@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/test/layer-0-primitives/output-header-hardening.test.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * Response-output, header, and compliance hardening — each test drives the
+ * shipped consumer path with the input that triggers the failure.
+ *
+ *   - ai.output.sanitize: a markdown image/link whose alt text equals its URL
+ *     no longer leaves the real exfiltration target intact (EchoLeak / CWE-918).
+ *   - dora.classify: evaluates the percentage-of-client-base criterion (not just
+ *     absolute counts); dora.report anchors the next-stage deadline on the
+ *     report's submission time, not detection.
+ *   - cookies.serialize: value cap is byte-length (multibyte overflow refused);
+ *     a ';' in Path is scrubbed (no attribute injection).
+ *   - csp.mergeDirectives: merging a real source into a 'none' directive drops
+ *     'none' (no malformed "'none' host").
+ *   - cdnCacheControl.parse: delta-seconds accepts only decimal digits (no
+ *     hex / exponential / whitespace forms).
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function _throws(fn) { try { fn(); return null; } catch (e) { return (e && e.code) || e.message || "threw"; } }
+
+function testAiOutputEchoLeak() {
+  var meta = "https://169.254.169.254/latest/meta-data";
+  var out = b.ai.output.sanitize("![" + meta + "](" + meta + ")", { audit: false });
+  var text = out.text || out;
+  check("ai.output.sanitize neutralizes the real URL when alt === url (EchoLeak)",
+    text.indexOf("(" + meta + ")") === -1 && /about:blank#blocked/.test(text));
+  // A normal link is still neutralized.
+  var out2 = b.ai.output.sanitize("[x](" + meta + ")", { audit: false });
+  check("ai.output.sanitize still neutralizes a normal metadata link",
+    /about:blank#blocked/.test(out2.text || out2));
+}
+
+function testDoraClientBasePercentile() {
+  var d = b.dora.create({ audit: false });
+  // 8000 of 50000 = 16% > 10% major threshold, but 8000 < 100000 absolute.
+  var major = d.classify({ affectedClients: 8000, clientBase: 50000 });
+  check("dora.classify: 16% of client base → major (percentile criterion)",
+    major.classification === "major");
+  // Absolute-only behavior unchanged when clientBase omitted.
+  var minor = d.classify({ affectedClients: 8000 });
+  check("dora.classify: 8000 with no clientBase → not major (absolute-only)",
+    minor.classification !== "major");
+}
+
+function testDoraDeadlineAnchor() {
+  var d = b.dora.create({ audit: false });
+  var detected = Date.now() - 5 * 60 * 60 * 1000;   // detected 5h ago
+  var rep = d.report({
+    incidentId: "inc-1", classification: "major", stage: "initial",
+    detectedAt: detected, description: "x",
+  });
+  // nextStageDueAt must anchor on submission (~now), not detectedAt — so it is
+  // well past detectedAt + 72h would have been if anchored on detection.
+  check("dora.report: nextStageDueAt anchored on submission, not detectedAt",
+    rep.nextStageDueAt > detected + 72 * 60 * 60 * 1000 - 60000);
+}
+
+function testCookieByteCapAndPath() {
+  var bigMultibyte = "€".repeat(4096);   // 4096 chars = 12288 UTF-8 bytes
+  check("cookies.serialize refuses an over-byte-cap multibyte value",
+    _throws(function () { b.cookies.serialize("c", bigMultibyte, { secure: true }); }) === "cookies/invalid-value");
+  // A ';' in Path must not survive into the Set-Cookie attribute list.
+  var sc = b.cookies.serialize("c", "v", { path: "/a;HttpOnly=evil", secure: true });
+  check("cookies.serialize scrubs ';' from Path (no attribute injection)",
+    sc.indexOf("/aHttpOnly=evil") !== -1 && sc.indexOf("/a;HttpOnly=evil") === -1);
+}
+
+function testCspMergeNone() {
+  var merged = b.csp.mergeDirectives("script-src 'none'", { "script-src": ["https://cdn.example"] });
+  check("csp.mergeDirectives drops 'none' when a real source is merged in",
+    merged.indexOf("'none'") === -1 && merged.indexOf("https://cdn.example") !== -1);
+}
+
+function testCdnDeltaSeconds() {
+  var ok = b.cdnCacheControl.parse("max-age=3600");
+  check("cdnCacheControl.parse accepts decimal delta-seconds", ok.maxAge === 3600);
+  // hex / exponential / whitespace are not RFC 9111 delta-seconds.
