@blamejs/blamejs-shop 0.5.20 → 0.5.21

package/lib/site-redirects.js

@@ -101,18 +101,15 @@ var MAX_REGEX_SOURCE_LEN  = 512;
 var MAX_LIMIT             = 1000;
 var DEFAULT_LIMIT         = 100;
 
-var CONTROL_BYTE_RE       = /[\x00-\x1f\x7f]/;
 // Zero-width + invisible bytes: U+200B (zero-width space),
 // U+200C (zero-width non-joiner), U+200D (zero-width joiner),
 // U+2060 (word joiner), U+FEFF (zero-width no-break space / BOM).
 // Source code uses escape sequences so the file itself stays
 // linter-clean (raw zero-width bytes in source trip both
 // no-irregular-whitespace and no-misleading-character-class).
-var ZERO_WIDTH_RE         = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // Monotonic clock — ensures consecutive _now() calls from the same
 // process never collide in the same millisecond, so updated_at /
@@ -153,9 +150,7 @@ function _sourcePath(s) {
       "siteRedirects: source_path must be <= " + MAX_SOURCE_PATH_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("siteRedirects: source_path contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "siteRedirects: source_path", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) !== 47 /* "/" */) {
     throw new TypeError("siteRedirects: source_path must be /-rooted (start with '/')");
   }
@@ -179,9 +174,7 @@ function _targetUrl(s) {
       "siteRedirects: target_url must be <= " + MAX_TARGET_URL_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("siteRedirects: target_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "siteRedirects: target_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     if (s.length > 1 && s.charCodeAt(1) === 47) {
       throw new TypeError(
@@ -272,9 +265,7 @@ function _compileRegex(source) {
       "siteRedirects: regex source must be <= " + MAX_REGEX_SOURCE_LEN + " characters"
     );
   }
-  if (CONTROL_BYTE_RE.test(source) || ZERO_WIDTH_RE.test(source)) {
-    throw new TypeError("siteRedirects: regex source contains control / zero-width bytes");
-  }
+  textGuard.freeText(source, "siteRedirects: regex source", { singleLine: "reject", zeroWidth: "reject" });
   var anchored = "^(?:" + source + ")$";
   try {
     return b.regexLinear.compile(anchored);
@@ -500,9 +491,7 @@ function create(opts) {
     if (typeof path !== "string" || !path.length) {
       throw new TypeError("siteRedirects.resolveForPath: path must be a non-empty string");
     }
-    if (CONTROL_BYTE_RE.test(path)) {
-      throw new TypeError("siteRedirects.resolveForPath: path contains control bytes");
-    }
+    textGuard.freeText(path, "siteRedirects.resolveForPath: path", { singleLine: "reject" });
     var now = _now();
 
     // -- exact ----------------------------------------------------------

package/lib/sitemap-generator.js

@@ -107,9 +107,9 @@ var ALLOWED_CHANGEFREQS = Object.freeze([
   "never",
 ]);
 
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -134,9 +134,7 @@ function _basePath(s) {
   if (typeof s !== "string" || s.length < 1 || s.length > MAX_BASE_PATH_LEN) {
     throw new TypeError("sitemapGenerator: base_path must be a string 1.." + MAX_BASE_PATH_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("sitemapGenerator: base_path contains control bytes");
-  }
+  textGuard.freeText(s, "sitemapGenerator: base_path", { singleLine: "reject" });
   if (s.charCodeAt(0) !== 47 /* "/" */) {
     throw new TypeError("sitemapGenerator: base_path must start with '/'");
   }
@@ -177,9 +175,7 @@ function _originUrl(u) {
   if (typeof u !== "string" || u.length < 1 || u.length > MAX_ORIGIN_URL_LEN) {
     throw new TypeError("sitemapGenerator: origin_url must be a string 1.." + MAX_ORIGIN_URL_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(u)) {
-    throw new TypeError("sitemapGenerator: origin_url contains control bytes");
-  }
+  textGuard.freeText(u, "sitemapGenerator: origin_url", { singleLine: "reject" });
   try {
     b.safeUrl.parse(u, { allowedProtocols: ["https:"] });
   } catch (e) {

package/lib/sms-dispatcher.js

@@ -62,6 +62,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -103,10 +104,6 @@ var SLUG_RE          = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
 var COUNTRY_RE       = /^[A-Z]{2}$/;
 var PHONE_HASH_RE    = /^[0-9a-f]{128}$/;
 var PHONE_NORM_RE    = /^\+[1-9][0-9]{6,14}$/;   // E.164: +<country><subscriber>, 7-15 digits total
-var CONTROL_BYTE_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Inbound STOP-keyword detection. Operators in the US/UK/AU regulatory
 // envelope have all converged on this short list; the primitive
@@ -150,9 +147,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("smsDispatcher: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: name contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: name", { zeroWidth: "reject" });
   return s;
 }
 
