@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/lib/server-timing.js

@@ -37,6 +37,7 @@
  *   W3C Server-Timing response header builder — per-request timing-metric collector that surfaces server-side latency in the browser's Performance API.
  */
 
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -46,9 +47,6 @@ var ServerTimingError = defineClass("ServerTimingError", { alwaysPermanent: true
 // at 128 chars for sanity; operator-supplied desc is sf-string.
 var METRIC_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,128}$/;                                       // RFC 7230 token shape + length cap
 
-function _quoteDesc(s) {
-  return "\"" + String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + "\"";
-}
 
 /**
  * @primitive b.serverTiming.create
@@ -120,7 +118,7 @@ function create() {
     return entries.map(function (e) {
       var parts = [e.name];
       if (e.dur !== null) parts.push("dur=" + _formatDur(e.dur));
-      if (e.desc !== null) parts.push("desc=" + _quoteDesc(e.desc));
+      if (e.desc !== null) parts.push("desc=" + safeBuffer.quoteString(e.desc));
       return parts.join("; ");
     }).join(", ");
   }

package/lib/vendor/blamejs/lib/session.js

@@ -488,7 +488,12 @@ async function create(opts) {
  * the bound fingerprint — the result carries `fingerprintDrift: true`
  * on mismatch (audit event always fires). `requireFingerprintMatch:
  * true` or a `maxAnomalyScore` threshold (with a `scorer` callback)
- * makes drift refuse the session by returning `null`.
+ * makes drift refuse the session by returning `null`. A strict policy
+ * also refuses (returns `null`) a session that carries no comparable
+ * binding — one created without `{ req }`, or whose sealed binding
+ * cannot be decrypted — since the device match cannot be proven; bind
+ * every session you intend to verify strictly by passing `{ req }` to
+ * `create`.
  *
  * @opts
  *   {
@@ -627,15 +632,24 @@ async function verify(token, verifyOpts) {
   // login-from-Tokyo-then-immediately-from-Brazil pattern is not).
   var fingerprintDrift = false;
   var fingerprintAnomalyScore = null;
-  // A strict binding policy (requireFingerprintMatch / maxAnomalyScore) cannot be
-  // satisfied when the binding is UNREADABLE — we can't prove it matches, so fail
-  // CLOSED rather than silently skipping the gate (the pre-fix fail-open).
-  if (bindingUnreadable && verifyOpts.req &&
-      (verifyOpts.requireFingerprintMatch === true ||
-       typeof verifyOpts.maxAnomalyScore === "number")) {
+  // A strict binding policy (requireFingerprintMatch / maxAnomalyScore) is a
+  // per-request assertion that this session IS device-bound and the current
+  // device matches. It cannot be satisfied when there is no stored fingerprint
+  // to compare against — whether the binding is UNREADABLE (the sealed data
+  // cell exists but won't decrypt: key-rotation skew / corruption / tamper) or
+  // simply ABSENT (the session was created without { req }, so it was never
+  // bound). Either way the device match cannot be proven, so fail CLOSED rather
+  // than silently skip the gate. Treating "no binding to compare" as "the
+  // binding matches" is the fail-open this refuses: it admitted an unbound (or
+  // unreadable-binding) session from ANY device even under a strict policy.
+  var strictBindingRequested = !!verifyOpts.req &&
+    (verifyOpts.requireFingerprintMatch === true ||
+     typeof verifyOpts.maxAnomalyScore === "number");
+  if (strictBindingRequested && !storedFingerprint) {
     try {
       audit.safeEmit({
-        action:   "auth.session.binding_unreadable",
+        action:   bindingUnreadable ? "auth.session.binding_unreadable"
+                                     : "auth.session.binding_missing",
         outcome:  "failure",
         metadata: { hasUserId: !!unsealed.userId },
       });
@@ -681,10 +695,18 @@ async function verify(token, verifyOpts) {
       if (verifyOpts.requireFingerprintMatch === true) {
         return null;
       }
-      if (typeof verifyOpts.maxAnomalyScore === "number" &&
-          fingerprintAnomalyScore !== null &&
-          fingerprintAnomalyScore > verifyOpts.maxAnomalyScore) {
-        return null;
+      if (typeof verifyOpts.maxAnomalyScore === "number") {
+        // Genuine drift under a declared strict anomaly threshold. Refuse when
+        // the computed score exceeds the threshold — AND when no decisive score
+        // could be produced (no scorer supplied, or the scorer threw / returned
+        // a non-finite value, leaving fingerprintAnomalyScore null). An
+        // uncomputable anomaly score on real drift must FAIL CLOSED, not be
+        // treated as "below threshold" and silently admit a relocated device.
+        // Same fail-closed discipline the unreadable-binding branch above applies.
+        if (fingerprintAnomalyScore === null ||
+            fingerprintAnomalyScore > verifyOpts.maxAnomalyScore) {
+          return null;
+        }
       }
     }
   }

