@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/lib/mail.js

@@ -430,6 +430,26 @@ function _validateMessage(message) {
     throw new MailError("mail/invalid-subject",
       "message.subject contains forbidden CRLF", true);
   }
+  // Reply-To and custom header KEYS go straight onto the wire in _buildRfc822;
+  // a CRLF in either smuggles arbitrary headers (Bcc / Reply-To override /
+  // Content-Type) — RFC 5322 / CWE-93 header injection. Fail closed.
+  if (message.replyTo && safeBuffer.hasCrlf(String(message.replyTo))) {
+    throw new MailError("mail/invalid-reply-to",
+      "message.replyTo contains forbidden CRLF (header injection)", true);
+  }
+  if (message.headers && typeof message.headers === "object") {
+    for (var _hk in message.headers) {
+      if (!Object.prototype.hasOwnProperty.call(message.headers, _hk)) continue;
+      if (safeBuffer.hasCrlf(_hk) || _hk.indexOf("\0") !== -1) {
+        throw new MailError("mail/invalid-header",
+          "message.headers key contains forbidden CRLF/NUL (header injection)", true);
+      }
+      if (safeBuffer.hasCrlf(String(message.headers[_hk]))) {
+        throw new MailError("mail/invalid-header",
+          "message.headers value for '" + _hk + "' contains forbidden CRLF (header injection)", true);
+      }
+    }
+  }
 
   if (!message.text && !message.html && !message.calendar) {
     throw new MailError("mail/missing-body",
@@ -711,7 +731,7 @@ function _buildRfc822(message) {
   headers.push("From: " + message.from);
   headers.push("To: " + (Array.isArray(message.to) ? message.to.join(", ") : message.to));
   if (message.cc)      headers.push("Cc: " + (Array.isArray(message.cc) ? message.cc.join(", ") : message.cc));
-  if (message.replyTo) headers.push("Reply-To: " + message.replyTo);
+  if (message.replyTo) headers.push("Reply-To: " + safeBuffer.stripCrlf(String(message.replyTo)));
   if (message.subject) headers.push("Subject: " + message.subject);
   headers.push("MIME-Version: 1.0");
   headers.push("Date: " + new Date().toUTCString());
@@ -721,7 +741,7 @@ function _buildRfc822(message) {
         // Strip CRLF defensively even though we already validated the
         // message; custom headers go straight onto the wire.
         var v = safeBuffer.stripCrlf(String(message.headers[k]));
-        headers.push(k + ": " + v);
+        headers.push(safeBuffer.stripCrlf(String(k)) + ": " + v);
       }
     }
   }

package/lib/vendor/blamejs/lib/markup-tokenizer.js

@@ -48,7 +48,31 @@ function splitTagNameAttrs(inner, tagNameRe) {
   };
 }
 
+// htmlCommentEnd(s, lt) — given that an HTML comment opens at index `lt`
+// (s.startsWith("<!--", lt)), return the index ONE PAST the comment's
+// terminator per the WHATWG HTML tokenizer, not just the legacy "-->" form.
+// A browser also closes a comment at "--!>" (comment-end-bang state) and
+// ABRUPTLY closes one that begins "<!-->" or "<!--->". A scanner that honours
+// only "-->" therefore disagrees with the browser about where the comment
+// ends, so markup AFTER an early "--!>" / abrupt close is swallowed as inert
+// comment by the sanitizer but parsed as a LIVE element by the browser (mXSS,
+// the comment-parser differential). Returns -1 if the comment is unterminated
+// so each caller keeps its own policy (lenient end-of-input vs. fail-closed
+// throw). NOTE: HTML/SVG-in-HTML only — XML comments do NOT have these forms.
+function htmlCommentEnd(s, lt) {
+  var i = lt + 4;                                  // first char after "<!--"
+  if (s.charAt(i) === ">") return i + 1;           // <!--> abrupt close
+  if (s.charAt(i) === "-" && s.charAt(i + 1) === ">") return i + 2;   // <!---> abrupt close
+  var a = s.indexOf("-->", i);
+  var b = s.indexOf("--!>", i);
+  if (a === -1 && b === -1) return -1;             // unterminated
+  if (a === -1) return b + 4;
+  if (b === -1) return a + 3;
+  return a <= b ? a + 3 : b + 4;                   // earliest terminator wins
+}
+
 module.exports = {
   scanToTagEnd: scanToTagEnd,
   splitTagNameAttrs: splitTagNameAttrs,
+  htmlCommentEnd: htmlCommentEnd,
 };

