@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/watcher.js

@@ -74,6 +74,14 @@ var DEFAULT_POLL_MAX_FILES   = 50000;
 // Operators with legitimate high-churn directories raise this via opts.
 var DEFAULT_MAX_PENDING = 10000;                                                   // pending-event queue cap
 
+// Native fs.watch runtime-error codes that leave the underlying handle dead —
+// change detection is permanently off, not a transient blip. Classified as a
+// fatal watcher/handle-dead so a wrapper can recreate/alert rather than ignore.
+var HANDLE_DEAD_CODES = ["EPERM", "EBADF", "ENOSPC", "EMFILE", "ENFILE", "EACCES"];
+// Windows MAX_PATH is 260; a path approaching it needs the \\?\ long-path
+// prefix for lstat to resolve it (below the threshold, plain paths are fine).
+var WIN32_LONG_PATH_THRESHOLD = 250;
+
 // ---- glob-style matcher ----
 //
 // Supports three shapes per entry:
@@ -133,7 +141,7 @@ function _matchGlobBasename(parts, base) {
   return true;
 }
 
-function _compileIgnore(patterns) {
+function _compileIgnore(patterns, caseFold) {
   if (!Array.isArray(patterns) || patterns.length === 0) {
     return function () { return false; };
   }
@@ -154,26 +162,33 @@ function _compileIgnore(patterns) {
       throw new WatcherError("watcher/bad-ignore",
         "watcher.create: ignore[" + i + "] exceeds " + MAX_IGNORE_STAR_COUNT + "-wildcard cap");
     }
-    if (p.indexOf("**") !== -1) {
+    // When ignoreCaseFold is on, fold the pattern to lower case at compile time
+    // and the walked path at match time, so the walk-prune aligns with a
+    // case-insensitive consumer's own filter (an on-disk 'Node_Modules' is
+    // pruned by a 'node_modules/**' ignore, not stat'd toward pollMaxFiles).
+    // Length + wildcard caps stay measured on the original pattern.
+    var pk = caseFold ? p.toLowerCase() : p;
+    if (pk.indexOf("**") !== -1) {
       // dir/** prefix-match — strip the trailing **; reject `**` mid-pattern.
-      if (!/^[^*]*\/?\*\*$/.test(p)) {
+      if (!/^[^*]*\/?\*\*$/.test(pk)) {
         throw new WatcherError("watcher/bad-ignore",
           "watcher.create: ignore[" + i + "] '**' is only supported as a trailing dir/** prefix form");
       }
-      var prefix = p.replace(/\/?\*\*$/, "");
+      var prefix = pk.replace(/\/?\*\*$/, "");
       compiled.push({ kind: "prefix", value: prefix });
     } else if (starCount > 0) {
-      compiled.push({ kind: "glob", value: _parseGlobBasename(p) });
+      compiled.push({ kind: "glob", value: _parseGlobBasename(pk) });
     } else {
-      compiled.push({ kind: "exact", value: p });
+      compiled.push({ kind: "exact", value: pk });
     }
   }
   return function (relPath) {
-    var base = nodePath.basename(relPath);
-    var normalized = relPath.split(nodePath.sep).join("/");
+    var matchPath = caseFold ? relPath.toLowerCase() : relPath;
+    var base = nodePath.basename(matchPath);
+    var normalized = matchPath.split(nodePath.sep).join("/");
     for (var j = 0; j < compiled.length; j += 1) {
       var c = compiled[j];
-      if (c.kind === "exact" && (c.value === relPath || c.value === normalized)) return true;
+      if (c.kind === "exact" && (c.value === matchPath || c.value === normalized)) return true;
       if (c.kind === "prefix" && (normalized === c.value || normalized.indexOf(c.value + "/") === 0)) return true;
       if (c.kind === "glob" && _matchGlobBasename(c.value, base)) return true;
     }
@@ -312,6 +327,21 @@ function _validateOpts(opts) {
     throw new WatcherError("watcher/bad-ignore",
       "watcher.create: ignore must be an array of glob patterns");
   }
+  validateOpts.optionalBoolean(opts.ignoreCaseFold, "ignoreCaseFold", WatcherError, "watcher/bad-ignore");
+}
+
+function _lstatLongPathSafe(fullPath) {
+  // Windows MAX_PATH (260): lstatSync on a path at/over the limit without the
+  // \\?\ long-path prefix spuriously throws ENOENT, which _normalizeAndDispatch
+  // would misread as a delete. The prefix needs a backslashed absolute path
+  // (the watcher root is realpathSync.native'd → absolute) and disables path
+  // normalization, which is safe here — fullPath has no relative components. A
+  // genuinely-missing file still ENOENTs on the plain-path fallback → real delete.
+  if (process.platform === "win32" && fullPath.length >= WIN32_LONG_PATH_THRESHOLD && fullPath.indexOf("\\\\?\\") !== 0) {
+    try { return nodeFs.lstatSync("\\\\?\\" + fullPath); }
+    catch (_e) { /* fall through to the plain path so a real ENOENT resurfaces */ }
+  }
+  return nodeFs.lstatSync(fullPath);
 }
 
