@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/safe-mime.test.js

@@ -308,6 +308,490 @@ function testPrototypePollutionDefense() {
   check("proto: header skipped",    tree.headers.get("__proto__") === null);
 }
 
+// ---- Walk / findFirst guard clauses ---------------------------------------
+
+function testWalkAndFindFirstGuards() {
+  var tree = b.safeMime.parse(_msg(["Content-Type: text/plain"], "x"));
+  // walk(null) is a documented no-op (returns undefined, no throw).
+  var r = b.safeMime.walk(null, function () {});
+  check("walk: null tree is a no-op", r === undefined);
+  // Non-function visitor is a caller error → TypeError (config-time throw).
+  var threwW = null;
+  try { b.safeMime.walk(tree, "not-a-function"); } catch (e) { threwW = e; }
+  check("walk: non-function visitor throws TypeError", threwW instanceof TypeError);
+  // findFirst with a non-function predicate → TypeError.
+  var threwF = null;
+  try { b.safeMime.findFirst(tree, 123); } catch (e) { threwF = e; }
+  check("findFirst: non-function predicate throws TypeError", threwF instanceof TypeError);
+}
+
+// ---- extractText outside multipart/alternative ----------------------------
+
+function testExtractTextNonAlternativePaths() {
+  // A bare text/plain leaf (not multipart/alternative) → the findFirst
+  // "preferred" branch.
+  var leafTree = b.safeMime.parse(_msg(["Content-Type: text/plain; charset=utf-8"], "just plain"));
+  var t1 = b.safeMime.extractText(leafTree, { prefer: "plain" });
+  check("extractText: single leaf plain", t1 && t1.body === "just plain" && t1.contentType === "text/plain");
+
+  // multipart/mixed carrying only text/html, prefer=plain → no preferred
+  // match, falls through to the any-text branch.
+  var htmlOnly = [
+    "Content-Type: multipart/mixed; boundary=M", "",
+    "--M", "Content-Type: text/html", "", "<b>hi</b>", "--M--",
+  ].join("\r\n");
+  var t2 = b.safeMime.extractText(b.safeMime.parse(htmlOnly), { prefer: "plain" });
+  check("extractText: falls back to any text/*", t2 && t2.contentType === "text/html" && t2.body.trim() === "<b>hi</b>");
+
+  // multipart/mixed with no text part at all → null.
+  var noText = [
+    "Content-Type: multipart/mixed; boundary=M", "",
+    "--M", "Content-Type: application/octet-stream", "Content-Transfer-Encoding: base64", "", "AAAA", "--M--",
+  ].join("\r\n");
+  var t3 = b.safeMime.extractText(b.safeMime.parse(noText), { prefer: "plain" });
+  check("extractText: no text part returns null", t3 === null);
+}
+
+function testExtractTextAlternativeFallback() {
+  // multipart/alternative but prefer=plain with only a text/html child:
+  // the last-wins loop misses, the fallback loop returns the html.
+  var altHtmlOnly = [
+    "Content-Type: multipart/alternative; boundary=A", "",
+    "--A", "Content-Type: text/html", "", "<i>x</i>", "--A--",
+  ].join("\r\n");
+  var t1 = b.safeMime.extractText(b.safeMime.parse(altHtmlOnly), { prefer: "plain" });
+  check("extractText alt: fallback to text/html", t1 && t1.contentType === "text/html" && t1.body.trim() === "<i>x</i>");
+
+  // multipart/alternative with no text parts → null.
+  var altNoText = [
+    "Content-Type: multipart/alternative; boundary=A", "",
+    "--A", "Content-Type: application/json", "", "{}", "--A--",
+  ].join("\r\n");
+  var t2 = b.safeMime.extractText(b.safeMime.parse(altNoText), { prefer: "plain" });
+  check("extractText alt: no text returns null", t2 === null);
+}
+
+// ---- LF-only line endings (CRLF is not the only wire form) -----------------
+
+function testLfOnlyLineEndings() {
+  // A message with bare-LF separators exercises the LF (not CRLF) branch
+  // of both the header/body split and the header-section skip.
+  var tree = b.safeMime.parse("Subject: y\n\nbody-here");
+  check("LF-only: subject parsed", tree.headers.get("subject") === "y");
+  check("LF-only: body parsed",    tree.leaf.body.toString("utf8") === "body-here");
+}
+
+function testMultipartLfLineEndings() {
+  // LF-only multipart exercises the LF-trim of the byte before each
+  // boundary delimiter (both the interior and the final one).