package/lib/vendor/blamejs/lib/mcp.js

@@ -636,10 +636,12 @@ function _validateValueAgainstSchema(value, schema, path) {
     }
     if (typeof schema.pattern === "string") {
       // Schema-supplied pattern — operator-controlled at registration
-      // time, not request-controlled. Cap value length first per the
-      // codebase-patterns regex-bound rule so a 10MB string doesn't
-      // ReDoS the validator.
-      if (value.length > 4096) return path + ": value exceeds 4 KiB cap before regex test";    // 4 KiB regex-input cap
+      // time, not request-controlled. Cap the input LENGTH first per the
+      // codebase-patterns regex-bound rule so a huge string can't ReDoS the
+      // validator. This is a CHARACTER cap, not a byte cap: regex matching
+      // cost scales with the number of code units the engine scans, so 4096
+      // chars is the correct ReDoS bound regardless of UTF-8 byte size.
+      if (value.length > 4096) return path + ": value exceeds 4096-char cap before regex test";    // ReDoS char cap (not bytes)
       try {
         var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern from registered tool author, not request input; bounded above
         if (!pat.test(value)) return path + ": does not match pattern";

package/lib/vendor/blamejs/lib/mdoc.js

@@ -53,6 +53,7 @@ var C = require("./constants");
 var cbor = require("./cbor");
 var cose = require("./cose");
 var bCrypto = require("./crypto");
+var x509Chain = require("./x509-chain");
 var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -128,10 +129,26 @@ function _mapGet(m, k) { return m instanceof Map ? m.get(k) : (m ? m[k] : undefi
  */
 async function verifyIssuerSigned(issuerSigned, opts) {
   validateOpts.requireObject(opts, "mdoc.verifyIssuerSigned", MdocError);
-  validateOpts(opts, ["algorithms", "trustAnchorsPem", "expectedDocType", "at", "maxBytes", "maxDepth"], "mdoc.verifyIssuerSigned");
+  validateOpts(opts, ["algorithms", "trustAnchorsPem", "allowUntrustedIssuer", "expectedDocType", "at", "maxBytes", "maxDepth"], "mdoc.verifyIssuerSigned");
   if (!Array.isArray(opts.algorithms) || opts.algorithms.length === 0) {
     throw new MdocError("mdoc/algorithms-required", "mdoc.verifyIssuerSigned: opts.algorithms is required");
   }
+  // Issuer authentication is the WHOLE point of verifyIssuerSigned. The signer
+  // cert rides in the attacker-supplied x5chain, so verifying the COSE_Sign1
+  // against that embedded key only proves the MSO is self-consistent — a forged
+  // mDL (attacker keypair, self-signed leaf, self-signed MSO) passes unless the
+  // chain is anchored to a configured trust root. Require trustAnchorsPem by
+  // default; an operator who genuinely wants trust-anchor-free verification must
+  // opt in EXPLICITLY (and gets issuerTrusted:false on the result so the
+  // unauthenticated posture is visible). Fail closed — never silently accept an
+  // unanchored issuer.
+  var hasAnchors = opts.trustAnchorsPem !== undefined && opts.trustAnchorsPem !== null;
+  if (!hasAnchors && opts.allowUntrustedIssuer !== true) {
+    throw new MdocError("mdoc/trust-anchors-required",
+      "mdoc.verifyIssuerSigned: opts.trustAnchorsPem is required to authenticate the issuer " +
+      "(the x5chain signer cert is attacker-controlled); pass trustAnchorsPem, or set " +
+      "allowUntrustedIssuer:true to explicitly accept an unauthenticated issuer");
+  }
   validateOpts.optionalDate(opts.at, "mdoc.verifyIssuerSigned: opts.at", MdocError, "mdoc/bad-at");
   var at = (opts.at !== undefined && opts.at !== null) ? opts.at : new Date();
   var decodeOpts = { allowedTags: ALLOWED_TAGS, maxBytes: opts.maxBytes, maxDepth: opts.maxDepth };
@@ -264,6 +281,10 @@ async function verifyIssuerSigned(issuerSigned, opts) {
     deviceKey:    deviceKey,
     signerCert:   signerCert.toString(),
     alg:          verified.alg,
+    // true only when the signer chain was validated against a configured trust
+    // anchor; false on the explicit allowUntrustedIssuer opt-out so a caller
+    // can tell an authenticated issuer from a merely self-consistent MSO.
+    issuerTrusted: hasAnchors,
   };
 }
 
