@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/test/layer-0-primitives/guard-json.test.js

@@ -203,6 +203,40 @@ function testGuardJsonStringLengthCap() {
         rv.issues.some(function (i) { return i.kind === "string-too-long"; }));
 }
 
+function testGuardJsonByteCap() {
+  // maxBytes is a BYTE cap — multibyte input must be measured by UTF-8
+  // byte length, not UTF-16 code-unit count (.length). "é" is one code
+  // unit but two bytes, so a string under the char count can still
+  // exceed the byte cap.
+  var inner = "é".repeat(25);
+  var s     = JSON.stringify(inner);               // .length ~27, bytes ~52
+  var byteLen = Buffer.byteLength(s, "utf8");
+  // Cap sits between the code-unit count and the byte length so a
+  // char-length check would (wrongly) pass while a byte check refuses.
+  var cap = s.length + 5;
+  check("byte-cap fixture: bytes exceed cap but code units do not",
+        byteLen > cap && s.length <= cap);
+  var rv = b.guardJson.validate(s, { maxBytes: cap });
+  check("multibyte input over the byte cap is refused (too-large by bytes)",
+        rv.issues.some(function (i) {
+          return i.kind === "too-large" && i.ruleId === "json.too-large";
+        }));
+
+  // ASCII inputs (one byte per code unit) are unaffected — a byte-length
+  // cap that exactly admits the string must still pass.
+  var ascii = '"' + "x".repeat(20) + '"';           // 22 bytes, 22 code units
+  var rvAscii = b.guardJson.validate(ascii, { maxBytes: 64 });
+  check("ASCII input within the byte cap is not flagged too-large",
+        !rvAscii.issues.some(function (i) { return i.kind === "too-large"; }));
+
+  // Non-string input keeps the bad-input shape and now carries a ruleId.
+  var rvBad = b.guardJson.validate(12345, { maxBytes: 64 });
+  check("non-string input → bad-input with json.bad-input ruleId",
+        rvBad.issues.some(function (i) {
+          return i.kind === "bad-input" && i.ruleId === "json.bad-input";
+        }));
+}
+
 function testGuardJsonNumericPrecision() {
   var rv = b.guardJson.validate('{"id":99999999999999999999}', { profile: "strict" });
   check("numeric precision-loss detected (above MAX_SAFE_INTEGER)",
@@ -267,6 +301,24 @@ async function testGuardJsonGate() {
         hostile.action !== "serve");
 }
 
+async function testGuardJsonGateSanitizeByPolicy() {
+  // The gate decides sanitize-vs-refuse from the finding's OWN policy, not a
+  // global "is any policy reject?" guess that wrongly blocked sanitize for
+  // unrelated findings. So the SAME __proto__ input REFUSES under
+  // pollutionPolicy=reject and SANITIZES under pollutionPolicy=strip (the
+  // parse drops __proto__) — independent of the other policies' reject state.
+  var pollute = Buffer.from('{"__proto__":{"x":1},"keep":2}', "utf8");
+  var reject = await b.guardJson.gate({ profile: "strict", pollutionPolicy: "reject" })
+    .check({ bytes: pollute });
+  check("pollutionPolicy=reject → refuse", reject.action === "refuse");
+  var strip = await b.guardJson.gate({ profile: "strict", pollutionPolicy: "strip" })
+    .check({ bytes: pollute });
+  check("pollutionPolicy=strip → sanitize (__proto__ dropped per policy)",
+        strip.action === "sanitize" &&
+        strip.sanitized.toString("utf8").indexOf("__proto__") === -1 &&
+        strip.sanitized.toString("utf8").indexOf("keep") !== -1);
+}
+
 function testGuardJsonCompliancePosture() {
   var hipaa = b.guardJson.compliancePosture("hipaa");
   check("compliancePosture('hipaa') sets reject policies",
@@ -304,6 +356,7 @@ async function run() {
   testGuardJsonKeyCountCap();
   testGuardJsonArrayLengthCap();
   testGuardJsonStringLengthCap();
+  testGuardJsonByteCap();
   testGuardJsonNumericPrecision();
   testGuardJsonTopLevelKeyAllowlist();
   testGuardJsonBidi();
@@ -312,6 +365,7 @@ async function run() {
   testGuardJsonCompliancePosture();
   testGuardJsonBadProfile();
   await testGuardJsonGate();
+  await testGuardJsonGateSanitizeByPolicy();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/guard-managesieve-command.test.js

