@fedify/webfinger 2.4.0-pr.936.41 → 2.4.1

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/webfinger",
-  "version": "2.4.0-pr.936.41+59c7432c",
+  "version": "2.4.1",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts"

package/dist/lookup.test.cjs

@@ -22,10 +22,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 //#endregion
 let _fedify_fixture = require("@fedify/fixture");
-let es_toolkit = require("es-toolkit");
-let node_assert_strict = require("node:assert/strict");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _logtape_logtape = require("@logtape/logtape");
+let es_toolkit = require("es-toolkit");
+let node_assert_strict = require("node:assert/strict");
+let node_dns_promises = require("node:dns/promises");
+node_dns_promises = __toESM(node_dns_promises, 1);
 let _opentelemetry_api = require("@opentelemetry/api");
 //#endregion
 //#region ../../node_modules/.pnpm/regexparam@3.0.0/node_modules/regexparam/dist/index.mjs
@@ -132,27 +134,27 @@ function parse(input, loose) {
 }
 //#endregion
 //#region ../../node_modules/.pnpm/fetch-mock@12.6.0/node_modules/fetch-mock/dist/esm/TypeDescriptor.js
-const valueTypes = new Set([
+const valueTypes = /* @__PURE__ */ new Set([
 	"boolean",
 	"number",
 	"null",
 	"string",
 	"undefined"
 ]);
-const referenceTypes = new Set([
+const referenceTypes = /* @__PURE__ */ new Set([
 	"array",
 	"function",
 	"object",
 	"symbol"
 ]);
-const detectableTypes = new Set([
+const detectableTypes = /* @__PURE__ */ new Set([
 	"boolean",
 	"function",
 	"number",
 	"string",
 	"symbol"
 ]);
-const typeConstructors = new Set([
+const typeConstructors = /* @__PURE__ */ new Set([
 	Boolean,
 	Number,
 	String
@@ -223,7 +225,7 @@ var TypeDescriptor = class TypeDescriptor {
 };
 //#endregion
 //#region ../../node_modules/.pnpm/fetch-mock@12.6.0/node_modules/fetch-mock/dist/esm/IsSubsetOf.js
-const allowedTypes = new Set([
+const allowedTypes = /* @__PURE__ */ new Set([
 	"array",
 	"object",
 	"function",
@@ -715,7 +717,14 @@ var __classPrivateFieldGet = function(receiver, state, kind, f) {
 	if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
 	return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _Route_instances, _a, _Route_responseSubscriptions, _Route_validate, _Route_sanitize, _Route_generateMatcher, _Route_limit, _Route_delayResponse;
+var _Route_instances;
+var _a;
+var _Route_responseSubscriptions;
+var _Route_validate;
+var _Route_sanitize;
+var _Route_generateMatcher;
+var _Route_limit;
+var _Route_delayResponse;
 var RouteConfigWrapper = class {
 	constructor(config) {
 		Object.assign(this, config);
@@ -1228,7 +1237,81 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.4.0-pr.936.41+59c7432c";
+var version = "2.4.1";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends _fedify_vocab_runtime.FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = (0, _logtape_logtape.getLogger)([
@@ -1280,7 +1363,7 @@ function getResourceScheme(resource) {
 	}
 	return resource.protocol.replace(/:$/, "").toLowerCase();
 }
-const WEBFINGER_LOOKUP_SCHEME_WHITELIST = new Set([
+const WEBFINGER_LOOKUP_SCHEME_WHITELIST = /* @__PURE__ */ new Set([
 	"acct",
 	"http",
 	"https",
@@ -1373,7 +1456,11 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url.href);
