@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/guard-jmap.js

@@ -133,10 +133,18 @@ var CORE_CAPABILITIES = Object.freeze({
 function validate(rawBody, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every size / count cap compares against `undefined` (fails
+  // open). An unknown posture is ignored (falls through to profile/default)
+  // as before; an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardJmapError("guard-jmap/bad-profile",
       "guardJmap.validate: unknown profile '" + profileName + "'");
@@ -198,7 +206,15 @@ function validate(rawBody, opts) {
       throw new GuardJmapError("urn:ietf:params:jmap:error:invalidArguments",
         "guardJmap.validate: `using[" + ui + "]` must be a string capability URI");
     }
-    if (!Object.prototype.hasOwnProperty.call(CORE_CAPABILITIES, cap) && !serverCaps[cap]) {
+    // hasOwnProperty on both tables: `cap` is attacker-supplied (from the
+    // request body). A bare `serverCaps[cap]` bracket read resolves an
+    // inherited Object.prototype member (constructor / __proto__ / toString
+    // / ...) to a truthy value, letting a prototype-key capability pass the
+    // allowlist the server never advertised. Own-key AND truthy preserves
+    // the operator's "capability: false disables it" semantics.
+    var advertised = Object.prototype.hasOwnProperty.call(CORE_CAPABILITIES, cap) ||
+      (Object.prototype.hasOwnProperty.call(serverCaps, cap) && serverCaps[cap]);
+    if (!advertised) {
       throw new GuardJmapError("urn:ietf:params:jmap:error:unknownCapability",
         "guardJmap.validate: capability '" + cap + "' not advertised by this server");
     }

package/lib/vendor/blamejs/lib/guard-jwt.js

@@ -312,9 +312,25 @@ function _detectIssues(input, opts) {
     }
   }
 
-  // Payload claim sanity (only if payload is decodable).
+  // Payload claim sanity. A JWT claims set MUST be a JSON object (RFC 7519
+  // §7.2); a payload that does not decode to one — undecodable base64url,
+  // non-JSON bytes, a JSON primitive, or a JSON array — is refused
+  // symmetrically with the header-decode path above. Skipping it silently
+  // (the earlier behaviour) let the required-claims and exp/nbf/iat sanity
+  // checks never run, so a token carrying no readable claims set passed at
+  // strict with the guard's advertised required-claims enforcement bypassed.
   var payload = _b64urlDecodeJson(payloadSeg);
-  if (payload && typeof payload === "object") {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    issues.push({
+      kind: "payload-decode", severity: "high",
+      ruleId: "jwt.payload-decode",
+      snippet: "JWT payload is not a decodable JSON object (a JWT claims " +
+               "set must be a JSON object per RFC 7519 §7.2) or contains " +
+               "prototype-pollution keys",
+    });
+    return issues;
+  }
+  {
     var nowSec = Math.floor(Date.now() / 1000);                                  // seconds-per-millisecond conversion
 
     // exp in the past.

package/lib/vendor/blamejs/lib/guard-list-unsubscribe.js

@@ -174,7 +174,7 @@ function _isRefusedAutoFetchHost(hostname, allowedHosts) {
   }
   if (lower.length === 0) return "missing-host";
   if (IPV4_LITERAL_RE.test(lower) || IPV6_LITERAL_RE.test(lower)) return "ip-literal";
-  if (RESERVED_LOCAL_HOSTS[lower]) return "reserved-local-host";
+  if (Object.prototype.hasOwnProperty.call(RESERVED_LOCAL_HOSTS, lower)) return "reserved-local-host";
   // Hostname suffix refusal — RFC 6761 reserved / mDNS / single-network.
   if (lower === "local" || lower.endsWith(".local")) return "reserved-local-suffix";
   if (lower === "lan" || lower.endsWith(".lan")) return "reserved-local-suffix";
@@ -277,7 +277,7 @@ function validate(headers, opts) {
       return _verdict("refuse", "URI '" + _trunc(u) + "' has no scheme (RFC 3986 §3.1)",
         { uris: classified, hasHttpsUri: hasHttpsUri, hasMailtoUri: hasMailtoUri, postHeaderOk: false });
     }
-    if (DANGEROUS_SCHEMES[scheme]) {
+    if (Object.prototype.hasOwnProperty.call(DANGEROUS_SCHEMES, scheme)) {
       return _verdict("refuse", "URI scheme '" + scheme + "' is on the always-refused list (XSS / file-read class)",
         { uris: classified, hasHttpsUri: hasHttpsUri, hasMailtoUri: hasMailtoUri, postHeaderOk: false });
     }