@@ -278,7 +278,17 @@ function testBSurface() {
                                                                typeof b.guardManageSieveCommand.GuardManageSieveCommandError === "function");
 }
 
+function testByteCapMultibyte() {
+  // maxLineBytes is a BYTE cap (regression for byte-cap-vs-char-length).
+  var line = String.fromCharCode(0x4e2d).repeat(2731); // 8193 UTF-8 bytes; strict cap 8192
+  var threw = null;
+  try { guardManageSieveCommand.validate(line, { profile: "strict" }); } catch (e) { threw = e; }
+  check("managesieve byte-cap: oversize multibyte line refused as line-too-long",
+    threw && threw.code === "guard-managesieve-command/line-too-long");
+}
+
 function run() {
+  testByteCapMultibyte();
   testBSurface();
   testSurface();
   testHappyPath();

package/lib/vendor/blamejs/test/layer-0-primitives/guard-markdown.test.js

@@ -199,6 +199,35 @@ function testGuardMarkdownBlockquoteDepthCap() {
         rv.issues.some(function (i) { return i.kind === "blockquote-depth-cap"; }));
 }
 
+function testGuardMarkdownByteCap() {
+  // maxBytes is a BYTE limit. A multibyte string can stay under the cap by
+  // UTF-16 code-unit count (.length) while its UTF-8 encoding blows past it,
+  // so the cap must measure Buffer.byteLength, never .length. "é" (U+00E9)
+  // is 1 code unit but 2 UTF-8 bytes: 8 of them = .length 8 (under a 10-byte
+  // cap by char count) yet 16 bytes (over it).
+  var multibyte = "é".repeat(8);
+  check("multibyte input is 8 UTF-16 units but 16 UTF-8 bytes",
+        multibyte.length === 8 && Buffer.byteLength(multibyte, "utf8") === 16);
+
+  var rvOver = b.guardMarkdown.validate(multibyte, { maxBytes: 10 });
+  var cap = rvOver.issues.filter(function (i) { return i.kind === "too-large"; });
+  check("multibyte over the BYTE cap fires too-large (not char-count-gated)",
+        cap.length === 1);
+  check("too-large snippet reports the BYTE length, not the char count",
+        cap.length === 1 && /16 bytes exceeds maxBytes 10/.test(cap[0].snippet));
+  check("too-large carries ruleId markdown.too-large",
+        cap.length === 1 && cap[0].ruleId === "markdown.too-large");
+
+  // ASCII is unaffected: byte length equals char length, so the cap behaves
+  // identically before and after the fix.
+  var rvAsciiUnder = b.guardMarkdown.validate("aaaaaaaa", { maxBytes: 10 });
+  check("ASCII under the byte cap → no too-large",
+        !rvAsciiUnder.issues.some(function (i) { return i.kind === "too-large"; }));
+  var rvAsciiOver = b.guardMarkdown.validate("aaaaaaaaaaaaaaaa", { maxBytes: 10 });
+  check("ASCII over the byte cap → too-large still fires",
+        rvAsciiOver.issues.some(function (i) { return i.kind === "too-large"; }));
+}
+
 function testGuardMarkdownSanitizeRefusesCritical() {
   var threw = null;
   try { b.guardMarkdown.sanitize(
@@ -208,6 +237,20 @@ function testGuardMarkdownSanitizeRefusesCritical() {
         threw && /scheme|refused/.test(threw.code || threw.message || ""));
 }
 
+function testGuardMarkdownSanitizeRefusesBadInput() {
+  // A non-string/Buffer sanitize input is unprocessable — it must throw a typed
+  // markdown.bad-input, NEVER silently return the garbage. (sanitizeSeverities
+  // is ["critical"], so the high-severity bad-input issue is not a content
+  // refusal; the generated sanitize refuses a `bad-input` KIND unconditionally.)
+  [123, null, {}, [1, 2, 3], true].forEach(function (bad) {
+    var threw = null;
+    try { b.guardMarkdown.sanitize(bad, { profile: "strict" }); }
+    catch (e) { threw = e; }
+    check("sanitize(" + JSON.stringify(bad) + ") throws markdown.bad-input (no silent pass)",
+          threw && threw.code === "markdown.bad-input");
+  });
+}
+
 async function testGuardMarkdownGate() {
   var g = b.guardMarkdown.gate({ profile: "strict" });
   var clean = await g.check({
@@ -257,7 +300,9 @@ async function run() {
   testGuardMarkdownLinkCap();
   testGuardMarkdownListDepthCap();
   testGuardMarkdownBlockquoteDepthCap();
+  testGuardMarkdownByteCap();
   testGuardMarkdownSanitizeRefusesCritical();
+  testGuardMarkdownSanitizeRefusesBadInput();
   testGuardMarkdownCompliancePosture();
   await testGuardMarkdownGate();
 }