 function create(opts) {
@@ -339,7 +369,7 @@ function create(opts) {
   var onChange    = opts.onChange || function () {};
   var onDelete    = opts.onDelete || function () {};
   var onError     = opts.onError  || function () {};
-  var isIgnored   = _compileIgnore(opts.ignore);
+  var isIgnored   = _compileIgnore(opts.ignore, opts.ignoreCaseFold === true);
   var auditOn     = opts.audit !== false;
 
   // Pre-flight: root must exist and be a directory.
@@ -375,13 +405,33 @@ function create(opts) {
     try { onError(err); } catch (_e) { /* operator error handler must not crash the watcher */ }
   }
 
+  // Native-backend (fs.watch) error handler. A runtime error whose code leaves
+  // the handle dead (EPERM after the watched root is deleted/recreated on
+  // Windows, EBADF, inotify exhaustion) permanently stops detection — classify
+  // it fatal so a consumer can react (recreate/alert) rather than treat it as a
+  // transient blip. Non-handle-dead errors pass through unclassified.
+  function _handleBackendError(err) {
+    if (err && HANDLE_DEAD_CODES.indexOf(err.code) !== -1) {
+      var dead = new WatcherError("watcher/handle-dead",
+        "watcher: native watch handle died (" + err.code + ") — change detection has " +
+        "permanently stopped; recreate the watcher to resume: " + (err.message || String(err)));
+      dead.fatal = true;
+      dead.cause = err;
+      _safeError(dead);
+      return;
+    }
+    _safeError(err);
+  }
+
   function _normalizeAndDispatch(relPath) {
     if (stopped) return;
     if (isIgnored(relPath)) return;
     var fullPath = nodePath.join(root, relPath);
-    // lstat (NOT stat) — refuses to follow symlinks out of root.
+    // lstat (NOT stat) — refuses to follow symlinks out of root. Long-path-safe
+    // so a Windows path over MAX_PATH isn't misread as a delete (issue: a deep
+    // change delivered to onDelete instead of onChange).
     var lst;
-    try { lst = nodeFs.lstatSync(fullPath); }
+    try { lst = _lstatLongPathSafe(fullPath); }
     catch (e) {
       if (e && e.code === "ENOENT") {
         // Path is gone — delete event. Type unknown by the time we
@@ -456,10 +506,23 @@ function create(opts) {
       var absDir = relDir === "" ? root : nodePath.join(root, relDir);
       var entries;
       try { entries = nodeFs.readdirSync(absDir, { withFileTypes: true }); }
-      catch (_e) {
-        // Root vanished mid-walk OR an inner dir got deleted between
-        // the parent listing and the descent. Skip — the next tick's
-        // walk surfaces the deletion via the snapshot diff.
+      catch (rootErr) {
+        if (relDir === "") {
+          // The ROOT itself is unreadable (unmounted NFS/SMB/USB volume, or a
+          // deleted root). Returning an empty snapshot would diff as a delete
+          // of EVERY tracked entry — a mass-delete a consumer can't tell apart
+          // from a real rm -rf. Surface a distinct fatal root-lost signal and
+          // abort the walk; _pollTick's catch keeps the prior snapshot, so no
+          // spurious onDelete fires.
+          var lost = new WatcherError("watcher/root-lost",
+            "watcher.poll: root '" + root + "' is no longer readable: " +
+            ((rootErr && rootErr.message) || String(rootErr)));
+          lost.fatal = true;
+          lost.cause = rootErr;
+          throw lost;
+        }
+        // Inner dir vanished mid-walk between the parent listing and the
+        // descent. Skip — the next tick's diff surfaces the deletion.
         continue;
       }
       for (var i = 0; i < entries.length; i += 1) {
@@ -544,7 +607,7 @@ function create(opts) {
         if (rel === "" || rel === ".") return;
         _enqueue(rel);
       });
-      watcherHandle.on("error", function (err) { _safeError(err); });
+      watcherHandle.on("error", function (err) { _handleBackendError(err); });
     } catch (e) {
       if (e && (e.code === "ERR_FEATURE_UNAVAILABLE_ON_PLATFORM" || e.code === "ENOSYS")) {
         throw new WatcherError("watcher/recursive-unsupported",
@@ -609,10 +672,19 @@ function create(opts) {
     root:           root,
     mode:           mode,
     _flushForTest:  _flushForTest,
+    // Test seam — drives the native-backend error classification path (the OS
+    // killing the handle isn't deterministically reproducible). Not part of the
+    // operator contract.
+    _simulateBackendErrorForTest: _handleBackendError,
   };
 }
 
