@blamejs/blamejs-shop 0.4.85 → 0.4.87

package/lib/vendor/blamejs/lib/mail-dkim.js

@@ -482,6 +482,36 @@ function _parseDkimTagList(value) {
   return tags;
 }
 
+// RFC 6376 §3.5 — x= / t= / l= are unsigned decimal integers ("1*DIGIT").
+// parseInt() is too lenient here ("12abc" → 12, "0x10" → 0, " 12" → 12),
+// so a present-but-malformed value must not be coerced into a finite
+// number that then passes the downstream check. Returns the parsed integer,
+// or null when the value is not a well-formed unsigned integer — the caller
+// fails CLOSED on null. `maxDigits` bounds the digit count (a ReDoS-free
+// length cap; x=/t= are NumericDate, bounded to 12 digits).
+function _parseDkimUnsignedInt(raw, maxDigits) {
+  if (typeof raw !== "string") return null;
+  var len = raw.length;
+  // "1*DIGIT": non-empty, ASCII 0-9 only, length-capped. A char-code scan
+  // (no regex) keeps this linear and avoids a dynamic RegExp / a shared
+  // digit-pattern literal — maxDigits bounds x=/t=/l= to their NumericDate
+  // / octet-count headroom.
+  if (len === 0 || (maxDigits && len > maxDigits)) return null;
+  for (var i = 0; i < len; i++) {
+    var c = raw.charCodeAt(i);
+    if (c < 0x30 || c > 0x39) return null;   // not an ASCII digit
+  }
+  var n = parseInt(raw, 10);
+  if (!isFinite(n)) return null;
+  return n;
+}
+
+// x= / t= are NumericDate (seconds-since-epoch); 12 digits is ample headroom
+// past any realistic epoch and keeps the parse bounded.
+function _parseDkimNumericDate(raw) {
+  return _parseDkimUnsignedInt(raw, 12);
+}
+
 function _selectorTxtToKeyTags(txtRecords) {
   // DKIM key record is a TXT record at <selector>._domainkey.<domain>.
   // Format: "v=DKIM1; k=rsa; p=<base64>" (chunks may be split across
@@ -694,8 +724,16 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
     // the signature still validates against legitimate senders that
     // use l=, but flag in the result. The cap is octets of the
     // CANONICALIZED body (RFC 6376 §3.4.5), applied inside _bodyHashB64.
-    var parsedL = parseInt(sigTags.l, 10);
-    if (isFinite(parsedL) && parsedL >= 0) lcap = parsedL;
+    // l= is an unsigned decimal integer ("1*DIGIT" per §3.5); a
+    // present-but-unparseable value must FAIL CLOSED rather than fall
+    // through to lcap=undefined (hashing the whole body silently masks the
+    // malformed tag instead of refusing it).
+    var parsedL = _parseDkimUnsignedInt(sigTags.l, 18);
+    if (parsedL === null) {
+      return { result: "permerror",
+               errors: ["DKIM-Signature l= present but unparseable (RFC 6376 §3.5 — unsigned integer required)"] };
+    }
+    lcap = parsedL;
   }
 