package/lib/vendor/blamejs/lib/guard-managesieve-command.js

@@ -202,10 +202,18 @@ var LITERAL_RE = /^\{([0-9]{1,10})(\+?)\}$/;
 function validate(line, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every line / script / script-name cap compares against
+  // `undefined` (fails open). An unknown posture is ignored (falls through
+  // to profile/default); an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardManageSieveCommandError("guard-managesieve-command/bad-profile",
       "guardManageSieveCommand.validate: unknown profile '" + profileName + "'");

package/lib/vendor/blamejs/lib/guard-markdown.js

@@ -87,8 +87,6 @@ var INLINE_LINK_RE  = /(!?)\[([^\]\n]*)\]\(\s*([^)\s]+)\s*(?:"[^"]*")?\s*\)/g;
 var AUTOLINK_RE     = /<((?:[a-zA-Z][a-zA-Z0-9+.-]{0,32}):[^\s>]+)>/g;
 // Reference-link definition `[label]: url "title"`.
 var REF_DEF_RE      = /^\s{0,3}\[([^\]\n]+)\]:\s*([^\s]+)/gm;
-// HTML entity hex / decimal scheme bypass — decode and re-test.
-var HTML_ENTITY_NUM_RE = /&#(?:x([0-9a-f]+)|(\d+));?/gi;
 
 // Front-matter block (YAML triple-dash or TOML triple-plus).
 var FRONT_MATTER_YAML_RE = /^---\s*\n[\s\S]+?\n---\s*\n?/;
@@ -99,31 +97,20 @@ var DOCTYPE_INLINE_RE = /<!DOCTYPE\b/i;
 var CODE_FENCE_LANG_RE = /^(?:```|~~~)([^\n]*)\n/gm;
 var EMPH_RUN_RE = /[*_]{20,}/;                                                   // allow:regex-no-length-cap — character-class repeat is linear in input length
 
-function _decodeHtmlEntities(s) {
-  return s.replace(HTML_ENTITY_NUM_RE, function (match, hex, dec) {
-    var code = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);       // parseInt radix args (16 hex / 10 decimal)
-    if (!isFinite(code) || code < 0 || code > 0x10ffff) return match;            // Unicode codepoint range
-    try { return String.fromCodePoint(code); } catch (_e) { return match; }
-  });
-}
 
 function _isDangerousUrl(url, opts) {
   if (typeof url !== "string") return null;
-  var s = url.trim();
-  s = _decodeHtmlEntities(s);
-  // Strip null + ASCII control chars from the URL — ` javascript:` works
-  // in some browsers because the leading control bytes are tolerated.
-  // Char-by-char filter avoids the no-control-regex lint surface; the
-  // codepoint catalog (< 0x20 or 0x7F) is the same shape as the
-  // codepointClass tables.
-  var stripped = "";
-  for (var ci = 0; ci < s.length; ci += 1) {
-    var cc = s.charCodeAt(ci);
-    if (cc > 0x1f && cc !== 0x7f) stripped += s.charAt(ci);                     // ASCII control range thresholds
-  }
-  s = stripped;
-  if (DANGEROUS_SCHEME_RE.test(s)) return s.match(/^[a-z]+/i)[0].toLowerCase(); // allow:regex-no-length-cap — `s` is a markdown URL token already bounded by the inline-link / autolink / ref-def matchers (which themselves run on input bounded by maxBytes)
-  if (FILE_SCHEME_RE.test(s) && opts.filePolicy !== "allow") return "file";     // allow:regex-no-length-cap — same bounded-URL-token reasoning
+  // Decode the entity-hidden scheme tricks a browser resolves -- numeric AND the
+  // named-entity ASCII subset (guard-markdown previously decoded numeric only, so
+  // `java&Tab;script:` / a `&colon;`-hidden scheme slipped past) -- then fold away
+  // the whitespace the WHATWG URL parser strips (tab/lf/cr anywhere + a leading/
+  // trailing C0-control-or-space run, so `&#32;javascript:` -> " javascript:" can't
+  // defeat the `^scheme:` anchor). Shared codepoint-class primitives keep
+  // guard-markdown / guard-html / guard-svg from drifting on which encodings to fold.
+  var s = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(url.trim()));
+  if (DANGEROUS_SCHEME_RE.test(s)) return s.match(/^[a-z]+/i)[0].toLowerCase(); // allow:regex-no-length-cap -- `s` is a markdown URL token already bounded by the inline-link / autolink / ref-def matchers (which themselves run on input bounded by maxBytes)
+  if (FILE_SCHEME_RE.test(s) && opts.filePolicy !== "allow") return "file";     // allow:regex-no-length-cap -- same bounded-URL-token reasoning
   return null;
 }
 