+  var msg =
+    "Content-Type: multipart/mixed; boundary=B\n\n" +
+    "--B\nContent-Type: text/plain\n\naaa\n" +
+    "--B\nContent-Type: text/plain\n\nbbb\n" +
+    "--B--";
+  var tree = b.safeMime.parse(msg);
+  check("multipart LF: 2 parts", tree.parts.length === 2);
+  check("multipart LF: part 0",  tree.parts[0].leaf.body.toString().trim() === "aaa");
+  check("multipart LF: part 1",  tree.parts[1].leaf.body.toString().trim() === "bbb");
+}
+
+// ---- Structural edge cases in the splitter ---------------------------------
+
+function testNoBlankLineSeparator() {
+  // No blank-line separator at all: the whole buffer is the header
+  // section, the body is empty.
+  var tree = b.safeMime.parse("Subject: only-headers");
+  check("no-sep: subject parsed", tree.headers.get("subject") === "only-headers");
+  check("no-sep: empty body",     tree.leaf.body.length === 0);
+}
+
+function testMultipartUnclosedLastPart() {
+  // No final "--B--" closing delimiter: the last part stays open and is
+  // materialized from its start offset to end-of-buffer.
+  var msg = "Content-Type: multipart/mixed; boundary=B\r\n\r\n--B\r\nContent-Type: text/plain\r\n\r\nonly-part\r\n";
+  var tree = b.safeMime.parse(msg);
+  check("unclosed: one part",     tree.parts.length === 1);
+  check("unclosed: body captured", tree.parts[0].leaf.body.toString().indexOf("only-part") !== -1);
+}
+
+function testMultipartBoundaryNoTrailingNewline() {
+  // A boundary line at end-of-buffer with no terminating newline: the
+  // line-end scan returns -1 and the split stops cleanly.
+  var msg = "Content-Type: multipart/mixed; boundary=B\r\n\r\n--B\r\nContent-Type: text/plain\r\n\r\nx\r\n--B";
+  var tree = b.safeMime.parse(msg);
+  check("no-trailing-nl: at least one part", tree.parts.length >= 1);
+  check("no-trailing-nl: first body captured", tree.parts[0].leaf.body.toString().indexOf("x") !== -1);
+}
+
+function testMultipartBoundaryShapeMidLine() {
+  // A "--B" sequence appearing mid-line (not at a line start) MUST NOT be
+  // treated as a boundary delimiter (RFC 2046 §5.1.1). The preamble junk
+  // is skipped and only the real line-start boundary splits.
+  var msg = "Content-Type: multipart/mixed; boundary=B\r\n\r\n" +
+            "preamble--Bjunk\r\n--B\r\nContent-Type: text/plain\r\n\r\nreal\r\n--B--";
+  var tree = b.safeMime.parse(msg);
+  check("midline-boundary: one real part", tree.parts.length === 1);
+  check("midline-boundary: real body",     tree.parts[0].leaf.body.toString().trim() === "real");
+}
+
+// ---- Cap / refusal branches not yet exercised ------------------------------
+
+function testRefusesOversizeHeaderSection() {
+  expectRefused("refuses header section > maxHeaderBytes",
+    function () { b.safeMime.parse("Subject: hello there\r\nContent-Type: text/plain\r\n\r\nbody", { maxHeaderBytes: 5 }); },
+    "safe-mime/oversize-headers");
+}
+
+function testRefusesOversizeBodyRaw() {
+  var body = new Array(101).join("a"); // 100 raw bytes, 7bit (no decode)
+  expectRefused("refuses raw body > maxBodyBytes",
+    function () { b.safeMime.parse(_msg(["Content-Type: text/plain"], body), { maxBodyBytes: 10 }); },
+    "safe-mime/oversize-body");
+}
+
+function testRefusesTooManyHeaders() {
+  expectRefused("refuses header count > maxHeaderCount (DoS bound)",
+    function () { b.safeMime.parse("A: 1\r\nB: 2\r\nC: 3\r\nContent-Type: text/plain\r\n\r\nbody", { maxHeaderCount: 2 }); },
+    "safe-mime/too-many-headers");
+}
+
+function testRefusesOversizeHeaderLine() {
+  var longVal = new Array(60).join("x"); // 59 chars → line well over 10 bytes
+  expectRefused("refuses header line > maxHeaderLineBytes (RFC 5322 §2.1.1)",
+    function () { b.safeMime.parse("Subject: " + longVal + "\r\n\r\nbody", { maxHeaderLineBytes: 10 }); },
+    "safe-mime/oversize-header-line");
+}
+
+function testRefusesHeaderMissingColon() {
+  // A long (>64 char) header line with no colon: malformed-headers, and
+  // the error's byte-preview is truncated with an ellipsis.
