@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/test/layer-0-primitives/otel-export.test.js

@@ -245,6 +245,139 @@ async function run() {
   check("record: bad name dropped",             ex3.bufferedCounters === 0);
   check("record: bad value dropped",            ex3.bufferedObservations === 0);
   await ex3.close();
+
+  // ---- Telemetry-attribute redaction (CWE-532) ----
+  // Span/metric attribute VALUES are a first-class egress sink — a secret
+  // in an attribute must not reach the OTLP collector verbatim. Redaction
+  // is ON by default (composes b.redact via b.observability.getRedactor);
+  // benign attributes pass through unchanged.
+  await _testRedaction();
+
+  // setRedactor surface validation
+  check("setRedactor rejects non-function/non-null", (function () {
+    var t = null;
+    try { b.observability.setRedactor(42); } catch (e) { t = e; }
+    return t instanceof TypeError && /must be a function or null/.test(t.message);
+  })());
+  check("getRedactor returns a function", typeof b.observability.getRedactor() === "function");
+}
+
+function _findAttr(list, key) {
+  for (var i = 0; i < list.length; i++) if (list[i].key === key) return list[i];
+  return null;
+}
+
+async function _testRedaction() {
+  // Always restore the default redactor so this block can't pollute the
+  // shared b.observability singleton used by sibling tests.
+  try {
+    // Default-on: secret-shaped attrs scrubbed, benign attrs untouched —
+    // asserted on the real OTLP payload captured by the test exporter.
+    var captured = null;
+    var hc = b.testing.fakeHttpClient(function (req) {
+      captured = JSON.parse(req.body);
+      return { statusCode: 200, headers: {}, body: Buffer.from("") };
+    });
+    var ex = b.otelExport.create({
+      endpoint:    "https://otel.example/v1/metrics",
+      serviceName: "wiki",
+      intervalMs:  0,
+      httpClient:  hc,
+    });
+    ex.recordCounter("http.requests", 1, {
+      "http.route":   "/checkout",                          // benign — passes through
+      "authorization": "Bearer eyJabc.eyJdef.sigsigsig",    // sensitive field name
+      "card":          "4111 1111 1111 1111",               // credit-card value-shape
+      "status":        200,                                  // benign number
+    });
+    await ex.flush();
+
+    var dp = captured.resourceMetrics[0].scopeMetrics[0].metrics
+      .find(function (m) { return m.name === "http.requests" && m.sum; })
+      .sum.dataPoints[0];
+    var attrs = dp.attributes;
+    check("redact: benign route attr passes through",
+      _findAttr(attrs, "http.route").value.stringValue === "/checkout");
+    check("redact: benign number attr passes through",
+      _findAttr(attrs, "status").value.intValue === "200");
+    check("redact: sensitive field-name attr redacted",
+      _findAttr(attrs, "authorization").value.stringValue === b.redact.MARKER);
+    check("redact: credit-card value-shape attr redacted",
+      _findAttr(attrs, "card").value.stringValue === "[REDACTED-CC]");
+    await ex.close();
+
+    // Resource attributes also flow through the redactor — a secret in a
+    // resource attribute (operator misconfiguration) is scrubbed too.
+    var capturedRes = null;
+    var hcRes = b.testing.fakeHttpClient(function (req) {
+      capturedRes = JSON.parse(req.body);
+      return { statusCode: 200, headers: {}, body: Buffer.from("") };
+    });
+    var exRes = b.otelExport.create({
+      endpoint:           "https://otel.example/v1/metrics",
+      serviceName:        "wiki",
+      intervalMs:         0,
+      httpClient:         hcRes,
+      resourceAttributes: { "deployment.environment": "production", "api_key": "AKIAABCDEFGHIJKLMNOP" },
+    });
+    exRes.recordCounter("x", 1);
+    await exRes.flush();
+    var resAttrs = capturedRes.resourceMetrics[0].resource.attributes;
+    check("redact: benign resource attr passes through",
+      _findAttr(resAttrs, "deployment.environment").value.stringValue === "production");
+    check("redact: sensitive resource attr redacted",
+      _findAttr(resAttrs, "api_key").value.stringValue === b.redact.MARKER);
+    await exRes.close();
+
+    // Operator override via setRedactor — a stricter scrubber is honored
+    // without re-creating the exporter.