@@ -409,8 +430,10 @@ function _verifyChain(chainDer, anchorsPem, at) {
   throw new MdocError("mdoc/chain-loop", "mdoc.verifyIssuerSigned: certificate chain did not terminate");
 }
 function _issued(issuer, subject) {
-  try { return subject.checkIssued(issuer) && subject.verify(issuer.publicKey); }
-  catch (_e) { return false; }
+  // Enforces basicConstraints cA:TRUE on the issuer alongside the
+  // checkIssued + signature linkage — an IACA/DS chain cannot accept a
+  // non-CA cert as an issuer (basicConstraints bypass, CVE-2002-0862 class).
+  return x509Chain.issuerValidlyIssued(issuer, subject);
 }
 function _assertValidAt(cert, atMs) {
   if (atMs < cert.validFromDate.getTime() || atMs > cert.validToDate.getTime()) {

package/lib/vendor/blamejs/lib/metrics.js

@@ -39,7 +39,6 @@
 
 var C = require("./constants");
 var canonicalJson = require("./canonical-json");
-var nodeFs   = require("node:fs");
 var atomicFile = require("./atomic-file");
 var safeJson = require("./safe-json");
 var { defineClass } = require("./framework-error");
@@ -1067,8 +1066,20 @@ function snapshotRead(p) {
     MetricsError, "metrics-snapshot/bad-path");
   var raw;
   try {
-    raw = nodeFs.readFileSync(p, "utf8");
+    // Capped fd-bound read: the snapshot is parsed AFTER read, so the cap must
+    // precede the alloc — a hostile multi-GB file at the snapshot path would
+    // otherwise OOM the reader before safeJson's 4 MiB parse cap is consulted.
+    raw = atomicFile.fdSafeReadSync(p, {
+      maxBytes: C.BYTES.mib(4), encoding: "utf8", refuseSymlink: true,
+      errorFor: function (kind, detail) {
+        if (kind === "enoent") return new MetricsError("metrics-snapshot/not-found", "metrics.snapshot.read: " + p + " — not found");
+        if (kind === "too-large") return new MetricsError("metrics-snapshot/too-large", "metrics.snapshot.read: " + p + " exceeds " + detail.max + " bytes");
+        if (kind === "symlink") return new MetricsError("metrics-snapshot/symlink-refused", "metrics.snapshot.read: " + p + " is a symlink (refused)");
+        return undefined;
+      },
+    });
   } catch (e) {
+    if (e instanceof MetricsError) throw e;
     throw new MetricsError("metrics-snapshot/not-found",
       "metrics.snapshot.read: " + p + " — " + (e && e.message ? e.message : String(e)));
   }
@@ -1329,7 +1340,7 @@ function shadowRegistry(opts) {
   var gaugeSet   = _shadowSetOf(opts.gauges,   "gauges");
   var infoSet    = _shadowSetOf(opts.info,     "info");
   var cap = opts.cardinalityCap === undefined ? SHADOW_DEFAULT_CARDINALITY : opts.cardinalityCap;
-  if (typeof cap !== "number" || !isFinite(cap) || cap < 1 || Math.floor(cap) !== cap) {
+  if (!numericBounds.isPositiveFiniteInt(cap)) {
     throw new MetricsError("metrics-shadow/bad-cap",
       "shadowRegistry: cardinalityCap must be a positive integer");
   }

package/lib/vendor/blamejs/lib/middleware/api-encrypt.js

@@ -556,7 +556,7 @@ function create(opts) {
           _emitFailure(req, "shape");
           return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
-        if (typeof ctr !== "number" || !isFinite(ctr) || ctr < 0 || Math.floor(ctr) !== ctr) {
+        if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
           _emitFailure(req, "shape");
           return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
@@ -596,7 +596,7 @@ function create(opts) {
         _emitFailure(req, "shape");
         return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }
-      if (!isFinite(ctr) || ctr < 0 || Math.floor(ctr) !== ctr) {
+      if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
         _emitFailure(req, "shape");
         return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }

package/lib/vendor/blamejs/lib/middleware/body-parser.js

@@ -269,13 +269,19 @@ function _contentType(req) {
 }
 
 function _typeMatches(actual, allowed) {
+  var ab = actual.split("/");
   for (var i = 0; i < allowed.length; i++) {
     var a = allowed[i].toLowerCase();
-    // Match either exact type or "type/*" prefix
+    // Exact match, or component-wise wildcard where `*` in either the type or
+    // subtype segment matches any value — so "*/*" (the raw() default) matches
+    // every type, "type/*" matches a whole type, and "*/json" matches a
+    // subtype across types. (A literal indexOf on "*/" never matched a real
+    // Content-Type, which made the "*/*" default reject every request.)
     if (a === actual) return true;
-    var slash = a.indexOf("/");
-    if (slash !== -1 && a.slice(slash + 1) === "*" &&
-        actual.indexOf(a.slice(0, slash + 1)) === 0) return true;
+    var pb = a.split("/");
+    if (pb.length === 2 && ab.length === 2 &&
+        (pb[0] === "*" || pb[0] === ab[0]) &&
+        (pb[1] === "*" || pb[1] === ab[1])) return true;
   }
   return false;
 }

package/lib/vendor/blamejs/lib/middleware/bot-guard.js

@@ -71,17 +71,6 @@ function _coerceAgentPattern(r, where) {
     "in operator code)");
 }
 
-// Bot-guard's "trust the proxy header" semantics for actor.ip — the
-// audit event records the apparent source even when behind a CDN, but
-// only when the operator opts in to trustProxy. Without the opt, we
-// stick to socket.remoteAddress so an attacker-forged XFF can't
-// pollute audit attribution.
-function _xffIpFor(trustProxy) {
-  return function (req) {
-    return requestHelpers.clientIp(req, { trustProxy: trustProxy });
-  };
-}
-
 /**
  * @primitive b.middleware.botGuard
  * @signature b.middleware.botGuard(req, res, next)
@@ -115,7 +104,10 @@ function _xffIpFor(trustProxy) {
  *     bodyOnBlock:   string,
  *     onDeny:        function(req, res, info): void,  // own the block response; info = { status, reason }
  *     problemDetails: boolean,          // default false — emit RFC 9457 application/problem+json instead of text/plain
- *     trustProxy:    boolean|number,
+ *     trustedProxies: string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-For / -Proto
+ *     clientIpResolver: function(req): string|null,    // own the audit-actor IP
+ *     protocolResolver: function(req): "http"|"https", // own the secure-context decision
+ *     trustProxy:    boolean|number,    // legacy; refused unless paired with trustedProxies/resolver (spoofable)
  *   }
  *
  * @example
@@ -131,11 +123,26 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "mode", "onlyForHtml", "allowedAgents", "blockedAgents",
-    "skipPaths", "statusOnBlock", "bodyOnBlock", "onDeny", "problemDetails", "trustProxy",
+    "skipPaths", "statusOnBlock", "bodyOnBlock", "onDeny", "problemDetails",
+    "trustProxy", "trustedProxies", "clientIpResolver", "protocolResolver",
   ], "middleware.botGuard");
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _xffIp = _xffIpFor(trustProxy);
+  // The single trustProxy opt drives two forwarded-header reads: the audit
+  // actor.ip (X-Forwarded-For) and the secure-context check (X-Forwarded-Proto,
+  // see _isSecureContext). Both are peer-gated — declare your reverse proxies
+  // via trustedProxies (CIDRs), or own resolution via clientIpResolver /
+  // protocolResolver. A bare trustProxy is refused: it would trust forgeable
+  // headers from any caller.
+  var _ipResolver, _proto;
+  try {
+    _ipResolver = requestHelpers.trustedClientIp({ trustedProxies: opts.trustedProxies, clientIpResolver: opts.clientIpResolver });
+    _proto      = requestHelpers.trustedProtocol({ trustedProxies: opts.trustedProxies, protocolResolver: opts.protocolResolver });
+  } catch (e) { throw new BotGuardError("bot-guard/bad-opt", e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_ipResolver.peerGated) {
+    throw new BotGuardError("bot-guard/bad-opt",
+      "trustProxy is spoofable — a direct caller could forge X-Forwarded-For / -Proto. Declare " +
+      "your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] or supply clientIpResolver / protocolResolver.");
+  }
+  var _xffIp = _ipResolver.resolve;
   var mode = opts.mode || "block";
   var onlyForHtml = opts.onlyForHtml !== false;
   var allowedAgents = (opts.allowedAgents || []).map(function (r, i) {
@@ -163,9 +170,10 @@ function create(opts) {
   // app, a LAN / *.local reverse-proxy deployment — the browser omits
   // Sec-Fetch-* entirely, so a missing Sec-Fetch-Mode is NORMAL there and
   // must not be read as a bot signal. The effective scheme honours
-  // X-Forwarded-Proto only under trustProxy (otherwise it is forgeable).
+  // X-Forwarded-Proto only from a trusted proxy peer (peer-gated), else the
+  // real TLS socket — a direct caller's forged header is ignored.
   function _isSecureContext(req) {
-    if (requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https") return true;
+    if (_proto.resolve(req) === "https") return true;
     var host = (req.headers && req.headers.host) || "";
     host = String(host).toLowerCase().replace(/:\d+$/, "");   // strip :port
     if (host.charAt(0) === "[") {                              // [::1] IPv6 literal