+  var longNoColon = "ThisIsAHeaderLineWithNoColonAtAllAndItIsDefinitelyLongerThanSixtyFourCharacters";
+  var threw = null;
+  try { b.safeMime.parse(longNoColon + "\r\nContent-Type: text/plain\r\n\r\nbody"); }
+  catch (e) { threw = e; }
+  check("missing-colon: refused",             threw && (threw.code || "").indexOf("safe-mime/malformed-headers") !== -1);
+  check("missing-colon: preview truncated",   threw && threw.message.indexOf("...") !== -1);
+}
+
+function testRefusesMalformedBoundaryGrammar() {
+  // A boundary within the length cap but containing a char outside the
+  // RFC 2046 §5.1.1 bchars set ("!") must be refused.
+  expectRefused("refuses boundary violating RFC 2046 bchars grammar",
+    function () { b.safeMime.parse(_msg(["Content-Type: multipart/mixed; boundary=bad!boundary"], "x")); },
+    "safe-mime/malformed-boundary");
+}
+
+// ---- Content-Type quoted parameter value -----------------------------------
+
+function testQuotedContentTypeParams() {
+  var tree = b.safeMime.parse(_msg(["Content-Type: text/plain; charset=\"utf-8\""], "hi"));
+  check("quoted param: charset unquoted", tree.leaf.charset === "utf-8");
+}
+
+// ---- RFC 2047 encoded-word header injection --------------------------------
+
+function testRefusesRfc2047HeaderInjection() {
+  // RFC 2047 §5 — an encoded-word whose decoded bytes carry CR/LF/NUL is a
+  // header-injection attempt (a smuggled Bcc:) and must be refused.
+  var payload = Buffer.from("\r\nBcc: attacker@evil.example").toString("base64");
+  var msg = "Subject: =?utf-8?B?" + payload + "?=\r\nContent-Type: text/plain\r\n\r\nbody";
+  expectRefused("refuses RFC 2047 encoded-word header injection",
+    function () { b.safeMime.parse(msg); },
+    "safe-mime/rfc2047-header-injection");
+}
+
+// ---- Charset decoders: utf-16 family + fall-through ------------------------
+
+function testCharsetDecodingBranches() {
+  function decodedFor(charset, rawBuf) {
+    var tree = b.safeMime.parse(_msg(
+      ["Content-Type: text/plain; charset=" + charset, "Content-Transfer-Encoding: base64"],
+      rawBuf.toString("base64")));
+    return tree.decoded;
+  }
+  var le = Buffer.from("Hi", "utf16le");        // [0x48,0x00,0x69,0x00]
+  var be = Buffer.from(le); be.swap16();        // [0x00,0x48,0x00,0x69] — UTF-16BE
+  check("charset utf-16le",                 decodedFor("utf-16le", le) === "Hi");
+  check("charset utf-16be",                 decodedFor("utf-16be", be) === "Hi");
+  check("charset utf-16 LE BOM",            decodedFor("utf-16", Buffer.concat([Buffer.from([0xff, 0xfe]), le])) === "Hi");
+  check("charset utf-16 BE BOM",            decodedFor("utf-16", Buffer.concat([Buffer.from([0xfe, 0xff]), be])) === "Hi");
+  check("charset utf-16 no BOM (BE default)", decodedFor("utf-16", be) === "Hi");
+  // windows-1252 is allowlisted but has no dedicated decoder branch → the
+  // utf-8 fall-through is used.
+  check("charset windows-1252 fall-through", decodedFor("windows-1252", Buffer.from("hi", "ascii")) === "hi");
+}
+
+// ---- Attachment filename derivation ----------------------------------------
+
+function testRfc2231ExtendedFilename() {
+  // RFC 2231 extended-parameter filename*=<charset>'<lang>'<pct-encoded>.
