@blamejs/blamejs-shop 0.4.56 → 0.4.58

package/lib/vendor/blamejs/lib/guard-jwt.js

@@ -72,13 +72,12 @@
  *   JWT identifier-safety guard — validates user-supplied JWT compact-serialization strings against the canonical CVE-class refuse list BEFORE hand-off to a signature verifier.
  */
 
-var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
 var { GuardJwtError } = require("./framework-error");
+var codepointClass = require("./codepoint-class");
 
 var observability = lazyRequire(function () { return require("./observability"); });
 void observability;
@@ -118,10 +117,7 @@ function _b64urlDecodeJson(seg) {
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:           "reject",
-    controlPolicy:        "reject",
-    nullBytePolicy:       "reject",
-    zeroWidthPolicy:      "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     algNonePolicy:        "reject",
     algAllowlistPolicy:   "reject",
     kidTraversalPolicy:   "reject",
@@ -142,10 +138,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:         C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:           "reject",
-    controlPolicy:        "reject",
-    nullBytePolicy:       "reject",
-    zeroWidthPolicy:      "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     algNonePolicy:        "reject",                                              // alg=none refused at every profile
     algAllowlistPolicy:   "audit",
     kidTraversalPolicy:   "reject",                                              // kid traversal refused at every profile
@@ -166,10 +159,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:         C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:           "reject",                                              // BIDI refused at every profile
-    controlPolicy:        "reject",                                              // controls refused at every profile
-    nullBytePolicy:       "reject",                                              // null refused at every profile
-    zeroWidthPolicy:      "reject",                                              // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     algNonePolicy:        "reject",                                              // alg=none refused at every profile
     algAllowlistPolicy:   "allow",
     kidTraversalPolicy:   "reject",                                              // kid traversal refused at every profile
@@ -191,55 +181,10 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardJwtError,
-    errCodePrefix:      "jwt",
-  });
-}
-
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              ruleId: "jwt.bad-input",
-              snippet: "jwt is not a string" }];
-  }
-  if (input.length === 0) {
-    return [{ kind: "empty", severity: "high",
-              ruleId: "jwt.empty",
-              snippet: "jwt is empty" }];
-  }
-  if (Buffer.byteLength(input, "utf8") > opts.maxBytes) {
-    return [{ kind: "jwt-cap", severity: "high",
-              ruleId: "jwt.jwt-cap",
-              snippet: "jwt input exceeds maxBytes " + opts.maxBytes }];
-  }
-
-  var charThreats = codepointClass.detectCharThreats(input, opts, "jwt");
-  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+  var pre = gateContract.detectStringInput(input, opts, { name: "jwt", cap: { bytes: opts.maxBytes } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   if (!JWT_SHAPE_RE.test(input)) {                                               // allow:regex-no-length-cap — input bounded by maxBytes
     issues.push({
@@ -490,22 +435,11 @@ function _detectIssues(input, opts) {
  *   var ok = b.guardJwt.validate(benign, { profile: "strict" });
  *   ok.ok;                                              // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxHeaderBytes", "maxPayloadBytes", "maxSignatureBytes",
-     "nbfFutureSlackMs", "iatFutureSlackMs"],
-    "guardJwt.validate", GuardJwtError, "jwt.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 ruleId: "jwt.bad-input",
-                 snippet: "jwt is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the segment/total byte caps and slack
+// windows declared via `intOpts`. The @primitive block above documents the
+// resulting public ABI.
 
 /**
  * @primitive  b.guardJwt.sanitize
@@ -537,15 +471,11 @@ function validate(input, opts) {
  *     e.code;                                           // → "jwt.alg-none"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("jwt.bad-input", "sanitize requires string input");
-  }
-  // JWT shape can't be repaired — sanitize either passes through
-  // valid input or throws.
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, { errorClass: GuardJwtError, codePrefix: "jwt" });
+// _sanitizeTransform — the guard-specific normalize applied by defineGuard's
+// generated sanitize AFTER resolve → detect → throw-on-refusal. JWT compact
+// serialization can't be repaired (every byte feeds the signature), so the
+// transform is identity: a validated token passes through unchanged.
+function _sanitizeTransform(input) {
   return input;
 }
 
@@ -590,36 +520,23 @@ function kidSafe(kid) {
     throw _err("jwt.kid-traversal",
       "kid `" + kid + "` contains path-traversal indicators");
   }
-  for (var i = 0; i < kid.length; i += 1) {
-    var cc = kid.charCodeAt(i);
-    if (cc < 0x20 || cc === 0x7F) {                                              // control-byte boundary check
-      throw _err("jwt.kid-control",
-        "kid contains control byte at index " + i);
-    }
+  var _kidCtl = codepointClass.firstControlCharOffset(kid, { forbidTab: true });                       // control-byte boundary check
+  if (_kidCtl !== -1) {
+    throw _err("jwt.kid-control",
+      "kid contains control byte at index " + _kidCtl);
   }
   return kid;
 }
 
