@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/text-guard.js

@@ -36,7 +36,11 @@
  *     - slugLabel(s, label, opts?) — lowercase URL-slug label
  *     - hostLabel(host, label?) — outbound host SSRF + by-name denylist
  *     - freeText(s, label, policy?) — dangerous-codepoint screen for
- *       unconstrained UTF-8 text fields
+ *       unconstrained UTF-8 text fields, throwing on a refusal
+ *     - hasCodepointThreat(s, policy?) — the same screen for a defensive
+ *       reader that DROPS a bad value instead of refusing the request
+ *     - firstCodepointThreat(s, policy?) — the one decision both run, so
+ *       the throwing and dropping paths cannot disagree
  *
  * @primitive textGuard
  * @related   b.money, b.ssrfGuard, b.safeUrl, shop.currencyRounding,
@@ -52,6 +56,41 @@ var b = require("./vendor/blamejs");
 // second copy of the tables.
 var codepointClass = b.codepointClass;
 
+// Two invisible-codepoint groups this shop refuses that the framework catalog
+// does not carry yet. Built with codepointClass.charClass off a range table so
+// the escaping is the catalog's, not a second hand-spelled class:
+//
+//   U+007F DELETE — grouped with the C0 controls everywhere it matters, but
+//     outside the 0x00-0x1F block the framework's C0_CTRL_RANGES covers.
+//   U+2061-2064 FUNCTION APPLICATION / INVISIBLE TIMES / INVISIBLE SEPARATOR /
+//     INVISIBLE PLUS — zero-width invisible operators, the same spoofing class
+//     as U+2060 WORD JOINER, which the framework's ZERO_WIDTH_RANGES does have.
+//
+// Requested upstream (blamejs#580). When a vendor refresh lands them in the
+// catalog this supplement becomes dead weight and comes out — the drift test
+// in test/layer-1-state/text-guard.test.js fails the moment that happens, so
+// it cannot be silently carried forever.
+//
+// Kept as two classes rather than one so each joins the check whose refusal
+// message is already true of it.
+// allow:dynamic-regex — codepoints from a literal range table
+var DEL_RE = new RegExp("[" + codepointClass.charClass([0x007F]) + "]");
+// allow:dynamic-regex — codepoints from a literal range table
+var INVISIBLE_OP_RE = new RegExp("[" + codepointClass.charClass([[0x2061, 0x2064]]) + "]");
+// Global twin for the strip pass; the unglobbed one above is the presence test.
+// allow:dynamic-regex — codepoints from a literal range table
+var INVISIBLE_OP_RE_G = new RegExp("[" + codepointClass.charClass([[0x2061, 0x2064]]) + "]", "g");
+
+// Everything that ends a line or pads it out, for a value that must stay on
+// one. Tab / LF / CR sit outside the framework's C0 table on purpose — a
+// multi-line body needs them — so a single-line field asks for them here.
+// U+2028 / U+2029 are not control characters at all, but they terminate a
+// line for both a renderer and a JS string literal.
+// allow:dynamic-regex — codepoints from a literal range table
+var LINE_BREAK_RE = new RegExp(
+  "[" + codepointClass.charClass([0x0009, 0x000A, 0x000D, [0x2028, 0x2029]]) + "]"
+);
+
 // ---- shop validators ----------------------------------------------------
 
 // asciiUpperLetters(s, label, n?) — exactly `n` (default 3) ASCII
@@ -157,45 +196,105 @@ function hostLabel(host, label) {
   return h;
 }
 
