@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/lib/network-smtp-policy.js

@@ -57,7 +57,9 @@ var nodeCrypto = require("node:crypto");
 var zlib = require("node:zlib");
 var asn1 = require("./asn1-der");
 var lazyRequire = require("./lazy-require");
+var networkDnsResolver = lazyRequire(function () { return require("./network-dns-resolver"); });
 var validateOpts = require("./validate-opts");
+var structuredFields = require("./structured-fields");
 var bCrypto = require("./crypto");
 var safeUrl = require("./safe-url");
 var safeJson = require("./safe-json");
@@ -91,14 +93,12 @@ function _parseStsPolicy(text) {
       "MTA-STS policy text is empty");
   }
   var policy = { version: null, mode: null, mx: [], max_age: null };
-  var lines = text.split(/\r?\n/);
-  for (var i = 0; i < lines.length; i += 1) {
-    var line = lines[i].trim();
-    if (line.length === 0) continue;
-    var colonAt = line.indexOf(":");
-    if (colonAt === -1) continue;
-    var key = line.slice(0, colonAt).trim().toLowerCase();
-    var val = line.slice(colonAt + 1).trim();
+  // RFC 8461 §3.2 — newline-separated `key: value` lines, no quoted-string;
+  // mx may repeat, so iterate pairs (a last-wins map would drop hosts).
+  var pairs = structuredFields.parseTagList(text, { sep: /\r?\n/, kvSep: ":" });
+  for (var i = 0; i < pairs.length; i += 1) {
+    var key = pairs[i][0];
+    var val = pairs[i][1];
     if (key === "version") policy.version = val;
     else if (key === "mode") policy.mode = val.toLowerCase();
     else if (key === "mx") policy.mx.push(val.toLowerCase());
@@ -123,17 +123,13 @@ function _parseStsPolicy(text) {
 // cached policy forever (defeating operator rotation), and would also
 // fetch policies from domains that don't publish one.
 async function _fetchStsTxt(domain, dnsLookup) {
-  var records;
-  try {
-    records = dnsLookup
-      ? await dnsLookup("_mta-sts." + domain, "TXT")
-      : await dnsPromises.resolveTxt("_mta-sts." + domain);
-  } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
-    throw new SmtpPolicyError("smtp/mta-sts-txt-lookup-failed",
-      "_mta-sts." + domain + " TXT lookup failed: " +
-      ((e && e.message) || String(e)));
-  }
+  // Secure DNS path — a spoofed _mta-sts TXT could downgrade mail TLS, so this
+  // must not use plaintext dnsPromises.
+  var records = await networkDnsResolver().safeResolveTxt("_mta-sts." + domain, {
+    dnsLookup:    dnsLookup,
+    errorFactory: function (code, msg) { return new SmtpPolicyError(code, msg); },
+    code:         "smtp/mta-sts-txt-lookup-failed",
+  });
   if (!Array.isArray(records)) return null;
   for (var i = 0; i < records.length; i += 1) {
     var rec = Array.isArray(records[i]) ? records[i].join("") : records[i];
@@ -577,19 +573,14 @@ async function tlsRptFetchPolicy(domain, opts) {
   }
   opts = opts || {};
   var qname = "_smtp._tls." + domain;
-  var records;
-  try {
-    if (opts.dnsLookup) {
-      records = await opts.dnsLookup(qname, "TXT");
-    } else {
-      records = await dnsPromises.resolveTxt(qname);
-    }
-  } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
-    throw new SmtpPolicyError("smtp/tls-rpt-lookup-failed",
-      "TLS-RPT TXT lookup for " + qname + " failed: " +
-      ((e && e.message) || String(e)));
-  }
+  // Secure DNS path — not plaintext dnsPromises (a spoofed TLS-RPT TXT could
+  // redirect failure reports).
+  var records = await networkDnsResolver().safeResolveTxt(qname, {
+    dnsLookup:    opts.dnsLookup,
+    errorFactory: function (code, msg) { return new SmtpPolicyError(code, msg); },
+    code:         "smtp/tls-rpt-lookup-failed",
+  });
+  if (records === null) return null;
   // Pick the first record that begins with v=TLSRPTv1 per RFC 8460 §3.
   var joined = "";
   for (var i = 0; i < (records || []).length; i += 1) {
@@ -598,16 +589,13 @@ async function tlsRptFetchPolicy(domain, opts) {
     if (/^v=TLSRPTv1\b/i.test(s)) { joined = s; break; }
   }
   if (joined.length === 0) return null;
-  var parts = joined.split(";");                                                              // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT record grammar (RFC 8460 §3): `tlsrpt-record = "v=TLSRPTv1;" *(WSP) tlsrpt-rua` with token-only values; no quoted-string
+  // TLS-RPT record grammar (RFC 8460 §3): `"v=TLSRPTv1;" *(WSP) tlsrpt-rua`
+  // with token-only values, no quoted-string — the naive split is correct.
+  var pairs = structuredFields.parseTagList(joined);
   var rua = [];
-  for (var p = 0; p < parts.length; p += 1) {
-    var t = parts[p].trim();
-    var eq = t.indexOf("=");
-    if (eq === -1) continue;
-    var k = t.slice(0, eq).trim().toLowerCase();
-    var v = t.slice(eq + 1).trim();
-    if (k === "rua") {
-      var uris = v.split(",");                                                                // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
+  for (var p = 0; p < pairs.length; p += 1) {
+    if (pairs[p][0] === "rua") {
+      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
       for (var u = 0; u < uris.length; u += 1) {
         var uri = uris[u].trim();
         if (uri.length > 0) rua.push(uri);