+    b.observability.setRedactor(function (value, key) {
+      if (key === "enduser.id") return "[CUSTOM]";
+      return b.redact.redact(value, { parentKey: key });
+    });
+    var enc = b.otelExport._attrsToOtlpForTest({ "enduser.id": "u-42", "http.route": "/p" });
+    check("redact: custom redactor applied",
+      _findAttr(enc, "enduser.id").value.stringValue === "[CUSTOM]");
+    check("redact: custom redactor leaves benign attr",
+      _findAttr(enc, "http.route").value.stringValue === "/p");
+
+    // A throwing redactor must DROP the attribute (fail toward dropping,
+    // not leaking) and must NOT crash the export.
+    b.observability.setRedactor(function () { throw new Error("redactor-boom"); });
+    var threw = null;
+    var encThrow;
+    try { encThrow = b.otelExport._attrsToOtlpForTest({ secret_token: "shhh", keep: "x" }); }
+    catch (e) { threw = e; }
+    check("redact: throwing redactor does not crash export", threw === null);
+    check("redact: throwing redactor drops all attrs (no leak)", encThrow.length === 0);
+
+    // A throwing redactor through the full flush path still ships an
+    // empty-attribute datapoint rather than the raw secret.
+    var capturedThrow = null;
+    var hcThrow = b.testing.fakeHttpClient(function (req) {
+      capturedThrow = JSON.parse(req.body);
+      return { statusCode: 200, headers: {}, body: Buffer.from("") };
+    });
+    var exThrow = b.otelExport.create({
+      endpoint:    "https://otel.example/v1/metrics",
+      serviceName: "wiki",
+      intervalMs:  0,
+      httpClient:  hcThrow,
+    });
+    exThrow.recordCounter("http.requests", 1, { secret_token: "shhh" });
+    await exThrow.flush();
+    var dpThrow = capturedThrow.resourceMetrics[0].scopeMetrics[0].metrics
+      .find(function (m) { return m.name === "http.requests" && m.sum; })
+      .sum.dataPoints[0];
+    check("redact: flush with throwing redactor drops the secret attr",
+      (dpThrow.attributes || []).length === 0);
+    var bodyStr = JSON.stringify(capturedThrow);
+    check("redact: secret never appears in exported payload",
+      bodyStr.indexOf("shhh") === -1);
+    await exThrow.close();
+  } finally {
+    b.observability.setRedactor(null);   // restore default for sibling tests
+  }
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/otlp-attr-redaction.test.js

@@ -0,0 +1,101 @@
+"use strict";
+// The OTLP span exporter must run every attribute VALUE through the telemetry
+// redactor before serialization. Telemetry is a first-class EGRESS sink — a
+// span attribute holding a bearer token, password, or API key would otherwise
+// be shipped verbatim onto the OTLP wire (CWE-532: insertion of sensitive
+// information into an externally-shipped sink), reaching whatever collector the
+// operator points at.
+//
+// Drives the real consumer path: create() an exporter with a capturing
+// fetchImpl, queue a span (and a span EVENT) carrying sensitive attributes,
+// flush, and inspect the outgoing body — for BOTH json and protobuf encodings.
+// The default redactor (b.redact.redact) scrubs by sensitive field name.
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+var otlp = require("../../lib/observability-otlp-exporter");
+
+var SECRET_TOKEN = "Bearer eyJSECRETtokenABCdef.ghi.jkl";
+var SECRET_PW    = "hunter2-PLAINTEXT-PASSWORD";
+var SECRET_API   = "sk_live_PLAINTEXT_APIKEY_0001";
+var CONTROL_VAL  = "GET-control-value-keep-me";
+
+function makeSpan() {
+  return {
+    traceId:           "0123456789abcdef0123456789abcdef",
+    spanId:            "0123456789abcdef",
+    parentSpanId:      "",
+    name:              "GET /x",
+    kind:              "server",
+    startTimeUnixNano: "1700000000000000000",
+    endTimeUnixNano:   "1700000000100000000",
+    attributes: {
+      "http.method":   CONTROL_VAL,        // non-sensitive control — must survive
+      "authorization": SECRET_TOKEN,
+      "password":      SECRET_PW,
+      "api_key":       SECRET_API,
+    },
+    events: [
+      { timeUnixNano: "1700000000050000000", name: "log",
+        attributes: { "password": SECRET_PW } },
+    ],
+    status:   { code: 1, message: "" },
+    resource: { "service.name": "svc" },
+  };
+}
+
+async function captureBody(encoding) {
+  var captured = [];
+  var ex = otlp.create({
+    endpoint:  "https://collector.invalid/v1/traces",
+    encoding:  encoding,
+    batchSize: 100,            // don't auto-flush; flush explicitly
+    audit:     false,
+    fetchImpl: async function (url, init) {
+      captured.push(init && init.body);
+      return { ok: true, status: 200, text: async function () { return ""; } };
+    },
+  });
+  ex.queue(makeSpan());
+  await ex.flush();
+  await ex.shutdown();
+  var body = captured[0];
+  return Buffer.isBuffer(body) ? body.toString("latin1") : String(body);
+}
+
+async function run() {
+  b.observability.setRedactor(null);   // default redactor active
+
+  // The shared primitive both exporters route through — assert it directly so
+  // the redaction contract is covered at the seam, not only end-to-end.