   // 1. Body-hash check.
@@ -922,34 +960,49 @@ async function verify(rfc822, opts) {
     // attack). Both are in seconds-since-epoch per ABNF.
     var nowSec = Math.floor(Date.now() / C.TIME.seconds(1));
     var clockSkewSec = Math.floor(clockSkewMs / C.TIME.seconds(1));
+    // x= / t= are NumericDate (digits-only seconds-since-epoch per the
+    // §3.5 ABNF). A present-but-unparseable value must FAIL CLOSED — a NaN
+    // result silently skipping the expiry / future-date / ordering checks
+    // would let verification proceed to result:"pass" with NO expiry
+    // enforced (mirrors the SAML Conditions present-but-unparseable fix).
+    var xSec = null;
     if (sigTags.x !== undefined) {
-      var expSec = parseInt(sigTags.x, 10);
-      if (isFinite(expSec) && expSec + clockSkewSec < nowSec) {
+      xSec = _parseDkimNumericDate(sigTags.x);
+      if (xSec === null) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature x= present but unparseable (RFC 6376 §3.5 — NumericDate required)"] });
+        continue;
+      }
+      if (xSec + clockSkewSec < nowSec) {
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
-          errors: ["DKIM-Signature x=" + expSec + " has expired (RFC 6376 §3.5)"] });
+          errors: ["DKIM-Signature x=" + xSec + " has expired (RFC 6376 §3.5)"] });
         continue;
       }
     }
     if (sigTags.t !== undefined) {
-      var tSec = parseInt(sigTags.t, 10);
+      var tSec = _parseDkimNumericDate(sigTags.t);
+      if (tSec === null) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature t= present but unparseable (RFC 6376 §3.5 — NumericDate required)"] });
+        continue;
+      }
       // Allow up to 24h future-skew; beyond that, refuse — neither
       // operator clock drift nor delivery latency explains a future-
       // dated signing time of more than a day.
-      if (isFinite(tSec) && tSec - (24 * 60 * 60) > nowSec) {                                  // allow:raw-time-literal — 24h future-date sanity ceiling
+      if (tSec - (24 * 60 * 60) > nowSec) {                                                    // allow:raw-time-literal — 24h future-date sanity ceiling
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
           errors: ["DKIM-Signature t=" + tSec + " is more than 24h in the future (RFC 6376 §3.5 sanity)"] });
         continue;
       }
-      if (sigTags.x !== undefined) {
-        var xSec = parseInt(sigTags.x, 10);
-        if (isFinite(xSec) && isFinite(tSec) && xSec < tSec) {
-          results.push({ d: d || null, s: s || null, alg: alg || null,
-            result: "permerror",
-            errors: ["DKIM-Signature x= must be after t= (RFC 6376 §3.5)"] });
-          continue;
-        }
+      if (xSec !== null && xSec < tSec) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature x= must be after t= (RFC 6376 §3.5)"] });
+        continue;
       }
     }
     if (!d || !s) {

package/lib/vendor/blamejs/lib/mail.js

@@ -825,6 +825,16 @@ function smtpTransport(opts) {
   _refuseCtlBytes("host",       opts.host);
   _refuseCtlBytes("servername", opts.servername);
   var timeoutMs = opts.timeoutMs || C.TIME.seconds(15);
+  // Absolute transaction deadline — distinct from the per-socket IDLE
+  // timeout above. A slow-trickle MX that emits one byte just inside
+  // every idle window resets socket.setTimeout forever and never
+  // completes; this wall-clock bound fails the whole send regardless of
+  // trickle. Defaults well above timeoutMs so a normal multi-round-trip
+  // SMTP conversation (greeting → EHLO → STARTTLS → AUTH → MAIL/RCPT →
+  // DATA/BDAT) never trips it.
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxTransactionMs,
+    "smtp transport: opts.maxTransactionMs", MailError, "mail/smtp-misconfigured");
+  var maxTransactionMs = opts.maxTransactionMs || C.TIME.minutes(5);
   var tlsOpts = {
     rejectUnauthorized: rejectUnauthorized,
     minVersion: opts.minTlsVersion || "TLSv1.3",
@@ -875,6 +885,7 @@ function smtpTransport(opts) {
     useImplicitTLS:  useImplicitTLS,
     ehloName:        ehloName,
     timeoutMs:       timeoutMs,
+    maxTransactionMs: maxTransactionMs,
     tlsOpts:         tlsOpts,
     servername:      servername,
     dkimSigner:      opts.dkimSigner || null,
@@ -1043,6 +1054,7 @@ function _smtpSend(message, cfg) {
     var dataWireBytes = null;             // Buffer view of dataMessage for BDAT slicing
     var useBdat = false;                  // Decided post-EHLO based on peerSupportsChunking + cfg.chunkingEnabled
     var bodyMode = "7BIT";                // "7BIT" / "8BITMIME" / "BINARYMIME"
+    var txTimer = null;                   // Absolute transaction-deadline timer (cfg.maxTransactionMs)
 
     var fromAddr = _extractAddr(message.from);
     var toList   = _toArray(message.to).map(_extractAddr);
@@ -1081,9 +1093,13 @@ function _smtpSend(message, cfg) {
       }
     }
 
