Meta: Add an option to group LD object entities

.github/workflows/tests.yml

@@ -9,15 +9,15 @@ jobs:
 
     strategy:
       matrix:
-        node-version: ['20.x']
+        node-version: ['22.x']
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 11
           run_install: false
 
       - name: Use Node.js ${{ matrix.node-version }}

audit.log

@@ -1 +1,48 @@
-No known vulnerabilities found
+┌─────────────────────┬────────────────────────────────────────────────────────┐
+│ moderate            │ js-yaml: YAML merge-key chains can force quadratic CPU │
+│                     │ consumption in js-yaml                                 │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Package             │ js-yaml                                                │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Vulnerable versions │ >=5.0.0 <=5.1.0                                        │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Patched versions    │ >=5.1.1                                                │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Paths               │ .>node-yaml-config>js-yaml                             │
+│                     │                                                        │
+│                     │ .>mocha>js-yaml                                        │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ More info           │ https://github.com/advisories/GHSA-g796-fgmg-93mv      │
+└─────────────────────┴────────────────────────────────────────────────────────┘
+┌─────────────────────┬────────────────────────────────────────────────────────┐
+│ moderate            │ js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap  │
+│                     │ tag in YAML11_SCHEMA                                   │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Package             │ js-yaml                                                │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Vulnerable versions │ >=5.0.0 <=5.2.0                                        │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Patched versions    │ >=5.2.1                                                │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Paths               │ .>node-yaml-config>js-yaml                             │
+│                     │                                                        │
+│                     │ .>mocha>js-yaml                                        │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ More info           │ https://github.com/advisories/GHSA-724g-mxrg-4qvm      │
+└─────────────────────┴────────────────────────────────────────────────────────┘
+┌─────────────────────┬────────────────────────────────────────────────────────┐
+│ low                 │ body-parser vulnerable to denial of service when       │
+│                     │ invalid limit value silently disables size enforcement │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Package             │ body-parser                                            │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Vulnerable versions │ >=2.0.0 <2.3.0                                         │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Patched versions    │ >=2.3.0                                                │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ Paths               │ .>mock-http-server>body-parser                         │
+├─────────────────────┼────────────────────────────────────────────────────────┤
+│ More info           │ https://github.com/advisories/GHSA-v422-hmwv-36x6      │
+└─────────────────────┴────────────────────────────────────────────────────────┘
+3 vulnerabilities found
+Severity: 1 low | 2 moderate

config.js

@@ -136,6 +136,7 @@
             og: "og",
             twitter: "twitter",
             oembed: "oembed",
+            ld: "ld",
 
             icon: "icon",
             logo: "logo",
@@ -373,6 +374,18 @@
             'getSignals': 'signals',
             'getPolicy': 'policy',
             'getContent': 'content',
+        },
+
+        // Used to (re-)group LD+JSON into buckets
+        LD_TYPE_ALIASES: {
+            article: [
+                'Article'
+            ],
+
+            image: [
+                'ImageObject',
+                'Photograph'
+            ]
         }
     };
 

lib/utils.js

@@ -494,7 +494,7 @@ export function parseJSONSource(text, decode) {
     return JSON.parse(s);
 };
 
-export function parseLDSource(ld, decode, uri) {    
+export function parseLDSource(ld, decode, uri, type_aliases) {
 
     if (typeof ld === 'string') {
         try {
@@ -505,7 +505,7 @@ export function parseLDSource(ld, decode, uri) {
         }
     }
 
-    if (!ld) return;    
+    if (!ld) return;
 
     if (!(ld instanceof Array)) {
         if (!ld['@type'] && ld['@graph'] && Array.isArray(ld['@graph'])) {
@@ -515,52 +515,70 @@ export function parseLDSource(ld, decode, uri) {
         }
     }
 
-    var ldParsed;
+    let ldParsed;
 
-    const addObject = function(obj) {
+    const getName = function(type) {
+        if (!type) return '-';
 
-        const pushObj = function(id, obj) {
-            if (id) {
+        let name = String(type).toLowerCase().replace(/[^a-z0-9]/g, '');
+        const TYPE_ALIASES = type_aliases || CONFIG.LD_TYPE_ALIASES;
+        if (TYPE_ALIASES) {
+            const alias = Object.keys(TYPE_ALIASES).find(alias => {
+                return TYPE_ALIASES[alias].some(
+                    type => name === type.toLowerCase() || name.endsWith(type.toLowerCase())
+                );
+            })
+            if (alias) {
+                name = alias;
+            }
+        }
+        return name;
+    }
 
-                if (!ldParsed) {
-                    ldParsed = {};
-                }
+    const pushObj = function(name, obj) {
+        if (name) {
 