package/lib/vendor/blamejs/lib/sql.js

@@ -1760,7 +1760,21 @@ class SelectBuilder extends Builder {
     if (h.sql) { sql += " HAVING " + h.sql; for (var hi = 0; hi < h.params.length; hi++) params.push(h.params[hi]); }
 
     if (this._orderBy.length > 0) sql += " ORDER BY " + this._orderBy.join(", ");
-    if (this._limit !== null) sql += " LIMIT " + this._limit;
+    // OFFSET without LIMIT is valid only on Postgres; SQLite and MySQL both
+    // reject a bare OFFSET as a syntax error (there is no bare-OFFSET spelling
+    // for "skip N, return the rest" on those backends). Emit the dialect's
+    // unbounded-limit sentinel so one query text runs unchanged across all
+    // three: SQLite `LIMIT -1`, MySQL the max unsigned BIGINT, Postgres
+    // `LIMIT ALL`. When a real LIMIT is set the existing token is emitted
+    // untouched, so limit-present statements are byte-for-byte unchanged.
+    var limitToken = null;
+    if (this._limit !== null) {
+      limitToken = String(this._limit);
+    } else if (this._offset !== null) {
+      limitToken = dialect === "sqlite" ? "-1"
+        : (dialect === "mysql" ? "18446744073709551615" : "ALL");
+    }
+    if (limitToken !== null) sql += " LIMIT " + limitToken;
     if (this._offset !== null) sql += " OFFSET " + this._offset;
 
     if (this._lockMode !== null) {

package/lib/vendor/blamejs/lib/ssrf-guard.js

@@ -820,6 +820,56 @@ function isPrivate(ip)       { return classify(ip) === "private"; }
  */
 function isLoopback(ip)      { return classify(ip) === "loopback"; }
 
+/**
+ * @primitive b.ssrfGuard.isLoopbackHost
+ * @signature b.ssrfGuard.isLoopbackHost(host)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.ssrfGuard.isExactLoopbackName, b.ssrfGuard.isLoopback, b.ssrfGuard.canonicalizeHost
+ *
+ * Hostname-aware loopback test. Unlike `isLoopback` (IP literals only) this
+ * canonicalizes `host` (strips `[]` brackets + trailing dots, folds an
+ * IPv4-mapped IPv6, lowercases) and returns `true` for a loopback IP literal
+ * OR the RFC 6761 §6.3 reserved names `localhost` and any `*.localhost`. Pure
+ * name-shape — never resolves DNS.
+ *
+ * @example
+ *   b.ssrfGuard.isLoopbackHost("localhost");     // → true
+ *   b.ssrfGuard.isLoopbackHost("[::1]");          // → true
+ *   b.ssrfGuard.isLoopbackHost("app.localhost");  // → true
+ *   b.ssrfGuard.isLoopbackHost("example.com");    // → false
+ */
+function isLoopbackHost(host) {
+  if (typeof host !== "string" || host.length === 0) return false;
+  var canon = canonicalizeHost(host);
+  if (net.isIP(canon)) return classify(canon) === "loopback";
+  return canon === "localhost" || /\.localhost$/.test(canon);
+}
+
+/**
+ * @primitive b.ssrfGuard.isExactLoopbackName
+ * @signature b.ssrfGuard.isExactLoopbackName(host)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.ssrfGuard.isLoopbackHost
+ *
+ * Like `isLoopbackHost` but WITHOUT the `*.localhost` subdomain reservation —
+ * accepts only the exact `localhost` name or a loopback IP literal. For the
+ * OAuth/OIDC cleartext-redirect loopback exception (RFC 9700 §4.1.1), which
+ * must not widen to a `*.localhost` name an attacker could register in a resolver.
+ *
+ * @example
+ *   b.ssrfGuard.isExactLoopbackName("localhost");     // → true
+ *   b.ssrfGuard.isExactLoopbackName("127.0.0.1");     // → true
+ *   b.ssrfGuard.isExactLoopbackName("app.localhost"); // → false
+ */
+function isExactLoopbackName(host) {
+  if (typeof host !== "string" || host.length === 0) return false;
+  var canon = canonicalizeHost(host);
+  if (net.isIP(canon)) return classify(canon) === "loopback";
+  return canon === "localhost";
+}
+
 /**
  * @primitive b.ssrfGuard.isLinkLocal
  * @signature b.ssrfGuard.isLinkLocal(ip)
@@ -958,6 +1008,8 @@ module.exports = {
   createAllowlist:  createAllowlist,
   isPrivate:        isPrivate,
   isLoopback:       isLoopback,
+  isLoopbackHost:   isLoopbackHost,
+  isExactLoopbackName: isExactLoopbackName,
   isLinkLocal:      isLinkLocal,
   isCloudMetadata:  isCloudMetadata,
   isReserved:       isReserved,