+  var hex = b.cdnCacheControl.parse("max-age=0x10");
+  check("cdnCacheControl.parse rejects hex delta-seconds", hex.maxAge === undefined);
+  var exp = b.cdnCacheControl.parse("max-age=1e3");
+  check("cdnCacheControl.parse rejects exponential delta-seconds", exp.maxAge === undefined);
+}
+
+async function run() {
+  testAiOutputEchoLeak();
+  testDoraClientBasePercentile();
+  testDoraDeadlineAnchor();
+  testCookieByteCapAndPath();
+  testCspMergeNone();
+  testCdnDeltaSeconds();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/parser-verify-hardening.test.js

@@ -0,0 +1,191 @@
+"use strict";
+/**
+ * Pre-auth parse/verify hardening — each test drives the shipped consumer
+ * path with the adversarial input that triggers the failure.
+ *
+ *   - cbor: O(1) duplicate-key detection (was O(n²) — pre-auth DoS on every
+ *     COSE/CWT/EAT/mdoc verify); duplicates still refused.
+ *   - crypto.decrypt: a truncated envelope throws the documented envelope Error,
+ *     not a raw RangeError.
+ *   - mdoc.verifyIssuerSigned: issuer trust is enforced by default (the x5chain
+ *     signer cert is attacker-controlled) — refuses without trustAnchorsPem
+ *     unless allowUntrustedIssuer is set.
+ *   - cose: RFC 9053 alg↔curve binding — refuses ES512 over a P-256 key.
+ *   - jsonPath: a deeply-nested filter throws JsonPathError, not a raw
+ *     stack-overflow RangeError.
+ *   - bodyParser.raw(): the default match-all wildcard contentTypes accepts a
+ *     real Content-Type (was 415 on every request).
+ */
+
+var nodeCrypto = require("node:crypto");
+var EventEmitter = require("events").EventEmitter;
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+var _bodyRes = helpers._bodyRes;
+
+function _codeOf(fn) {
+  try { fn(); return null; } catch (e) { return (e && e.code) || (e && e.message) || "threw"; }
+}
+
+async function _codeOfAsync(p) {
+  try { await p; return null; } catch (e) { return (e && e.code) || (e && e.message) || "threw"; }
+}
+
+function testCborDuplicateKeyAndLinearSpeed() {
+  // Duplicates still refused.
+  var dup = Buffer.from([0xa2, 0x01, 0x01, 0x01, 0x02]);   // {1:1, 1:2}
+  check("cbor.decode refuses a duplicate map key",
+    _codeOf(function () { b.cbor.decode(dup); }) === "cbor/duplicate-key");
+
+  // A large distinct-key map decodes in linear time. The old O(n²) per-key
+  // Buffer.compare scan over a 20k-key map is ~4e8 comparisons (many seconds);
+  // the Set-based guard is milliseconds.
+  var m = new Map();
+  for (var i = 0; i < 20000; i++) m.set(i, i);
+  var encoded = b.cbor.encode(m);
+  var t0 = Date.now();
+  var decoded = b.cbor.decode(encoded, { maxBytes: 4 * 1024 * 1024 });
+  var ms = Date.now() - t0;
+  check("cbor.decode of a 20k distinct-key map is correct", decoded instanceof Map && decoded.size === 20000);
+  check("cbor.decode of a 20k-key map is linear-fast (<3s), not O(n²)", ms < 3000);
+}
+
+function testCryptoDecryptTruncatedEnvelope() {
+  // A truncated envelope must surface the documented "Invalid envelope" Error,
+  // never a raw Node RangeError from an out-of-bounds readUInt16BE.
+  [Buffer.from([0xe2, 1]), Buffer.from([0xe2, 1, 1, 1])].forEach(function (buf, idx) {
+    var msg = null;
+    try { b.crypto.decrypt(buf, "no-key"); } catch (e) { msg = e.message || ""; }
+    check("crypto.decrypt truncated envelope #" + idx + " → documented envelope Error",
+      msg !== null && msg.indexOf("Invalid envelope") === 0);
+  });
+}
+
+async function testMdocRequiresTrustAnchorByDefault() {
+  // Issuer authentication is fail-closed by default: without trustAnchorsPem
+  // (and without the explicit opt-out) the call is refused BEFORE trusting the
+  // attacker-supplied x5chain signer.
