@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/lib/gdpr-ropa.js

@@ -91,7 +91,7 @@ function create(opts) {
       throw new GdprRopaError("gdpr-ropa/bad-id",
         "gdpr.ropa." + op + ": activity.id must be a non-empty string");
     }
-    if (!VALID_LEGAL_BASES[activity.legalBasis]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, activity.legalBasis)) {
       throw new GdprRopaError("gdpr-ropa/bad-legal-basis",
         "gdpr.ropa." + op + ": activity.legalBasis must be one of " + Object.keys(VALID_LEGAL_BASES).join(", "));
     }
@@ -127,7 +127,7 @@ function create(opts) {
       registeredAt: existing.registeredAt,
       lastUpdatedAt: now(),
     });
-    if (patch.legalBasis && !VALID_LEGAL_BASES[merged.legalBasis]) {
+    if (patch.legalBasis && !Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, merged.legalBasis)) {
       throw new GdprRopaError("gdpr-ropa/bad-legal-basis",
         "gdpr.ropa.update: legalBasis must be one of " + Object.keys(VALID_LEGAL_BASES).join(", "));
     }
@@ -173,6 +173,21 @@ function create(opts) {
       activities:           list(),
     };
   }
+  // Quote a CSV cell AND neutralize spreadsheet formula injection (CWE-1236):
+  // a value beginning with = + - @ TAB or CR is evaluated as a formula by
+  // Excel / Google Sheets when the export is opened, so a RoPA field like
+  // "=HYPERLINK(...)" or "=cmd|..." would execute. Prefix such a value with a
+  // single quote so the spreadsheet renders it as literal text; then RFC-4180
+  // quote (double internal quotes).
+  function _csvCell(v) {
+    var s = (v === undefined || v === null) ? ""
+      : (Array.isArray(v) ? JSON.stringify(v) : String(v));
+    var c0 = s.charCodeAt(0);
+    if (c0 === 0x3d || c0 === 0x2b || c0 === 0x2d || c0 === 0x40 || c0 === 0x09 || c0 === 0x0d) {
+      s = "'" + s;
+    }
+    return '"' + s.replace(/"/g, '""') + '"';
+  }
   function _exportCsv() {
     var headers = [
       "id", "name", "purposes", "legalBasis", "dataCategories",
@@ -183,13 +198,7 @@ function create(opts) {
     var entries = list();
     for (var i = 0; i < entries.length; i++) {
       var e = entries[i];
-      var row = headers.map(function (h) {
-        var v = e[h];
-        if (v === undefined || v === null) return "";
-        if (Array.isArray(v)) return JSON.stringify(v).replace(/"/g, "\"\"");
-        return String(v).replace(/"/g, "\"\"");
-      });
-      rows.push(row.map(function (c) { return '"' + c + '"'; }).join(","));
+      rows.push(headers.map(function (h) { return _csvCell(e[h]); }).join(","));
     }
     return rows.join("\n");
   }

package/lib/vendor/blamejs/lib/graphql-federation.js

@@ -35,7 +35,13 @@ var ROUTER_TOKEN_MIN_LEN = 32;
 var NONCE_MIN_LEN = 16;                                                                     // string-length floor for nonce entropy, not bytes
 var NONCE_MAX_LEN = 256;                                                                    // string-length cap, not bytes
 var NONCE_PREVIEW_LEN = 8;                                                                  // log-preview slice length, not bytes
-var SDL_PROBE_RE = /(^|[\s,{])_service\b|_entities\b/;
+// Word-boundary anchored on BOTH probes. A prefix char-class ([\s,{]) on
+// `_service` was bypassable by an alias with no leading space — `query{x:_service{sdl}}`
+// has `:` before `_service`, which is not in the class, so the SDL trust gate
+// was skipped and the subgraph leaked its full SDL. `\b` already prevents
+// matching substrings like `my_service` (no boundary between `y` and `_`), so
+// the prefix class only added the bypass.
+var SDL_PROBE_RE = /\b_service\b|\b_entities\b/;
 
