@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/lib/mail-scan.js

@@ -236,7 +236,7 @@ function create(opts) {
         return _failTo(auditImpl, e, ms);
       });
     }
-    return _scanClamavInstream(messageBytes).then(function (rv) {
+    return _scanClamavInstream(messageBytes, scanOpts).then(function (rv) {
       rv.durationMs = Date.now() - t0;
       _emitScanResult(auditImpl, rv);
       return rv;
@@ -339,9 +339,11 @@ function create(opts) {
     });
   }
 
-  function _scanClamavInstream(messageBytes) {
+  function _scanClamavInstream(messageBytes, scanOpts) {
     return new Promise(function (resolve, reject) {
-      var sock = net.createConnection({ host: opts.host, port: opts.port });
+      var sock = (scanOpts && scanOpts._socket && typeof scanOpts._socket.write === "function")
+        ? scanOpts._socket
+        : net.createConnection({ host: opts.host, port: opts.port });
       var collector = safeBuffer.boundedChunkCollector({
         maxBytes:   caps.maxResponseBytes,
         errorClass: MailScanError,
@@ -383,21 +385,26 @@ function create(opts) {
         var reply = collector.result().toString("utf8").replace(/[\r\n\0]+$/g, "");                // allow:regex-no-length-cap — trailing-trim anchored
         // ClamAV INSTREAM reply: "<id>: <verdict>" where verdict is
         // "stream: OK", "stream: <Sig.Name> FOUND", or "INSTREAM size
-        // limit exceeded. ERROR".
-        if (/stream:\s+OK\b/.test(reply)) {                                                        // allow:regex-no-length-cap — anchored to fixed token
+        // limit exceeded. ERROR". This is a security verdict classifier,
+        // so it is fail-closed: the malign FOUND signal is tested BEFORE
+        // the benign OK signal. A reply that carries both a FOUND token
+        // and an OK token (a coalesced / stale-then-fresh reply on a
+        // reused connection, or an intermediary that concatenates two
+        // responses) must resolve to "infected", never downgrade to
+        // "clean". An unrecognized shape is "error" (do-not-deliver), so
+        // the only path to "clean" is an OK with no FOUND / no ERROR.
+        var m = reply.match(/stream:\s+(.+?)\s+FOUND\b/);                                          // allow:regex-no-length-cap — anchored to fixed FOUND token
+        if (m) {
+          resolve({ verdict: "infected", threats: [m[1]] });
+        } else if (/ERROR/i.test(reply)) {                                                         // allow:regex-no-length-cap — anchored to fixed ERROR token
+          resolve({ verdict: "error", threats: [] });
+        } else if (/stream:\s+OK\b/.test(reply)) {                                                 // allow:regex-no-length-cap — anchored to fixed token
           resolve({ verdict: "clean", threats: [] });
         } else {
-          var m = reply.match(/stream:\s+(.+?)\s+FOUND\b/);                                        // allow:regex-no-length-cap — anchored to fixed FOUND token
-          if (m) {
-            resolve({ verdict: "infected", threats: [m[1]] });
-          } else if (/ERROR/i.test(reply)) {                                                       // allow:regex-no-length-cap — anchored to fixed ERROR token
-            resolve({ verdict: "error", threats: [] });
-          } else {
-            // Unrecognized reply shape — treat as error so the caller
-            // gets a definite "do not deliver" signal instead of a
-            // silent clean verdict.
-            resolve({ verdict: "error", threats: [] });
-          }
+          // Unrecognized reply shape — treat as error so the caller
+          // gets a definite "do not deliver" signal instead of a
+          // silent clean verdict.
+          resolve({ verdict: "error", threats: [] });
         }
       });
 

