@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/lib/middleware/fetch-metadata.js

@@ -42,6 +42,10 @@ var audit = lazyRequire(function () { return require("../audit"); });
 var observability = lazyRequire(function () { return require("../observability"); });
 
 var DEFAULT_METHODS = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
+// Monotonic per-process counter giving each fetchMetadata mount a unique
+// idempotency id (see GATE_ID in create) so a stricter sub-route instance is
+// not silently disabled by an earlier lenient one sharing a global flag.
+var _fmGateSeq = 0;
 
 // Sec-Fetch-Dest request-destination vocabulary (Fetch Standard §3.2.6
 // "destination", https://fetch.spec.whatwg.org/#concept-request-destination;
@@ -81,7 +85,7 @@ function _validateDestList(list, label) {
   // the typo surfaces before it silently fails to match at request time.
   if (!Array.isArray(list)) return;
   for (var i = 0; i < list.length; i += 1) {
-    if (!KNOWN_DEST_SET[list[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_DEST_SET, list[i])) {
       throw new Error("middleware.fetchMetadata: " + label + "[" + i +
         "] is not a known Sec-Fetch-Dest value (got '" + String(list[i]) +
         "'). Known destinations: " + KNOWN_DESTINATIONS.join(", ") + ".");
@@ -206,8 +210,26 @@ function create(opts) {
     }
   }
   var allowedNavigate = opts.allowedNavigate !== false;
+  // An empty methods array is truthy, so `opts.methods || DEFAULT_METHODS`
+  // would keep `[]` and `methods.indexOf(req.method) === -1` would be true for
+  // EVERY request — silently turning the gate into a pass-through. Reject a
+  // present-but-empty/garbage list at config time (fail-fast, don't degrade
+  // the gate to a no-op).
+  if (opts.methods !== undefined) {
+    if (!Array.isArray(opts.methods) || opts.methods.length === 0 ||
+        !opts.methods.every(function (m) { return typeof m === "string" && m.length > 0; })) {
+      throw new Error("middleware.fetchMetadata: opts.methods must be a non-empty array of HTTP method tokens (omit it for the POST/PUT/DELETE/PATCH default)");
+    }
+  }
   var methods         = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
   var auditOn         = opts.audit !== false;
+  // Per-instance idempotency id: a request carries a Set of gates that have
+  // already run. The OLD shared `req._fetchMetadataChecked` boolean let the
+  // FIRST fetch-metadata mount (e.g. the lenient app-level default) permanently
+  // disable a STRICTER instance layered on a sub-route. Keying by a unique id
+  // lets each distinct mount run once while the SAME instance mounted twice
+  // still no-ops.
+  var GATE_ID = "fm:" + (_fmGateSeq++);
 
   function _emitDenied(req, reason) {
     if (!auditOn) return;
@@ -223,9 +245,11 @@ function create(opts) {
   }
 
   return function fetchMetadata(req, res, next) {
-    // Idempotent: a second fetch-metadata mount this request is a no-op.
-    if (req._fetchMetadataChecked) return next();
-    req._fetchMetadataChecked = true;
+    // Idempotent PER INSTANCE: the same mount running twice on a request is a
+    // no-op, but a distinct (e.g. stricter sub-route) instance still evaluates.
+    if (!req._fetchMetadataGates) req._fetchMetadataGates = Object.create(null);
+    if (req._fetchMetadataGates[GATE_ID]) return next();
+    req._fetchMetadataGates[GATE_ID] = true;
     if (_shouldSkip(req)) return next();
     if (methods.indexOf(req.method) === -1) return next();
 