 /**
  * @primitive b.graphqlFederation.queryProbesSdl
@@ -173,14 +179,21 @@ function guardSdl(opts) {
   return function graphqlFedGuard(req, res, next) {
     Promise.resolve().then(function () {
       return _readBody(req, errorClass).then(function (rawBody) {
-        var query = null;
+        var probesSdl = false;
         try {
           var parsed = typeof rawBody === "string" ? safeJson.parse(rawBody, { maxBytes: C.BYTES.mib(1) }) : rawBody;             // routed via safeJson.parse
-          query = parsed && typeof parsed === "object" ? parsed.query : null;
+          // A GraphQL HTTP batch is a JSON ARRAY of operations; probe EVERY
+          // element's query, not just `parsed.query` (which is undefined for an
+          // array → the SDL gate was skipped and a batched `_service{sdl}`
+          // operation leaked the SDL on batching-enabled subgraphs).
+          var candidates = Array.isArray(parsed)
+            ? parsed.map(function (o) { return o && typeof o === "object" ? o.query : null; })
+            : [parsed && typeof parsed === "object" ? parsed.query : null];
+          probesSdl = candidates.some(queryProbesSdl);
         } catch (_e) { /* not JSON; pass through */ }
         if (req.body === undefined) req.body = rawBody;
 
-        if (!queryProbesSdl(query)) {
+        if (!probesSdl) {
           if (typeof next === "function") next();
           return;
         }

package/lib/vendor/blamejs/lib/guard-all.js

@@ -128,12 +128,12 @@ function _verifyParity() {
       failures.push(g.NAME + ": missing gate(opts) function");
     }
     SHARED_PROFILES.forEach(function (p) {
-      if (!g.PROFILES || !g.PROFILES[p]) {
+      if (!g.PROFILES || !Object.prototype.hasOwnProperty.call(g.PROFILES, p)) {
         failures.push(g.NAME + ": does not declare shared profile " + JSON.stringify(p));
       }
     });
     SHARED_POSTURES.forEach(function (p) {
-      if (!g.COMPLIANCE_POSTURES || !g.COMPLIANCE_POSTURES[p]) {
+      if (!g.COMPLIANCE_POSTURES || !Object.prototype.hasOwnProperty.call(g.COMPLIANCE_POSTURES, p)) {
         failures.push(g.NAME + ": does not declare shared compliance posture " + JSON.stringify(p));
       }
     });

package/lib/vendor/blamejs/lib/guard-dsn.js

@@ -210,7 +210,7 @@ function parse(deliveryStatusBody, opts) {
         "parse: per-recipient block missing Action (RFC 3464 §2.3.3)");
     }
     var action = fields["action"].toLowerCase();
-    if (!KNOWN_ACTIONS[action]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_ACTIONS, action)) {
       throw new GuardDsnError("guard-dsn/bad-action",
         "parse: Action '" + action + "' not in RFC 3464 §2.3.3 vocabulary");
     }

package/lib/vendor/blamejs/lib/guard-envelope.js

@@ -148,7 +148,7 @@ var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 function check(ctx, opts) {
   opts = opts || {};
   var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
-  if (!PROFILES[profile]) {
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, profile)) {
     throw new GuardEnvelopeError("guard-envelope/bad-profile",
       "check: unknown profile '" + profile + "'");
   }

package/lib/vendor/blamejs/lib/guard-html.js

@@ -107,7 +107,6 @@ var observability = lazyRequire(function () { return require("./observability");
 void observability;
 
 var _err = GuardHtmlError.factory;
-var HEX_RADIX = 16;                                                 // base-16 radix, not byte size
 
 // ---- Codepoint catalog (shared via lib/codepoint-class) ----
 
@@ -390,14 +389,11 @@ var NAMED_ENTITY_ASCII = {
 // scheme. Returns "" if no scheme.
 function _extractScheme(rawUrl) {
   var s = String(rawUrl || "").trim();
-  // Decode HTML numeric entities just enough to expose hidden schemes
-  // like javascript:... or javascript:...
-  s = s.replace(/&#x([0-9a-f]+);/gi, function (_m, h) {
-    return String.fromCharCode(parseInt(h, HEX_RADIX));
-  });
-  s = s.replace(/&#(\d+);/g, function (_m, d) {
-    return String.fromCharCode(parseInt(d, 10));
-  });
+  // Decode HTML numeric entities (hex &#x..; and decimal &#..;, semicolon
+  // OPTIONAL) just enough to expose hidden schemes like javascript: or
+  // the browser-decoded no-semicolon form &#106avascript:. Shared decoder so
+  // guard-html / guard-svg / guard-markdown can't drift (see codepoint-class).
+  s = codepointClass.decodeNumericEntities(s);
   // Decode HTML5 named entities that browsers honor inside URL
   // contexts. Without this, payloads like `java	script:alert(1)`
   // bypass the scheme allowlist (the literal `	` between `java`
@@ -482,9 +478,11 @@ function _tokenize(input, maxBytes) {
 
