@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -197,7 +197,7 @@ async function _safeResolveMx(qname, operatorLookup) {
   return entries.map(function (e) { return e.exchange; });
 }
 
-async function _safeReverse(ip) {
+async function _safeReverse(ip, operatorLookup) {
   // PTR query against the reverse-arpa name. IPv4: a.b.c.d.in-addr.arpa
   // (reversed octets); IPv6: nibble-reversed under ip6.arpa.
   var qname = _ipToReverseArpa(ip);
@@ -206,6 +206,30 @@ async function _safeReverse(ip) {
     err.code = "ENOTFOUND";
     throw err;
   }
+  // Operator-supplied resolver: the callback receives the reverse-arpa
+  // qname (the same name a real resolver queries) and returns the
+  // documented flat PTR-name array. Threading it here makes the iprev
+  // forward-confirm path operator-mockable, matching the dnsLookup
+  // contract every other type in this file already honors.
+  if (operatorLookup) {
+    var resp = await operatorLookup(qname, "PTR");
+    if (!Array.isArray(resp) || resp.length === 0) {
+      var perr = new Error("no PTR records for " + ip);
+      perr.code = "ENODATA";
+      throw perr;
+    }
+    var names = [];
+    for (var pi = 0; pi < resp.length; pi += 1) {
+      var nm = String(resp[pi]).replace(/\.$/, "");
+      if (nm.length > 0) names.push(nm);
+    }
+    if (names.length === 0) {
+      var perr2 = new Error("no PTR records for " + ip);
+      perr2.code = "ENODATA";
+      throw perr2;
+    }
+    return names;
+  }
   var r = await _getDefaultResolver().query(qname, "PTR");
   var out = [];
   for (var i = 0; i < r.rrs.length; i += 1) {
@@ -1483,6 +1507,17 @@ async function arcVerify(rfc822, opts) {
       "arc.verify: rfc822 must be a non-empty string");
   }
   opts = opts || {};
+  // RFC 8617 §5.1.1 / RFC 6376 §3.4 — ARC-Message-Signature verification
+  // reuses the DKIM verifier, whose header/body split REQUIRES CRLF CRLF and
+  // whose canonicalization is CRLF-based. _splitHeaders / _parseHeaderLines
+  // here accept bare-LF, so a bare-LF ARC message (proper for its own header
+  // scan) reached the DKIM step and threw an uncaught DkimError out of
+  // arc.verify — a foreign error type breaking the "returns a chain result or
+  // throws only a typed MailAuthError" contract. Normalize bare LF the
+  // operator's tooling introduced to canonical CRLF (a no-op on a proper CRLF
+  // message; identical to the LF→CRLF fold the DKIM body canon already does)
+  // so the AMS DKIM verify sees the same canonical bytes the sealer signed.
+  rfc822 = rfc822.replace(/\r?\n/g, "\r\n");
   var headers = _parseHeaderLines(_splitHeaders(rfc822));
   var hops = [];
   var seenSlot = {};                                                             // {`<instance>:<name>`: true} — duplicate detection
@@ -1814,6 +1849,19 @@ async function _verifyArc(rfc822, hop, allHops, kind, dnsLookup, dkim) {
   var asUnsigned = dkim._stripBTagValue(sigValue);
   canonicalized += _canonRelaxedHeader("ARC-Seal", asUnsigned).replace(/\r\n$/, "");
 
+  // RFC 6376 §3.6.1 / RFC 8617 — the ARC key record's k= (DEFAULT "rsa" when
+  // absent) must match the seal's a= family. Without this, a record
+  // `p=<raw-32-byte-key>` with no k= is an RSA record that would be misread as
+  // Ed25519 and validate an a=ed25519-sha256 seal the record never authorized
+  // (a key-family confusion that marks a forged chain as cryptographically
+  // passing).
+  var asKFamily   = keyTags.k !== undefined ? String(keyTags.k).toLowerCase() : "rsa";
+  var asSigFamily = String(tags.a || "").toLowerCase().split("-")[0];
+  if (asKFamily !== asSigFamily) {
+    return { result: "permerror",
+      errors: [kind + ": key k=" + asKFamily + " does not match seal a=" + tags.a + " (RFC 6376 §3.6.1)"] };
+  }
+
   // Verify the AS signature.
   return _runVerify(canonicalized, tags.b, tags.a, keyTags.p, "as");
 }
@@ -1897,7 +1945,18 @@ function _canonRelaxedHeader(name, value) {
   return dkim.canonHeaderRelaxed(name, value);
 }
 
