@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/metrics.js

@@ -211,6 +211,48 @@ function _validateLabelValue(value) {
   return coerced;
 }
 
+// Redact every value of a free-form label map through the credential
+// scrubber. Exemplar labels (trace_id / span_id, or any operator-supplied
+// pair passed to histogram.observe) are rendered verbatim into the
+// OpenMetrics exposition — the SAME scrape surface regular labels reach — so
+// they get the same scrub. Redacting at STORE time mirrors how _resolveLabels
+// scrubs regular labels before they land in entry.labels, keeping
+// _renderFamilyLines a verbatim renderer for every exposition path that shares
+// it (CWE-532).
+function _redactLabelMap(labelObj) {
+  var out = {};
+  if (!labelObj || typeof labelObj !== "object") return out;
+  var keys = Object.keys(labelObj);
+  for (var i = 0; i < keys.length; i++) {
+    var k = keys[i];
+    // Exemplar label NAMES are rendered verbatim into the OpenMetrics
+    // exposition by _renderLabels — and a label name (unlike a value) cannot
+    // be quoted or escaped in the Prometheus wire format. Regular label keys
+    // are gated (LABEL_NAME_RE at registration + _resolveLabels' undeclared
+    // refusal), but the exemplar path had no such gate, so a key carrying a
+    // newline / quote / brace forged a metric line into every scrape (CWE-93,
+    // the exemplar-KEY sibling of the already-fixed exemplar-VALUE injection).
+    // Drop any key that isn't a valid Prometheus label name; the length bound
+    // keeps a hostile multi-megabyte key from turning the regex test into a
+    // DoS, exactly as _validateLabelName caps the config-time path.
+    if (k.length > MAX_METRIC_NAME_LEN || !LABEL_NAME_RE.test(k)) continue;
+    out[k] = _validateLabelValue(labelObj[k]);
+  }
+  return out;
+}
+
+// Coerce an exemplar's value / timestamp to a finite number. Per OpenMetrics
+// 1.0 §6.2 both are numeric, but _renderFamilyLines appends them to the
+// exposition line RAW (unlike labels, which _escapeLabelValue quotes). A
+// non-numeric operator-supplied field — `exemplar.value = "1\n# forged 9"` —
+// would otherwise inject a forged metric line into every scrape. Reject any
+// non-finite value to the caller-supplied fallback so only a bare number ever
+// reaches the wire.
+function _numericExemplarField(value, fallback) {
+  var n = typeof value === "number" ? value : Number(value);
+  return isFinite(n) ? n : fallback;
+}
+
 // Serialize a labels object to a canonical Map key. Routed through
 // canonical-json so the framework has one canonical-sort source of
 // truth for sorted-keys serialization (avoiding the silent-data-loss
@@ -256,6 +298,88 @@ function _sortedLabelKeys(labelObj) {
   return keys;
 }
 