+  var code = await _codeOfAsync(
+    b.mdoc.verifyIssuerSigned(Buffer.from([0xa0]), { algorithms: ["ES256"] }));
+  check("mdoc.verifyIssuerSigned refuses without a trust anchor",
+    code === "mdoc/trust-anchors-required");
+
+  // The explicit opt-out gets past the trust gate (it then fails later on the
+  // garbage payload — a DIFFERENT, non-trust error), proving the gate is the
+  // only thing the default adds.
+  var code2 = await _codeOfAsync(
+    b.mdoc.verifyIssuerSigned(Buffer.from([0xa0]), { algorithms: ["ES256"], allowUntrustedIssuer: true }));
+  check("mdoc allowUntrustedIssuer opt-out bypasses the trust gate (fails later, not on trust)",
+    code2 !== "mdoc/trust-anchors-required" && code2 !== null);
+}
+
+async function testCoseAlgCurveBinding() {
+  var p256 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+  // ES256 over a P-256 key is the correct binding — succeeds.
+  var signedOk = null;
+  try { await b.cose.sign(Buffer.from("hi"), { alg: "ES256", privateKey: p256.privateKey }); signedOk = true; }
+  catch (_e) { signedOk = false; }
+  check("cose.sign ES256 over a P-256 key succeeds (correct binding)", signedOk === true);
+
+  // ES512 over a P-256 key violates RFC 9053 §2 — refused.
+  var mismatch = null;
+  try { await b.cose.sign(Buffer.from("hi"), { alg: "ES512", privateKey: p256.privateKey }); }
+  catch (e) { mismatch = e && e.code; }
+  check("cose.sign ES512 over a P-256 key is refused (alg/curve binding)",
+    mismatch === "cose/alg-curve-mismatch");
+}
+
+function testJsonPathFilterDepthCap() {
+  // A pathologically nested filter must throw a typed JsonPathError, never a
+  // raw V8 RangeError ("Maximum call stack size exceeded").
+  var deep = "$[?(" + "(".repeat(500) + "@.a==1" + ")".repeat(500) + ")]";
+  var err = null;
+  try { b.jsonPath.query({ a: 1 }, deep); } catch (e) { err = e; }
+  check("jsonPath deeply-nested filter throws JsonPathError, not a raw RangeError",
+    err !== null && err.name !== "RangeError" &&
+    ((err.code || "").indexOf("json-path/") === 0));
+}
+
+function testBodyParserRawWildcardMatchesRealType() {
+  // bodyParser.raw() defaults contentTypes to ["*/*"]; that wildcard must match
+  // a real Content-Type (it never did → 415 on every request).
+  var bp = b.middleware.bodyParser.raw();
+  var req = new EventEmitter();
+  req.method = "POST"; req.url = "/hooks";
+  req.headers = { "content-type": "application/json", "content-length": "2" };
+  req.socket = { remoteAddress: "127.0.0.1" };
+  var res = _bodyRes();
+  return new Promise(function (resolve) {
+    var settled = false;
+    bp(req, res, function () {
+      if (settled) return; settled = true;
+      check("bodyParser.raw() */* accepts application/json → next() runs", true);
+      check("bodyParser.raw() exposes the raw body as a Buffer", Buffer.isBuffer(req.body));
+      resolve();
+    });
+    res.on("finish", function () {
+      if (settled) return; settled = true;
+      check("bodyParser.raw() */* did NOT 415 a real Content-Type (status=" + res._endedStatus + ")",
+        res._endedStatus !== 415);
+      resolve();
+    });
+    setImmediate(function () { req.emit("data", Buffer.from("{}")); req.emit("end"); });
+    setTimeout(function () { if (!settled) { settled = true; check("bodyParser.raw() settled", false); resolve(); } }, 1500);
+  });
+}
+
+async function testPromiseToStreamWrapsPromise() {
+  // The object-store remote backends' getStream() wraps a Promise<Buffer> via
+  // sharedRequest.promiseToStream. A bare Readable.from(promise) throws
+  // ERR_INVALID_ARG_TYPE — the helper must return a Readable that yields the
+  // resolved bytes and surfaces a rejection as a stream 'error'.