+// RFC 8410 Ed25519 SubjectPublicKeyInfo header prepended to a raw 32-byte key.
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
 function _pemFromB64KeyMaterial(b64) {
+  // RFC 8463 §3-4 publishes an ed25519 DKIM key as the RAW 32-byte key
+  // (base64'd), which is not valid SPKI DER; wrap it in the ed25519 SPKI header
+  // first. Already-SPKI ed25519 (44 bytes) / RSA SPKI (larger) pass through.
+  var raw = null;
+  try { raw = Buffer.from(b64, "base64"); } catch (_e) { raw = null; }
+  if (raw && raw.length === 32) {
+    b64 = Buffer.concat([ED25519_SPKI_PREFIX, raw]).toString("base64");
+  }
   var pem = "-----BEGIN PUBLIC KEY-----\n";
   for (var i = 0; i < b64.length; i += 64) {                                     // PEM wrap width
     pem += b64.slice(i, i + 64) + "\n";                                          // PEM wrap width
@@ -2158,7 +2217,7 @@ function authResultsEmit(opts) {
       // (`\"`). Pre-v0.8.32 the framework collapsed `"` to `'` which
       // is lossy. Use the spec-correct escape so the receiver can
       // round-trip the original reason.
-      clause += ' reason="' + r.reason.replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"';
+      clause += " reason=" + safeBuffer.quoteString(r.reason);
     }
     // Method-specific properties (ptype.property=value triples per
     // RFC 8601 §2.3). Operators pass them as flat object keys.
@@ -2365,6 +2424,27 @@ async function inboundVerify(opts) {
     throw new MailAuthError("mail-auth/inbound-bad-message",
       "inbound.verify: message must be a non-empty string or Buffer (the full RFC 5322 message)");
   }
+  // RFC 5322 §2.1 — the SMTP wire format is CRLF, but bare-LF input is
+  // accepted defensively (see the pipeline note above; _splitHeaderBlock
+  // already honors it for the From extraction). The DKIM verifier
+  // (RFC 6376 §3.4) canonicalizes over CRLF and its header/body split
+  // REQUIRES CRLF CRLF — a bare-LF message otherwise threw an uncaught
+  // DkimError out of the pipeline, breaking the documented "bare-LF
+  // accepted" contract (and the module-wide invariant that message-derived
+  // faults surface as a verdict, never a throw). Normalize any bare LF the
+  // operator's tooling introduced to canonical CRLF — a no-op on a proper
+  // CRLF message, and identical to the LF→CRLF fold the DKIM body
+  // canonicalizer already performs — so every sub-verifier receives the
+  // same canonical bytes and produces a verdict.
+  message = message.replace(/\r?\n/g, "\r\n");
+  // RFC 5322 §2.1 — a well-formed message terminates its header block with
+  // an empty line. _splitHeaderBlock already treats a message with no such
+  // separator as headers-only (empty body); mirror that here so the DKIM
+  // verifier — whose split REQUIRES CRLF CRLF — sees a separator and
+  // returns a "none" verdict on the same headers-only input instead of
+  // throwing. Same root as the bare-LF case: every message _splitHeaderBlock
+  // accepts must reach a verdict, never an uncaught throw.
+  if (message.indexOf("\r\n\r\n") === -1) message += "\r\n\r\n";
   var mailFrom = (typeof opts.mailFrom === "string" && opts.mailFrom.length > 0) ? opts.mailFrom : null;
   var helo     = (typeof opts.helo === "string" && opts.helo.length > 0) ? opts.helo : null;
 
@@ -2864,13 +2944,22 @@ function dmarcBuildAggregateReport(report, opts) {
 // Authentication-Results header so downstream policies can react.
 //
 // Surface:
-//   await b.mail.iprev.verify(ip)
+//   await b.mail.iprev.verify(ip, opts?)
 //   → { result: "pass"|"fail"|"permerror"|"temperror",
 //       ptr, forward, fcrdns, ip }
 //
-// Returns "permerror" on bad-shape input (not an IP literal); returns
-// "temperror" on ENODATA / ENOTFOUND / lookup failure (the receiver
-// retries on transient DNS faults). Pure-DNS — no operator state.
+// Returns "permerror" on bad-shape input (not an IP literal, or a PTR
+// whose rdata isn't a valid DNS name). A definitive negative answer
+// (no PTR record, or the PTR forward-resolves to a set that omits the
+// connecting IP) is a "fail"; a transient resolver fault (SERVFAIL,
+// timeout, or any non-negative error code) is a "temperror" the
+// receiver retries on. Every path RETURNS a verdict object — the
+// primitive never throws on a message- or DNS-derived fault.
+//
+// DNS defaults to b.network.dns.resolver; an operator `opts.dnsLookup`
+// callback overrides it (same shape as the rest of this file — the PTR
+// query receives the reverse-arpa qname; the forward query the PTR
+// name), so a receiver can unit-test the forward-confirm decision.
 