 // ---- guard-* family registry exports ----
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:              "identifier",
-  // Benign: minimal v4 token with alg=ES256, valid JSON header / payload.
-  benignBytes: Buffer.from(
-    "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9." +
-    "eyJpc3MiOiJleGFtcGxlIiwiZXhwIjo5OTk5OTk5OTk5LCJpYXQiOjE3MDAwMDAwMDB9." +
-    "sig", "utf8"),
-  benignIdentifier:
-    "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9." +
+// Benign: minimal v4 token with alg=ES256, valid JSON header / payload.
+// Hostile: alg=none — universal refuse class.
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures(
+  "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9." +
     "eyJpc3MiOiJleGFtcGxlIiwiZXhwIjo5OTk5OTk5OTk5LCJpYXQiOjE3MDAwMDAwMDB9." +
     "sig",
-  // Hostile: alg=none — universal refuse class.
-  hostileBytes: Buffer.from(
-    "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0." +
-    "eyJzdWIiOiJhdHRhY2tlciIsImV4cCI6OTk5OTk5OTk5OX0.", "utf8"),
-  hostileIdentifier:
-    "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0." +
-    "eyJzdWIiOiJhdHRhY2tlciIsImV4cCI6OTk5OTk5OTk5OX0.",
-});
+  "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0." +
+    "eyJzdWIiOiJhdHRhY2tlciIsImV4cCI6OTk5OTk5OTk5OX0.");
 
 // Assembled from the gate-contract guard factory. KIND "identifier"; the
 // gate is the standard serve -> audit-only -> refuse chain over
@@ -632,11 +549,12 @@ module.exports = gateContract.defineGuard({
   kind:        "identifier",
   errorClass:  GuardJwtError,
   profiles:    PROFILES,
-  defaults:    DEFAULTS,
-  postures:    COMPLIANCE_POSTURES,
+  base:        256,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:           _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:          ["maxBytes", "maxHeaderBytes", "maxPayloadBytes",
+                     "maxSignatureBytes", "nbfFutureSlackMs", "iatFutureSlackMs"],
   extra: {
     kidSafe: kidSafe,
   },

package/lib/vendor/blamejs/lib/guard-list-id.js

@@ -74,6 +74,7 @@
 var C                  = require("./constants");
 var { defineClass }    = require("./framework-error");
 var gateContract       = require("./gate-contract");
+var codepointClass     = require("./codepoint-class");
 
 var GuardListIdError = defineClass("GuardListIdError", { alwaysPermanent: true });
 
@@ -272,13 +273,7 @@ function validate(headerValue, opts) {
 // generator.
 
 function _hasControlChar(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var c = s.charCodeAt(i);
-    if (c === 0x00 || c === 0x7f || (c < 0x20 && c !== 0x09)) {                                          // RFC 5322 control + TAB allow
-      return true;
-    }
-  }
-  return false;
+  return codepointClass.firstControlCharOffset(s) !== -1;
 }
 
 function _refuse(reason) {

package/lib/vendor/blamejs/lib/guard-list-unsubscribe.js

@@ -80,6 +80,7 @@ var C                  = require("./constants");
 var { defineClass }    = require("./framework-error");
 var safeUrl            = require("./safe-url");
 var gateContract       = require("./gate-contract");
+var codepointClass     = require("./codepoint-class");
 
 var GuardListUnsubscribeError = defineClass("GuardListUnsubscribeError", { alwaysPermanent: true });
 
@@ -354,13 +355,7 @@ function _extractUris(raw, maxUris) {
 }
 
 function _hasControlChar(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var c = s.charCodeAt(i);
-    if (c === 0x00 || c === 0x7f || (c < 0x20 && c !== 0x09)) {                                          // RFC 5322 control + TAB allow
-      return true;
-    }
-  }
-  return false;
+  return codepointClass.firstControlCharOffset(s) !== -1;
 }
 
 function _trunc(s) {

package/lib/vendor/blamejs/lib/guard-mail-compose.js

@@ -37,6 +37,7 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
 
 var GuardMailComposeError = defineClass("GuardMailComposeError", { alwaysPermanent: true });
 
@@ -229,12 +230,10 @@ function _checkBody(body, profile, allowAlt) {
 }
 
 function _checkHeaderValue(v, label) {
-  for (var i = 0; i < v.length; i += 1) {
-    var c = v.charCodeAt(i);
-    if ((c < 0x20 && c !== 0x09) || c === 0x7F) {                                                     // C0 + DEL refusal in header
-      throw new GuardMailComposeError("mail-compose/control-char-in-header",
-        "guardMailCompose.validate: control char 0x" + c.toString(16) + " in " + label);
-    }
+  var ctrlAt = codepointClass.firstControlCharOffset(v);                                              // C0 (except TAB) + DEL refusal in header
+  if (ctrlAt !== -1) {
+    throw new GuardMailComposeError("mail-compose/control-char-in-header",
+      "guardMailCompose.validate: control char 0x" + v.charCodeAt(ctrlAt).toString(16) + " in " + label);
   }
 }
 

package/lib/vendor/blamejs/lib/guard-mail-move.js

@@ -35,6 +35,7 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
 
 var GuardMailMoveError = defineClass("GuardMailMoveError", { alwaysPermanent: true });
 
