@blamejs/blamejs-shop 0.4.87 → 0.4.89

package/lib/vendor/blamejs/test/layer-0-primitives/api-encrypt-rejection-envelope.test.js

@@ -0,0 +1,309 @@
+"use strict";
+/**
+ * api-encrypt — protocol-level rejection bodies must ride the session
+ * envelope on an ESTABLISHED per-session encrypted channel (#361).
+ *
+ * A client on a keyed per-session channel that sends a stale / replayed
+ * / malformed request used to get an UNENCRYPTED { error: <code> } back,
+ * leaking — in cleartext, over an otherwise-encrypted channel — which
+ * validation tripped. The rejection must instead be wrapped exactly like
+ * a successful response ({ _ct, _sid, _ctr }), with plaintext reserved
+ * for pre-session handshake errors where no session context exists yet.
+ *
+ * Run standalone:
+ *   node test/layer-0-primitives/api-encrypt-rejection-envelope.test.js
+ * Or via smoke: node test/smoke.js
+ */
+
+var helpers  = require("../helpers");
+var b        = helpers.b;
+var check    = helpers.check;
+var _bodyReq = helpers._bodyReq;
+var _bodyRes = helpers._bodyRes;
+
+function _newFinish(res) {
+  return new Promise(function (resolve) { res.on("finish", resolve); });
+}
+
+function _mkRes() {
+  var res = _bodyRes();
+  // Mirror the router's res.json convention so the response-encryption
+  // wrap chains correctly (the router installs this in production).
+  res.json = function (data) {
+    res.writeHead(res.statusCode || 200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(data));
+  };
+  res.statusCode = 200;
+  return res;
+}
+
+function _serverKeypair() {
+  return b.crypto.generateEncryptionKeyPair();
+}
+
+// On an established per-session channel a rejection that consumes a
+// persisted response counter (the post-claim tag-mismatch path) MUST be an
+// encrypted envelope, not a plaintext { error } — leaking, in cleartext over
+// an otherwise-encrypted channel, which check tripped. RED before #361
+// (rejection emitted as plaintext JSON); GREEN once _writeRejection wraps it
+// in the session envelope. The session must remain USABLE afterwards: the
+// rejection rides a response counter the server actually persisted (the
+// atomic claim ran before the decrypt failed), so the client's monotonic
+// _ctr check still holds on the next genuine response.
+async function testRejectionEncryptedOnEstablishedSession() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({
+    keypair:      keypair,
+    audit:        false,
+    keying:       "per-session",
+    sessionTtlMs: 60_000,
+  });
+  var clientCtx = b.middleware.apiEncrypt.client({
+    pubkey: keypair, keying: "per-session",
+  });
+
+  // Bootstrap the session (ctr=1) — establishes the keyed channel.
+  var first = clientCtx.encryptRequest({ user: "alice" });
+  var req1 = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req1.body = first.body;
+  var res1 = _mkRes();
+  var fin1 = _newFinish(res1);
+  await mw(req1, res1, function () { res1.json({ ok: true, n: 1 }); });
+  await fin1;
+  check("bootstrap returns 200", res1._endedStatus === 200);
+  var resp1 = JSON.parse(res1._captured);
+  check("bootstrap response is encrypted", typeof resp1._ct === "string");
+  first.decryptResponse(resp1);   // advances the client's response counter
+
+  // Valid second request (ctr=2) — server now expects ctr>2.
+  var second = clientCtx.encryptRequest({ user: "alice", action: "ping" });
+  var req2 = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req2.body = second.body;
+  var res2 = _mkRes();
+  var fin2 = _newFinish(res2);
+  await mw(req2, res2, function () { res2.json({ ok: true, n: 2 }); });
+  await fin2;
+  check("second request returns 200", res2._endedStatus === 200);
+  second.decryptResponse(JSON.parse(res2._captured));
+
+  // Third request with a FRESH counter (ctr=3) but a corrupted ciphertext:
+  // it passes the shape / expiry / rotation / replay gates AND wins the
+  // atomic (sid, ctr) claim — so the server persists the consumed response
+  // counter — then fails the AEAD decrypt. This rejection rides the session
+  // envelope under that persisted counter (the leak vector #361 closes).
+  var third = clientCtx.encryptRequest({ user: "alice", action: "tamper" });
+  var req3 = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req3.body = JSON.parse(JSON.stringify(third.body));
+  req3.body._ct = Buffer.from("corrupted-ciphertext-bytes").toString("base64");
+  var res3 = _mkRes();
+  var fin3 = _newFinish(res3);
+  await mw(req3, res3, function () {
+    check("tampered ciphertext must NOT reach next()", false);
+  });
+  await fin3;
+