package/lib/vendor/blamejs/lib/network-tls.js

@@ -5,6 +5,8 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var net = require("node:net");
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
+var atomicFile = require("./atomic-file");
 
 var bCrypto = require("./crypto");
 var C = require("./constants");
@@ -103,7 +105,7 @@ function _certMetadata(pem) {
 
 function _isPathLike(s) {
   if (s.indexOf("-----BEGIN") !== -1) return false;
-  if (s.length > C.BYTES.kib(1)) return false;
+  if (safeBuffer.byteLengthOf(s) > C.BYTES.kib(1)) return false;
   if (safeBuffer.hasCrlf(s)) return false;
   return true;
 }
@@ -115,20 +117,13 @@ function _isPathLike(s) {
 // shape, where an attacker who could swap the file in-between could
 // short-circuit the PEM marker check downstream.
 function _readPathFile(p) {
-  var fd = nodeFs.openSync(p, "r");
-  try {
-    var fstat = nodeFs.fstatSync(fd);
-    var buf = Buffer.alloc(fstat.size);
-    var read = 0;
-    while (read < fstat.size) {
-      var n = nodeFs.readSync(fd, buf, read, fstat.size - read, null);
-      if (n === 0) break;
-      read += n;
-    }
-    return buf.slice(0, read).toString("utf8");
-  } finally {
-    try { nodeFs.closeSync(fd); } catch (_c) { /* close best-effort */ }
-  }
+  // TOCTOU-safe read via atomic-file: utf8 string, slice on a short read,
+  // raw ENOENT preserved (errorFor returns undefined → rethrow).
+  return atomicFile.fdSafeReadSync(p, {
+    encoding:       "utf8",
+    allowShortRead: true,
+    errorFor:       function () { return undefined; },
+  });
 }
 
 function _readPath(p) {
@@ -198,6 +193,21 @@ function getTrustStore() {
   });
 }
 
