@blamejs/blamejs-shop 0.4.69 → 0.4.70

package/lib/vendor/blamejs/lib/vault/passphrase-ops.js

@@ -38,6 +38,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("../atomic-file");
+var C = require("../constants");
 var frameworkFiles = require("../framework-files");
 var vaultWrap = require("./wrap");
 var { defineClass } = require("../framework-error");
@@ -75,17 +76,6 @@ function _requirePassphrase(opts, fieldName) {
   }
 }
 
-// fsync-by-path semantic: open then sync then close. atomicFile.fsync
-// expects an already-open fd; this wrapper opens the file we just
-// wrote, flushes its contents, and closes — the right shape when we
-// don't have the original write fd around.
-function _fsyncPath(p) {
-  try {
-    var fd = nodeFs.openSync(p, "r+");
-    try { atomicFile.fsync(fd); } finally { nodeFs.closeSync(fd); }
-  } catch (_e) { /* best-effort across filesystems */ }
-}
-
 // ---- Pre-flight checks (no side effects) ----
 
 function preflightSealable(opts) {
@@ -142,16 +132,18 @@ async function seal(opts) {
   var p = _paths(opts.dataDir);
   var keepPlaintext = !!opts.keepPlaintext;
 
-  var plainBytes = nodeFs.readFileSync(p.plaintext);
+  var plainBytes = atomicFile.fdSafeReadSync(p.plaintext, { maxBytes: C.BYTES.kib(64) });
   var sealedBytes = await vaultWrap.wrap(plainBytes, opts.passphrase);
 
-  // Step 1: write sealed.tmp + fsync
-  nodeFs.writeFileSync(p.sealedTmp, sealedBytes, { mode: 0o600 });
-  _fsyncPath(p.sealedTmp);
+  // Step 1: write sealed.tmp (exclusive + no-follow create, fsynced) — a
+  // bare writeFileSync to this PREDICTABLE temp name would follow a symlink
+  // pre-planted at sealed.tmp (CWE-59); writeExclSync clears any stale entry
+  // then creates with O_EXCL | O_NOFOLLOW and fsyncs the bytes.
+  atomicFile.writeExclSync(p.sealedTmp, sealedBytes, { fileMode: 0o600 });
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip verify the .tmp before committing the rename
-  var verifyBytes = nodeFs.readFileSync(p.sealedTmp);
+  var verifyBytes = atomicFile.fdSafeReadSync(p.sealedTmp, { maxBytes: C.BYTES.kib(64) });
   var unwrapped;
   try {
     unwrapped = await vaultWrap.unwrap(verifyBytes, opts.passphrase);
@@ -195,7 +187,7 @@ async function unseal(opts) {
   }
   var p = _paths(opts.dataDir);
 
-  var sealedBytes = nodeFs.readFileSync(p.sealed);
+  var sealedBytes = atomicFile.fdSafeReadSync(p.sealed, { maxBytes: C.BYTES.kib(64) });
   var plainBytes;
   try {
     plainBytes = await vaultWrap.unwrap(sealedBytes, opts.passphrase);
@@ -205,13 +197,15 @@ async function unseal(opts) {
       " — " + SEALED_NAME + " is UNCHANGED");
   }
 
-  // Step 1: write plaintext.tmp + fsync
-  nodeFs.writeFileSync(p.plaintextTmp, plainBytes, { mode: 0o600 });
-  _fsyncPath(p.plaintextTmp);
+  // Step 1: write plaintext.tmp (exclusive + no-follow create, fsynced) — a
+  // bare writeFileSync to this PREDICTABLE temp name would follow a symlink
+  // pre-planted at plaintext.tmp (CWE-59); writeExclSync clears any stale
+  // entry then creates with O_EXCL | O_NOFOLLOW and fsyncs the bytes.
+  atomicFile.writeExclSync(p.plaintextTmp, plainBytes, { fileMode: 0o600 });
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip sanity — re-read tmp and verify
-  var verifyBytes = nodeFs.readFileSync(p.plaintextTmp);
+  var verifyBytes = atomicFile.fdSafeReadSync(p.plaintextTmp, { maxBytes: C.BYTES.kib(64) });
   if (Buffer.compare(verifyBytes, plainBytes) !== 0) {
     try { nodeFs.unlinkSync(p.plaintextTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-mismatch",
@@ -246,7 +240,7 @@ async function rotate(opts) {
   }
   var p = _paths(opts.dataDir);
 