package/lib/vendor/blamejs/lib/mail-send-deliver.js

@@ -244,22 +244,32 @@ async function _applyMtaStsPolicy(domain, mxs, policyMode, auditEmit) {
       { domain: domain, mode: policyMode });
     return mxs;
   }
-  if (sts.mode === "testing" && policyMode === "enforce") {
-    // Testing-mode STS doesn't refuse delivery but does record the
-    // mismatch via TLS-RPT. Honor the STS allowlist as an information
-    // signal; don't refuse.
+  if (sts.mode === "testing") {
+    // RFC 8461 §5.2 — a policy published in "testing" mode records
+    // validation failures via TLS-RPT but MUST NOT block delivery. The
+    // domain has explicitly opted out of enforcement, so the local
+    // posture (even the default mtaSts:"enforce") cannot promote a
+    // testing policy to a hard bounce. Deliver against the full MX set
+    // and surface the match result as a report-only signal.
+    var testingMatched = mxs.filter(function (m) {
+      return smtpPolicy().mtaSts.matchMx(m.exchange, sts.mx || []);
+    });
     auditEmit("mail.send.deliver.mtaSts.testing", "info",
-      { domain: domain, mxPatterns: sts.mx });
+      { domain: domain, mxPatterns: sts.mx,
+        matched: testingMatched.length, total: mxs.length });
+    return mxs;
   }
   var filtered = mxs.filter(function (m) {
     return smtpPolicy().mtaSts.matchMx(m.exchange, sts.mx || []);
   });
-  if (filtered.length === 0 && (sts.mode === "enforce" || policyMode === "enforce")) {
+  if (filtered.length === 0 && sts.mode === "enforce") {
     throw new DeliverError("deliver/mta-sts-mx-mismatch",
       "no MX for " + domain + " matches the published MTA-STS policy (mode=" + sts.mode + ")");
   }
   if (filtered.length === 0) {
-    // testing or off mode — log and continue with original list
+    // Any remaining published mode that is neither enforce nor testing
+    // with no match — log and continue with the original list rather
+    // than block delivery.
     auditEmit("mail.send.deliver.mtaSts.no-match", "warn",
       { domain: domain, mode: sts.mode });
     return mxs;
@@ -352,7 +362,23 @@ async function _deliverOne(envelope, recipient, ctx) {
     // composes directly into smtpTransport.dane); this branch carries
     // the discovery so the audit chain records the policy posture
     // applied to each delivery attempt.
-    await _fetchDaneTlsa(mx.exchange, ctx.port, ctx.policy.dane, ctx.auditEmit);
+    try {
+      await _fetchDaneTlsa(mx.exchange, ctx.port, ctx.policy.dane, ctx.auditEmit);
+    } catch (daneErr) {
+      // DANE "enforce": a TLSA lookup failure means this MX host cannot
+      // be used for authenticated delivery (RFC 7672 §2.2). Fail this
+      // single MX over to the next candidate; if every MX for this
+      // recipient fails DANE the recipient is deferred (and eventually
+      // bounced once the operator's retry budget is spent). A per-
+      // recipient DANE failure must never throw out of the whole
+      // deliver() batch and discard the sibling recipients' outcomes —
+      // it is contained here exactly like the MTA-STS enforce path.
+      lastErr = daneErr;
+      ctx.auditEmit("mail.send.deliver.dane-failover", "warn", {
+        recipient: recipient, mxHost: mx.exchange, reason: daneErr.message,
+      });
+      continue;
+    }
     try {
       var rv = await _tryHost({
         from:       envelope.from,

package/lib/vendor/blamejs/lib/mail-server-imap.js

@@ -789,7 +789,7 @@ function create(opts) {
       .then(function (rows) {
         if (Array.isArray(rows) && rows.length > 0) {
           var pairs = rows.map(function (r) {
-            var v = r.value === null || r.value === undefined ? "NIL" : '"' + String(r.value).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + '"';
+            var v = r.value === null || r.value === undefined ? "NIL" : safeBuffer.quoteString(r.value);
             return r.entry + " " + v;
           }).join(" ");
           _writeUntagged(socket, "METADATA " + (mailbox === "" ? '""' : mailbox) + " (" + pairs + ")");
@@ -1247,7 +1247,7 @@ function create(opts) {
         for (var i = 0; i < folders.length; i += 1) {
           var f = folders[i];
           var attrs = (f.attributes || []).map(function (a) { return "\\" + a; }).join(" ");
-          _writeUntagged(socket, "LIST (" + attrs + ") \"/\" " + _quote(f.name));
+          _writeUntagged(socket, "LIST (" + attrs + ") \"/\" " + safeBuffer.quoteString(f.name));
         }
         _writeTagged(socket, tag, "OK LIST completed");
       })
@@ -1282,7 +1282,7 @@ function create(opts) {
           var key = items[k].toUpperCase();
           if (info[key] !== undefined) parts.push(key + " " + info[key]);
         }
-        _writeUntagged(socket, "STATUS " + _quote(name) + " (" + parts.join(" ") + ")");
+        _writeUntagged(socket, "STATUS " + safeBuffer.quoteString(name) + " (" + parts.join(" ") + ")");
         _writeTagged(socket, tag, "OK STATUS completed");
       })
       .catch(function (err) {
@@ -1780,7 +1780,6 @@ function create(opts) {
     try { socket.destroy(); } catch (_e2) { /* idempotent */ }
     connections.delete(socket);
   }
-  function _quote(s) { return '"' + String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + '"'; }
   function _unquote(s) {
     if (typeof s !== "string") return "";
     if (s[0] === "\"" && s[s.length - 1] === "\"") return s.slice(1, -1);