+// Shared metric-family encoder for the Prometheus / OpenMetrics text
+// formats. The live registry's exposition(), the shadow registry's
+// prometheus render, and snapshot.render's labeled-registry path all
+// route through here, so there is exactly one encoder for labeled /
+// bucketed sample lines.
+//
+//   family: { name, type, help, unit, buckets, entries }
+//     counter / gauge entries: [{ labels, value }]
+//     histogram entries:       [{ labels, counts, sum, count, exemplars }]
+function _renderFamilyLines(family, openMetrics, lines) {
+  // OpenMetrics §5.1.2 — counter sample lines MUST suffix with
+  // `_total`. The metadata `# HELP / # TYPE / # UNIT` lines MUST
+  // name the SAME family identifier the samples use, otherwise
+  // strict OpenMetrics parsers reject the family. Derive the
+  // exposition name once so metadata and sample lines agree.
+  var exposedName = family.name;
+  if (openMetrics && family.type === "counter" && !/_total$/.test(family.name)) {                    // allow:regex-no-length-cap — name-suffix check
+    exposedName = family.name + "_total";
+  }
+  if (family.help) lines.push("# HELP " + exposedName + " " + family.help);
+  lines.push("# TYPE " + exposedName + " " + family.type);
+  if (openMetrics && family.unit) lines.push("# UNIT " + exposedName + " " + family.unit);
+  var entries = family.entries;
+  if (family.type === "histogram") {
+    for (var k = 0; k < entries.length; k++) {
+      var entry = entries[k];
+      for (var bi = 0; bi < family.buckets.length; bi++) {
+        var bLabels = Object.assign(Object.create(null), entry.labels, { le: String(family.buckets[bi]) });
+        var bucketLine = family.name + "_bucket" + _renderLabels(bLabels) + " " + entry.counts[bi];
+        // OpenMetrics 1.0 §6.2 — exemplar trace + span IDs appended
+        // as `# {trace_id="...",span_id="..."} <value> <timestamp>`.
+        if (openMetrics && entry.exemplars && entry.exemplars[bi]) {
+          var ex = entry.exemplars[bi];
+          bucketLine += " # " + _renderLabels(ex.labels || {}) + " " + ex.value;
+          // Present-vs-missing on the coerced timestamp is `is a number`, not
+          // truthiness: _numericExemplarField stores a finite number or null,
+          // and the Unix epoch is a valid timestamp of 0 — a truthiness guard
+          // would silently drop it.
+          if (typeof ex.timestamp === "number") bucketLine += " " + ex.timestamp;
+        }
+        lines.push(bucketLine);
+      }
+      var infLabels = Object.assign(Object.create(null), entry.labels, { le: "+Inf" });
+      lines.push(family.name + "_bucket" + _renderLabels(infLabels) + " " + entry.counts[family.buckets.length]);
+      lines.push(family.name + "_sum"   + _renderLabels(entry.labels) + " " + entry.sum);
+      lines.push(family.name + "_count" + _renderLabels(entry.labels) + " " + entry.count);
+    }
+  } else {
+    // exposedName only diverges from family.name for OpenMetrics
+    // counters (the `_total` suffix rule above), so using it
+    // unconditionally keeps Prometheus output byte-identical.
+    for (var v = 0; v < entries.length; v++) {
+      lines.push(exposedName + _renderLabels(entries[v].labels) + " " + entries[v].value);
+    }
+  }
+}
+
+// Flatten one family into `{ key → value }` sample pairs (key = sample
+// name + rendered labels). The text-format snapshot renderer consumes
+// these as synthetic field rows; _renderFamilyLines renders the same
+// samples as wire-format lines (plus metadata + exemplars, which have
+// no key/value representation).
+function _familySamples(family) {
+  var out = Object.create(null);
+  for (var i = 0; i < family.entries.length; i++) {
+    var entry = family.entries[i];
+    if (family.type === "histogram") {
+      for (var bi = 0; bi < family.buckets.length; bi++) {
+        var bLabels = Object.assign(Object.create(null), entry.labels, { le: String(family.buckets[bi]) });
+        out[family.name + "_bucket" + _renderLabels(bLabels)] = entry.counts[bi];
+      }
+      var infLabels = Object.assign(Object.create(null), entry.labels, { le: "+Inf" });
+      out[family.name + "_bucket" + _renderLabels(infLabels)] = entry.counts[family.buckets.length];
+      out[family.name + "_sum" + _renderLabels(entry.labels)] = entry.sum;
+      out[family.name + "_count" + _renderLabels(entry.labels)] = entry.count;
+    } else {
+      out[family.name + _renderLabels(entry.labels)] = entry.value;
+    }
+  }
+  return out;
+}
+
 // Combine default + per-call labels, validating against the metric's
 // declared labelNames. Throws if a label name isn't declared.
 function _resolveLabels(defaultLabels, declaredNames, callLabels) {
@@ -566,9 +690,9 @@ function create(opts) {
             // arg; the registry only records what's passed in.
             if (exemplar && typeof exemplar === "object") {