package/lib/vendor/blamejs/lib/static.js

@@ -50,6 +50,7 @@ var gateContract = require("./gate-contract");
 var lazyRequire = require("./lazy-require");
 var numericBounds = require("./numeric-bounds");
 var requestHelpers = require("./request-helpers");
+var safePath = require("./safe-path");
 var validateOpts = require("./validate-opts");
 var { StaticServeError } = require("./framework-error");
 
@@ -205,11 +206,10 @@ function _assertInsideRoot(root, candidate) {
       rel.indexOf(".." + nodePath.sep) !== -1 ||
       rel.indexOf(".." + (nodePath.sep === "/" ? "\\" : "/")) !== -1 ||
       nodePath.isAbsolute(rel)) return null;
-  var safe = nodePath.join(rootResolved, rel);
-  // Defense-in-depth lexical containment alongside the join sanitizer.
-  if (safe !== rootResolved &&
-      !safe.startsWith(rootResolved + nodePath.sep)) return null;
-  return safe;
+  // Final lexical containment via the shared traversal-containment primitive
+  // (cross-platform-aware resolve + strict base-prefix check). rel is already
+  // `..`-stripped and relative above, so this confines to root or returns null.
+  return safePath.confineToBase(rootResolved, rel);
 }
 
 // Module-level metadata cache. Entries hold:
@@ -274,6 +274,24 @@ async function _readMeta(root, candidate) {
   return entry;
 }
 
+// _integrityHeadersForBytes — recompute the strong ETag + SRI integrity for
+// an in-memory buffer, mirroring the digest shape `_readMeta` derives from a
+// file on disk (SHA3-512-truncated ETag for the PQC posture, SHA-384 SRI for
+// the W3C subresource-integrity spec). Used on the content-safety SANITIZE
+// path: the meta cache holds digests of the on-disk ORIGINAL, but the gate
+// replaces the served bytes, so the validators the response advertises must be
+// computed over the bytes actually delivered — otherwise SRI verification of
+// the served body fails and a strong-validator / If-None-Match cache is keyed
+// to a representation the client never receives.
+function _integrityHeadersForBytes(buf) {
+  var sha3Hex = nodeCrypto.createHash("sha3-512").update(buf).digest("hex");
+  var sriDigest = nodeCrypto.createHash("sha384").update(buf).digest("base64");
+  return {
+    etag:      '"' + sha3Hex.slice(0, ETAG_HEX_PREFIX) + '"',
+    integrity: "sha384-" + sriDigest,
+  };
+}
+
 function _resolveSafe(root, requestedPath) {
   if (typeof requestedPath !== "string" || requestedPath.length === 0) return null;
   if (requestedPath.indexOf("\0") !== -1) return null;
@@ -845,7 +863,11 @@ function create(opts) {
   var auditSuccess    = cfg.auditSuccess;
   var auditFailures   = cfg.auditFailures;
   var acceptRanges    = cfg.acceptRanges;
-  var safeAttachment  = !!cfg.safeAttachmentForRiskyMimes;
+  // Read straight from opts: safeAttachmentForRiskyMimes is not a DEFAULTS
+  // key, so applyDefaults(opts, DEFAULTS) never carries it into cfg — reading
+  // it off cfg silently dropped the opt and left the drive-by-execution
+  // defense (Content-Disposition: attachment for risky inline MIMEs) inert.
+  var safeAttachment  = !!opts.safeAttachmentForRiskyMimes;
   // forceAttachmentForNonText default follows mountType (v0.15.0): a
   // mount TYPED "user-content" forces risky inline MIMEs to download by
   // default (stored-XSS defense for untrusted uploads); a "curated" mount
@@ -1180,15 +1202,26 @@ function create(opts) {
 