+  var sharedRequest = require("../../lib/object-store/http-request");
+  var s = sharedRequest.promiseToStream(Promise.resolve(Buffer.from("hello-stream")));
+  var chunks = [];
+  await new Promise(function (resolve, reject) {
+    s.on("data", function (c) { chunks.push(c); });
+    s.on("end", resolve); s.on("error", reject);
+  });
+  check("promiseToStream yields the resolved buffer", Buffer.concat(chunks).toString() === "hello-stream");
+
+  var s2 = sharedRequest.promiseToStream(Promise.reject(new Error("upstream boom")));
+  var errored = false;
+  await new Promise(function (resolve) {
+    s2.on("error", function () { errored = true; resolve(); });
+    s2.on("end", resolve);
+    s2.resume();
+  });
+  check("promiseToStream surfaces a rejected promise as a stream 'error'", errored === true);
+}
+
+async function testSchedulerFarFutureNoImmediateFire() {
+  // A task whose first fire is ~40 days out (> the 2147483647 ms setTimeout
+  // ceiling) must NOT fire now. Pre-fix, Node coerced the over-max delay to 1ms
+  // and the task fired immediately (and re-armed into a tight loop).
+  var sched = b.scheduler.create({ audit: false });
+  var fired = 0;
+  sched.schedule({ name: "far", every: 40 * 24 * 60 * 60 * 1000, run: function () { fired += 1; } });
+  await sched.start();
+  await helpers.passiveObserve(600, "scheduler far-future: no immediate fire");
+  check("scheduler far-future task does not fire immediately (setTimeout overflow clamped)", fired === 0);
+  await sched.stop();
+}
+
+async function run() {
+  testCborDuplicateKeyAndLinearSpeed();
+  await testPromiseToStreamWrapsPromise();
+  await testSchedulerFarFutureNoImmediateFire();
+  testCryptoDecryptTruncatedEnvelope();
+  await testMdocRequiresTrustAnchorByDefault();
+  await testCoseAlgCurveBinding();
+  testJsonPathFilterDepthCap();
+  await testBodyParserRawWildcardMatchesRealType();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/proto-shadow-allowlist.test.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Prototype-shadow / proto-pollution allowlist-bypass class (CWE-1321).
+ *
+ * An object-literal allowlist (`var MAP = { a: 1 }`) inherits Object.prototype,
+ * so MAP["constructor"], MAP["__proto__"], MAP["toString"], MAP["valueOf"],
+ * MAP["hasOwnProperty"] are all TRUTHY (and !== undefined) even though never
+ * added. A membership gate `if (!MAP[key])` / `if (MAP[key] === undefined)` is
+ * therefore BYPASSED by a prototype-named key when `key` is caller- or
+ * attacker-controlled, and `var v = MAP[key]` hands back a Function. The fix is
+ * `Object.prototype.hasOwnProperty.call(MAP, key)` (own-key only).
+ *
+ * This drives the SHIPPED public consumer paths with prototype-named inputs and
+ * asserts each is refused / resolves to its safe default — never a bypass and
+ * never a Function reaching downstream. RED before the v0.15.14 sweep (the
+ * bracket lookup is truthy for a proto key → no throw, or a Function returned).
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+var PROTO_KEYS = ["constructor", "__proto__", "toString", "valueOf", "hasOwnProperty"];
+
+function _throws(fn) {
+  try { fn(); return null; } catch (e) { return e; }
+}
+
+function testContentDigestCreateRefusesProtoAlg() {
+  // ACTIVE = { "sha-256": ..., "sha-512": ... }. A proto-named algorithm must
+  // be refused as unsupported, NOT silently accepted (which previously reached
+  // nodeCrypto.createHash(<Function>) and threw an opaque type error).
+  PROTO_KEYS.forEach(function (k) {
+    var e = _throws(function () { b.contentDigest.create("payload", { algorithms: [k] }); });
+    check("contentDigest.create refuses proto-named algorithm '" + k + "'",
+      e !== null && /unsupported-algorithm|insecure-algorithm/.test(String(e.code || e.message)));
+  });
+  // A real algorithm still works (no over-rejection).