+  check("tampered request on established session returns 400", res3._endedStatus === 400);
+
+  var rejBody = JSON.parse(res3._captured);
+  // The core assertion: the rejection is an ENCRYPTED envelope, NOT a
+  // plaintext { error: ... }. On the buggy tree rejBody.error is the
+  // cleartext code and rejBody._ct is absent.
+  check("rejection body carries NO plaintext error field",
+        rejBody.error === undefined);
+  check("rejection body is an encrypted envelope (_ct present)",
+        typeof rejBody._ct === "string");
+  check("rejection envelope is bound to the session sid",
+        rejBody._sid === first.body._sid);
+  check("rejection envelope carries a response counter",
+        typeof rejBody._ctr === "number");
+
+  // The encrypted rejection must decrypt under the session key to reveal
+  // the error code only to the legitimate key-holder — and decrypting it
+  // advances the client's response counter.
+  var plain = third.decryptResponse(rejBody);
+  check("decrypted rejection reveals the error code to the key-holder",
+        plain && typeof plain.error === "string" && plain.error.length > 0);
+
+  // P2 regression guard: the session must still be usable. The encrypted
+  // rejection consumed a counter the server PERSISTED (it won the claim), so
+  // the next genuine request's response counter is strictly above the one
+  // the client just saw — decrypting it must NOT throw a replay error.
+  var fourth = clientCtx.encryptRequest({ user: "alice", action: "after-reject" });
+  var req4 = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req4.body = fourth.body;
+  var res4 = _mkRes();
+  var fin4 = _newFinish(res4);
+  await mw(req4, res4, function () { res4.json({ ok: true, n: 4 }); });
+  await fin4;
+  check("a genuine request after an encrypted rejection still returns 200",
+        res4._endedStatus === 200);
+  var afterReject = fourth.decryptResponse(JSON.parse(res4._captured));
+  check("its response decrypts cleanly (counter stayed monotonic)",
+        afterReject && afterReject.ok === true && afterReject.n === 4);
+}
+
+// P2: the two GENERIC surviving-session rejections (monotonic-counter replay
+// and atomic-claim loss) return BEFORE the consumed response counter is
+// persisted. Encrypting them would emit a _ctr the client tracks as consumed
+// while the server never records it — so the next genuine response reuses
+// that _ctr and the client refuses it as a replay, bricking the session.
+// They must stay PLAINTEXT (their body is generic — no session-lifecycle
+// reason leaks), and the session must remain usable across the rejection.
+// RED before the P2 fix (replay rejection encrypted → the follow-up valid
+// response desyncs → decryptResponse throws); GREEN after.
+async function testReplayRejectionStaysPlaintextAndSessionSurvives() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session", sessionTtlMs: 60_000,
+  });
+  var clientCtx = b.middleware.apiEncrypt.client({
+    pubkey: keypair, keying: "per-session",
+  });
+
+  // Bootstrap + one valid request so the channel is established (lastReqCtr=2).
+  var first = clientCtx.encryptRequest({ user: "bob" });
+  var req1 = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req1.body = first.body;
+  var res1 = _mkRes();
+  var fin1 = _newFinish(res1);
+  await mw(req1, res1, function () { res1.json({ ok: true, n: 1 }); });
+  await fin1;
+  first.decryptResponse(JSON.parse(res1._captured));
+
+  var second = clientCtx.encryptRequest({ user: "bob", action: "ping" });
+  var req2 = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req2.body = second.body;
+  var res2 = _mkRes();
+  var fin2 = _newFinish(res2);
+  await mw(req2, res2, function () { res2.json({ ok: true, n: 2 }); });
+  await fin2;
+  second.decryptResponse(JSON.parse(res2._captured));
+
+  // REPLAY the second request verbatim (stale _ctr=2 <= lastReqCtr=2). This
+  // is the monotonic-replay path: it must refuse, and the refusal stays
+  // plaintext so no unpersisted response counter is consumed.
+  var reqR = _bodyReq("POST", { "content-type": "application/json" }, "");
+  reqR.body = JSON.parse(JSON.stringify(second.body));
+  var resR = _mkRes();
+  var finR = _newFinish(resR);
+  await mw(reqR, resR, function () { check("replay must NOT reach next()", false); });
+  await finR;
+  check("replay on established session returns 400", resR._endedStatus === 400);
+  var replBody = JSON.parse(resR._captured);
+  check("replay rejection is generic PLAINTEXT (no consumed counter)",
+        replBody.error === "encrypted-payload-rejected" && replBody._ct === undefined);