     var cacheControl = _cacheControlFor(urlPath);
 
+    // The validators the response advertises must describe the bytes ACTUALLY
+    // delivered. On the content-safety SANITIZE path the gate replaced the
+    // bytes, so the strong ETag + SRI X-Integrity are recomputed over the
+    // override buffer rather than reused from the meta cache (which hashed the
+    // on-disk original). The conditional-request checks below compare against
+    // this same effective ETag so a strong-validator / If-None-Match cache
+    // revalidates against the representation it was actually served.
+    var served = gateBytesOverride
+      ? _integrityHeadersForBytes(gateBytesOverride)
+      : { etag: meta.etag, integrity: meta.integrity };
+
     var headersIn = req.headers || {};
 
     // Conditional: If-None-Match (304)
     var ifNone = headersIn["if-none-match"];
-    if (ifNone && ifNone === meta.etag) {
+    if (ifNone && ifNone === served.etag) {
       stats.etagHits += 1;
       _emitObs("staticServe.etag_hits", 1, { route: urlPath });
       res.writeHead(HTTP.NOT_MODIFIED, {
-        "ETag":          meta.etag,
+        "ETag":          served.etag,
         "Cache-Control": cacheControl,
         "Last-Modified": meta.lastModified,
       });
@@ -1197,7 +1230,7 @@ function create(opts) {
 
     // Conditional: If-Match (412 if no match — strong validator only)
     var ifMatch = headersIn["if-match"];
-    if (ifMatch && ifMatch !== "*" && ifMatch !== meta.etag) {
+    if (ifMatch && ifMatch !== "*" && ifMatch !== served.etag) {
       stats.failures += 1;
       _emitObs("staticServe.precondition_failed", 1, { route: urlPath, header: "if-match" });
       return writeErr(res, HTTP.PRECONDITION_FAILED || 412,
@@ -1215,7 +1248,7 @@ function create(opts) {
         stats.etagHits += 1;
         _emitObs("staticServe.if_modified_since_hits", 1, { route: urlPath });
         res.writeHead(HTTP.NOT_MODIFIED, {
-          "ETag":          meta.etag,
+          "ETag":          served.etag,
           "Cache-Control": cacheControl,
           "Last-Modified": meta.lastModified,
         });
@@ -1305,10 +1338,10 @@ function create(opts) {
     var headers = {
       "Content-Type":   _contentTypeFor(absPath, contentTypes),
       "Content-Length": sendBytes,
-      "ETag":           meta.etag,
+      "ETag":           served.etag,
       "Cache-Control":  cacheControl,
       "Last-Modified":  meta.lastModified,
-      "X-Integrity":    meta.integrity,
+      "X-Integrity":    served.integrity,
     };
     // Drive-by-execution defense — when safeAttachmentForRiskyMimes is
     // on, force Content-Disposition: attachment for HTML / JS / SVG /
@@ -1358,6 +1391,15 @@ function create(opts) {
     }
 
     if (req.method === "HEAD") {
+      // A sanitized resource is delivered as the override buffer on GET, so a
+      // HEAD must advertise that same length (and drop Content-Range) — the
+      // meta-cache size describes the on-disk original the client never gets.
+      var headSize = gateBytesOverride ? gateBytesOverride.length : meta.size;
+      if (gateBytesOverride) {
+        headers = Object.assign({}, headers, { "Content-Length": headSize });
+        delete headers["Content-Range"];
+        status = HTTP.OK;
+      }
       res.writeHead(status, headers);
       res.end();
       stats.requestsServed += 1;
@@ -1365,7 +1407,7 @@ function create(opts) {
       if (auditSuccess) {
         emitAudit("staticServe.serve.success", Object.assign({
           outcome: "success", resource: urlPath, method: "HEAD",
-          size: meta.size, contentType: headers["Content-Type"],
+          size: headSize, contentType: headers["Content-Type"],
         }, actorCtx));
       }
       return;