-  var sealedBytes = nodeFs.readFileSync(p.sealed);
+  var sealedBytes = atomicFile.fdSafeReadSync(p.sealed, { maxBytes: C.BYTES.kib(64) });
   var plainBytes;
   try {
     plainBytes = await vaultWrap.unwrap(sealedBytes, opts.oldPassphrase);
@@ -257,14 +251,16 @@ async function rotate(opts) {
   }
   var newSealedBytes = await vaultWrap.wrap(plainBytes, opts.newPassphrase);
 
-  // Step 1: write new sealed.tmp + fsync
-  nodeFs.writeFileSync(p.sealedTmp, newSealedBytes, { mode: 0o600 });
-  _fsyncPath(p.sealedTmp);
+  // Step 1: write new sealed.tmp (exclusive + no-follow create, fsynced) — a
+  // bare writeFileSync to this PREDICTABLE temp name would follow a symlink
+  // pre-planted at sealed.tmp (CWE-59); writeExclSync clears any stale entry
+  // then creates with O_EXCL | O_NOFOLLOW and fsyncs the bytes.
+  atomicFile.writeExclSync(p.sealedTmp, newSealedBytes, { fileMode: 0o600 });
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip verify with NEW passphrase, AND assert unwrap
   // with the OLD passphrase fails — otherwise the rotation didn't take.
-  var verifyBytes = nodeFs.readFileSync(p.sealedTmp);
+  var verifyBytes = atomicFile.fdSafeReadSync(p.sealedTmp, { maxBytes: C.BYTES.kib(64) });
   var verifyPlain;
   try { verifyPlain = await vaultWrap.unwrap(verifyBytes, opts.newPassphrase); }
   catch (e) {

package/lib/vendor/blamejs/lib/vault/passphrase-source.js

@@ -23,10 +23,10 @@
  * exposure to later env-dump surfaces. This doesn't zero the memory
  * (JavaScript can't) but does remove the env-object reference.
  */
-var nodeFs = require("node:fs");
 var readline = require("node:readline");
 var safeEnv = require("../parsers/safe-env");
 var safeBuffer = require("../safe-buffer");
+var atomicFile = require("../atomic-file");
 
 var MAX_PASSPHRASE_BYTES = 4096;
 
@@ -83,9 +83,14 @@ async function fromFile(filePath, opts) {
   }
   var raw;
   try {
-    raw = nodeFs.readFileSync(filePath);
+    // Cap the passphrase-file read at MAX_PASSPHRASE_BYTES at READ time (was only
+    // checked AFTER the whole file was in memory), so a swapped multi-GiB target
+    // can't OOM boot before validatePassphraseBuffer. NO refuseSymlink: the
+    // BLAMEJS_VAULT_PASSPHRASE_FILE is frequently a k8s projected-secret mount,
+    // which is a symlink chain — following it is correct.
+    raw = atomicFile.fdSafeReadSync(filePath, { maxBytes: MAX_PASSPHRASE_BYTES });
   } catch (e) {
-    throw new Error("failed to read " + envVars.file + " (" + filePath + "): " + e.code);
+    throw new Error("failed to read " + envVars.file + " (" + filePath + "): " + (e.code || e.message));
   }
   var buf = trimTrailingNewlines(raw);
   validatePassphraseBuffer(buf, "file source (" + filePath + ")");

package/lib/vendor/blamejs/lib/vault/rotate.js

@@ -493,16 +493,11 @@ function _emit(cb, ev) {
 // staging dir is already 0o700 owner-only, so this is defense in depth
 // against a same-user pre-plant / symlink swap (CWE-377 / CWE-379 / CWE-59).
 function _writeStagedFileExclusive(p, data) {
-  try { nodeFs.unlinkSync(p); } catch (_e) { /* no stale entry to clear */ }
-  var fd = nodeFs.openSync(p,
-    nodeFs.constants.O_WRONLY | nodeFs.constants.O_CREAT |
-      nodeFs.constants.O_EXCL | (nodeFs.constants.O_NOFOLLOW || 0), 0o600);
-  try {
-    nodeFs.writeFileSync(fd, data);
-    nodeFs.fsyncSync(fd);
-  } finally {
-    nodeFs.closeSync(fd);
-  }
+  // The clear-stale + O_EXCL|O_NOFOLLOW create + write + fsync sequence now
+  // lives in the atomic-file primitive (also used by the vault passphrase
+  // seal/unseal staging writes) so every staged exclusive write shares one
+  // implementation.
+  atomicFile.writeExclSync(p, data, { fileMode: 0o600 });
 }
 