 		} catch (e) {
 			if (e instanceof _fedify_vocab_runtime.UrlError) {
-				logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
+				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url: url.href,
+					error: e
+				});
+				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 				return {
 					resource: null,
 					result: "network_error",
@@ -1459,12 +1546,18 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		}
 		try {
 			return {
-				resource: await response.json(),
+				resource: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)),
 				result: "found",
 				statusCode: response.status,
 				remoteHost
 			};
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return {
+				resource: null,
+				result: "invalid",
+				statusCode: response.status,
+				remoteHost
+			};
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return {
@@ -1894,4 +1987,57 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		esm_default.hardReset();
 	}
 });
+(0, _fedify_fixture.test)("lookupWebFinger() bounds resource descriptors", async () => {
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		esm_default.get("begin:https://example.com/.well-known/webfinger?", () => new Response("{\"subject\":\"acct:alice@example.com\"}" + (oversized ? " ".repeat(16 * 1024 * 1024) : ""), { headers: {
+			"Content-Type": "application/jrd+json",
+			"Content-Length": "1"
+		} }));
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), null);
+		oversized = false;
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
+	} finally {
+		esm_default.hardReset();
+	}
+});
+(0, _fedify_fixture.test)("lookupWebFinger() logs DNS failures as such", async (t) => {
+	if ("Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted") return;
+	for (const result of [
+		"throws",
+		"empty",
+		"private"
+	]) await t.step(result, async () => {
+		const originalLookup = node_dns_promises.default.lookup;
+		node_dns_promises.default.lookup = (() => result === "throws" ? Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")) : Promise.resolve(result === "empty" ? [] : [{
+			address: "127.0.0.1",
+			family: 4
+		}]));
+		const records = [];
+		await (0, _logtape_logtape.configure)({
+			sinks: { buffer: (record) => records.push(record) },
+			loggers: [{
+				category: "fedify",
+				sinks: ["buffer"],
+				lowestLevel: "debug"
+			}, {
+				category: ["logtape", "meta"],
+				sinks: []
+			}],
+			reset: true
+		});
+		try {
+			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@dns-failure.invalid"), null);
+			const failures = records.filter((r) => r.rawMessage !== "Fetching WebFinger resource descriptor from {url}...");
+			(0, node_assert_strict.deepStrictEqual)(failures.map((r) => [r.level, r.rawMessage]), [result === "private" ? ["error", "Invalid URL for WebFinger resource descriptor: {error}"] : ["debug", "DNS lookup failed for {url}"]]);
+			const { error } = failures[0].properties;
+			(0, node_assert_strict.ok)(error instanceof _fedify_vocab_runtime.UrlError);
+			(0, node_assert_strict.deepStrictEqual)(error.reason, result === "private" ? "disallowed" : "dns");
+		} finally {
+			await (0, _logtape_logtape.reset)();
+			node_dns_promises.default.lookup = originalLookup;
+		}
+	});
+});
 //#endregion