package/lib/vendor/blamejs/lib/middleware/clear-site-data.js

@@ -113,7 +113,11 @@ function headerValue(types, label) {
   }
   for (var i = 0; i < types.length; i += 1) {
     var t = types[i];
-    if (typeof t !== "string" || !KNOWN_TYPES[t]) {
+    // hasOwnProperty, not `KNOWN_TYPES[t]`: a bracket lookup on the plain-object
+    // allowlist resolves inherited members ("toString" / "constructor" /
+    // "hasOwnProperty") to truthy functions, so those would pass validation and
+    // be emitted as bogus Clear-Site-Data directives (prototype shadowing).
+    if (typeof t !== "string" || !Object.prototype.hasOwnProperty.call(KNOWN_TYPES, t)) {
       throw new TypeError(
         label + ": unknown type '" + t +
         "' (expected one of: " + Object.keys(KNOWN_TYPES).join(", ") + ")");

package/lib/vendor/blamejs/lib/middleware/compression.js

@@ -328,6 +328,15 @@ function create(opts) {
       // Status precludes body? skip.
       if (NO_BODY_STATUS.has(statusCode)) { compress = false; return; }
 
+      // 206 Partial Content / any Content-Range response must pass through
+      // UNtransformed (RFC 7233 §4.1) — compressing it drops Content-Length but
+      // leaves Content-Range advertising an uncompressed byte interval over a
+      // now-compressed body, corrupting range-assembling clients.
+      if (statusCode === 206) { compress = false; return; }
+      var crRange = (headersObj && headersObj["content-range"]) ||
+                    (originalGetHeader && originalGetHeader("Content-Range"));
+      if (crRange) { compress = false; return; }
+
       // Already compressed by the handler / earlier middleware? skip.
       var existingCE = (headersObj && headersObj["content-encoding"]) ||
                        (originalGetHeader && originalGetHeader("Content-Encoding"));

package/lib/vendor/blamejs/lib/middleware/cors.js

@@ -58,15 +58,6 @@ var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 
-// CORS audit events use the proxy-aware client IP only when the
-// operator opts in via `trustProxy`. Default refuses forwarded
-// headers — same boundary as the rest of the v0.5.3 trustProxy sweep.
-function _xffIpFor(trustProxy) {
-  return function (req) {
-    return requestHelpers.clientIp(req, { trustProxy: trustProxy });
-  };
-}
-
 var CorsError = defineClass("CorsError", { alwaysPermanent: true });
 
 // allowList entries:
@@ -117,17 +108,18 @@ function _canonicalOrigin(input) {
 // supplied. Works for direct deployments (no proxy); operators behind
 // a TLS-terminating proxy that doesn't forward correct Host should set
 // opts.siteOrigin explicitly.
-function _inferRequestOrigin(req, trustProxy) {
+function _inferRequestOrigin(req, protoResolve) {
   if (!req || !req.headers) return null;
   var host = req.headers.host;
   if (!host) return null;
-  // Protocol resolution honors the operator's trustProxy opt — without
-  // it, X-Forwarded-Proto is ignored as attacker-forgeable.
-  var proto = requestHelpers.requestProtocol(req, { trustProxy: trustProxy });
+  // Peer-gated protocol resolution — X-Forwarded-Proto is honored only from a
+  // trusted proxy (else the TLS socket), so a direct caller can't forge the
+  // inferred origin's scheme to slip past the same-origin check.
+  var proto = protoResolve(req);
   return _canonicalOrigin(proto + "://" + host);
 }
 