               entry.exemplars[i] = {
-                labels:    exemplar.labels    || {},
-                value:     exemplar.value !== undefined ? exemplar.value : arg.value,
-                timestamp: exemplar.timestamp || null,
+                labels:    _redactLabelMap(exemplar.labels),
+                value:     _numericExemplarField(exemplar.value, arg.value),
+                timestamp: _numericExemplarField(exemplar.timestamp, null),
               };
             }
           }
@@ -596,53 +720,17 @@ function create(opts) {
     var sortedNames = Array.from(metrics.keys()).sort();
     for (var i = 0; i < sortedNames.length; i++) {
       var m = metrics.get(sortedNames[i]);
-      // OpenMetrics §5.1.2 — counter sample lines MUST suffix with
-      // `_total`. The metadata `# HELP / # TYPE / # UNIT` lines MUST
-      // name the SAME family identifier the samples use, otherwise
-      // strict OpenMetrics parsers reject the family. Derive the
-      // exposition name once at the top of the loop so both the
-      // metadata lines and the sample lines agree.
-      var exposedName = m.name;
-      if (openMetrics && m.type === "counter" && !/_total$/.test(m.name)) {
-        exposedName = m.name + "_total";
-      }
-      if (m.help) lines.push("# HELP " + exposedName + " " + m.help);
-      lines.push("# TYPE " + exposedName + " " + m.type);
-      if (openMetrics && m.unit) lines.push("# UNIT " + exposedName + " " + m.unit);
       var keys = Array.from(m.values.keys()).sort();
-      if (m.type === "histogram") {
-        for (var k = 0; k < keys.length; k++) {
-          var entry = m.values.get(keys[k]);
-          for (var bi = 0; bi < m.buckets.length; bi++) {
-            var bLabels = Object.assign({}, entry.labels, { le: String(m.buckets[bi]) });
-            var bucketLine = m.name + "_bucket" + _renderLabels(bLabels) + " " + entry.counts[bi];
-            // OpenMetrics 1.0 §6.2 — exemplar trace + span IDs appended
-            // as `# {trace_id="...",span_id="..."} <value> <timestamp>`.
-            if (openMetrics && entry.exemplars && entry.exemplars[bi]) {
-              var ex = entry.exemplars[bi];
-              bucketLine += " # " + _renderLabels(ex.labels || {}) + " " + ex.value;
-              if (ex.timestamp) bucketLine += " " + ex.timestamp;
-            }
-            lines.push(bucketLine);
-          }
-          var infLabels = Object.assign({}, entry.labels, { le: "+Inf" });
-          lines.push(m.name + "_bucket" + _renderLabels(infLabels) + " " + entry.counts[m.buckets.length]);
-          lines.push(m.name + "_sum"   + _renderLabels(entry.labels) + " " + entry.sum);
-          lines.push(m.name + "_count" + _renderLabels(entry.labels) + " " + entry.count);
-        }
-      } else if (m.type === "counter" && openMetrics) {
-        // exposedName already carries the `_total` suffix when needed
-        // (derived at the top of the loop so metadata + samples agree).
-        for (var v = 0; v < keys.length; v++) {
-          var ent = m.values.get(keys[v]);
-          lines.push(exposedName + _renderLabels(ent.labels) + " " + ent.value);
-        }
-      } else {
-        for (var v2 = 0; v2 < keys.length; v2++) {
-          var ent2 = m.values.get(keys[v2]);
-          lines.push(m.name + _renderLabels(ent2.labels) + " " + ent2.value);
-        }
-      }
+      var entries = [];
+      for (var k = 0; k < keys.length; k++) entries.push(m.values.get(keys[k]));
+      _renderFamilyLines({
+        name:    m.name,
+        type:    m.type,
+        help:    m.help,
+        unit:    m.unit,
+        buckets: m.buckets,
+        entries: entries,
+      }, openMetrics, lines);
       lines.push("");
     }
     if (openMetrics) lines.push("# EOF");
@@ -1157,6 +1245,19 @@ function snapshotRead(p) {
  * queries start returning the right answer once the new types reach
  * the scrape target.
  *
+ * ## Labeled registry series
+ *
+ * A snapshot written with `startWriter`'s `registry` option carries the
+ * registry's counters / gauges / histograms — label sets and histogram
+ * bucket counts — in a structured `metrics` field. Both formats render
+ * them: `prometheus` emits the same labeled / bucketed sample lines the
+ * live `exposition()` endpoint serves, family names verbatim (NOT
+ * `prefix`-qualified) so dashboards see one series name regardless of
+ * scrape source; `text` lists each labeled sample as a
+ * `name{label="value"}` row. A malformed family, metric / label name,
+ * or non-numeric sample in a hand-edited snapshot file is dropped,
+ * never rendered.
+ *
  * @opts
  *   format:      "text" | "prometheus",   // default: "text"
  *   prefix:      string,                   // prometheus-only; default: "blamejs"
@@ -1233,6 +1334,84 @@ function _renderText(fields, snap, opts) {
   return lines.join("\n") + "\n";
 }
 