-                if (!ldParsed[id]) {
-                    ldParsed[id] = obj;
-                } else {
-                    if (!Array.isArray(ldParsed[id])) {
-                        ldParsed[id] = [ldParsed[id]];
-                    }
-                    ldParsed[id].push(obj);
+            if (!ldParsed) {
+                ldParsed = {};
+            }
+
+            if (!ldParsed[name]) {
+                ldParsed[name] = obj;
+
+            } else {
+                if (!Array.isArray(ldParsed[name])) {
+                    ldParsed[name] = [ldParsed[name]];
                 }
-            }            
+                ldParsed[name].push(obj);
+            }
         }
+    };
 
-        if (Array.isArray(obj['@type'])) {            
-            for (var i = 0; i < obj['@type'].length; i++) {
-                var type = obj['@type'][i];
-                pushObj(type && type.toLowerCase && type.toLowerCase(), obj);
-            }
-        } else {
-            var type = obj && obj['@type'];
-            pushObj(type && type.toLowerCase && type.toLowerCase(), obj);
+    const addObject = function(obj) {
+
+        if (!obj || !obj['@type']) {
+            return;
         }
+
+        const type = Array.isArray(obj['@type']) ? obj['@type'][0] : obj['@type'];
+        const name = getName(type);
+
+        pushObj(name, obj);
     };
 
-    for (var i = 0; i < ld.length; i++) {
+    for (let i = 0; i < ld.length; i++) {
         try {
-            var str = ld[i];
-            var obj = typeof str === 'string' ? parseJSONSource(str, decode) : str;
+            const str = ld[i];
+            const obj = typeof str === 'string' ? parseJSONSource(str, decode) : str;
 
             if (Array.isArray(obj)) {
-                for(var j = 0; j < obj.length; j++) {
+                for(let j = 0; j < obj.length; j++) {
                     addObject(obj[j]);
                 }
             } else {
                 addObject(obj);
             }
-            
+
         } catch (ex) {
             log('   -- Error parsing ld-json', uri, ex.message);
         }

package.json

@@ -67,10 +67,5 @@
     },
     "engines": {
         "node": ">=20.19.3"
-    },
-    "pnpm": {
-        "patchedDependencies": {
-            "readabilitySAX@1.6.1": "patches/readabilitySAX@1.6.1.patch"
-        }
     }
 }

plugins/domains/facebook.com/facebook.thumbnail.js

@@ -15,10 +15,7 @@ export default {
     getLink: function(url, __allowFBThumbnail, options, meta) {
 
         var thumbnail = meta.twitter?.image
-                        || meta.og?.image
-                        || meta.ld?.socialmediaposting?.image?.contenturl
-                        || meta.ld?.socialmediaposting?.image && Array.isArray(meta.ld.socialmediaposting.image) // This one is for photos
-                            && meta.ld.socialmediaposting.image.length === 1 && meta.ld.socialmediaposting.image[0].contenturl; 
+                        || meta.og?.image; 
 
         if (thumbnail?.url || thumbnail?.src) {
             thumbnail = thumbnail.url || thumbnail.src;

plugins/meta/ld-article-keywords.js

@@ -2,9 +2,9 @@ export default {
 
     getMeta: function(ld) {
 
-        if (ld.newsarticle && ld.newsarticle.keywords && ld.newsarticle.keywords instanceof Array) {
+        if (ld.article?.keywords && ld.article.keywords instanceof Array) {
             return {
-                keywords: ld.newsarticle.keywords.join(', ')
+                keywords: ld.article.keywords.join(', ')
             }
         }
     }

plugins/meta/ld-article.js

@@ -14,27 +14,34 @@ export default {
             }
         }
 
-        if (ld.newsarticle) {
+        if (ld.article) {
             return {
-                title: clean(ld.newsarticle.headline),
-                category: clean(ld.newsarticle.articlesection),
-                description: clean(ld.newsarticle.description)
+                title: clean(ld.article.headline),
+                category: clean(ld.article.articlesection),
+                description: clean(ld.article.description)
             }
         }
     },
 
     getLink: function(ld) {
 
-        if (ld.newsarticle && ld.newsarticle.thumbnailurl) {
-            return {
-                href: ld.newsarticle.thumbnailurl,
-                type: CONFIG.T.image,
-                rel: CONFIG.R.thumbnail
-            }
+        if (ld.article?.image) {
+            const images = Array.isArray(ld.article.image) ? ld.article.image : [ld.article.image]
+            const links = [];
+
+            images.forEach(image => {
+                links.push({
+                    href: image.contenturl || image.url,
+                    type: CONFIG.T.image,
+                    rel: [CONFIG.R.thumbnail, CONFIG.R.ld],
+                    alt: image.caption || image.name
+                })
+            });
+
+            return links;
         }
     }
 
     // ex: 
-    // http://www.app.com/story/entertainment/music/2017/03/17/springsteen-legacy-apmff-upstage-film-explores-1970-asbury-park/99313864/
-    // https://www.nhl.com/video/oshie-buries-ppg-with-a-backhand/c-51625603?tcid=tw_video_content_id
+    // https://www.sabah.com.tr/yasam/2019/09/20/son-dakika-tuzladaki-yanginla-ilgili-flas-aciklama
 };