+
+  // The session must still work: a genuine next request (ctr=3) succeeds and
+  // its response decrypts cleanly. On the pre-P2 tree the replay rejection
+  // was an encrypted envelope whose _ctr the client consumed, so this
+  // decryptResponse would throw CLIENT_RESPONSE_REPLAY.
+  var third = clientCtx.encryptRequest({ user: "bob", action: "after-replay" });
+  var req3 = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req3.body = third.body;
+  var res3 = _mkRes();
+  var fin3 = _newFinish(res3);
+  await mw(req3, res3, function () { res3.json({ ok: true, n: 3 }); });
+  await fin3;
+  check("a genuine request after a plaintext replay rejection returns 200",
+        res3._endedStatus === 200);
+  var afterReplay = third.decryptResponse(JSON.parse(res3._captured));
+  check("its response decrypts cleanly (replay rejection did not desync the counter)",
+        afterReplay && afterReplay.ok === true && afterReplay.n === 3);
+}
+
+// A pre-session handshake error — a bootstrap envelope whose _ek does not
+// decrypt — has no session context yet, so the rejection MUST stay
+// plaintext (the client cannot derive a session key to read an encrypted
+// body it never established).
+async function testHandshakeErrorStaysPlaintext() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session", sessionTtlMs: 60_000,
+  });
+  var clientCtx = b.middleware.apiEncrypt.client({
+    pubkey: keypair, keying: "per-session",
+  });
+
+  // Bootstrap shape, but corrupt _ek so it fails to decrypt to a session
+  // key — no session is ever established.
+  var first = clientCtx.encryptRequest({ user: "mallory" });
+  var req = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req.body = JSON.parse(JSON.stringify(first.body));
+  req.body._ek = Buffer.from("not-a-valid-envelope").toString("base64");
+  var res = _mkRes();
+  var fin = _newFinish(res);
+  await mw(req, res, function () {
+    check("handshake failure must NOT reach next()", false);
+  });
+  await fin;
+
+  check("handshake error returns 400", res._endedStatus === 400);
+  var body = JSON.parse(res._captured);
+  check("pre-session handshake error stays PLAINTEXT (has error field)",
+        typeof body.error === "string" && body.error.length > 0);
+  check("pre-session handshake error is NOT an encrypted envelope",
+        body._ct === undefined);
+}
+
+// A subsequent-shape request with a sid the server never saw is also a
+// pre-session error (no key to encrypt under) — must stay plaintext.
+async function testUnknownSidStaysPlaintext() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session",
+  });
+  var req = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req.body = {
+    _ct:  Buffer.from("nope").toString("base64"),
+    _ts:  Date.now(),
+    _sid: "12345678-1234-4234-8234-123456789012",
+    _ctr: 5,
+  };
+  var res = _mkRes();
+  var fin = _newFinish(res);
+  await mw(req, res, function () {
+    check("unknown sid must NOT reach next()", false);
+  });
+  await fin;
+  check("unknown-sid returns 401", res._endedStatus === 401);
+  var body = JSON.parse(res._captured);
+  check("unknown-sid rejection stays plaintext (no session to key under)",
+        typeof body.error === "string" && body._ct === undefined);
+}
+
+// Per-request mode never establishes a session, so its rejections stay
+// plaintext (regression guard: the fix must not encrypt per-request
+// errors, which have no session key on req).
+async function testPerRequestModeRejectionStaysPlaintext() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false });
+  var req = _bodyReq("POST", { "content-type": "application/json" }, "");
+  req.body = { _ct: "garbage", _ts: Date.now() };   // no _ek/_nonce → shape error
+  var res = _mkRes();
+  var fin = _newFinish(res);
+  await mw(req, res, function () {
+    check("per-request shape error must NOT reach next()", false);
+  });
+  await fin;
+  check("per-request rejection returns 400", res._endedStatus === 400);
+  var body = JSON.parse(res._captured);
+  check("per-request rejection stays plaintext",
+        typeof body.error === "string" && body._ct === undefined);
+}
+
+async function run() {
+  await testRejectionEncryptedOnEstablishedSession();
+  await testReplayRejectionStaysPlaintextAndSessionSurvives();
+  await testHandshakeErrorStaysPlaintext();
+  await testUnknownSidStaysPlaintext();
+  await testPerRequestModeRejectionStaysPlaintext();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.message); console.error(e.stack); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/api-encrypt.test.js

