@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/lib/guard-shell.js

@@ -41,11 +41,9 @@
  *   Shell-argument content-safety guard — refuses user-supplied strings that carry shell-injection shapes BEFORE they reach a child-process spawn.
  */
 
-var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardShellError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -76,10 +74,7 @@ var NEWLINE_RE = /[\r\n]/;
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:           "reject",
-    controlPolicy:         "reject",
-    nullBytePolicy:        "reject",
-    zeroWidthPolicy:       "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     posixMetaPolicy:       "reject",
     cmdMetaPolicy:         "reject",
     dollarSubstPolicy:     "reject",
@@ -91,10 +86,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:          C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:           "reject",
-    controlPolicy:         "reject",
-    nullBytePolicy:        "reject",
-    zeroWidthPolicy:       "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     posixMetaPolicy:       "audit",
     cmdMetaPolicy:         "audit",
     dollarSubstPolicy:     "reject",
@@ -106,10 +98,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:          C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:           "reject",                                              // BIDI refused at every profile
-    controlPolicy:         "reject",                                              // controls refused at every profile
-    nullBytePolicy:        "reject",                                              // null refused at every profile
-    zeroWidthPolicy:       "reject",                                              // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     posixMetaPolicy:       "audit",
     cmdMetaPolicy:         "audit",
     dollarSubstPolicy:     "reject",                                              // command substitution refused at every profile
@@ -122,54 +111,14 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
+var DEFAULTS = gateContract.strictDefaults(PROFILES);
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardShellError,
-    errCodePrefix:      "shell",
-  });
-}
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              ruleId: "shell.bad-input",
-              snippet: "shell arg is not a string" }];
-  }
-  if (input.length === 0) {
-    // Empty arg is not necessarily a threat (legit blank args exist).
-    return [];
-  }
-  if (Buffer.byteLength(input, "utf8") > opts.maxBytes) {
-    return [{ kind: "shell-cap", severity: "high",
-              ruleId: "shell.shell-cap",
-              snippet: "shell arg exceeds maxBytes " + opts.maxBytes }];
-  }
-
-  var charThreats = codepointClass.detectCharThreats(input, opts, "shell");
-  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+  var pre = gateContract.detectStringInput(input, opts, { name: "shell", noun: "shell arg", emptyMode: "ok", cap: { bytes: opts.maxBytes, snippet: "shell arg exceeds maxBytes " + opts.maxBytes } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // $(...) / ${...} / backtick — universal refuse.
   if (opts.dollarSubstPolicy !== "allow" &&
@@ -285,13 +234,10 @@ function _detectIssues(input, opts) {
  *   hostile.ok;                                        // → false
  *   hostile.issues.some(function (i) { return i.kind === "posix-metachar"; });  // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes"],
-    "guardShell.validate", GuardShellError, "shell.bad-opt");
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the maxBytes cap declared via `intOpts`.
+// The @primitive block above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardShell.sanitize
@@ -334,17 +280,11 @@ function validate(input, opts) {
  *     e.code;                                          // → "shell.posix-metachar"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("shell.bad-input", "sanitize requires string input");
-  }
-  // Shell args can't be repaired — sanitize either passes through
-  // valid input or throws.
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, {
-    errorClass: GuardShellError, codePrefix: "shell",
-  });
+// _sanitizeTransform — the guard-specific normalize applied by defineGuard's
+// generated sanitize AFTER resolve → detect → throw-on-refusal. Shell args
+// cannot be repaired, so the transform is pass-through: an already-validated
+// clean string is returned unchanged (a hostile string refuses upstream).
+function _sanitizeTransform(input) {
   return input;
 }
 
@@ -364,14 +304,8 @@ function sanitize(input, opts) {
 // in gate-contract.js, instantiated per guard by the page generator.
 
 // ---- adaptive integration-test fixtures (consumed by layer-5 host harness) ----
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:              "identifier",
-  benignBytes:       Buffer.from("safe-arg-value", "utf8"),
-  hostileBytes:      Buffer.from("safe; rm -rf /", "utf8"),
-  benignIdentifier:  "safe-arg-value",
-  // Hostile: command-injection via metacharacter chain.
-  hostileIdentifier: "safe; rm -rf /",
-});
+// Hostile: command-injection via metacharacter chain.
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures("safe-arg-value", "safe; rm -rf /");
 
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
@@ -386,7 +320,8 @@ module.exports = gateContract.defineGuard({
   defaults:    DEFAULTS,
   postures:    COMPLIANCE_POSTURES,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:           _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:          ["maxBytes"],
   ctxFields:   ["identifier", "arg"],
 });

package/lib/vendor/blamejs/lib/guard-smtp-command.js

@@ -89,6 +89,7 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract    = require("./gate-contract");
+var codepointClass  = require("./codepoint-class");
 
 var GuardSmtpCommandError = defineClass("GuardSmtpCommandError", { alwaysPermanent: true });
 
@@ -196,7 +197,7 @@ function validate(line, opts) {
     // so the documented allowBareLf path actually accepts LF (Codex
     // caught this: permissive profile was effectively broken).
     if (c === 0x0a && caps.allowBareLf) continue;                                                                                                                                                            // RFC 5321 §2.3.8 LF, permissive bypass
-    if (c < 0x20 || c === 0x7f) {                                                                                                                                                                          // RFC 5321 §2.3.8 forbids C0 / DEL
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true })) {                                                                                                                                                                          // RFC 5321 §2.3.8 forbids C0 / DEL
       throw new GuardSmtpCommandError("guard-smtp-command/control-char",
         "guardSmtpCommand.validate: control char 0x" + c.toString(16) + " refused");
     }
@@ -550,16 +551,12 @@ function detectBodySmuggling(buf) {
   return false;
 }
 