 module.exports = {
   create:        create,
   WatcherError:  WatcherError,
+  // Exported so a consumer pre-filtering operator ignore patterns (to keep one
+  // bad pattern from aborting the whole watcher) can align with the caps
+  // create() enforces, instead of pinning hand-copied mirror constants.
+  MAX_IGNORE_PATTERN_LEN: MAX_IGNORE_PATTERN_LEN,
+  MAX_IGNORE_STAR_COUNT:  MAX_IGNORE_STAR_COUNT,
 };

package/lib/vendor/blamejs/lib/webhook-dispatcher.js

@@ -72,7 +72,7 @@ var HTTP_OK_MAX = 300;
 function _validateTableName(name, label) {
   validateOpts.requireNonEmptyString(name, label, WebhookDispatcherError, "webhook-dispatcher/bad-opts");
   // safeSql.quoteIdentifier refuses an injection-bearing name at construction.
-  safeSql.quoteIdentifier(name);
+  safeSql.quoteIdentifier(name, undefined, { allowReserved: true }); // parity with b.db.from()
   return name;
 }
 
@@ -154,6 +154,7 @@ function _coercePayloadString(payload) {
  *   allowInternalDestinations: boolean,   // default false — refuse SSRF (private/loopback/metadata)
  *   httpRequest:     function,            // (url, body, headers) → { status } — inject for tests
  *   now:             function,            // clock injection → ms epoch
+ *   dnsLookup:       function,            // (host) → [{ address, family }] — override the SSRF destination resolver
  *
  * @example
  *   var wd = b.webhook.dispatcher({ externalDb: b.externalDb });
@@ -186,6 +187,7 @@ function dispatcher(opts) {
     allowInternalDestinations: "optional-boolean",
     httpRequest:               "optional-function",
     now:                       "optional-function",
+    dnsLookup:                 "optional-function",
   }, "webhook.dispatcher", WebhookDispatcherError, "webhook-dispatcher/bad-opts");
   var externalDb = opts.externalDb;
   var endpointsTable = _validateTableName(
@@ -216,12 +218,20 @@ function dispatcher(opts) {
   // because the IP check resolves the host. Throws a dispatcher-coded error.
   async function _assertSafeDestination(url, where) {
     safeUrl.parse(url, { allowedProtocols: allowedProtocols, errorClass: WebhookDispatcherError });
+    var checkOpts = { allowInternal: allowInternal };
+    if (typeof opts.dnsLookup === "function") checkOpts.dnsLookup = opts.dnsLookup;
     try {
-      await ssrfGuard().checkUrl(url, { allowInternal: allowInternal });
+      await ssrfGuard().checkUrl(url, checkOpts);
     } catch (e) {
       if (e && e.isSsrfError) {
+        // A genuine SSRF refusal (destination resolved to a private / loopback /
+        // metadata IP, or a rebind since registration) is PERMANENT — dead-letter.
         throw _err("webhook-dispatcher/ssrf-refused", where + ": " + e.message);
       }
+      // A non-SsrfError from checkUrl is a raw resolver / network fault during
+      // host resolution (EAI_AGAIN, ETIMEDOUT, SERVFAIL, ...). Re-throw it as-is
+      // so the caller classifies it as TRANSIENT (retry), not permanent — a
+      // transient DNS blip must not dead-letter a delivery.