+// Validate + normalize one serialized registry family from a snapshot's
+// `metrics` field (written by startWriter's `registry` option) into the
+// _renderFamilyLines shape. Snapshot files are read back from disk, so
+// this is a defensive reader: a malformed family, a non-Prometheus
+// metric / label name, or a non-numeric sample is dropped rather than
+// rendered — a hand-edited snapshot file must not be able to forge
+// exposition lines. Returns null when the whole family is unusable.
+function _normalizeSnapshotFamily(name, fam) {
+  if (!fam || typeof fam !== "object" || Array.isArray(fam)) return null;
+  // Same name contracts as the live registry (METRIC_NAME_RE allows the
+  // colon forms _validateMetricName accepts, LABEL_NAME_RE does not) —
+  // a family the live exposition emits must never be dropped here. The
+  // length cap bounds the anchored test on untrusted snapshot-file bytes.
+  if (name.length > 1024 || !METRIC_NAME_RE.test(name)) return null;
+  var type = fam.type;
+  if (type !== "counter" && type !== "gauge" && type !== "histogram") return null;
+  var buckets = null;
+  if (type === "histogram") {
+    if (!Array.isArray(fam.buckets)) return null;
+    buckets = [];
+    for (var bi = 0; bi < fam.buckets.length; bi += 1) {
+      if (typeof fam.buckets[bi] !== "number" || !isFinite(fam.buckets[bi])) return null;
+      buckets.push(fam.buckets[bi]);
+    }
+  }
+  var observations = Array.isArray(fam.observations) ? fam.observations : [];
+  var entries = [];
+  for (var i = 0; i < observations.length; i += 1) {
+    var obs = observations[i];
+    if (!obs || typeof obs !== "object") continue;
+    // null-proto so a label literally named `__proto__` / `constructor`
+    // lands as an own property instead of being swallowed by the
+    // plain-object prototype setter.
+    var labels = Object.create(null);
+    var rawLabels = obs.labels && typeof obs.labels === "object" ? obs.labels : {};
+    var lnames = Object.keys(rawLabels);
+    for (var li = 0; li < lnames.length; li += 1) {
+      if (lnames[li].length > 1024 || !LABEL_NAME_RE.test(lnames[li])) continue;   // drop forged / oversized label names
+      labels[lnames[li]] = String(rawLabels[lnames[li]]);
+    }
+    if (type === "histogram") {
+      if (!Array.isArray(obs.counts) || obs.counts.length !== buckets.length + 1) continue;
+      var countsOk = true;
+      for (var ci = 0; ci < obs.counts.length; ci += 1) {
+        if (typeof obs.counts[ci] !== "number" || !isFinite(obs.counts[ci])) { countsOk = false; break; }
+      }
+      if (!countsOk) continue;
+      if (typeof obs.sum !== "number" || !isFinite(obs.sum)) continue;
+      if (typeof obs.count !== "number" || !isFinite(obs.count)) continue;
+      entries.push({ labels: labels, counts: obs.counts, sum: obs.sum, count: obs.count });
+    } else {
+      if (typeof obs.value !== "number" || !isFinite(obs.value)) continue;   // numeric samples only
+      entries.push({ labels: labels, value: obs.value });
+    }
+  }
+  // Escape HELP text per the exposition format so a forged help string
+  // can't inject metric lines (live registries carry operator-authored
+  // help; snapshot files are untrusted bytes).
+  var help = typeof fam.help === "string"
+    ? fam.help.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/\r/g, "")                       // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus help-text escape shape
+    : "";
+  return { name: name, type: type, help: help, buckets: buckets, entries: entries };
+}
+
+// Walk a snapshot's serialized `metrics` object into validated families,
+// sorted by name for stable exposition output.
+function _normalizeSnapshotFamilies(metricsObj) {
+  if (!metricsObj || typeof metricsObj !== "object" || Array.isArray(metricsObj)) return [];
+  var families = [];
+  // allow:bare-canonicalize-walk — stable exposition output ordering
+  var names = Object.keys(metricsObj).sort();
+  for (var i = 0; i < names.length; i += 1) {
+    var family = _normalizeSnapshotFamily(names[i], metricsObj[names[i]]);
+    if (family) families.push(family);
+  }
+  return families;
+}
+
 function snapshotRender(snap, opts) {
   opts = opts || {};
   var format = opts.format || "text";
@@ -1241,8 +1420,25 @@ function snapshotRender(snap, opts) {
       "metrics.snapshot.render: snap must be a startWriter-produced object (got " + typeof snap + ")");
   }
   var fields = snap.fields;
+  // Labeled registry families (issue #430) — a snapshot written with
+  // startWriter's `registry` option carries every registered counter /
+  // gauge / histogram under `metrics`. Both formats render them so a
+  // sidecar consuming a snapshot written by another process gets the