 function _reSealValue(sealedValue, oldKeys, newKeys) {
@@ -759,7 +754,7 @@ async function rotate(opts) {
     // Stage via the exclusive-create + fsync helper rather than a plain copy,
     // so the verbatim file is durable at write time (no later by-path fsync)
     // and a pre-planted file/symlink at the staging path hard-fails.
-    _writeStagedFileExclusive(dest, nodeFs.readFileSync(src));
+    _writeStagedFileExclusive(dest, atomicFile.fdSafeReadSync(src, { maxBytes: C.BYTES.mib(64) }));
   }
   for (var vd = 0; vd < paths.verbatimDirs.length; vd++) {
     var dent = paths.verbatimDirs[vd];
@@ -797,7 +792,7 @@ async function rotate(opts) {
   var dbKeySealedPath = nodePath.join(dataDir, paths.dbKeySealed);
   var dbKey = null;
   if (nodeFs.existsSync(dbKeySealedPath)) {
-    var sealedKey = nodeFs.readFileSync(dbKeySealedPath, "utf8").trim();
+    var sealedKey = atomicFile.fdSafeReadSync(dbKeySealedPath, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }).trim();
     if (vaultAad.isAadSealed(sealedKey)) {
       // AAD-bound db.key.enc (db.js since v0.14.7): unseal under the OLD
       // root with the deployment-context AAD, then re-emit under the NEW
@@ -832,7 +827,7 @@ async function rotate(opts) {
       }
       continue;
     }
-    var current = nodeFs.readFileSync(asSrc, "utf8").trim();
+    var current = atomicFile.fdSafeReadSync(asSrc, { maxBytes: C.BYTES.mib(1), encoding: "utf8" }).trim();
     if (current.indexOf(C.VAULT_PREFIX) !== 0) {
       throw new VaultRotateError("vault-rotate/bad-sealed",
         "rotate: sealed file does not start with the vault prefix: " + ase.relativePath);
@@ -854,11 +849,11 @@ async function rotate(opts) {
     // Stage via the exclusive-create + fsync helper (not a plain copy) so the
     // salt is durable at write time and no later by-path fsync is needed.
     _writeStagedFileExclusive(nodePath.join(stagingDir, "vault.derived-hash-salt"),
-      nodeFs.readFileSync(saltSrc));
+      atomicFile.fdSafeReadSync(saltSrc, { maxBytes: C.BYTES.kib(4) }));
   }
   var macSrc = nodePath.join(dataDir, "vault.derived-hash-mac.sealed");
   if (nodeFs.existsSync(macSrc)) {
-    var macCurrent = nodeFs.readFileSync(macSrc, "utf8").trim();
+    var macCurrent = atomicFile.fdSafeReadSync(macSrc, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }).trim();
     if (macCurrent.indexOf(C.VAULT_PREFIX) === 0) {
       _writeStagedFileExclusive(nodePath.join(stagingDir, "vault.derived-hash-mac.sealed"),
         _reSealValue(macCurrent, oldKeys, newKeys));
@@ -873,7 +868,7 @@ async function rotate(opts) {
   var verifyResult = null;
 
   if (nodeFs.existsSync(encDbPath) && dbKey) {
-    var packed = nodeFs.readFileSync(encDbPath);
+    var packed = atomicFile.fdSafeReadSync(encDbPath, { maxBytes: C.BYTES.gib(2) });
     // db.enc is XChaCha20-Poly1305-sealed AAD-bound to its dataDir
     // (db.js _dbEncAad). Read with the dataDir AAD; retry without AAD for
     // pre-AAD envelopes (mirrors db.js:765-768). The in-place swap keeps
@@ -945,7 +940,7 @@ async function rotate(opts) {
     // _writeStagedFileExclusive — exclusive + no-follow create, owner-only
     // 0o600 — so a same-user pre-plant or symlink swap is a hard failure
     // rather than a followed write, and the bytes never inherit a wider mode.
-    var rotatedBytes = nodeFs.readFileSync(tmpDbPath);
+    var rotatedBytes = atomicFile.fdSafeReadSync(tmpDbPath, { maxBytes: C.BYTES.gib(2) });
     // Re-encrypt under the SAME dataDir AAD so db.init's AAD-first open
     // succeeds after the staged dir is swapped over dataDir in place.
     _writeStagedFileExclusive(nodePath.join(stagingDir, paths.encryptedDb),
@@ -956,7 +951,7 @@ async function rotate(opts) {
     _emit(progress, { phase: "verify" });
     var verifyTmp = nodePath.join(stagingDir, "_blamejs_verify.tmp.db");
     _writeStagedFileExclusive(verifyTmp,
-      bCrypto.decryptPacked(nodeFs.readFileSync(nodePath.join(stagingDir, paths.encryptedDb)), dbKey, dbEncAad));
+      bCrypto.decryptPacked(atomicFile.fdSafeReadSync(nodePath.join(stagingDir, paths.encryptedDb), { maxBytes: C.BYTES.gib(2) }), dbKey, dbEncAad));
     var vdb = new DatabaseSync(verifyTmp);
     try {
       verifyResult = verify({ keys: newKeys, db: vdb, oldKeys: oldKeys });