-function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, strictNullOrigin) {
+function _isSameOrigin(req, originHeader, configuredSiteOrigins, protoResolve, strictNullOrigin) {
   // Origin: null arrives when a browser opaques the Origin (e.g.
   // Referrer-Policy: no-referrer on the page). Sec-Fetch-Site can
   // distinguish the same-origin case, but non-browser clients can forge
@@ -150,10 +142,10 @@ function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, str
     }
     return false;
   }
-  // Fall back to inferring from the request itself. trustProxy threads
-  // through so operators behind a TLS terminator with X-Forwarded-Proto
-  // can opt in to consult the header.
-  var reqOrigin = _inferRequestOrigin(req, trustProxy);
+  // Fall back to inferring from the request itself. The peer-gated protocol
+  // resolver threads through so operators behind a TLS terminator consult
+  // X-Forwarded-Proto only from a trusted peer.
+  var reqOrigin = _inferRequestOrigin(req, protoResolve);
   return reqOrigin !== null && reqOrigin === canonOrigin;
 }
 
@@ -185,7 +177,10 @@ function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, str
  *     maxAgeSeconds:    number,     // default 600
  *     refuseUnknown:    boolean,    // default true
  *     strictNullOrigin: boolean,    // default true
- *     trustProxy:       boolean|number,
+ *     trustedProxies:   string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto for same-origin inference
+ *     protocolResolver: function(req): "http"|"https",  // own the HTTPS decision
+ *     clientIpResolver: function(req): string|null,     // own the audit-actor IP
+ *     trustProxy:       boolean|number,    // legacy; refused unless paired with trustedProxies/resolver (spoofable)
  *     onDeny:           function(req, res, info): void,  // own every refusal; info = { status, reason, origin, header? }
  *     problemDetails:   boolean,    // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
@@ -205,11 +200,25 @@ function create(opts) {
   validateOpts(opts, [
     "origins", "siteOrigin", "methods", "headers", "exposeHeaders",
     "credentials", "maxAgeSeconds", "refuseUnknown", "trustProxy",
+    "trustedProxies", "clientIpResolver", "protocolResolver",
     "strictNullOrigin", "allowPrivateNetwork", "onDeny", "problemDetails",
   ], "middleware.cors");
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _xffIp = _xffIpFor(trustProxy);
+  // The request scheme feeds the same-origin determination, and a bare
+  // trustProxy trusts a forgeable X-Forwarded-Proto from any caller. Peer-gate
+  // both protocol and the audit-actor IP via trustedProxies (CIDRs) or own them
+  // via protocolResolver / clientIpResolver. A bare trustProxy is refused.
+  var _proto, _ip;
+  try {
+    _proto = requestHelpers.trustedProtocol({ trustedProxies: opts.trustedProxies, protocolResolver: opts.protocolResolver });
+    _ip    = requestHelpers.trustedClientIp({ trustedProxies: opts.trustedProxies, clientIpResolver: opts.clientIpResolver });
+  } catch (e) { throw new CorsError("cors/bad-opt", e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_proto.peerGated) {
+    throw new CorsError("cors/bad-opt",
+      "trustProxy is spoofable — a direct caller could forge X-Forwarded-Proto to alter the " +
+      "same-origin decision. Declare your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] " +
+      "or supply protocolResolver(req) / clientIpResolver(req).");
+  }
+  var _xffIp = _ip.resolve;
 
   // Build a canonicalized allowList at create() time. String entries
   // get parsed through _canonicalOrigin so case + default-port
@@ -296,7 +305,7 @@ function create(opts) {
     // Same-origin POST/PUT/etc. carry an Origin header per the Fetch
     // spec but should not be subject to CORS allow-listing — they're
     // the operator's own site talking to itself.
-    if (_isSameOrigin(req, origin, siteOrigins, trustProxy, strictNullOrigin)) return next();
+    if (_isSameOrigin(req, origin, siteOrigins, _proto.resolve, strictNullOrigin)) return next();
 
     var matched = _matchOrigin(origin, origins);
     if (!matched) {

package/lib/vendor/blamejs/lib/middleware/csrf-protect.js

@@ -77,6 +77,9 @@ var audit = lazyRequire(function () { return require("../audit"); });
 var DEFAULT_FIELD_NAME    = "_csrf";
 var DEFAULT_HEADER_NAME   = "X-CSRF-Token";
 var DEFAULT_METHODS       = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
+// Per-process counter giving each csrfProtect mount a unique idempotency id so
+// a stricter sub-route instance is not silently disabled by an earlier one.
+var _csrfGateSeq = 0;
 
