@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/forms.js

@@ -178,8 +178,11 @@ var INPUT_TYPES = {
 };
 
 function _renderInput(field) {
+  // A field with no explicit type defaults to a text input — mirror the
+  // `|| "text"` dispatch in _renderField so the emitted type attribute
+  // agrees with the widget actually rendered (never a bare type="").
   var attrs = [
-    'type="' + escapeAttribute(field.type) + '"',
+    'type="' + escapeAttribute(field.type || "text") + '"',
     'name="' + escapeAttribute(field.name) + '"',
   ];
   if (field.value !== undefined && field.value !== null) {
@@ -358,7 +361,14 @@ function _coerce(field, raw) {
   // (false), not "not provided." Coerce to false BEFORE the generic
   // undefined-passthrough below.
   if (field.type === "checkbox") {
-    if (raw === undefined || raw === null || raw === "" || raw === "false" || raw === "0") return false;
+    // A urlencoded checkbox submits its VALUE string only when checked, so
+    // any present string — including a custom value of "false" / "0" / "" —
+    // means checked: presence, not the string content, is the checked
+    // signal. Unchecked is the field's ABSENCE (undefined / null) or, for a
+    // typed (JSON) body, an explicit boolean false / numeric 0. This keeps a
+    // required checkbox satisfiable whatever value it is rendered with, while
+    // a JSON false / 0 still reads as unchecked.
+    if (raw === undefined || raw === null || raw === false || raw === 0) return false;
     return true;
   }
   if (raw === undefined) return undefined;
@@ -381,6 +391,74 @@ function _isEmpty(v) {
   return v === undefined || v === null || v === "";
 }
 