       throw e;
     }
   }
@@ -483,8 +493,20 @@ function dispatcher(opts) {
     try {
       await _assertSafeDestination(row.url, "deliver");
     } catch (err) {
+      // Permanence by CLASS: a genuine SSRF refusal or malformed URL surfaces
+      // as a WebhookDispatcherError (won't fix on retry) -> dead-letter. A
+      // resolver fault from the host-resolution step carries the framework's
+      // own terminal-vs-transient verdict on err.permanent — honor it so a
+      // PERMANENT lookup failure (no addresses / a removed record: the
+      // dns/no-result DnsError) dead-letters, while a transient one (a lookup
+      // timeout, a system/resolve failure) is retried on the backoff curve
+      // (capped at maxAttempts) like every other transport error below. A raw
+      // resolver error without that verdict (EAI_AGAIN from the native
+      // fallback, an injected resolver) is treated as transient — a DNS blip
+      // must not dead-letter a delivery.
+      var permanent = (err instanceof WebhookDispatcherError) || (err && err.permanent === true);
       return await _onFailure(deliveryId, attemptNo,
-        (err && err.message) || String(err), true);
+        (err && err.message) || String(err), permanent);
     }
     // Sign + POST. Transport errors (network, TLS, timeout, DNS) and any
     // non-2xx HTTP status are TRANSIENT — back off and retry (capped at

package/lib/vendor/blamejs/lib/webhook.js

@@ -669,8 +669,18 @@ function verifier(opts) {
       throw _failure("MISSING_TIMESTAMP", "webhook: t= field missing from signature header", "missing-timestamp", ctxReq);
     }
     var ts = Number(parsed.t);
-    if (!numericBounds.isNonNegativeFiniteInt(ts)) {
-      throw _failure("BAD_TIMESTAMP", "webhook: t= field is not a non-negative integer, got " + JSON.stringify(parsed.t), "bad-timestamp", ctxReq);
+    // The authenticated timestamp is re-composed into the signed string from
+    // `ts` (the Number) below, so it must be the exact canonical decimal the
+    // signer emits (`String(Math.floor(now / 1000))`). Validating only the
+    // post-coercion value would accept every string Number() maps to the same
+    // integer — scientific ("1.7e9"), a trailing ".0", hex ("0x..."), a
+    // leading "0"/"+"/whitespace — each of which re-canonicalizes into the
+    // signed string and re-verifies, making the authenticated t= field
+    // malleable. Require the raw bytes to equal String(ts) so the sole
+    // canonical form the signer produces is the sole form accepted (matching
+    // the strict digits-only parse the Stripe verifier already applies).
+    if (!numericBounds.isNonNegativeFiniteInt(ts) || String(ts) !== parsed.t) {
+      throw _failure("BAD_TIMESTAMP", "webhook: t= field is not a canonical non-negative integer, got " + JSON.stringify(parsed.t), "bad-timestamp", ctxReq);
     }
     if (parsed.id === null || parsed.id.length === 0) {
       throw _failure("MISSING_ID", "webhook: id= field missing from signature header", "missing-id", ctxReq);