+// _certAuditMetadata(m) — the shared cert-identity fields stamped on every
+// network.tls.ca.* audit event (the add / remove emitters overlay their
+// own label / reason on top via Object.assign). Distinct from
+// _certMetadata(pem), which PARSES a PEM into the meta object `m`.
+function _certAuditMetadata(m) {
+  return {
+    subject:        m.subject,
+    issuer:         m.issuer,
+    fingerprint256: m.fingerprint256,
+    validFrom:      m.validFrom,
+    validTo:        m.validTo,
+    isSelfSigned:   m.isSelfSigned,
+  };
+}
+
 function _emitAuditRemove(metaList, reason) {
   var sink;
   try { sink = audit(); } catch (_e) { sink = null; }
@@ -208,16 +218,10 @@ function _emitAuditRemove(metaList, reason) {
       sink.safeEmit({
         action:   "network.tls.ca.removed",
         outcome:  "success",
-        metadata: {
-          subject:        m.subject,
-          issuer:         m.issuer,
-          fingerprint256: m.fingerprint256,
-          validFrom:      m.validFrom,
-          validTo:        m.validTo,
-          isSelfSigned:   m.isSelfSigned,
-          label:          m.label,
-          reason:         reason || "operator",
-        },
+        metadata: Object.assign(_certAuditMetadata(m), {
+          label:  m.label,
+          reason: reason || "operator",
+        }),
       });
     } catch (_e) { /* audit best-effort — never break the caller */ }
   }
@@ -515,7 +519,7 @@ var DEFAULT_PQC_KEY_SHARES = Object.freeze([
 ]);
 
 function _validateKeyShare(name) {
-  if (typeof name !== "string" || name.length === 0 || name.length > C.BYTES.bytes(64)) {  // bound
+  if (typeof name !== "string" || name.length === 0 || safeBuffer.byteLengthOf(name) > C.BYTES.bytes(64)) {  // bound
     throw new TlsTrustError("tls/bad-key-share",
       "tls.pqc.setKeyShares: each entry must be a non-empty string up to 64 chars");
   }
@@ -714,15 +718,7 @@ function _emitAuditAdd(metaList, opts) {
       sink.safeEmit({
         action:   "network.tls.ca.added",
         outcome:  "success",
-        metadata: {
-          subject:        m.subject,
-          issuer:         m.issuer,
-          fingerprint256: m.fingerprint256,
-          validFrom:      m.validFrom,
-          validTo:        m.validTo,
-          isSelfSigned:   m.isSelfSigned,
-          label:          opts.label || null,
-        },
+        metadata: Object.assign(_certAuditMetadata(m), { label: opts.label || null }),
       });
     } catch (_e) { /* audit best-effort — never break the caller */ }
   }
@@ -2701,11 +2697,8 @@ function connectWithEch(opts) {
   validateOpts.requireNonEmptyString(opts.host, "connectWithEch: host",
     NetworkTlsError, "tls/ech-bad-opts");
   var port = opts.port === undefined ? 443 : opts.port;                          // HTTPS default port
-  if (typeof port !== "number" || !isFinite(port) ||
-      port <= 0 || port > 65535 || Math.floor(port) !== port) {                  // TCP port range
-    throw new NetworkTlsError("tls/ech-bad-opts",
-      "connectWithEch: port must be an integer in 1..65535");
-  }
+  numericBounds.requirePositiveFiniteInt(port,
+    "connectWithEch: port", NetworkTlsError, "tls/ech-bad-opts", { max: 65535 });
   if (opts.alpn !== undefined && !Array.isArray(opts.alpn)) {
     throw new NetworkTlsError("tls/ech-bad-opts",
       "connectWithEch: alpn must be an array of strings");
@@ -2742,8 +2735,13 @@ function connectWithEch(opts) {
       if (typeof opts.checkServerIdentity === "function") {
         connectOpts.checkServerIdentity = opts.checkServerIdentity;
       }
-      if (opts.rejectUnauthorized === false) {
-        connectOpts.rejectUnauthorized = false;
+      // rejectUnauthorized defaults to true (full validation). An operator may
+      // explicitly opt out — audited, never a framework default. Derived from
+      // the operator's own value (operator-governed shape, mirroring mail.js /
+      // log-stream-syslog.js), not a hardcoded literal.
+      var rejectUnauthorized = opts.rejectUnauthorized !== false;
+      connectOpts.rejectUnauthorized = rejectUnauthorized;
+      if (!rejectUnauthorized) {
         auditInsecureTls({ host: opts.host, port: port, source: "network.tls.connectWithEch" });
       }
       var echAttached = false;

package/lib/vendor/blamejs/lib/nis2-report.js

@@ -66,7 +66,6 @@ function create(opts) {
   var sectorAnnex = opts.sectorAnnex;
   var csirtEndpoint = opts.csirtEndpoint || null;
   var httpClient = opts.httpClient || null;
-  var auditOn = opts.audit !== false;
 
