@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/pubsub.js

@@ -102,19 +102,30 @@ function _matchGlobPart(part, channel, fromIdx) {
       if (channel.substr(pos, lit.length) !== lit) return -1;
       pos += lit.length;
     } else if (i === segments.length - 1) {
-      // Trailing literal: search forward in this segment (no '.' jump).
+      // Trailing literal after the final '*'. The '*' gap between the
+      // previous literal and this one matches non-'.' chars only, so the
+      // literal must START at or before the next '.' boundary — but the
+      // literal itself MAY contain '.' (it is matched verbatim, e.g. the
+      // '.created' tail in 'orders.*.created'). Greedy: pick the
+      // rightmost dot-free-reachable start.
       var hardStop = channel.indexOf(".", pos);
-      var searchEnd = hardStop === -1 ? channel.length : hardStop;
-      if (lit === "") { pos = searchEnd; break; }
-      var found = channel.lastIndexOf(lit, searchEnd - lit.length);
-      if (found < pos) return -1;
-      pos = found + lit.length;
+      var maxStart = hardStop === -1 ? channel.length : hardStop;
+      if (lit === "") { pos = maxStart; break; }
+      var placed = -1;
+      for (var s = maxStart; s >= pos; s--) {
+        if (channel.substr(s, lit.length) === lit) { placed = s; break; }
+      }
+      if (placed < 0) return -1;
+      pos = placed + lit.length;
     } else {
-      // Middle literal: find next occurrence within current segment.
+      // Middle literal after a '*'. The '*' gap must be dot-free, so the
+      // literal must START at or before the next '.'; the literal itself
+      // MAY contain '.'. Leftmost occurrence keeps the preceding '*'
+      // minimal.
       var hardStop2 = channel.indexOf(".", pos);
-      var searchEnd2 = hardStop2 === -1 ? channel.length : hardStop2;
+      var maxStart2 = hardStop2 === -1 ? channel.length : hardStop2;
       var f2 = channel.indexOf(lit, pos);
-      if (f2 < 0 || f2 + lit.length > searchEnd2) return -1;
+      if (f2 < 0 || f2 > maxStart2) return -1;
       pos = f2 + lit.length;
     }
   }

package/lib/vendor/blamejs/lib/queue-local.js

@@ -467,7 +467,8 @@ function create(config) {
     // dispatches both calls to the same backend.
     var rowBuilt = _select()
       .columns(["_id", "queueName", "payload", "repeatCron", "repeatTimezone",
-                "flowId", "flowChildName", "priority", "classification", "traceId"])
+                "flowId", "flowChildName", "priority", "classification", "traceId",
+                "maxAttempts"])
       .where("_id", jobId)
       .toSql();
     var rowRes = await store.execute(rowBuilt.sql, rowBuilt.params);
@@ -503,6 +504,11 @@ function create(config) {
         var unsealedRow = cryptoField.unsealRow(SEAL_TABLE, row);
         var cron = scheduler.parseCron(unsealedRow.repeatCron);
         var nextMs = scheduler.nextCronFire(cron, new Date(nowMs), unsealedRow.repeatTimezone || null);
+        // Carry the operator's maxAttempts forward: the next occurrence must
+        // keep the same retry budget the operator configured, not silently
+        // reset to the enqueue default. A non-positive / non-finite value
+        // falls back to undefined so enqueue applies its own default.
+        var repeatMax = Number(unsealedRow.maxAttempts);
         await enqueue(unsealedRow.queueName,
           unsealedRow.payload ? safeJson.parse(unsealedRow.payload, { maxBytes: C.BYTES.mib(64) }) : null,
           {
@@ -514,6 +520,7 @@ function create(config) {
             availableAt:     nextMs,
             repeat:          { cron: unsealedRow.repeatCron, timezone: unsealedRow.repeatTimezone },
             priority:        Number(unsealedRow.priority) || 0,
+            maxAttempts:     (isFinite(repeatMax) && repeatMax > 0) ? repeatMax : undefined,
             classification:  unsealedRow.classification || null,
             traceId:         unsealedRow.traceId || null,
           });