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:        "identifier",
-  // Benign: standard EHLO greeting.
-  benignBytes: Buffer.from("EHLO mail.example.com", "ascii"),
-  // Hostile: CRLF smuggling attempt — bare CR inside a command line
-  // (CVE-2023-51764 / 51765 / 51766 class).
-  hostileBytes: Buffer.from("MAIL FROM:<a@b.com>\r\n.\r\nMAIL FROM:<evil@x.com>", "ascii"),
-  benignIdentifier:  "EHLO mail.example.com",
-  hostileIdentifier: "MAIL FROM:<a@b.com>\r\n.\r\nMAIL FROM:<evil@x.com>",
-});
+// Benign: standard EHLO greeting.
+// Hostile: CRLF smuggling attempt — bare CR inside a command line
+// (CVE-2023-51764 / 51765 / 51766 class).
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures(
+  "EHLO mail.example.com",
+  "MAIL FROM:<a@b.com>\r\n.\r\nMAIL FROM:<evil@x.com>", "ascii");
 
 // Assembled from the gate-contract parser factory: error class,
 // compliancePosture wiring, PROFILES / COMPLIANCE_POSTURES, the `validate`

package/lib/vendor/blamejs/lib/guard-sql.js

@@ -140,6 +140,7 @@
  */
 
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
 var safeSql      = require("./safe-sql");
 var C            = require("./constants");
 var bCrypto      = require("./crypto");
@@ -459,15 +460,14 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES.strict, {
-  mode:         "enforce",
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
   contextMode:  DEFAULT_CONTEXT_MODE,
   maxBytes:     C.BYTES.bytes(1048576),                                 // 1 MiB raw-SQL cap
   maxRuntimeMs: C.TIME.seconds(5),
   // gdprRedact controls whether the audited fragment body is replaced
   // by a salted hash fingerprint (set by the gdpr posture overlay).
   gdprRedact:   false,
-}));
+});
 
 // All four postures map to the strict floor — a regulated deployment
 // gets the tightest raw-SQL gate regardless of which framework it cites.
@@ -1197,7 +1197,7 @@ function _identifierHazard(ident) {
   // rest are reported by code point.
   for (var k = 0; k < ident.length; k += 1) {
     var c = ident.charCodeAt(k);
-    if (c < 0x20 || c === 0x7f) {
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true })) {
       return c === 0 ? "contains a null byte"
                      : "contains a control byte 0x" + c.toString(16);
     }
@@ -1267,9 +1267,11 @@ function _identifierHazard(ident) {
 function validate(input, opts) {
   opts = _resolveOpts(opts);
   var contextMode = _resolveContextMode(opts);
-  var bad = gateContract.badInputResultIfNotStringOrBuffer(input);
-  if (bad) return bad;
-  return gateContract.aggregateIssues(_inspect(input, opts, contextMode));
+  // "bytes" contract — accept string/Buffer and pass it RAW: _inspect runs an
+  // encoding gate on raw bytes before any decode, so coercing to text first
+  // would hide the very bytes it checks. The closure binds contextMode.
+  return gateContract.runIssueValidator(input, opts,
+    function (subject, o) { return _inspect(subject, o, contextMode); }, "bytes");
 }
 
 /**
@@ -1408,11 +1410,10 @@ function _emitDecisionAudit(sql, issues, opts, contextMode, ctx) {
     var refused = _firstRefusal(issues) !== null;
     var text = Buffer.isBuffer(sql) ? sql.toString("utf8") : String(sql);
     var body = opts.gdprRedact ? _fingerprint(text) : _truncateForAudit(text);
-    audit().safeEmit({
-      action:  "guardSql.gate." + (refused ? "refused" : (issues.length > 0 ? "audited" : "served")),
-      actor:   ctx && ctx.actor,
-      outcome: refused ? "denied" : "success",
-      metadata: {
+    audit().namespaced("guardSql.gate")(
+      refused ? "refused" : (issues.length > 0 ? "audited" : "served"),
+      refused ? "denied" : "success",
+      {
         contextMode: contextMode,
         profile:     opts.profile || "strict",
         route:       ctx && ctx.route,
@@ -1420,7 +1421,8 @@ function _emitDecisionAudit(sql, issues, opts, contextMode, ctx) {
         sqlRedacted: !!opts.gdprRedact,
         issues:      gateContract.summarizeIssues(issues),
       },
-    });
+      { actor: ctx && ctx.actor }
+    );
   } catch (_e) { /* drop-silent — audit sinks must never crash the producer */ }
 }
 

package/lib/vendor/blamejs/lib/guard-stream-args.js

@@ -21,6 +21,7 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var pick = require("./pick");
 
 var GuardStreamArgsError = defineClass("GuardStreamArgsError", { alwaysPermanent: true });
 
@@ -122,7 +123,7 @@ function _checkCursorOpts(cursorOpts, depth) {
   }
   var keys = Object.keys(cursorOpts);
   for (var k = 0; k < keys.length; k += 1) {
-    if (keys[k] === "__proto__" || keys[k] === "constructor" || keys[k] === "prototype") {
+    if (pick.isPoisonedKey(keys[k])) {
       throw new GuardStreamArgsError("stream-args/proto-key",
         "guardStreamArgs.validate: forbidden key '" + keys[k] + "' in cursorOpts");
     }