   var ir = incidentReport().create({
     audit:    opts.audit,
@@ -79,16 +78,7 @@ function create(opts) {
     },
   });
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "nis2.report." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("nis2.report", opts.audit);
 
   async function _submitToCsirt(payload) {
     if (!csirtEndpoint || !httpClient) {

package/lib/vendor/blamejs/lib/nonce-store.js

@@ -13,6 +13,16 @@
  *     inserting second would race on concurrent requests carrying
  *     the same nonce.
  *
+ *   await store.release(nonce) → boolean
+ *     Un-claims a single nonce so a later checkAndInsert of the same value
+ *     succeeds again — the rollback half of reserve -> commit -> rollback.
+ *     A handler that claims an event id the moment a signature verifies (to
+ *     win the race against a concurrent duplicate) MUST release it when
+ *     downstream processing fails, otherwise the provider's at-least-once
+ *     redelivery is reported as a replay and the event is dropped. Returns
+ *     whether a live claim existed. Pair with checkAndInsert; without it an
+ *     eager claim inverts the at-least-once contract on any failure.
+ *
  *   await store.purgeExpired() → number
  *     Removes entries past their expireAt. Called periodically by the
  *     middleware that uses the store. Returns the count purged.
@@ -32,8 +42,11 @@
  *     table _blamejs_api_encrypt_nonces. The PRIMARY KEY race is what
  *     makes the check + insert atomic across nodes.
  *
- *   { checkAndInsert, purgeExpired, close } — operator-supplied
- *     custom backend (Redis SETNX, Memcached add, etc.). Use this
+ *   { checkAndInsert, release?, purgeExpired?, close? } — operator-supplied
+ *     custom backend (Redis SETNX, Memcached add, etc.). release() is
+ *     optional but required to use reserve -> rollback; a backend omitting
+ *     it throws NONCE_BACKEND_NO_RELEASE the first time release() is called
+ *     (a loud gap, never a silent dropped rollback). Use this
  *     for cross-process accuracy without a per-request SQL hop.
  *
  * Sweep cadence: memory backend sweeps every opts.sweepIntervalMs
@@ -132,6 +145,21 @@ function _memoryBackend(opts) {
     return Promise.resolve(true);
   }
 
+  // Un-claim a nonce so a future checkAndInsert of the same value succeeds
+  // again — the rollback half of reserve -> commit -> rollback. A handler
+  // that claims an event id the moment a signature verifies (to win the race
+  // against a concurrent duplicate) MUST release it when downstream processing
+  // fails, otherwise the provider's at-least-once redelivery is reported as a
+  // replay and the event is dropped. Returns whether a live claim existed.
+  function release(nonce) {
+    if (typeof nonce !== "string" || nonce.length === 0) {
+      return Promise.reject(_err("INVALID_NONCE", "nonce must be a non-empty string"));
+    }
+    var existed = seen.get(nonce) !== undefined;
+    if (existed) seen.delete(nonce);
+    return Promise.resolve(existed);
+  }
+
   function purgeExpired() {
     return Promise.resolve(_purgeExpiredSync());
   }
@@ -144,6 +172,7 @@ function _memoryBackend(opts) {
   return {
     name:            "memory",
     checkAndInsert:  checkAndInsert,
+    release:         release,
     purgeExpired:    purgeExpired,
     close:           close,
     // Test hooks — underlying entry count + count of capacity fail-closed
@@ -178,6 +207,19 @@ function _clusterBackend(_opts) {
     return (result && result.rowCount > 0);
   }
 