@@ -45,6 +45,15 @@ function _serverKeypair() {
   return b.crypto.generateEncryptionKeyPair();
 }
 
+// #361 — a rejection emitted on an ESTABLISHED per-session encrypted channel is
+// wrapped in the session envelope (an { _ct, ... } object), so its reason never
+// travels in cleartext. Pre-session / per-request rejections stay plaintext
+// ({ error: <code> }). This helper distinguishes the two captured-body shapes.
+function _isEncryptedEnvelope(captured) {
+  try { var p = JSON.parse(captured); return !!p && typeof p._ct === "string"; }
+  catch (_e) { return false; }
+}
+
 // ---- Nonce-store ----
 
 async function testNonceStoreSurface() {
@@ -1006,8 +1015,14 @@ async function testApiEncryptPerSessionExpiry() {
   });
   await fin2;
   check("per-session expired: 401", res2._endedStatus === 401);
-  check("per-session expired: body says session-expired or session-unknown",
-        /session-expired|session-unknown/.test(res2._captured));
+  // #361: when the store still holds the (past-TTL) row the channel is
+  // established, so the expiry rejection is wrapped in the session envelope;
+  // when the store has already evicted the TTL=1ms row the request is
+  // session-unknown BEFORE any key is resolved, so it stays plaintext. Both
+  // are valid 401 refusals — accept either (neither leaks "session-expired"
+  // over an established channel in cleartext).
+  check("per-session expired: encrypted envelope OR plaintext session-unknown",
+        _isEncryptedEnvelope(res2._captured) || /session-unknown/.test(res2._captured));
 }
 
 async function testApiEncryptPerSessionMaxResponses() {
@@ -1042,8 +1057,9 @@ async function testApiEncryptPerSessionMaxResponses() {
   });
   await fin2;
   check("per-session maxResponses exceeded: 401", res2._endedStatus === 401);
-  check("per-session maxResponses exceeded: body says rotation-required",
-        /session-rotation-required/.test(res2._captured));
+  // #361: established channel → the rotation-required rejection is encrypted.
+  check("per-session maxResponses exceeded: rejection is an encrypted envelope",
+        _isEncryptedEnvelope(res2._captured));
 }
 
 async function testApiEncryptPerSessionResponseCounterMonotonic() {
@@ -1286,8 +1302,15 @@ async function testApiEncryptPerSessionConcurrentCtrExecutesOnce() {
   check("concurrent-ctr: exactly one 200 and one 400",
         statuses[0] === 200 && statuses[1] === 400);
   var rejected = a.res._endedStatus === 400 ? a.res : c.res;
-  check("concurrent-ctr: the loser is refused with the replay shape",
-        /encrypted-payload-rejected/.test(rejected._captured));
+  // The atomic-claim loser returns BEFORE the consumed response counter is
+  // persisted, so its generic rejection stays PLAINTEXT: encrypting it would
+  // emit a response _ctr the client tracks as consumed while the server never
+  // records it, desyncing the session's monotonic counter. The body is generic
+  // ("encrypted-payload-rejected") so plaintext leaks no session-lifecycle
+  // reason. See _writeRejection({ plaintext: true }).
+  check("concurrent-ctr: the loser is refused with the generic plaintext rejection body",
+        /encrypted-payload-rejected/.test(rejected._captured) &&
+        !_isEncryptedEnvelope(rejected._captured));
 }
 
 async function testApiEncryptPerSessionSequentialCounterStillWorks() {
@@ -1409,8 +1432,12 @@ async function testApiEncryptCtrClaimLifetimeAndSetFailure() {
   var fin3 = _newFinish(res3);
   await mw(req3, res3, function () { execCount += 1; res3.json({ ok: 3 }); });
   await fin3;
-  check("ctr-claim: replay of the captured body is refused",
-        res3._endedStatus === 400 && /encrypted-payload-rejected/.test(res3._captured));
+  // The replay loses the atomic claim, which returns before persisting a
+  // consumed counter — so the refusal is generic PLAINTEXT (see
+  // _writeRejection({ plaintext: true })), not an envelope.
+  check("ctr-claim: replay of the captured body is refused (generic plaintext)",
+        res3._endedStatus === 400 && /encrypted-payload-rejected/.test(res3._captured) &&
+        !_isEncryptedEnvelope(res3._captured));
   check("ctr-claim: handler did not execute twice", execCount === 1);
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/atomic-file-fd-read-errorfor-bypass.test.js

