@blamejs/blamejs-shop 0.4.85 → 0.4.86

package/lib/vendor/blamejs/test/layer-0-primitives/fido-mds3-cert-bad-validity.test.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * b.auth.fidoMds3 — x5c cert validity-window must fail closed when the
+ * notBefore / notAfter dates are present but unparseable.
+ *
+ * _validateChain reads chain[v].validFrom / .validTo and feeds them to
+ * Date.parse. A cert whose encoded validity dates parse to NaN (e.g. a
+ * malformed / hand-forged DER) makes isFinite(notBefore) /
+ * isFinite(notAfter) false, which — pre-fix — SKIPS both the
+ * not-yet-valid and the expired checks, so the cert sails through the
+ * validity window unchecked. The verifier must instead refuse with
+ * fido-mds3/cert-bad-validity.
+ *
+ * The test drives the real fetch() consumer path with a mocked
+ * httpClient serving a genuine RS256-signed BLOB whose self-signed leaf
+ * is also the operator-supplied caCertificate, so absent the validity
+ * bug the chain anchors and the JWS verifies — the validity-window
+ * check is the only gate left. node:crypto's X509Certificate is
+ * overridden so the parsed leaf reports an unparseable validFrom while
+ * every other cert behaviour (verify / checkIssued / publicKey /
+ * fingerprint256) stays real.
+ */
+
+var nodeCrypto = require("node:crypto");
+var helpers = require("../helpers");
+var check   = helpers.check;
+
+// Mint an RSA self-signed cert + matching private-key PEM via the
+// vendored pki bundle, mirroring the sibling fido-mds3 test fixture.
+async function _makeSelfSignedRsaCert() {
+  var pki  = require("../../lib/vendor/pki.cjs");
+  var x509 = pki.x509;
+  var keys = await nodeCrypto.webcrypto.subtle.generateKey(
+    { name:           "RSASSA-PKCS1-v1_5",
+      modulusLength:  2048,
+      publicExponent: new Uint8Array([1, 0, 1]),
+      hash:           "SHA-256" },
+    true, ["sign", "verify"]);
+  var now      = new Date();
+  var notAfter = new Date(now.getTime() + 7 * 86400000);
+  var cert = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber:     "01",
+    name:             "CN=blamejs-mds3-test-root",
+    notBefore:        now,
+    notAfter:         notAfter,
+    signingAlgorithm: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    keys:             keys,
+    extensions:       [
+      new x509.BasicConstraintsExtension(true, 0, true),
+      new x509.KeyUsagesExtension(
+        x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.digitalSignature,
+        true),
+    ],
+  });
+  var pkcs8  = await nodeCrypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+  var pkB64  = Buffer.from(pkcs8).toString("base64").match(/.{1,64}/g).join("\n");
+  var keyPem = "-----BEGIN PRIVATE KEY-----\n" + pkB64 + "\n-----END PRIVATE KEY-----\n";
+  return { keyPem: keyPem, certPem: cert.toString("pem") };
+}
+
+function _b64url(buf) {
+  return Buffer.from(buf).toString("base64url");
+}
+
+function _makeBlob(payload, keyPem, certPem) {
+  var derB64 = certPem
+    .replace(/-----BEGIN CERTIFICATE-----/g, "")
+    .replace(/-----END CERTIFICATE-----/g, "")
+    .replace(/\s+/g, "");
+  var header     = { alg: "RS256", typ: "JWT", x5c: [derB64] };
+  var headerB64  = _b64url(JSON.stringify(header));
+  var payloadB64 = _b64url(JSON.stringify(payload));
+  var signingInput = headerB64 + "." + payloadB64;
+  var sig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "ascii"), {
+    key:     keyPem,
+    padding: nodeCrypto.constants.RSA_PKCS1_PADDING,
+  });
+  return signingInput + "." + _b64url(sig);
+}
+
+function _futureDateString(daysFromNow) {
+  var d = new Date(Date.now() + daysFromNow * 86400000);
+  return d.toISOString().slice(0, 10);
+}
+
+// Make every freshly-parsed X509Certificate report an unparseable
+// validFrom (Date.parse -> NaN) while keeping all real cert behaviour.