 // RFC 8601 §3 — PTR result shape. The PTR rdata is an FQDN (1*labels).
 // Reject answers that aren't shaped as a DNS name: non-strings,
@@ -2897,7 +2986,10 @@ function _isValidPtrName(name) {
   return true;
 }
 
-async function iprevVerify(ip) {
+async function iprevVerify(ip, opts) {
+  opts = opts || {};
+  validateOpts(opts, ["dnsLookup"], "mail.iprev.verify");
+  var dnsLookup = opts.dnsLookup;
   if (typeof ip !== "string" || ip.length === 0) {
     return { result: "permerror", ip: ip || null,
              ptr: null, forward: [], fcrdns: false,
@@ -2910,7 +3002,7 @@ async function iprevVerify(ip) {
   }
 
   var ptrs;
-  try { ptrs = await _safeReverse(ip); }
+  try { ptrs = await _safeReverse(ip, dnsLookup); }
   catch (e) {
     var rcode = e && e.code;
     if (rcode === "ENOTFOUND" || rcode === "ENODATA") {
@@ -2942,7 +3034,7 @@ async function iprevVerify(ip) {
   var isV6 = net.isIPv6(ip);
   var forwardAddrs;
   try {
-    forwardAddrs = await _safeResolveA(ptr, isV6 ? 6 : 4);
+    forwardAddrs = await _safeResolveA(ptr, isV6 ? 6 : 4, dnsLookup);
   } catch (e) {
     var fcode = e && e.code;
     if (fcode === "ENOTFOUND" || fcode === "ENODATA") {
@@ -2950,23 +3042,32 @@ async function iprevVerify(ip) {
                ptr: ptr, forward: [], fcrdns: false,
                explanation: "no forward record for PTR " + ptr };
     }
-    if (fcode === "ETIMEOUT" || fcode === "ESERVFAIL") {
-      return { result: "temperror", ip: ip,
-               ptr: ptr, forward: [], fcrdns: false,
-               explanation: "forward lookup transient failure: " + fcode };
-    }
-    // Anything else — propagate as temperror; Node DNS surfaces some
-    // non-RFC error codes via the platform resolver. Permerror only
-    // for definitive negative answers above.
-    throw new MailAuthError("mail-auth/iprev-temperror",
-      "iprev.verify: forward lookup of " + ptr + " threw: " +
-      ((e && e.message) || String(e)));
+    // Every non-negative fault (SERVFAIL, timeout, or any other
+    // platform-resolver code) is transient — RETURN a temperror verdict,
+    // mirroring the reverse-lookup catch above. Throwing here broke the
+    // primitive's contract that every message/DNS-derived fault surfaces
+    // as a verdict object: a caller of the documented API got an
+    // exception on e.g. an EREFUSED forward fault. Only the definitive
+    // negative answers above (no forward record) are a "fail".
+    return { result: "temperror", ip: ip,
+             ptr: ptr, forward: [], fcrdns: false,
+             explanation: "forward lookup of " + ptr + " transient failure: " +
+                          (fcode || (e && e.message) || String(e)) };
   }
   var forward = Array.isArray(forwardAddrs) ? forwardAddrs.slice() : [];
-  var ipLc = ip.toLowerCase();
+  // RFC 8601 §3 forward-confirm match. An IPv6 address has many equivalent
+  // textual forms (compressed `2001:db8::1` vs expanded
+  // `2001:0db8:0:0:0:0:0:1`); the connecting literal and the AAAA rdata
+  // routinely differ. Compare the CANONICAL form (fixed-width hex nibbles)
+  // so an equivalent-but-differently-written IPv6 address still confirms.
+  // IPv4 has a single canonical dotted form, so a lowercased string compare
+  // is exact there.
+  var ipCanon = isV6 ? ipUtils.expandIpv6Hex(ip) : ip.toLowerCase();
   var fcrdns = false;
   for (var i = 0; i < forward.length; i += 1) {
-    if (String(forward[i]).toLowerCase() === ipLc) { fcrdns = true; break; }
+    var fwdStr = String(forward[i]);
+    var fwdCanon = isV6 ? ipUtils.expandIpv6Hex(fwdStr) : fwdStr.toLowerCase();
+    if (ipCanon && fwdCanon && fwdCanon === ipCanon) { fcrdns = true; break; }
   }
   return {
     result:      fcrdns ? "pass" : "fail",