+// A field's numeric bound (min / max / minlength / maxlength) must resolve
+// to a finite number. A non-finite bound (a non-numeric string, NaN,
+// Infinity) would make its comparison a silent no-op — NaN comparisons are
+// always false — turning a documented constraint into nothing. That is an
+// operator config error, so throw at the entry point (mirrors the
+// pre-compiled-RegExp requirement for `pattern`) rather than shipping a
+// form whose bound is quietly unenforced.
+// A clean numeric literal: an optional sign, an integer/decimal mantissa,
+// and an optional exponent. Linear (no nested quantifier over overlapping
+// classes), so it is a framework-internal constant with no ReDoS surface.
+var NUMERIC_LITERAL_RE = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/;
+// Any real numeric bound is short — Number.MAX_VALUE stringifies to ~23
+// chars — so cap the length before the regex test; a longer "number" string
+// is malformed, and running a regex over an unbounded operator string is a
+// DoS shape regardless of the pattern's own linearity.
+var MAX_NUMERIC_BOUND_CHARS = 40;
+
+function _numericBound(f, key) {
+  var v = f[key];
+  // Accept ONLY a genuine finite number or a string that is a clean numeric
+  // literal. A bare Number() coerces null / "" / whitespace / false / [] to a
+  // finite 0 (and true to 1), which would let a malformed bound — e.g.
+  // min: null, which the renderer emits as min="" (no constraint) — silently
+  // validate as 0 on the backend and diverge from the browser. Those are
+  // rejected here, not coerced.
+  var n = NaN;
+  if (typeof v === "number") n = v;
+  else if (typeof v === "string" && v.length <= MAX_NUMERIC_BOUND_CHARS && NUMERIC_LITERAL_RE.test(v)) n = Number(v);
+  if (!Number.isFinite(n)) {
+    throw new Error("forms.validate: field '" + f.name + "'." + key +
+      " must be a finite number; got " +
+      (typeof v === "string" ? JSON.stringify(v) : typeof v) +
+      ". Fix the form spec.");
+  }
+  return n;
+}
+
+// Validate a field's SPEC — the operator-supplied shape, independent of any
+// submitted value. A numeric bound (min / max / minlength / maxlength) must
+// be finite, and a `pattern` must be a pre-compiled, ReDoS-safe RegExp
+// (compiling operator source on the request path would be an engine ReDoS
+// surface). A malformed spec is an operator config error surfaced
+// deterministically at the entry point — never conditionally on whether a
+// given request happens to carry a value that reaches the bound, which would
+// turn a config bug into an input-dependent runtime failure.
+function _assertFieldSpec(f) {
+  if (!f.name || f.type === "submit") return;
+  // min / max are compared numerically only for number / range controls;
+  // date / time / datetime-local / month / week controls carry ISO-string
+  // bounds (e.g. min: "2026-01-01") that validate() never compares
+  // numerically, so those are not numeric bounds and must not be rejected.
+  if (f.type === "number" || f.type === "range") {
+    if (f.min !== undefined) _numericBound(f, "min");
+    if (f.max !== undefined) _numericBound(f, "max");
+  }
+  // minlength / maxlength are always character counts, whatever the control.
+  if (f.minlength !== undefined) _numericBound(f, "minlength");
+  if (f.maxlength !== undefined) _numericBound(f, "maxlength");
+  if (f.pattern) {
+    if (!(f.pattern instanceof RegExp)) {
+      throw new Error("forms.validate: field '" + f.name +
+        "'.pattern must be a pre-compiled RegExp; got " +
+        (typeof f.pattern) + ". Wrap the source string with `RegExp` at config time.");
+    }
+    guardRegex.assertSafe(f.pattern, "forms: field[" + f.name + "].pattern");
+  }
+}
+
 /**
  * @primitive b.forms.validate
  * @signature b.forms.validate(spec, body)
@@ -390,8 +468,9 @@ function _isEmpty(v) {
  *
  * Walks the same spec the renderer accepts and validates a submitted
  * body. Per field: required-field check, type coercion (string /
- * number / boolean / email / url), `minLength` / `maxLength` bounds,
- * regex `pattern`, `enum` membership. Returns
+ * number / boolean / email / url), `minlength` / `maxlength` bounds,
+ * numeric `min` / `max` bounds, regex `pattern`, `enum` membership.
+ * Returns
  * `{ valid: boolean, errors: { field: msg, ... }, values: { ... } }`.
  * The `values` object holds coerced values keyed by field name —
  * route handlers consume `result.values` directly without re-parsing.
@@ -400,7 +479,7 @@ function _isEmpty(v) {
  *   var result = b.forms.validate(
  *     { fields: [
  *         { type: "email",  name: "email", required: true },
- *         { type: "number", name: "age",   minLength: 1 },
+ *         { type: "number", name: "age",   min: 1 },
  *     ] },
  *     { email: "ada@example.com", age: "37" }
  *   );
@@ -410,6 +489,12 @@ function validate(spec, body) {
   if (!spec || !Array.isArray(spec.fields)) {
     throw new Error("forms.validate: spec.fields must be an array");
   }
+  // Validate every field's spec up front — a malformed bound or pattern is
+  // rejected on the first call, deterministically, regardless of the body
+  // (never only when a request happens to carry a value that reaches it).
+  for (var s = 0; s < spec.fields.length; s++) {
+    _assertFieldSpec(spec.fields[s]);
+  }
   body = body || {};
   var errors = {};
   var values = {};
@@ -423,7 +508,21 @@ function validate(spec, body) {
     var coerced = _coerce(f, raw);
     values[f.name] = coerced;
 