+async function _withUnparseableValidFrom(fn) {
+  var realX509 = nodeCrypto.X509Certificate;
+  function Wrapped(arg) {
+    var c = new realX509(arg);
+    Object.defineProperty(c, "validFrom", {
+      configurable: true,
+      get: function () { return "GARBAGE-NOT-A-DATE"; },
+    });
+    return c;
+  }
+  nodeCrypto.X509Certificate = Wrapped;
+  try { return await fn(); }
+  finally { nodeCrypto.X509Certificate = realX509; }
+}
+
+async function run() {
+  var pair = await _makeSelfSignedRsaCert();
+  var payload = {
+    legalHeader: "Test BLOB",
+    no: 1,
+    nextUpdate: _futureDateString(7),
+    entries: [{
+      aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+      metadataStatement: { description: "Test entry" },
+      statusReports: [{ status: "FIDO_CERTIFIED_L2" }],
+    }],
+  };
+  var token = _makeBlob(payload, pair.keyPem, pair.certPem);
+
+  // Mock httpClient.request via require-cache override (sibling pattern).
+  var hcPath = require.resolve("../../lib/http-client");
+  var origHc = require.cache[hcPath].exports;
+  require.cache[hcPath].exports = Object.assign({}, origHc, {
+    request: async function () {
+      return { statusCode: 200, headers: {}, body: Buffer.from(token, "ascii") };
+    },
+  });
+
+  // Re-require the verifier so it captures both the mocked httpClient and
+  // the wrapped X509Certificate through its module-level references.
+  var fmPath = require.resolve("../../lib/auth/fido-mds3");
+  delete require.cache[fmPath];
+  var fm = require(fmPath);
+
+  var threw = null;
+  try {
+    await _withUnparseableValidFrom(async function () {
+      await fm.fetch({
+        url:           "https://test.invalid/mds3",
+        caCertificate: pair.certPem,
+        force:         true,
+      });
+    });
+  } catch (e) {
+    threw = e;
+  } finally {
+    require.cache[hcPath].exports = origHc;
+    delete require.cache[fmPath];
+  }
+
+  check("fetch rejects a cert with present-but-unparseable validity dates",
+        threw !== null);
+  check("rejection is fido-mds3/cert-bad-validity (fail closed, not silently accepted)",
+        threw && /cert-bad-validity/.test(threw.code || ""));
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/graphql-federation.test.js

@@ -38,14 +38,61 @@ async function run() {
 
   // nonceHeader override — the replay nonce can be read from a custom
   // request header (not just the Apollo-vendor default), for operators
-  // fronting the gateway with a non-Apollo router.
+  // fronting the gateway with a non-Apollo router. The replay store speaks
+  // the framework's ATOMIC checkAndInsert(nonce, expireAt) contract.
   var withNonce = b.graphqlFederation.guardSdl({
     routerToken: "a".repeat(64),
-    nonceStore:  { has: function () { return false; }, remember: function () {} },
+    nonceStore:  { checkAndInsert: function () { return true; } },
     nonceHeader: "x-my-nonce",
   });
   check("guardSdl: accepts custom nonceHeader", typeof withNonce === "function");
 
+  // #328 sibling — the replay nonceStore must speak the framework's ATOMIC
+  // checkAndInsert(nonce, expireAt) contract (was a racy non-atomic
+  // has()-then-remember() check-then-set). A store lacking checkAndInsert —
+  // including the legacy { has, remember } shape — is refused at config time.
+  var racyStoreThrew = null;
+  try {
+    b.graphqlFederation.guardSdl({
+      routerToken: "a".repeat(64),
+      nonceStore:  { has: function () { return false; }, remember: function () {} },
+    });
+  } catch (e) { racyStoreThrew = e; }
+  check("guardSdl: refuses a nonceStore lacking checkAndInsert (legacy racy has/remember)",
+        racyStoreThrew && racyStoreThrew.code === "graphql-federation/bad-nonce-store");
+
+  // The framework's own b.nonceStore.create drops straight in, and a replay of
+  // the SAME nonce on a valid bearer _service probe is refused (401) — driving
+  // the REAL consumer path through the atomic store.