package/lib/vendor/blamejs/lib/ws-client.js

@@ -268,6 +268,7 @@ function connect(target, opts) {
   // performs the (async) check + pinning before the dial and reruns it on
   // every reconnect, so a urlFor-swapped target is validated too.
   client._prepareDial().then(function () {
+    if (client._closed) return;   // close() during the async SSRF re-resolve retires the dial
     client._dial();
   }).catch(function (e) {
     setImmediate(function () { client._handleSocketError(e); });
@@ -366,6 +367,10 @@ class WsClient extends EventEmitter {
   }
 
   _dial() {
+    // Guard the shared dial funnel: a close() during the pending _prepareDial
+    // (initial dial) or the reconnect backoff sets _closed; without this check
+    // the resolved continuation would open a socket + heartbeat nobody owns.
+    if (this._closed) return;
     var self = this;
     this._readyState = "connecting";
 
@@ -406,10 +411,24 @@ class WsClient extends EventEmitter {
       var tlsOpts = Object.assign({
         host:         host,
         port:         port,
-        servername:   host,
         rejectUnauthorized: true,
         minVersion:   "TLSv1.3",
       }, dialTlsOpts || {});
+      // RFC 6066 §3: the TLS SNI ServerName MUST be a hostname, never an IP
+      // literal — Node throws ERR_INVALID_ARG_VALUE when servername is an IP,
+      // which made wss:// to any IP-literal target unusable. Send SNI only for
+      // hostname targets; for an IP-literal host omit it (cert identity is still
+      // verified against the address' iPAddress SAN by the default
+      // checkServerIdentity). An operator servername in tlsOpts still wins.
+      // Decide via ssrfGuard.canonicalizeHost so an IPv6 literal is recognized:
+      // parsed.hostname keeps the brackets (`[::1]`), and net.isIP only accepts
+      // the bare form — canonicalizeHost strips the brackets (and normalizes the
+      // address) so the IP test is correct. Without it an IPv6 literal would set
+      // servername=`[::1]`, a malformed SNI a strict server rejects. Hostnames
+      // canonicalize to a non-IP form, so they still get their SNI.
+      if (!tlsOpts.servername && !net.isIP(ssrfGuard.canonicalizeHost(host))) {
+        tlsOpts.servername = host;
+      }
       if (lookup) tlsOpts.lookup = lookup;
       try {
         var pqcShares = networkTls().pqc.getKeyShares();
@@ -869,6 +888,18 @@ class WsClient extends EventEmitter {
       this._closed = true;
       return;
     }
+    if (this._readyState === "connecting") {
+      // No socket is established yet (the dial is still in _prepareDial's SSRF
+      // re-resolve or the handshake). There is no peer to exchange a graceful
+      // close frame with, so the 1000ms grace window buys nothing — and leaving
+      // _closed false across it lets a slow _prepareDial resolve into _dial()
+      // and open a socket nobody owns. Retire immediately (sets _closed and
+      // destroys any partial socket).
+      code = (typeof code === "number") ? code : CLOSE_NORMAL;
+      reason = (typeof reason === "string") ? reason : "";
+      this._teardown(code, reason, false);
+      return;
+    }
     code = (typeof code === "number") ? code : CLOSE_NORMAL;
     reason = (typeof reason === "string") ? reason : "";
     // RFC 6455 §5.5: control frames must be <= 125 bytes total. The

package/lib/vendor/blamejs/lib/xml-c14n.js

@@ -112,6 +112,20 @@ function parse(xml) {
       "parse: <!ENTITY> declarations refused");
   }
 