package/lib/vendor/blamejs/lib/queue-redis.js

@@ -532,12 +532,17 @@ function create(opts) {
         var cron = scheduler.parseCron(unsealed.repeatCron);
         var nextMs = scheduler.nextCronFire(
           cron, new Date(nowMs), unsealed.repeatTimezone || null);
+        // Carry the operator's maxAttempts forward so the next occurrence keeps
+        // the configured retry budget instead of silently resetting to the
+        // enqueue default (mirrors queue-local's cron-repeat).
+        var repeatMax = Number(unsealed.maxAttempts);
         await enqueue(unsealed.queueName,
           unsealed.payload ? safeJson.parse(unsealed.payload) : null,
           {
             availableAt:     nextMs,
             repeat:          { cron: unsealed.repeatCron, timezone: unsealed.repeatTimezone },
             priority:        Number(unsealed.priority) || 0,
+            maxAttempts:     (isFinite(repeatMax) && repeatMax > 0) ? repeatMax : undefined,
             classification:  unsealed.classification || null,
             traceId:         unsealed.traceId || null,
           });

package/lib/vendor/blamejs/lib/redact.js

@@ -1055,8 +1055,62 @@ function installForPosture(posture, primitives) {
   });
 }
 
+var TEXT_REDACT_MARKER = "[redacted]";
+
+/**
+ * @primitive b.redact.redactText
+ * @signature b.redact.redactText(str)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.redact.redact
+ *
+ * Scrub credentials EMBEDDED in a free-text string in place, keeping the
+ * surrounding prose — for log messages and other operator-facing text where a
+ * secret may be interpolated mid-sentence. Unlike `redact` (structured,
+ * whole-value, anchored), this uses word-boundary fragment replacement so
+ * "login failed: <jwt> for bob" keeps everything but the jwt. Detects PEM
+ * blocks, JWTs, AWS access keys, URL-userinfo passwords, bearer tokens,
+ * `key=secret` assignments, SSN/EIN, and Luhn-valid PANs. The high-entropy
+ * api-key-shape detector is deliberately excluded (on free text it eats
+ * ordinary IDs / hashes / base64). Drop-safe: never throws (it runs on the
+ * hot-path log-emit sink); on any error it returns a fully-masked marker rather
+ * than the raw input. Every quantifier is length-capped (ReDoS backstop).
+ *
+ * @example
+ *   b.redact.redactText("token=AKIAIOSFODNN7EXAMPLE ok");  // → "token=[redacted] ok"
+ */
+function redactText(str) {
+  if (typeof str !== "string" || str.length === 0) return str;
+  try {
+    return str
+      // PEM / OpenSSH private-key blocks (multi-line).
+      .replace(/-----BEGIN [A-Z0-9 ]{1,40}-----[\s\S]{0,8192}?-----END [A-Z0-9 ]{1,40}-----/g, TEXT_REDACT_MARKER)
+      // JWT — three base64url segments, word-boundary anchored for embedding.
+      .replace(/\beyJ[A-Za-z0-9_-]{1,4096}\.[A-Za-z0-9_-]{1,8192}\.[A-Za-z0-9_-]{1,4096}\b/g, TEXT_REDACT_MARKER)
+      // AWS access-key IDs.
+      .replace(/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[A-Z0-9]{16}\b/g, TEXT_REDACT_MARKER)
+      // Credentials in a URL userinfo: scheme://user:secret@host.
+      .replace(/([a-z][a-z0-9+.-]{0,32}:\/\/[^\s:@/]{1,256}:)[^\s@/]{1,256}(@)/gi, "$1" + TEXT_REDACT_MARKER + "$2")
+      // Bearer tokens.
+      .replace(/\b([Bb]earer\s{1,4})[A-Za-z0-9._~+/-]{8,4096}=*/g, "$1" + TEXT_REDACT_MARKER)
+      // key=secret / password: secret style assignments.
+      .replace(/\b((?:api[_-]?key|access[_-]?token|secret|password|passwd|pwd|token)\s{0,4}[=:]\s{0,4})[^\s&;"']{6,4096}/gi, "$1" + TEXT_REDACT_MARKER)
+      // SSN / EIN.
+      .replace(/\b\d{3}-\d{2}-\d{4}\b/g, TEXT_REDACT_MARKER)
+      .replace(/\b\d{2}-\d{7}\b/g, TEXT_REDACT_MARKER)
+      // Credit-card / PAN — Luhn-validated so ordinary long digit runs survive.
+      .replace(/\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{1,7}\b/g, function (m) {
+        var inner = m.replace(/[\s-]/g, "");
+        return (inner.length >= 13 && inner.length <= 19 && _luhnCheck(inner)) ? TEXT_REDACT_MARKER : m;
+      });
+  } catch (_e) {
+    return TEXT_REDACT_MARKER;
+  }
+}
+
 module.exports = {
   redact:                redact,
+  redactText:            redactText,
   registerFieldRule:     registerFieldRule,
   registerValueDetector: registerValueDetector,
   classifyDefaults:      classifyDefaults,