-    if (f.required && _isEmpty(coerced) && coerced !== false) {
+    // Checkbox: the only constraint is `required`, which HTML defines as
+    // "must be checked" — and the renderer emits that attribute, so the
+    // server enforces the same (backend validates what the frontend
+    // displays). An unchecked required box (coerced === false) is an error,
+    // never a silent pass. No length / pattern / enum checks apply.
+    if (f.type === "checkbox") {
+      if (f.required && coerced !== true) {
+        errors[f.name] = f.errorMessages && f.errorMessages.required
+          ? f.errorMessages.required
+          : (f.label || f.name) + " is required";
+      }
+      continue;
+    }
+
+    if (f.required && _isEmpty(coerced)) {
       errors[f.name] = f.errorMessages && f.errorMessages.required
         ? f.errorMessages.required
         : (f.label || f.name) + " is required";
@@ -486,27 +585,14 @@ function validate(spec, body) {
         errors[f.name] = (f.label || f.name) + " must be at most " + f.maxlength + " characters";
         continue;
       }
-      if (f.pattern) {
-        // Pattern accepts a pre-compiled RegExp only — taking a string
-        // and compiling it here would be a ReDoS surface against the
-        // form-render engine. Operators construct the RegExp at config
-        // time so the framework never compiles operator-supplied source
-        // on the request path.
-        if (!(f.pattern instanceof RegExp)) {
-          throw new Error("forms.validate: field '" + f.name +
-            "'.pattern must be a pre-compiled RegExp; got " +
-            (typeof f.pattern) + ". Wrap the source string with `RegExp` at config time.");
-        }
-        // Screen the operator-supplied pattern for catastrophic-backtracking
-        // (ReDoS) shapes before the test, so a pathological regex can't be
-        // run against the submitted value.
-        guardRegex.assertSafe(f.pattern, "forms: field[" + f.name + "].pattern");
-        if (!f.pattern.test(coerced)) {
-          errors[f.name] = f.errorMessages && f.errorMessages.pattern
-            ? f.errorMessages.pattern
-            : (f.label || f.name) + " has an invalid format";
-          continue;
-        }
+      // `pattern` was proven a pre-compiled, ReDoS-safe RegExp by the
+      // up-front spec pass, so only the match against the submitted value
+      // remains on the request path.
+      if (f.pattern && !f.pattern.test(coerced)) {
+        errors[f.name] = f.errorMessages && f.errorMessages.pattern
+          ? f.errorMessages.pattern
+          : (f.label || f.name) + " has an invalid format";
+        continue;
       }
     }
     if ((f.type === "select" || f.type === "radio") && Array.isArray(f.options)) {

package/lib/vendor/blamejs/lib/gate-contract.js

@@ -1190,12 +1190,20 @@ function makeProfileResolver(cfg) {
   var label      = _guardLabelFromError(ErrorClass);
   return function resolveProfile(opts) {
     opts = opts || {};
-    if (opts.posture && postures && postures[opts.posture]) {
+    // Own-property lookups only: opts.posture / opts.profile are attacker/
+    // operator input, so a bare bracket read would let a prototype key
+    // ("constructor" / "__proto__" / "toString") resolve to an inherited
+    // truthy member — the posture read would return it as the profile name,
+    // and `!profiles[p]` would treat it as a known profile and skip the
+    // bad-profile refusal, running the gate under a bogus profile (fail-open).
+    if (opts.posture && postures &&
+        Object.prototype.hasOwnProperty.call(postures, opts.posture) &&
+        postures[opts.posture]) {
       var pn = postures[opts.posture];
       return byObject ? profiles[pn] : pn;
     }
     var p = opts.profile || dft;
-    if (!profiles[p]) {
+    if (!Object.prototype.hasOwnProperty.call(profiles, p)) {
       throw ErrorClass.factory(codePrefix + "/bad-profile",
         label + ": unknown profile '" + p + "' (use " +
         Object.keys(profiles).join(" / ") + ")");
@@ -2313,11 +2321,11 @@ function _resetForTest() {
  * `makeProfileBuilder` and never call `buildProfile` directly.
  *
  * @opts
- *   baseProfile:    string,        // start from this profile name
- *   extends:        string[],      // additional bases (later-wins)
- *   overrides:      object,        // inline merge after extends
- *   removes:        object,        // drop array entries or keys
- *   resolveProfile: function,      // (name) → profile|null  (required)
+ *   baseProfile:    string,           // start from this profile name
+ *   extends:        string|string[],  // additional base(s) (later-wins)
+ *   overrides:      object,           // inline merge after extends
+ *   removes:        object,           // drop array entries or keys
+ *   resolveProfile: function,         // (name) → profile|null  (required)
  *
  * @example
  *   var PROFILES = {
@@ -2363,9 +2371,14 @@ function buildProfile(opts) {
     return merged;
   }
   var base = opts.baseProfile ? _walk(opts.baseProfile) : {};
-  if (Array.isArray(opts.extends)) {
-    for (var i = 0; i < opts.extends.length; i++) {
-      base = _mergeProfile(base, _walk(opts.extends[i]));
+  // @opts documents `extends: string|string[]`; normalize a bare string
+  // to a one-element list so the single-base form composes instead of
+  // being silently dropped (the ABI-template @example every guard shares
+  // is `buildProfile({ extends: "strict" })`).
+  var extendsList = typeof opts.extends === "string" ? [opts.extends] : opts.extends;
+  if (Array.isArray(extendsList)) {
+    for (var i = 0; i < extendsList.length; i++) {
+      base = _mergeProfile(base, _walk(extendsList[i]));
     }
   }
   if (opts.overrides) base = _mergeProfile(base, opts.overrides);