package/dist/lookup.test.js

@@ -1,8 +1,9 @@
 import { createTestMeterProvider, test } from "@fedify/fixture";
+import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { configure, getLogger, reset } from "@logtape/logtape";
 import { withTimeout } from "es-toolkit";
 import { deepStrictEqual, ok } from "node:assert/strict";
-import { UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
-import { getLogger } from "@logtape/logtape";
+import dns from "node:dns/promises";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
@@ -131,27 +132,27 @@ function parse(input, loose) {
 }
 //#endregion
 //#region ../../node_modules/.pnpm/fetch-mock@12.6.0/node_modules/fetch-mock/dist/esm/TypeDescriptor.js
-const valueTypes = new Set([
+const valueTypes = /* @__PURE__ */ new Set([
 	"boolean",
 	"number",
 	"null",
 	"string",
 	"undefined"
 ]);
-const referenceTypes = new Set([
+const referenceTypes = /* @__PURE__ */ new Set([
 	"array",
 	"function",
 	"object",
 	"symbol"
 ]);
-const detectableTypes = new Set([
+const detectableTypes = /* @__PURE__ */ new Set([
 	"boolean",
 	"function",
 	"number",
 	"string",
 	"symbol"
 ]);
-const typeConstructors = new Set([
+const typeConstructors = /* @__PURE__ */ new Set([
 	Boolean,
 	Number,
 	String
@@ -222,7 +223,7 @@ var TypeDescriptor = class TypeDescriptor {
 };
 //#endregion
 //#region ../../node_modules/.pnpm/fetch-mock@12.6.0/node_modules/fetch-mock/dist/esm/IsSubsetOf.js
-const allowedTypes = new Set([
+const allowedTypes = /* @__PURE__ */ new Set([
 	"array",
 	"object",
 	"function",
@@ -714,7 +715,14 @@ var __classPrivateFieldGet = function(receiver, state, kind, f) {
 	if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
 	return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _Route_instances, _a, _Route_responseSubscriptions, _Route_validate, _Route_sanitize, _Route_generateMatcher, _Route_limit, _Route_delayResponse;
+var _Route_instances;
+var _a;
+var _Route_responseSubscriptions;
+var _Route_validate;
+var _Route_sanitize;
+var _Route_generateMatcher;
+var _Route_limit;
+var _Route_delayResponse;
 var RouteConfigWrapper = class {
 	constructor(config) {
 		Object.assign(this, config);
@@ -1227,7 +1235,81 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.4.0-pr.936.41+59c7432c";
+var version = "2.4.1";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = getLogger([
@@ -1279,7 +1361,7 @@ function getResourceScheme(resource) {
 	}
 	return resource.protocol.replace(/:$/, "").toLowerCase();
 }
-const WEBFINGER_LOOKUP_SCHEME_WHITELIST = new Set([
+const WEBFINGER_LOOKUP_SCHEME_WHITELIST = /* @__PURE__ */ new Set([
 	"acct",
 	"http",
 	"https",
@@ -1372,7 +1454,11 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			await validatePublicUrl(url.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
-				logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
+				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url: url.href,
+					error: e
+				});
+				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 				return {
 					resource: null,
 					result: "network_error",
@@ -1458,12 +1544,18 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		}
 		try {
 			return {
-				resource: await response.json(),
+				resource: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)),
 				result: "found",
 				statusCode: response.status,
 				remoteHost
 			};
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return {
+				resource: null,
+				result: "invalid",
+				statusCode: response.status,
+				remoteHost
+			};
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return {
@@ -1893,5 +1985,58 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
 		esm_default.hardReset();
 	}
 });
+test("lookupWebFinger() bounds resource descriptors", async () => {
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		esm_default.get("begin:https://example.com/.well-known/webfinger?", () => new Response("{\"subject\":\"acct:alice@example.com\"}" + (oversized ? " ".repeat(16 * 1024 * 1024) : ""), { headers: {
+			"Content-Type": "application/jrd+json",
+			"Content-Length": "1"
+		} }));
+		deepStrictEqual(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), null);
+		oversized = false;
+		deepStrictEqual(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("lookupWebFinger() logs DNS failures as such", async (t) => {
+	if ("Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted") return;
+	for (const result of [
+		"throws",
+		"empty",
+		"private"
+	]) await t.step(result, async () => {
+		const originalLookup = dns.lookup;
+		dns.lookup = (() => result === "throws" ? Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")) : Promise.resolve(result === "empty" ? [] : [{
+			address: "127.0.0.1",
+			family: 4
+		}]));
+		const records = [];
+		await configure({
+			sinks: { buffer: (record) => records.push(record) },
+			loggers: [{
+				category: "fedify",
+				sinks: ["buffer"],
+				lowestLevel: "debug"
+			}, {
+				category: ["logtape", "meta"],
+				sinks: []
+			}],
+			reset: true
+		});
+		try {
+			deepStrictEqual(await lookupWebFinger("acct:alice@dns-failure.invalid"), null);
+			const failures = records.filter((r) => r.rawMessage !== "Fetching WebFinger resource descriptor from {url}...");
+			deepStrictEqual(failures.map((r) => [r.level, r.rawMessage]), [result === "private" ? ["error", "Invalid URL for WebFinger resource descriptor: {error}"] : ["debug", "DNS lookup failed for {url}"]]);
+			const { error } = failures[0].properties;
+			ok(error instanceof UrlError);
+			deepStrictEqual(error.reason, result === "private" ? "disallowed" : "dns");
+		} finally {
+			await reset();
+			dns.lookup = originalLookup;
+		}
+	});
+});
 //#endregion
 export {};