package/lib/vendor/blamejs/lib/restore-bundle.js

@@ -50,6 +50,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
+var safePath = require("./safe-path");
 var C = require("./constants");
 var backupCrypto = require("./backup/crypto");
 var backupManifest = require("./backup/manifest");
@@ -226,7 +227,11 @@ async function extract(opts) {
         continue;
       }
 
-      var blobPath = nodePath.join(bundleDir, entry.encryptedPath);
+      // Resolve the manifest-declared encrypted-blob path THROUGH the base with
+      // safePath -- a tampered manifest could otherwise carry a traversal /
+      // absolute / drive-letter / NTFS-ADS encryptedPath and read a file outside
+      // the bundle. manifest.validate is a first-line check; this is the sink.
+      var blobPath = safePath.resolve(bundleDir, entry.encryptedPath);
       // Cap the read to the manifest's declared encryptedSize so an oversize-on-
       // disk blob is refused BEFORE it is read into memory (was: read fully, then
       // compare → an OOM window for a huge swapped blob). A valid blob is exactly
@@ -282,7 +287,10 @@ async function extract(opts) {
           " — bundle is corrupted or manifest tampered");
       }
 
-      var destPath = nodePath.join(stagingDir, entry.relativePath);
+      // Resolve the restore destination THROUGH the staging base with safePath
+      // so a tampered relativePath (traversal / absolute / drive-letter / ADS)
+      // cannot escape stagingDir when the decrypted file is written.
+      var destPath = safePath.resolve(stagingDir, entry.relativePath);
       atomicFile.ensureDir(nodePath.dirname(destPath));
       atomicFile.writeSync(destPath, plaintext, { fileMode: 0o600 });
 

package/lib/vendor/blamejs/lib/restore.js

@@ -310,6 +310,25 @@ function create(opts) {
         "extract failed: " + ((e && e.message) || String(e)));
     }
 
+    // Defense-in-depth: never swap a zero-file extract over a populated
+    // dataDir. A zero-file staging dir moved over the live dataDir is a
+    // silent full wipe. The manifest validator now refuses an empty
+    // manifest (the attacker path), but an opts.filter that matched no
+    // entry also yields fileCount 0 — an operator mistake that must not
+    // destroy live data with a success report. If the dataDir is already
+    // empty a zero-file swap is a harmless no-op, so gate on non-empty.
+    var dataDirEntries = [];
+    try { dataDirEntries = nodeFs.readdirSync(dataDir); } catch (_e) { dataDirEntries = []; }
+    if (extracted.fileCount === 0 && dataDirEntries.length > 0) {
+      _cleanupTmp();
+      _emitAudit("restore.failure",
+        { bundleId: bundleId, reason: "refusing zero-file restore over a non-empty dataDir" },
+        "failure");
+      throw new RestoreError("restore/empty-extract-refused",
+        "refusing to swap a zero-file restore over the non-empty dataDir '" + dataDir +
+        "' (a filter matched no manifest entry, or the manifest is empty) — this would wipe live data");
+    }
+
     // 3. Atomic swap. On swap failure, the stagingDir is preserved so
     // an operator can recover manually — we do NOT delete it here.
     var swapResult;