+  check("contentDigest.create still accepts sha-256",
+    typeof b.contentDigest.create("payload", { algorithms: ["sha-256"] }) === "string");
+}
+
+function testSqlFnAndPragmaRefuseProtoNames() {
+  PROTO_KEYS.forEach(function (k) {
+    var e1 = _throws(function () { b.sql.fn(k); });
+    check("b.sql.fn refuses proto-named function '" + k + "' (no allowlist bypass)",
+      e1 !== null);
+    var e2 = _throws(function () { b.sql.pragma(k); });
+    check("b.sql.pragma refuses proto-named verb '" + k + "'", e2 !== null);
+  });
+  // A real allowlisted function/pragma still resolves (no over-rejection).
+  check("b.sql.fn still accepts an allowlisted function",
+    _throws(function () { b.sql.fn("now"); }) === null);
+  check("b.sql.pragma still accepts an allowlisted verb",
+    _throws(function () { b.sql.pragma("journal_mode"); }) === null);
+}
+
+function testLogCreateRefusesProtoLevel() {
+  PROTO_KEYS.forEach(function (k) {
+    var e = _throws(function () { b.log.create({ level: k }); });
+    check("b.log.create refuses proto-named level '" + k + "'",
+      e !== null && /bad-level/.test(String(e.code || e.message)));
+  });
+  check("b.log.create still accepts level 'info'",
+    _throws(function () { var l = b.log.create({ level: "info" }); return l; }) === null);
+}
+
+function testCompliancePostureAccessorReturnsNullForProto() {
+  // The mail-scanner compliancePosture accessor maps a posture name through its
+  // own table; a proto-named posture must resolve to null, not an inherited
+  // Function.
+  PROTO_KEYS.forEach(function (k) {
+    check("mail.scan.compliancePosture('" + k + "') is null (not a Function)",
+      b.mail.scan.compliancePosture(k) === null);
+  });
+  check("mail.scan.compliancePosture('hipaa') still maps to a profile",
+    typeof b.mail.scan.compliancePosture("hipaa") === "string");
+}
+
+function testMakePostureAccessorPrimitive() {
+  var accessor = b.gateContract.makePostureAccessor({ hipaa: "strict", gdpr: "balanced" });
+  check("makePostureAccessor maps a known posture", accessor("hipaa") === "strict");
+  PROTO_KEYS.forEach(function (k) {
+    check("makePostureAccessor('" + k + "') → null (proto key)", accessor(k) === null);
+  });
+  var withFallback = b.gateContract.makePostureAccessor({ hipaa: "strict" }, { fallback: "default" });
+  check("makePostureAccessor honors opts.fallback for unknown", withFallback("nope") === "default");
+  check("makePostureAccessor honors opts.fallback for proto key", withFallback("constructor") === "default");
+}
+
+function testMailBounceDsnRefusesProtoAction() {
+  // DSN_ACTIONS allowlist; a proto-named action must be refused as malformed.
+  PROTO_KEYS.forEach(function (k) {
+    var e = _throws(function () {
+      b.mailBounce.dsn.build({
+        finalRecipient: "user@example.com",
+        action:         k,
+        status:         "5.1.1",
+        reportingMta:   "mx.example.com",
+      });
+    });
+    check("mailBounce.dsn.build refuses proto-named action '" + k + "'", e !== null);
+  });
+}
+
+async function run() {
+  testContentDigestCreateRefusesProtoAlg();
+  testSqlFnAndPragmaRefuseProtoNames();
+  testLogCreateRefusesProtoLevel();
+  testCompliancePostureAccessorReturnsNullForProto();
+  testMakePostureAccessorPrimitive();
+  testMailBounceDsnRefusesProtoAction();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-xff-spoofing.test.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * b.middleware.rateLimit — X-Forwarded-For spoofing of the rate-limit key
+ * (CWE-290/348). A bare trustProxy honored a forgeable header, so a caller
+ * could rotate X-Forwarded-For to evade their own limit, or set a victim's
+ * IP to exhaust the victim's bucket (targeted DoS). The key is now peer-
+ * gated: trustProxy without trustedProxies/clientIpResolver/keyFn is refused
+ * at construction, and a declared proxy CIDR gates the header.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function _runMw(mw, req) {
+  return new Promise(function (resolve) {
+    var res = { setHeader: function () {}, writeHead: function () {}, end: function () {}, statusCode: 200 };
+    var next = false;
+    var maybe = mw(req, res, function () { next = true; });
+    Promise.resolve(maybe).then(function () {
+      setImmediate(function () { resolve({ next: next }); });
+    });
+  });
+}
+function _req(sock, xff) {
+  return { url: "/x", pathname: "/x", method: "GET",
+    socket: { remoteAddress: sock },
+    headers: xff ? { "x-forwarded-for": xff } : {}, requestId: "r" };
+}
+
+async function run() {
+  // Construction fails closed: bare trustProxy with the default IP key.