+  // full labeled series, not just the flat numeric fields.
+  var families = _normalizeSnapshotFamilies(snap.metrics);
   if (format === "text") {
-    return _renderText(fields, snap, opts);
+    var textFields = fields;
+    if (families.length > 0) {
+      // Labeled series become synthetic `name{label="value"}` rows; an
+      // operator-supplied flat field wins on a (pathological) name
+      // collision.
+      var synth = Object.create(null);
+      for (var tf = 0; tf < families.length; tf += 1) {
+        Object.assign(synth, _familySamples(families[tf]));
+      }
+      textFields = Object.assign(synth, fields);
+    }
+    return _renderText(textFields, snap, opts);
   }
   if (format === "prometheus") {
     var prefix = opts.prefix || "blamejs";
@@ -1299,6 +1495,14 @@ function snapshotRender(snap, opts) {
       out.push("# TYPE " + emName + " gauge");
       out.push(emName + " " + ms);
     }
+    // Registry families render through the same encoder the live
+    // exposition() endpoint uses, names verbatim (NOT prefix-qualified),
+    // so a scraper switching between the live /metrics route and the
+    // snapshot sidecar sees identical series names.
+    for (var fj = 0; fj < families.length; fj += 1) {
+      if (out.length > 0) out.push("");   // blank-line family separator, mirrors exposition()
+      _renderFamilyLines(families[fj], false, out);
+    }
     return out.join("\n") + "\n";
   }
   throw new MetricsError("metrics-snapshot/bad-format",
@@ -1477,30 +1681,31 @@ function shadowRegistry(opts) {
       function _emitLabeled(name, labelMap, kind) {
         var metric = prefix + "_" + name;
         if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(metric)) return;                                        // allow:regex-no-length-cap — Prometheus name-shape; metric length bounded by namespace + name caps
-        out.push("# TYPE " + metric + " " + kind);
+        var entries = [];
         var lks = Object.keys(labelMap);
         for (var li = 0; li < lks.length; li += 1) {
           var lk = lks[li];
-          if (lk === "") { out.push(metric + " " + labelMap[lk]); continue; }
           // Read the structured label set kept alongside the canonical key (see
           // _coerceLabels) rather than re-parsing the key. No serialize-then-
           // split round-trip, so a `,` or `=` in a label value stays inside the
           // value and can never forge extra label pairs; and a label NAMED
           // `constructor` / `prototype` / `__proto__` survives instead of being
           // stripped by a prototype-pollution-hardened parse.
-          var labelObj = labelSets[lk];
-          if (!labelObj || typeof labelObj !== "object") { out.push(metric + " " + labelMap[lk]); continue; }
-          var lnames = Object.keys(labelObj).sort();                                                 // allow:bare-canonicalize-walk — deterministic label ordering in the exposition line
-          var formatted = [];
-          for (var pi = 0; pi < lnames.length; pi += 1) {
-            var lname = lnames[pi];
-            if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(lname)) continue;                                   // allow:regex-no-length-cap — Prometheus label-name shape
-            // Prometheus exposition: escape `\`, `"`, `\n` in label values.
-            var lvalue = String(labelObj[lname]).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n"); // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus value escape shape
-            formatted.push(lname + '="' + lvalue + '"');
+          var labelObj = lk === "" ? null : labelSets[lk];
+          // null-proto so a label literally named `__proto__` /
+          // `constructor` lands as an own property instead of being
+          // swallowed by the plain-object prototype setter.
+          var labels = Object.create(null);
+          if (labelObj && typeof labelObj === "object") {
+            var lnames = Object.keys(labelObj);
+            for (var pi = 0; pi < lnames.length; pi += 1) {
+              if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(lnames[pi])) continue;                            // allow:regex-no-length-cap — Prometheus label-name shape
+              labels[lnames[pi]] = labelObj[lnames[pi]];
+            }
           }
-          out.push(metric + "{" + formatted.join(",") + "} " + labelMap[lk]);
+          entries.push({ labels: labels, value: labelMap[lk] });
         }
+        _renderFamilyLines({ name: metric, type: kind, help: "", entries: entries }, false, out);
       }
       var cn2 = Object.keys(counters);
       for (var ci = 0; ci < cn2.length; ci += 1) {