package/lib/vendor/blamejs/test/layer-0-primitives/guard-pdf.test.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * guard-pdf — PDF content-safety primitive (b.guardPdf).
+ *
+ * Covers: surface; registry parity; magic-byte / declared-MIME mismatch;
+ * polyglot; JavaScript / Launch / OpenAction active-content detection;
+ * embedded files; encryption; inspectMagic; and the disarm-by-refusal
+ * sanitize — PDF active content lives in a cross-referenced object graph
+ * that cannot be excised without a vendored parser, so sanitize forces every
+ * active-content / exfil / encryption policy to reject and refuses anything
+ * it cannot disarm rather than passing a live action through.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+var _PDF = Buffer.from([0x25, 0x50, 0x44, 0x46, 0x2D]);                           // %PDF-
+function _code(fn) { try { fn(); return null; } catch (e) { return e && e.code; } }
+
+function testGuardPdfSurface() {
+  check("guardPdf is an object",                typeof b.guardPdf === "object");
+  check("guardPdf.NAME === 'pdf'",              b.guardPdf.NAME === "pdf");
+  check("guardPdf.PROFILES has strict",         !!b.guardPdf.PROFILES["strict"]);
+  check("guardPdf.COMPLIANCE_POSTURES hipaa",   !!b.guardPdf.COMPLIANCE_POSTURES["hipaa"]);
+  check("guardPdf.validate is a function",      typeof b.guardPdf.validate === "function");
+  check("guardPdf.sanitize is a function",      typeof b.guardPdf.sanitize === "function");
+  check("guardPdf.gate is a function",          typeof b.guardPdf.gate === "function");
+  check("frameworkError.GuardPdfError exposed", typeof b.frameworkError.GuardPdfError === "function");
+}
+
+function testGuardPdfRegistryParity() {
+  check("guardPdf registered in guardAll",
+    b.guardAll.allGuards().some(function (g) { return (g.name || g.NAME) === "pdf"; }));
+}
+
+function testValidateActiveContent() {
+  var rv = b.guardPdf.validate({ bytes: _PDF, hasJavaScript: true }, { profile: "strict" });
+  check("javascript: validate ok:false", rv.ok === false);
+  check("javascript: kind reported", rv.issues.some(function (i) { return i.kind === "javascript-action"; }));
+}
+
+// ---- disarm-by-refusal sanitize ----
+
+function testSanitizeInertPassthrough() {
+  var inert = { bytes: _PDF };
+  var out = b.guardPdf.sanitize(inert, { profile: "balanced" });
+  check("inert PDF passes through unchanged", out === inert);
+}
+
+function testSanitizeRefusesJavaScript() {
+  check("javascript refused",
+    _code(function () { b.guardPdf.sanitize({ bytes: _PDF, hasJavaScript: true }, { profile: "balanced" }); }) === "pdf.javascript-action");
+}
+
+function testSanitizeRefusesLaunch() {
+  check("launch refused",
+    _code(function () { b.guardPdf.sanitize({ bytes: _PDF, hasLaunchAction: true }, { profile: "balanced" }); }) === "pdf.launch-action");
+}
+
+function testSanitizeForcesOpenActionReject() {
+  // open-action is warn-level under permissive at the gate, but sanitize forces
+  // reject (it cannot strip the action) → refuse, never a silent passthrough.
+  check("open-action refused under sanitize even at permissive",
+    _code(function () { b.guardPdf.sanitize({ bytes: _PDF, hasOpenAction: true }, { profile: "permissive" }); }) === "pdf.open-action");
+}
+
+function testSanitizeForcesEmbeddedFileReject() {
+  check("embedded-file refused under sanitize even at permissive",
+    _code(function () { b.guardPdf.sanitize({ bytes: _PDF, hasEmbeddedFiles: true }, { profile: "permissive" }); }) === "pdf.embedded-file");
+}
+
+function testSanitizeForcesEncryptedReject() {
+  check("encrypted refused under sanitize even at permissive",
+    _code(function () { b.guardPdf.sanitize({ bytes: _PDF, isEncrypted: true }, { profile: "permissive" }); }) === "pdf.encrypted");
+}
+
+function testSanitizeBadInput() {
+  check("bad input refused",
+    _code(function () { b.guardPdf.sanitize(null, { profile: "balanced" }); }) === "pdf.bad-input");
+}
+
+function run() {
+  testGuardPdfSurface();
+  testGuardPdfRegistryParity();
+  testValidateActiveContent();
+  testSanitizeInertPassthrough();
+  testSanitizeRefusesJavaScript();
+  testSanitizeRefusesLaunch();
+  testSanitizeForcesOpenActionReject();
+  testSanitizeForcesEmbeddedFileReject();
+  testSanitizeForcesEncryptedReject();
+  testSanitizeBadInput();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("[guard-pdf] OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/guard-pop3-command.test.js