+  var threwBare = null;
+  try { b.middleware.rateLimit({ backend: "memory", burst: 1, refillPerSecond: 0.001, trustProxy: true }); }
+  catch (e) { threwBare = e; }
+  check("create: bare trustProxy refused (spoofable IP key)", threwBare !== null);
+
+  // Allowed: bare trustProxy when the operator owns the key (not IP-derived).
+  var okKeyFn = true;
+  try { b.middleware.rateLimit({ backend: "memory", burst: 1, refillPerSecond: 0.001, trustProxy: true, keyFn: function () { return "k"; } }); }
+  catch (_e) { okKeyFn = false; }
+  check("create: trustProxy + keyFn allowed (key not IP)", okKeyFn === true);
+
+  // Malformed trustedProxies CIDR refused.
+  var threwCidr = null;
+  try { b.middleware.rateLimit({ backend: "memory", burst: 1, refillPerSecond: 0.001, trustedProxies: ["nope"] }); }
+  catch (e) { threwCidr = e; }
+  check("create: malformed trustedProxies CIDR refused", threwCidr !== null);
+
+  // Peer-gated: a direct attacker cannot evade by rotating X-Forwarded-For —
+  // the key is the socket address, so both requests hit the same bucket.
+  var atkMw = b.middleware.rateLimit({ backend: "memory", burst: 1, refillPerSecond: 0.001, trustedProxies: ["10.0.0.0/8"] });
+  var a1 = await _runMw(atkMw, _req("198.51.100.66", "1.1.1.1"));
+  var a2 = await _runMw(atkMw, _req("198.51.100.66", "2.2.2.2"));
+  check("attacker first request allowed",                 a1.next === true);
+  check("attacker cannot evade by rotating XFF (blocked)", a2.next === false);
+
+  // Behind a trusted proxy, distinct real clients get distinct buckets.
+  var proxMw = b.middleware.rateLimit({ backend: "memory", burst: 1, refillPerSecond: 0.001, trustedProxies: ["10.0.0.0/8"] });
+  var c1 = await _runMw(proxMw, _req("10.0.0.9", "203.0.113.1"));
+  var c2 = await _runMw(proxMw, _req("10.0.0.9", "203.0.113.2"));
+  check("trusted proxy: client A allowed", c1.next === true);
+  check("trusted proxy: client B (distinct bucket) allowed", c2.next === true);
+
+  // Same real client via the proxy shares a bucket (limit enforced per-client).
+  var c2again = await _runMw(proxMw, _req("10.0.0.9", "203.0.113.1"));
+  check("trusted proxy: client A second request blocked", c2again.next === false);
+
+  console.log("[rate-limit-xff-spoofing] OK — " + helpers.getChecks() + " checks passed");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () {}, function (e) { console.error("FAIL: " + helpers.formatErr(e)); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/request-helpers.test.js

@@ -298,9 +298,137 @@ function testExtractBearerLeadingTrailingSpaces() {
   check("extractBearer: trims leading + trailing whitespace from token", t === "abc");
 }
 
+function testClientIpDefaultIgnoresXff() {
+  // Default: socket address only — X-Forwarded-For is attacker-forgeable.
+  var req = { socket: { remoteAddress: "10.0.0.1" },
+    headers: { "x-forwarded-for": "203.0.113.7, 10.0.0.5" } };
+  check("clientIp default → socket addr", b.requestHelpers.clientIp(req) === "10.0.0.1");
+}
+
+function testClientIpPeerGatedTrustedPeer() {
+  // Predicate form: peer 10.0.0.1 is a trusted proxy → first untrusted hop
+  // walking right-to-left is the real client.