package/lib/vendor/blamejs/lib/middleware/age-gate.js

@@ -140,7 +140,13 @@ function create(opts) {
     }
 
     var classification;
-    if (age === null || typeof age !== "number") classification = "unknown";
+    // A non-finite age (NaN from parseInt on a malformed birth field or
+    // date math, ±Infinity) is NOT a confirmed adult: typeof NaN === "number"
+    // and `NaN < consentRequired` is false, so without the isFinite guard the
+    // classifier fell through to "above-threshold" and dropped every privacy
+    // default for a user whose age simply failed to compute. Treat it as
+    // "unknown" (privacy headers applied), consistent with a null return.
+    if (age === null || typeof age !== "number" || !isFinite(age)) classification = "unknown";
     else if (consentRequired !== null && age < consentRequired) classification = "below-threshold";
     else classification = "above-threshold";
 

package/lib/vendor/blamejs/lib/middleware/asyncapi-serve.js

@@ -94,7 +94,7 @@ var audit         = lazyRequire(function () { return require("../audit"); });
  * @example
  *   var b = require("@blamejs/core");
  *   var app = b.router.create();
- *   var aapi = b.asyncapi.create({ title: "events", version: "1.0.0" });
+ *   var aapi = b.asyncapi.create({ info: { title: "events", version: "1.0.0" } });
  *   app.use(b.middleware.asyncapiServe({
  *     document:      aapi,
  *     pathJson:      "/asyncapi.json",

package/lib/vendor/blamejs/lib/middleware/body-parser.js

@@ -1651,12 +1651,27 @@ function _resolveStandaloneMultipartOpts(opts, ct) {
       null, { permanent: true, statusCode: HTTP_STATUS.BAD_REQUEST });
     resolved.fileCount = mf;
   }
-  // Pass-through overrides for the multipart-specific knobs the middleware
-  // accepts. parsers.multipart is a thin wrapper, not a feature subset.
-  ["tmpDir", "fileSize", "fieldCount", "fieldSize", "mimeAllowlist",
-   "fileFilter", "fields", "audit"].forEach(function (k) {
+  // Pass through EVERY documented multipart knob the middleware honors —
+  // parsers.multipart is a thin wrapper, not a feature subset. Derive the
+  // passthrough from DEFAULTS.multipart rather than a hand-maintained list so a
+  // knob added to the middleware can never silently vanish on the standalone
+  // path (the drift that dropped `storage` + `filenameCharsets`). Only the keys
+  // the standalone surfaces under a different name (totalSize←maxBytes,
+  // fileCount←maxFiles) or that are dispatch-only (contentTypes — the standalone
+  // requires multipart/form-data) are excluded.
+  var STANDALONE_MULTIPART_EXCLUDE = { totalSize: true, fileCount: true, contentTypes: true };
+  Object.keys(DEFAULTS.multipart).forEach(function (k) {
+    if (STANDALONE_MULTIPART_EXCLUDE[k]) return;
     if (opts[k] !== undefined) resolved[k] = opts[k];
   });
+  // storage is an operator-config enum — reject a typo at the call the same way
+  // b.middleware.bodyParser does (a bad value must not silently fall back to
+  // disk mode and then throw deep in the parser on a read-only FS).
+  if (resolved.storage !== "disk" && resolved.storage !== "memory") {
+    throw new TypeError(
+      "parsers.multipart: storage must be \"disk\" or \"memory\" (got " +
+      JSON.stringify(resolved.storage) + ")");
+  }
   // ct is the parsed Content-Type; required for the boundary parameter.
   if (!ct || typeof ct.type !== "string" || ct.type !== "multipart/form-data") {
     throw new BodyParserError("body-parser/standalone-not-multipart",