package/lib/vendor/blamejs/lib/gdpr-ropa.js

@@ -129,7 +129,14 @@ function create(opts) {
       registeredAt: existing.registeredAt,
       lastUpdatedAt: now(),
     });
-    if (patch.legalBasis && !Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, merged.legalBasis)) {
+    // Validate whenever the patch TOUCHES legalBasis — keyed on own-property
+    // presence, not truthiness. A falsy-but-invalid value ("" / 0 / false /
+    // undefined) is still an invalid legal basis and must be rejected with the
+    // same rigor register() applies; a `patch.legalBasis &&` guard would skip
+    // the enum check for those values and silently corrupt a required
+    // Article 30 field.
+    if (Object.prototype.hasOwnProperty.call(patch, "legalBasis") &&
+        !Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, merged.legalBasis)) {
       throw new GdprRopaError("gdpr-ropa/bad-legal-basis",
         "gdpr.ropa.update: legalBasis must be one of " + Object.keys(VALID_LEGAL_BASES).join(", "));
     }

package/lib/vendor/blamejs/lib/guard-agent-registry.js

@@ -102,7 +102,7 @@ function _checkName(name, profile) {
     throw new GuardAgentRegistryError("agent-registry/name-too-long",
       "guardAgentRegistry.validate: name exceeds maxNameBytes=" + profile.maxNameBytes);
   }
-  if (RESERVED_EXACT[name]) {
+  if (Object.prototype.hasOwnProperty.call(RESERVED_EXACT, name)) {
     throw new GuardAgentRegistryError("agent-registry/reserved-name",
       "guardAgentRegistry.validate: name '" + name + "' is framework-reserved");
   }

package/lib/vendor/blamejs/lib/guard-archive.js

@@ -781,10 +781,10 @@ function gate(opts) {
  * `GuardArchiveError("archive.bad-profile")` on unknown name.
  *
  * @opts
- *   profile: "strict"|"balanced"|"permissive",
+ *   extends: "strict"|"balanced"|"permissive",   // base profile name(s)
  *
  * @example
- *   var resolved = b.guardArchive.buildProfile({ profile: "strict" });
+ *   var resolved = b.guardArchive.buildProfile({ extends: "strict" });
  *   resolved.maxEntries;                                 // → 100
  *   resolved.symlinkPolicy;                              // → "reject"
  *   resolved.maxCompressionRatio;                        // → 100

package/lib/vendor/blamejs/lib/guard-cidr.js

@@ -182,6 +182,11 @@ function _parseIpv6(s) {
     if (left === null || right === null) return null;
     var pad = IPV6_GROUPS - left.length - right.length;
     if (pad < 0) return null;
+    // RFC 4291 §2.2 — "::" must compress at least one all-zero group. Eight
+    // explicit groups adjacent to a "::" (pad === 0) compress nothing and are
+    // malformed IPv6 text (net.isIP rejects them), so reject rather than accept
+    // a non-canonical spelling into CIDR matching.
+    if (pad === 0) return null;
     var zeros = [];
     for (var z = 0; z < pad; z += 1) zeros.push("0000");                         // IPv6 zero group
     groups = left.concat(zeros).concat(right);
@@ -232,13 +237,34 @@ function _ipv4InReservedRange(octets, prefix) {
   return hits;
 }
 