package/lib/vendor/blamejs/lib/mail-bimi.js

@@ -398,7 +398,7 @@ function validateTinyPsSvg(svgBytes) {
 
     if (t.type === "tag") {
       var name = t.name;
-      if (TINY_PS_FORBIDDEN_TAGS[name]) {
+      if (Object.prototype.hasOwnProperty.call(TINY_PS_FORBIDDEN_TAGS, name)) {
         _vio("element-forbidden",
           "<" + name + "> is forbidden in Tiny-PS (script / style / animation / filter / image / foreign-content class)");
       }

package/lib/vendor/blamejs/lib/mail-bounce.js

@@ -183,6 +183,14 @@ function _parseSes(p) {
       throw _err("ses/bad-message-json",
         "SES SNS Message field is not valid JSON: " + (e && e.message));
     }
+    // A syntactically valid Message can still decode to a non-object —
+    // JSON literal null / number / string / boolean / array. Reject it
+    // with a typed error rather than dereferencing null downstream, and
+    // do not echo the decoded value (avoid leaking payload internals).
+    if (!msg || typeof msg !== "object" || Array.isArray(msg)) {
+      throw _err("ses/bad-message-json",
+        "SES SNS Message field must decode to a JSON object");
+    }
   }
   var notificationType = msg.notificationType || msg.eventType;
   if (!notificationType) {

package/lib/vendor/blamejs/lib/mail-crypto-pgp.js

@@ -456,7 +456,12 @@ function sign(opts) {
     hashAlg = HASH_ALG_SHA512;
     var rawPub = _extractEd25519PublicRaw(publicKey);
     publicPacketBody = _ed25519PublicPacketBody(rawPub, creationTime);
-  } else if (keyType === "rsa" || keyType === "rsa-pss") {
+  } else if (keyType === "rsa") {
+    // Only rsaEncryption (keyType "rsa") keys sign here. An id-RSASSA-PSS
+    // key (keyType "rsa-pss") is padding-restricted to PSS by OpenSSL and
+    // cannot express the PKCS#1-v1.5 signature this module emits, so it is
+    // refused with a typed error below rather than crashing on the JWK
+    // export path (which refuses rsa-pss keys).
     pubAlg  = PUB_ALG_RSA;
     hashAlg = HASH_ALG_SHA256;
     var rsaPub = _extractRsaPublicComponents(publicKey);
@@ -811,7 +816,12 @@ function verify(opts) {
     "publicKeyPem could not be parsed: " + ((e && e.message) || String(e))); }
 
   var keyType = publicKey.asymmetricKeyType;
-  if (parsed.pubAlg === PUB_ALG_RSA && !(keyType === "rsa" || keyType === "rsa-pss")) {
+  // Only rsaEncryption (keyType "rsa") keys verify a PKCS#1-v1.5 signature.
+  // An id-RSASSA-PSS key (keyType "rsa-pss") is PSS-padding-restricted and
+  // cannot JWK-export for component extraction; treat it as a key/algorithm
+  // mismatch and return a typed verdict rather than letting the extraction
+  // throw a raw Error out of verify().
+  if (parsed.pubAlg === PUB_ALG_RSA && keyType !== "rsa") {
     return _fail("mail-crypto/pgp/key-alg-mismatch",
       "signature claims RSA but provided key is " + keyType);
   }
@@ -866,7 +876,13 @@ function verify(opts) {
 
   var ok;
   if (parsed.pubAlg === PUB_ALG_RSA) {
-    var rsaMpi = _readMpi(parsed.sigMpisBytes, 0);
+    // A malformed / truncated signature MPI is untrusted input like any
+    // other packet field: return a verdict, don't throw. Every other
+    // bad-signature path here routes through _fail; the raw _readMpi
+    // reads did not, so a truncated MPI escaped as an exception.
+    var rsaMpi;
+    try { rsaMpi = _readMpi(parsed.sigMpisBytes, 0); }
+    catch (mpiErr) { return _fail(mpiErr.code || "mail-crypto/pgp/bad-mpi", mpiErr.message); }
     // The signature is an integer in [0, n); when its value has one or more
     // high zero bytes (~1/256 of signatures) the OpenPGP MPI encoding strips
     // them (RFC 9580 §3.2), but node's RSA verify requires a signature exactly
@@ -889,9 +905,13 @@ function verify(opts) {
     }
   } else {
     // Ed25519Legacy — two MPIs (R, S) reassemble into the 64-byte raw
-    // EdDSA signature.
-    var rMpi = _readMpi(parsed.sigMpisBytes, 0);
-    var sMpi = _readMpi(parsed.sigMpisBytes, rMpi.next);
+    // EdDSA signature. Truncated/malformed MPIs are untrusted input:
+    // return a verdict via _fail rather than throwing out of verify().
+    var rMpi, sMpi;
+    try {
+      rMpi = _readMpi(parsed.sigMpisBytes, 0);
+      sMpi = _readMpi(parsed.sigMpisBytes, rMpi.next);
+    } catch (mpiErrE) { return _fail(mpiErrE.code || "mail-crypto/pgp/bad-mpi", mpiErrE.message); }
     function _padTo32(buf) {
       if (buf.length === 32) return buf;
       if (buf.length > 32) return buf.slice(buf.length - 32);
@@ -1018,6 +1038,18 @@ function experimentalEncrypt(opts) {
   return { armored: armored, envelope: envelope };
 }
 