package/dist/mod.cjs

@@ -4,7 +4,81 @@ let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.4.0-pr.936.41+59c7432c";
+var version = "2.4.1";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends _fedify_vocab_runtime.FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = (0, _logtape_logtape.getLogger)([
@@ -56,7 +130,7 @@ function getResourceScheme(resource) {
 	}
 	return resource.protocol.replace(/:$/, "").toLowerCase();
 }
-const WEBFINGER_LOOKUP_SCHEME_WHITELIST = new Set([
+const WEBFINGER_LOOKUP_SCHEME_WHITELIST = /* @__PURE__ */ new Set([
 	"acct",
 	"http",
 	"https",
@@ -149,7 +223,11 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url.href);
 		} catch (e) {
 			if (e instanceof _fedify_vocab_runtime.UrlError) {
-				logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
+				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url: url.href,
+					error: e
+				});
+				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 				return {
 					resource: null,
 					result: "network_error",
@@ -235,12 +313,18 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		}
 		try {
 			return {
-				resource: await response.json(),
+				resource: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)),
 				result: "found",
 				statusCode: response.status,
 				remoteHost
 			};
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return {
+				resource: null,
+				result: "invalid",
+				statusCode: response.status,
+				remoteHost
+			};
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return {

package/dist/mod.d.cts

@@ -71,10 +71,10 @@ interface Link {
 *  -  `not_found`: the remote responded with HTTP `404 Not Found` or
 *     `410 Gone`.  Recorded together with `http.response.status_code`.
 *  -  `invalid`: the remote responded with content Fedify could not parse
-*     into a {@link ResourceDescriptor} (JSON parse failure), the
-*     redirect chain exceeded `maxRedirection`, the remote redirected to
-*     a different protocol, or the queried `acct:` resource itself was
-*     malformed.
+*     into a {@link ResourceDescriptor} (JSON parse failure or a body over
+*     the size limit), the redirect chain exceeded `maxRedirection`, the
+*     remote redirected to a different protocol, or the queried `acct:`
+*     resource itself was malformed.
 *  -  `network_error`: no HTTP response was received (the URL was
 *     rejected as a private address, `fetch()` threw, or an `AbortError`
 *     cancelled the request).

package/dist/mod.d.ts

@@ -71,10 +71,10 @@ interface Link {
 *  -  `not_found`: the remote responded with HTTP `404 Not Found` or
 *     `410 Gone`.  Recorded together with `http.response.status_code`.
 *  -  `invalid`: the remote responded with content Fedify could not parse
-*     into a {@link ResourceDescriptor} (JSON parse failure), the
-*     redirect chain exceeded `maxRedirection`, the remote redirected to
-*     a different protocol, or the queried `acct:` resource itself was
-*     malformed.
+*     into a {@link ResourceDescriptor} (JSON parse failure or a body over
+*     the size limit), the redirect chain exceeded `maxRedirection`, the
+*     remote redirected to a different protocol, or the queried `acct:`
+*     resource itself was malformed.
 *  -  `network_error`: no HTTP response was received (the URL was
 *     rejected as a private address, `fetch()` threw, or an `AbortError`
 *     cancelled the request).