+  var msg = [
+    "Content-Type: multipart/mixed; boundary=B", "",
+    "--B",
+    "Content-Type: application/octet-stream",
+    "Content-Disposition: attachment; filename*=UTF-8''r%C3%A9port.pdf",
+    "Content-Transfer-Encoding: base64", "",
+    "AAAA",
+    "--B--",
+  ].join("\r\n");
+  var atts = b.safeMime.extractAttachments(b.safeMime.parse(msg));
+  check("rfc2231: filename percent-decoded", atts.length === 1 && atts[0].filename === "réport.pdf");
+}
+
+function testFilenameFromContentTypeName() {
+  // No filename in Content-Disposition → fall back to the Content-Type
+  // name= parameter (quoted form unwrapped).
+  var withName = [
+    "Content-Type: multipart/mixed; boundary=B", "",
+    "--B",
+    "Content-Type: application/octet-stream; name=\"doc.bin\"",
+    "Content-Disposition: attachment",
+    "Content-Transfer-Encoding: base64", "",
+    "AAAA",
+    "--B--",
+  ].join("\r\n");
+  var a1 = b.safeMime.extractAttachments(b.safeMime.parse(withName));
+  check("name-fallback: quoted name used", a1.length === 1 && a1[0].filename === "doc.bin");
+
+  // Neither filename nor name present → null filename.
+  var noName = [
+    "Content-Type: multipart/mixed; boundary=B", "",
+    "--B",
+    "Content-Type: application/octet-stream",
+    "Content-Disposition: attachment",
+    "Content-Transfer-Encoding: base64", "",
+    "AAAA",
+    "--B--",
+  ].join("\r\n");
+  var a2 = b.safeMime.extractAttachments(b.safeMime.parse(noName));
+  check("name-fallback: null when neither present", a2.length === 1 && a2[0].filename === null);
+}
+
+function testRfc2231MalformedFilenameNoThrow() {
+  // A hostile `filename*=<charset>'<lang>'<pct>` whose percent-escape is
+  // malformed (truncated `%`, non-hex digits) or decodes to invalid UTF-8
+  // must NOT crash extractAttachments with a raw URIError — the parser
+  // family's contract is that only typed SafeMimeError escapes, and every
+  // other decodeURIComponent site in the framework guards this. Degrade to
+  // the still-encoded segment (best-effort; downstream filename guards own
+  // the raw form) rather than throwing.
+  function attFor(fnParam) {
+    var msg = [
+      "Content-Type: multipart/mixed; boundary=B", "",
+      "--B",
+      "Content-Type: application/octet-stream",
+      "Content-Disposition: attachment; filename*=" + fnParam,
+      "Content-Transfer-Encoding: base64", "",
+      "AAAA",
+      "--B--",
+    ].join("\r\n");
+    return b.safeMime.extractAttachments(b.safeMime.parse(msg));
+  }
+  // Truncated `%` with no following hex — decodeURIComponent throws URIError.
+  var a1 = attFor("UTF-8''%");
+  check("rfc2231 malformed: truncated % does not crash",
+    a1.length === 1 && a1[0].filename === "%");
+  // `%ZZ` — non-hex escape digits.
+  var a2 = attFor("UTF-8''bad%ZZname.pdf");
+  check("rfc2231 malformed: non-hex % escape does not crash",
+    a2.length === 1 && a2[0].filename === "bad%ZZname.pdf");
+  // `%FF%FE` — well-formed escapes that decode to invalid UTF-8.
+  var a3 = attFor("UTF-8''%FF%FE");
+  check("rfc2231 malformed: invalid-UTF-8 % escape does not crash",
+    a3.length === 1 && a3[0].filename === "%FF%FE");
+  // Regression guard — a valid ext-value still percent-decodes.
+  var a4 = attFor("UTF-8''r%65port.pdf");
+  check("rfc2231 valid: still decodes after guard",
+    a4.length === 1 && a4[0].filename === "report.pdf");
+}
+
+// ---- Transfer-encoding allowlist edges -------------------------------------
+
+function testCustomTransferEncodingAllowlist() {
+  // RFC 3030 BINARYMIME opt-in — "binary" decodes to the raw bytes
+  // (identity) once the operator adds it to the allowlist.