+  var nonceStore = b.nonceStore.create({ backend: "memory" });
+  var nguard = b.graphqlFederation.guardSdl({
+    routerToken: "a".repeat(64), nonceStore: nonceStore, audit: false,
+  });
+  function _driveNonce(nonce) {
+    return new Promise(function (resolve) {
+      var out = { status: null, nextCalled: false };
+      var res = {
+        statusCode: 200,
+        setHeader: function () {}, getHeader: function () { return undefined; },
+        writeHead: function (s) { out.status = s; },
+        end: function () { if (out.status === null) out.status = res.statusCode; resolve(out); },
+      };
+      nguard({
+        method:  "POST",
+        headers: { authorization: "Bearer " + "a".repeat(64),
+                   "x-apollographql-router-nonce": nonce },
+        body:    { query: "{ _service { sdl } }" },
+        on:      function () {},
+      }, res, function () { out.nextCalled = true; resolve(out); });
+    });
+  }
+  var freshNonce = await _driveNonce("nonce-aaaaaaaaaaaaaaaa");
+  check("guardSdl: fresh nonce on a valid bearer _service probe is forwarded",
+        freshNonce.nextCalled === true && freshNonce.status === null);
+  var replayNonce = await _driveNonce("nonce-aaaaaaaaaaaaaaaa");
+  check("guardSdl: a replayed nonce is refused (401), not forwarded",
+        replayNonce.status === 401 && replayNonce.nextCalled === false);
+
   // ---- guardSdl drives: a batched ARRAY body whose SECOND operation probes
   // _service must be refused (401) without a router token, not forwarded. ----
   function _drive(mw, body) {

package/lib/vendor/blamejs/test/layer-0-primitives/mail-auth-dmarc-policy-failclosed.test.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * b.mail.dmarc.evaluate — a DMARC record that lacks a valid required p=
+ * tag (RFC 7489 §6.3) must NOT recommend "deliver" for a failing/unaligned
+ * message.
+ *
+ * Regression: _parseDmarcRecord took p= / sp= verbatim and never required
+ * p=, so the disposition ternary mapped any policy.p that was not exactly
+ * "reject"/"quarantine" — including null (no p=) and typos ("rejct") —
+ * to recommendedAction "deliver". A spoofed sender with a
+ * failing SPF and no DKIM therefore got result:"fail" +
+ * recommendedAction:"deliver" (fail-open). The fix validates p=/sp= against
+ * {none,quarantine,reject}, requires a valid p= for the record to count,
+ * and fails closed (permerror, no "deliver") on an absent/invalid policy.
+ *
+ * Network-free: DNS is supplied via an operator dnsLookup mock.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+// Failing/unaligned auth for a spoofed sender: SPF fail, no DKIM, From a
+// domain whose published DMARC record is the one under test.
+var SPOOF = {
+  from: "ceo@victim.example",
+  spf:  { result: "fail", domain: "attacker.invalid" },
+  dkim: [],
+};
+
+function dnsReturning(record) {
+  return async function (host) {
+    if (host === "_dmarc.victim.example") {
+      return [[record]];
+    }
+    var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+  };
+}
+
+async function testNoPolicyTagFailsClosed() {
+  // RFC 7489 §6.3 — p= is REQUIRED. A record without it carries no usable
+  // policy; the receiver must treat it as none/permerror, NOT deliver.
+  var rv = await b.mail.dmarc.evaluate(Object.assign({}, SPOOF, {
+    dnsLookup: dnsReturning("v=DMARC1; adkim=s; aspf=s"),
+  }));
+  check("dmarc.evaluate: missing p= → NOT deliver",
+        rv.recommendedAction !== "deliver");
+  check("dmarc.evaluate: missing p= → permerror",
+        rv.result === "permerror");
+}
+
+async function testTypoPolicyTagFailsClosed() {
+  // "rejct" is not a recognized policy; must not silently fall through to
+  // deliver.
+  var rv = await b.mail.dmarc.evaluate(Object.assign({}, SPOOF, {
+    dnsLookup: dnsReturning("v=DMARC1; p=rejct"),
+  }));
+  check("dmarc.evaluate: typo p=rejct → NOT deliver",
+        rv.recommendedAction !== "deliver");
+  check("dmarc.evaluate: typo p=rejct → permerror",
+        rv.result === "permerror");
+}
+
+async function testWhitespacePaddedPolicyTag() {
+  // RFC 7489 §6.4 tag-list grammar permits whitespace around the value;
+  // "p= reject " is a legitimate reject policy once the grammar's trim
+  // applies — it must NOT deliver the spoofed/failing message.
+  var rv = await b.mail.dmarc.evaluate(Object.assign({}, SPOOF, {
+    dnsLookup: dnsReturning("v=DMARC1; p= reject "),
+  }));
+  check("dmarc.evaluate: whitespace-padded p= reject → NOT deliver",
+        rv.recommendedAction !== "deliver");
+  check("dmarc.evaluate: whitespace-padded p= reject → fail + reject",
+        rv.result === "fail" && rv.recommendedAction === "reject");
+}
+
+async function testBadSpTagFailsClosed() {
+  // sp= feeds policy.p on the organizational-domain path; an invalid sp=
+  // value must fail closed there too (validated like p=).