-// freeText(s, label, policy?) — the dangerous-codepoint screen for an
-// UNCONSTRAINED UTF-8 text field (customer note, review body, gift
-// message, product Q&A). Unlike the ASCII-allowlist validators above,
-// these fields legitimately carry arbitrary letters, so the codepoint
-// catalog is the right backing: bidi overrides (CVE-2021-42574 Trojan
-// Source), null bytes, and C0 control characters are refused by default;
-// zero-width / invisible formatting is refused when policy.zeroWidth is
-// "reject"; a mixed-script confusable (Cyrillic 'а' inside an otherwise
-// Latin label) is refused when policy.mixedScript is "reject". Throws
-// TypeError on a refused codepoint. Returns the input on success.
-function freeText(s, label, policy) {
-  var name = label || "value";
-  if (typeof s !== "string") {
-    throw new TypeError(name + " must be a string");
-  }
+// firstCodepointThreat(s, policy?) — the single decision both the throwing
+// screen (freeText) and the drop-silent one (hasCodepointThreat) run, so a
+// field guarded one way and a field guarded the other can never disagree
+// about what "dangerous" means. Returns a short reason string naming the
+// class, or null when the text is clean. The reason is the clause that
+// follows the field name in a refusal ("contains a null byte"), so a caller
+// building a message just joins the two.
+//
+// Policies, each "reject" to enable and any other value to allow:
+//   bidi        — default "reject". Bidi overrides (CVE-2021-42574).
+//   nullByte    — default "reject". U+0000.
+//   control     — default "reject". C0 controls + U+007F DELETE. Tab, LF and
+//                 CR are ALLOWED here: a multi-line body legitimately has
+//                 them. Use singleLine for a field that must not.
+//   singleLine  — off by default. Tab / LF / CR, plus U+2028 LINE SEPARATOR
+//                 and U+2029 PARAGRAPH SEPARATOR, which break a line without
+//                 being C0 at all. For a value rendered on one line — a URL,
+//                 a subject, a title, a header value.
+//   zeroWidth   — off by default. Zero-width / invisible formatting. Includes
+//                 U+00AD SOFT HYPHEN, which text pasted out of a hyphenating
+//                 word processor or PDF carries invisibly.
+//   mixedScript — off by default. Confusable / homograph across writing
+//                 systems, narrowed by policy.allowedScripts.
+function firstCodepointThreat(s, policy) {
   policy = policy || {};
-  var bidiP    = policy.bidi    || "reject";
-  var nullP    = policy.nullByte || "reject";
-  var controlP = policy.control || "reject";
-  if (bidiP === "reject" && codepointClass.BIDI_RE.test(s)) {
-    throw new TypeError(name + " contains a Unicode bidi override (CVE-2021-42574 Trojan Source)");
+  if ((policy.bidi || "reject") === "reject" && codepointClass.BIDI_RE.test(s)) {
+    return "contains a Unicode bidi override (CVE-2021-42574 Trojan Source)";
   }
-  if (nullP === "reject" && s.indexOf(codepointClass.NULL_BYTE) !== -1) {
-    throw new TypeError(name + " contains a null byte");
+  if ((policy.nullByte || "reject") === "reject" &&
+      s.indexOf(codepointClass.NULL_BYTE) !== -1) {
+    return "contains a null byte";
   }
-  if (controlP === "reject" && codepointClass.C0_CTRL_RE.test(s)) {
-    throw new TypeError(name + " contains a C0 control character");
+  if ((policy.control || "reject") === "reject" &&
+      (codepointClass.C0_CTRL_RE.test(s) || DEL_RE.test(s))) {
+    return "contains a C0 control character";
   }
-  if (policy.zeroWidth === "reject" && codepointClass.ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError(name + " contains a zero-width / invisible formatting character");
+  if (policy.singleLine === "reject" && LINE_BREAK_RE.test(s)) {
+    return "contains a line break or tab but must be a single line";
+  }
+  if (policy.zeroWidth === "reject" &&
+      (codepointClass.ZERO_WIDTH_RE.test(s) || INVISIBLE_OP_RE.test(s))) {
+    return "contains a zero-width / invisible formatting character";
   }
   if (policy.mixedScript === "reject") {
     var scripts = codepointClass.detectMixedScripts(s, policy.allowedScripts);
     if (scripts) {
-      throw new TypeError(
-        name + " mixes writing systems (" + scripts.join(", ") + ") — possible confusable / homograph"
-      );
+      return "mixes writing systems (" + scripts.join(", ") +
+             ") — possible confusable / homograph";
     }
   }
+  return null;
+}
+
+// hasCodepointThreat(s, policy?) — the non-throwing sibling of freeText, for
+// the defensive readers that DROP a bad value rather than refusing the
+// request (a link URL inside a rendered body, a header line being assembled).
+// A non-string is dangerous by definition here: the caller is about to render
+// or transmit it. Returns true when the text must not be used.
+function hasCodepointThreat(s, policy) {
+  if (typeof s !== "string") return true;
+  return firstCodepointThreat(s, policy) !== null;
+}
+
+// scrubInvisible(s) — remove every bidi override and invisible-formatting
+// codepoint and return the cleaned string. The third disposition, alongside
+// throwing and dropping: for a value that must be ACCEPTED whatever it
+// contains, because refusing it would hand an attacker a denial-of-service
+// against a legitimate user (a search query is the standing example — a
+// pasted BOM must not cost the shopper their search).
+//
+// Composes the framework's strip pass and then removes the codepoints the
+// catalog does not carry yet, so what this deletes is exactly what
+// hasCodepointThreat would have objected to under zeroWidth: "reject".
+// Control characters are deliberately NOT touched: a caller stripping those
+// usually wants to substitute a space to avoid welding two words together,
+// which is its own decision.
+function scrubInvisible(s) {
+  if (typeof s !== "string") return s;
+  var out = codepointClass.applyCharStripPolicies(s, {
+    bidiPolicy:      "strip",
+    zeroWidthPolicy: "strip",
+    tagsPolicy:      "strip",
+  });
+  return out.replace(INVISIBLE_OP_RE_G, "");
+}
+
+// freeText(s, label, policy?) — the dangerous-codepoint screen for an
+// UNCONSTRAINED UTF-8 text field (customer note, review body, gift
+// message, product Q&A). Unlike the ASCII-allowlist validators above,
+// these fields legitimately carry arbitrary letters, so the codepoint
+// catalog is the right backing. Throws TypeError on a refused codepoint;
+// returns the input on success. See firstCodepointThreat for the policies.
+function freeText(s, label, policy) {
+  var name = label || "value";
+  if (typeof s !== "string") {
+    throw new TypeError(name + " must be a string");
+  }
+  var reason = firstCodepointThreat(s, policy);
+  if (reason) throw new TypeError(name + " " + reason);
   return s;
 }
 