+    function clearTxTimer() {
+      if (txTimer) { try { clearTimeout(txTimer); } catch (_e) { /* best-effort */ } txTimer = null; }
+    }
     function fail(reason) {
       if (settled) return;
       settled = true;
+      clearTxTimer();
       try { if (socket) socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
       reject(new MailError("mail/smtp-failed",
         "SMTP send failed: " + reason, false));
@@ -1091,6 +1107,7 @@ function _smtpSend(message, cfg) {
     function done(ok, code) {
       if (settled) return;
       settled = true;
+      clearTxTimer();
       try { socket.end(); } catch (_e) { /* socket may already be torn down */ }
       if (ok) resolve({ transport: "smtp", deliveredAt: Date.now(), code: code });
       else reject(new MailError("mail/smtp-rejected",
@@ -1149,6 +1166,16 @@ function _smtpSend(message, cfg) {
 
     function onData(data) {
       buffer += data;
+      // Bound the framing accumulator. A hostile / broken MX that
+      // streams bytes without ever sending CRLF would otherwise grow
+      // `buffer` without limit and OOM the process. SMTP responses are
+      // tiny per spec; the 256 KiB cap is generous headroom. Measure
+      // bytes (not UTF-16 code units) so multibyte trickle can't slip a
+      // larger payload past a char-length check.
+      if (safeBuffer.byteLengthOf(buffer) > MAIL_RESPONSE_MAX_BYTES) {
+        fail("response-too-large");
+        return;
+      }
       var lines = buffer.split("\r\n");
       buffer = lines.pop();
       for (var i = 0; i < lines.length; i++) {
@@ -1233,6 +1260,7 @@ function _smtpSend(message, cfg) {
         // would corrupt NUL-bearing octets in transit.
         if (requiresBinaryMime && !peerSupportsBinaryMime) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/binarymime-not-advertised",
             "message has 8-bit binary content but peer does not advertise BINARYMIME (RFC 3030 §3)",
@@ -1245,6 +1273,7 @@ function _smtpSend(message, cfg) {
         // cap"; -1 means "SIZE not advertised" (no precheck).
         if (cfg.respectPeerSize && peerSizeCap > 0 && messageWireSize > peerSizeCap) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/peer-size-exceeded",
             "message wire size " + messageWireSize + " bytes exceeds peer SIZE cap " +
@@ -1341,6 +1370,7 @@ function _smtpSend(message, cfg) {
         // the chunked-body failure mode.
         if (code !== 250) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/bdat-chunk-rejected",
             "BDAT chunk rejected (code " + code + ", offset " + bdatOffset + "/" +
@@ -1360,6 +1390,15 @@ function _smtpSend(message, cfg) {
       }
     }
 
+    // Arm the absolute transaction deadline before opening the socket so
+    // a peer that connects but then trickles (or never responds) is
+    // bounded regardless of how it games the per-socket idle timer.
+    // unref so a pending deadline never keeps the process alive on its own.
+    txTimer = setTimeout(function () {
+      fail("transaction-timeout");
+    }, cfg.maxTransactionMs);
+    if (txTimer && typeof txTimer.unref === "function") txTimer.unref();
+
     try { connect(); }
     catch (e) { fail(e.message || String(e)); }
   });

package/lib/vendor/blamejs/lib/middleware/api-encrypt.js

@@ -1086,8 +1086,12 @@ function httpClientEncrypted(opts) {
     headers["Content-Type"] = "application/json";
 
     var passThrough = {};
-    var passable = ["allowedProtocols", "allowInternal", "idleTimeoutMs", "maxResponseBytes",
-                    "agent", "errorClass"];
+    // timeoutMs (overall wall-clock cap) and signal (caller cancellation) are
+    // forwarded alongside idleTimeoutMs: without the wall-clock cap a peer that
+    // trickles bytes within the idle window holds the encrypted call open
+    // indefinitely (the plain request path already accepts both).
+    var passable = ["allowedProtocols", "allowInternal", "timeoutMs", "idleTimeoutMs",
+                    "maxResponseBytes", "signal", "agent", "errorClass"];
     for (var i = 0; i < passable.length; i++) {
       if (reqOpts[passable[i]] !== undefined) passThrough[passable[i]] = reqOpts[passable[i]];
     }