+// Envelope length fields (recipientId / KEM-ciphertext / wrapped-key /
+// body lengths) are attacker-controlled: every multi-byte read and every
+// slice below must confirm the bytes exist before advancing `off`, or a
+// truncated envelope escapes as a raw RangeError instead of the typed
+// refusal decrypt() promises. Fail closed with mail-crypto/pgp/truncated.
+function _envNeed(buf, off, n) {
+  if (off + n > buf.length) {
+    throw new MailCryptoError("mail-crypto/pgp/truncated",
+      "decrypt: envelope truncated (need " + n + " byte(s) at offset " + off + ")");
+  }
+}
+
 function experimentalDecrypt(opts) {
   opts = validateOpts.requireObject(opts, "mail.crypto.pgp.experimental.decrypt",
     MailCryptoError, "mail-crypto/pgp/bad-opts");
@@ -1054,15 +1086,17 @@ function experimentalDecrypt(opts) {
   var nRecips = envelope[off]; off += 1;
   var matchedSessionKey = null;
   for (var i = 0; i < nRecips; i += 1) {
-    if (off >= envelope.length) {
-      throw new MailCryptoError("mail-crypto/pgp/truncated",
-        "decrypt: envelope truncated at recipient " + i);
-    }
+    _envNeed(envelope, off, 1);
     var ridLen = envelope[off]; off += 1;
+    _envNeed(envelope, off, ridLen);
     var rid = envelope.slice(off, off + ridLen); off += ridLen;
+    _envNeed(envelope, off, 2);
     var ctLen = envelope.readUInt16BE(off); off += 2;                                                 // u16-be width
+    _envNeed(envelope, off, ctLen);
     var ct = envelope.slice(off, off + ctLen); off += ctLen;
+    _envNeed(envelope, off, 2);
     var wkLen = envelope.readUInt16BE(off); off += 2;                                                 // u16-be width
+    _envNeed(envelope, off, wkLen);
     var wrappedKey = envelope.slice(off, off + wkLen); off += wkLen;
     if (matchedSessionKey) continue;
     if (!rid.equals(opts.recipientId)) continue;
@@ -1086,7 +1120,9 @@ function experimentalDecrypt(opts) {
     throw new MailCryptoError("mail-crypto/pgp/no-matching-recipient",
       "decrypt: no recipient in envelope matches opts.recipientId");
   }
+  _envNeed(envelope, off, 4);
   var bodyLen = envelope.readUInt32BE(off); off += 4;                                                 // u32-be width
+  _envNeed(envelope, off, bodyLen);
   var body = envelope.slice(off, off + bodyLen);
   var plaintext;
   try { plaintext = bCrypto.decryptPacked(body, matchedSessionKey); }

package/lib/vendor/blamejs/lib/mail-dav.js

@@ -247,8 +247,19 @@ function create(opts) {
     var segs = path.split("/").filter(function (s) { return s.length > 0; });
     var decoded = [];
     for (var i = 0; i < segs.length; i++) {
-      try { decoded.push(decodeURIComponent(segs[i])); }
+      var seg;
+      try { seg = decodeURIComponent(segs[i]); }
       catch (_e) { return { principalId: null, parts: [], rejected: "malformed-uri" }; }
+      // Validate the DECODED segment. The pre-decode guard above only catches a
+      // literal ".."/"%2e%2e", so a MIXED encoding (".%2e", "%2e.") passes it and
+      // then decodes to "..". Reject any decoded segment that is "." / ".." or
+      // carries a NUL or an embedded path separator — the traversal the storage
+      // backend (getComponent/putComponent/...) would otherwise receive.
+      if (seg === "." || seg === ".." || seg.indexOf("\0") >= 0 ||
+          seg.indexOf("/") >= 0 || seg.indexOf("\\") >= 0) {
+        return { principalId: null, parts: [], rejected: "traversal" };
+      }
+      decoded.push(seg);
     }
     return {
       principalId: decoded[0] || null,
@@ -551,7 +562,11 @@ function create(opts) {
       _emit("mail.dav.handler_threw",
         { method: method, kind: "caldav",
           error: (e && e.message) || String(e) }, "failure");
-      return _refuseStatus(res, 500, "Server error");
+      // A malformed / empty client request BODY (bad PROPFIND/REPORT XML) is a
+      // client fault → 400, mirroring the 400 that MKCALENDAR/MKCOL already return
+      // for the same input; only a genuine server-side throw is 500.
+      var isClientFault = e && /mail-dav\/bad-(propfind|report)-body/.test(e.code || "");
+      return _refuseStatus(res, isClientFault ? 400 : 500, isClientFault ? "Bad request" : "Server error");
     }
   }
 