package/lib/vendor/blamejs/lib/retention.js

@@ -492,7 +492,7 @@ function create(opts) {
           // tables), the central registry is authoritative. Honors
           // the same skip semantics as the per-row field.
           if (rule.subjectField && row[rule.subjectField]) {
-            var holdsRegistry = legalHold._getSingleton();
+            var holdsRegistry = legalHold()._getSingleton();
             if (holdsRegistry && holdsRegistry.isHeld(row[rule.subjectField])) {
               summary.legalHoldsHonored++;
               _emit("retention.row.legal_hold_skipped",
@@ -623,7 +623,7 @@ var COMPLIANCE_RETENTION_FLOOR_MS = Object.freeze({
  * matched). Throws on an unknown posture so config-time typos surface.
  *
  * @example
- *   var ttl = b.retention.complianceFloor("hipaa", b.C.TIME.days(180));
+ *   var ttl = b.retention.complianceFloor("hipaa", b.constants.TIME.days(180));
  *   // → 189216000000 (HIPAA's 6-year floor wins over the 180-day candidate)
  *
  *   var sox = b.retention.complianceFloor("sox", 0);
@@ -641,7 +641,12 @@ function complianceFloor(posture, candidateTtlMs) {
       "complianceFloor: posture must be a string (pass one, or set the active " +
       "posture via applyPosture / b.compliance.set), got " + JSON.stringify(posture));
   }
-  var floor = COMPLIANCE_RETENTION_FLOOR_MS[posture];
+  // Own-key lookup only: `posture` is operator-supplied, so a value colliding
+  // with an Object.prototype member ("valueOf" / "toString" / "constructor" /
+  // "hasOwnProperty" / ...) must be treated as unknown and throw below — not
+  // resolve to the inherited prototype function and be returned as a "floor".
+  var floor = Object.prototype.hasOwnProperty.call(COMPLIANCE_RETENTION_FLOOR_MS, posture)
+    ? COMPLIANCE_RETENTION_FLOOR_MS[posture] : undefined;
   if (floor === undefined) {
     throw new RetentionError("retention/unknown-posture",
       "complianceFloor: unknown posture '" + posture + "'; expected one of " +
@@ -691,7 +696,10 @@ function applyPosture(posture) {
     STATE.activeFloorMs = null;
     return null;
   }
-  var floor = COMPLIANCE_RETENTION_FLOOR_MS[posture];
+  // Own-key lookup only — a proto-member posture name must not inherit a
+  // prototype function as the floor (see complianceFloor above).
+  var floor = Object.prototype.hasOwnProperty.call(COMPLIANCE_RETENTION_FLOOR_MS, posture)
+    ? COMPLIANCE_RETENTION_FLOOR_MS[posture] : undefined;
   STATE.activePosture = posture;
   STATE.activeFloorMs = (typeof floor === "number") ? floor : null;
   return { posture: posture, floorMs: STATE.activeFloorMs };

package/lib/vendor/blamejs/lib/router.js

@@ -298,6 +298,18 @@ function compilePattern(pattern) {
 // object on match, null otherwise. Single non-empty trailing slash
 // difference is treated as a no-match (callers that want trailing-slash
 // tolerance normalize the path before dispatch).
+// Collapse a leading run of slashes in a request target to a single "/" so a
+// `//host/path` network-path reference becomes a plain path. Shared by handle()
+// (routing + the value written back onto req.url) and _check0RttReplay (the
+// early-data replay key) so both derive from ONE canonical target: otherwise
+// `//x`, `///x`, and `/x` route to the same endpoint but would each mint a
+// distinct replay-cache key, letting an attacker replay Early-Data by varying
+// the leading-slash run.
+function _canonicalRequestTarget(url) {
+  var t = String(url == null ? "/" : url);
+  return t.charAt(0) === "/" && t.charAt(1) === "/" ? t.replace(/^\/+/, "/") : t;
+}
+
 function _matchCompiled(compiled, pathname) {
   var pathSegments = pathname.split("/");
   var patSegments = compiled.segments;
@@ -747,11 +759,50 @@ class Router {
   }
 