package/lib/vendor/blamejs/lib/middleware/network-allowlist.js

@@ -16,12 +16,12 @@
  * the wiki example default).
  *
  *   var fence = b.middleware.networkAllowlist({
- *     paths:        ["/admin", "/admin/", "/healthz/internal"],
- *     allowedCidrs: ["10.0.0.0/8", "192.168.0.0/16", "::1/128"],
- *     trustProxy:   true,         // honour x-forwarded-for; default false
- *     denyStatus:   404,          // default — reveal nothing about the gate
- *     denyBody:     "Not Found",  // default
- *     audit:        b.audit,      // default: null — emits network.gate.denied
+ *     paths:          ["/admin", "/admin/", "/healthz/internal"],
+ *     allowedCidrs:   ["10.0.0.0/8", "192.168.0.0/16", "::1/128"],
+ *     trustedProxies: ["10.0.0.0/8"], // peer-gate XFF to your proxy range
+ *     denyStatus:     404,            // default — reveal nothing about the gate
+ *     denyBody:       "Not Found",    // default
+ *     audit:          b.audit,        // default: null — emits network.gate.denied
  *   });
  *
  *   router.use(fence);
@@ -29,9 +29,11 @@
  * Behaviour:
  *   - The middleware is path-scoped: requests whose pathname doesn't
  *     start with any of `paths` pass through unchanged. Hot-path-cheap.
- *   - Requests on a gated path get their client IP resolved through
- *     b.requestHelpers.clientIp(req, { trustProxy }) — same trust
- *     model as every other middleware that reads client IP.
+ *   - Requests on a gated path get their client IP resolved peer-gated:
+ *     the socket address by default, or — when `trustedProxies` /
+ *     `clientIpResolver` is set — X-Forwarded-For honored only from a
+ *     trusted proxy peer. A bare `trustProxy` is refused at construction
+ *     because it would let a direct caller forge an allowed address.
  *   - The IP is checked against the CIDR allowlist using
  *     b.ssrfGuard.cidrContains. A miss returns denyStatus + denyBody
  *     and audits the rejection. Default 404 hides the gate's
@@ -84,38 +86,47 @@ function _validateCidr(cidr) {
  * authorization prevents unauthorized USERS from reaching sensitive
  * routes; this middleware adds a NETWORK-layer fence so a credential
  * leak doesn't compromise the gate. Path-scoped — requests outside
- * the configured prefixes pass through hot-path-cheap. Resolves
- * client IP via `b.requestHelpers.clientIp` (with `trustProxy`),
- * checks against the CIDR allowlist via `b.ssrfGuard.cidrContains`,
- * and refuses misses with HTTP 404 by default (hides the gate from
- * probes). Throws at create-time on malformed opts.
+ * the configured prefixes pass through hot-path-cheap. Checks the
+ * resolved client IP against the CIDR allowlist via
+ * `b.ssrfGuard.cidrContains` and refuses misses with HTTP 404 by
+ * default (hides the gate from probes). Throws at create-time on
+ * malformed opts.
+ *
+ * Client-IP resolution is peer-gated. By default only the socket
+ * address is used — X-Forwarded-For is attacker-forgeable, so trusting
+ * it bare would let a direct caller spoof an allowed IP through the
+ * gate. Behind a reverse proxy, declare it with `trustedProxies`
+ * (CIDRs — XFF is then honored only when the immediate peer is one of
+ * them) or own resolution entirely with `clientIpResolver(req)`. A bare
+ * `trustProxy` is refused at construction.
  *
  * @opts
  *   {
- *     paths:        string[],   // pathname prefixes, required
- *     allowedCidrs: string[],   // required
- *     deniedCidrs:  string[],
- *     trustProxy:   boolean,    // default false
- *     denyStatus:   number,     // default 404
- *     denyBody:     string,     // default "Not Found"
- *     audit:        object,
- *     onDeny:       function(req, res, info): void,  // own the refusal; info = { status, reason, clientIp, route }
- *     problemDetails: boolean,  // default false — emit RFC 9457 application/problem+json instead of text/plain
+ *     paths:           string[],   // pathname prefixes, required
+ *     allowedCidrs:    string[],   // required
+ *     deniedCidrs:     string[],
+ *     trustedProxies:  string[],   // CIDRs of your reverse proxies — peer-gates X-Forwarded-For
+ *     clientIpResolver: function(req): string|null,  // own client-IP resolution
+ *     denyStatus:      number,     // default 404
+ *     denyBody:        string,     // default "Not Found"
+ *     audit:           object,
+ *     onDeny:          function(req, res, info): void,  // own the refusal; info = { status, reason, clientIp, route }
+ *     problemDetails:  boolean,    // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
  *
  * @example
  *   var b = require("@blamejs/core");
  *   var app = b.router.create();
  *   app.use(b.middleware.networkAllowlist({
- *     paths:        ["/admin"],
- *     allowedCidrs: ["10.0.0.0/8", "::1/128"],
- *     trustProxy:   true,
+ *     paths:          ["/admin"],
+ *     allowedCidrs:   ["10.0.0.0/8", "::1/128"],
+ *     trustedProxies: ["10.0.0.0/8"],   // your reverse proxy's range
  *   }));
  */
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
-    "paths", "allowedCidrs", "deniedCidrs", "trustProxy",
+    "paths", "allowedCidrs", "deniedCidrs", "trustProxy", "trustedProxies", "clientIpResolver",
     "denyStatus", "denyBody", "audit", "onDeny", "problemDetails",
   ], "middleware.networkAllowlist");
 