package/lib/vendor/blamejs/lib/network-dns-resolver.js

@@ -112,6 +112,7 @@ var networkDns         = require("./network-dns");
 var safeDns            = require("./safe-dns");
 var safeUrl            = require("./safe-url");
 var safeBuffer         = require("./safe-buffer");
+var safeAsync          = require("./safe-async");
 var lazyRequire        = require("./lazy-require");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
@@ -126,6 +127,14 @@ var DEFAULT_MAX_TTL_MS    = C.TIME.hours(24);
 var DEFAULT_MIN_TTL_MS    = C.TIME.seconds(60);
 var DEFAULT_STALE_WINDOW  = C.TIME.hours(6);
 var DEFAULT_PROFILE       = "strict";
+// CWE-400. Per-query wall-clock deadline on the upstream transport
+// lookup. A non-responsive / slow / stalling DoH endpoint (or a
+// transport that sends headers then never ends the body) must not hold
+// the await pending forever — every query() and every followCnames hop
+// is bounded by this, and the default _wireLookup additionally tears
+// the socket down (req.setTimeout) so the fd is released, not just the
+// promise rejected. 10s matches a generous DoH round-trip ceiling.
+var DEFAULT_TIMEOUT_MS    = C.TIME.seconds(10);
 // CWE-400/770. Bound the cache so a hostile peer
 // that can drive query-name selection (e.g. inbound SMTP forwarding
 // DKIM `s=` / `d=` tag-controlled lookups) cannot inflate the Map to
@@ -168,6 +177,7 @@ var QTYPE_BY_NAME = Object.freeze({
  *   maxTtlMs:    number,           // cap any TTL from upstream; default 24h
  *   minTtlMs:    number,           // floor short-TTL records; default 60s
  *   serveStale:  number | false,   // ms to retain expired entries; default 6h
+ *   timeoutMs:   number,           // per-query upstream deadline; default 10s
  *   transport:   { lookup(name, qtype) → Promise<Buffer> },   // operator override
  *   audit:       b.audit namespace,
  *
@@ -187,7 +197,12 @@ function create(opts) {
   var minTtlMs    = typeof opts.minTtlMs === "number" ? opts.minTtlMs : DEFAULT_MIN_TTL_MS;
   var serveStale  = opts.serveStale === false ? 0 :
                     typeof opts.serveStale === "number" ? opts.serveStale : DEFAULT_STALE_WINDOW;
-  var transport   = opts.transport || _defaultTransport();
+  var timeoutMs   = typeof opts.timeoutMs === "number" ? opts.timeoutMs : DEFAULT_TIMEOUT_MS;
+  if (!isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new ResolverError("resolver/bad-input",
+      "create: timeoutMs must be a positive finite number");
+  }
+  var transport   = opts.transport || _defaultTransport(timeoutMs);
   // Audit goes to the operator-supplied sink (opts.audit) when present, else the
   // framework chain — b.audit.namespaced no-ops if the sink has no safeEmit.
   var _baseAudit  = audit().namespaced("network.dns.resolver", { sink: opts.audit });
@@ -276,10 +291,18 @@ function create(opts) {
       return _result(hit.parsed, hit.ttl, true, false, hit.validated);
     }
 
-    // Cache miss / expired — fetch from upstream.
+    // Cache miss / expired — fetch from upstream, bounded by the
+    // per-query wall-clock deadline. withTimeout rejects the await so a
+    // non-responsive / stalling endpoint can't hold the request pending
+    // forever; the default _wireLookup also tears the socket down on its
+    // own req.setTimeout so the underlying fd is released.
     var wireResponse;
     try {
-      wireResponse = await transport.lookup(name, qtype);
+      wireResponse = await safeAsync.withTimeout(
+        Promise.resolve(transport.lookup(name, qtype)),
+        timeoutMs,
+        { name: "dns-resolver:" + name + "/" + qtype }
+      );
     } catch (e) {
       // Upstream failure — serve stale if we have it within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
@@ -425,13 +448,13 @@ function create(opts) {
   };
 }
 