@@ -889,7 +904,11 @@ function create(opts) {
       _emit("mail.dav.handler_threw",
         { method: method, kind: "carddav",
           error: (e && e.message) || String(e) }, "failure");
-      return _refuseStatus(res, 500, "Server error");
+      // A malformed / empty client request BODY (bad PROPFIND/REPORT XML) is a
+      // client fault → 400, mirroring the 400 that MKCALENDAR/MKCOL already return
+      // for the same input; only a genuine server-side throw is 500.
+      var isClientFault = e && /mail-dav\/bad-(propfind|report)-body/.test(e.code || "");
+      return _refuseStatus(res, isClientFault ? 400 : 500, isClientFault ? "Bad request" : "Server error");
     }
   }
 

package/lib/vendor/blamejs/lib/mail-dkim.js

@@ -134,6 +134,17 @@ function _splitHeadersBody(rfc822) {
   // Headers terminated by the first empty line. Headers may use folded
   // continuation lines (CRLF + WSP); we keep them folded and let the
   // canonicalizer unfold relaxed-mode.
+  //
+  // RFC 5322 §2.1 — the wire format is CRLF, but a message read from a
+  // Unix file/mbox or passed through operator tooling that stripped CRs
+  // arrives bare-LF. Normalize to canonical CRLF before locating the
+  // separator (a no-op on a proper CRLF message, and identical to the
+  // LF->CRLF fold _canonBodySimple already performs) so a valid bare-LF
+  // message verifies instead of failing the separator search. A message
+  // with no empty line at all (no \n either) is genuinely separator-less
+  // and still throws below — normalization converts existing line endings,
+  // it never invents a separator.
+  rfc822 = rfc822.replace(/\r?\n/g, "\r\n");
   var sep = rfc822.indexOf("\r\n\r\n");
   if (sep === -1) {
     throw new DkimError("dkim/missing-body-separator",
@@ -402,18 +413,42 @@ function create(opts) {
         });
       } catch (_e) { /* drop-silent */ }
     }
-    // Append the unsigned DKIM-Signature header without trailing CRLF
-    // per RFC 6376 §3.7.
-    var dkimHeaderForSigning = canonHeader === "simple"
-      ? _canonHeaderSimple("DKIM-Signature", " " + unsignedSigValue)
-      : _canonHeaderRelaxed("DKIM-Signature", unsignedSigValue);
+    // Append the unsigned DKIM-Signature header (b= value emptied) without a
+    // trailing CRLF per RFC 6376 §3.7. Under SIMPLE header canonicalization the
+    // header is signed and verified BYTE-FOR-BYTE as it appears on the wire —
+    // including its folding — so the signer must canonicalize the FOLDED form,
+    // exactly as the verifier does when it strips b= from the parsed (folded)
+    // wire header. (Relaxed unfolds on both sides, so it signs the unfolded
+    // value.) The empty-b header folds identically to the final header up to the
+    // last `b=` line (folding breaks only at "; " tag boundaries and b= is the
+    // last tag), so we can build the wire header by appending the signature to
+    // this folded empty-b header, and the verifier recovers exactly these bytes.
+    var foldedEmptyB = _foldSignatureHeader(unsignedSigValue);
+    var dkimHeaderForSigning;
+    if (canonHeader === "simple") {
+      // Simple canon is verbatim (RFC 6376 §3.4.1): the canonical form of the
+      // DKIM-Signature header (b= emptied) is the folded wire header exactly as
+      // it will appear — which is precisely foldedEmptyB ("DKIM-Signature: " +
+      // the folded, b-emptied value). No re-spacing or re-canonicalization.
+      dkimHeaderForSigning = foldedEmptyB;
+    } else {
+      dkimHeaderForSigning = _canonHeaderRelaxed("DKIM-Signature", unsignedSigValue);
+    }
     canonicalizedHeaders += dkimHeaderForSigning.replace(/\r\n$/, "");
 
     var signature = _signString(canonicalizedHeaders, keyObject, algorithm);
-    // Replace the empty `b=` placeholder with the actual base64 signature.
-    var finalSigValue = sigTags.slice(0, -1).concat(["b=" + signature]).join("; ");
 