package/lib/vendor/blamejs/lib/storage.js

@@ -162,9 +162,15 @@ function _normalizeConfig(opts) {
       };
     }
     if (opts.backend === "http-put" || opts.backend === "sigv4" || opts.backend === "gcs" || opts.backend === "azure-blob") {
-      // Forward as-is; user provided a single-backend spec for a remote protocol
+      // Forward the single-backend spec, translating the `backend` shorthand
+      // into the `protocol` key the object-store adapter builds against — the
+      // local branch above already spells it `protocol`, and buildBackend keys
+      // off `protocol`, so forwarding `backend` verbatim left the default
+      // backend without a protocol and failed to build.
+      var remoteCfg = Object.assign({}, opts, { protocol: opts.backend, name: undefined });
+      delete remoteCfg.backend;
       return {
-        backends: { "default": Object.assign({}, opts, { name: undefined }) },
+        backends: { "default": remoteCfg },
         defaultClassification: null,
         refuseUnclassified:    false,
       };

package/lib/vendor/blamejs/lib/subject.js

@@ -133,7 +133,12 @@ function exportData(subjectId, opts) {
 
   var tables = db()._getSubjectTables();
   if (tables.length === 0) {
-    return _writeAudit("subject.export", subjectId, "success", { reason: opts.reason || null }, {});
+    // No subjectField-tagged tables: still audit, but return the documented
+    // empty dump ({}) — _writeAudit returns undefined, so returning its value
+    // (with a vestigial 5th arg) silently handed callers `undefined`, crashing
+    // `Object.keys(dump)` / `dump.<table>` before any table is even declared.
+    _writeAudit("subject.export", subjectId, "success", { reason: opts.reason || null });
+    return {};
   }
 
   var dump = {};

package/lib/vendor/blamejs/lib/tenant-quota.js

@@ -55,12 +55,14 @@
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var boundedMap = require("./bounded-map");
+var sql = require("./sql");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 var TenantQuotaError = defineClass("TenantQuotaError", { alwaysPermanent: true });
 
 var audit = lazyRequire(function () { return require("./audit"); });
+var cryptoField = lazyRequire(function () { return require("./crypto-field"); });
 var observability = lazyRequire(function () { return require("./observability"); });
 
 var DEFAULT_CACHE_TTL_MS = C.TIME.seconds(30);
@@ -115,6 +117,7 @@ function create(opts) {
   ], "tenantQuota.create");
 
