@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/mail-helo.test.js

@@ -64,6 +64,32 @@ async function testRejectsLocalhostClaim() {
   check("localhost reason",         v.reason.indexOf("localhost") !== -1);
 }
 
+async function testPrototypeKeyClaimNotReservedName() {
+  // A HELO claim that collides with an Object.prototype key
+  // ("constructor") must be classified on its own merits, not read
+  // out of the reserved-name table's prototype chain. Under the
+  // permissive profile a bare host is accepted, so the collision
+  // surfaces as an action-level divergence (reject vs accept).
+  var v = await b.mail.helo.evaluate({
+    ip:          "203.0.113.42",
+    claimedName: "constructor",
+  }, { profile: "permissive" });
+  check("constructor not mislabelled localhost",
+    !(v.shape === "invalid" && v.reason.indexOf("localhost-class") !== -1));
+  check("constructor accepts like any bare host (permissive)",
+    v.action === "accept");
+  // The genuine reserved names must still be refused.
+  var real = ["localhost", "localhost.localdomain", "localdomain"];
+  for (var i = 0; i < real.length; i += 1) {
+    var vr = await b.mail.helo.evaluate({
+      ip:          "203.0.113.42",
+      claimedName: real[i],
+    }, { profile: "permissive" });
+    check(real[i] + " still refused as reserved name",
+      vr.action === "reject-shape" && vr.reason.indexOf("localhost-class") !== -1);
+  }
+}
+
 async function testRejectsBareHost() {
   var v = await b.mail.helo.evaluate({
     ip:          "203.0.113.42",
@@ -273,6 +299,7 @@ async function run() {
   testSurface();
   await testAcceptsValidFqdn();
   await testRejectsLocalhostClaim();
+  await testPrototypeKeyClaimNotReservedName();
   await testRejectsBareHost();
   await testAcceptsAddressLiteralV4Match();
   await testRefusesAddressLiteralV4Mismatch();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-scan.test.js

@@ -41,6 +41,27 @@ function _fakeSocket(scriptedResponse) {
   return sock;
 }
 
+// A socket that never replies — end() is a no-op, so the only way the
+// scan promise settles is the lib's own wall-clock timeout timer.
+function _fakeSilentSocket() {
+  var sock = new EventEmitter();
+  sock.write = function () { return true; };
+  sock.end = function () { /* never emits data/end — force the timeout path */ };
+  sock.destroy = function () { sock.emit("close"); };
+  return sock;
+}
+
+// A socket that surfaces a transport error instead of a reply.
+function _fakeErrorSocket(errMsg) {
+  var sock = new EventEmitter();
+  sock.write = function () { return true; };
+  sock.end = function () {
+    setImmediate(function () { sock.emit("error", new Error(errMsg || "ECONNRESET")); });
+  };
+  sock.destroy = function () { sock.emit("close"); };
+  return sock;
+}
+
 function testSurface() {
   check("create is fn",              typeof mailScan.create === "function");
   check("compliancePosture is fn",   typeof mailScan.compliancePosture === "function");
@@ -191,6 +212,171 @@ async function testScanArchiveEntriesGate() {
     rv.threats[0] && rv.threats[0].indexOf("archive:") === 0);
 }
 
