1",
-    "@fedify/vocab-runtime": "2.4.0-dev.1964+1d28dc03"
+    "@fedify/vocab-runtime": "2.4.0-dev.1995+618fd4e7"
   },
   "scripts": {
     "build:self": "tsdown",

package/src/body.ts

@@ -0,0 +1,95 @@
+// Kept private in each package to avoid adding public API in a patch release.
+// TODO(Jiwon Kwon): Consolidate the duplicated body helpers in @fedify/vocab-runtime,
+// @fedify/webfinger, and @fedify/fedify into a shared implementation.
+import { FetchError } from "@fedify/vocab-runtime";
+import { getLogger } from "@logtape/logtape";
+
+/** Decoded JSON body limit: 16 MiB.  @internal */
+export const MAX_BODY_SIZE: number = 16 * 1024 * 1024;
+
+/** A body exceeded the byte limit.  @internal */
+export class BodyTooLargeError extends FetchError {
+  /** Creates an error for a body exceeding the given limit. */
+  constructor(url: string | URL, maxBytes: number) {
+    super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+    this.name = "BodyTooLargeError";
+  }
+}
+
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes: number): void {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError(
+      "The body size limit must be a positive safe integer.",
+    );
+  }
+}
+
+/**
+ * Reads UTF-8 text while limiting bytes received from the body stream.
+ * Fetch responses are already decompressed, so the stream count is authoritative.
+ * @param message The response or request to read.
+ * @param maxBytes The maximum number of decoded bytes to read.
+ * @param url The URL to include in errors and logs.
+ * @returns The decoded body text.
+ * @throws {BodyTooLargeError} If the body exceeds the limit.
+ * @internal
+ */
+export async function readBoundedText(
+  message: Pick<Request, "body" | "headers">,
+  maxBytes: number,
+  url: string | URL,
+): Promise<string> {
+  validateBodySizeLimit(maxBytes);
+  const reader = message.body?.getReader();
+  const tooLarge = (): never => {
+    getLogger(["fedify", "runtime", "body"]).warn(
+      "Body from {url} exceeds the limit of {maxBytes} bytes.",
+      { url: url.toString(), maxBytes },
+    );
+    throw new BodyTooLargeError(url, maxBytes);
+  };
+  try {
+    // Content-Length describes the encoded body when compression is used.
+    // Only use it as an early rejection for an unencoded body.
+    const length = message.headers.get("Content-Length");
+    const encoding = message.headers.get("Content-Encoding");
+    if (
+      (encoding == null || encoding.toLowerCase() === "identity") &&
+      length != null && /^\d+$/.test(length) && Number(length) > maxBytes
+    ) tooLarge();
+    if (reader == null) return "";
+    let size = 0;
+    const bounded = new ReadableStream<BufferSource>({
+      async pull(controller) {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          return;
+        }
+        size += value.byteLength;
+        if (size > maxBytes) tooLarge();
+        controller.enqueue(value);
+      },
+    }, { highWaterMark: 0 });
+    const textReader = bounded.pipeThrough(new TextDecoderStream()).getReader();
+    try {
+      const chunks: string[] = [];
+      while (true) {
+        const { done, value } = await textReader.read();
+        if (done) break;
+        chunks.push(value);
+      }
+      return chunks.join("");
+    } finally {
+      textReader.releaseLock();
+    }
+  } catch (error) {
+    // A cloned inbox request is a tee.  Awaiting one branch's cancellation
+    // would deadlock until the other branch is canceled by the inbox handler.
+    if (reader != null) void reader.cancel(error).catch(() => {});
+    throw error;
+  } finally {
+    reader?.releaseLock();
+  }
+}

package/src/lookup.test.ts

@@ -886,3 +886,39 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
 });
 
 // cSpell: ignore johndoe
+
+test("lookupWebFinger() bounds resource descriptors", async () => {
+  fetchMock.mockGlobal();
+  let oversized = true;
+  try {
+    fetchMock.get(
+      "begin:https://example.com/.well-known/webfinger?",
+      () =>
+        new Response(
+          '{"subject":"acct:alice@example.com"}' +
+            (oversized ? " ".repeat(16 * 1024 * 1024) : ""),
+          {
+            headers: {
+              "Content-Type": "application/jrd+json",
+              "Content-Length": "1",
+            },
+          },
+        ),
+    );
+    deepStrictEqual(
+      await lookupWebFinger("acct:alice@example.com", {
+        allowPrivateAddress: true,
+      }),
+      null,
+    );
+    oversized = false;
+    deepStrictEqual(
+      await lookupWebFinger("acct:alice@example.com", {
+        allowPrivateAddress: true,
+      }),
+      { subject: "acct:alice@example.com" },
+    );
+  } finally {
+    fetchMock.hardReset();
+  }
+});

package/src/lookup.ts

@@ -16,6 +16,7 @@ import {
   type TracerProvider,
 } from "@opentelemetry/api";
 import metadata from "../deno.json" with { type: "json" };
+import { BodyTooLargeError, MAX_BODY_SIZE, readBoundedText } from "./body.ts";
 import type { ResourceDescriptor } from "./jrd.ts";
 
 const logger = getLogger(["fedify", "webfinger", "lookup"]);
@@ -31,10 +32,10 @@ const DEFAULT_MAX_REDIRECTION = 5;
  *  -  `not_found`: the remote responded with HTTP `404 Not Found` or
  *     `410 Gone`.  Recorded together with `http.response.status_code`.
  *  -  `invalid`: the remote responded with content Fedify could not parse
- *     into a {@link ResourceDescriptor} (JSON parse failure), the
- *     redirect chain exceeded `maxRedirection`, the remote redirected to
- *     a different protocol, or the queried `acct:` resource itself was
- *     malformed.
+ *     into a {@link ResourceDescriptor} (JSON parse failure or a body over
+ *     the size limit), the redirect chain exceeded `maxRedirection`, the
+ *     remote redirected to a different protocol, or the queried `acct:`
+ *     resource itself was malformed.
  *  -  `network_error`: no HTTP response was received (the URL was
  *     rejected as a private address, `fetch()` threw, or an `AbortError`
  *     cancelled the request).
@@ -430,7 +431,9 @@ async function lookupWebFingerInternal(
       };
     }
     try {
-      const parsed = await response.json() as ResourceDescriptor;
+      const parsed = JSON.parse(
+        await readBoundedText(response, MAX_BODY_SIZE, url),
+      ) as ResourceDescriptor;
       return {
         resource: parsed,
         result: "found",
@@ -438,6 +441,14 @@ async function lookupWebFingerInternal(
         remoteHost,
       };
     } catch (e) {
+      if (e instanceof BodyTooLargeError) {
+        return {
+          resource: null,
+          result: "invalid",
+          statusCode: response.status,
+          remoteHost,
+        };
+      }
       if (e instanceof SyntaxError) {
         logger.debug(
           "Failed to parse WebFinger resource descriptor as JSON: {error}",