@@ -148,10 +159,30 @@ function create(opts) {
     }
   }
 
+  // Client-IP resolution for an access-control gate must be peer-gated:
+  // a bare `trustProxy` honors X-Forwarded-For from any caller, so a client
+  // connecting directly can forge an allowed address and walk through the
+  // gate. Operators behind a reverse proxy declare it via `trustedProxies`
+  // (CIDRs of their proxies — XFF is then peer-gated) or own resolution
+  // entirely via `clientIpResolver`. We refuse, at construction, the
+  // spoofable combination of `trustProxy` without either.
+  var _ipResolver;
+  try {
+    _ipResolver = requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    });
+  } catch (e) { throw _err("BAD_OPT", e.message); }
+  var trustProxyOpt = opts.trustProxy === true || typeof opts.trustProxy === "number";
+  if (trustProxyOpt && !_ipResolver.peerGated) {
+    throw _err("BAD_OPT",
+      "trustProxy is spoofable for an access-control gate — X-Forwarded-For from a " +
+      "direct caller would be trusted. Declare your reverse proxies via " +
+      "trustedProxies: [\"10.0.0.0/8\", …] (peer-gated XFF) or supply clientIpResolver(req).");
+  }
+
   var paths        = opts.paths.slice();
   var allowedCidrs = opts.allowedCidrs.slice();
-  var trustProxy   = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
   var denyStatus   = typeof opts.denyStatus === "number" ? opts.denyStatus : 404;
   if (denyStatus < 400 || denyStatus >= 600 || Math.floor(denyStatus) !== denyStatus) {
     throw _err("BAD_OPT", "denyStatus must be a 4xx or 5xx integer, got " + denyStatus);
@@ -212,7 +243,7 @@ function create(opts) {
     var pathname = req.pathname || (req.url || "").split("?")[0];
     if (!_matchesPath(pathname)) return next();
 
-    var ip = requestHelpers.clientIp(req, { trustProxy: trustProxy });
+    var ip = _ipResolver.resolve(req);
     if (!ip) {
       // Fail closed: a request we can't even derive an IP for shouldn't
       // bypass the gate.

package/lib/vendor/blamejs/lib/middleware/rate-limit.js

@@ -118,17 +118,6 @@ function _conflictRefs(dialect, table) {
 var audit  = lazyRequire(function () { return require("../audit"); });
 var logger = lazyRequire(function () { return require("../log").boot("rate-limit"); });
 