package/lib/vendor/blamejs/lib/middleware/bot-guard.js

@@ -52,6 +52,7 @@ var DEFAULT_BLOCKED_AGENTS = [
 
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
+var ssrfGuard = require("../ssrf-guard");
 var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
@@ -185,15 +186,10 @@ function create(opts) {
     if (_proto.resolve(req) === "https") return true;
     var host = (req.headers && req.headers.host) || "";
     host = String(host).toLowerCase().replace(/:\d+$/, "");   // strip :port
-    if (host.charAt(0) === "[") {                              // [::1] IPv6 literal
-      var end = host.indexOf("]");
-      host = end === -1 ? host.slice(1) : host.slice(1, end);
-    }
-    host = host.replace(/\.$/, "");                            // strip trailing root-zone dot (RFC 1034 §3.1) so "localhost." matches
-    if (host === "localhost" || /\.localhost$/.test(host)) return true;
-    if (host === "::1") return true;
-    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)) return true;   // allow:regex-no-length-cap — bounded dotted-quad loopback
-    return false;
+    // Loopback HTTP is a secure context (can't be reached off-box). Compose the
+    // canonical hostname-aware classifier — 127/8, ::1 / [::1], localhost, and
+    // *.localhost (RFC 6761 §6.3) — instead of re-rolling the triad here.
+    return ssrfGuard.isLoopbackHost(host);
   }
 
   function _checkHeuristics(req) {

package/lib/vendor/blamejs/lib/middleware/csp-report.js

@@ -39,6 +39,15 @@ var audit = lazyRequire(function () { return require("../audit"); });
 
 var DEFAULT_MAX_BYTES = C.BYTES.kib(64);
 var SAMPLE_TRUNCATE = 200;
+// A single POST may carry a batch of reports (Reporting API). The byte
+// cap bounds the body, but NOT the number of reports inside it — a
+// 64 KiB body of ~40-byte report objects is ~1600 reports, and each one
+// drives a full audit-chain append (SHA3 hash + seal + DB insert) plus an
+// onReport hook. On an unauthenticated endpoint that is a per-request
+// amplification vector, so the batch length is capped independently. A
+// real browser batch is a handful; 100 is generous headroom. Operators
+// raise or lower it via opts.maxReports.
+var DEFAULT_MAX_REPORTS = 100;
 
 function _truncate(value) {
   if (typeof value !== "string") return value;
@@ -108,16 +117,25 @@ function _normalizeOne(reportLike) {
  * alerting use as `onReport`: a flood of 413s signals a misconfigured
  * `Reporting-Endpoints` URL or a report-bomb. It receives
  * `(req, res, { status, reason })` where `reason` is one of
- * `method-not-allowed` / `payload-too-large` / `invalid-json`. Invoked
- * after the rejection response is written; a throwing hook is swallowed
- * so a broken metrics sink can't crash the endpoint.
+ * `method-not-allowed` / `payload-too-large` / `too-many-reports` /
+ * `invalid-json`. Invoked after the rejection response is written; a
+ * throwing hook is swallowed so a broken metrics sink can't crash the
+ * endpoint.
+ *
+ * A single POST may batch multiple reports; the batch length is capped
+ * at `maxReports` (default 100) independently of the byte cap so an
+ * unauthenticated caller can't force one audit-chain append + `onReport`
+ * hook per entry across a body packed with thousands of tiny reports. A
+ * batch over the cap is refused whole with HTTP 413 + `onReject`
+ * `too-many-reports`.
  *
  * @opts
  *   {
- *     onReport: function(report): void,
- *     onReject: function(req, res, { status, reason }): void,
- *     maxBytes: number,    // default 64 KiB
- *     audit:    boolean,   // default true
+ *     onReport:   function(report): void,
+ *     onReject:   function(req, res, { status, reason }): void,
+ *     maxBytes:   number,    // default 64 KiB
+ *     maxReports: number,    // default 100 — batch length cap
+ *     audit:      boolean,   // default true
  *   }
  *
  * @example
@@ -132,14 +150,17 @@ function _normalizeOne(reportLike) {
  */
 function create(opts) {
   opts = opts || {};
-  validateOpts(opts, ["audit", "onReport", "onReject", "maxBytes"], "middleware.cspReport");
+  validateOpts(opts, ["audit", "onReport", "onReject", "maxBytes", "maxReports"], "middleware.cspReport");
   if (opts.onReject !== undefined && opts.onReject !== null &&
       typeof opts.onReject !== "function") {
     throw new TypeError("middleware.cspReport: opts.onReject must be a function");
   }
   validateOpts.optionalPositiveInt(opts.maxBytes, "middleware.cspReport: maxBytes");
+  validateOpts.optionalPositiveInt(opts.maxReports, "middleware.cspReport: maxReports");
   var maxBytes = (opts.maxBytes === undefined || opts.maxBytes === null)
     ? DEFAULT_MAX_BYTES : opts.maxBytes;
+  var maxReports = (opts.maxReports === undefined || opts.maxReports === null)
+    ? DEFAULT_MAX_REPORTS : opts.maxReports;
   var auditOn  = opts.audit !== false;
   var onReport = (typeof opts.onReport === "function") ? opts.onReport : null;
   var onReject = (typeof opts.onReject === "function") ? opts.onReject : null;
@@ -177,6 +198,17 @@ function create(opts) {
       return;
     }
     var reports = Array.isArray(parsed) ? parsed : [parsed];
+    // Fail closed on a report-bomb: a batch whose length exceeds maxReports
+    // is refused whole (413) rather than driving one audit-chain append +
+    // onReport hook per entry. This bounds the per-request work an
+    // unauthenticated caller can force. A throwing/absent audit or hook is
+    // unaffected — nothing is processed on this path.
+    if (reports.length > maxReports) {
+      res.writeHead(413);                                                         // HTTP 413 status
+      res.end();
+      _emitReject(req, res, 413, "too-many-reports");
+      return;
+    }
     for (var i = 0; i < reports.length; i++) {
       var normalized = _normalizeOne(reports[i]);
       if (!normalized) continue;

