Fedify Linked Data Signature bypass via JSON-LD named-graph restructuring

#!/usr/bin/env python3
# check_fedify_cve_2026_42462.py
# Detects vulnerable @fedify/fedify versions for CVE-2026-42462.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import json
import os
import re
import sys
from pathlib import Path

PKG = "@fedify/fedify"

FIXED = {
    (1, 9): (1, 9, 11),
    (1, 10): (1, 10, 10),
    (2, 0): (2, 0, 18),
    (2, 1): (2, 1, 14),
    (2, 2): (2, 2, 3),
}

SEMVER_RE = re.compile(r"^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$")


def parse_semver(v):
    if not v:
        return None
    v = v.strip()
    m = SEMVER_RE.match(v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def status_for(version_str):
    ver = parse_semver(version_str)
    if ver is None:
        return "UNKNOWN", f"Unparseable version: {version_str}"

    major_minor = (ver[0], ver[1])
    if major_minor in FIXED:
        fixed = FIXED[major_minor]
        if cmp_ver(ver, fixed) >= 0:
            return "PATCHED", f"{version_str} >= fixed {'.'.join(map(str, fixed))}"
        return "VULNERABLE", f"{version_str} < fixed {'.'.join(map(str, fixed))}"

    # Vendor/GHSA advisory describes affected versions as < 2.2.3.
    # For branches without explicit backport data, conservatively treat anything older as vulnerable.
    if cmp_ver(ver, (2, 2, 3)) < 0:
        return "VULNERABLE", f"{version_str} falls below advisory mainline fix 2.2.3 and has no explicit branch exemption"

    return "PATCHED", f"{version_str} is newer than 2.2.3"


def find_package_json_versions(root):
    findings = []
    for path in root.rglob("package.json"):
        try:
            data = json.loads(path.read_text(encoding="utf-8"))
        except Exception:
            continue

        if isinstance(data, dict):
            if data.get("name") == PKG and data.get("version"):
                findings.append((str(path), data.get("version"), "installed-package"))

            for section in ("dependencies", "devDependencies", "optionalDependencies", "peerDependencies"):
                deps = data.get(section, {})
                if isinstance(deps, dict) and PKG in deps:
                    findings.append((str(path), str(deps[PKG]), f"declared-{section}"))
    return findings


def normalize_declared_range(s):
    # Best-effort extraction of a concrete version from simple ranges like ^2.2.2, ~2.1.13, 2.0.18.
    m = re.search(r"(\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?)", s)
    return m.group(1) if m else None


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 check_fedify_cve_2026_42462.py /path/to/app")
        sys.exit(3)

    root = Path(sys.argv[1])
    if not root.exists():
        print(f"UNKNOWN - path does not exist: {root}")
        sys.exit(3)

    findings = find_package_json_versions(root)
    if not findings:
        print("UNKNOWN - @fedify/fedify not found in package.json files under target path")
        sys.exit(2)

    vuln = []
    patched = []
    unknown = []

    for file_path, raw_version, source in findings:
        version = raw_version
        if source.startswith("declared-"):
            extracted = normalize_declared_range(raw_version)
            if extracted is None:
                unknown.append((file_path, raw_version, source, "Range cannot be resolved offline"))
                continue
            version = extracted

        state, reason = status_for(version)
        record = (file_path, raw_version, source, reason)
        if state == "VULNERABLE":
            vuln.append(record)
        elif state == "PATCHED":
            patched.append(record)
        else:
            unknown.append(record)

    if vuln:
        print("VULNERABLE")
        for f, v, s, r in vuln:
            print(f"- {f} [{s}] => {v} :: {r}")
        if patched:
            print("Additional patched findings:")
            for f, v, s, r in patched:
                print(f"- {f} [{s}] => {v} :: {r}")
        if unknown:
            print("Additional unknown findings:")
            for f, v, s, r in unknown:
                print(f"- {f} [{s}] => {v} :: {r}")
        sys.exit(1)

    if patched and not unknown:
        print("PATCHED")
        for f, v, s, r in patched:
            print(f"- {f} [{s}] => {v} :: {r}")
        sys.exit(0)

    print("UNKNOWN")
    for f, v, s, r in unknown:
        print(f"- {f} [{s}] => {v} :: {r}")
    if patched:
        print("Additional patched findings:")
        for f, v, s, r in patched:
            print(f"- {f} [{s}] => {v} :: {r}")
    sys.exit(2)


if __name__ == "__main__":
    main()