+// Bit-accurate prefix match over two hex strings. Reserved-range membership
+// is a relation on the first `prefixBits` bits, NOT on a whole number of hex
+// nibbles: ULA fc00::/7 (7 bits) and link-local fe80::/10 (10 bits) end
+// mid-nibble, so a hex-string startsWith on the reserved nibbles silently
+// misses every address whose trailing (masked-off) bits differ — e.g. fd00::
+// (the assigned half of fc00::/7) and fe90::/fea0::/feb0:: (all inside
+// fe80::/10). Compare the whole nibbles, then the top `prefixBits % 4` bits of
+// the boundary nibble under a mask — the same bit-prefix relation the IPv4
+// side gets from `(addr & mask) === net` and ssrf-guard gets from its byte-
+// level `_ipv6PrefixMatch`.
+function _ipv6HexPrefixMatch(hex, reservedHex, prefixBits) {
+  var fullNibbles = Math.floor(prefixBits / 4);                                  // whole hex chars fully inside the prefix
+  if (hex.slice(0, fullNibbles) !== reservedHex.slice(0, fullNibbles)) return false;
+  var remBits = prefixBits - fullNibbles * 4;                                    // 0-3 bits in the boundary nibble
+  if (remBits === 0) return true;
+  var mask = (0xF << (4 - remBits)) & 0xF;                                       // high `remBits` bits of the nibble
+  var aNib = parseInt(hex.charAt(fullNibbles), 16);                              // base-16 radix
+  var rNib = parseInt(reservedHex.charAt(fullNibbles), 16);                      // base-16 radix
+  return (aNib & mask) === (rNib & mask);
+}
+
 function _ipv6InReservedRange(groups, prefix) {
   var hex = groups.join("");
   var hits = [];
   for (var i = 0; i < IPV6_RESERVED.length; i += 1) {
     var r = IPV6_RESERVED[i];
     if (prefix < r.prefix) continue;
-    if (hex.startsWith(r.hexPrefix)) hits.push(r.label);
+    if (_ipv6HexPrefixMatch(hex, r.hexPrefix, r.prefix)) hits.push(r.label);
   }
   return hits;
 }

package/lib/vendor/blamejs/lib/guard-graphql.js

@@ -165,7 +165,8 @@ function _measureQueryShape(query) {
   var depth = 0;
   var inString = false;
   var inComment = false;
-  var aliasCounts = [0];                                                         // per-depth alias counter
+  var escapeNext = false;                                                        // inside a string, the previous char was an unescaped backslash
+  var aliasStack = [0];                                                          // per-selection-set alias counter (top of stack = current set)
   for (var i = 0; i < query.length; i += 1) {
     var c = query.charAt(i);
     if (inComment) {
@@ -173,7 +174,18 @@ function _measureQueryShape(query) {
       continue;
     }
     if (inString) {
-      if (c === '"' && query.charAt(i - 1) !== "\\") inString = false;
+      // Escaped-quote handling must track the backslash RUN, not just the
+      // single preceding char. `"\\"` is a complete string (its backslash is