+  var policy;
+  var threw = false;
+  try {
+    policy = b.mail.dmarc.parseRecord("v=DMARC1; p=reject; sp=quarntine");
+  } catch (e) {
+    threw = true;
+    check("dmarc.parseRecord: bad sp= throws dmarcbis-bad-tag",
+          e && e.code === "mail-auth/dmarcbis-bad-tag");
+  }
+  check("dmarc.parseRecord: bad sp= rejected", threw === true && !policy);
+}
+
+async function testMissingPolicyParseThrows() {
+  // parseRecord must reject a record missing the required p= outright.
+  var threw = false;
+  try {
+    b.mail.dmarc.parseRecord("v=DMARC1; adkim=s");
+  } catch (e) {
+    threw = true;
+    check("dmarc.parseRecord: missing p= throws dmarc-missing-policy",
+          e && e.code === "mail-auth/dmarc-missing-policy");
+  }
+  check("dmarc.parseRecord: missing p= rejected", threw === true);
+}
+
+async function testValidRejectStillFailsClosed() {
+  // Control: a well-formed p=reject for the same spoofed/failing message
+  // still reaches the reject disposition (the fix doesn't over-broaden).
+  var rv = await b.mail.dmarc.evaluate(Object.assign({}, SPOOF, {
+    dnsLookup: dnsReturning("v=DMARC1; p=reject"),
+  }));
+  check("dmarc.evaluate: valid p=reject + spoof → fail + reject",
+        rv.result === "fail" && rv.recommendedAction === "reject");
+}
+
+async function testValidNoneDelivers() {
+  // Control: p=none is monitor-only → deliver is the correct disposition.
+  var rv = await b.mail.dmarc.evaluate(Object.assign({}, SPOOF, {
+    dnsLookup: dnsReturning("v=DMARC1; p=none"),
+  }));
+  check("dmarc.evaluate: valid p=none + spoof → fail + deliver (monitor)",
+        rv.result === "fail" && rv.recommendedAction === "deliver");
+}
+
+async function run() {
+  await testNoPolicyTagFailsClosed();
+  await testTypoPolicyTagFailsClosed();
+  await testWhitespacePaddedPolicyTag();
+  await testBadSpTagFailsClosed();
+  await testMissingPolicyParseThrows();
+  await testValidRejectStillFailsClosed();
+  await testValidNoneDelivers();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/mail-bimi-cert-validity-unparseable.test.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * b.mail.bimi — VMC / CMC certificate validity-window enforcement when the
+ * cert's notBefore / notAfter are PRESENT but UNPARSEABLE.
+ *
+ * _verifyCertChain reads `current.validFrom` / `current.validTo` and runs
+ * `Date.parse` to derive the validity window. A cert whose date strings
+ * Date.parse cannot interpret yields NaN. The window checks were guarded by
+ * `isFinite(...)`, so a NaN date SKIPPED both the not-yet-valid and the
+ * expired check and the cert validated — a present-but-unparseable validity
+ * window must FAIL CLOSED, not be waved through.
+ *
+ * This drives the real consumer path: b.mail.bimi.fetchAndVerifyMark with a
+ * self-signed test chain + stubbed httpClient. Date.parse is stubbed to
+ * return NaN for exactly the leaf cert's two date strings (simulating a cert
+ * whose ASN.1 time fields node surfaces as a string Date.parse rejects);
+ * every other Date.parse call is unaffected, so chain signature / issuer /
+ * SAN / EKU validation proceed normally and the ONLY failing signal is the
+ * unparseable window.