-function _defaultTransport() {
+function _defaultTransport(timeoutMs) {
   // Default transport — compose b.network.dns.useDnsOverHttps()'s
   // existing DoH path. We use the wire-format DoH endpoint directly
   // so the response arrives as raw bytes for safeDns parsing.
   return {
     lookup: function (name, qtype) {
-      return _wireLookup(name, qtype);
+      return _wireLookup(name, qtype, timeoutMs);
     },
   };
 }
@@ -440,7 +463,9 @@ function _defaultTransport() {
 // existing DoH path. Returns the raw response bytes for safeDns to
 // parse. Distinct from the existing network-dns DoH path which returns
 // already-decoded address strings — we need the raw bytes here.
-async function _wireLookup(name, qtype) {
+async function _wireLookup(name, qtype, timeoutMs) {
+  var ms = typeof timeoutMs === "number" && isFinite(timeoutMs) && timeoutMs > 0
+    ? timeoutMs : DEFAULT_TIMEOUT_MS;
   var url = networkDns._getDohUrlForTest ? networkDns._getDohUrlForTest() : "https://cloudflare-dns.com/dns-query";
   // Encode a wire-format query for the target qtype.
   var qbuf = _encodeWireQuery(name, qtype);
@@ -448,6 +473,18 @@ async function _wireLookup(name, qtype) {
   var getUrl = url + (url.indexOf("?") === -1 ? "?" : "&") + "dns=" + b64;
   var u = safeUrl.parse(getUrl, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
   return new Promise(function (resolve, reject) {
+    var settled = false;
+    function _fail(err) {
+      if (settled) return;
+      settled = true;
+      try { req.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+      reject(err);
+    }
+    function _done(buf) {
+      if (settled) return;
+      settled = true;
+      resolve(buf);
+    }
     // Raw DoH wire-format request — bypasses b.httpClient envelope
     // because we need the raw binary response bytes for safeDns to
     // parse (httpClient assumes JSON/text shapes).
@@ -470,18 +507,31 @@ async function _wireLookup(name, qtype) {
       res.on("data", function (c) { if (!pushFailed) { try { collector.push(c); } catch (e) { pushFailed = e; } } });
       res.on("end", function () {
         try {
-          if (pushFailed) { reject(pushFailed); return; }
+          if (pushFailed) { _fail(pushFailed); return; }
           if (res.statusCode !== 200) {                                                                  // HTTP 200 OK
-            reject(new ResolverError("resolver/upstream-http",
+            _fail(new ResolverError("resolver/upstream-http",
               "DoH HTTP " + res.statusCode + " for " + name));
             return;
           }
-          resolve(collector.result());
-        } catch (e) { reject(e); }
+          _done(collector.result());
+        } catch (e) { _fail(e); }
       });
     });
+    // Wall-clock / idle deadline — a DoH endpoint that accepts the
+    // connection, sends 200 headers, then never ends the body would
+    // otherwise hold the socket (and its fd) open indefinitely. setTimeout
+    // arms on socket inactivity; on fire we tear the socket down AND reject
+    // so neither the promise nor the fd leaks (CWE-400 slowloris-style).
+    req.setTimeout(ms, function () {
+      _fail(new ResolverError("resolver/upstream-timeout",
+        "DoH request to " + u.hostname + " for " + name + " exceeded " + ms + "ms"));
+    });
+    req.on("timeout", function () {
+      _fail(new ResolverError("resolver/upstream-timeout",
+        "DoH request to " + u.hostname + " for " + name + " exceeded " + ms + "ms"));
+    });
     req.on("error", function (e) {
-      reject(new ResolverError("resolver/upstream-failed",
+      _fail(new ResolverError("resolver/upstream-failed",
         "DoH request failed: " + e.message));
     });
     req.end();

package/lib/vendor/blamejs/lib/network-dns.js

@@ -28,11 +28,18 @@ var HEX_RADIX        = C.BYTES.bytes(16);   // parseInt / toString radix-16
 var observability = lazyRequire(function () { return require("./observability"); });
 var safeEnv = require("./parsers/safe-env");
 