package/dist/mod.js

@@ -1,9 +1,83 @@
-import { UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.4.0-pr.936.41+59c7432c";
+var version = "2.4.1";
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/lookup.ts
 const logger = getLogger([
@@ -55,7 +129,7 @@ function getResourceScheme(resource) {
 	}
 	return resource.protocol.replace(/:$/, "").toLowerCase();
 }
-const WEBFINGER_LOOKUP_SCHEME_WHITELIST = new Set([
+const WEBFINGER_LOOKUP_SCHEME_WHITELIST = /* @__PURE__ */ new Set([
 	"acct",
 	"http",
 	"https",
@@ -148,7 +222,11 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			await validatePublicUrl(url.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
-				logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
+				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url: url.href,
+					error: e
+				});
+				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 				return {
 					resource: null,
 					result: "network_error",
@@ -234,12 +312,18 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		}
 		try {
 			return {
-				resource: await response.json(),
+				resource: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)),
 				result: "found",
 				statusCode: response.status,
 				remoteHost
 			};
 		} catch (e) {
+			if (e instanceof BodyTooLargeError) return {
+				resource: null,
+				result: "invalid",
+				statusCode: response.status,
+				remoteHost
+			};
 			if (e instanceof SyntaxError) {
 				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
 				return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/webfinger",
-  "version": "2.4.0-pr.936.41+59c7432c",
+  "version": "2.4.1",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -47,7 +47,7 @@
   },
   "license": "MIT",
   "devDependencies": {
-    "@types/node": "^24.2.1",
+    "@types/node": "^24.12.2",
     "fetch-mock": "^12.5.4",
     "tsdown": "^0.22.0",
     "typescript": "^6.0.0",
@@ -57,7 +57,7 @@
     "@logtape/logtape": "^2.2.0",
     "@opentelemetry/api": "^1.9.1",
     "es-toolkit": "1.46.1",
-    "@fedify/vocab-runtime": "2.4.0-pr.936.41+59c7432c"
+    "@fedify/vocab-runtime": "2.4.1"
   },
   "scripts": {
     "build:self": "tsdown",

package/src/body.ts

@@ -0,0 +1,95 @@
+// Kept private in each package to avoid adding public API in a patch release.
+// TODO(Jiwon Kwon): Consolidate the duplicated body helpers in @fedify/vocab-runtime,
+// @fedify/webfinger, and @fedify/fedify into a shared implementation.
+import { FetchError } from "@fedify/vocab-runtime";
+import { getLogger } from "@logtape/logtape";
+
+/** Decoded JSON body limit: 16 MiB.  @internal */
+export const MAX_BODY_SIZE: number = 16 * 1024 * 1024;
+
+/** A body exceeded the byte limit.  @internal */
+export class BodyTooLargeError extends FetchError {
+  /** Creates an error for a body exceeding the given limit. */
+  constructor(url: string | URL, maxBytes: number) {
+    super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+    this.name = "BodyTooLargeError";
+  }
+}
+
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes: number): void {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError(
+      "The body size limit must be a positive safe integer.",
+    );
+  }
+}
+
+/**
+ * Reads UTF-8 text while limiting bytes received from the body stream.
+ * Fetch responses are already decompressed, so the stream count is authoritative.
+ * @param message The response or request to read.
+ * @param maxBytes The maximum number of decoded bytes to read.
+ * @param url The URL to include in errors and logs.
+ * @returns The decoded body text.
+ * @throws {BodyTooLargeError} If the body exceeds the limit.
+ * @internal
+ */
+export async function readBoundedText(
+  message: Pick<Request, "body" | "headers">,
+  maxBytes: number,
+  url: string | URL,
+): Promise<string> {
+  validateBodySizeLimit(maxBytes);
+  const reader = message.body?.getReader();
+  const tooLarge = (): never => {
+    getLogger(["fedify", "runtime", "body"]).warn(
+      "Body from {url} exceeds the limit of {maxBytes} bytes.",
+      { url: url.toString(), maxBytes },
+    );
+    throw new BodyTooLargeError(url, maxBytes);
+  };
+  try {
+    // Content-Length describes the encoded body when compression is used.
+    // Only use it as an early rejection for an unencoded body.
+    const length = message.headers.get("Content-Length");
+    const encoding = message.headers.get("Content-Encoding");
+    if (
+      (encoding == null || encoding.toLowerCase() === "identity") &&
+      length != null && /^\d+$/.test(length) && Number(length) > maxBytes
+    ) tooLarge();
+    if (reader == null) return "";
+    let size = 0;
+    const bounded = new ReadableStream<BufferSource>({
+      async pull(controller) {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          return;
+        }
+        size += value.byteLength;
+        if (size > maxBytes) tooLarge();
+        controller.enqueue(value);
+      },
+    }, { highWaterMark: 0 });
+    const textReader = bounded.pipeThrough(new TextDecoderStream()).getReader();
+    try {
+      const chunks: string[] = [];
+      while (true) {
+        const { done, value } = await textReader.read();
+        if (done) break;
+        chunks.push(value);
+      }
+      return chunks.join("");
+    } finally {
+      textReader.releaseLock();
+    }
+  } catch (error) {
+    // A cloned inbox request is a tee.  Awaiting one branch's cancellation
+    // would deadlock until the other branch is canceled by the inbox handler.
+    if (reader != null) void reader.cancel(error).catch(() => {});
+    throw error;
+  } finally {
+    reader?.releaseLock();
+  }
+}