+  var tree = b.safeMime.parse(
+    _msg(["Content-Type: text/plain", "Content-Transfer-Encoding: binary"], "rawbytes"),
+    { transferEncodingAllowlist: ["7bit", "binary"] });
+  check("binary opt-in: identity decode", tree.leaf.body.toString() === "rawbytes");
+
+  // An encoding allowlisted by the operator but with no decoder branch
+  // fails closed at the decoder rather than decoding as something else.
+  expectRefused("allowlisted-but-unimplemented encoding fails closed",
+    function () { b.safeMime.parse(
+      _msg(["Content-Type: text/plain", "Content-Transfer-Encoding: x-uuencode"], "data"),
+      { transferEncodingAllowlist: ["7bit", "x-uuencode"] }); },
+    "safe-mime/unknown-transfer-encoding");
+}
+
+// ---- Charset name normalization aliases ------------------------------------
+
+function testCharsetAliasNormalization() {
+  function decodedFor(charset, rawBuf) {
+    return b.safeMime.parse(_msg(
+      ["Content-Type: text/plain; charset=" + charset, "Content-Transfer-Encoding: base64"],
+      rawBuf.toString("base64"))).decoded;
+  }
+  var ascii = Buffer.from("hey", "ascii");
+  check("charset utf8 alias",      decodedFor("utf8", Buffer.from("hi", "utf8")) === "hi");
+  check("charset ascii alias",     decodedFor("ascii", ascii) === "hey");
+  check("charset latin1 alias",    decodedFor("latin1", ascii) === "hey");
+  check("charset cp1252 alias",    decodedFor("cp1252", ascii) === "hey");
+  check("charset shift-jis alias", decodedFor("shift-jis", ascii) === "hey");
+}
+
+// ---- extractText / extractAttachments option branches ----------------------
+
+function testExtractTextExtraBranches() {
+  var altTree = b.safeMime.parse([
+    "Content-Type: multipart/alternative; boundary=A", "",
+    "--A", "Content-Type: text/plain", "", "P",
+    "--A", "Content-Type: text/html", "", "<p>H</p>",
+    "--A--",
+  ].join("\r\n"));
+  // No opts argument → prefer defaults to "plain".
+  var d = b.safeMime.extractText(altTree);
+  check("extractText: default prefer=plain", d && d.contentType === "text/plain");
+  // prefer=any on multipart/alternative → last-wins picks the last text/*.
+  var anyPick = b.safeMime.extractText(altTree, { prefer: "any" });
+  check("extractText: prefer any picks last text/*", anyPick && anyPick.contentType === "text/html");
+
+  // Non-alternative tree, prefer=html → the html arm of the findFirst.
+  var mixedHtml = b.safeMime.parse([
+    "Content-Type: multipart/mixed; boundary=M", "",
+    "--M", "Content-Type: text/plain", "", "p",
+    "--M", "Content-Type: text/html", "", "<b>h</b>",
+    "--M--",
+  ].join("\r\n"));
+  var h = b.safeMime.extractText(mixedHtml, { prefer: "html" });
+  check("extractText: non-alt prefer html", h && h.contentType === "text/html");
+
+  // multipart/alternative whose FIRST child is itself a multipart (no
+  // leaf): the reverse last-wins loop visits the non-leaf child and skips
+  // it before matching the text/plain sibling.
+  var altNested = b.safeMime.parse([
+    "Content-Type: multipart/alternative; boundary=A", "",
+    "--A", "Content-Type: text/plain", "", "outer",
+    "--A", "Content-Type: multipart/mixed; boundary=N", "",
+    "--N", "Content-Type: text/plain", "", "inner", "--N--",
+    "--A--",
+  ].join("\r\n"));
+  var nested = b.safeMime.extractText(altNested, { prefer: "plain" });
+  check("extractText: skips non-leaf alt child", nested && nested.body.trim() === "outer");
+}
+
+function testExtractAttachmentsInline() {
+  var msg = [
+    "Content-Type: multipart/mixed; boundary=B", "",
+    "--B", "Content-Type: text/plain", "Content-Disposition: inline", "", "inline-body",
+    "--B", "Content-Type: application/pdf", "Content-Disposition: attachment; filename=a.pdf",
+    "Content-Transfer-Encoding: base64", "", "AAAA",
+    "--B--",
+  ].join("\r\n");
+  var tree = b.safeMime.parse(msg);
+  // Default excludes inline parts.