package/lib/vendor/blamejs/lib/mail-server-managesieve.js

@@ -730,7 +730,7 @@ function create(opts) {
           var s = list[i];
           var nm = String(s.name || "");
           var active = s.active === true ? " ACTIVE" : "";
-          socket.write('"' + _quoteEscape(nm) + '"' + active + "\r\n");
+          socket.write(safeBuffer.quoteString(nm) + active + "\r\n");
         }
         _emit("mail.server.managesieve.listscripts",
           { connectionId: state.id, count: list.length });
@@ -813,24 +813,20 @@ function create(opts) {
       });
   }
 
-  // RFC 5804 §1.2 quoted-string escaping: backslash + DQUOTE inside
-  // the value get escaped with a leading backslash.
-  function _quoteEscape(s) {
-    return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');                                               // allow:regex-no-length-cap — backslash + DQUOTE escape on bounded-input
-  }
-
+  // RFC 5804 §1.2 quoted strings — serialization routes through
+  // safeBuffer.quoteString (one quoted-string escaper framework-wide).
   function _writeOk(socket, msg) {
-    try { socket.write('OK "' + _quoteEscape(msg) + '"\r\n'); } catch (_e) { /* socket down */ }
+    try { socket.write("OK " + safeBuffer.quoteString(msg) + "\r\n"); } catch (_e) { /* socket down */ }
   }
   function _writeOkWithTag(socket, tag, msg) {
-    try { socket.write('OK (TAG "' + _quoteEscape(tag) + '") "' + _quoteEscape(msg) + '"\r\n'); }
+    try { socket.write("OK (TAG " + safeBuffer.quoteString(tag) + ") " + safeBuffer.quoteString(msg) + "\r\n"); }
     catch (_e) { /* socket down */ }
   }
   function _writeNo(socket, msg) {
-    try { socket.write('NO "' + _quoteEscape(msg) + '"\r\n'); } catch (_e) { /* socket down */ }
+    try { socket.write("NO " + safeBuffer.quoteString(msg) + "\r\n"); } catch (_e) { /* socket down */ }
   }
   function _writeBye(socket, msg) {
-    try { socket.write('BYE "' + _quoteEscape(msg) + '"\r\n'); } catch (_e) { /* socket down */ }
+    try { socket.write("BYE " + safeBuffer.quoteString(msg) + "\r\n"); } catch (_e) { /* socket down */ }
   }
   function _close(socket) {
     try { socket.end(); } catch (_e) { /* idempotent */ }

package/lib/vendor/blamejs/lib/mail-server-mx.js

@@ -150,6 +150,8 @@ var safeSmtp = require("./safe-smtp");
 var validateOpts = require("./validate-opts");
 var guardSmtpCommand = require("./guard-smtp-command");
 var guardDomain = require("./guard-domain");
+var guardCidr = require("./guard-cidr");
+var ssrfGuard = require("./ssrf-guard");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerTls = require("./mail-server-tls");
 var mailServerNet = require("./mail-server-net");
@@ -196,6 +198,42 @@ var RE_MAIL_FROM = /^MAIL\s+FROM:\s*<([^>]*)>(?:\s+(.*))?$/i;
 var RE_RCPT_TO   = /^RCPT\s+TO:\s*<([^>]+)>(?:\s+.*)?$/i;
 var RE_SIZE      = /SIZE=(\d+)/i;
 