+  var trust = function (a) { return a.indexOf("10.") === 0; };
+  var req = { socket: { remoteAddress: "10.0.0.1" },
+    headers: { "x-forwarded-for": "203.0.113.7, 10.0.0.5" } };
+  check("clientIp peer-gated (trusted peer) → first untrusted hop",
+    b.requestHelpers.clientIp(req, { trustProxy: trust }) === "203.0.113.7");
+}
+
+function testClientIpPeerGatedUntrustedPeerIgnoresXff() {
+  // The bypass: a direct attacker (socket peer NOT a trusted proxy) forging
+  // an XFF must NOT be believed — fall through to the socket address.
+  var trust = function (a) { return a.indexOf("10.") === 0; };
+  var forged = { socket: { remoteAddress: "198.51.100.66" },
+    headers: { "x-forwarded-for": "203.0.113.7" } };
+  check("clientIp peer-gated (untrusted peer) → ignores forged XFF",
+    b.requestHelpers.clientIp(forged, { trustProxy: trust }) === "198.51.100.66");
+}
+
+function testClientIpPeerGatedAllHopsTrusted() {
+  // Whole chain trusted (no untrusted hop) → earliest claimed client.
+  var trust = function (a) { return a.indexOf("10.") === 0; };
+  var req = { socket: { remoteAddress: "10.0.0.1" },
+    headers: { "x-forwarded-for": "10.0.0.9, 10.0.0.5" } };
+  check("clientIp peer-gated (all trusted) → leftmost",
+    b.requestHelpers.clientIp(req, { trustProxy: trust }) === "10.0.0.9");
+}
+
+function testClientIpLegacyFormsStillWork() {
+  // Legacy spoofable forms preserved for edge-terminated deployments.
+  var req = { socket: { remoteAddress: "10.0.0.1" },
+    headers: { "x-forwarded-for": "203.0.113.7, 10.0.0.5" } };
+  check("clientIp legacy true → leftmost", b.requestHelpers.clientIp(req, { trustProxy: true }) === "203.0.113.7");
+  check("clientIp legacy N=1 → Nth-from-right", b.requestHelpers.clientIp(req, { trustProxy: 1 }) === "10.0.0.5");
+}
+
+function testTrustedClientIpPeerGatedFlag() {
+  check("trustedClientIp default → not peerGated",
+    b.requestHelpers.trustedClientIp().peerGated === false);
+  check("trustedClientIp trustedProxies → peerGated",
+    b.requestHelpers.trustedClientIp({ trustedProxies: ["10.0.0.0/8"] }).peerGated === true);
+  check("trustedClientIp clientIpResolver → peerGated",
+    b.requestHelpers.trustedClientIp({ clientIpResolver: function () { return "1.2.3.4"; } }).peerGated === true);
+}
+
+function testTrustedClientIpResolves() {
+  var pg = b.requestHelpers.trustedClientIp({ trustedProxies: ["10.0.0.0/8"] });
+  var forged = { socket: { remoteAddress: "198.51.100.66" },
+    headers: { "x-forwarded-for": "203.0.113.7" } };
+  check("trustedClientIp peer-gated ignores forged XFF (untrusted peer)",
+    pg.resolve(forged) === "198.51.100.66");
+  var viaProxy = { socket: { remoteAddress: "10.0.0.9" },
+    headers: { "x-forwarded-for": "203.0.113.7" } };
+  check("trustedClientIp peer-gated honors XFF behind trusted proxy",
+    pg.resolve(viaProxy) === "203.0.113.7");
+  var owned = b.requestHelpers.trustedClientIp({ clientIpResolver: function (rq) { return rq.headers["true-client-ip"]; } });
+  check("trustedClientIp clientIpResolver wins",
+    owned.resolve({ headers: { "true-client-ip": "9.9.9.9" } }) === "9.9.9.9");
+}
+
+function testTrustedProxyMappedPeerNormalized() {
+  // A dual-stack listener reports an IPv4 proxy peer as an IPv4-mapped IPv6
+  // address (::ffff:10.0.0.9). It must still match an IPv4 trustedProxies CIDR
+  // so X-Forwarded-* is honored — otherwise the proxy is treated as untrusted
+  // and the gate keys on the proxy address / misclassifies the scheme.