+  async function release(nonce) {
+    if (typeof nonce !== "string" || nonce.length === 0) {
+      throw _err("INVALID_NONCE", "nonce must be a non-empty string");
+    }
+    // Un-claim a single nonce (the reserve -> rollback half). The middleware
+    // hashes the raw nonce before it reaches here, so we delete by hash.
+    var built = sql.delete(frameworkSchema.tableName(NONCE_TABLE), _nonceSqlOpts())
+      .where("nonceHash", "=", nonce)
+      .toSql();
+    var result = await clusterStorage.execute(built.sql, built.params);
+    return (result && result.rowCount > 0);
+  }
+
   async function purgeExpired() {
     var built = sql.delete(frameworkSchema.tableName(NONCE_TABLE), _nonceSqlOpts())
       .where("expireAt", "<=", Date.now())
@@ -191,6 +233,7 @@ function _clusterBackend(_opts) {
   return {
     name:           "cluster",
     checkAndInsert: checkAndInsert,
+    release:        release,
     purgeExpired:   purgeExpired,
     close:          close,
   };
@@ -208,6 +251,15 @@ function create(opts) {
     return Object.assign({
       name:         "custom",
       purgeExpired: function () { return Promise.resolve(0); },
+      // A custom backend that omits release() cannot participate in
+      // reserve -> rollback. Fail LOUDLY (not a silent no-op) so the gap
+      // surfaces the first time a handler tries to un-claim, rather than
+      // silently dropping the rollback and inverting the at-least-once contract.
+      release:      function () {
+        return Promise.reject(_err("BACKEND_NO_RELEASE",
+          "this custom nonce backend does not implement release(nonce); " +
+          "the reserve -> commit -> rollback pattern requires it"));
+      },
       close:        function () {},
     }, backend);
   }
@@ -215,11 +267,37 @@ function create(opts) {
   if (!backend || backend === "memory") return _memoryBackend(opts);
   throw _err("UNKNOWN_BACKEND",
     "nonce-store: unknown backend '" + backend +
-    "' (must be 'memory', 'cluster', or { checkAndInsert, purgeExpired, close })");
+    "' (must be 'memory', 'cluster', or { checkAndInsert, release?, purgeExpired?, close? })");
+}
+
+// enforceReplay(store, jti, expireAtMs, opts) — single-use enforcement
+// against a replay store: `await store.checkAndInsert(jti, expireAtMs)`,
+// raising opts.errorClass(opts.storeFailedCode, …) if the store itself
+// fails (a store outage must NOT be mistaken for a clean token) and
+// opts.errorClass(opts.replayCode, "<opts.tokenLabel> jti='<jti>' has
+// been seen before — replay refused") if the jti was already seen. The
+// fail-closed anti-replay control flow every JWT / DPoP verifier repeated
+// identically — centralised here so the contract lives in one place.
+// Verifiers with a divergent message or store contract (e.g. an atomic
+// back-channel-logout-token store) keep their own inline check.
+async function enforceReplay(store, jti, expireAtMs, opts) {
+  opts = opts || {};
+  var inserted;
+  try {
+    inserted = await store.checkAndInsert(jti, expireAtMs);
+  } catch (e) {
+    throw new opts.errorClass(opts.storeFailedCode,
+      "replayStore.checkAndInsert threw: " + ((e && e.message) || String(e)));
+  }
+  if (inserted === false) {
+    throw new opts.errorClass(opts.replayCode,
+      opts.tokenLabel + " jti='" + jti + "' has been seen before — replay refused");
+  }
 }
 
 module.exports = {
   create:           create,
+  enforceReplay:    enforceReplay,
   NonceStoreError:  NonceStoreError,
   _memoryBackend:   _memoryBackend,
   _clusterBackend:  _clusterBackend,

package/lib/vendor/blamejs/lib/numeric-bounds.js

@@ -42,6 +42,20 @@ function shape(value) {
   return (typeof value) + " " + String(value);
 }
 