 // Default cookie name uses the RFC 6265bis __Host- prefix when the request
 // is over HTTPS. The prefix forces browsers to refuse the cookie unless
@@ -124,17 +127,6 @@ function _parseCookieHeader(header) {
   return Object.assign(Object.create(null), Object.fromEntries(pairs));
 }
 
-// `_isHttps` defers to `requestHelpers.requestProtocol` so the
-// per-middleware `trustProxy` opt gates whether X-Forwarded-Proto is
-// consulted. Without trustProxy, an attacker could otherwise forge
-// the header to force the Secure cookie attribute (and inversely,
-// suppress it) on direct-to-server connections.
-function _isHttpsFor(trustProxy) {
-  return function (req) {
-    return requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https";
-  };
-}
-
 function _formatSetCookie(name, value, opts) {
   var parts = [name + "=" + value];
   parts.push("Path=" + (opts.path || "/"));
@@ -275,7 +267,9 @@ function _writeReject(req, res, message, reason, onDeny, problemMode) {
  *     allowedOrigins:         string[],
  *     requireOrigin:          boolean,
  *     requireJsonContentType: boolean,
- *     trustProxy:             boolean|number,
+ *     trustedProxies:         string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto for the Secure-cookie decision
+ *     protocolResolver:       function(req): "http"|"https",  // own the HTTPS decision
+ *     trustProxy:             boolean|number,    // legacy; refused unless paired with trustedProxies/protocolResolver (spoofable)
  *     audit:                  boolean,
  *     skipStateless:          boolean,   // default false — skip validation for Authorization-header / cookieless (not-CSRF-able) requests
  *     onDeny:                 function(req, res, info): void,  // own the 403; info = { status, reason }
@@ -296,14 +290,31 @@ function create(opts) {
 
   validateOpts(opts, [
     "cookie", "tokenLookup", "fieldName", "headerName", "methods", "audit",
-    "trustProxy", "checkOrigin", "allowedOrigins", "requireJsonContentType",
+    "trustProxy", "trustedProxies", "protocolResolver",
+    "checkOrigin", "allowedOrigins", "requireJsonContentType",
     "requireOrigin", "skipStateless", "skipPaths", "skip", "onDeny", "problemDetails",
   ], "middleware.csrfProtect");
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _isHttps = _isHttpsFor(trustProxy);
+  // The Secure-cookie decision turns on whether the request is HTTPS, which
+  // behind a proxy comes from X-Forwarded-Proto. A bare trustProxy trusts that
+  // forgeable header from any caller — a direct request could suppress the
+  // Secure flag (cookie downgrade) or force it. Peer-gate it: declare your
+  // reverse proxies via trustedProxies, or own the decision via
+  // protocolResolver. A bare trustProxy is refused at construction.
+  var _proto;
+  try {
+    _proto = requestHelpers.trustedProtocol({
+      trustedProxies:   opts.trustedProxies,
+      protocolResolver: opts.protocolResolver,
+    });
+  } catch (e) { throw new Error("middleware.csrfProtect: " + e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_proto.peerGated) {
+    throw new Error("middleware.csrfProtect: trustProxy is spoofable for the Secure-cookie " +
+      "decision — a direct caller could forge X-Forwarded-Proto. Declare your reverse proxies " +
+      "via trustedProxies: [\"10.0.0.0/8\", …] or supply protocolResolver(req).");
+  }
+  function _isHttps(req) { return _proto.resolve(req) === "https"; }
 