+  var d = b.safeMime.extractAttachments(tree);
+  check("attachments: inline excluded by default", d.length === 1 && d[0].filename === "a.pdf");
+  // includeInline:true pulls inline in alongside the attachment.
+  var w = b.safeMime.extractAttachments(tree, { includeInline: true });
+  check("attachments: includeInline pulls inline too", w.length === 2);
+}
+
+// ---- Header accessor + input-shape branches --------------------------------
+
+function testHeaderGetAllMissing() {
+  var tree = b.safeMime.parse(_msg(["Content-Type: text/plain"], "x"));
+  check("getAll missing header → empty array", tree.headers.getAll("x-absent").length === 0);
+}
+
+function testUint8ArrayInput() {
+  var bytes = new Uint8Array(Buffer.from(_msg(["Content-Type: text/plain"], "u8")));
+  var tree = b.safeMime.parse(bytes);
+  check("Uint8Array input parsed", tree.leaf.body.toString() === "u8");
+}
+
+function testShortMalformedHeaderPreview() {
+  // A short (<64 char) header line with no colon: refused, and the
+  // byte-preview is returned untruncated (no ellipsis).
+  var threw = null;
+  try { b.safeMime.parse("nocolon\r\nContent-Type: text/plain\r\n\r\nbody"); }
+  catch (e) { threw = e; }
+  check("short missing-colon: refused",       threw && (threw.code || "").indexOf("safe-mime/malformed-headers") !== -1);
+  check("short missing-colon: no ellipsis",   threw && threw.message.indexOf("...") === -1);
+}
+
+// ---- Boundary grammar first/last-char rejection ----------------------------
+
+function testBoundaryInvalidFirstLastChar() {
+  // Quoted boundary whose FIRST char is outside bcharsnospace.
+  expectRefused("boundary invalid first char refused",
+    function () { b.safeMime.parse(_msg(["Content-Type: multipart/mixed; boundary=\"!bad\""], "x")); },
+    "safe-mime/malformed-boundary");
+  // Quoted boundary whose LAST char is outside bcharsnospace.
+  expectRefused("boundary invalid last char refused",
+    function () { b.safeMime.parse(_msg(["Content-Type: multipart/mixed; boundary=\"bad!\""], "x")); },
+    "safe-mime/malformed-boundary");
+}
+
+// ---- Content-Type poisoned parameter key -----------------------------------
+
+function testContentTypePoisonedParamSkipped() {
+  var tree = b.safeMime.parse(_msg(["Content-Type: text/plain; __proto__=x; charset=utf-8"], "hi"));
+  check("ct poisoned param skipped", tree.leaf.charset === "utf-8" && ({}).x === undefined);
+}
+
+// ---- Malformed multipart bodies: empty-part slice clamps -------------------
+
+function testMultipartEmptyPartClampsSlice() {
+  // A part opening immediately followed by the FINAL boundary (no body
+  // bytes between) clamps to a well-formed zero-length slice (RFC 2046
+  // §5.1.1 malformed-body handling).
+  var tree = b.safeMime.parse("Content-Type: multipart/mixed; boundary=B\r\n\r\n--B\r\n--B--");
+  check("empty-part clamp: one part",   tree.parts.length === 1);
+  check("empty-part clamp: empty body", tree.parts[0].leaf.body.length === 0);
+}
+
+function testMultipartEmptyInteriorPartClamps() {
+  // A part opening immediately followed by a NON-final boundary clamps the
+  // same way, then a real second part follows.
+  var tree = b.safeMime.parse(
+    "Content-Type: multipart/mixed; boundary=B\r\n\r\n--B\r\n--B\r\nContent-Type: text/plain\r\n\r\nsecond\r\n--B--");
+  check("interior clamp: 2 parts",       tree.parts.length === 2);
+  check("interior clamp: first empty",   tree.parts[0].leaf.body.length === 0);
+  check("interior clamp: second body",   tree.parts[1].leaf.body.toString().trim() === "second");
+}
+
+// ---- extractText on a null/absent tree -------------------------------------
+
+function testExtractTextNullTree() {
+  // extractText is commonly called on the result of a lookup that may be
+  // absent; a falsy tree must return null (not throw). Drives the
+  // `tree &&` short-circuit false arm plus the findFirst(null) → walk(null)
+  // no-op path.