+  // XML 1.0 §2.11 end-of-line handling — a conforming processor folds every
+  // literal CRLF and lone CR to a single LF across the WHOLE document (text,
+  // CDATA, comments, attribute literals) BEFORE the InfoSet is built. A CR
+  // delivered through a character reference (&#xD;) is NOT a source line
+  // ending and is preserved. Doing this document-wide once (rather than the
+  // attribute literal alone) closes the same distinct-input / identical-output
+  // collision in element text and CDATA: without it a literal CR in text and
+  // the &#xD; reference both canonicalize to `&#xD;` (the escape _escapeText
+  // applies to a surviving CR), letting a signed document be swapped for one
+  // whose character data differs but whose canonical bytes match. The
+  // attribute §3.3.3 whitespace fold below still runs (it additionally folds
+  // TAB and the now-LF to a single space, which §2.11 alone does not).
+  xml = xml.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+
   var pos = 0;
   function err(msg) {
     throw _xmlErr("xml-c14n/parse", "parse: " + msg + " at offset " + pos);
@@ -159,7 +173,21 @@ function parse(xml) {
     if (pos >= xml.length) err("unterminated attribute value");
     var raw = xml.slice(start, pos);
     pos += 1; // closing quote
-    return _decodeEntities(raw);
+    // XML 1.0 §2.11 line-ending + §3.3.3 attribute-value normalization: a
+    // literal TAB / CR / LF in the attribute literal (and a CRLF / lone-CR
+    // line ending) folds to a single SPACE. The SAME character delivered
+    // through a character reference (&#9; / &#xA; / &#xD;) is decoded AFTER
+    // this fold and is therefore preserved. Because c14n later escapes the
+    // surviving literal control characters back to &#x9; / &#xA; / &#xD;,
+    // skipping the fold makes `a="x<TAB>y"` and `a="x&#9;y"` canonicalize
+    // to IDENTICAL bytes even though their InfoSet attribute values differ
+    // ("x y" vs a real TAB) — a distinct-input / identical-output collision
+    // that would let a signed document be swapped for a semantically
+    // different one whose canonical bytes still match (XML-signature-
+    // wrapping / smuggling). Normalize the literal text BEFORE entity
+    // decode so character-reference whitespace stays intact.
+    var normalized = raw.replace(/\r\n/g, " ").replace(/[\r\n\t]/g, " ");
+    return _decodeEntities(normalized);
   }
 
   function _decodeEntities(s) {

package/lib/vendor/blamejs/oss-fuzz/projects/blamejs/Dockerfile

@@ -11,7 +11,7 @@
 # never built by OSS-Fuzz's own infra. The actual upstream OSS-Fuzz submission
 # un-pins the FROM in its own PR per OSS-Fuzz convention (that infra tracks the
 # latest base-builder). This is a CI-only fuzzing image, never deployed.
-FROM gcr.io/oss-fuzz-base/base-builder-javascript@sha256:990a7eb71a3001c3df3ae3b528e3797442d8666592ee24f86d4ce13b231db968
+FROM gcr.io/oss-fuzz-base/base-builder-javascript@sha256:649105c8df1de6b5e752aaad2c944198aba5cb79481b9ccbcaa189854d9f50d2
 
 # Clone the framework into the build context. OSS-Fuzz builds against
 # main on every run; once the project is accepted, ClusterFuzz tracks

package/lib/vendor/blamejs/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.3",
+  "version": "0.17.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@blamejs/core",
-      "version": "0.16.3",
+      "version": "0.17.22",
       "license": "Apache-2.0",
       "bin": {
         "blamejs": "bin/blamejs.js"

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.3",
+  "version": "0.17.22",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",