   async handle(req, res) {
-    // Compose an absolute URL from the request's path + Host header so
-    // safeUrl.parse can validate the protocol + length. The "http://"
-    // base is the relative-resolution origin; the request's actual
-    // scheme lives in requestHelpers.requestProtocol elsewhere.
-    var absolute = "http://" + (req.headers.host || "localhost") + (req.url || "/");
+    // Derive the request path + query from req.url ALONE, resolved against a
+    // FIXED internal authority — the Host header must NEVER influence which
+    // route is dispatched. Host is client-controlled: a value like
+    // "trusted/admin" bleeds its path segment into WHATWG-URL's pathname
+    // parsing (a leading "/admin" prepended), so a request whose request-line
+    // is "/x" would route as "/admin/x" while req.url stays "/x". That
+    // desyncs req.pathname (the value the route matcher AND every path-scoped
+    // guard compare against) from req.url, and a front proxy that ACLs on the
+    // visible request path is bypassed — the proxy sees "/x", the origin
+    // dispatches "/admin/x". Parsing req.url against a constant base keeps
+    // req.pathname a pure function of the request target. The request's real
+    // scheme + host live on req.headers.host / requestHelpers.requestProtocol
+    // for the consumers (canonical-URL, CORS, host-allowlist) that need them.
+    var reqTarget = req.url || "/";
+    // Only an origin-form request target — beginning with "/" (RFC 9112
+    // §3.2.1) — is routable by a path router. Reject an absolute-form
+    // (`http://host/path`), authority-form (`host:port`), or asterisk-form
+    // (`OPTIONS *`) target with 400 rather than coercing it into a routable
+    // path by prefixing: prefixing would turn `http://evil/admin` into
+    // `/http://evil/admin`, which a `/:x` or catch-all route would still match
+    // — the opposite of failing closed. A "/"-leading target (including one
+    // with a redundant leading slash like `//x`, a valid absolute-path with an
+    // empty first segment) is safe: parsed against the fixed authority it
+    // becomes a pathname, never a host, so the Host header still cannot steer
+    // routing.
+    if (reqTarget.charAt(0) !== "/") {
+      res.statusCode = 400;
+      res.end("400 Bad Request: non-origin-form request target");
+      return;
+    }
+    // Collapse a leading run of slashes to a single "/". A `//host/path` target
+    // is a valid absolute-path (empty first segment) so it need not be refused,
+    // but left intact it stays a network-path reference: any consumer that
+    // resolves req.url as a URL reference (`new URL(req.url, base)`) would read
+    // the first segment as an AUTHORITY — a Host bleed / SSRF. Normalizing here
+    // (via the same canonical-target helper the 0-RTT replay key uses), and
+    // writing the result back onto req.url, keeps it a pure path for the route
+    // matcher AND every downstream req.url reader.
+    var canonicalTarget = _canonicalRequestTarget(reqTarget);
+    if (canonicalTarget !== reqTarget) {
+      reqTarget = canonicalTarget;
+      req.url = reqTarget;
+    }
+    var absolute = "http://blamejs.invalid" + reqTarget;
     var parsed = safeUrl.parse(absolute, {
       allowedProtocols: safeUrl.ALLOW_HTTP_ALL,
     });
@@ -930,7 +981,10 @@ class Router {
     this._reap0RttCache(nowMs);
     var hash = require("node:crypto").createHash("sha3-512");
     hash.update(String(req.method || "") + "\n");
-    hash.update(String(req.url || "") + "\n");
+    // Canonical target — collapse a leading slash run so `//x` and `/x`, which
+    // dispatch to the same route, share one replay key (varying the leading
+    // slashes must not mint a fresh key and defeat the replay window).
+    hash.update(_canonicalRequestTarget(req.url) + "\n");
     hash.update(String((req.headers && req.headers["host"]) || "") + "\n");
     hash.update(String((req.headers && req.headers["authorization"]) || "") + "\n");
     hash.update(String((req.headers && req.headers["date"]) || "") + "\n");

package/lib/vendor/blamejs/lib/safe-buffer.js

@@ -366,6 +366,38 @@ function byteLengthOf(value, encoding) {
     "Buffer, or Uint8Array; got " + (value === null ? "null" : typeof value));
 }
 