+ *
+ * Live network is NOT used.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+var pki        = require("../../lib/vendor/pki.cjs");
+var x509       = pki.x509;
+var nodeCrypto = require("crypto");
+
+async function _generateTestChain() {
+  var caKeys = await pki.crypto.subtle.generateKey(
+    { name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+  var leafKeys = await pki.crypto.subtle.generateKey(
+    { name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+
+  var now = new Date();
+  var notAfter = new Date(now.getTime() + 365 * 24 * 60 * 60 * 1000);
+
+  var ca = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber: "01",
+    name: "CN=BIMI Test Root",
+    notBefore: now,
+    notAfter: notAfter,
+    signingAlgorithm: { name: "ECDSA", hash: "SHA-256" },
+    keys: caKeys,
+    extensions: [
+      new x509.BasicConstraintsExtension(true, 1, true),
+      new x509.KeyUsagesExtension(
+        x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.cRLSign, true),
+    ],
+  });
+
+  var leaf = await x509.X509CertificateGenerator.create({
+    serialNumber: "02",
+    issuer: ca.subject,
+    subject: "CN=example.com",
+    notBefore: now,
+    notAfter: notAfter,
+    signingAlgorithm: { name: "ECDSA", hash: "SHA-256" },
+    publicKey: leafKeys.publicKey,
+    signingKey: caKeys.privateKey,
+    extensions: [
+      new x509.BasicConstraintsExtension(false, undefined, true),
+      new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature, true),
+      new x509.SubjectAlternativeNameExtension([
+        { type: "dns", value: "example.com" },
+      ]),
+      new x509.ExtendedKeyUsageExtension(["1.3.6.1.5.5.7.3.31"], false),
+    ],
+  });
+
+  return { rootPem: ca.toString("pem"), leafPem: leaf.toString("pem") };
+}
+
+function _stubHttpClient(body) {
+  return {
+    request: function () {
+      return Promise.resolve({
+        statusCode: 200,
+        headers:    {},
+        body:       Buffer.from(String(body), "utf8"),
+      });
+    },
+  };
+}
+
+async function testUnparseableValidityFailsClosed() {
+  var chain = await _generateTestChain();
+
+  // Surface the leaf's exact date strings the lib will feed to Date.parse,
+  // then stub Date.parse to return NaN for ONLY those two strings — every
+  // other Date.parse call (and the rest of chain validation) is untouched.
+  var leafCert = new nodeCrypto.X509Certificate(chain.leafPem);
+  var certDateStrings = [leafCert.validFrom, leafCert.validTo];
+  var origParse = Date.parse;
+  Date.parse = function (value) {
+    if (certDateStrings.indexOf(value) !== -1) return NaN;
+    return origParse.call(Date, value);
+  };
+
+  var threw = null;
+  var rv = null;
+  try {
+    rv = await b.mail.bimi.fetchAndVerifyMark({
+      domain:          "example.com",
+      vmcUrl:          "https://example.com/cert.pem",
+      trustAnchorsPem: chain.rootPem,
+      httpClient:      _stubHttpClient(chain.leafPem),
+    });
+  } catch (e) {
+    threw = e;
+  } finally {
+    Date.parse = origParse;
+  }
+
+  // RED on the buggy tree: rv.ok === true (cert accepted despite an
+  // unparseable validity window). GREEN after the fix: rejected with
+  // bimi/vmc-chain-invalid and a "validity dates unparseable" reason.
+  check("fetchAndVerifyMark: present-but-unparseable cert validity is rejected",
+        rv === null && threw !== null &&
+        threw.code === "bimi/vmc-chain-invalid");
+  check("fetchAndVerifyMark: unparseable-validity rejection names the cause",
+        threw !== null && /unparseable/i.test(String(threw.message)));
+}
+
+async function run() {
+  await testUnparseableValidityFailsClosed();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime-bad-validity.test.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * b.mail.crypto.smime.checkCert — fail closed on unparseable validity.
+ *
+ * RFC 5280 §4.1.2.5 makes notBefore / notAfter mandatory; checkCert's
+ * validity-window guard refuses certs outside that window. The guard
+ * gated each comparison behind isFinite(Date.parse(...)), so a cert
+ * carrying a PRESENT-but-unparseable validFrom / validTo (Date.parse
+ * → NaN) silently skipped BOTH checks and passed validity. A signing
+ * cert whose dates a peer cannot parse must be refused at preflight,
+ * not accepted and left to fail interop later.
+ *
+ * This drives the real operator consumer path
+ * b.mail.crypto.smime.checkCert({ certPem }). node:crypto's
+ * X509Certificate always exposes parseable RFC date strings, so we
+ * stub the parser on the shared crypto module (require("node:crypto")
+ * === require("crypto"); lib reads X509Certificate off it) to present
+ * unparseable validity to the real checkCert logic.