-// `_clientIp` defers to `requestHelpers.clientIp`, threading the
-// per-middleware `trustProxy` opt. Default refuses forwarded headers
-// (returning the socket address only) — operators behind a sanitizing
-// reverse proxy opt in via `trustProxy: true` (or a hop count).
-function _clientIpFor(trustProxy) {
-  return function (req) {
-    var ip = requestHelpers.clientIp(req, { trustProxy: trustProxy });
-    return ip || "unknown";
-  };
-}
-
 // Reject NaN / Infinity / negative / non-positive / non-number at create
 // time so a misconfigured rate-limit can't silently degrade to "no
 // limit" or produce divide-by-zero verdicts at request time.
@@ -457,7 +446,9 @@ function _resolveBackend(opts) {
  *     limit:           number,
  *     windowMs:        number,
  *     pruneIntervalMs: number,
- *     trustProxy:      boolean|number,
+ *     trustedProxies:  string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-For for the IP key
+ *     clientIpResolver: function(req): string|null,  // own the rate-limit key's client IP
+ *     trustProxy:      boolean|number,   // legacy; refused with the default IP key (spoofable) — use trustedProxies
  *   }
  *
  * @example
@@ -475,15 +466,33 @@ function create(opts) {
   validateOpts(opts, [
     "keyFn", "statusOnLimit", "bodyOnLimit", "onDeny", "problemDetails",
     "header", "headerPrefix", "skipPaths", "scope",
-    "backend", "trustProxy", "algorithm",
+    "backend", "trustProxy", "trustedProxies", "clientIpResolver", "algorithm",
     // memory backend (token-bucket)
     "burst", "refillPerSecond",
     // memory backend (fixed-window) + cluster backend
     "max", "limit", "windowMs", "pruneIntervalMs",
   ], "middleware.rateLimit");
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _clientIp = _clientIpFor(trustProxy);
+  // Peer-gated client-IP resolution. The default key (and the audit-actor
+  // IP) is the client address; a bare trustProxy would let a caller forge
+  // X-Forwarded-For to evade their own limit or poison a victim's bucket.
+  // Operators behind a proxy declare trustedProxies (CIDRs) or own
+  // resolution via clientIpResolver. A bare trustProxy is refused when the
+  // default IP key is in use (no keyFn) — it would be spoofable.
+  var _ipResolver;
+  try {
+    _ipResolver = requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    });
+  } catch (e) { throw new Error("middleware.rateLimit: " + e.message); }
+  var trustProxyBare = opts.trustProxy === true || typeof opts.trustProxy === "number";
+  if (trustProxyBare && !_ipResolver.peerGated && !opts.keyFn) {
+    throw new Error("middleware.rateLimit: trustProxy is spoofable — a caller can forge " +
+      "X-Forwarded-For to evade the limit or poison another IP's bucket. Declare your " +
+      "reverse proxies via trustedProxies: [\"10.0.0.0/8\", …], supply clientIpResolver(req), " +
+      "or set your own keyFn.");
+  }
+  var _clientIp = function (req) { return _ipResolver.resolve(req) || "unknown"; };
   var keyFn = opts.keyFn || _clientIp;
   var statusOnLimit = opts.statusOnLimit || 429;
   var bodyOnLimit = opts.bodyOnLimit !== undefined ? opts.bodyOnLimit : "Too Many Requests";

package/lib/vendor/blamejs/lib/middleware/scim-server.js

@@ -4,6 +4,7 @@
 // + /Schemas surfaces backed by operator-supplied CRUD callbacks.
 
 var framework_error = require("../framework-error");
+var numericBounds   = require("../numeric-bounds");
 var pick            = require("../pick");
 var validateOpts    = require("../validate-opts");
 var safeJson        = require("../safe-json");
@@ -609,7 +610,7 @@ function _anyDependencyFailed(refs, plan, executed, bulkIdMap) {
 // RFC 7644 §3.7 — failOnErrors is an OPTIONAL integer >= 1. Absent /
 // non-conforming values mean "process every operation" (null).
 function _parseFailOnErrors(value) {
-  if (typeof value !== "number" || !isFinite(value) || Math.floor(value) !== value || value < 1) {
+  if (!numericBounds.isPositiveFiniteInt(value)) {
     return null;
   }
   return value;