package/lib/vendor/blamejs/lib/guard-pdf.js

@@ -156,8 +156,16 @@ function _detectIssues(metadata, opts) {
               snippet: "pdf metadata is not an object" }];
   }
 
+  // Measure the byte cap only for measurable values. A hostile bag whose
+  // `bytes` is a plain Array or array-like object carries a numeric `.length`
+  // but is NOT a byte-carrier — measuring it would throw, breaking validate's
+  // documented never-throw-on-hostile-metadata contract; byteLengthOfIfMeasurable
+  // returns null for those, so the cap is skipped (magic detection reads only
+  // the leading bytes, O(1)-bounded regardless of the reported size) instead of
+  // crashing the caller.
   var bytes = metadata.bytes;
-  if (bytes && typeof bytes.length === "number" && safeBuffer.byteLengthOf(bytes) > opts.maxBytes) {
+  var byteCount = safeBuffer.byteLengthOfIfMeasurable(bytes);
+  if (byteCount !== null && byteCount > opts.maxBytes) {
     return [{ kind: "pdf-cap", severity: "high",
               ruleId: "pdf.pdf-cap",
               snippet: "pdf bytes exceed maxBytes " + opts.maxBytes }];
@@ -364,13 +372,21 @@ function sanitize(input, opts) {
   // Force the active-content / exfil / encryption policies to reject, then
   // refuse anything the validate chain flags. The object graph can't be
   // edited without a parser, so disarm collapses to "refuse if not already
-  // inert" — never a silent passthrough of a live action.
+  // inert" — never a silent passthrough of a live action. Every active-content
+  // policy is pinned to "reject" here so an operator-supplied permissive opt
+  // (javascriptPolicy / launchActionPolicy / polyglotPolicy: "allow" | "audit")
+  // cannot make disarm hand back a live PDF — the RCE / polyglot classes the
+  // guard "refuses to negotiate" on must be pinned exactly as the exfil /
+  // encryption ones are, or the override is only half-applied.
   var strict = Object.assign({}, resolved, {
     magicPolicy:             "reject",
+    javascriptPolicy:        "reject",
+    launchActionPolicy:      "reject",
     openActionPolicy:        "reject",
     embeddedFilePolicy:      "reject",
     embeddedFileCountPolicy: "reject",
     encryptedPolicy:         "reject",
+    polyglotPolicy:          "reject",
   });
   var issues = _detectIssues(input, strict);
   gateContract.throwOnRefusalSeverity(issues,

package/lib/vendor/blamejs/lib/guard-pop3-command.js

@@ -155,10 +155,18 @@ var MSG_NUM_RE = /^[1-9][0-9]{0,9}$/;
 function validate(line, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every line / username / password cap compares against
+  // `undefined` (fails open). An unknown posture is ignored (falls through
+  // to profile/default); an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardPop3CommandError("guard-pop3-command/bad-profile",
       "guardPop3Command.validate: unknown profile '" + profileName + "'");

package/lib/vendor/blamejs/lib/guard-regex.js

@@ -59,7 +59,11 @@ var _err = GuardRegexError.factory;
 
 // Nested-quantifier detector: `(group)+`-style followed by another
 // quantifier or repetition that operates on the grouped match.
-var NESTED_QUANT_RE = /\([^()]*[*+?][^()]*\)\s*[*+?{]/;
+// (The flat single-group nested-quantifier case is handled by the paren-aware
+// structural scanner _hasNestedQuantifier, which — unlike a flat regex — requires
+// the OUTER quantifier to be UNBOUNDED (`*`/`+`/`{n,}`, not `?`/`{0,1}`/`{n,m}`)
+// and does not miscount a `(?:` group prefix as an inner quantifier, so it does
+// not false-positive on linear shapes like `(?:X+)?` / `(X+)?` / `(?:bar)*`.)
 