+  var ra = b.observability.redactAttrs({
+    "http.method": CONTROL_VAL, authorization: SECRET_TOKEN, password: SECRET_PW,
+  });
+  check("redactAttrs scrubs sensitive keys", ra.authorization === "[REDACTED]" && ra.password === "[REDACTED]");
+  check("redactAttrs keeps non-sensitive keys", ra["http.method"] === CONTROL_VAL);
+
+  var jsonWire = await captureBody("json");
+  check("json: bearer token redacted on the OTLP wire", jsonWire.indexOf(SECRET_TOKEN) === -1);
+  check("json: password redacted on the OTLP wire",     jsonWire.indexOf(SECRET_PW) === -1);
+  check("json: api key redacted on the OTLP wire",      jsonWire.indexOf(SECRET_API) === -1);
+  check("json: span-EVENT attribute password redacted", jsonWire.split(SECRET_PW).length === 1);
+  check("json: non-sensitive control attribute survives", jsonWire.indexOf(CONTROL_VAL) !== -1);
+
+  var protoWire = await captureBody("protobuf");
+  check("protobuf: bearer token redacted on the OTLP wire", protoWire.indexOf(SECRET_TOKEN) === -1);
+  check("protobuf: password redacted on the OTLP wire",     protoWire.indexOf(SECRET_PW) === -1);
+  check("protobuf: api key redacted on the OTLP wire",      protoWire.indexOf(SECRET_API) === -1);
+  check("protobuf: non-sensitive control attribute survives", protoWire.indexOf(CONTROL_VAL) !== -1);
+
+  b.observability.setRedactor(null);   // restore default for other tests
+  process.stdout.write("OK — otlp attribute redaction tests\n");
+}
+
+run().then(function () {
+  process.exit(0);
+}).catch(function (e) {
+  process.stderr.write((e && e.stack ? e.stack : String(e)) + "\n");
+  process.exit(1);
+});

package/lib/vendor/blamejs/test/layer-0-primitives/outbox-inflight-reaper.test.js

@@ -0,0 +1,136 @@
+"use strict";
+// #128: the outbox must reclaim a row stranded 'in-flight' by a crashed
+// publisher. A claim flips status pending → in-flight and stamps claimed_at;
+// the claim path then only SELECTs status='pending', so if the process dies
+// between the claim and _markPublished/_markRetry/_markDead, the row sits
+// in-flight forever — silently dropped, violating the at-least-once delivery
+// the module header advertises (b.queue has a sweepExpired reaper; outbox had
+// none). The fix reaps any in-flight row whose claim is older than the lease
+// (or predates the claimed_at column) back to 'pending' at the top of every
+// poll.
+//
+// Driven against a REAL node:sqlite backend (a faithful externalDb), so the
+// claim / reap / publish SQL actually executes. RED on the buggy tree: the
+// stranded row is never published. GREEN after the fix: the reaper returns it
+// to the pending pool and it publishes on the next poll.
+
+var { DatabaseSync } = require("node:sqlite");
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var C     = b.constants;
+
+// Minimal faithful externalDb over an in-memory node:sqlite db: implements
+// query(sql, params) + transaction(fn) + dialect, converting JS Date params
+// to ISO strings the way the framework's real sqlite provider does.