package/lib/vendor/blamejs/lib/middleware/security-headers.js

@@ -210,7 +210,9 @@ function _validatePermissionsPolicy(value) {
  *     acceptCh:           string|false,
  *     criticalCh:         string|false,
  *     reportingEndpoints: object,
- *     trustProxy:         boolean|number,
+ *     trustedProxies:     string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto for HSTS
+ *     protocolResolver:   function(req): "http"|"https",  // own the HTTPS decision
+ *     trustProxy:         boolean|number,    // legacy; refused unless paired with trustedProxies/protocolResolver (spoofable)
  *     coopReportOnly:           string,  // default: off — monitor-mode COOP
  *     coepReportOnly:           string,  // default: off — monitor-mode COEP
  *     documentPolicyReportOnly: string,  // default: off — monitor-mode Document-Policy
@@ -231,6 +233,7 @@ function create(opts) {
     "hsts", "contentTypeOptions", "frameOptions", "referrerPolicy",
     "permissionsPolicy", "coop", "coep", "corp",
     "originAgentCluster", "dnsPrefetchControl", "csp", "trustProxy",
+    "trustedProxies", "protocolResolver",
     "reportingEndpoints", "documentPolicy", "criticalCh", "acceptCh",
     "coopReportOnly", "coepReportOnly", "documentPolicyReportOnly",
     "requireDocumentPolicy", "serviceWorkerAllowed",
@@ -238,8 +241,23 @@ function create(opts) {
   if (opts.permissionsPolicy && typeof opts.permissionsPolicy === "string") {
     _validatePermissionsPolicy(opts.permissionsPolicy);
   }
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
+  // HSTS is emitted only on HTTPS responses; behind a proxy that comes from
+  // X-Forwarded-Proto. A bare trustProxy trusts the forgeable header from any
+  // caller, so a direct request forging "http" could suppress HSTS on a real
+  // HTTPS response (SSL-strip window). Peer-gate it via trustedProxies, or own
+  // the decision via protocolResolver; a bare trustProxy is refused.
+  var _proto;
+  try {
+    _proto = requestHelpers.trustedProtocol({
+      trustedProxies:   opts.trustedProxies,
+      protocolResolver: opts.protocolResolver,
+    });
+  } catch (e) { throw new TypeError("middleware.securityHeaders: " + e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_proto.peerGated) {
+    throw new TypeError("middleware.securityHeaders: trustProxy is spoofable for the HSTS " +
+      "decision — a direct caller could forge X-Forwarded-Proto to suppress HSTS. Declare your " +
+      "reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] or supply protocolResolver(req).");
+  }
   var hsts = opts.hsts === undefined ? "max-age=63072000; includeSubDomains; preload" : opts.hsts;
   var ctOpts = opts.contentTypeOptions === undefined ? "nosniff" : opts.contentTypeOptions;
   var frameOpts = opts.frameOptions === undefined ? "DENY" : opts.frameOptions;
@@ -317,9 +335,9 @@ function create(opts) {
     // RFC 6797 §7.2: HSTS over plain HTTP is meaningless (UAs ignore
     // it). Skip the header on non-TLS requests so dev-over-HTTP doesn't
     // surface confusing "Strict-Transport-Security on http://" lines.
-    // requestProtocol respects trustProxy — operators behind a TLS
-    // terminator opt in to read X-Forwarded-Proto.
-    if (hsts && requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https") {
+    // Peer-gated protocol resolution — X-Forwarded-Proto honored only from a
+    // trusted proxy (trustedProxies / protocolResolver), else the TLS socket.
+    if (hsts && _proto.resolve(req) === "https") {
       res.setHeader("Strict-Transport-Security", hsts);
     }
     if (ctOpts)     res.setHeader("X-Content-Type-Options", ctOpts);

package/lib/vendor/blamejs/lib/middleware/speculation-rules.js

@@ -66,6 +66,7 @@
 
 var validateOpts = require("../validate-opts");
 var safeBuffer = require("../safe-buffer");
+var safeJson = require("../safe-json");
 
 // Per W3C draft + Chromium implementation. `immediate` triggers the
 // speculation as soon as the rules are seen; `conservative` waits
@@ -129,7 +130,7 @@ function _validateRules(rules, label) {
         throw new TypeError(label + "." + actionKey + "[" + ei +
           "].where must be a `where` clause object (W3C draft, e.g. { href_matches: \"/path/*\" })");
       }
-      if (typeof rule.eagerness !== "string" || !EAGERNESS_LEVELS[rule.eagerness]) {
+      if (typeof rule.eagerness !== "string" || !Object.prototype.hasOwnProperty.call(EAGERNESS_LEVELS, rule.eagerness)) {
         throw new TypeError(label + "." + actionKey + "[" + ei +
           "].eagerness must be one of: " + Object.keys(EAGERNESS_LEVELS).join(", "));
       }
@@ -245,8 +246,10 @@ function create(opts) {
   }
 