+      // itself escaped), so a naive `charAt(i - 1) !== "\\"` test reads the
+      // closing quote as escaped, leaves the walker stuck in-string, and
+      // blinds it to every following brace / colon — silently under-counting
+      // depth and alias breadth so a depth-bomb or alias-bomb rides through as
+      // shape-clean (a fail-open DoS-measurement bypass on valid GraphQL).
+      // Toggle on each backslash: a closing quote ends the string only after
+      // an EVEN run (escapeNext false).
+      if (escapeNext) { escapeNext = false; continue; }
+      if (c === "\\") { escapeNext = true; continue; }
+      if (c === '"') inString = false;
       continue;
     }
     if (c === '"') { inString = true; continue; }
@@ -181,28 +193,35 @@ function _measureQueryShape(query) {
     if (c === "{") {
       depth += 1;
       if (depth > maxDepth) maxDepth = depth;
-      aliasCounts.push(0);
+      aliasStack.push(0);
     } else if (c === "}") {
       // Capture the current selection-set's alias count before popping
       // — otherwise we lose the per-block max when the block closes.
-      var current = aliasCounts[aliasCounts.length - 1] || 0;
+      var current = aliasStack[aliasStack.length - 1] || 0;
       if (current > maxAliases) maxAliases = current;
       depth -= 1;
-      aliasCounts.pop();
+      // Never pop the base counter: an unbalanced leading `}` would otherwise
+      // desync the stack from `depth`, and a subsequent `depth`-indexed
+      // increment lands on an absent slot (`undefined + 1 === NaN`), poisoning
+      // every later comparison so an alias-bomb reads as clean.
+      if (aliasStack.length > 1) aliasStack.pop();
       if (depth < 0) depth = 0;
     } else if (c === ":") {
-      // Alias indicator — `alias: field`. Increment the current depth's
-      // counter when the char before `:` looks like an identifier.
+      // Alias / argument indicator — `alias: field` / `field(arg: value)`.
+      // Increment the CURRENT selection-set's counter (top of stack) when the
+      // char before `:` looks like an identifier. Using the stack top rather
+      // than a `depth` index keeps counting correct even when a malformed
+      // brace run has decoupled `depth` from the stack length.
       var prev = i > 0 ? query.charAt(i - 1) : "";
-      if (/[A-Za-z0-9_]/.test(prev) && depth > 0) {
-        aliasCounts[depth] += 1;
+      if (/[A-Za-z0-9_]/.test(prev) && aliasStack.length > 1) {
+        aliasStack[aliasStack.length - 1] += 1;
       }
     }
   }
   // Final sweep covers any unclosed selection-sets (operator-supplied
   // syntactically-invalid queries).
-  for (var ai = 0; ai < aliasCounts.length; ai += 1) {
-    if (aliasCounts[ai] > maxAliases) maxAliases = aliasCounts[ai];
+  for (var ai = 0; ai < aliasStack.length; ai += 1) {
+    if (aliasStack[ai] > maxAliases) maxAliases = aliasStack[ai];
   }
   return { maxDepth: maxDepth, maxAliases: maxAliases };
 }