@@ -213,9 +312,12 @@ module.exports = {
   applyCharStripPolicies: codepointClass.applyCharStripPolicies,
 
   // Shop validators.
-  asciiUpperLetters: asciiUpperLetters,
-  currencyCode:      currencyCode,
-  slugLabel:         slugLabel,
-  hostLabel:         hostLabel,
-  freeText:          freeText,
+  asciiUpperLetters:    asciiUpperLetters,
+  currencyCode:         currencyCode,
+  slugLabel:            slugLabel,
+  hostLabel:            hostLabel,
+  freeText:             freeText,
+  hasCodepointThreat:   hasCodepointThreat,
+  firstCodepointThreat: firstCodepointThreat,
+  scrubInvisible:       scrubInvisible,
 };

package/lib/theme-assets.js

@@ -84,6 +84,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_SLUG_LEN         = 80;
 var MAX_THEME_SLUG_LEN   = 80;
@@ -130,14 +131,10 @@ var SHA3_512_HEX_RE = /^[0-9a-f]{128}$/;
 var CONTENT_TYPE_RE = /^[A-Za-z0-9!#$&^_.+-]+\/[A-Za-z0-9!#$&^_.+-]+(?:\s*;\s*[A-Za-z0-9!#$&^_.+-]+\s*=\s*(?:"[^"\x00-\x1f]*"|[A-Za-z0-9!#$&^_.+-]+))*$/;
 
 // Refuse C0 control bytes + DEL in operator-authored text fields.
-var CONTROL_BYTE_LINE_RE = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the rest of the
 // shop primitives. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var MS_PER_DAY = b.constants.TIME.days(1);
 
@@ -181,9 +178,7 @@ function _contentType(s) {
       MAX_CONTENT_TYPE_LEN + " chars"
     );
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("themeAssets: content_type contains control bytes");
-  }
+  textGuard.freeText(s, "themeAssets: content_type", { singleLine: "reject" });
   if (!CONTENT_TYPE_RE.test(s)) {
     throw new TypeError(
       "themeAssets: content_type " + JSON.stringify(s) +
@@ -230,9 +225,7 @@ function _sourceUrl(s) {
       MAX_SOURCE_URL_LEN + " chars"
     );
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("themeAssets: source_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "themeAssets: source_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     if (s.length > 1 && s.charCodeAt(1) === 47) {
       throw new TypeError(
@@ -264,12 +257,7 @@ function _altText(s) {
       MAX_ALT_TEXT_LEN + " chars (or null)"
     );
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("themeAssets: alt_text contains control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("themeAssets: alt_text contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "themeAssets: alt_text", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/translations.js

@@ -58,6 +58,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_KIND_LEN          = 64;
 var MAX_RESOURCE_ID_LEN   = 128;
@@ -90,14 +91,10 @@ var LOCALE_RE = /^[a-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;
 // allowed (operators author multi-line page bodies) — the rest of
 // the C0 range would only reach the storefront as a smuggling
 // payload or a copy-paste accident from a terminal.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family. Spelled with \u-escapes
 // so ESLint's no-irregular-whitespace stays happy. Same defence the
 // rest of the shop uses on operator-authored strings.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -193,10 +190,10 @@ function _value(s, fnLabel) {
   if (s.length > MAX_VALUE_LEN) {
     throw new TypeError(fnLabel + ": value must be <= " + MAX_VALUE_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError(fnLabel + ": value contains forbidden control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError(fnLabel + ": value contains zero-width / direction-override characters");
   }
   return s;

package/lib/trust-badges.js

@@ -116,13 +116,9 @@ var EVENT_TYPES = Object.freeze(["impression", "click"]);
 var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 
 // Refuse C0 control bytes + DEL in single-line operator strings.
-var CONTROL_BYTE_LINE_RE = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — same catalogue as the
 // other operator-authored primitives.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Hash namespace — opaque per-primitive constant so a session_id_hash
 // emitted by trustBadges can't collide with one emitted by analytics
@@ -142,6 +138,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -184,10 +181,10 @@ function _line(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("trustBadges: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("trustBadges: " + label + " contains control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("trustBadges: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -201,7 +198,7 @@ function _httpsOrRootUrl(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("trustBadges: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject", zeroWidth: "reject" })) {
     throw new TypeError("trustBadges: " + label + " contains control / zero-width bytes");
   }
   if (s.charCodeAt(0) === 47 /* "/" */) {