+function _sqliteExternalDb() {
+  var db = new DatabaseSync(":memory:");
+  function _bind(params) {
+    return (params || []).map(function (v) {
+      if (v instanceof Date) return v.toISOString();
+      return v;
+    });
+  }
+  function _query(sqlText, params) {
+    var stmt = db.prepare(sqlText);
+    var args = _bind(params);
+    if (/^\s*select/i.test(sqlText)) {
+      return { rows: stmt.all.apply(stmt, args) };
+    }
+    var info = stmt.run.apply(stmt, args);
+    return { rows: [], changes: info.changes };
+  }
+  var xdb = {
+    dialect: "sqlite",
+    query: async function (s, p) { return _query(s, p); },
+  };
+  return {
+    dialect: "sqlite",
+    query: async function (s, p) { return _query(s, p); },
+    transaction: async function (fn) {
+      db.exec("BEGIN");
+      try { var r = await fn(xdb); db.exec("COMMIT"); return r; }
+      catch (e) { try { db.exec("ROLLBACK"); } catch (_e) {} throw e; }
+    },
+    _raw: db,
+  };
+}
+
+async function run() {
+  var xdb = _sqliteExternalDb();
+  var published = [];
+  var outbox = b.outbox.create({
+    externalDb:     xdb,
+    table:          "test_outbox",
+    publisher:      async function (event) { published.push(event); },
+    pollIntervalMs: C.TIME.seconds(1),
+    claimReclaimMs: C.TIME.seconds(1),   // short lease so a 10s-old claim is stale
+    audit:          false,
+  });
+  await outbox.declareSchema();
+
+  // enqueue is transactional (the outbox pattern — written in the same txn as
+  // the domain row); wrap each in a transaction and hand it the txClient.
+  function _enqueue(event) {
+    return xdb.transaction(async function (tx) { await outbox.enqueue(event, tx); });
+  }
+
+  // ---- the crash: a row claimed (in-flight) but never published ----
+  await _enqueue({ topic: "orders", payload: { id: "o-1" } });
+  check("#128 the enqueued row starts pending", (await outbox.pendingCount()) === 1);
+
+  // Simulate a publisher that claimed the row then died: flip it to in-flight
+  // with a claim timestamp older than the lease.
+  var staleClaim = new Date(Date.now() - C.TIME.seconds(10)).toISOString();
+  xdb._raw.prepare(
+    "UPDATE \"test_outbox\" SET status = 'in-flight', claimed_at = ? WHERE topic = 'orders'"
+  ).run(staleClaim);
+  check("#128 the stranded row is no longer in the pending pool",
+        (await outbox.pendingCount()) === 0);
+  check("#128 nothing has been published yet", published.length === 0);
+
+  // ---- one poll: the reaper must reclaim + the row must publish ----
+  await outbox._processOnce();
+
+  check("#128 the stranded in-flight row is reclaimed and published",
+        published.length === 1 && published[0].topic === "orders");
+  check("#128 no row is left stranded in-flight",
+        Number(xdb._raw.prepare(
+          "SELECT COUNT(*) AS n FROM \"test_outbox\" WHERE status = 'in-flight'").get().n) === 0);
+  check("#128 the published row is marked published",
+        Number(xdb._raw.prepare(
+          "SELECT COUNT(*) AS n FROM \"test_outbox\" WHERE status = 'published'").get().n) === 1);
+  check("#128 deadCount stays 0 (the row was delivered, not dead-lettered)",
+        (await outbox.deadCount()) === 0);
+
+  // ---- a FRESH in-flight claim (within the lease) must NOT be reclaimed ----
+  await _enqueue({ topic: "fresh", payload: { id: "f-1" } });
+  xdb._raw.prepare(
+    "UPDATE \"test_outbox\" SET status = 'in-flight', claimed_at = ? WHERE topic = 'fresh'"
+  ).run(new Date().toISOString());
+  var publishedBefore = published.length;
+  await outbox._processOnce();
+  check("#128 a fresh in-flight claim (within the lease) is NOT reclaimed",
+        Number(xdb._raw.prepare(
+          "SELECT COUNT(*) AS n FROM \"test_outbox\" WHERE topic = 'fresh' AND status = 'in-flight'").get().n) === 1);
+  check("#128 the fresh in-flight row was not re-published",
+        published.length === publishedBefore);
+
+  // ---- a legacy in-flight row (NULL claimed_at) is reclaimed ----
+  await _enqueue({ topic: "legacy", payload: { id: "l-1" } });
+  xdb._raw.prepare(
+    "UPDATE \"test_outbox\" SET status = 'in-flight', claimed_at = NULL WHERE topic = 'legacy'"
+  ).run();
+  await outbox._processOnce();
+  check("#128 a legacy in-flight row (NULL claimed_at) is reclaimed and published",
+        published.some(function (e) { return e.topic === "legacy"; }));
+
+  await outbox.stop();
+  console.log("OK — outbox stale-in-flight reaper tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.stderr.write(String(err && err.stack || err) + "\n"); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/parsers-standalone.test.js

@@ -12,6 +12,9 @@ var EventEmitter = require("events");
 var helpers = require("../helpers");
 var b       = helpers.b;
 var check   = helpers.check;
+// _contentType is the internal Content-Type parameter parser the
+// middleware + standalone helpers share; exposed for tests.