package/lib/vendor/blamejs/lib/guard-html.js

@@ -110,11 +110,6 @@ void observability;
 
 var _err = GuardHtmlError.factory;
 
-// ---- Codepoint catalog (shared via lib/codepoint-class) ----
-
-var C0_CTRL_RE_G  = codepointClass.C0_CTRL_RE_G;
-var ZW_RE_G       = codepointClass.ZW_RE_G;
-
 // ---- Tag denylists / allowlists ----
 
 // Always-dangerous tags. Active scripts, plugin embeds, form elements,
@@ -362,54 +357,21 @@ function escapeAttr(value) {
     .replace(/=/g, "=");
 }
 
-// HTML5 named entities that decode to ASCII codepoints — focused on
-// the entries browsers honor inside URL contexts (whitespace, control
-// chars, scheme-significant punctuation). The full WHATWG named-
-// character-reference table is ~2,231 entries; this is the
-// security-load-bearing subset documented in scheme-bypass writeups
-// (CVE-2026-30838 class). High-codepoint named entities (e.g. mathematical
-// symbols) don't affect URL scheme parsing, so they're omitted.
-var NAMED_ENTITY_ASCII = {
-  // Whitespace + control chars browsers strip inside URL schemes
-  Tab: "\t", NewLine: "\n",
-  // Scheme-significant punctuation
-  colon: ":", semi: ";", period: ".", sol: "/", bsol: "\\",
-  num: "#", excl: "!", quest: "?", lpar: "(", rpar: ")",
-  lsqb: "[", rsqb: "]", lcub: "{", rcub: "}",
-  // Quotes / brackets
-  quot: "\"", apos: "'", lt: "<", gt: ">",
-  // Misc ASCII
-  amp: "&", commat: "@", dollar: "$", percnt: "%",
-  ast: "*", plus: "+", lowbar: "_", hyphen: "-",
-  // Whitespace markers (codepoints in the ASCII / Latin-1 range that
-  // browsers treat as URL-strippable)
-  nbsp: " ",
-};
-
-// _normalizeUrl — peel off entity-encoded leading whitespace and
-// HTML/URL-encoded scheme prefix tricks, then return the lowercased
-// scheme. Returns "" if no scheme.
+// The named-entity ASCII table + entity decoder now live in codepoint-class
+// (NAMED_ENTITY_ASCII / decodeMarkupEntities), shared with guard-svg /
+// guard-markdown so all three decode the SAME browser-honored set and cannot
+// drift on which encoding a scheme / CSS-token danger check must fold away.
+// _extractScheme — decode entity-hidden scheme-prefix tricks, fold away the
+// whitespace the WHATWG URL parser would (tab/lf/cr anywhere + a leading/
+// trailing C0-control-or-space run — none of which the C0/zero-width strip
+// covers: tab/lf/cr are excluded from C0_CTRL_RANGES and space is not a
+// control), then return the lowercased scheme ("" if none). The shared
+// codepoint-class primitive keeps guard-html / guard-svg from drifting on which
+// whitespace to strip, so neither `java<TAB>script:` nor `&#32;javascript:` can
+// read as scheme-less.
 function _extractScheme(rawUrl) {
-  var s = String(rawUrl || "").trim();
-  // Decode HTML numeric entities (hex &#x..; and decimal &#..;, semicolon
-  // OPTIONAL) just enough to expose hidden schemes like &#x6A;avascript: or
-  // the browser-decoded no-semicolon form &#106avascript:. Shared decoder so
-  // guard-html / guard-svg / guard-markdown can't drift (see codepoint-class).
-  s = codepointClass.decodeNumericEntities(s);
-  // Decode HTML5 named entities that browsers honor inside URL
-  // contexts. Without this, payloads like `java&Tab;script:alert(1)`
-  // bypass the scheme allowlist (the literal `&Tab;` between `java`
-  // and `script:` doesn't match any denied scheme; the browser then
-  // decodes the entity, strips the tab, and executes javascript:).
-  s = s.replace(/&([A-Za-z][A-Za-z0-9]+);/g, function (m, name) {
-    if (Object.prototype.hasOwnProperty.call(NAMED_ENTITY_ASCII, name)) {
-      return NAMED_ENTITY_ASCII[name];
-    }
-    return m;
-  });
-  // Strip embedded whitespace + control chars + zero-widths the
-  // URL parser would tolerate.
-  s = s.replace(C0_CTRL_RE_G, "").replace(ZW_RE_G, "");
+  var s = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(String(rawUrl || "").trim()));
   var m = s.match(/^([A-Za-z][A-Za-z0-9+.-]*):/);
   return m ? m[1].toLowerCase() : "";
 }
@@ -443,8 +405,19 @@ function _isClobberGlobal(name) {
 }
 
 function _isCssDangerous(value) {
+  // A style attribute is HTML/XML character-reference-decoded before the CSS
+  // parser sees it, so `ex&#x70;ression(` reaches CSS as `expression(` and
+  // `behavior&colon;` as `behavior:`. Match against the decoded value — the same
+  // normalization the URL-scheme check performs — so an entity-encoded CSS
+  // payload can't be served verbatim past the danger patterns.
+  // Also fold the URL-scheme whitespace a browser strips inside url(...) -- tab /
+  // lf / cr -- so an entity-hidden tab in a CSS URL scheme (url(java&Tab;script:))
+  // cannot defeat the contiguous `javascript:` danger pattern, the same bypass the
+  // URL-scheme check folds away for href.
+  var decoded = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(value));
   for (var i = 0; i < CSS_DANGEROUS_PATTERNS.length; i += 1) {
-    if (CSS_DANGEROUS_PATTERNS[i].test(value)) return true;
+    if (CSS_DANGEROUS_PATTERNS[i].test(decoded)) return true;
   }
   return false;
 }