-    var dkimHeaderLine = _foldSignatureHeader(finalSigValue) + "\r\n";
+    // Wire header. Under simple canon, append the signature to the SAME folded
+    // empty-b header we signed, so a verifier parsing the folded wire and
+    // stripping b= reconstructs the signed bytes exactly. Under relaxed, re-fold
+    // the completed value (folding is normalized away on verify).
+    var dkimHeaderLine;
+    if (canonHeader === "simple") {
+      dkimHeaderLine = foldedEmptyB + signature + "\r\n";
+    } else {
+      var finalSigValue = sigTags.slice(0, -1).concat(["b=" + signature]).join("; ");
+      dkimHeaderLine = _foldSignatureHeader(finalSigValue) + "\r\n";
+    }
 
     _emit("dkim.sign.success", {
       bodyLength: body.length,
@@ -610,10 +645,21 @@ async function _safeResolveTxt(qname, operatorLookup) {
 
 function _resetDkimKeyCacheForTest() { DKIM_KEY_CACHE.clear(); }
 
+// RFC 8410 Ed25519 SubjectPublicKeyInfo header (algorithm id + BIT STRING
+// wrapper) prepended to a raw 32-byte key to form valid SPKI DER.
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
 function _pemFromB64KeyMaterial(b64) {
-  // RSA: SubjectPublicKeyInfo DER in base64. Ed25519: raw 32-byte key
-  // OR SPKI DER. Wrap in PEM markers so node:crypto.createPublicKey
-  // accepts it.
+  // RSA: SubjectPublicKeyInfo DER in base64. Ed25519: RFC 8463 §3-4 publishes
+  // the RAW 32-byte key (base64'd) — the canonical form every conformant
+  // ed25519 sender uses — which is NOT valid SPKI DER; wrap it in the ed25519
+  // SPKI header first. An already-SPKI ed25519 key (44 bytes) or an RSA SPKI
+  // key (larger) is passed through unchanged.
+  var raw = null;
+  try { raw = Buffer.from(b64, "base64"); } catch (_e) { raw = null; }
+  if (raw && raw.length === 32) {
+    b64 = Buffer.concat([ED25519_SPKI_PREFIX, raw]).toString("base64");
+  }
   var pem = "-----BEGIN PUBLIC KEY-----\n";
   // 64-char wrap (PEM convention).
   for (var i = 0; i < b64.length; i += 64) {                                     // PEM wrap width
@@ -805,13 +851,23 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   // structure instead.
   var unsignedSigValue = _stripBTagValue(sigHeader.value);
   // The signature header is canonicalized under its true field name (§3.7).
-  // For the ARC reuse the header on the wire is ARC-Message-Signature, signed
-  // under that name; the synthetic renames it to DKIM-Signature only so this
-  // verifier finds it, so the canonical form must restore the real name or the
-  // b= value never matches what the relay signed.
-  var sigCanonName = verifyOpts.arcAmsReuse ? "ARC-Message-Signature" : "DKIM-Signature";
+  // Under simple canon the name is verbatim, so it must be the EXACT on-wire
+  // spelling the peer signed (sigHeader.name — _findDkimSignatureHeaders matches
+  // the field name case-insensitively and _parseHeaders preserves its casing),
+  // not a hardcoded "DKIM-Signature"; a peer that emits `dkim-signature:` signs
+  // that lowercase name and would otherwise never verify. (Relaxed canon
+  // lowercases the name, so the on-wire spelling doesn't matter there.) For the
+  // ARC reuse the header on the wire is ARC-Message-Signature, signed under that
+  // name; the synthetic renames it to DKIM-Signature only so this verifier finds
+  // it, so the canonical form must restore the real ARC name.
+  var sigCanonName = verifyOpts.arcAmsReuse ? "ARC-Message-Signature" : sigHeader.name;
+  // Simple canon is verbatim: the parsed sigHeader.value already carries the
+  // single space the wire places after the colon and its folding, so it is
+  // canonicalized as-is (b= emptied) — NOT re-spaced. (A prior `" " +` prefix
+  // here injected a spurious second space, so simple-canon signatures — ours
+  // and any RFC-compliant peer's — never matched what was signed.)
   canonicalizedHeaders += canonHeader === "simple"
-    ? _canonHeaderSimple(sigCanonName, " " + unsignedSigValue).replace(/\r\n$/, "")
+    ? _canonHeaderSimple(sigCanonName, unsignedSigValue).replace(/\r\n$/, "")
     : _canonHeaderRelaxed(sigCanonName, unsignedSigValue).replace(/\r\n$/, "");
 