@@ -159,7 +160,7 @@ function _checkFolderName(name, label, profile) {
   }
   for (var i = 0; i < name.length; i += 1) {
     var c = name.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) {                                                                     // C0 + DEL refusal
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true })) {                              // C0 + DEL refusal
       throw new GuardMailMoveError("mail-move/control-char-in-name",
         "guardMailMove.validate: " + label + " contains control char 0x" + c.toString(16));
     }

package/lib/vendor/blamejs/lib/guard-mail-query.js

@@ -28,6 +28,8 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var pick = require("./pick");
+var boundedMap = require("./bounded-map");
 
 var GuardMailQueryError = defineClass("GuardMailQueryError", { alwaysPermanent: true });
 
@@ -211,10 +213,10 @@ function _walk(node, depth, profile, visited) {
     throw new GuardMailQueryError("mail-query/buffer-not-allowed",
       "guardMailQuery.validate: Buffer refused inside filter");
   }
-  if (visited.has(node)) {
+  boundedMap.requireAbsentMember(visited, node, function () {
     throw new GuardMailQueryError("mail-query/cycle",
       "guardMailQuery.validate: cyclic filter refused");
-  }
+  });
   visited.add(node);
 
   if (Array.isArray(node)) {
@@ -235,7 +237,7 @@ function _walk(node, depth, profile, visited) {
   }
   for (var ki = 0; ki < keys.length; ki += 1) {
     var k = keys[ki];
-    if (k === "__proto__" || k === "constructor" || k === "prototype") {
+    if (pick.isPoisonedKey(k)) {
       throw new GuardMailQueryError("mail-query/proto-key",
         "guardMailQuery.validate: forbidden key '" + k + "'");
     }

package/lib/vendor/blamejs/lib/guard-mail-sieve.js

@@ -34,6 +34,7 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
 
 var GuardMailSieveError = defineClass("GuardMailSieveError", { alwaysPermanent: true });
 
@@ -125,12 +126,10 @@ function validate(op, opts) {
     // Control-char refusal in script (NUL is always refused; other
     // C0 except CR/LF/TAB are refused too — Sieve scripts are
     // text-only per RFC 5228 §1.4).
-    for (var j = 0; j < op.script.length; j += 1) {
-      var c = op.script.charCodeAt(j);
-      if (c === 0x00 || (c < 0x20 && c !== 0x09 && c !== 0x0A && c !== 0x0D) || c === 0x7F) {         // NUL / C0 except TAB/LF/CR / DEL refusal
-        throw new GuardMailSieveError("mail-sieve/control-char-in-script",
-          "guardMailSieve.validate: control char 0x" + c.toString(16) + " at offset " + j);
-      }
+    var ctrlAt = codepointClass.firstControlCharOffset(op.script, { allowLf: true, allowCr: true });  // NUL / C0 except TAB/LF/CR / DEL refusal
+    if (ctrlAt !== -1) {
+      throw new GuardMailSieveError("mail-sieve/control-char-in-script",
+        "guardMailSieve.validate: control char 0x" + op.script.charCodeAt(ctrlAt).toString(16) + " at offset " + ctrlAt);
     }
   }
 
@@ -169,7 +168,7 @@ function _checkName(name, profile) {
   }
   for (var i = 0; i < name.length; i += 1) {
     var c = name.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // C0 / DEL / slash / backslash refusal
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x2F || c === 0x5C) {                                         // C0 / DEL / slash / backslash refusal
       throw new GuardMailSieveError("mail-sieve/bad-name-char",
         "guardMailSieve.validate: op.name contains forbidden char 0x" + c.toString(16));
     }

package/lib/vendor/blamejs/lib/guard-managesieve-command.js

@@ -102,6 +102,8 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
+var safeBuffer = require("./safe-buffer");
 
 var GuardManageSieveCommandError = defineClass("GuardManageSieveCommandError",
   { alwaysPermanent: true });
@@ -214,9 +216,9 @@ function validate(line, opts) {
     throw new GuardManageSieveCommandError("guard-managesieve-command/empty-line",
       "guardManageSieveCommand.validate: empty command line");
   }
-  if (line.length > caps.maxLineBytes) {
+  if (safeBuffer.byteLengthOf(line) > caps.maxLineBytes) {
     throw new GuardManageSieveCommandError("guard-managesieve-command/line-too-long",
-      "guardManageSieveCommand.validate: line " + line.length +
+      "guardManageSieveCommand.validate: line " + safeBuffer.byteLengthOf(line) +
       " bytes exceeds cap " + caps.maxLineBytes);
   }
 
@@ -232,8 +234,7 @@ function validate(line, opts) {
       continue;
     }
     if (inQuote) continue;
-    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                         // control-byte refusal
-      if (c === 0x0A && caps.allowBareLf) continue;
+    if (codepointClass.isForbiddenControlChar(c, { allowLf: caps.allowBareLf })) {                     // control-byte refusal (bare LF only when caps allow)
       throw new GuardManageSieveCommandError("guard-managesieve-command/bad-byte",
         "guardManageSieveCommand.validate: control byte 0x" +
         c.toString(16) + " at offset " + i);                                                            // base-16 toString radix