   // Pre-built inline JSON. The body is small (rules objects are
-  // typically ~200 bytes); JSON.stringify once and cache.
-  var inlineJson = inline ? JSON.stringify(rulesObj) : null;
+  // typically ~200 bytes); stringify once and cache. Uses the
+  // <script>-safe serializer so a rules value containing "</script>"
+  // (or U+2028/U+2029) cannot break out of the injected element.
+  var inlineJson = inline ? safeJson.stringifyForScript(rulesObj) : null;
 
   return function speculationRules(req, res, next) {
     if (!inline) {

package/lib/vendor/blamejs/lib/middleware/tus-upload.js

@@ -399,7 +399,7 @@ function create(opts) {
 
   var extensions = Array.isArray(opts.extensions) ? opts.extensions.slice() : DEFAULT_EXTENSIONS.slice();
   for (var i = 0; i < extensions.length; i++) {
-    if (!KNOWN_EXTENSIONS[extensions[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_EXTENSIONS, extensions[i])) {
       throw new TusError("tus/bad-opts",
         "middleware.tusUpload: unknown extension '" + extensions[i] + "'");
     }
@@ -416,7 +416,7 @@ function create(opts) {
   var checksumAlgorithmSet = {};
   for (var j = 0; j < checksumAlgorithms.length; j++) {
     var algo = checksumAlgorithms[j];
-    if (!KNOWN_CHECKSUM_ALGORITHMS[algo]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_CHECKSUM_ALGORITHMS, algo)) {
       throw new TusError("tus/bad-opts",
         "middleware.tusUpload: unknown checksum algorithm '" + algo + "'");
     }

package/lib/vendor/blamejs/lib/money.js

@@ -412,7 +412,7 @@ function roundMinor(minor, step, mode) {
     throw new MoneyError("money/bad-minor-units",
       "minor must be an integer (BigInt or safe integer Number); got " + (typeof minor));
   }
-  if (!INCREMENT_MODES[mode]) {
+  if (!Object.prototype.hasOwnProperty.call(INCREMENT_MODES, mode)) {
     throw new MoneyError("money/bad-rounding-mode",
       "mode must be one of half-even | half-up | half-down | ceiling | floor; got " + String(mode));
   }

package/lib/vendor/blamejs/lib/mtls-ca.js

@@ -211,7 +211,7 @@ function create(opts) {
   var paths = _resolvePaths(opts.dataDir, opts.paths);
   var vault = opts.vault || null;
   var caKeySealedMode = (opts.caKeySealedMode || "required").toLowerCase();
-  if (!VALID_SEAL_MODES[caKeySealedMode]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_SEAL_MODES, caKeySealedMode)) {
     throw new MtlsCaError("mtls-ca/bad-mode",
       "caKeySealedMode must be 'required' or 'disabled' " +
       "(legacy 'auto' was removed — it defaulted to plaintext-on-disk)");
@@ -246,7 +246,7 @@ function create(opts) {
         current:    generation,
       };
     }
-    var pem = nodeFs.readFileSync(paths.caCert);
+    var pem = atomicFile.fdSafeReadSync(paths.caCert, { maxBytes: C.BYTES.mib(1) });
     var gen = parseGeneration(pem);
     return {
       exists:     true,
@@ -272,7 +272,9 @@ function create(opts) {
           "CA_KEY_SEALED='required' but " + paths.caKeySealed + " does not exist");
       }
       _requireVault("sealed CA key load");
-      var sealedBytes = nodeFs.readFileSync(paths.caKeySealed, "utf8").trim();
+      // Cap + fd-bound CA-private-key read. NO refuseSymlink: caKeySealed may be
+      // an operator-absolute path on a k8s/KMS secret volume that symlinks it.
+      var sealedBytes = atomicFile.fdSafeReadSync(paths.caKeySealed, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }).trim();
       var pem = vault.unseal(sealedBytes);
       if (!pem) {
         throw new MtlsCaError("mtls-ca/unseal-failed",
@@ -285,7 +287,9 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/plain-required",
         "caKeySealedMode='disabled' but " + paths.caKey + " does not exist");
     }
-    return nodeFs.readFileSync(paths.caKey);
+    // Cap + fd-bound plaintext CA-private-key read (disabled mode = dev opt-out).
+    // NO refuseSymlink (operator-absolute path may symlink).
+    return atomicFile.fdSafeReadSync(paths.caKey, { maxBytes: C.BYTES.kib(64) });
   }
 