@@ -143,7 +143,25 @@ function testCompliancePosture() {
   check("posture: unknown → null",   b.guardPop3Command.compliancePosture("nope") === null);
 }
 
+function testByteCapMultibyte() {
+  // maxLineBytes / maxUsernameBytes / maxPasswordBytes are BYTE caps.
+  var mb = String.fromCharCode(0x4e2d); // one 3-byte UTF-8 char
+  var t1 = null;
+  try { b.guardPop3Command.validate(mb.repeat(100), { profile: "strict", tls: true }); } catch (e) { t1 = e; }
+  check("pop3 byte-cap: oversize multibyte line refused as line-too-long",
+    t1 && t1.code === "guard-pop3-command/line-too-long");
+  var t2 = null;
+  try { b.guardPop3Command.validate("USER " + mb.repeat(40), { profile: "strict", tls: true }); } catch (e) { t2 = e; }
+  check("pop3 byte-cap: oversize multibyte USER name refused",
+    t2 && t2.code === "guard-pop3-command/username-too-long");
+  var t3 = null;
+  try { b.guardPop3Command.validate("PASS " + mb.repeat(40), { profile: "strict", tls: true }); } catch (e) { t3 = e; }
+  check("pop3 byte-cap: oversize multibyte PASS argument refused",
+    t3 && t3.code === "guard-pop3-command/password-too-long");
+}
+
 function run() {
+  testByteCapMultibyte();
   testSurface();
   testHappyPath();
   testCleartextAuthRefused();

package/lib/vendor/blamejs/test/layer-0-primitives/guard-svg.test.js

@@ -203,6 +203,53 @@ function testGuardSvgCaps() {
         rv.issues.some(function (issue) { return issue.kind === "use-depth-cap"; }));
 }
 