   if (!opts.db || typeof opts.db.from !== "function" ||
+      typeof opts.db.prepare !== "function" ||
       typeof opts.db.getTableMetadata !== "function") {
     throw new TenantQuotaError("tenant-quota/bad-db",
       "tenantQuota.create: opts.db must be the framework's b.db namespace");
@@ -197,25 +200,61 @@ function create(opts) {
     var tables = _resolveTables();
     var total = 0;
     for (var i = 0; i < tables.length; i++) {
-      // SUM(LENGTH(...)) across every column wins over a per-row
-      // serializer — SQLite computes it in one scan and the framework's
-      // sealed-column ciphertext is already on disk under this length.
-      // We sum the textual length of every column to approximate row
-      // bytes; a small under-count for INTEGER columns is acceptable
-      // when the cap is a soft limit operators raise long before
-      // hitting hard storage.
-      var rows = db.from(tables[i])
-        .where(tenantField, "=", tenantId)
-        .select(["*"])
-        .all();
+      var table = tables[i];
+      // Resolve the tenant predicate. When tenantField is itself a SEALED
+      // column, the plaintext tenantId never equals the on-disk vault
+      // envelope, so the framework filters it by its derived-hash blind index.
+      // Reuse cryptoField.lookupHash — the same rewrite db.from().where()
+      // applies — so a sealed tenantField resolves correctly (including the
+      // legacy dual-read across the keyed-MAC flip). A plaintext tenantField
+      // compares directly. Without this, a schema that seals the tenant id
+      // matches zero rows and the cap silently never fires.
+      var whereField = tenantField;
+      var whereVals = [tenantId];
+      var sealed = cryptoField().getSealedFields(table) || [];
+      if (sealed.indexOf(tenantField) !== -1) {
+        var lk = cryptoField().lookupHash(table, tenantField, tenantId);
+        if (!lk) {
+          throw new TenantQuotaError("tenant-quota/sealed-tenant-no-hash",
+            "tenantQuota: tenantField '" + tenantField + "' on table '" + table +
+            "' is a sealed column without a derived hash; declare " +
+            "derivedHashes: { <name>: { from: '" + tenantField + "' } } so it can be queried");
+        }
+        whereField = lk.field;
+        whereVals = (lk.legacyValue != null && lk.legacyValue !== lk.value)
+          ? [lk.value, lk.legacyValue]
+          : [lk.value];
+      }
+      // Build the read with b.sql — the same builder db.from() uses — so the
+      // table and column identifiers get identical handling (schema-qualified
+      // "schema.table" names, reserved-word names, dialect quoting) without
+      // re-implementing any of it here. Run it raw via db.prepare and, unlike
+      // db.from().all(), do NOT route rows through cryptoField.unsealRow: a
+      // storage cap must count what is actually on disk — the (much larger)
+      // vault envelope of a sealed column, not the plaintext it unseals to —
+      // or a tenant whose data lives in sealed columns sails under the cap.
+      // The tenant value(s) are bound parameters.
+      var built = sql.select(table, { dialect: "sqlite", quoteName: true })
+        .whereIn(whereField, whereVals)
+        .toSql();
+      var stmt = db.prepare(built.sql);
+      var rows = stmt.all.apply(stmt, built.params);
       for (var r = 0; r < rows.length; r++) {
         var row = rows[r];
         var keys = Object.keys(row);
         for (var k = 0; k < keys.length; k++) {
           var v = row[keys[k]];
           if (v == null) continue;
-          if (Buffer.isBuffer(v)) total += v.length;
-          else total += String(v).length;
+          // BLOB columns round-trip as a typed-array view (node:sqlite hands
+          // them back as Uint8Array, not a Node Buffer), so count the true
+          // byte length off any ArrayBuffer view rather than stringifying it
+          // — String(Uint8Array) is the decimal-joined bytes, a ~3x overcount
+          // that would refuse inserts well below the real storage cap. Text
+          // (including a sealed column's "vault:" envelope) is counted as its
+          // UTF-8 byte length, not the JS string .length — a multi-byte
+          // character occupies more than one byte on disk.
+          if (ArrayBuffer.isView(v)) total += v.byteLength;
+          else total += Buffer.byteLength(String(v), "utf8");
         }
       }
     }

package/lib/vendor/blamejs/lib/tls-exporter.js

@@ -106,7 +106,7 @@ function _resolveTlsSocket(socketOrReq) {
  *   }
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var server = b.https.createServer({ key: KEY, cert: CERT }, function (req, res) {
  *     var exporter = b.tlsExporter.fromSocket(req, { length: 32 });
  *     res.end("exporter bytes: " + exporter.length);
@@ -175,7 +175,7 @@ function fromSocket(socketOrReq, opts) {
  * compare via `verifyTokenBinding` on the next request.
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   b.https.createServer({ key: KEY, cert: CERT }, function (req, res) {
  *     var binding = b.tlsExporter.bindToken(req, "session-token-abc123");
  *     binding.length;
@@ -214,7 +214,7 @@ function bindToken(socketOrReq, token) {
  * the input shape is wrong.
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   b.https.createServer({ key: KEY, cert: CERT }, function (req, res) {
  *     var stored = b.tlsExporter.bindToken(req, "session-token-abc123");
  *     var ok = b.tlsExporter.verifyTokenBinding(req, "session-token-abc123", stored);