+// A relayAllowedFor entry's `cidr` must be an `<ip>/<prefix>` range so the
+// relay-authorization decision can match the connecting peer against it via
+// b.ssrfGuard.cidrContains (the same range arithmetic the HTTP
+// b.middleware.networkAllowlist fence uses). Shape-validated by composing
+// b.guardCidr.validate rather than a hand-rolled parse: a mask is REQUIRED
+// (a bare IP never matches in cidrContains, so it is refused at boot rather
+// than silently disabling the entry), reserved / private ranges are ALLOWED
+// (a relay allowlist legitimately names 10.0.0.0/8 and friends), and a
+// non-canonical-but-functional network address (host bits set) is audited,
+// not rejected — cidrContains masks it off at match time.
+var _RELAY_CIDR_OPTS = Object.freeze({
+  requireMaskPolicy:      "reject-bare-ip",
+  reservedRangesPolicy:   "allow",
+  ipv4MappedIpv6Policy:   "allow",
+  networkAlignmentPolicy: "audit",
+  family:                 "either",
+});
+
+// _normalizeRelayCidr — fold a DOTTED IPv4-mapped IPv6 relay CIDR
+// (::ffff:a.b.c.d/N, N in 96..128) to its plain IPv4 CIDR (a.b.c.d/(N-96)).
+// guardCidr.validate parses hex-group IPv6 but not the dotted-mapped spelling,
+// so an operator naming a mapped range that way would be refused at boot even
+// though cidrContains accepts it. Folding to plain IPv4 both validates AND
+// makes the entry match every peer form: a genuine IPv4 peer directly, and an
+// IPv4-mapped peer via the _isRelayAllowed fold. Storing the mapped CIDR as-is
+// would instead match a mapped peer but NOT a genuine IPv4 peer (the inverse
+// asymmetry). Every other spelling (plain IPv4, hex-group IPv6) is unchanged.
+function _normalizeRelayCidr(cidr) {
+  if (typeof cidr !== "string") return cidr;
+  var m = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\/(\d{1,3})$/i.exec(cidr);
+  if (!m) return cidr;
+  var prefix = parseInt(m[2], 10);
+  if (prefix < 96 || prefix > 128) return cidr;   // outside the ::ffff:0:0/96 block — a genuine IPv6 range
+  return m[1] + "/" + (prefix - 96);
+}
+
 // Map the b.mail.inbound.verify verdict to the DATA-phase gate action.
 // The sender's published DMARC policy drives it (RFC 7489 §6.3 p= /
 // §6.6.2 disposition): reject → refuse at the wire; quarantine →
@@ -319,6 +357,25 @@ function create(opts) {
     throw new MailServerMxError("mail-server-mx/bad-opts",
       "mail.server.mx.create: relayAllowedFor must be an array if provided");
   }
+  // Every relay-allowlist entry MUST carry a valid `<ip>/<prefix>` CIDR:
+  // relay is granted only to a peer whose address falls inside an allowlisted
+  // range. Refuse a malformed / mask-less entry at boot so an operator typo
+  // can't silently leave the relay decision mis-scoped (open relay is the
+  // failure this closes — pre-fix any non-empty relayAllowedFor admitted
+  // every peer regardless of source address).
+  if (Array.isArray(opts.relayAllowedFor)) {
+    for (var __ri = 0; __ri < opts.relayAllowedFor.length; __ri += 1) {
+      var __re = opts.relayAllowedFor[__ri];
+      var __reOk = __re && typeof __re === "object" && !Array.isArray(__re) &&
+        guardCidr.validate(_normalizeRelayCidr(__re.cidr), _RELAY_CIDR_OPTS).ok;
+      if (!__reOk) {
+        throw new MailServerMxError("mail-server-mx/bad-relay-cidr",
+          "mail.server.mx.create: relayAllowedFor[" + __ri + "] must be an object with a " +
+          "valid CIDR string (e.g. { cidr: \"10.0.0.0/8\", scope: \"internal\" }); relay is " +
+          "granted only to peers whose source address falls inside an allowlisted range");
+      }
+    }
+  }
 