+function testGuardSvgByteCapsMeasureBytes() {
+  // Caps named in *Bytes must measure UTF-8 bytes, not UTF-16 code units.
+  // "é" is one code unit (.length 1) but two UTF-8 bytes. A 50-char run is
+  // 50 code units / 100 bytes — under a 60 char-count but over a 60-byte cap.
+  var multibyte = "é".repeat(50);
+  check("multibyte fixture: 50 code units, 100 UTF-8 bytes",
+        multibyte.length === 50 && Buffer.byteLength(multibyte, "utf8") === 100);
+
+  // Top-level maxBytes (validate path → tokenizer cap).
+  var rvSize = b.guardSvg.validate(multibyte, { profile: "strict", maxBytes: 60 });
+  check("validate: multibyte over byte cap reports too-large",
+        rvSize.issues.some(function (issue) {
+          return /exceeds maxBytes/.test(issue.snippet || "");
+        }));
+  check("validate: too-large snippet reports the BYTE count, not char count",
+        rvSize.issues.some(function (issue) {
+          return /input 100 bytes exceeds maxBytes 60/.test(issue.snippet || "");
+        }));
+
+  // Top-level maxBytes (sanitize path → throws).
+  var threwMb = null;
+  try { b.guardSvg.sanitize(multibyte, { profile: "strict", maxBytes: 60 }); }
+  catch (e) { threwMb = e; }
+  check("sanitize: multibyte over byte cap throws too-large with byte count",
+        threwMb && /input 100 bytes exceeds maxBytes 60/.test(threwMb.message));
+
+  // ASCII under the same cap stays unchanged (no false positive).
+  var rvAscii = b.guardSvg.validate("a".repeat(50), { profile: "strict", maxBytes: 60 });
+  check("validate: 50-byte ASCII under 60-byte cap is NOT flagged too-large",
+        !rvAscii.issues.some(function (issue) {
+          return /exceeds maxBytes/.test(issue.snippet || "");
+        }));
+
+  // Per-attribute maxAttrValueBytes measures bytes too.
+  var attrMb = "<svg><circle foo=\"" + "é".repeat(50) + "\"/></svg>";
+  var rvAttr = b.guardSvg.validate(attrMb,
+    { profile: "balanced", maxAttrValueBytes: 60, maxBytes: 1000000 });
+  check("validate: multibyte attr value over byte cap reports attr-value-too-large",
+        rvAttr.issues.some(function (issue) { return issue.ruleId === "svg.attr-size"; }));
+
+  var attrAscii = "<svg><circle foo=\"" + "a".repeat(50) + "\"/></svg>";
+  var rvAttrAscii = b.guardSvg.validate(attrAscii,
+    { profile: "balanced", maxAttrValueBytes: 60, maxBytes: 1000000 });
+  check("validate: 50-byte ASCII attr value under 60-byte cap NOT flagged",
+        !rvAttrAscii.issues.some(function (issue) { return issue.ruleId === "svg.attr-size"; }));
+}
+
 function testGuardSvgSanitize() {
   var clean = b.guardSvg.sanitize("<svg><script>alert(1)</script><circle/></svg>",
                                   { profile: "strict" });
@@ -257,6 +304,33 @@ function testGuardSvgCompliancePosture() {
         threw && /unknown/.test(threw.message));
 }
 
+function testGdprPostureMatchesBalancedTier() {
+  // gdpr is the balanced-tier posture for content guards (data-minimization
+  // strips rather than rejects, but structural threats stay rejected). svg's
+  // balanced profile allows cross-origin external refs (allowExternalRefs:
+  // true) while strict refuses them. A partial gdpr posture object that omits
+  // allowExternalRefs silently backfills the strict value, turning gdpr into
+  // an incoherent strict/balanced hybrid that rejects an external <use> the
+  // balanced tier accepts. Assert the gdpr verdict matches the balanced
+  // verdict for that exact input.
+  var external = '<svg><use xlink:href="https://cdn.example/icons.svg#x"/></svg>';
+  var gdpr     = b.guardSvg.validate(external, { compliancePosture: "gdpr" });
+  var balanced = b.guardSvg.validate(external, { profile: "balanced" });
+
+  check("gdpr posture allows the same external <use> the balanced tier allows",
+        gdpr.ok === balanced.ok);
+  check("gdpr posture raises no external-ref the balanced tier does not",
+        !gdpr.issues.some(function (issue) { return issue.kind === "external-ref"; }));
+
+  // Structural identity: the gdpr posture is the balanced profile plus the
+  // data-minimization forensic budget (base 256 / 2 = 128), nothing
+  // strict-derived backfilled.
+  var expected = Object.assign({}, b.guardSvg.PROFILES.balanced,
+                               { forensicSnippetBytes: 128 });
+  check("COMPLIANCE_POSTURES.gdpr deep-equals balanced + forensicSnippetBytes:128",
+        JSON.stringify(b.guardSvg.COMPLIANCE_POSTURES.gdpr) === JSON.stringify(expected));
+}
+
 function testGuardSvgBadProfile() {
   var threw = null;
   try { b.guardSvg.validate("<svg/>", { profile: "made-up" }); }
@@ -279,8 +353,10 @@ async function run() {
   testGuardSvgCssInjection();
   testGuardSvgBidiNullControl();
   testGuardSvgCaps();
+  testGuardSvgByteCapsMeasureBytes();
   testGuardSvgSanitize();
   testGuardSvgCompliancePosture();
+  testGdprPostureMatchesBalancedTier();
   testGuardSvgBadProfile();
   await testGuardSvgGate();
 }