   function loadCert() {
@@ -293,7 +297,7 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/missing-cert",
         "no CA cert on disk at " + paths.caCert);
     }
-    return nodeFs.readFileSync(paths.caCert);
+    return atomicFile.fdSafeReadSync(paths.caCert, { maxBytes: C.BYTES.mib(1) });
   }
 
   // Atomic commit: write .tmp + atomic rename for both key and cert.
@@ -446,7 +450,7 @@ function create(opts) {
         // safeJson.parse caps depth + size + protects against
         // proto-pollution; a tampered or truncated file shouldn't be able to
         // corrupt the rotator process.
-        var json = safeJson.parse(nodeFs.readFileSync(paths.revocations, "utf8"),
+        var json = safeJson.parse(atomicFile.fdSafeReadSync(paths.revocations, { maxBytes: C.BYTES.mib(16), encoding: "utf8" }),
           { maxBytes: C.BYTES.mib(16) });
         return (json && Array.isArray(json.revocations)) ? json.revocations : [];
       } catch (e) {

package/lib/vendor/blamejs/lib/network-dns-resolver.js

@@ -179,7 +179,7 @@ var QTYPE_BY_NAME = Object.freeze({
 function create(opts) {
   opts = opts || {};
   var profile     = opts.profile || (opts.posture && safeDns.compliancePosture(opts.posture)) || DEFAULT_PROFILE;
-  if (!safeDns.PROFILES[profile]) {
+  if (!Object.prototype.hasOwnProperty.call(safeDns.PROFILES, profile)) {
     throw new ResolverError("resolver/bad-profile",
       "create: unknown profile '" + profile + "'");
   }

package/lib/vendor/blamejs/lib/network-dns.js

@@ -1,6 +1,7 @@
 "use strict";
 
 var dns = require("node:dns");
+var numericBounds = require("./numeric-bounds");
 var net = require("node:net");
 var https = require("node:https");
 var nodeTls = require("node:tls");
@@ -347,10 +348,16 @@ function _decodeDnsAnswer(buf, qtype) {
   for (var a = 0; a < ancount; a++) {
     _skipDnsName(buf, state);
     var off = state.off;
+    // Bound the RR fixed header (10 bytes: type+class+ttl+rdlen) and the rdata
+    // before indexing — ancount comes from the (untrusted upstream) header, so a
+    // truncated reply would otherwise over-read into a raw RangeError. Mirrors
+    // the hardened _decodeDnsAnswerRaw guards.
+    if (off + 10 > buf.length) throw new DnsError("dns/bad-reply", "answer record truncated");
     var rtype  = buf.readUInt16BE(off); off += 2;
     off += 2;
     off += 4;
     var rdlen  = buf.readUInt16BE(off); off += 2;
+    if (off + rdlen > buf.length) throw new DnsError("dns/bad-reply", "answer rdata truncated");
     if (rtype === qtype && qtype === 1 && rdlen === 4) {
       addrs.push(buf[off] + "." + buf[off + 1] + "." + buf[off + 2] + "." + buf[off + 3]);
     } else if (rtype === qtype && qtype === DNS_QTYPE_AAAA && rdlen === IPV6_ADDR_BYTES) {
@@ -1851,7 +1858,7 @@ var DS_DIGEST_TYPES = Object.freeze({
 });
 
 function classifyDnskeyAlgorithm(algorithm) {
-  if (typeof algorithm !== "number" || !isFinite(algorithm) || Math.floor(algorithm) !== algorithm) {
+  if (!numericBounds.isFiniteInt(algorithm)) {
     return null;
   }
   var row = DNSKEY_ALGORITHMS[algorithm];
@@ -1874,7 +1881,7 @@ function classifyDnskeyAlgorithm(algorithm) {
 }
 