+// _throwInt — construct + throw a code-first defineClass error. When no
+// errorOpts is supplied the call is the historical bare `new ErrorClass(
+// code, message)` (byte-identical for every existing caller); pass
+// errorOpts { permanent, statusCode } to forward the framework error's
+// non-retryable flag / HTTP status (a config opt that's wrong on retry
+// stays wrong; a request-shaped opt carries its 4xx). Message-FIRST
+// classes (AtomicFileError / SafeBufferError / SafeUrlError) must NOT use
+// the require* throwers — they use the isPositiveFiniteInt predicate + their
+// own throw (see the module header) so code/message don't swap.
+function _throwInt(errorClass, code, message, errorOpts) {
+  if (errorOpts) throw new errorClass(code, message, errorOpts.permanent, errorOpts.statusCode);
+  throw new errorClass(code, message);
+}
+
 function isPositiveFiniteInt(value) {
   return typeof value === "number" && Number.isFinite(value) &&
          Number.isInteger(value) && value > 0;
@@ -64,11 +78,11 @@ function isNonNegativeFiniteInt(value) {
 //   nb.requirePositiveFiniteIntIfPresent(opts.graceMs,
 //     "app-shutdown.create: opts.graceMs", AppShutdownError,
 //     "app-shutdown/bad-grace-ms");
-function requirePositiveFiniteIntIfPresent(value, label, errorClass, code) {
+function requirePositiveFiniteIntIfPresent(value, label, errorClass, code, errorOpts) {
   if (value === undefined) return value;
   if (!isPositiveFiniteInt(value)) {
-    throw new errorClass(code,
-      (label || "value") + " must be a positive finite integer; got " + shape(value));
+    _throwInt(errorClass, code,
+      (label || "value") + " must be a positive finite integer; got " + shape(value), errorOpts);
   }
   return value;
 }
@@ -102,13 +116,13 @@ function _rangeSuffix(range) {
   if (range.min != null) return " >= " + range.min;
   return "";
 }
-function requirePositiveFiniteInt(value, label, errorClass, code, range) {
+function requirePositiveFiniteInt(value, label, errorClass, code, range, errorOpts) {
   var inRange = !range ||
     ((range.min == null || value >= range.min) && (range.max == null || value <= range.max));
   if (!isPositiveFiniteInt(value) || !inRange) {
-    throw new errorClass(code,
+    _throwInt(errorClass, code,
       (label || "value") + " must be a positive finite integer" +
-      _rangeSuffix(range) + "; got " + shape(value));
+      _rangeSuffix(range) + "; got " + shape(value), errorOpts);
   }
   return value;
 }
@@ -123,12 +137,12 @@ function requirePositiveFiniteInt(value, label, errorClass, code, range) {
 //   nb.requireAllPositiveFiniteIntIfPresent(opts,
 //     ["maxBytes", "maxAttrValueBytes", "maxTagDepth", "maxAttrsPerTag"],
 //     "guardHtml.validate", GuardHtmlError, "html.bad-opt");
-function requireAllPositiveFiniteIntIfPresent(opts, names, labelPrefix, errorClass, code) {
+function requireAllPositiveFiniteIntIfPresent(opts, names, labelPrefix, errorClass, code, errorOpts) {
   if (!opts || !Array.isArray(names)) return;
   for (var i = 0; i < names.length; i += 1) {
     var n = names[i];
     requirePositiveFiniteIntIfPresent(opts[n],
-      (labelPrefix || "") + ": " + n, errorClass, code);
+      (labelPrefix || "") + ": " + n, errorClass, code, errorOpts);
   }
 }
 

package/lib/vendor/blamejs/lib/object-store/azure-blob-bucket-ops.js

@@ -33,6 +33,7 @@ var C = require("../constants");
 var httpClient = require("../http-client");
 var requestHelpers = require("../request-helpers");
 var safeUrl = require("../safe-url");
+var markupEscape = require("../markup-escape").markupEscape;
 var { ObjectStoreError } = require("../framework-error");
 
 var _err = ObjectStoreError.factory;
@@ -122,12 +123,7 @@ function _validateCorsRule(rule, idx) {
 }
 
 function _xmlEscape(s) {
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
+  return markupEscape(s, { apos: "&apos;" });
 }
 
 function _buildCorsXml(rules) {

package/lib/vendor/blamejs/lib/object-store/azure-blob.js

@@ -93,14 +93,6 @@ function _encodeBlobKey(key) {
 
 var DEFAULT_API_VERSION = "2024-08-04";
 