 // Alternation-with-quantifier — `(a|b|...)+`, `(a|b)*`.
 var ALTERNATION_QUANT_RE = /\([^()]*\|[^()]*\)\s*[*+]/;
@@ -184,8 +188,7 @@ function _detectIssues(input, opts) {
   if (pre.done) return pre.issues;
   var issues = pre.issues;
 
-  if (opts.nestedQuantPolicy !== "allow" &&
-      (NESTED_QUANT_RE.test(input) || _hasNestedQuantifier(input))) {            // allow:regex-no-length-cap — input bounded by maxPatternBytes
+  if (opts.nestedQuantPolicy !== "allow" && _hasNestedQuantifier(input)) {
     issues.push({
       kind: "nested-quantifier", severity: "critical",
       ruleId: "regex.nested-quantifier",
@@ -481,12 +484,12 @@ function _sanitizeTransform(input) {
  * @example
  *   var gate = b.guardRegex.gate({ profile: "strict" });
  *
- *   gate({ identifier: "(a+)+b" }).then(function (rv) {
+ *   gate.check({ identifier: "(a+)+b" }).then(function (rv) {
  *     rv.ok;                                           // → false
  *     rv.action;                                       // → "refuse"
  *   });
  *
- *   gate({ identifier: "^[a-z]+$" }).then(function (rv) {
+ *   gate.check({ identifier: "^[a-z]+$" }).then(function (rv) {
  *     rv.action;                                       // → "serve"
  *   });
  */

package/lib/vendor/blamejs/lib/guard-svg.js

@@ -122,11 +122,6 @@ void observability;
 
 var _err = GuardSvgError.factory;
 
-// ---- Codepoint catalog (shared via lib/codepoint-class) ----
-
-var C0_CTRL_RE_G  = codepointClass.C0_CTRL_RE_G;
-var ZW_RE_G       = codepointClass.ZW_RE_G;
-
 // ---- Tag classification ----
 
 // Always-dangerous SVG tags. Active scripts, namespace-shift escape
@@ -314,32 +309,20 @@ var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256
 // ---- Internal helpers ----
 
 
-// HTML5 named-entity ASCII subset — same shape as guard-html.
-// Browsers honor these inside URL contexts; without decoding them,
-// `java	script:` and friends bypass the scheme allowlist.
-var SVG_NAMED_ENTITY_ASCII = {
-  Tab: "\t", NewLine: "\n",
-  colon: ":", semi: ";", period: ".", sol: "/", bsol: "\\",
-  num: "#", excl: "!", quest: "?", lpar: "(", rpar: ")",
-  lsqb: "[", rsqb: "]", lcub: "{", rcub: "}",
-  quot: "\"", apos: "'", lt: "<", gt: ">",
-  amp: "&", commat: "@", dollar: "$", percnt: "%",
-  ast: "*", plus: "+", lowbar: "_", hyphen: "-",
-  nbsp: " ",
-};
+// The named-entity ASCII table + entity decoder live in codepoint-class
+// (NAMED_ENTITY_ASCII / decodeMarkupEntities), shared with guard-html /
+// guard-markdown so all three decode the SAME browser-honored set and cannot
+// drift on which encoding a scheme / CSS-token danger check must fold away.
 