+/**
+ * @primitive b.safeBuffer.byteLengthOfIfMeasurable
+ * @signature b.safeBuffer.byteLengthOfIfMeasurable(value)
+ * @since     0.16.36
+ * @related   b.safeBuffer.byteLengthOf
+ *
+ * Like `byteLengthOf`, but returns `null` for a value that is not a
+ * measurable byte-carrier (a plain `Array`, an array-like object with a
+ * numeric `.length`, a number, ...) instead of throwing.
+ *
+ * For capping the size of an UNTRUSTED metadata bag whose byte field may be
+ * any shape: a content guard measures its cap only when the value is
+ * measurable and treats an unmeasurable value as uncapped-here — its
+ * magic/shape inspection reads only the leading bytes, so it is O(1)-bounded
+ * regardless of a claimed `.length` — rather than throwing out of its
+ * documented never-throw-on-hostile-metadata inspection contract. Route a
+ * hostile-metadata byte cap through this instead of gating `byteLengthOf` on
+ * a hand-rolled `typeof x.length === "number"` check (which admits array-likes
+ * and crashes `byteLengthOf`).
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeBuffer.byteLengthOfIfMeasurable("abc");          // → 3
+ *   b.safeBuffer.byteLengthOfIfMeasurable([1, 2, 3]);      // → null (a plain Array)
+ *   b.safeBuffer.byteLengthOfIfMeasurable({ length: 1e9 }); // → null (array-like)
+ */
+function byteLengthOfIfMeasurable(value) {
+  if (typeof value === "string") return Buffer.byteLength(value, "utf8");
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array) return value.length;
+  return null;
+}
+
 // ---- boundedChunkCollector ----
 //
 // Replaces the unbounded `chunks.push(c); ... Buffer.concat(chunks)`
@@ -872,11 +904,47 @@ function assertHeaderSafe(value, label, ErrorClass, code) {
   return value;
 }
 
+/**
+ * @primitive b.safeBuffer.quoteString
+ * @signature b.safeBuffer.quoteString(s)
+ * @since     0.16.9
+ * @status    stable
+ * @related   b.safeBuffer.assertHeaderSafe, b.safeBuffer.foldHeaderText
+ *
+ * Serialize a value as an RFC quoted-string: coerce to string, escape
+ * every backslash and DQUOTE with a leading backslash, and wrap the
+ * result in DQUOTEs. One serializer for the quoted-string grammars the
+ * framework emits — RFC 8941 §3.3.3 Structured Fields sf-string
+ * (Cache-Status, Signature-Input, Server-Timing desc), RFC 8288 Link
+ * header parameters, RFC 8601 §2.2 Authentication-Results reason,
+ * RFC 3501 §4.3 IMAP quoted strings, and RFC 5804 §1.2 ManageSieve
+ * strings — so an unescaped quote can never terminate the string early
+ * and smuggle extra parameters into the protocol line.
+ *
+ * Escaping only — it does not validate a grammar's character range. A
+ * grammar that forbids bytes a quoted-string cannot carry (sf-string is
+ * printable-ASCII only; IMAP quoted strings cannot carry CR / LF)
+ * enforces its range check before calling this.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeBuffer.quoteString("cache miss");
+ *   // → "\"cache miss\""
+ *
+ *   // A quote or backslash in the value cannot break out of the string.
+ *   b.safeBuffer.quoteString('say "hi"');
+ *   // → "\"say \\\"hi\\\"\""
+ */
+function quoteString(s) {
+  return "\"" + String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + "\"";                       // allow:regex-no-length-cap — fixed-char-set escape on caller-bounded input
+}
+
 module.exports = {
   normalizeText:         normalizeText,
   toBuffer:              toBuffer,
   makeByteCoercer:       makeByteCoercer,
   byteLengthOf:          byteLengthOf,
+  byteLengthOfIfMeasurable: byteLengthOfIfMeasurable,
   boundedChunkCollector: boundedChunkCollector,
   collectStream: collectStream,
   secureZero:            secureZero,
@@ -885,6 +953,7 @@ module.exports = {
   stripCrlf:             stripCrlf,
   foldHeaderText:        foldHeaderText,
   assertHeaderSafe:      assertHeaderSafe,
+  quoteString:           quoteString,
   stripTrailingHspace:   stripTrailingHspace,
   indexAfterOpenTag:     indexAfterOpenTag,
   HEX_RE:                HEX_RE,

package/lib/vendor/blamejs/lib/safe-decompress.js

@@ -165,8 +165,14 @@ function safeDecompress(input, opts) {
      "windowBits", "audit", "ctx"],
     "safeDecompress");
 