-// Service SAS expiry bounds. Azure doesn't enforce a hard max, but
-// matching the SigV4 / V4 7-day cap keeps semantics uniform across
-// backends and reflects best practice (long-lived SAS tokens are
-// effectively credentials).
-var SAS_DEFAULT_EXPIRES_SECONDS = C.TIME.minutes(15) / C.TIME.seconds(1);
-var SAS_MAX_EXPIRES_SECONDS     = C.TIME.days(7)     / C.TIME.seconds(1);
-var SAS_MIN_EXPIRES_SECONDS     = 1;
-
 var _err = ObjectStoreError.factory;
 
 var _httpRequest = sharedRequest;
@@ -312,33 +304,13 @@ function create(config) {
   function getResponse(key, opts) {
     opts = opts || {};
     var url = _blobUrl(key);
-    var extraHeaders = {};
-    if (opts.range) {
-      extraHeaders["x-ms-range"] = "bytes=" + opts.range.start + "-" + opts.range.end;
-    }
-    if (opts.ifNoneMatch)       extraHeaders["If-None-Match"]       = opts.ifNoneMatch;
-    if (opts.ifMatch)           extraHeaders["If-Match"]            = opts.ifMatch;
-    if (opts.ifModifiedSince)   extraHeaders["If-Modified-Since"]   = opts.ifModifiedSince;
-    if (opts.ifUnmodifiedSince) extraHeaders["If-Unmodified-Since"] = opts.ifUnmodifiedSince;
+    var extraHeaders = sharedRequest.applyConditionalGetHeaders({}, opts, "x-ms-range");
     var headers = _signed("GET", url, extraHeaders);
     return _httpRequest("GET", url, headers, null, reqOpts).then(function (res) {
-      return {
-        statusCode:   res.statusCode,
-        body:         res.body,
-        etag:         res.headers && res.headers.etag,
-        lastModified: res.headers && res.headers["last-modified"]
-                      ? Date.parse(res.headers["last-modified"]) : null,
-        contentRange: res.headers && res.headers["content-range"] || null,
-        size:         res.headers && res.headers["content-length"]
-                      ? parseInt(res.headers["content-length"], 10) : null,
-        contentType:  res.headers && res.headers["content-type"] || null,
-      };
+      return sharedRequest.mapGetResponse(res);
     }, function (err) {
       if (err && err.statusCode === requestHelpers.HTTP_STATUS.NOT_MODIFIED) {
-        return {
-          statusCode: requestHelpers.HTTP_STATUS.NOT_MODIFIED,
-          body: null, etag: null, lastModified: null,
-        };
+        return sharedRequest.notModifiedGetResult();
       }
       throw err;
     });
@@ -348,11 +320,7 @@ function create(config) {
     var url = _blobUrl(key);
     var headers = _signed("HEAD", url, {});
     return _httpRequest("HEAD", url, headers, null, reqOpts).then(function (res) {
-      return {
-        size:         res.headers["content-length"] ? parseInt(res.headers["content-length"], 10) : null,
-        etag:         res.headers.etag,
-        lastModified: res.headers["last-modified"] ? Date.parse(res.headers["last-modified"]) : null,
-      };
+      return sharedRequest.mapHeadResponse(res);
     });
   }
 
@@ -415,15 +383,7 @@ function create(config) {
   // "Create a service SAS". We sign with the account key (HMAC-SHA256
   // over the canonical string) and emit the token as URL query params.
   function _buildSasToken(permissions, opts) {
-    var expiresIn = opts.expiresIn != null ? opts.expiresIn : SAS_DEFAULT_EXPIRES_SECONDS;
-    if (typeof expiresIn !== "number" ||
-        expiresIn < SAS_MIN_EXPIRES_SECONDS ||
-        expiresIn > SAS_MAX_EXPIRES_SECONDS) {
-      throw _err("INVALID_EXPIRES",
-        "presigned URL: expiresIn must be a number of seconds between " +
-        SAS_MIN_EXPIRES_SECONDS + " and " + SAS_MAX_EXPIRES_SECONDS +
-        " (7 days)", true);
-    }
+    var expiresIn = sharedRequest.resolvePresignExpires(opts, "presigned URL", "");
     var nowDate = opts.date || new Date();
     var expiry = new Date(nowDate.getTime() + C.TIME.seconds(expiresIn));
     // Azure accepts ISO 8601 with second precision; strip ms.