     // Comment / CDATA / doctype
     if (s.startsWith("<!--", lt)) {
-      var endC = s.indexOf("-->", lt + 4);
+      // WHATWG comment end (covers "--!>" + abrupt "<!-->" / "<!--->"), not
+      // only "-->", so a smuggled element after an early terminator is split
+      // out as a live token instead of hidden inside the comment (mXSS).
+      var endC = markupTokenizer.htmlCommentEnd(s, lt);
       if (endC === -1) endC = len;
-      else endC += 3;
       tokens.push({ type: "comment", raw: s.slice(lt, endC), start: lt, end: endC });
       pos = endC; continue;
     }

package/lib/vendor/blamejs/lib/guard-imap-command.js

@@ -242,7 +242,7 @@ function validate(line, opts) {
   var verb = (verbSpace === -1 ? rest : rest.slice(0, verbSpace)).toUpperCase();
   var args = verbSpace === -1 ? "" : rest.slice(verbSpace + 1);
 
-  if (!KNOWN_VERBS[verb]) {
+  if (!Object.prototype.hasOwnProperty.call(KNOWN_VERBS, verb)) {
     throw new GuardImapCommandError("guard-imap-command/unknown-verb",
       "guardImapCommand.validate: unknown verb '" + verb + "'");
   }

package/lib/vendor/blamejs/lib/guard-jmap.js

@@ -196,7 +196,7 @@ function validate(rawBody, opts) {
       throw new GuardJmapError("urn:ietf:params:jmap:error:invalidArguments",
         "guardJmap.validate: `using[" + ui + "]` must be a string capability URI");
     }
-    if (!CORE_CAPABILITIES[cap] && !serverCaps[cap]) {
+    if (!Object.prototype.hasOwnProperty.call(CORE_CAPABILITIES, cap) && !serverCaps[cap]) {
       throw new GuardJmapError("urn:ietf:params:jmap:error:unknownCapability",
         "guardJmap.validate: capability '" + cap + "' not advertised by this server");
     }

package/lib/vendor/blamejs/lib/guard-json.js

@@ -76,6 +76,7 @@ var pick = require("./pick");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
 var safeJson = require("./safe-json");
+var safeBuffer = require("./safe-buffer");
 var { GuardJsonError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -229,12 +230,19 @@ function _scanTree(value, opts, ctx) {
     return ctx;
   }
   if (value === null || typeof value !== "object") {
-    if (typeof value === "string" && value.length > opts.maxStringLength) {
-      ctx.stringTooLongHits.push({
-        kind: "string-too-long",
-        snippet: "string length " + value.length +
-                 " exceeds maxStringLength " + opts.maxStringLength,
-      });
+    // maxStringLength is a BYTE cap (profiles set it via C.BYTES.*). Measure
+    // UTF-8 byte length, not value.length (UTF-16 code units) — otherwise a
+    // multibyte string (emoji / CJK / accented) under-enforces the cap by up
+    // to ~3x and the snippet mislabels the count.
+    if (typeof value === "string") {
+      var strBytes = safeBuffer.byteLengthOf(value);
+      if (strBytes > opts.maxStringLength) {
+        ctx.stringTooLongHits.push({
+          kind: "string-too-long",
+          snippet: "string byte length " + strBytes +
+                   " exceeds maxStringLength " + opts.maxStringLength + " bytes",
+        });
+      }
     }
     return ctx;
   }

package/lib/vendor/blamejs/lib/guard-mail-move.js

@@ -123,7 +123,7 @@ function validate(move, opts) {
 
   // System-folder allowlist OR admin scope OR allowed-folders.
   var dest = move.toFolder;
-  if (SYSTEM_FOLDERS[dest]) return move;
+  if (Object.prototype.hasOwnProperty.call(SYSTEM_FOLDERS, dest)) return move;
   var isAdmin = move.actor.mailScope === "admin";
   if (isAdmin) return move;
   var allowed = Array.isArray(move.actor.allowedFolders) ? move.actor.allowedFolders : null;

package/lib/vendor/blamejs/lib/guard-managesieve-command.js

@@ -249,7 +249,7 @@ function validate(line, opts) {
   var verb = (firstSpace === -1 ? line : line.slice(0, firstSpace)).toUpperCase();
   var rest = firstSpace === -1 ? "" : line.slice(firstSpace + 1);
 