package/src/lookup.test.ts

@@ -1,7 +1,10 @@
 import { createTestMeterProvider, test } from "@fedify/fixture";
+import { UrlError } from "@fedify/vocab-runtime";
+import { configure, type LogRecord, reset } from "@logtape/logtape";
 import { withTimeout } from "es-toolkit";
 import fetchMock from "fetch-mock";
 import { deepStrictEqual, ok } from "node:assert/strict";
+import dns from "node:dns/promises";
 import type { ResourceDescriptor } from "./jrd.ts";
 import { lookupWebFinger } from "./lookup.ts";
 
@@ -886,3 +889,103 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
 });
 
 // cSpell: ignore johndoe
+
+test("lookupWebFinger() bounds resource descriptors", async () => {
+  fetchMock.mockGlobal();
+  let oversized = true;
+  try {
+    fetchMock.get(
+      "begin:https://example.com/.well-known/webfinger?",
+      () =>
+        new Response(
+          '{"subject":"acct:alice@example.com"}' +
+            (oversized ? " ".repeat(16 * 1024 * 1024) : ""),
+          {
+            headers: {
+              "Content-Type": "application/jrd+json",
+              "Content-Length": "1",
+            },
+          },
+        ),
+    );
+    deepStrictEqual(
+      await lookupWebFinger("acct:alice@example.com", {
+        allowPrivateAddress: true,
+      }),
+      null,
+    );
+    oversized = false;
+    deepStrictEqual(
+      await lookupWebFinger("acct:alice@example.com", {
+        allowPrivateAddress: true,
+      }),
+      { subject: "acct:alice@example.com" },
+    );
+  } finally {
+    fetchMock.hardReset();
+  }
+});
+
+test("lookupWebFinger() logs DNS failures as such", async (t) => {
+  // The validator skips DNS when Deno has no network permission.  Checked
+  // here rather than with top-level await, which the CommonJS build rejects.
+  if (
+    "Deno" in globalThis &&
+    (await Deno.permissions.query({ name: "net" })).state !== "granted"
+  ) return;
+  for (const result of ["throws", "empty", "private"] as const) {
+    await t.step(result, async () => {
+      // Stubbing works only because vocab-runtime's url.ts uses the default
+      // node:dns/promises import; see the FIXME there.
+      const originalLookup = dns.lookup;
+      dns.lookup = (() =>
+        result === "throws"
+          ? Promise.reject(new Error("Resolver unavailable"))
+          : Promise.resolve(
+            result === "empty" ? [] : [{ address: "127.0.0.1", family: 4 }],
+          )) as typeof dns.lookup;
+      const records: LogRecord[] = [];
+      await configure({
+        sinks: {
+          buffer: (record) =>
+            records.push(record),
+        },
+        loggers: [
+          { category: "fedify", sinks: ["buffer"], lowestLevel: "debug" },
+          { category: ["logtape", "meta"], sinks: [] },
+        ],
+        reset: true,
+      });
+      try {
+        deepStrictEqual(
+          await lookupWebFinger("acct:alice@dns-failure.invalid"),
+          null,
+        );
+        const failures = records.filter((r) =>
+          r.rawMessage !==
+            "Fetching WebFinger resource descriptor from {url}..."
+        );
+        deepStrictEqual(
+          failures.map((r) => [r.level, r.rawMessage]),
+          [
+            result === "private"
+              ? [
+                "error",
+                "Invalid URL for WebFinger resource descriptor: {error}",
+              ]
+              : ["debug", "DNS lookup failed for {url}"],
+          ],
+        );
+        const { error } = failures[0].properties;
+        ok(error instanceof UrlError);
+        deepStrictEqual(
+          error.reason,
+          result === "private" ? "disallowed" : "dns",
+        );
+      } finally {
+        await reset();
+        dns.lookup = originalLookup;
+      }
+    });
+  }
+});