package/lib/vendor/blamejs/lib/vault/seal-pem-file.js

@@ -232,7 +232,10 @@ function sealPemFile(opts) {
       }
     }
     var sealed = vault().seal(plaintextBytes);
-    nodeFs.writeFileSync(markerPath, String(Date.now()), { mode: 0o600 });   // POSIX file mode
+    // Atomic, symlink-refusing marker write (matches the destination write
+    // just below) — a bare writeFileSync would follow a symlink planted at
+    // markerPath (CWE-59).
+    atomicFile.writeSync(markerPath, String(Date.now()), { fileMode: 0o600 });   // POSIX file mode
     try {
       atomicFile.writeSync(destination, sealed, { fileMode: 0o600 });    // POSIX file mode
     } catch (e) {

package/lib/vendor/blamejs/lib/vc.js

@@ -226,7 +226,7 @@ function _verifyJose(token, opts, expectedTyp) {
     throw new VcError("vc/crit-unsupported",
       "vc.verify: JWS 'crit' header lists extensions this verifier does not support (RFC 7515 §4.1.11)");
   }
-  if (header.alg === "none" || !JOSE_ALGS[header.alg]) {
+  if (header.alg === "none" || !Object.prototype.hasOwnProperty.call(JOSE_ALGS, header.alg)) {
     throw new VcError("vc/bad-alg", "vc.verify: unsupported or unsecured JWS alg '" + header.alg + "'");
   }
   if (opts.algorithms.indexOf(header.alg) === -1) {

package/lib/vendor/blamejs/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:5d539dfc9ef47121d4c09bd7256d76448a1f5ac47ee09ac44c78ff6a062af9ab"
       },
-      "refreshedAt": "2026-05-27T17:51:05.993Z"
+      "refreshedAt": "2026-06-20T04:17:15.833Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731"
       },
-      "refreshedAt": "2026-05-27T17:51:05.993Z"
+      "refreshedAt": "2026-06-20T04:17:15.833Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68"
       },
-      "refreshedAt": "2026-05-27T17:51:05.993Z"
+      "refreshedAt": "2026-06-20T04:17:15.833Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.1",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:f359a782ac57e3ff56ac71083d17f5c082f88ab49d645fc2bede398b47adebdb"
       },
-      "refreshedAt": "2026-05-27T17:51:05.993Z"
+      "refreshedAt": "2026-06-20T04:17:15.833Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-05-27T17:51:05.993Z"
+      "refreshedAt": "2026-06-20T04:17:15.833Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-05-27T17:51:05.993Z"
+      "refreshedAt": "2026-06-20T04:17:15.833Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -154,12 +154,12 @@
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
       "bundledAt": "2026-05-13T00:00:00Z",
       "hashes": {
-        "server": "sha256:f15642cea028662c39d380caa9ddfbe36c81466e3a82f8f4b10703d83760295c",
-        "data_js": "sha256:b4b6ae76fdacbfe07683c4ea62761326f42894c2ccf4359f253bbcab9826ed04"
+        "server": "sha256:927884952ea8857ba3608eefe617f3c8acd63ad94be7b0bfb7586632cfc59560",
+        "data_js": "sha256:c2f67f5e7f7306eb5ec26548ea275673c652cfdd830b909fd63ed2b39e4838f6"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-05-27T17:51:05.993Z"
+      "refreshedAt": "2026-06-20T04:17:15.833Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77"
       },
-      "refreshedAt": "2026-05-27T17:51:05.993Z"
+      "refreshedAt": "2026-06-20T04:17:15.833Z"
     }
   }
 }