 function _extractScheme(rawUrl) {
-  var s = String(rawUrl || "").trim();
-  // Numeric entities (hex/decimal, semicolon OPTIONAL) via the shared decoder
-  // so guard-html / guard-svg / guard-markdown can't drift (see codepoint-class).
-  s = codepointClass.decodeNumericEntities(s);
-  s = s.replace(/&([A-Za-z][A-Za-z0-9]+);/g, function (m, name) {
-    if (Object.prototype.hasOwnProperty.call(SVG_NAMED_ENTITY_ASCII, name)) {
-      return SVG_NAMED_ENTITY_ASCII[name];
-    }
-    return m;
-  });
-  s = s.replace(C0_CTRL_RE_G, "").replace(ZW_RE_G, "");
+  // Decode entities, then fold away exactly the whitespace the WHATWG URL parser
+  // would (tab/lf/cr anywhere + a leading/trailing C0-control-or-space run) via
+  // the shared codepoint-class primitive, so an entity-hidden tab or leading
+  // space (`java&Tab;script:` / `&#32;javascript:`) can't push the scheme past
+  // the `^[A-Za-z]` anchor and read as scheme-less. Shared with guard-html so
+  // the two can't drift on which whitespace to strip.
+  var s = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(String(rawUrl || "").trim()));
   var m = s.match(/^([A-Za-z][A-Za-z0-9+.-]*):/);
   return m ? m[1].toLowerCase() : "";
 }
@@ -355,8 +338,19 @@ function _isFragmentRef(rawUrl) {
 }
 
 function _isCssDangerous(value) {
+  // A style attribute is HTML/XML character-reference-decoded before the CSS
+  // parser sees it, so `ex&#x70;ression(` reaches CSS as `expression(` and
+  // `behavior&colon;` as `behavior:`. Match against the decoded value — the
+  // same normalization the URL-scheme check performs — so an entity-encoded
+  // CSS payload can't be served verbatim past the danger patterns.
+  // Also fold the URL-scheme whitespace a browser strips inside url(...) -- tab /
+  // lf / cr -- so an entity-hidden tab in a CSS URL scheme (url(java&Tab;script:))
+  // cannot defeat the contiguous `javascript:` danger pattern, the same bypass the
+  // URL-scheme check folds away for href.
+  var decoded = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(value));
   for (var i = 0; i < CSS_DANGEROUS_PATTERNS.length; i += 1) {
-    if (CSS_DANGEROUS_PATTERNS[i].test(value)) return true;
+    if (CSS_DANGEROUS_PATTERNS[i].test(decoded)) return true;
   }
   return false;
 }
@@ -782,7 +776,12 @@ function _sanitize(input, opts) {
     }
     var allowed = !dangerousTags[tok.name] && allowedTags[tok.name];
     if (animationTags[tok.name] && opts.allowAnimation && allowedTags[tok.name]) {
-      // Animation element — re-check attributeName.
+      // Animation element under a profile that permits animation: allowed iff
+      // its attributeName is in the safe-targets allowlist. Every animation tag
+      // is in DANGEROUS_TAGS, so `allowed` is already false above — this branch
+      // must AFFIRMATIVELY re-permit the safe case, else the open tag is dropped
+      // while its (still-allowlisted) end tag is emitted, leaving an orphan
+      // close and silently stripping a profile-permitted element.
       var safeAnimation = true;
       (tok.attrs || []).forEach(function (a) {
         if (a.name.toLowerCase() === "attributename" &&
@@ -790,7 +789,7 @@ function _sanitize(input, opts) {
           safeAnimation = false;
         }
       });
-      if (!safeAnimation) allowed = false;
+      allowed = safeAnimation;
     }
     if (!allowed) {
       if (BODY_DROP[tok.name] && !tok.selfClosing) {

package/lib/vendor/blamejs/lib/guard-time.js

@@ -319,7 +319,7 @@ function _detectIssues(input, opts) {
  *
  *   var bad = b.guardTime.validate("1969-12-31T23:59:59Z", { profile: "strict" });
  *   bad.ok;                                            // → false
- *   bad.issues[0].ruleId;                              // → "time.year-out-of-range"
+ *   bad.issues[0].ruleId;                              // → "time.year-window"
  */
 // validate is assembled by gateContract.defineGuard from `detect`
 // (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(