 function classifyDsDigestType(digestType) {
-  if (typeof digestType !== "number" || !isFinite(digestType) || Math.floor(digestType) !== digestType) {
+  if (!numericBounds.isFiniteInt(digestType)) {
     return null;
   }
   var row = DS_DIGEST_TYPES[digestType];

package/lib/vendor/blamejs/lib/network-dnssec.js

@@ -45,6 +45,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
 var bCrypto = require("./crypto");
 var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
@@ -515,7 +516,7 @@ function nsec3Hash(name, opts) {
   validateOpts(opts, ["salt", "iterations"], "dnssec.nsec3Hash");
   var salt = _bytes(opts.salt, "salt");
   var iters = opts.iterations;
-  if (typeof iters !== "number" || !isFinite(iters) || iters < 0 || Math.floor(iters) !== iters) {
+  if (!numericBounds.isNonNegativeFiniteInt(iters)) {
     throw new DnssecError("dnssec/bad-iterations", "dnssec.nsec3Hash: iterations must be a non-negative integer");
   }
   return _nsec3HashWire(_canonicalName(name), salt, iters);

package/lib/vendor/blamejs/lib/network-smtp-policy.js

@@ -176,6 +176,15 @@ async function mtaStsFetch(domain, opts) {
         rejectUnauthorized: true,
       });
     } catch (_e) {
+      // RFC 8461 opportunistic fallback: a policy that can't be fetched — a
+      // network error, OR (with rejectUnauthorized:true + pinned servername
+      // above) a TLS-validation failure that signals a possible MITM of the
+      // policy endpoint — yields "no enforceable policy", so the sender
+      // proceeds without MTA-STS. This is the documented TOFU limitation for an
+      // UN-cached first fetch only: a valid cached policy is honored by the
+      // _getStsCache().wrap() wrapper and never reaches this catch, and the TLS
+      // failure itself is independently audited by httpClient's TLS layer — so
+      // this is a deliberate opportunistic fallback, not a silent swallow.
       return null;
     }
     if (res.statusCode === 404) return null;                                     // HTTP 404
@@ -403,23 +412,32 @@ function _selectorBytes(certDer, selector) {
   return null;
 }
 
+// Constant-time byte-compare for TLSA association data. The TLSA record is
+// public DNS so there is no secret to leak via timing, but the framework
+// compares all crypto material (digests, certs) in constant time so the
+// boundary stays uniform and can't regress into a leaky compare elsewhere.
+function _constEqBytes(a, b) {
+  // bCrypto.timingSafeEqual is the length-tolerant constant-time wrapper.
+  return Buffer.isBuffer(a) && Buffer.isBuffer(b) && bCrypto.timingSafeEqual(a, b);
+}
+
 function _matchTlsaAgainstCert(rec, certDer) {
   // Returns null on no-match, or { ok: true, mtypeLabel } on match.
   var bytes = _selectorBytes(certDer, rec.selector);
   if (!bytes) return null;
-  var dataHex = String(rec.dataHex || "").toLowerCase();
+  var dataHex = (typeof rec.dataHex === "string" ? rec.dataHex : "").toLowerCase();
+  var want = Buffer.from(dataHex, "hex");
   // RFC 6698 §2.1.3 matching types — Full byte match (0) or hashed
   // comparison via SHA two-family (1 short / 2 long digest).
   if (rec.mtype === 0) {
-    return bytes.toString("hex") === dataHex
-      ? { ok: true, mtype: "Full" } : null;
+    return _constEqBytes(bytes, want) ? { ok: true, mtype: "Full" } : null;
   }
   if (rec.mtype === 1) {
-    return _hashHex("sha256", bytes) === dataHex
+    return _constEqBytes(nodeCrypto.createHash("sha256").update(bytes).digest(), want)
       ? { ok: true, mtype: "SHA-256" } : null;
   }
   if (rec.mtype === 2) {
-    return _hashHex("sha512", bytes) === dataHex
+    return _constEqBytes(nodeCrypto.createHash("sha512").update(bytes).digest(), want)
       ? { ok: true, mtype: "SHA-512" } : null;
   }
   return null;