+  check("extractText: null tree returns null",      b.safeMime.extractText(null) === null);
+  check("extractText: undefined tree returns null", b.safeMime.extractText(undefined) === null);
+  check("extractText: null tree prefer=html null",  b.safeMime.extractText(null, { prefer: "html" }) === null);
+}
+
+// ---- RFC 2046 §5.1.1 70-char boundary hard cap -----------------------------
+
+function testBoundaryHardCapIndependentOfMaxBoundary() {
+  // The RFC 2046 §5.1.1 70-char boundary ceiling is enforced by the grammar
+  // validator itself, independent of the tunable `maxBoundary` opt. Raising
+  // maxBoundary above 70 does NOT permit a >70-char boundary: a 71-char
+  // otherwise-valid boundary still refuses as malformed. maxBoundary can
+  // only tighten the cap below 70, never loosen the RFC hard ceiling.
+  var boundary71 = new Array(72).join("a"); // 71 chars, all valid bchars
+  check("boundary71 is 71 chars", boundary71.length === 71);
+  expectRefused("71-char boundary refused even with maxBoundary raised to 200 (RFC 2046 §5.1.1 hard cap)",
+    function () {
+      b.safeMime.parse(
+        _msg(["Content-Type: multipart/mixed; boundary=" + boundary71], "x"),
+        { maxBoundary: 200 });
+    },
+    "safe-mime/malformed-boundary");
+}
+
 async function run() {
   testSurface();
   testSimpleTextParse();
@@ -331,6 +815,40 @@ async function run() {
   testHeaderFolding();
   testMultiOccurrenceHeaders();
   testPrototypePollutionDefense();
+  testWalkAndFindFirstGuards();
+  testExtractTextNonAlternativePaths();
+  testExtractTextAlternativeFallback();
+  testLfOnlyLineEndings();
+  testMultipartLfLineEndings();
+  testNoBlankLineSeparator();
+  testMultipartUnclosedLastPart();
+  testMultipartBoundaryNoTrailingNewline();
+  testMultipartBoundaryShapeMidLine();
+  testRefusesOversizeHeaderSection();
+  testRefusesOversizeBodyRaw();
+  testRefusesTooManyHeaders();
+  testRefusesOversizeHeaderLine();
+  testRefusesHeaderMissingColon();
+  testRefusesMalformedBoundaryGrammar();
+  testQuotedContentTypeParams();
+  testRefusesRfc2047HeaderInjection();
+  testCharsetDecodingBranches();
+  testRfc2231ExtendedFilename();
+  testFilenameFromContentTypeName();
+  testRfc2231MalformedFilenameNoThrow();
+  testCustomTransferEncodingAllowlist();
+  testCharsetAliasNormalization();
+  testExtractTextExtraBranches();
+  testExtractAttachmentsInline();
+  testHeaderGetAllMissing();
+  testUint8ArrayInput();
+  testShortMalformedHeaderPreview();
+  testBoundaryInvalidFirstLastChar();
+  testContentTypePoisonedParamSkipped();
+  testMultipartEmptyPartClampsSlice();
+  testMultipartEmptyInteriorPartClamps();
+  testExtractTextNullTree();
+  testBoundaryHardCapIndependentOfMaxBoundary();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/safe-object.test.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.safeObject — prototype-pollution-safe own-property access.