-  if (!KNOWN_VERBS[verb]) {
+  if (!Object.prototype.hasOwnProperty.call(KNOWN_VERBS, verb)) {
     throw new GuardManageSieveCommandError("guard-managesieve-command/unknown-verb",
       "guardManageSieveCommand.validate: unknown verb '" + verb + "' (RFC 5804 §2)");
   }

package/lib/vendor/blamejs/lib/guard-pop3-command.js

@@ -183,7 +183,7 @@ function validate(line, opts) {
   var verb = (firstSpace === -1 ? line : line.slice(0, firstSpace)).toUpperCase();
   var rest = firstSpace === -1 ? "" : line.slice(firstSpace + 1);
 
-  if (!KNOWN_VERBS[verb]) {
+  if (!Object.prototype.hasOwnProperty.call(KNOWN_VERBS, verb)) {
     throw new GuardPop3CommandError("guard-pop3-command/unknown-verb",
       "guardPop3Command.validate: unknown verb '" + verb + "' (RFC 1939 §6)");
   }

package/lib/vendor/blamejs/lib/guard-smtp-command.js

@@ -210,7 +210,7 @@ function validate(line, opts) {
   var verb = (firstSpace === -1 ? line : line.slice(0, firstSpace)).toUpperCase();
   var rest = firstSpace === -1 ? "" : line.slice(firstSpace + 1);
 
-  if (!KNOWN_VERBS[verb]) {
+  if (!Object.prototype.hasOwnProperty.call(KNOWN_VERBS, verb)) {
     throw new GuardSmtpCommandError("guard-smtp-command/unknown-verb",
       "guardSmtpCommand.validate: unknown verb '" + verb + "' (RFC 5321 §3)");
   }

package/lib/vendor/blamejs/lib/guard-svg.js

@@ -119,7 +119,6 @@ var observability = lazyRequire(function () { return require("./observability");
 void observability;
 
 var _err = GuardSvgError.factory;
-var HEX_RADIX = 16;                                                 // base-16 radix, not byte size
 
 // ---- Codepoint catalog (shared via lib/codepoint-class) ----
 
@@ -329,12 +328,9 @@ var SVG_NAMED_ENTITY_ASCII = {
 
 function _extractScheme(rawUrl) {
   var s = String(rawUrl || "").trim();
-  s = s.replace(/&#x([0-9a-f]+);/gi, function (_m, h) {
-    return String.fromCharCode(parseInt(h, HEX_RADIX));
-  });
-  s = s.replace(/&#(\d+);/g, function (_m, d) {
-    return String.fromCharCode(parseInt(d, 10));
-  });
+  // Numeric entities (hex/decimal, semicolon OPTIONAL) via the shared decoder
+  // so guard-html / guard-svg / guard-markdown can't drift (see codepoint-class).
+  s = codepointClass.decodeNumericEntities(s);
   s = s.replace(/&([A-Za-z][A-Za-z0-9]+);/g, function (m, name) {
     if (Object.prototype.hasOwnProperty.call(SVG_NAMED_ENTITY_ASCII, name)) {
       return SVG_NAMED_ENTITY_ASCII[name];
@@ -401,8 +397,11 @@ function _tokenize(input, maxBytes) {
     }
 
     if (s.startsWith("<!--", lt)) {
-      var endC = s.indexOf("-->", lt + 4);
-      if (endC === -1) endC = len; else endC += 3;
+      // WHATWG comment end ("--!>" + abrupt "<!-->" / "<!--->"), not only
+      // "-->", so the comment boundary matches a browser parsing inline SVG
+      // and no element is smuggled past the sanitizer (mXSS differential).
+      var endC = markupTokenizer.htmlCommentEnd(s, lt);
+      if (endC === -1) endC = len;
       tokens.push({ type: "comment", raw: s.slice(lt, endC), start: lt, end: endC });
       pos = endC; continue;
     }

package/lib/vendor/blamejs/lib/html-balance.js

@@ -110,7 +110,10 @@ function check(html) {
         html.charCodeAt(i + 1) === 0x21 /* ! */ &&
         html.charCodeAt(i + 2) === 0x2D &&
         html.charCodeAt(i + 3) === 0x2D) {
-      var endComment = html.indexOf("-->", i + 4);
+      // WHATWG comment end ("--!>" + abrupt "<!-->" / "<!--->"), not only
+      // "-->", so the structural scan agrees with a browser on where the
+      // comment ends (the comment-parser differential).
+      var endComment = markupTokenizer.htmlCommentEnd(html, i);
       if (endComment === -1) {
         var pos = _posToLineColumn(html, i);
         return {
@@ -121,7 +124,7 @@ function check(html) {
           column:  pos.column,
         };
       }
-      i = endComment + 3;
+      i = endComment;
       continue;
     }
 