@@ -0,0 +1,138 @@
+"use strict";
+/**
+ * b.atomicFile.fdSafeReadSync — errorFor must own EVERY failure KIND (#358).
+ *
+ * Two regressions:
+ *   (A) refuseSymlink lstats the path first; a MISSING file makes lstatSync
+ *       throw raw ENOENT BEFORE the openSync branch that consults
+ *       errorFor("enoent") — so a caller's enoent mapping silently never
+ *       fires when refuseSymlink is on (the missing-file error class then
+ *       differs by whether refuseSymlink is set).
+ *   (B) The openSync ENOENT branch guards errorFor returning undefined
+ *       (throw-if-truthy, else rethrow raw) — but the symlink / too-large /
+ *       toctou / short-read / integrity branches threw errorFor(...) raw,
+ *       so an errorFor that returns undefined for those throws `undefined`.
+ */
+
+var fs   = require("fs");
+var path = require("path");
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _dir() { return b.testing.tempDir("fdsaferead-errorfor"); }
+
+function _throws(fn) {
+  try { fn(); return null; } catch (e) { return { e: e, threw: true }; }
+}
+
+// (A) refuseSymlink + missing file → the caller's errorFor("enoent") fires.
+function testRefuseSymlinkMissingRoutesEnoent() {
+  var dir = _dir();
+  try {
+    var missing = path.join(dir.path, "nope.pem");
+    function Tagged(msg) { this.message = msg; this.tag = "custom-enoent"; }
+    var r = _throws(function () {
+      b.atomicFile.fdSafeReadSync(missing, {
+        refuseSymlink: true,
+        errorFor: function (kind) {
+          return kind === "enoent" ? new Tagged("not there") : undefined;
+        },
+      });
+    });
+    check("fdSafeReadSync refuseSymlink + missing: caller errorFor(enoent) fires (not raw ENOENT)",
+          r !== null && r.e && r.e.tag === "custom-enoent");
+  } finally { dir.cleanup(); }
+}
+
+// (A) refuseSymlink + missing + errorFor returning undefined → rethrows raw ENOENT
+// (same posture the openSync branch already gives), never `undefined`.
+function testRefuseSymlinkMissingErrorForUndefinedRethrowsRaw() {
+  var dir = _dir();
+  try {
+    var missing = path.join(dir.path, "nope2.pem");
+    var r = _throws(function () {
+      b.atomicFile.fdSafeReadSync(missing, {
+        refuseSymlink: true,
+        errorFor: function () { return undefined; },
+      });
+    });
+    check("fdSafeReadSync refuseSymlink + missing + undefined errorFor rethrows raw ENOENT",
+          r !== null && r.e && r.e.code === "ENOENT");
+  } finally { dir.cleanup(); }
+}
+
+// (B) errorFor returning undefined for "too-large" must throw a REAL error,
+// never the literal `undefined`.
+function testTooLargeErrorForUndefinedThrowsRealError() {
+  var dir = _dir();
+  try {
+    var p = path.join(dir.path, "big.bin");
+    fs.writeFileSync(p, Buffer.alloc(4096), { mode: 0o600 });
+    var r = _throws(function () {
+      b.atomicFile.fdSafeReadSync(p, {
+        maxBytes: 16,
+        errorFor: function () { return undefined; },
+      });
+    });
+    check("fdSafeReadSync too-large + undefined errorFor throws a real Error (not undefined)",
+          r !== null && r.e instanceof Error);
+  } finally { dir.cleanup(); }
+}
+
+// (B) errorFor returning undefined for "symlink" must throw a REAL error.
+function testSymlinkErrorForUndefinedThrowsRealError() {
+  var dir = _dir();
+  try {
+    var victim = path.join(dir.path, "victim.pem");
+    fs.writeFileSync(victim, "SECRET", { mode: 0o600 });
+    var link = path.join(dir.path, "link.pem");
+    var symlinkOk = true;
+    try { fs.symlinkSync(victim, link); } catch (_e) { symlinkOk = false; }
+    if (symlinkOk) {
+      var r = _throws(function () {
+        b.atomicFile.fdSafeReadSync(link, {
+          refuseSymlink: true,
+          errorFor: function () { return undefined; },
+        });
+      });
+      check("fdSafeReadSync symlink + undefined errorFor throws a real Error (not undefined)",
+            r !== null && r.e instanceof Error);
+    } else {
+      check("fdSafeReadSync symlink case skipped (platform lacks symlink privilege)", true);
+    }
+  } finally { dir.cleanup(); }
+}
+
+// (B) errorFor returning undefined for "integrity" must throw a REAL error.
+function testIntegrityErrorForUndefinedThrowsRealError() {
+  var dir = _dir();
+  try {
+    var p = path.join(dir.path, "hashed.bin");
+    fs.writeFileSync(p, Buffer.from("integrity"), { mode: 0o600 });
+    var r = _throws(function () {
+      b.atomicFile.fdSafeReadSync(p, {
+        expectedHash: "0".repeat(128),
+        errorFor: function () { return undefined; },
+      });
+    });
+    check("fdSafeReadSync integrity + undefined errorFor throws a real Error (not undefined)",
+          r !== null && r.e instanceof Error);
+  } finally { dir.cleanup(); }
+}
+
+async function run() {
+  testRefuseSymlinkMissingRoutesEnoent();
+  testRefuseSymlinkMissingErrorForUndefinedRethrowsRaw();
+  testTooLargeErrorForUndefinedThrowsRealError();
+  testSymlinkErrorForUndefinedThrowsRealError();
+  testIntegrityErrorForUndefinedThrowsRealError();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -332,6 +332,7 @@ var VALID_ALLOW_CLASSES = {
   "raw-randombytes-token": 1,
   "raw-time-literal": 1,
   "raw-timing-safe-equal": 1,
+  "raw-xfp": 1,
   "regex-no-length-cap": 1,
   "seal-without-aad": 1,
   "silent-catch": 1,
@@ -1802,6 +1803,30 @@ function testNoRawXffRead() {
     matches);
 }
 