+// ---- create() adversarial / omitted-input branches ----
+
+function testCreateRefusesNonObjectOpts() {
+  expectThrow("refuses non-object opts (number)",
+    function () { mailScan.create(42); },
+    "mail-scan/bad-opts");
+}
+
+function testCreateRefusesBadService() {
+  // service defaults to "srv_clamav", but an operator who passes a
+  // non-string truthy service on the ICAP backend must be refused, not
+  // silently coerced into the request line.
+  expectThrow("refuses non-string service on icap",
+    function () {
+      mailScan.create({ host: "av.example.test", port: 1344, service: 123 });
+    },
+    "mail-scan/bad-service");
+}
+
+function testCreateRefusesBadTimeout() {
+  expectThrow("refuses negative timeoutMs",
+    function () {
+      mailScan.create({ host: "av.example.test", port: 1344, timeoutMs: -5 });
+    },
+    "mail-scan/bad-timeout");
+  expectThrow("refuses non-finite timeoutMs",
+    function () {
+      mailScan.create({ host: "av.example.test", port: 1344, timeoutMs: Infinity });
+    },
+    "mail-scan/bad-timeout");
+}
+
+function _clamHandle(audit, extra) {
+  var o = { host: "clamd.example.test", port: 3310, protocol: "clamav-instream", audit: audit };
+  if (extra) { for (var k in extra) { if (Object.prototype.hasOwnProperty.call(extra, k)) o[k] = extra[k]; } }
+  return mailScan.create(o);
+}
+
+// ---- ClamAV INSTREAM reply-classifier branches (previously untestable:
+// the clamav path had no socket-injection seam, so none of its
+// verdict branches had coverage). ----
+
+async function testClamavCleanVerdict() {
+  var audit = _fakeAudit();
+  var h = _clamHandle(audit);
+  var sock = _fakeSocket(Buffer.from("stream: OK\n", "ascii"));
+  var rv = await h.scan(Buffer.from("clean body"), { _socket: sock });
+  check("clamav stream: OK -> clean", rv.verdict === "clean");
+  check("clamav clean threats empty", Array.isArray(rv.threats) && rv.threats.length === 0);
+  var seen = audit.emitted.map(function (e) { return e.action; });
+  check("clamav clean emits request+clean",
+    seen.indexOf("mail.scan.request") !== -1 && seen.indexOf("mail.scan.clean") !== -1);
+  // Wire-format sanity: the first frame must be the zINSTREAM command.
+  check("clamav sends zINSTREAM command first",
+    sock._writes.length > 0 && sock._writes[0].toString("ascii").indexOf("zINSTREAM") === 0);
+}
+
+async function testClamavInfectedVerdict() {
+  var audit = _fakeAudit();
+  var h = _clamHandle(audit);
+  var sock = _fakeSocket(Buffer.from("stream: Eicar-Test-Signature FOUND\n", "ascii"));
+  var rv = await h.scan(Buffer.from("body with signature"), { _socket: sock });
+  check("clamav FOUND -> infected", rv.verdict === "infected");
+  check("clamav threat name surfaced", rv.threats[0] === "Eicar-Test-Signature");
+  var seen = audit.emitted.map(function (e) { return e.action; });
+  check("clamav infected emits mail.scan.infected", seen.indexOf("mail.scan.infected") !== -1);
+}
+
+async function testClamavErrorReplyVerdict() {
+  var audit = _fakeAudit();
+  var h = _clamHandle(audit);
+  var sock = _fakeSocket(Buffer.from("INSTREAM size limit exceeded. ERROR\n", "ascii"));
+  var rv = await h.scan(Buffer.from("oversize-at-daemon"), { _socket: sock });
+  check("clamav ERROR reply -> error verdict", rv.verdict === "error");
+}
+
+async function testClamavUnrecognizedReplyFailsClosed() {
+  // An unparseable reply must NOT be treated as clean — fail closed so
+  // the listener gets a definite do-not-deliver signal.
+  var audit = _fakeAudit();
+  var h = _clamHandle(audit);
+  var sock = _fakeSocket(Buffer.from("garbled daemon banner without a verdict\n", "ascii"));
+  var rv = await h.scan(Buffer.from("payload"), { _socket: sock });
+  check("clamav unrecognized reply -> error (fail closed)", rv.verdict === "error");
+}
+
+// RED before the fix: a reply that carries BOTH a benign "stream: OK"
+// token and a malign "... FOUND" token (a coalesced / stale-then-fresh
+// reply, or an intermediary that concatenates two responses) must never
+// downgrade an infection to "clean". The classifier is fail-closed: the
+// FOUND signal dominates the OK signal.
+async function testClamavCoalescedReplyDoesNotFailOpen() {
+  var audit = _fakeAudit();
+  var h = _clamHandle(audit);
+  var sock = _fakeSocket(
+    Buffer.from("stream: OK\nstream: Eicar-Test-Signature FOUND\n", "ascii"));
+  var rv = await h.scan(Buffer.from("body"), { _socket: sock });
+  check("clamav coalesced OK+FOUND -> infected (no fail-open)",