package/src/lookup.ts

@@ -16,6 +16,7 @@ import {
   type TracerProvider,
 } from "@opentelemetry/api";
 import metadata from "../deno.json" with { type: "json" };
+import { BodyTooLargeError, MAX_BODY_SIZE, readBoundedText } from "./body.ts";
 import type { ResourceDescriptor } from "./jrd.ts";
 
 const logger = getLogger(["fedify", "webfinger", "lookup"]);
@@ -31,10 +32,10 @@ const DEFAULT_MAX_REDIRECTION = 5;
  *  -  `not_found`: the remote responded with HTTP `404 Not Found` or
  *     `410 Gone`.  Recorded together with `http.response.status_code`.
  *  -  `invalid`: the remote responded with content Fedify could not parse
- *     into a {@link ResourceDescriptor} (JSON parse failure), the
- *     redirect chain exceeded `maxRedirection`, the remote redirected to
- *     a different protocol, or the queried `acct:` resource itself was
- *     malformed.
+ *     into a {@link ResourceDescriptor} (JSON parse failure or a body over
+ *     the size limit), the redirect chain exceeded `maxRedirection`, the
+ *     remote redirected to a different protocol, or the queried `acct:`
+ *     resource itself was malformed.
  *  -  `network_error`: no HTTP response was received (the URL was
  *     rejected as a private address, `fetch()` threw, or an `AbortError`
  *     cancelled the request).
@@ -321,10 +322,17 @@ async function lookupWebFingerInternal(
         await validatePublicUrl(url.href);
       } catch (e) {
         if (e instanceof UrlError) {
-          logger.error(
-            "Invalid URL for WebFinger resource descriptor: {error}",
-            { error: e },
-          );
+          if (e.reason === "dns") {
+            logger.debug("DNS lookup failed for {url}", {
+              url: url.href,
+              error: e,
+            });
+          } else {
+            logger.error(
+              "Invalid URL for WebFinger resource descriptor: {error}",
+              { error: e },
+            );
+          }
           return { resource: null, result: "network_error", remoteHost };
         }
         throw e;
@@ -430,7 +438,9 @@ async function lookupWebFingerInternal(
       };
     }
     try {
-      const parsed = await response.json() as ResourceDescriptor;
+      const parsed = JSON.parse(
+        await readBoundedText(response, MAX_BODY_SIZE, url),
+      ) as ResourceDescriptor;
       return {
         resource: parsed,
         result: "found",
@@ -438,6 +448,14 @@ async function lookupWebFingerInternal(
         remoteHost,
       };
     } catch (e) {
+      if (e instanceof BodyTooLargeError) {
+        return {
+          resource: null,
+          result: "invalid",
+          statusCode: response.status,
+          remoteHost,
+        };
+      }
       if (e instanceof SyntaxError) {
         logger.debug(
           "Failed to parse WebFinger resource descriptor as JSON: {error}",