@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/lib/file-upload.js

@@ -22,8 +22,12 @@
  *   content gate inspects the reassembled buffer, so it runs on uploads
  *   up to `maxStreamReassemblyBytes` (default 64 MiB); a larger upload
  *   is handed to `onFinalize` as a stream and the byte-content gate is
- *   skipped (MIME-sniff + filename gates still run, and the skip emits a
- *   `fileUpload.content_safety_skipped` warning audit). To guarantee
+ *   skipped (MIME-sniff + filename gates still run). Every skip path —
+ *   the upload streamed past the reassembly cap, no gate is registered
+ *   for the file's extension, or `contentSafety: null` disabled scanning
+ *   — emits a `fileUpload.content_safety_skipped` audit whose `reason`
+ *   names the cause, so a security review of the audit log can tell which
+ *   uploads reached storage without a content scan and why. To guarantee
  *   content-gating of a type, cap `maxFileBytes` at or below
  *   `maxStreamReassemblyBytes`. Per-chunk hooks
  *   (`onChunk`) are the integration point for virus scanners and
@@ -475,6 +479,32 @@ function create(opts) {
     if (opts.observability) opts.observability.safeEvent(name, value, labels || {});
   }
 
+  // Emit an audit row whenever the byte-level content-safety scan is
+  // SKIPPED for a finalized upload — so a security review of the audit
+  // log can tell that bytes reached storage without passing the
+  // content gate, and WHY. Without this, every skip path (operator
+  // opt-out, no gate registered for the file's extension, or the upload
+  // streamed past maxStreamReassemblyBytes) was silent: the audit log
+  // showed a clean `fileUpload.finalize` success indistinguishable from
+  // a scanned upload. `reason` names the skip cause so operators can
+  // alert / lower maxStreamReassemblyBytes / register the missing gate.
+  // Observability-only: `_emitAudit` wraps audit.safeEmit in try/catch
+  // (drop-silent — by design) so a throwing sink never breaks the upload.
+  function _emitContentSafetySkipped(uploadId, actor, reason, ext, size) {
+    _emitObs("fileUpload.content_safety_skipped", 1, { reason: reason, ext: ext || "" });
+    // outcome "success" — the upload itself finalized; the audit records
+    // that the byte-level scan did NOT run, with `reason` naming why
+    // (the only outcomes the audit chain accepts are success / failure /
+    // denied, so the skip-cause lives in `reason` + `metadata`).
+    _emitAudit("fileUpload.content_safety_skipped", {
+      actor:    requestHelpers.extractActorContext(actor),
+      resource: { kind: "fileUpload", id: uploadId },
+      outcome:  "success",
+      reason:   reason,
+      metadata: { uploadId: uploadId, ext: ext || null, size: size, reason: reason },
+    });
+  }
+
   // Staging dir mode 0o700 — only the framework process reads its own
   // staging files.
   atomicFile.ensureDir(stagingDir, 0o700);
@@ -1088,12 +1118,27 @@ function create(opts) {
         // upload streamed past maxStreamReassemblyBytes and was never
         // reassembled into a buffer the byte-level gate can inspect. The
         // MIME-sniff and filename gates still ran; the per-extension
-        // content gate did NOT. Surface it (rather than skipping silently)
-        // via an observability counter so operators can alert, lower
-        // maxStreamReassemblyBytes, or cap maxFileBytes to force
-        // content-gating of this type.
-        _emitObs("fileUpload.content_safety_skipped_streamed", 1, { ext: safetyExt });
+        // content gate did NOT. Audit the skip (with the streamed reason)
+        // so operators can alert, lower maxStreamReassemblyBytes, or cap
+        // maxFileBytes to force content-gating of this type.
+        _emitContentSafetySkipped(uploadId, actor, "streamed-over-reassembly-cap",
+                                  safetyExt, verified.totalBytes);
+      } else {
+        // contentSafety is wired but no gate is registered for this file's
+        // extension — the byte-level scan does not run. Audit the skip so
+        // a review can tell the upload bypassed content scanning (and
+        // register a gate for the extension if it should be scanned).
+        _emitContentSafetySkipped(uploadId, actor, "no-gate-for-extension",
+                                  safetyExt, verified.totalBytes);
       }
+    } else {
+      // Content-safety scanning is disabled for this upload manager
+      // (contentSafety: null opt-out at create()). The create-time audit
+      // recorded the disable; this per-upload audit makes the bypass
+      // visible at the point bytes reached storage.
+      _emitContentSafetySkipped(uploadId, actor, "content-safety-disabled",
+                                nodePath.extname(filename).toLowerCase(),
+                                verified.totalBytes);
     }
 