   // Throw at create() — exactly one issuance source allowed.
   var hasCookie = opts.cookie != null && opts.cookie !== false;
@@ -318,8 +329,22 @@ function create(opts) {
 
   var fieldName  = opts.fieldName  || DEFAULT_FIELD_NAME;
   var headerName = (opts.headerName || DEFAULT_HEADER_NAME).toLowerCase();
+  // An empty methods array is truthy → `opts.methods || DEFAULT_METHODS` keeps
+  // `[]` and the method-gate matches nothing, silently disabling the primary
+  // CSRF check for all state-changing requests. Reject at config time.
+  if (opts.methods !== undefined) {
+    if (!Array.isArray(opts.methods) || opts.methods.length === 0 ||
+        !opts.methods.every(function (m) { return typeof m === "string" && m.length > 0; })) {
+      throw new Error("middleware.csrfProtect: opts.methods must be a non-empty array of HTTP method tokens (omit it for the POST/PUT/DELETE/PATCH default)");
+    }
+  }
   var methods    = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
   var auditOn    = opts.audit !== false;
+  // Per-instance idempotency id — a stricter sub-route csrf mount must not be
+  // silently disabled by an earlier lenient one sharing a global flag (token
+  // issue is idempotent and double-validate is safe, so per-instance re-run is
+  // sound).
+  var GATE_ID = "csrf:" + (_csrfGateSeq++);
 
   // Origin / Referer cross-check — second-line defense alongside the
   // double-submit token. If the request's Origin (or Referer when
@@ -452,6 +477,17 @@ function create(opts) {
       req.csrfToken = existing;
       return existing;
     }
+    // Cookie issuance is idempotent at the RESPONSE level, keyed by cookie
+    // name: a redundant mount (createApp wired csrf AND an operator re-mounted
+    // it with the same cookie name) must emit a single Set-Cookie, not one per
+    // instance. Enforcement stays per instance (each gate still validates the
+    // token below) — only the response-cookie resource is deduped, so a mount
+    // with a DIFFERENT cookie name still issues its own.
+    if (!req._csrfIssuedCookies) req._csrfIssuedCookies = Object.create(null);
+    if (Object.prototype.hasOwnProperty.call(req._csrfIssuedCookies, cookieName)) {
+      req.csrfToken = req._csrfIssuedCookies[cookieName];
+      return req.csrfToken;
+    }
     if (existing && !/^[a-f0-9]{64}$/.test(existing)) {
       // Audit-emit so operators see when a planted/short cookie is
       // refused — surfaces the attack class in compliance logs.
@@ -472,16 +508,19 @@ function create(opts) {
       maxAge:   cookieCfg.maxAge,
     });
     _appendSetCookie(res, setCookie);
+    req._csrfIssuedCookies[cookieName] = fresh;
     req.csrfToken = fresh;
     return fresh;
   }
 
   return function csrfProtect(req, res, next) {
-    // Idempotent: a second csrf mount this request (e.g. createApp wired
-    // it AND an operator mounted it again) is a no-op — the first instance
-    // already issued + validated.
-    if (req._csrfApplied) return next();
-    req._csrfApplied = true;
+    // Idempotent PER INSTANCE: the SAME mount running twice (createApp wired it
+    // AND an operator mounted it again) is a no-op, but a distinct stricter
+    // sub-route instance still runs — a shared global flag let the first
+    // (lenient) mount disable the second.
+    if (!req._csrfGates) req._csrfGates = Object.create(null);
+    if (req._csrfGates[GATE_ID]) return next();
+    req._csrfGates[GATE_ID] = true;
 
     // Issue/refresh the token on EVERY request (safe + state-changing)
     // when running in cookie mode — templates rendered after a POST

package/lib/vendor/blamejs/lib/middleware/daily-byte-quota.js

@@ -187,13 +187,15 @@ function create(opts) {
     // is observed via writableLength as res.write / res.end fire.
     var inboundBytes = 0;
     if (req.headers && typeof req.headers === "object") {
-      // Approximate: each header line is "Name: Value\r\n". Sum the
-      // string lengths; the actual byte count differs only on multi-
-      // byte UTF-8, which is uncommon in standard headers.
+      // Each header line is "Name: Value\r\n". Count UTF-8 BYTES (not .length
+      // / UTF-16 code units) so a multibyte header value isn't under-accounted
+      // against the byte quota — matching the outbound counting below, which
+      // already uses Buffer.byteLength.
       var keys = Object.keys(req.headers);
       for (var hi = 0; hi < keys.length; hi++) {
         var v = req.headers[keys[hi]];
-        inboundBytes += keys[hi].length + 2 + (typeof v === "string" ? v.length : 0) + 2;        // ": " + "\r\n" overhead
+        inboundBytes += Buffer.byteLength(keys[hi], "utf8") + 2 +
+          (typeof v === "string" ? Buffer.byteLength(v, "utf8") : 0) + 2;                         // ": " + "\r\n" overhead
       }
     }
     if (req.headers && req.headers["content-length"]) {