package/lib/vendor/blamejs/lib/tsa.js

@@ -122,11 +122,11 @@ function _normHex(h) {
 // Resolve the message imprint: hash the data, or use a pre-computed hash.
 function _imprint(data, opts, fnName) {
   var hashName = opts.hashAlg || "SHA-512";
-  var h = IMPRINT_HASHES[hashName];
-  if (!h) {
+  if (!Object.prototype.hasOwnProperty.call(IMPRINT_HASHES, hashName)) {
     throw new TsaError("tsa/bad-hash-alg",
       fnName + ": hashAlg must be one of " + Object.keys(IMPRINT_HASHES).join(" / "));
   }
+  var h = IMPRINT_HASHES[hashName];
   var digest;
   if (opts.hashed) {
     digest = _bytes(data, "hash");
@@ -567,9 +567,13 @@ function _assertValidAt(cert, atMs) {
  * <code>id-ct-TSTInfo</code>, the message imprint equals the hash of
  * <code>opts.data</code> (or <code>opts.hash</code>), a sent nonce
  * round-trips, the signer cert's extendedKeyUsage is a critical, sole
- * <code>id-kp-timeStamping</code>, and the CMS signature verifies. Pass
- * <code>opts.trustAnchorsPem</code> to also verify the certificate
- * chain and validity at the asserted time.
+ * <code>id-kp-timeStamping</code>, and the CMS signature verifies. The
+ * signer certificate is embedded in the token (and therefore
+ * attacker-controlled), so <code>opts.trustAnchorsPem</code> is
+ * <strong>required by default</strong> — without it a self-signed token
+ * would pass on its self-contained signature alone. To accept an
+ * unauthenticated timestamp, set <code>opts.allowUntrustedIssuer:true</code>;
+ * the result then carries <code>issuerTrusted:false</code>.
  *
  * @opts
  *   {
@@ -577,17 +581,18 @@ function _assertValidAt(cert, atMs) {
  *     hash:            Buffer,    // OR a pre-computed digest (with hashAlg)
  *     hashAlg:         string,    // default "SHA-512" — must match the imprint
  *     nonce:           Buffer,    // require the token nonce to match (from buildRequest)
- *     trustAnchorsPem: string|string[], // PEM root(s) — enables chain + validity verification
+ *     trustAnchorsPem: string|string[], // PEM trust root(s) to authenticate the TSA — REQUIRED unless allowUntrustedIssuer
+ *     allowUntrustedIssuer: boolean,     // accept a token with no trust anchor (result carries issuerTrusted:false)
  *     at:              Date,      // validity instant for chain check (default: genTime); must be a valid Date
  *   }
  *
  * @example
- *   var out = b.tsa.verifyToken(resp.token, { data: tarball, hashAlg: "SHA-512", nonce: req.nonce });
- *   // → { genTime, policy, serialHex, accuracy, hashAlg, signerCertPem }
+ *   var out = b.tsa.verifyToken(resp.token, { data: tarball, hashAlg: "SHA-512", nonce: req.nonce, trustAnchorsPem: caPem });
+ *   // → { genTime, policy, serialHex, accuracy, hashAlg, signerCertPem, issuerTrusted: true }
  */
 function verifyToken(token, opts) {
   validateOpts.requireObject(opts, "tsa.verifyToken", TsaError);
-  validateOpts(opts, ["data", "hash", "hashAlg", "nonce", "trustAnchorsPem", "at"], "tsa.verifyToken");
+  validateOpts(opts, ["data", "hash", "hashAlg", "nonce", "trustAnchorsPem", "allowUntrustedIssuer", "at"], "tsa.verifyToken");
   if (opts.data == null && opts.hash == null) {
     throw new TsaError("tsa/no-data", "tsa.verifyToken: pass opts.data or opts.hash to bind the token");
   }
@@ -654,10 +659,25 @@ function verifyToken(token, opts) {
       "tsa.verifyToken: no certificate in the token both carries the timestamping EKU and verifies the signature");
   }
 