+// Default wall-clock deadline for every lookup (resolve / DoH / DoT /
+// system). Without a non-zero default a header-then-stall or
+// slow-trickle upstream hangs the request forever (CWE-400). 10s
+// matches the resolver's default. Operators override via
+// setLookupTimeoutMs(); 0 disables the deadline (operator opt-out).
+var DEFAULT_LOOKUP_TIMEOUT_MS = C.TIME.seconds(10);
+
 var STATE = {
   servers:        null,
   resultOrder:    null,
   family:         0,
-  lookupTimeoutMs: 0,
+  lookupTimeoutMs: DEFAULT_LOOKUP_TIMEOUT_MS,
   cacheTtlMs:     0,
   cacheNegativeTtlMs: 0,
   doh:            null,
@@ -285,6 +292,19 @@ function _withTimeout(promise, ms, host) {
   });
 }
 
+// Arm a wall-clock deadline on a raw https.request so a stalled upstream
+// (headers-then-stall, slow-trickle body) tears the socket down instead
+// of leaking the fd until the process exits. The promise-level
+// _withTimeout rejects the caller, but only this destroys the underlying
+// connection. No-op when the operator has disabled the deadline (ms<=0).
+function _armRequestTimeout(req, ms, host, reject) {
+  if (ms <= 0) return;
+  req.setTimeout(ms, function () {
+    try { req.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+    reject(new DnsError("dns/lookup-timeout", "dns lookup of '" + host + "' exceeded " + ms + "ms"));
+  });
+}
+
 function _encodeDnsQuery(host, qtype) {
   var parts = host.split(".").filter(Boolean);
   var nameLen = 1;
@@ -450,6 +470,7 @@ async function _dohLookup(host, family) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -511,6 +532,7 @@ async function _dohLookupSecure(host, family) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -591,6 +613,17 @@ function _dotConnect() {
   // when idle — _dotLookup toggles this around its query. Calling
   // unref() unconditionally here let node exit during a normal lookup
   // when no other I/O kept the event loop alive.
+  //
+  // Wall-clock teardown: a stalled handshake or trickle-response upstream
+  // would otherwise leak the socket until the process exits (CWE-400).
+  // On inactivity past the deadline destroy the socket — the pool's
+  // error/close handlers evict it and the next lookup rebuilds. No-op
+  // when the operator has disabled the deadline (lookupTimeoutMs<=0).
+  if (STATE.lookupTimeoutMs > 0) {
+    sock.setTimeout(STATE.lookupTimeoutMs, function () {
+      try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+    });
+  }
   return sock;
 }
 
@@ -865,6 +898,7 @@ async function _dohRawQuery(host, qtype) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -979,6 +1013,17 @@ async function _systemRawQuery(host, qtype) {
       try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
       if (err) reject(err); else resolve(val);
     }
+    // Wall-clock teardown: a server that accepts the TCP connection but
+    // never replies (or trickles the length-prefix) would otherwise hang
+    // the query forever (CWE-400). On inactivity past the deadline
+    // settle()'s destroy() tears the socket down. No-op when the operator
+    // has disabled the deadline (lookupTimeoutMs<=0).
+    if (STATE.lookupTimeoutMs > 0) {
+      sock.setTimeout(STATE.lookupTimeoutMs, function () {
+        settle(new DnsError("dns/lookup-timeout",
+          "system DNS TCP query of '" + host + "' exceeded " + STATE.lookupTimeoutMs + "ms"));
+      });
+    }
     sock.on("connect", function () {
       var lenBuf = Buffer.alloc(2);
       lenBuf.writeUInt16BE(enc.buf.length, 0);
@@ -1684,7 +1729,7 @@ function nodeLookup(host, options, callback) {
 function _stateForTest() { return STATE; }
 function _resetForTest() {
   STATE.servers = null; STATE.resultOrder = null; STATE.family = 0;
-  STATE.lookupTimeoutMs = 0; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
+  STATE.lookupTimeoutMs = DEFAULT_LOOKUP_TIMEOUT_MS; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
   STATE.doh = null; STATE.dot = null; STATE.systemResolver = false;
   _designatedResolvers = null;
   _clearCache();