package/lib/vendor/blamejs/lib/middleware/csrf-protect.js

@@ -430,16 +430,30 @@ function create(opts) {
     if (["Lax", "Strict", "None"].indexOf(cookieCfg.sameSite) === -1) {
       throw new Error("middleware.csrfProtect: opts.cookie.sameSite must be Lax|Strict|None");
     }
-    // __Host- prefix safety: if operator picks a __Host- name, the
-    // Path/Domain/Secure constraints must be compatible. Path must be "/",
-    // no Domain (we never set one), Secure resolved per-request. Catch
-    // operator-side typos (e.g. __Host-csrf with a custom path) at boot.
-    if (cookieCfg.name && /^__Host-/.test(cookieCfg.name)) {
-      if (cookieCfg.path !== "/") {
-        throw new Error("middleware.csrfProtect: __Host-* cookie name requires path='/'");
-      }
-      if (cookieCfg.secure === false) {
-        throw new Error("middleware.csrfProtect: __Host-* cookie name requires secure (cannot be explicit false)");
+    // Cookie name-prefix safety (RFC 6265bis §4.1.3). csrf-protect builds its
+    // own Set-Cookie header rather than routing through b.cookies.serialize, so
+    // this boot check is the only enforcement point. §5.4 requires user agents
+    // to apply the prefix test case-INSENSITIVELY (the server-side §4.1.3
+    // description reads "case-sensitive", but the UA is what drops the cookie),
+    // so `__host-`/`__SECURE-` get the same browser enforcement as
+    // `__Host-`/`__Secure-` -- case-sensitive matching was itself CVE-2024-5699.
+    // Compare a lowercased copy so a case-variant name can't dodge the invariant
+    // here and then be silently rejected by the browser. Catch typos at boot.
+    //   __Host-*   — Path must be "/", no Domain (we never set one), Secure.
+    //   __Secure-* — Secure.
+    if (cookieCfg.name) {
+      var lowerCookieName = cookieCfg.name.toLowerCase();
+      if (lowerCookieName.indexOf("__host-") === 0) {
+        if (cookieCfg.path !== "/") {
+          throw new Error("middleware.csrfProtect: __Host-* cookie name requires path='/'");
+        }
+        if (cookieCfg.secure === false) {
+          throw new Error("middleware.csrfProtect: __Host-* cookie name requires secure (cannot be explicit false)");
+        }
+      } else if (lowerCookieName.indexOf("__secure-") === 0) {
+        if (cookieCfg.secure === false) {
+          throw new Error("middleware.csrfProtect: __Secure-* cookie name requires secure (cannot be explicit false)");
+        }
       }
     }
   }