   var greeting          = opts.greeting          || DEFAULT_GREETING;
   var maxLineBytes      = opts.maxLineBytes      || DEFAULT_MAX_LINE_BYTES;
@@ -326,7 +383,11 @@ function create(opts) {
   var maxRcptsPerMsg    = opts.maxRcptsPerMessage || DEFAULT_MAX_RCPTS_PER_MESSAGE;
   var idleTimeoutMs     = opts.idleTimeoutMs     || DEFAULT_IDLE_TIMEOUT_MS;
   var localDomains      = (opts.localDomains || []).map(function (d) { return String(d).toLowerCase(); });
-  var relayAllowedFor   = opts.relayAllowedFor || [];
+  var relayAllowedFor   = (opts.relayAllowedFor || []).map(function (__e) {
+    return (__e && typeof __e === "object" && !Array.isArray(__e))
+      ? Object.assign({}, __e, { cidr: _normalizeRelayCidr(__e.cidr) })
+      : __e;
+  });
   var profile           = opts.profile || "strict";
   // SMTPUTF8 (RFC 6531) — single switch threaded end-to-end. The MX
   // listener doesn't advertise SMTPUTF8 to the peer regardless, so
@@ -658,7 +719,7 @@ function create(opts) {
       } catch (err) {
         if (err.code === "guard-smtp-command/bare-lf" ||
             err.code === "guard-smtp-command/bare-cr" ||
-            err.code === "guard-smtp-command/nul-byte") {
+            err.code === "guard-smtp-command/nul") {
           _emit("mail.server.mx.smtp_smuggling_detected",
             { connectionId: state.id, code: err.code, line: line.slice(0, 200) },                     // audit-log line truncation
             "denied");
@@ -1195,12 +1256,37 @@ function create(opts) {
       return profile === "strict" || profile === "balanced";
     }
 
-    function _isRelayAllowed(_remoteAddress, _rcptTo) {
-      // Operator-supplied relayAllowedFor entries. v1 just checks
-      // presence in the array; CIDR/scope matching could be wired
-      // via b.middleware.networkAllowlist in a follow-up.
+    function _isRelayAllowed(remoteAddress, _rcptTo) {
+      // Relay is admitted ONLY when the connecting peer's source address
+      // falls inside one of the operator's allowlisted CIDR ranges — the
+      // same range arithmetic (b.ssrfGuard.cidrContains) the HTTP
+      // b.middleware.networkAllowlist fence uses. Every entry's `cidr` was
+      // shape-validated at create() time; a peer outside every range (or a
+      // non-string / empty peer address) is refused, so a misconfigured
+      // relayAllowedFor fails closed instead of turning the listener into an
+      // open relay. `scope` is an operator-facing annotation on the entry;
+      // the network boundary is the authorization control.
       if (relayAllowedFor.length === 0) return false;
-      return true;
+      if (typeof remoteAddress !== "string" || remoteAddress.length === 0) return false;
+      // Node reports an IPv4 client as an IPv4-mapped IPv6 address
+      // (::ffff:a.b.c.d) when the listener binds the IPv6 wildcard `::` (the
+      // common dual-stack deployment). cidrContains refuses a mixed-family
+      // compare, so a documented IPv4 relay CIDR (10.0.0.0/8) would deny every
+      // intended IPv4 client on that listener. Fold the mapped form to its
+      // IPv4 dotted address (ssrfGuard.canonicalizeHost, which folds only the
+      // ::ffff:0:0/96 block) and match EITHER the peer as reported OR the
+      // folded form — so an IPv4 CIDR matches a mapped peer and an IPv6 CIDR
+      // still matches a genuine IPv6 peer.
+      var canonPeer;
+      try { canonPeer = ssrfGuard.canonicalizeHost(remoteAddress); }
+      catch (_e) { canonPeer = remoteAddress; }
+      for (var i = 0; i < relayAllowedFor.length; i += 1) {
+        var entry = relayAllowedFor[i];
+        if (!entry || typeof entry !== "object") continue;
+        if (ssrfGuard.cidrContains(entry.cidr, remoteAddress)) return true;
+        if (canonPeer !== remoteAddress && ssrfGuard.cidrContains(entry.cidr, canonPeer)) return true;
+      }
+      return false;
     }
   }
 