-  // (7) optional chain + validity. Accept a single PEM string or an
-  // array — never silently skip chain verification when the caller
-  // supplied an anchor in an unexpected shape (a fail-open).
-  if (opts.trustAnchorsPem !== undefined && opts.trustAnchorsPem !== null) {
+  // (7) Trust anchors REQUIRED by default. The signer certificate is embedded
+  // in the token (sd.certificates) and attacker-controlled, so verifying only
+  // the self-contained CMS signature + the timestamping EKU proves the token is
+  // self-consistent — a forged timestamp (attacker keypair, self-signed leaf
+  // with the timeStamping EKU) passes unless the chain is anchored to a
+  // configured trust root (RFC 3161 §2.4.2). Require trustAnchorsPem by default;
+  // an operator who genuinely wants trust-anchor-free verification must opt in
+  // EXPLICITLY (and gets issuerTrusted:false so the unauthenticated posture is
+  // visible). Mirrors b.mdoc.verifyIssuerSigned; fail closed.
+  var issuerTrusted = opts.trustAnchorsPem !== undefined && opts.trustAnchorsPem !== null;
+  if (!issuerTrusted && opts.allowUntrustedIssuer !== true) {
+    throw new TsaError("tsa/trust-anchors-required",
+      "tsa.verifyToken: opts.trustAnchorsPem is required to authenticate the timestamping TSA " +
+      "(the signer certificate is embedded in the token and attacker-controlled); pass trustAnchorsPem, " +
+      "or set allowUntrustedIssuer:true to explicitly accept an unauthenticated timestamp (issuerTrusted:false)");
+  }
+  // Accept a single PEM string or an array — never silently skip chain
+  // verification when the caller supplied an anchor in an unexpected shape.
+  if (issuerTrusted) {
     var anchors = typeof opts.trustAnchorsPem === "string" ? [opts.trustAnchorsPem] : opts.trustAnchorsPem;
     if (!Array.isArray(anchors) || anchors.length === 0 ||
         !anchors.every(function (a) { return typeof a === "string" && a.length > 0; })) {
@@ -678,6 +698,7 @@ function verifyToken(token, opts) {
     accuracy:      tst.accuracy,
     hashAlg:       imp.hashName,
     signerCertPem: new nodeCrypto.X509Certificate(signerCertDer).toString(),
+    issuerTrusted: issuerTrusted,
   };
 }
 

package/lib/vendor/blamejs/lib/uri-template.js

@@ -159,7 +159,14 @@ function _expandExpr(expr, vars) {
   var o = OPERATORS[expr.op];
   var pieces = [];
   expr.specs.forEach(function (spec) {
-    var value = vars[spec.name];
+    // Own-property only: a varspec name is parse-derived from the template, so
+    // it can be `constructor` / `toString` / `__proto__` / any prototype-
+    // polluted key. A bare `vars[spec.name]` would read the INHERITED member
+    // and expand a function source (or a planted prototype value) into the URI.
+    // RFC 6570 §3.2.1 treats an undefined variable as omitted, so an inherited
+    // name must be undefined here — never a prototype-chain read.
+    var value = Object.prototype.hasOwnProperty.call(vars, spec.name)
+      ? vars[spec.name] : undefined;
     if (!_isDefined(value)) return;
 
     if (typeof value !== "object") {

package/lib/vendor/blamejs/lib/vault/index.js

@@ -193,6 +193,19 @@ function _readOrCreateDerivedHashMacKey() {
   }
   if (nodeFs.existsSync(paths.derivedHashMacKey)) {
     var sealed = atomicFile.readSync(paths.derivedHashMacKey, { encoding: "utf8" }).trim();
+    // A genuine MAC key file is a vault-sealed value (seal() always emits
+    // the VAULT_PREFIX). unseal() returns a NON-prefixed value VERBATIM
+    // (idempotent read passthrough), so without this load-bearing prefix
+    // check a plaintext (or otherwise-unsealed) file substituted on disk
+    // would be accepted as the secret MAC key — defeating the sealed-at-
+    // rest guarantee a disk-write-only attacker (no vault passphrase, so
+    // unable to forge a genuine seal) otherwise cannot bypass (CWE-345).
+    // Same load-bearing prefix check db.js applies to db.key.enc.
+    if (sealed.indexOf(VAULT_PREFIX) !== 0) {
+      throw new VaultError("vault/derived-hash-mac-key-corrupted",
+        "vault.derived-hash-mac.sealed is not a sealed value (missing '" +
+        VAULT_PREFIX + "' prefix) — refusing to accept it as the MAC key");
+    }
     var b64 = unseal(sealed);
     var key = Buffer.from(b64, "base64");
     if (key.length !== 32) {                                                        // 32-byte (256-bit) MAC key