+ */
+
+var b = require("../..");
+var helpers = require("../helpers");
+var check = helpers.check;
+
+function run() {
+  var so = b.safeObject;
+  check("b.safeObject.ownProp is a function", typeof so.ownProp === "function");
+  check("b.safeObject.ownSet is a function",  typeof so.ownSet === "function");
+
+  // own data property → value
+  check("ownProp: own property returns value", so.ownProp({ a: 1 }, "a") === 1);
+  check("ownProp: own property valued undefined returns undefined",
+    so.ownProp({ a: undefined }, "a") === undefined);
+  check("ownProp: missing own property returns undefined",
+    so.ownProp({ a: 1 }, "b") === undefined);
+
+  // inherited / prototype-chain keys read as ABSENT (the whole point)
+  check("ownProp: inherited toString → undefined", so.ownProp({}, "toString") === undefined);
+  check("ownProp: __proto__ → undefined",          so.ownProp({}, "__proto__") === undefined);
+  check("ownProp: constructor → undefined",        so.ownProp({}, "constructor") === undefined);
+  check("ownProp: valueOf → undefined",            so.ownProp({}, "valueOf") === undefined);
+
+  // an own key SHADOWING an inherited name is returned (it's own)
+  check("ownProp: own key shadowing an inherited name returns the own value",
+    so.ownProp({ toString: 7 }, "toString") === 7);
+
+  // a __proto__ accessor property cannot run on read (getOwnPropertyDescriptor,
+  // not a bracket read)
+  var trap = {};
+  Object.defineProperty(trap, "x", { get: function () { throw new Error("getter ran"); }, configurable: true });
+  var threw = false;
+  try { so.ownProp(trap, "x"); } catch (_e) { threw = true; }
+  check("ownProp: does not invoke an accessor getter on read", threw === false);
+
+  // null / undefined receivers are tolerated
+  check("ownProp: null receiver → undefined",      so.ownProp(null, "a") === undefined);
+  check("ownProp: undefined receiver → undefined", so.ownProp(undefined, "a") === undefined);
+
+  // ownSet writes a plain own data property; never pollutes the prototype
+  var o = {};
+  so.ownSet(o, "__proto__", { polluted: 1 });
+  check("ownSet: __proto__ write does not pollute Object.prototype",
+    ({}).polluted === undefined);
+  check("ownSet: the value lands as an OWN property", so.ownProp(o, "__proto__") &&
+    so.ownProp(o, "__proto__").polluted === 1);
+  so.ownSet(o, "k", 5);
+  check("ownSet: sets a normal own key", o.k === 5);
+
+  console.log("[safe-object] OK");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  try { run(); process.exit(0); } catch (e) { console.error(e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/safe-path.test.js

@@ -129,6 +129,35 @@ function testCrossPlatformBackslashTraversalRefused() {
     typeof ok === "string" && ok.indexOf("c.txt") !== -1);
 }
 
+// confineToBase is the lexical-containment core resolve() layers its
+// user-input strictness on top of. It contains traversal (escape → null)
+// while NOT pre-judging segment content — so a consumer that wants only
+// containment and runs its own, separately-calibrated filename validation
+// (b.staticServe, with a per-file b.guardFilename basename gate) composes it
+// instead of resolve. That layering divergence is why the primitive exists.
+function testConfineToBaseContainsWithoutUserInputStrictness() {
+  var inRoot = b.safePath.confineToBase("/srv/www", "docs/a.html", { platform: "linux" });
+  check("confineToBase resolves an in-base path",
+    typeof inRoot === "string" && inRoot.indexOf("docs/a.html") !== -1);
+  check("confineToBase refuses a `..` escape (→ null)",
+    b.safePath.confineToBase("/srv/www", "../etc/passwd", { platform: "linux" }) === null);
+  // The two entry points diverge on a colon-bearing segment: confineToBase
+  // (pure containment) admits it; resolve() refuses it as a user-input ADS
+  // marker. The consumer decides how to validate segment content separately.
+  var colon = "2026-07-24T12:00:00.log";
+  check("confineToBase admits a colon-bearing segment (no user-input strictness)",
+    typeof b.safePath.confineToBase("/srv/www", colon, { platform: "linux" }) === "string");
+  check("resolve() still refuses the same colon name (user-input strictness)",
+    b.safePath.resolveOrNull("/srv/www", colon, { platform: "linux" }) === null);
+  // Windows-target backslash traversal is contained by the target-platform
+  // resolve, same as resolve()'s core.
+  var BS = String.fromCharCode(92);
+  check("confineToBase refuses a windows-target backslash traversal",
+    b.safePath.confineToBase("/srv/www", "ok" + BS + ".." + BS + ".." + BS + "x", { platform: "windows" }) === null);
+  check("confineToBase bad-input → null (empty base / non-string rel)",
+    b.safePath.confineToBase("", "x") === null && b.safePath.confineToBase("/srv", 5) === null);
+}
+
 function run() {
   testHappyPath();
   testRefusalClasses();
@@ -138,6 +167,7 @@ function run() {
   testErrorClassExported();
   testCrossPlatformContainment();
   testCrossPlatformBackslashTraversalRefused();
+  testConfineToBaseContainsWithoutUserInputStrictness();
 }
 
 if (require.main === module) run();