-  // Algorithm — required, must be in allowlist
-  if (typeof opts.algorithm !== "string" || !_algorithms[opts.algorithm]) {
+  // Algorithm — required, must be in allowlist. Use an own-property check,
+  // not `!_algorithms[algo]`: a bare truthiness/`in` lookup inherits
+  // Object.prototype members, so a non-own key ("constructor", "toString",
+  // …) would resolve to a prototype function and get invoked below —
+  // `Object(buf)` returns the raw input, silently bypassing the allowlist
+  // and returning un-decompressed bytes (fail-open).
+  if (typeof opts.algorithm !== "string" ||
+      !Object.prototype.hasOwnProperty.call(_algorithms, opts.algorithm)) {
     throw new SafeDecompressError(
       "safe-decompress/unsupported-algorithm",
       "safeDecompress: algorithm must be one of " +

package/lib/vendor/blamejs/lib/safe-dns.js

@@ -357,14 +357,24 @@ function checkCnameChainDepth(depth, opts) {
   }
 }
 
-function _readName(state, pointerDepth) {
+function _readName(state, pointerDepth, acc) {
   if (pointerDepth > state.caps.maxPointerDepth) {
     throw new SafeDnsError("safe-dns/oversize-pointer-depth",
       "safeDns.readName: compression-pointer chain depth=" + pointerDepth +
       " exceeds maxPointerDepth=" + state.caps.maxPointerDepth + " (RFC 1035 §4.1.4 loop defense)");
   }
+  // Both per-name accountants — the decompressed octet count and the label
+  // count — thread through the WHOLE compression-pointer chain via `acc`. A
+  // pointer jump continues the same budget instead of restarting it, so the
+  // composite name a chain expands to is bounded by the same RFC 1035 §3.1
+  // 255-octet / §2.3.4 maxLabels caps that bound a single in-line name. When
+  // the accountants were frame-local, each jump began a fresh 255-octet /
+  // maxLabels budget, so a chain of N pointers decompressed to ~N x 255 octets
+  // and ~N x maxLabels labels past the advertised per-name caps — a
+  // decompression-amplification seam. `acc` is undefined for a top-level name
+  // (each is measured independently) and shared with every sub-read.
+  if (!acc) acc = { bytes: 0, labels: 0 };
   var labels = [];
-  var totalBytes = 0;
   var jumped = false;
   var afterPointerOff = -1;
   var off = state.off;
@@ -376,10 +386,10 @@ function _readName(state, pointerDepth) {
     var byte = state.buf[off];
     if (byte === 0) {
       off += 1;
-      totalBytes += 1;
-      if (totalBytes > DNS_MAX_NAME_BYTES) {
+      acc.bytes += 1;
+      if (acc.bytes > DNS_MAX_NAME_BYTES) {
         throw new SafeDnsError("safe-dns/oversize-name",
-          "safeDns.readName: wire-name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
+          "safeDns.readName: wire-name=" + acc.bytes + " bytes exceeds RFC 1035 cap=" +
           DNS_MAX_NAME_BYTES);
       }
       break;
@@ -394,20 +404,14 @@ function _readName(state, pointerDepth) {
         throw new SafeDnsError("safe-dns/truncated-name",
           "safeDns.readName: compression pointer offset past message end");
       }
-      // First compression pointer ends the in-line label walk
-      // (line break below). `jumped` can never already be true here;
-      // assign unconditionally per Codex code-quality review.
+      // First compression pointer ends the in-line label walk. The pointed-to
+      // tail continues accumulating into the SAME `acc`, so the composite
+      // decompressed name stays bounded by the per-name octet + label caps.
       afterPointerOff = off + 2;                                                                        // RFC 1035 §4.1.4 2-byte pointer width
       jumped = true;
       var subState = { off: ptrOff, buf: state.buf, caps: state.caps };
-      var tailName = _readName(subState, pointerDepth + 1);
+      var tailName = _readName(subState, pointerDepth + 1, acc);
       if (tailName.length) labels.push(tailName);
-      totalBytes += 2;                                                                                  // RFC 1035 §4.1.4 2-byte pointer width
-      if (totalBytes > DNS_MAX_NAME_BYTES) {
-        throw new SafeDnsError("safe-dns/oversize-name",
-          "safeDns.readName: composite name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
-          DNS_MAX_NAME_BYTES);
-      }
       break;
     }
     if (byte > DNS_MAX_LABEL_BYTES) {
@@ -419,15 +423,16 @@ function _readName(state, pointerDepth) {
         "safeDns.readName: label content past message end");
     }
     labels.push(state.buf.toString("ascii", off + 1, off + 1 + byte));
-    if (labels.length > state.caps.maxLabels) {
+    acc.labels += 1;
+    if (acc.labels > state.caps.maxLabels) {
       throw new SafeDnsError("safe-dns/oversize-labels",
-        "safeDns.readName: label count=" + labels.length + " exceeds maxLabels=" + state.caps.maxLabels);
+        "safeDns.readName: label count=" + acc.labels + " exceeds maxLabels=" + state.caps.maxLabels);
     }
     off += 1 + byte;
-    totalBytes += 1 + byte;
-    if (totalBytes > DNS_MAX_NAME_BYTES) {
+    acc.bytes += 1 + byte;
+    if (acc.bytes > DNS_MAX_NAME_BYTES) {
       throw new SafeDnsError("safe-dns/oversize-name",
-        "safeDns.readName: wire-name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
+        "safeDns.readName: wire-name=" + acc.bytes + " bytes exceeds RFC 1035 cap=" +
         DNS_MAX_NAME_BYTES);
     }
   }