   // 3. Verify the signature.
@@ -1068,18 +1124,18 @@ async function verify(rfc822, opts) {
         errors: ["DKIM key record missing p="] });
       continue;
     }
-    // RFC 6376 §3.6.1 — k= tag declares the key's algorithm family.
-    // Default is "rsa" when absent. If the key's k= disagrees with the
-    // signature's a= family, the operator who published the key intends
-    // a different algorithm; refuse rather than guess.
-    if (keyTags.k !== undefined) {
-      var kFamily   = String(keyTags.k).toLowerCase();
-      var sigFamily = String(alg || "").toLowerCase().split("-")[0];
-      if (kFamily !== sigFamily) {
-        results.push({ d: d, s: s, alg: alg, result: "permerror",
-          errors: ["DKIM key k=" + kFamily + " does not match signature a=" + alg + " (RFC 6376 §3.6.1)"] });
-        continue;
-      }
+    // RFC 6376 §3.6.1 — k= tag declares the key's algorithm family, DEFAULT
+    // "rsa" when absent. If it disagrees with the signature's a= family the
+    // operator who published the key intends a different algorithm; refuse
+    // rather than guess. The default matters: a record `p=<raw-32-byte-key>`
+    // with no k= is an RSA record, and must NOT be read as an Ed25519 key just
+    // because the bytes are 32 long (a key-family confusion).
+    var kFamily   = keyTags.k !== undefined ? String(keyTags.k).toLowerCase() : "rsa";
+    var sigFamily = String(alg || "").toLowerCase().split("-")[0];
+    if (kFamily !== sigFamily) {
+      results.push({ d: d, s: s, alg: alg, result: "permerror",
+        errors: ["DKIM key k=" + kFamily + " does not match signature a=" + alg + " (RFC 6376 §3.6.1)"] });
+      continue;
     }
     var rv = _verifySingleSignature(rfc822, parsedHeaders, sigHeaders[i], keyTags, sigTags, verifyOpts);
     results.push(Object.assign({ d: d, s: s, alg: alg }, rv));
@@ -1265,7 +1321,17 @@ function _bootstrapSingle(algorithm, domain, selector, rsaBits) {
   }
   var publicKeyPemObj = nodeCrypto.createPublicKey({ key: keyPair.publicKey, type: "spki", format: "der" });
   var publicKeyPem    = publicKeyPemObj.export({ type: "spki", format: "pem" });
-  var pBase64         = Buffer.from(keyPair.publicKey).toString("base64");
+  // RFC 8463 §3-4: an ed25519 DKIM key MUST be published as the RAW 32-byte key
+  // (base64'd), not SPKI DER — the SPKI form (60 base64 chars) does not verify
+  // at a conformant receiver. The raw key is the trailing 32 bytes of the SPKI
+  // encoding. RSA keeps the SPKI DER form (RFC 6376).
+  var pBase64;
+  if (k === "ed25519") {
+    var spkiDer = Buffer.from(keyPair.publicKey);
+    pBase64 = spkiDer.subarray(spkiDer.length - 32).toString("base64");
+  } else {
+    pBase64 = Buffer.from(keyPair.publicKey).toString("base64");
+  }
   var dnsName         = selector + "._domainkey." + domain;
   // RFC 6376 §3.6.1 record syntax: v=DKIM1; k=<alg>; p=<base64>
   // The optional t/s/g/n/h/k tags omitted (operator can re-edit

package/lib/vendor/blamejs/lib/mail-helo.js

@@ -280,7 +280,12 @@ async function evaluate(ctx, opts) {
 
   // Not an address-literal; must be a domain.
   var lower = claimed.toLowerCase();
-  if (LOCALHOST_REFUSED[lower]) {
+  // Own-property membership test — a bare `LOCALHOST_REFUSED[lower]`
+  // walks the prototype chain, so a claim that collides with an
+  // Object.prototype key (`constructor`, `__proto__`, ...) reads the
+  // inherited value as truthy and gets mislabelled a reserved-name
+  // claim. Match the table strictly against its own keys.
+  if (Object.prototype.hasOwnProperty.call(LOCALHOST_REFUSED, lower)) {
     return _emit(auditImpl, "reject-shape", {
       shape:  "invalid",
       reason: "localhost-class claim '" + lower + "' refused (RFC 6761 §6.3 reserved name)",