+var _contentType = require("../../lib/middleware/body-parser")._contentType;
 
 function _streamReq(opts) {
   opts = opts || {};
@@ -201,6 +204,83 @@ async function testMiddlewareAndStandaloneShareImpl() {
         JSON.stringify(standalone) === JSON.stringify(middlewareParsed));
 }
 
+// ---- Prototype-pollution defense (CWE-915 / CWE-1321) ----
+//
+// Header/parameter/field names are request-controlled. The parsers build
+// their maps from [key, value] pairs through Object.fromEntries instead
+// of a computed-write (`target[key] = value`) sink, dropping the
+// __proto__ / constructor / prototype names so a hostile name can never
+// reach Object.prototype.
+
+function testContentTypeIgnoresPoisonedParam() {
+  // A Content-Type parameter literally named `__proto__` must not pollute
+  // the prototype chain, and the legitimate boundary/charset must still
+  // parse to the same shape.
+  var ct = _contentType({
+    headers: {
+      "content-type":
+        'multipart/form-data; boundary=----abc; __proto__=evil; charset=utf-8',
+    },
+  });
+  check("content-type: type parsed", ct.type === "multipart/form-data");
+  check("content-type: boundary parsed", ct.params.boundary === "----abc");
+  check("content-type: charset parsed", ct.params.charset === "utf-8");
+  check("content-type: __proto__ param dropped (no own prop)",
+        !Object.prototype.hasOwnProperty.call(ct.params, "__proto__"));
+  check("content-type: Object.prototype not polluted",
+        ({}).evil === undefined && Object.prototype.evil === undefined);
+}
+
+async function testMultipartRefusesPoisonedFieldName() {
+  // A multipart field whose Content-Disposition name is `__proto__` is
+  // refused at the parse boundary (400) and never reaches the field map.
+  var boundary = "----blamejstest" + Date.now();
+  var body = _multipartBody(boundary, [
+    { name: "__proto__", value: '{"polluted":true}' },
+  ]);
+  var req = _streamReq({
+    headers: {
+      "content-type":   "multipart/form-data; boundary=" + boundary,
+      "content-length": String(Buffer.byteLength(body)),
+    },
+    body: body,
+  });
+  var threw = false;
+  try { await b.parsers.multipart(req, { maxBytes: b.constants.BYTES.mib(1), maxFiles: 5 }); }
+  catch (e) { threw = e.code === "body-parser/multipart-poisoned-field"; }
+  check("multipart: __proto__ field name refused with 400", threw);
+  check("multipart: Object.prototype not polluted by field name",
+        ({}).polluted === undefined && Object.prototype.polluted === undefined);
+}
+
+async function testMultipartRepeatedFieldShapeUnchanged() {
+  // Success path: repeated field name → array; single → scalar. The
+  // entries-merge accumulation must produce the same shape the prior
+  // computed-write accumulation did.
+  var boundary = "----blamejstest" + Date.now();
+  var body = _multipartBody(boundary, [
+    { name: "tag", value: "a" },
+    { name: "tag", value: "b" },
+    { name: "tag", value: "c" },
+    { name: "title", value: "solo" },
+  ]);
+  var req = _streamReq({
+    headers: {
+      "content-type":   "multipart/form-data; boundary=" + boundary,
+      "content-length": String(Buffer.byteLength(body)),
+    },
+    body: body,
+  });
+  var result = await b.parsers.multipart(req, { maxBytes: b.constants.BYTES.mib(1), maxFiles: 5 });
+  check("multipart: repeated field collapses to array in order",
+        Array.isArray(result.fields.tag) &&
+        result.fields.tag.length === 3 &&
+        result.fields.tag[0] === "a" &&
+        result.fields.tag[1] === "b" &&
+        result.fields.tag[2] === "c");
+  check("multipart: single field stays scalar", result.fields.title === "solo");
+}
+
 (async function run() {
   await testJsonParsesValidObject();
   await testJsonRefusesOverMaxBytes();
@@ -212,5 +292,8 @@ async function testMiddlewareAndStandaloneShareImpl() {
   await testMultipartEnforcesMaxFiles();
   await testMultipartRefusesBadOpts();
   await testMiddlewareAndStandaloneShareImpl();
+  testContentTypeIgnoresPoisonedParam();
+  await testMultipartRefusesPoisonedFieldName();
+  await testMultipartRepeatedFieldShapeUnchanged();
   console.log("OK — parsers-standalone tests");
 })().catch(function (e) { console.error(e); process.exit(1); });