package/lib/vendor/blamejs/lib/safe-ical.js

@@ -281,14 +281,18 @@ function _resolveCaps(opts) {
   if (typeof opts.profile === "string") {
     name = opts.profile;
   } else if (typeof opts.compliancePosture === "string") {
-    name = COMPLIANCE_POSTURES[opts.compliancePosture] || "strict";
+    name = Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.compliancePosture)
+      ? COMPLIANCE_POSTURES[opts.compliancePosture] : "strict";
   }
-  var caps = PROFILES[name];
-  if (!caps) {
+  // Own-property lookup: `name` derives from attacker/operator opts.profile, so
+  // a bare `if (!PROFILES[name])` would let a prototype key ("constructor") pass
+  // as a known profile and run under an inherited member (fail-open).
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, name)) {
     throw new SafeIcalError("safe-ical/bad-opt",
       "safeIcal.parse: unknown profile '" + name +
       "' (expected strict|balanced|permissive)");
   }
+  var caps = PROFILES[name];
   return caps;
 }
 

package/lib/vendor/blamejs/lib/safe-mime.js

@@ -750,7 +750,18 @@ function _filenameFromHeaders(headers) {
       }
       if (/^[A-Za-z0-9_-]+'[A-Za-z0-9_-]*'/.test(raw)) {
         var enc = raw.split("'");
-        return decodeURIComponent(enc[2]);
+        // RFC 2231 / 5987 ext-value percent-decode. A hostile
+        // `filename*=UTF-8''%` (truncated %-escape, non-hex digits, or a
+        // %-escape sequence that isn't valid UTF-8) makes decodeURIComponent
+        // throw a raw URIError, which would escape the SafeMimeError contract
+        // and crash the attachment walk. Degrade to the still-encoded segment
+        // — best-effort, and downstream filename guards handle the raw form —
+        // matching every other decodeURIComponent site in the framework.
+        try {
+          return decodeURIComponent(enc[2]);
+        } catch (_e) {
+          return enc[2];
+        }
       }
       return raw;
     }