+// ---- Pattern 20b: peer-gating bypass — raw X-Forwarded-Proto/-Host read ----
+
+function testNoRawForwardedProtoHostRead() {
+  // class: raw-xfp
+  // The XFP sibling of Pattern 20. X-Forwarded-Proto / X-Forwarded-Host are
+  // forgeable; reading them directly for a scheme/authority decision (Secure
+  // cookie, HSTS, same-origin, the cryptographically-bound DPoP htu) bypasses
+  // the peer-gating boundary — a direct caller can spoof the header. Route
+  // through requestHelpers.trustedProtocol / trustedHost (or requestProtocol /
+  // requestHost with a peer predicate) so the header is honored only when the
+  // immediate peer is a declared trusted proxy. csrf-protect / security-headers
+  // / cors / bot-guard / dpop all do; dpop was the consumer this rule was added
+  // for (it read XFP/XFH via a bare trustForwardedHeaders boolean → htu
+  // confusion). span-http-server reads both for the url.scheme/server.address
+  // telemetry span attributes (display-only, not a trust sink) and carries an
+  // allow:raw-xfp marker.
+  var matches = _scan(/req\.headers\s*\[\s*["']x-forwarded-(?:proto|host)["']\s*\]/i);
+  // request-helpers.js IS the canonical reader (the primitive home).
+  matches = matches.filter(function (m) { return m.file !== "lib/request-helpers.js"; });
+  matches = _filterMarkers(matches, "raw-xfp");
+  _report("req.headers['x-forwarded-proto'|'x-forwarded-host'] routes through requestHelpers.trustedProtocol/trustedHost",
+    matches);
+}
+
 // ---- Pattern 21: req.socket.remoteAddress raw read for actor IP ----
 
 function testNoRawRemoteAddress() {
@@ -13064,6 +13089,7 @@ async function run() {
   testNoSilentCatchSwallow();
   testNoDynamicRegexFromOperatorInput();
   testNoRawXffRead();
+  testNoRawForwardedProtoHostRead();
   testNoRawRemoteAddress();
   testNoRawProcessEnv();
   testNoRawTimingSafeEqual();