     // Hand to operator's onFinalize.

package/lib/vendor/blamejs/lib/framework-error.js

@@ -125,6 +125,11 @@ var QueueError            = defineClass("QueueError");
 // them and skips immediately rather than hammering a misconfig.
 var RedisError            = defineClass("RedisError");
 var ExternalDbError       = defineClass("ExternalDbError");
+// DbQueryError covers the local-SQLite query-builder refusal paths
+// (residency write gates, malformed-call shapes). Refusals pass the
+// permanent flag explicitly — a residency mismatch never becomes valid
+// on retry, while the class stays open for transient codes later.
+var DbQueryError          = defineClass("DbQueryError");
 var ClusterError          = defineClass("ClusterError");
 var ClusterProviderError  = defineClass("ClusterProviderError");
 var HandlerError          = defineClass("HandlerError",          { withCause: true });
@@ -210,6 +215,16 @@ var GuardSvgError         = defineClass("GuardSvgError",         { alwaysPermane
 // (Windows strips them silently), unicode bidi/RTLO file-name spoofing,
 // overlong UTF-8 encoding, length caps. alwaysPermanent.
 var GuardFilenameError    = defineClass("GuardFilenameError",    { alwaysPermanent: true });
+// GuardSqlError covers raw-SQL refusals from the b.guardSql guard: the
+// OS-reach floor (file / exec / FDW / extension / privilege-pivot
+// across Postgres / SQLite / MySQL), stacked statements, comment
+// smuggling, embedded string literals in a fragment, invalid UTF-8
+// (CVE-2025-1094 encoding-bypass class), time-based probes, schema
+// recon, and the migration DDL-verb allowlist. DOT-style codes
+// (sql.refuse / sql.stacked / sql.file-access / ...) so they don't
+// collide with SafeSqlError's slash codes (sql/bad-shape / ...).
+// alwaysPermanent.
+var GuardSqlError         = defineClass("GuardSqlError",         { alwaysPermanent: true });
 // GuardArchiveError covers archive-shape violations: zip-slip path
 // traversal, symlink + hardlink escape, decompression-ratio bombs,
 // nested-archive depth, file-count + total-size + per-entry-size caps,
@@ -552,7 +567,9 @@ var WatcherError          = defineClass("WatcherError",          { alwaysPermane
 // caller-shape misuse or an irrecoverable on-disk condition.
 var LocalDbThinError      = defineClass("LocalDbThinError",      { alwaysPermanent: true });
 // RouterError covers operator-shape violations on the router primitive:
-// invalid `allowedRedirectOrigins` opt at create time, and cross-origin
+// invalid `allowedRedirectOrigins` opt at create time, a malformed
+// `use()` mount (non-string / non-array prefix, a prefix not beginning
+// with "/", a missing or non-function middleware), and cross-origin
 // `res.redirect()` targets that are not on the allowlist. alwaysPermanent
 // — every case is config-time programming bug or an outbound-redirect
 // shape error that retry will not recover.
@@ -653,6 +670,7 @@ module.exports = {
   QueueError:             QueueError,
   RedisError:             RedisError,
   ExternalDbError:        ExternalDbError,
+  DbQueryError:           DbQueryError,
   ClusterError:           ClusterError,
   ClusterProviderError:   ClusterProviderError,
   HandlerError:           HandlerError,
@@ -679,6 +697,7 @@ module.exports = {
   GuardHtmlError:         GuardHtmlError,
   GuardSvgError:          GuardSvgError,
   GuardFilenameError:     GuardFilenameError,
+  GuardSqlError:          GuardSqlError,
   GuardArchiveError:      GuardArchiveError,
   GuardJsonError:         GuardJsonError,
   GuardYamlError:         GuardYamlError,