package/lib/vendor/blamejs/lib/network-nts.js

@@ -7,12 +7,20 @@ var nodeCrypto = require("node:crypto");
 var C = require("./constants");
 var { timingSafeEqual } = require("./crypto");
 var validateOpts = require("./validate-opts");
+var safeBuffer = require("./safe-buffer");
 var { defineClass } = require("./framework-error");
 
 var NtsError = defineClass("NtsError", { alwaysPermanent: false });
 
 var NTS_KE_DEFAULT_PORT = 4460;
 var NTPV4_DEFAULT_PORT  = 123;
+// Upper bound on accumulated NTS-KE handshake bytes before a REC_END
+// record terminates the exchange. A conformant NTS-KE response is a few
+// hundred bytes (RFC 8915 §4); 64 KiB is generous. Without this ceiling
+// a malicious or buggy server that streams non-END records fast enough
+// OOMs the process before the wall-clock timer fires (it bounds time,
+// not memory). Mirrors the ws-client handshake header cap.
+var NTS_KE_HANDSHAKE_MAX_BYTES = C.BYTES.kib(64);
 // RFC 5905 §6 — seconds between 1900-01-01T00:00Z (NTP epoch) and
 // 1970-01-01T00:00Z (Unix epoch). Protocol-fixed (not a tunable).
 var NTP_TO_UNIX_OFFSET_SECONDS = 2208988800;
@@ -284,6 +292,14 @@ function performKeHandshake(opts) {
     var warnings = [];
     sock.on("data", function (chunk) {
       got = Buffer.concat([got, chunk]);
+      if (safeBuffer.byteLengthOf(got) > NTS_KE_HANDSHAKE_MAX_BYTES) {
+        clearTimeout(timer);
+        try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+        done(new NtsError("nts/ke-too-large",
+          "NTS-KE handshake exceeded " + NTS_KE_HANDSHAKE_MAX_BYTES +
+          " bytes before a REC_END record"));
+        return;
+      }
       try {
         var records = _decodeRecords(got);
         var endRec = records.find(function (r) { return r.type === REC_END; });

package/lib/vendor/blamejs/lib/network-proxy.js

@@ -7,6 +7,7 @@ var nodeTls = require("node:tls");
 
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -19,6 +20,23 @@ var IPV4_PREFIX_MAX_BITS = C.BYTES.bytes(32);   // RFC 791 §3.1 IPv4 address bi
 var DEFAULT_HTTPS_PORT   = 443;                 // RFC 9110 §4.2.2
 var DEFAULT_HTTP_PORT    = C.BYTES.bytes(80);   // RFC 9110 §4.2.1
 