package/lib/vendor/blamejs/lib/guard-uuid.js

@@ -277,7 +277,7 @@ function _detectIssues(input, opts) {
  *   var bad = b.guardUuid.validate("00000000-0000-0000-0000-000000000000",
  *                                  { profile: "strict" });
  *   bad.ok;                                            // → false
- *   bad.issues[0].ruleId;                              // → "uuid.nil"
+ *   bad.issues[0].ruleId;                              // → "uuid.nil-uuid"
  */
 // validate is assembled by gateContract.defineGuard from `detect`
 // (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
@@ -311,7 +311,7 @@ function _detectIssues(input, opts) {
  *     b.guardUuid.sanitize("ffffffff-ffff-ffff-ffff-ffffffffffff",
  *                          { profile: "strict" });
  *   } catch (e) {
- *     e.code;                                          // → "uuid.max"
+ *     e.code;                                          // → "uuid.max-uuid"
  *   }
  */
 // _sanitizeTransform — the guard-specific normalize applied by defineGuard's

package/lib/vendor/blamejs/lib/html-balance.js

@@ -184,7 +184,7 @@ function check(html) {
       // Self-closing: `<foo />` or `<foo/>` or HTML5 void elements.
       var selfClose = html.charCodeAt(j - 1) === 0x2F /* / */;
       if (isClose) {
-        if (VOID_TAGS[tag]) {
+        if (Object.prototype.hasOwnProperty.call(VOID_TAGS, tag)) {
           // Stray closer for a void tag — surface as error.
           var pcv = _posToLineColumn(html, i);
           return {
@@ -221,7 +221,7 @@ function check(html) {
         stack.pop();
       } else {
         // Open tag (or self-closing).
-        if (selfClose || VOID_TAGS[tag]) {
+        if (selfClose || Object.prototype.hasOwnProperty.call(VOID_TAGS, tag)) {
           // No push.
         } else if (Object.prototype.hasOwnProperty.call(RAW_TEXT_TAGS, tag)) {
           // Skip raw-text content AND its closing tag entirely. Inside
@@ -326,7 +326,7 @@ var markupTokenizer = require("./markup-tokenizer");
  *
  * @example
  *   var rv = b.htmlBalance.checkSafe("<div onclick=\"x()\">hi</div>", { profile: "strict" });
- *   // → { balanceIssue: null, guardIssues: [{ kind: "event-handler-attribute", ... }], ok: false }
+ *   // → { balanceIssue: null, guardIssues: [{ kind: "event-handler", ... }], ok: false }
  *
  *   b.htmlBalance.checkSafe("<p>hello</p>", { profile: "strict" });
  *   // → { balanceIssue: null, guardIssues: [], ok: true }

package/lib/vendor/blamejs/lib/http-client-cache.js

@@ -130,6 +130,23 @@ function _ccPresent(directives, name) {
   return directives && Object.prototype.hasOwnProperty.call(directives, name);
 }
 
+// RFC 9111 §3.5 — does this request carry an `Authorization` header field
+// (RFC 9110 §11.6.2) with a non-empty value? A shared cache must treat the
+// response to such a request as per-principal unless the origin opts in via
+// public / s-maxage / must-revalidate. Proxy-Authorization is deliberately
+// NOT included — §3.5 names the Authorization header specifically.
+function _hasAuthorization(requestHeaders) {
+  if (!requestHeaders || typeof requestHeaders !== "object") return false;
+  var keys = Object.keys(requestHeaders);
+  for (var i = 0; i < keys.length; i++) {
+    if (keys[i].toLowerCase() === "authorization") {
+      var v = requestHeaders[keys[i]];
+      return v !== undefined && v !== null && String(v) !== "";
+    }
+  }
+  return false;
+}
+
 // ---- HTTP date parsing -----------------------------------------------
 
 function _parseHttpDate(s) {
@@ -236,7 +253,7 @@ function _extractVaryValues(varyHeader, requestHeaders) {
 //
 // freshnessMs is computed from the response — 0 means "store but
 // always revalidate" (no-cache), -1 means "never cacheable".
-function _evaluateStorage(method, statusCode, responseHeaders, sharedCache) {
+function _evaluateStorage(method, statusCode, responseHeaders, sharedCache, requestHeaders) {
   var lcResp = _lcHeaders(responseHeaders);
   var ccRaw = _headerOne(lcResp, "cache-control");
   var directives = _parseCacheControl(ccRaw);
@@ -262,6 +279,21 @@ function _evaluateStorage(method, statusCode, responseHeaders, sharedCache) {
     return { cacheable: false, reason: "private", freshnessMs: -1, directives: directives, varyHeader: varyHeader };
   }
 