package/lib/vendor/blamejs/lib/guard-image.js

@@ -101,8 +101,11 @@ var MAGIC_BYTES = Object.freeze([
   { mime: "image/heic", bytes: [0x66, 0x74, 0x79, 0x70, 0x68, 0x65, 0x69, 0x78], offset: 4 },
   { mime: "image/avif", bytes: [0x66, 0x74, 0x79, 0x70, 0x61, 0x76, 0x69, 0x66], offset: 4 },
   // SVG (XML) — `<?xml` or `<svg` starting bytes (after any UTF-8 BOM).
-  { mime: "image/svg+xml", bytes: [0x3C, 0x3F, 0x78, 0x6D, 0x6C] },              // `<?xml`
-  { mime: "image/svg+xml", bytes: [0x3C, 0x73, 0x76, 0x67] },                    // `<svg`
+  // textFamily: a leading UTF-8 BOM is legal before XML/SVG text and is skipped
+  // when matching these; binary rasters (above) are matched only at their real
+  // offset, so a BOM-prefixed raster is NOT accepted.
+  { mime: "image/svg+xml", bytes: [0x3C, 0x3F, 0x78, 0x6D, 0x6C], textFamily: true },   // `<?xml`
+  { mime: "image/svg+xml", bytes: [0x3C, 0x73, 0x76, 0x67], textFamily: true },         // `<svg`
 ]);
 
 // ---- Profile presets ----
@@ -163,12 +166,21 @@ function _bytesAt(buf, offset, sig) {
 
 function _detectMagicMimes(buf) {
   if (!buf || typeof buf.length !== "number") return [];
+  // A leading UTF-8 BOM (EF BB BF) is legal only before the text-family images
+  // (SVG / XML); skip it ONLY for those entries so a BOM-prefixed SVG still
+  // matches its `<?xml` / `<svg` signature and routes to guardSvg at every
+  // profile. Binary rasters (PNG/JPEG/GIF/...) must carry their signature at
+  // its real offset — applying the BOM shift to them would let a BOM-prefixed
+  // raster masquerade as valid, bypassing strict magic validation. So the
+  // shift is gated on entry.textFamily.
+  var bom = (buf.length >= 3 && buf[0] === 0xEF && buf[1] === 0xBB && buf[2] === 0xBF) ? 3 : 0;
   var hits = [];
   for (var i = 0; i < MAGIC_BYTES.length; i += 1) {
     var entry = MAGIC_BYTES[i];
-    var offset = entry.offset || 0;
+    var shift = entry.textFamily ? bom : 0;
+    var offset = (entry.offset || 0) + shift;
     if (!_bytesAt(buf, offset, entry.bytes)) continue;
-    if (entry.tail && !_bytesAt(buf, entry.tailOffset, entry.tail)) continue;
+    if (entry.tail && !_bytesAt(buf, entry.tailOffset + shift, entry.tail)) continue;
     hits.push(entry.mime);
   }
   return hits;
@@ -182,8 +194,15 @@ function _detectIssues(metadata, opts) {
               snippet: "image metadata is not an object" }];
   }
 
+  // Measure the byte cap only for measurable values. A hostile bag whose
+  // `bytes` is a plain Array or array-like object carries a numeric `.length`
+  // but is NOT a byte-carrier — measuring it would throw, breaking validate's
+  // documented never-throw contract; byteLengthOfIfMeasurable returns null for
+  // those, so the cap is skipped (magic detection below is O(1)-bounded
+  // regardless of size) instead of crashing the caller.
   var bytes = metadata.bytes;
-  if (bytes && typeof bytes.length === "number" && safeBuffer.byteLengthOf(bytes) > opts.maxBytes) {
+  var byteCount = safeBuffer.byteLengthOfIfMeasurable(bytes);
+  if (byteCount !== null && byteCount > opts.maxBytes) {
     return [{ kind: "image-cap", severity: "high",
               ruleId: "image.image-cap",
               snippet: "image bytes exceed maxBytes " + opts.maxBytes }];

package/lib/vendor/blamejs/lib/guard-imap-command.js

@@ -198,10 +198,18 @@ var LITERAL_SMUGGLE_RE = /\{[0-9]+\+?\}(?!\s*$)/;
 function validate(line, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every byte / literal cap compares against `undefined` (fails
+  // open). An unknown posture is ignored (falls through to profile/default);
+  // an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardImapCommandError("guard-imap-command/bad-profile",
       "guardImapCommand.validate: unknown profile '" + profileName + "'");