+// Bound the CONNECT-reply framing buffer (mirrors ws-client's handshake
+// cap). A proxy that streams bytes without ever sending the CRLFCRLF
+// header terminator would otherwise grow `buf` without limit and OOM the
+// process; CONNECT replies are tiny, 64 KiB is generous headroom.
+var TUNNEL_HEADER_MAX_BYTES = C.BYTES.kib(64);
+// Wall-clock bound on the proxy connect + CONNECT handshake. Without it a
+// proxy that accepts the socket but never replies (or trickles forever)
+// hangs the tunnel indefinitely.
+var TUNNEL_CONNECT_TIMEOUT_MS = C.TIME.seconds(30);
+// Test-only override of the connect deadline so a unit test can prove the
+// absolute-timeout behavior without a 30s wall-clock wait. null = use the
+// real default. Cleared by _resetForTest.
+var _testConnectTimeoutMs = null;
+function _connectTimeoutMs() {
+  return typeof _testConnectTimeoutMs === "number" ? _testConnectTimeoutMs : TUNNEL_CONNECT_TIMEOUT_MS;
+}
+
 var observability = lazyRequire(function () { return require("./observability"); });
 // Lazy so pqc-agent's TLS/audit graph isn't pulled into every process that
 // imports network-proxy but never proxies an https upstream. Used only to audit
@@ -169,7 +187,27 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
       })
     : net.connect({ host: proxyUrl.hostname, port: proxyPort });
   var settled = false;
-  function done(err, sock) { if (settled) return; settled = true; callback(err, sock); }
+  var connectDeadline = null;
+  function done(err, sock) {
+    if (settled) return;
+    settled = true;
+    if (connectDeadline) { try { clearTimeout(connectDeadline); } catch (_e) { /* best-effort */ } connectDeadline = null; }
+    callback(err, sock);
+  }
+  // ABSOLUTE wall-clock deadline on the proxy connect + CONNECT handshake. A
+  // proxy that accepts the socket but never sends the CRLFCRLF terminator —
+  // or trickles partial bytes just inside every idle window — must not hang
+  // the tunnel forever. socket.setTimeout is an IDLE timer that such a trickle
+  // resets indefinitely, so a fixed setTimeout (cleared in done()) enforces a
+  // real total-time bound regardless of how the bytes arrive.
+  var connectTimeoutMs = _connectTimeoutMs();
+  connectDeadline = setTimeout(function () {
+    done(new ProxyError("proxy/connect-timeout",
+      "proxy CONNECT to " + targetHost + ":" + targetPort + " timed out after " +
+      connectTimeoutMs + "ms"));
+    try { proxySocket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+  }, connectTimeoutMs);
+  if (connectDeadline && typeof connectDeadline.unref === "function") connectDeadline.unref();
   proxySocket.on("error", function (e) { done(e); });
   proxySocket.on(proxyUrl.protocol === "https:" ? "secureConnect" : "connect", function () {
     if (proxyUrl.protocol === "https:") {
@@ -191,7 +229,18 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
     function onData(chunk) {
       buf = Buffer.concat([buf, chunk]);
       var idx = buf.indexOf("\r\n\r\n");
-      if (idx === -1) return;
+      if (idx === -1) {
+        // No header terminator yet — bound the accumulator so a proxy
+        // that trickles non-CRLFCRLF bytes forever can't OOM the process.
+        if (safeBuffer.byteLengthOf(buf) > TUNNEL_HEADER_MAX_BYTES) {
+          proxySocket.removeListener("data", onData);
+          done(new ProxyError("proxy/connect-headers-too-large",
+            "proxy CONNECT reply exceeded " + TUNNEL_HEADER_MAX_BYTES +
+            " bytes before CRLFCRLF"));
+          try { proxySocket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+        }
+        return;
+      }
       proxySocket.removeListener("data", onData);
       var head = buf.slice(0, idx).toString("ascii");
       var status = head.split("\r\n")[0] || "";
@@ -271,8 +320,11 @@ function snapshot() {
 function _resetForTest() {
   STATE.http = null; STATE.https = null; STATE.noProxy = []; STATE.auth = null;
   STATE.agentCache.clear();
+  _testConnectTimeoutMs = null;
 }
 
+function _setConnectTimeoutForTest(ms) { _testConnectTimeoutMs = ms; }
+
 module.exports = {
   set:           set,
   fromEnv:       fromEnv,
@@ -281,4 +333,5 @@ module.exports = {
   snapshot:      snapshot,
   ProxyError:    ProxyError,
   _resetForTest: _resetForTest,
+  _setConnectTimeoutForTest: _setConnectTimeoutForTest,
 };

package/lib/vendor/blamejs/lib/object-store/azure-blob-bucket-ops.js

@@ -233,6 +233,7 @@ function create(config) {
       url:              url,
       headers:          headers,
       body:             body,
+      timeoutMs:        timeoutMs,
       idleTimeoutMs:    timeoutMs,
       allowedProtocols: allowedProtocols,
       errorClass:       ObjectStoreError,

package/lib/vendor/blamejs/lib/object-store/gcs-bucket-ops.js

@@ -182,6 +182,7 @@ function create(config) {
       url:              url,
       headers:          headers,
       body:             body,
+      timeoutMs:        timeoutMs,
       idleTimeoutMs:    timeoutMs,
       allowedProtocols: allowedProtocols,
       errorClass:       ObjectStoreError,