package/lib/vendor/blamejs/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-05-07_00-57-25_UTC
-// COMMIT: ee780bcf233174cb23ba8575d54c4154d47508e1
+// VERSION: 2026-06-13_21-47-18_UTC
+// COMMIT: 9186eeeda85cef35b1551d00731464939c765cab
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -1403,6 +1403,7 @@ video.hu
 // id : https://www.iana.org/domains/root/db/id.html
 id
 ac.id
+ai.id
 biz.id
 co.id
 desa.id
@@ -6157,7 +6158,6 @@ k12.mo.us
 k12.ms.us
 k12.mt.us
 k12.nc.us
-// k12.nd.us - Bug 1028347 - Removed at request of Travis Rosso <trossow@nd.gov>
 k12.ne.us
 k12.nh.us
 k12.nj.us
@@ -6239,8 +6239,6 @@ cc.mt.us
 lib.mt.us
 cc.nc.us
 lib.nc.us
-cc.nd.us
-lib.nd.us
 cc.ne.us
 lib.ne.us
 cc.nh.us
@@ -6824,7 +6822,7 @@ org.zw
 
 // newGTLDs
 
-// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2026-04-30T16:18:08Z
+// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2026-06-13T16:12:40Z
 // This list is auto-generated, don't edit it manually.
 // aaa : American Automobile Association, Inc.
 // https://www.iana.org/domains/root/db/aaa.html
@@ -10878,7 +10876,7 @@ xin
 // https://www.iana.org/domains/root/db/xn--5su34j936bgsg.html
 香格里拉
 
-// xn--5tzm5g : Global Website TLD Asia Limited
+// xn--5tzm5g : Jolly Host, LLC
 // https://www.iana.org/domains/root/db/xn--5tzm5g.html
 网站
 
@@ -12577,10 +12575,12 @@ cafjs.com
 // Submitted by Joel Aquilina <publicsuffixlist@canva.com>
 canva-apps.cn
 my.canvasite.cn
+khsj.cn
 canva-apps.com
 canva-hosted-embed.com
 canvacode.com
 rice-labs.com
+canva.link
 canva.run
 my.canva.site
 
@@ -13894,6 +13894,10 @@ whitesnow.jp
 zombie.jp
 heteml.net
 
+// GNTC, Inc. : https://gntc.com/
+// Submitted by VibeHost Security <security@vibehost.com>
+vibehost.space
+
 // GoDaddy Registry : https://registry.godaddy
 // Submitted by Rohan Durrant <tldns@registry.godaddy>
 graphic.design
@@ -14061,6 +14065,10 @@ ltd.ng
 ngo.ng
 plc.ng
 
+// Hostinger : https://hostinger.com
+// Submitted by Valentinas Cirba <domains@hostinger.com>
+hstgr.cloud
+
 // HostyHosting : https://hostyhosting.com
 hostyhosting.io
 
@@ -15048,6 +15056,7 @@ opensocial.site
 // OpenAI : https://openai.com
 // Submitted by Thomas Shadwell <security@openai.com>
 *.oaiusercontent.com
+chatgpt.site
 
 // OpenCraft GmbH : http://opencraft.com/
 // Submitted by Sven Marnach <sven@opencraft.com>
@@ -16005,6 +16014,11 @@ reservd.testing.thingdust.io
 // Submitted by Christian Franke <it@ticket.io>
 tickets.io
 
+// Tigris Data, Inc. : https://www.tigrisdata.com
+// Submitted by Bo Cao <security@tigrisdata.com>
+t3.storage.dev
+t3.storageapi.dev
+
 // Tlon.io : https://tlon.io
 // Submitted by Mark Staarink <mark@tlon.io>
 arvo.network
@@ -16197,11 +16211,10 @@ webflowtest.io
 *.webhare.dev
 
 // WebHotelier Technologies Ltd : https://www.webhotelier.net/
-// Submitted by Apostolos Tsakpinis <apostolos.tsakpinis@gmail.com>
-bookonline.app
+// Submitted by Apostolos Tsakpinis <cto@webhotelier.net>
 hotelwithflight.com
-reserve-online.com
 reserve-online.net
+book.online
 
 // WebPros International, LLC : https://webpros.com/
 // Submitted by Nicolas Rochelemagne <public.suffix@webpros.com>