@rmdes/indiekit-endpoint-activitypub 3.13.9 → 3.13.10

package/lib/inbox-handlers.js

@@ -43,6 +43,10 @@ import { getSettings } from "./settings.js";
 /** @type {string} ActivityStreams Public Collection constant */
 const PUBLIC = "https://www.w3.org/ns/activitystreams#Public";
 
+// Pure addressing/visibility helpers are exported for unit testing (see
+// tests/inbox-visibility.test.js). They are not part of the handler API.
+export { isDirectMessage as _isDirectMessage, computeVisibility as _computeVisibility };
+
 // ---------------------------------------------------------------------------
 // Router
 // ---------------------------------------------------------------------------

package/lib/item-processing.js

@@ -7,7 +7,9 @@
  */
 
 import { stripQuoteReferenceHtml } from "./og-unfurl.js";
-import { replaceCustomEmoji } from "./emoji-utils.js";
+// Use the hardened replaceCustomEmoji (validates http(s) URL schemes + escapes
+// attributes) — the render pipeline processes attacker-controlled remote emoji.
+import { replaceCustomEmoji } from "./timeline-store.js";
 import { shortenDisplayUrls, collapseHashtagStuffing } from "./content-utils.js";
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.13.9",
+  "version": "3.13.10",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",

package/lib/emoji-utils.js

@@ -1,38 +0,0 @@
-/**
- * Custom emoji replacement for fediverse content.
- *
- * Replaces :shortcode: patterns with <img> tags for custom emoji.
- * Must be called AFTER sanitizeContent() — the inserted <img> tags
- * would be stripped if run through the sanitizer.
- */
-
-/**
- * Escape special regex characters in a string.
- * @param {string} str
- * @returns {string}
- */
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-/**
- * Replace :shortcode: patterns in HTML with custom emoji <img> tags.
- *
- * @param {string} html - HTML string (already sanitized)
- * @param {Array<{shortcode: string, url: string}>} emojis - Custom emoji list
- * @returns {string} HTML with emoji shortcodes replaced by img tags
- */
-export function replaceCustomEmoji(html, emojis) {
-  if (!html || !emojis?.length) return html;
-
-  for (const emoji of emojis) {
-    if (!emoji.shortcode || !emoji.url) continue;
-    const pattern = new RegExp(`:${escapeRegex(emoji.shortcode)}:`, "g");
-    html = html.replace(
-      pattern,
-      `<img src="${emoji.url}" alt=":${emoji.shortcode}:" title=":${emoji.shortcode}:" class="ap-custom-emoji" loading="lazy">`,
-    );
-  }
-
-  return html;
-}