package/lib/vendor/blamejs/lib/mail-server-registry.js

@@ -197,12 +197,18 @@ function create(opts) {
         "register: '" + name + "' entry.maxHandlerMs must be a positive integer ≤ " +
         MAX_HANDLER_MS_CEILING + " (got " + entry.maxHandlerMs + ")");
     }
-    if (!catalogue[name] && entry.allowExperimental !== true) {
+    // Own-property membership, not `catalogue[name]` truthiness: the frozen
+    // plain-object catalogues (IMAP_VERBS / JMAP_METHODS / MANAGESIEVE_VERBS)
+    // inherit Object.prototype, so a handler name colliding with a prototype
+    // member (`constructor`, `toString`) would read a truthy inherited value
+    // and silently pass the catalogue gate without allowExperimental.
+    var inCatalogue = Object.prototype.hasOwnProperty.call(catalogue, name);
+    if (!inCatalogue && entry.allowExperimental !== true) {
       throw new MailServerRegistryError("mail-server-registry/unknown-method",
         "register: '" + name + "' is not in the " + opts.protocol + " catalogue; pass " +
         "allowExperimental: true to opt out of the catalogue gate (audited)");
     }
-    if (entry.allowExperimental === true && !catalogue[name]) {
+    if (entry.allowExperimental === true && !inCatalogue) {
       try {
         audit.safeEmit({
           action:   "mail.serverRegistry.experimental_registration",

package/lib/vendor/blamejs/lib/mail.js

@@ -786,13 +786,23 @@ function _buildRfc822(message) {
     body = parts.join("\r\n");
   }
 
-  // Normalize line endings then dot-stuff per SMTP transparency.
+  // Normalize line endings only. Dot-stuffing (SMTP DATA transparency, RFC 5321
+  // §4.5.2) is applied at DATA send time — NOT here — because it must NOT touch
+  // the RFC 3030 BDAT/CHUNKING path (length-framed; receivers do not un-stuff, so
+  // a baked-in doubled dot corrupts the body) and must NOT be inside the
+  // DKIM-signed message (the receiver verifies the un-stuffed body).
   body = body.replace(/\r?\n/g, "\r\n");
-  body = body.split("\r\n").map(function (l) { return l.charAt(0) === "." ? "." + l : l; }).join("\r\n");
 
   return headers.join("\r\n") + "\r\n\r\n" + body;
 }
 
+// Dot-stuff a message for the SMTP DATA path (RFC 5321 §4.5.2): any line whose
+// first byte is "." gets a doubled dot so the receiver's `.`-on-its-own-line
+// terminator can't be forged by body content. Applied ONLY on DATA, never BDAT.
+function _dotStuffForData(msg) {
+  return msg.split("\r\n").map(function (l) { return l.charAt(0) === "." ? "." + l : l; }).join("\r\n");
+}
+
 function smtpTransport(opts) {
   opts = opts || {};
   if (!opts.host) {
@@ -1371,7 +1381,7 @@ function _smtpSend(message, cfg) {
       }
       else if (step === SMTP_STEP_DATA) {
         if (code !== 354) { fail("data-rejected (code " + code + ")"); return; }
-        send(dataMessage + "\r\n.");
+        send(_dotStuffForData(dataMessage) + "\r\n.");
         step = SMTP_STEP_BODY;
       }
       else if (step === SMTP_STEP_BDAT) {
@@ -1609,10 +1619,10 @@ function resendTransport(opts) {
         throw new MailError("mail/resend-bad-response",
           "resend response was not JSON: " + text.slice(0, DIAG_SNIPPET_LEN), false);
       }
-      if (!data.id) {
+      if (!data || !data.id) {
         return {
           ok:     false,
-          reason: data.message || JSON.stringify(data).slice(0, DIAG_SNIPPET_LEN),
+          reason: (data && data.message) || JSON.stringify(data).slice(0, DIAG_SNIPPET_LEN),
         };
       }
       return { ok: true, id: data.id };