+    rv.verdict === "infected");
+  check("clamav coalesced surfaces the FOUND threat",
+    rv.threats[0] === "Eicar-Test-Signature");
+}
+
+// ---- ICAP verdict / error-path branches ----
+
+async function testIcapErrorStatusVerdict() {
+  // A 5xx ICAP response with no infection header is neither clean nor
+  // infected — the scanner must surface "error", not silently "clean".
+  var audit = _fakeAudit();
+  var h = mailScan.create({ host: "av.example.test", port: 1344, audit: audit });
+  var sock = _fakeSocket(Buffer.from("ICAP/1.0 500 Server Error\r\n\r\n", "ascii"));
+  var rv = await h.scan(Buffer.from("body"), { _socket: sock });
+  check("ICAP 500 -> error verdict", rv.verdict === "error");
+  var seen = audit.emitted.map(function (e) { return e.action; });
+  check("ICAP error emits mail.scan.error", seen.indexOf("mail.scan.error") !== -1);
+}
+
+async function testIcapBlockedStatusInfected() {
+  // RFC 3507 convention: 403 = the ICAP service blocked the request
+  // (AV hit). safeIcap flags threatFound; the scanner reports infected
+  // even when no threat name is present.
+  var audit = _fakeAudit();
+  var h = mailScan.create({ host: "av.example.test", port: 1344, audit: audit });
+  var sock = _fakeSocket(Buffer.from("ICAP/1.0 403 Forbidden\r\n\r\n", "ascii"));
+  var rv = await h.scan(Buffer.from("body"), { _socket: sock });
+  check("ICAP 403 -> infected verdict", rv.verdict === "infected");
+  check("ICAP 403 threats array present", Array.isArray(rv.threats));
+}
+
+async function testIcapMalformedResponseFailsToError() {
+  // A disallowed status code (302) makes b.safeIcap.parse throw; the
+  // scanner must convert that rejection into an error verdict carrying
+  // the underlying error code, never crash or resolve clean.
+  var audit = _fakeAudit();
+  var h = mailScan.create({ host: "av.example.test", port: 1344, audit: audit });
+  var sock = _fakeSocket(Buffer.from("ICAP/1.0 302 Found\r\n\r\n", "ascii"));
+  var rv = await h.scan(Buffer.from("body"), { _socket: sock });
+  check("ICAP disallowed-status parse throw -> error verdict", rv.verdict === "error");
+  check("ICAP error surfaces underlying errorCode",
+    typeof rv.errorCode === "string" && rv.errorCode.indexOf("safe-icap/") === 0);
+}
+
+async function testIcapSocketErrorFailsToError() {
+  var audit = _fakeAudit();
+  var h = mailScan.create({ host: "av.example.test", port: 1344, audit: audit });
+  var sock = _fakeErrorSocket("ECONNRESET");
+  var rv = await h.scan(Buffer.from("body"), { _socket: sock });
+  check("ICAP socket error -> error verdict", rv.verdict === "error");
+  check("ICAP socket error code is transport",
+    rv.errorCode === "mail-scan/transport");
+}
+
+async function testIcapTimeoutFailsToError() {
+  // Silent daemon: the only settle path is the per-request wall-clock
+  // timeout. Await the scan promise (the lib timer, not a test sleep).
+  var audit = _fakeAudit();
+  var h = mailScan.create({ host: "av.example.test", port: 1344, audit: audit, timeoutMs: 60 });
+  var sock = _fakeSilentSocket();
+  var rv = await h.scan(Buffer.from("body"), { _socket: sock });
+  check("ICAP silent daemon -> timeout error verdict", rv.verdict === "error");
+  check("ICAP timeout errorCode", rv.errorCode === "mail-scan/timeout");
+  var seen = audit.emitted.map(function (e) { return e.action; });
+  check("ICAP timeout emits mail.scan.timeout", seen.indexOf("mail.scan.timeout") !== -1);
+}
+
 function run(cb) {
   testSurface();
   testRefuseMissingHost();
@@ -198,6 +384,9 @@ function run(cb) {
   testRefuseBadProtocol();
   testRefuseBadProfile();
   testRefuseUnknownOpt();
+  testCreateRefusesNonObjectOpts();
+  testCreateRefusesBadService();
+  testCreateRefusesBadTimeout();
   testHandleSurface();
   testScanRefusesBadInput();
   testScanRefusesOversizeMessage();
@@ -206,6 +395,16 @@ function run(cb) {
     .then(testScanIcapCleanVerdictViaInjectedSocket)
     .then(testScanIcapInfectedVerdict)
     .then(testScanArchiveEntriesGate)
+    .then(testClamavCleanVerdict)
+    .then(testClamavInfectedVerdict)
+    .then(testClamavErrorReplyVerdict)
+    .then(testClamavUnrecognizedReplyFailsClosed)
+    .then(testClamavCoalescedReplyDoesNotFailOpen)
+    .then(testIcapErrorStatusVerdict)
+    .then(testIcapBlockedStatusInfected)
+    .then(testIcapMalformedResponseFailsToError)
+    .then(testIcapSocketErrorFailsToError)
+    .then(testIcapTimeoutFailsToError)
     .then(function () { if (cb) cb(); });
 }