@@ -218,7 +221,7 @@ function check(html) {
         // Open tag (or self-closing).
         if (selfClose || VOID_TAGS[tag]) {
           // No push.
-        } else if (RAW_TEXT_TAGS[tag]) {
+        } else if (Object.prototype.hasOwnProperty.call(RAW_TEXT_TAGS, tag)) {
           // Skip raw-text content AND its closing tag entirely. Inside
           // <script>/<style>/<textarea>/<title> the `<` characters are
           // text, not markup — re-entering the tag scanner on
@@ -294,6 +297,7 @@ function check(html) {
 // distinguish a structural problem from a content-safety reject.
 var lazyRequire = require("./lazy-require");
 var _guardHtml = lazyRequire(function () { return require("./guard-html"); });
+var markupTokenizer = require("./markup-tokenizer");
 
 /**
  * @primitive b.htmlBalance.checkSafe

package/lib/vendor/blamejs/lib/http-client-cookie-jar.js

@@ -60,9 +60,9 @@
  *   }
  */
 
-var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var C                = require("./constants");
+var atomicFile       = require("./atomic-file");
 var numericBounds    = require("./numeric-bounds");
 var safeAsync        = require("./safe-async");
 var safeJson         = require("./safe-json");
@@ -439,7 +439,10 @@ function create(opts) {
     var rows = getAll();
     var serialized = JSON.stringify(rows);
     var blob = vault ? vault.seal(serialized) : serialized;
-    nodeFs.writeFileSync(filePath, blob);
+    // Atomic, symlink-refusing write: a bare writeFileSync follows a symlink
+    // planted at filePath (CWE-59) and can leave a torn jar if the process
+    // dies mid-write. writeSync stages into a no-follow exclusive temp + renames.
+    atomicFile.writeSync(filePath, blob, { fileMode: 0o600 });
   }
   var flushScheduler = safeAsync.makeScheduledFlush(flushDebounceMs, function () {
     if (!filePath) return;
@@ -475,18 +478,36 @@ function create(opts) {
   // Persist file may be operator-tampered (or vault-sealed) — route through
   // safeJson with an explicit byte cap so a maliciously-large file can't
   // OOM the process before the parse fails.
-  if (filePath && nodeFs.existsSync(filePath)) {
+  if (filePath) {
+    // Capped fd-bound read (no existsSync check-then-read window): the cap now
+    // precedes the file allocation so a maliciously-large persist file can't OOM
+    // the process before parse. refuseSymlink+inodeCheck: the jar file is
+    // operator-local + may hold a vault-sealed (secret) blob, and is never a
+    // k8s-style projected-secret mount. A MISSING file is the normal first run.
+    var raw = null;
     try {
-      var raw = nodeFs.readFileSync(filePath, "utf8");
-      var serialized = vault ? vault.unseal(raw) : raw;
-      if (serialized && serialized.length > 0) {
-        var rows = safeJson.parse(serialized, { maxBytes: C.BYTES.mib(16) });
-        setFromSerialized(rows);
-      }
+      raw = atomicFile.fdSafeReadSync(filePath, {
+        maxBytes: C.BYTES.mib(16), encoding: "utf8", refuseSymlink: true, inodeCheck: true,
+      });
     } catch (e) {
-      throw _err("LOAD_FAILED",
-        "cookieJar.create: failed to load persist file '" + filePath + "': " +
-        (e.message || String(e)));
+      if (e && e.code === "ENOENT") { raw = null; }   // first run — no persist file yet
+      else {
+        throw _err("LOAD_FAILED",
+          "cookieJar.create: failed to load persist file '" + filePath + "': " +
+          (e.message || String(e)));
+      }
+    }
+    if (raw !== null) {
+      try {
+        var serialized = vault ? vault.unseal(raw) : raw;
+        if (serialized && serialized.length > 0) {
+          setFromSerialized(safeJson.parse(serialized, { maxBytes: C.BYTES.mib(16) }));
+        }
+      } catch (e) {
+        throw _err("LOAD_FAILED",
+          "cookieJar.create: failed to load persist file '" + filePath + "': " +
+          (e.message || String(e)));
+      }
     }
   }