+ *
+ * Run standalone: `node test/layer-0-primitives/mail-crypto-smime-bad-validity.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+var helpers    = require("../helpers");
+var check      = helpers.check;
+var nodeCrypto = require("crypto");
+
+var b     = helpers.b;
+var smime = b.mail.crypto.smime;
+
+// ---- Stub: a cert that parses fine but carries unparseable dates ----
+//
+// Passes the sig-algorithm (sha256WithRSAEncryption) and RSA-bit
+// (publicKey null → bit-floor check skipped) gates so execution
+// reaches the validity window — the only thing under test here.
+function _withUnparseableValidityCert(validFrom, validTo, fn) {
+  var Real = nodeCrypto.X509Certificate;
+  function StubCert(_input) {
+    return {
+      subject:               "CN=signer.example",
+      issuer:                "CN=signer.example",
+      signatureAlgorithm:    "sha256WithRSAEncryption",
+      signatureAlgorithmOid: "1.2.840.113549.1.1.11",
+      publicKey:             null,
+      fingerprint256:        "AA:BB:CC",
+      validFrom:             validFrom,
+      validTo:               validTo,
+    };
+  }
+  nodeCrypto.X509Certificate = StubCert;
+  try {
+    return fn();
+  } finally {
+    nodeCrypto.X509Certificate = Real;
+  }
+}
+
+var DUMMY_PEM =
+  "-----BEGIN CERTIFICATE-----\nMIIBdummy\n-----END CERTIFICATE-----\n";
+
+function testRejectsUnparseableValidity() {
+  // Both dates unparseable.
+  var threw = null, res = null;
+  _withUnparseableValidityCert("GARBAGE-NOT-A-DATE", "ALSO-GARBAGE", function () {
+    try { res = smime.checkCert({ certPem: DUMMY_PEM }); }
+    catch (e) { threw = e; }
+  });
+  check("checkCert refuses cert with unparseable validity (does not return)",
+    res === null);
+  check("checkCert throws on unparseable validity",
+    threw instanceof Error);
+  check("checkCert unparseable-validity uses the bad-validity code",
+    threw && threw.code === "mail-crypto/smime/bad-validity");
+  check("checkCert unparseable-validity message names the dates",
+    threw && /unparseable validity/.test(threw.message) &&
+    threw.message.indexOf("GARBAGE-NOT-A-DATE") !== -1);
+}
+
+function testRejectsUnparseableNotBeforeOnly() {
+  var threw = null, res = null;
+  // validTo parseable + in the future, validFrom unparseable — the
+  // old isFinite-gated notAfter check passes, so only fail-closed on
+  // the NaN notBefore catches this.
+  var future = new Date(Date.now() + 86400000).toUTCString();
+  _withUnparseableValidityCert("NOT-A-REAL-DATE", future, function () {
+    try { res = smime.checkCert({ certPem: DUMMY_PEM }); }
+    catch (e) { threw = e; }
+  });
+  check("checkCert refuses cert with unparseable notBefore only",
+    res === null && threw && threw.code === "mail-crypto/smime/bad-validity");
+}
+
+function testRejectsUnparseableNotAfterOnly() {
+  var threw = null, res = null;
+  var past = new Date(Date.now() - 86400000).toUTCString();
+  _withUnparseableValidityCert(past, "NOT-A-REAL-DATE", function () {
+    try { res = smime.checkCert({ certPem: DUMMY_PEM }); }
+    catch (e) { threw = e; }
+  });
+  check("checkCert refuses cert with unparseable notAfter only",
+    res === null && threw && threw.code === "mail-crypto/smime/bad-validity");
+}
+
+function testParseableValidityStillPasses() {
+  // Regression: a cert with parseable, in-window dates must NOT be
+  // tripped by the new fail-closed branch.
+  var threw = null, res = null;
+  var past   = new Date(Date.now() - 86400000).toUTCString();
+  var future = new Date(Date.now() + 86400000).toUTCString();
+  _withUnparseableValidityCert(past, future, function () {
+    try { res = smime.checkCert({ certPem: DUMMY_PEM }); }
+    catch (e) { threw = e; }
+  });
+  check("checkCert accepts cert with parseable in-window validity",
+    threw === null && res && res.subject === "CN=signer.example");
+}
+
+function run() {
+  testRejectsUnparseableValidity();
+  testRejectsUnparseableNotBeforeOnly();
+  testRejectsUnparseableNotAfterOnly();
+  testParseableValidityStillPasses();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try {
+    run();
+    console.log("OK — " + helpers.getChecks() + " checks passed");
+  } catch (e) {
+    console.error("FAIL:", e && e.stack || e);
+    process.exit(1);
+  }
+}