+  // RFC 9111 §3.5 — a shared cache MUST NOT reuse a stored response to a
+  // request carrying `Authorization` to satisfy a subsequent request unless
+  // the response explicitly permits it via `public`, `s-maxage`, or
+  // `must-revalidate`. Gate at store time: a per-user authenticated response
+  // that lacks the opt-in never lands in a fleet-shared cache where a
+  // different principal's request would be served it (cross-user data leak).
+  if (sharedCache && _hasAuthorization(requestHeaders)) {
+    var authShareable = _ccPresent(directives, "public") ||
+                        _ccPresent(directives, "must-revalidate") ||
+                        _ccNumber(directives, "s-maxage") !== null;
+    if (!authShareable) {
+      return { cacheable: false, reason: "authorization-shared", freshnessMs: -1, directives: directives, varyHeader: varyHeader };
+    }
+  }
+
   // Vary: * is uncacheable per RFC 9110 §12.5.5.
   if (typeof varyHeader === "string" && varyHeader.indexOf("*") !== -1) {
     var trimmed = varyHeader.split(",").map(function (s) { return s.trim(); });                  // RFC 9110 §12.5.5 Vary field-names; token grammar only, so a bare split is correct
@@ -653,6 +685,12 @@ function create(opts) {
       directives:    evaluation.directives,
       etag:          _headerOne(lcResp, "etag"),
       lastModified:  _headerOne(lcResp, "last-modified"),
+      // RFC 9111 §3.5 — remember whether the request that produced this entry
+      // carried Authorization, so a later 304 refresh can re-apply the shared-
+      // cache gate (a 304 can replace Cache-Control, dropping the public /
+      // s-maxage / must-revalidate opt-in that first permitted an authed
+      // response into a shared cache).
+      hadAuthorization: _hasAuthorization(requestHeaders),
     };
   }
 
@@ -698,6 +736,24 @@ function create(opts) {
   // index lives in the store under (method, url, varyValues) so we
   // need both a "what Vary names apply" marker and the real entry.
   function _lookupWithVary(method, url, requestHeaders) {
+    var result = _resolveEntryWithVary(method, url, requestHeaders);
+    // RFC 9111 §3.5 fail-closed for legacy persistent-store records: an entry
+    // written by a version before `hadAuthorization` was recorded carries no
+    // such flag. In a shared cache it could be a pre-upgrade AUTHENTICATED
+    // response, and every serve path (fresh HIT, stale-serve, revalidation)
+    // resolves through here — so evict it and report a miss rather than serve
+    // one principal's cached body to another. Entries written by this version
+    // carry the flag (true or false) and are unaffected; private caches are
+    // out of §3.5 scope.
+    if (sharedCache && result && result.entry &&
+        !result.entry.__varyMarker && result.entry.hadAuthorization === undefined) {
+      try { store.delete(result.key); } catch (_e) { /* drop-silent */ }
+      return null;
+    }
+    return result;
+  }
+
+  function _resolveEntryWithVary(method, url, requestHeaders) {
     var noVary = _lookup(method, url, requestHeaders);
     if (noVary) {
       // Distinguish marker from real entry via __varyMarker flag.
@@ -775,7 +831,20 @@ function create(opts) {
   // storedAt to "now" so age math restarts.
   function _refreshFrom304(stored, fresh304Headers) {
     var mergedHeaders = _merge304Headers(stored, fresh304Headers);
-    var evaluation = _evaluateStorage(stored.method, stored.statusCode, mergedHeaders, sharedCache);
+    // Re-apply the RFC 9111 §3.5 shared-cache Authorization gate against the
+    // MERGED headers, carrying forward whether the original request was
+    // Authorization-bearing. A 304 can replace Cache-Control (e.g. an entry
+    // first stored under `must-revalidate` now returns plain `max-age=60`);
+    // without the request's auth context here the refreshed entry would be
+    // retained as a freely-shareable response and served to other principals.
+    // Fail CLOSED when the flag is ABSENT (not just false): an entry written by
+    // a persistent shared store (Redis / filesystem) before this field existed
+    // carries no `hadAuthorization`, and assuming such a legacy entry was
+    // unauthenticated would let an originally-authenticated response survive
+    // the upgrade as shareable. Only an explicit `hadAuthorization === false`
+    // skips the gate.
+    var reqHeadersForGate = stored.hadAuthorization === false ? {} : { authorization: "1" };
+    var evaluation = _evaluateStorage(stored.method, stored.statusCode, mergedHeaders, sharedCache, reqHeadersForGate);
     var lcMerged = _lcHeaders(mergedHeaders);
     var dateMs = _parseHttpDate(_headerOne(lcMerged, "date"));
     var ageSec = parseInt(_headerOne(lcMerged, "age") || "0", 10);
@@ -792,6 +861,15 @@ function create(opts) {
     });
     var hasVary = refreshed.varyHeader && refreshed.varyValues && refreshed.varyValues.length > 0;
     var key = _buildCacheKey(refreshed.method, refreshed.url, hasVary ? refreshed.varyValues : []);
+    if (!evaluation.cacheable) {
+      // The merged 304 response no longer satisfies the storage policy (e.g. an
+      // Authorization-bearing entry lost its §3.5 opt-in). Evict rather than
+      // retain a now-unshareable entry — the current, freshly-revalidated
+      // caller still receives the merged body via the returned value; only its
+      // retention for a DIFFERENT principal is refused.
+      try { store.delete(key); } catch (_e) { /* drop-silent */ }
+      return refreshed;
+    }
     try { store.set(key, refreshed); } catch (_e) { /* drop-silent */ }
     return refreshed;
   }
@@ -851,8 +929,8 @@ function create(opts) {
       return _lookupWithVary(method, url, requestHeaders);
     },
 