package/lib/vendor/blamejs/lib/framework-files.js

@@ -0,0 +1,73 @@
+"use strict";
+
+// framework-files — the single source of truth for the framework's on-disk
+// state file names. Centralized (mirroring framework-schema's table-name
+// registry) so a rename / relocation is a one-line change and no module
+// hardcodes the literal. Every owner resolves its file name through
+// fileName(logical) instead of embedding the string; the codebase-patterns
+// `no-hardcoded-framework-file-name` detector drives the remaining owners
+// onto this registry in reverse (a file that still hardcodes a registered
+// name fails the gate once it leaves the migration backlog).
+//
+// Internal infrastructure (not a public b.* namespace) — consumed by db /
+// vault / audit / backup the way constants.js is.
+
+var { FrameworkError } = require("./framework-error");
+
+// Canonical state file names. Each is a BARE file name (no path) joined onto
+// the operator's dataDir / a sub-path by the owner. Security-/durability-
+// sensitive files only — templated names (e.g. the hashed working-db file)
+// are not registered here.
+var DEFAULT_FILE_NAMES = Object.freeze({
+  dbEnc:         "db.enc",          // encrypted-at-rest database ciphertext
+  dbKeyEnc:      "db.key.enc",      // sealed database encryption key
+  vaultKey:      "vault.key",       // sealed vault keypair
+  auditTip:      "audit.tip",       // audit rollback-detection sidecar
+  auditSignKey:  "audit-sign.key",  // sealed audit-signing keypair
+  rowsEnc:       "rows.enc",        // archive/backup rows ciphertext member
+  checkpointEnc: "checkpoint.enc",  // archive/backup checkpoint ciphertext member
+});
+
+var _overrides = {};
+
+// fileName(logical) — resolve a logical file key to its configured (or
+// default) bare file name. Defensive request-shape reader: throws on an
+// unknown logical key (a typo is a boot-time bug, not a runtime default).
+function fileName(logical) {
+  if (Object.prototype.hasOwnProperty.call(_overrides, logical)) return _overrides[logical];
+  if (Object.prototype.hasOwnProperty.call(DEFAULT_FILE_NAMES, logical)) {
+    return DEFAULT_FILE_NAMES[logical];
+  }
+  throw new FrameworkError(
+    "frameworkFiles.fileName: unknown logical file '" + logical + "'",
+    "framework-files/unknown");
+}
+
+// setFileName(logical, name) — config-time override of a state file name.
+// THROW on bad input (entry-point tier): the override must name a known
+// logical key and be a bare file name (no path separators, no '..') so it
+// can't redirect a sealed-key write outside the data dir.
+function setFileName(logical, name) {
+  if (!Object.prototype.hasOwnProperty.call(DEFAULT_FILE_NAMES, logical)) {
+    throw new FrameworkError(
+      "frameworkFiles.setFileName: unknown logical file '" + logical + "'",
+      "framework-files/unknown");
+  }
+  if (typeof name !== "string" || name.length === 0 ||
+      name.indexOf("/") !== -1 || name.indexOf("\\") !== -1 || name.indexOf("..") !== -1) {
+    throw new FrameworkError(
+      "frameworkFiles.setFileName: name must be a non-empty bare file name " +
+      "(no path separators or '..')", "framework-files/bad-name");
+  }
+  _overrides[logical] = name;
+}
+
+// Test/boot helper — drop all overrides back to the defaults.
+function _resetForTest() { _overrides = {}; }
+
+module.exports = {
+  fileName:          fileName,
+  setFileName:       setFileName,
+  DEFAULT_FILE_NAMES: DEFAULT_FILE_NAMES,
+  _resetForTest:     _resetForTest,
+};