+  var pg = b.requestHelpers.trustedClientIp({ trustedProxies: ["10.0.0.0/8"] });
+  var viaMapped = { socket: { remoteAddress: "::ffff:10.0.0.9" },
+    headers: { "x-forwarded-for": "203.0.113.7" } };
+  check("trustedClientIp recognizes an IPv4-mapped trusted-proxy peer",
+    pg.resolve(viaMapped) === "203.0.113.7");
+
+  var tp = b.requestHelpers.trustedProtocol({ trustedProxies: ["10.0.0.0/8"] });
+  var mappedHttps = { socket: { encrypted: false, remoteAddress: "::ffff:10.0.0.9" },
+    headers: { "x-forwarded-proto": "https" } };
+  check("trustedProtocol recognizes an IPv4-mapped trusted-proxy peer",
+    tp.resolve(mappedHttps) === "https");
+
+  // A direct (untrusted) IPv4-mapped peer still can't forge: not in the CIDR.
+  var forgedMapped = { socket: { remoteAddress: "::ffff:198.51.100.66" },
+    headers: { "x-forwarded-for": "203.0.113.7" } };
+  check("trustedClientIp still ignores forged XFF from an untrusted mapped peer",
+    pg.resolve(forgedMapped) === "::ffff:198.51.100.66");
+}
+
+function testTrustedProtocol() {
+  var tp = b.requestHelpers.trustedProtocol({ trustedProxies: ["10.0.0.0/8"] });
+  check("trustedProtocol trustedProxies → peerGated", tp.peerGated === true);
+  check("trustedProtocol default → not peerGated", b.requestHelpers.trustedProtocol().peerGated === false);
+  var forged = { socket: { encrypted: false, remoteAddress: "198.51.100.66" }, headers: { "x-forwarded-proto": "https" } };
+  check("trustedProtocol: forged XFP from untrusted peer → http", tp.resolve(forged) === "http");
+  var viaProxy = { socket: { encrypted: false, remoteAddress: "10.0.0.9" }, headers: { "x-forwarded-proto": "https" } };
+  check("trustedProtocol: XFP via trusted proxy → https", tp.resolve(viaProxy) === "https");
+  var realTls = { socket: { encrypted: true, remoteAddress: "203.0.113.1" }, headers: {} };
+  check("trustedProtocol: real TLS socket → https", tp.resolve(realTls) === "https");
+  var owned = b.requestHelpers.trustedProtocol({ protocolResolver: function () { return "https"; } });
+  check("trustedProtocol: protocolResolver wins", owned.resolve({}) === "https");
+  var threwBadCidr = false;
+  try { b.requestHelpers.trustedProtocol({ trustedProxies: ["nope"] }); } catch (_e) { threwBadCidr = true; }
+  check("trustedProtocol: malformed CIDR refused", threwBadCidr === true);
+}
+
+function testTrustedClientIpValidates() {
+  var threwResolver = false;
+  try { b.requestHelpers.trustedClientIp({ clientIpResolver: 123 }); } catch (_e) { threwResolver = true; }
+  check("trustedClientIp rejects non-function resolver", threwResolver === true);
+  var threwCidr = false;
+  try { b.requestHelpers.trustedClientIp({ trustedProxies: ["not-a-cidr"] }); } catch (_e) { threwCidr = true; }
+  check("trustedClientIp rejects malformed CIDR", threwCidr === true);
+}
+
 async function run() {
   testSurface();
   testSafeHeadersDistinct();
+  testClientIpDefaultIgnoresXff();
+  testClientIpPeerGatedTrustedPeer();
+  testClientIpPeerGatedUntrustedPeerIgnoresXff();
+  testClientIpPeerGatedAllHopsTrusted();
+  testClientIpLegacyFormsStillWork();
+  testTrustedClientIpPeerGatedFlag();
+  testTrustedClientIpResolves();
+  testTrustedProxyMappedPeerNormalized();
+  testTrustedProtocol();
+  testTrustedClientIpValidates();
   testResolveRoutePrefersRoutePattern();
   testResolveRouteFallsBackToUrl();
   testResolveRouteEmptyOrMissingUrl();