-    _evaluateStorage: function (method, statusCode, responseHeaders) {
-      return _evaluateStorage(method, statusCode, responseHeaders, sharedCache);
+    _evaluateStorage: function (method, statusCode, responseHeaders, requestHeaders) {
+      return _evaluateStorage(method, statusCode, responseHeaders, sharedCache, requestHeaders);
     },
 
     _evaluateStored: _evaluateStored,

package/lib/vendor/blamejs/lib/http-client-cookie-jar.js

@@ -185,6 +185,16 @@ function create(opts) {
       throw _err("BAD_OPT",
         "cookieJar.create: opts.file must be an absolute path, got " + JSON.stringify(filePath));
     }
+    // A vault is optional for file mode (it seals the on-disk bytes); when
+    // supplied it MUST be a real sealer, validated up front like the
+    // persist:"vault" path. Otherwise a malformed vault is not caught until a
+    // later debounced flush -- and on a first run (the persist file absent) the
+    // jar returns empty before any seal call could surface it, so writes would
+    // be silently dropped.
+    if (vault) {
+      validateOpts.requireMethods(vault, ["seal", "unseal"],
+        "cookieJar.create: persist: 'file' opts.vault (pass b.vault to seal the on-disk bytes)", CookieJarError, "BAD_OPT");
+    }
   }
   if (opts.flushDebounceMs !== undefined && !numericBounds.isNonNegativeFiniteInt(opts.flushDebounceMs)) {
     throw _err("BAD_OPT", "cookieJar.create: flushDebounceMs must be a non-negative finite integer; got " +
@@ -492,7 +502,12 @@ function create(opts) {
         maxBytes: C.BYTES.mib(16), encoding: "utf8", refuseSymlink: true, inodeCheck: true,
       });
     } catch (e) {
-      if (e && e.code === "ENOENT") { raw = null; }   // first run — no persist file yet
+      // First run — no persist file yet. A missing file surfaces as a raw
+      // ENOENT, or (when fdSafeReadSync's default errorFor maps it) as the
+      // typed "atomic-file/enoent" code; both mean "start empty", not "load
+      // failed". Any other kind (symlink / too-large / toctou) is a real
+      // load failure and falls through to LOAD_FAILED.
+      if (e && (e.code === "ENOENT" || e.code === "atomic-file/enoent")) { raw = null; }
       else {
         throw _err("LOAD_FAILED",
           "cookieJar.create: failed to load persist file '" + filePath + "': " +