@@ -163,9 +158,7 @@ function _endpointUrl(s) {
   if (s.length > MAX_URL_LEN) {
     throw new TypeError("smsDispatcher: endpoint_url must be <= " + MAX_URL_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: endpoint_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: endpoint_url", { zeroWidth: "reject" });
   // Shape gate — refuse anything that isn't an absolute https URL.
   // Provider endpoints are public APIs; operators using a non-https
   // egress are leaking the message body across the wire.
@@ -260,7 +253,7 @@ function _reason(s, label) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("smsDispatcher: " + label + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("smsDispatcher: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -274,9 +267,7 @@ function _optInText(s) {
   if (s.length > MAX_OPT_IN_TEXT_LEN) {
     throw new TypeError("smsDispatcher: opt_in_text must be <= " + MAX_OPT_IN_TEXT_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: opt_in_text contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: opt_in_text", { zeroWidth: "reject" });
   return s;
 }
 
@@ -287,9 +278,7 @@ function _providerRef(s) {
   if (s.length > MAX_PROVIDER_REF_LEN) {
     throw new TypeError("smsDispatcher: provider_ref must be <= " + MAX_PROVIDER_REF_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: provider_ref contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "smsDispatcher: provider_ref", { zeroWidth: "reject" });
   return s;
 }
 
@@ -333,12 +322,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("smsDispatcher: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("smsDispatcher: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("smsDispatcher: body contains zero-width / bidi-override codepoints");
-  }
+  textGuard.freeText(s, "smsDispatcher: body", { zeroWidth: "reject" });
   // Refuse the degenerate emoji-only shape. Walk the string by code
   // point so surrogate pairs in the SMP emoji blocks count as one
   // character.

package/lib/stock-receipts.js

@@ -70,6 +70,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -100,7 +101,6 @@ var LINE_STATES             = Object.freeze([
   "pending", "received", "damaged", "partial",
 ]);
 
-var CONTROL_BYTE_RE         = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -171,9 +171,7 @@ function _reason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_REASON_LEN) {
     throw new TypeError("stockReceipts: reason must be a non-empty string <= " + MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("stockReceipts: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "stockReceipts: reason");
   return s;
 }
 
@@ -192,9 +190,7 @@ function _uaOpt(s) {
   if (typeof s !== "string" || s.length > MAX_UA_LEN) {
     throw new TypeError("stockReceipts: user_agent must be a string <= " + MAX_UA_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("stockReceipts: user_agent must not contain control bytes");
-  }
+  textGuard.freeText(s, "stockReceipts: user_agent");
   return s;
 }
 
@@ -203,9 +199,7 @@ function _ipOpt(s) {
   if (typeof s !== "string" || s.length > MAX_IP_LEN) {
     throw new TypeError("stockReceipts: client_ip must be a string <= " + MAX_IP_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("stockReceipts: client_ip must not contain control bytes");
-  }
+  textGuard.freeText(s, "stockReceipts: client_ip");
   return s;
 }
 

package/lib/storefront-dashboards.js

@@ -89,6 +89,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_SLUG_LEN     = 80;
 var MAX_TITLE_LEN    = 200;
@@ -140,14 +141,10 @@ var WIDGET_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 var LOCALE_RE = /^[a-z]{2,3}(?:-[a-z0-9]{2,8})*$/;
 
 // Refuse C0 control bytes + DEL in operator-authored text fields.
-var CONTROL_BYTE_LINE_RE = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the rest of the
 // shop primitives. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -166,12 +163,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("storefrontDashboards: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("storefrontDashboards: title contains control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("storefrontDashboards: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "storefrontDashboards: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/storefront-forms.js

@@ -74,6 +74,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_SLUG_LEN              = 80;
 var MAX_TITLE_LEN              = 200;
@@ -144,14 +145,9 @@ var WEBHOOK_EVENT_RE = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)*$/;
 // Refuse C0 control bytes + DEL in single-line strings. Textarea
 // values permit LF (the customer's free-text response is line-
 // oriented).
-var CONTROL_BYTE_LINE_RE  = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BLOCK_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family. Spelled with \u-escapes
 // so ESLint's no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -170,10 +166,10 @@ function _line(s, label, maxLen, optional) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("storefrontForms: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("storefrontForms: " + label + " contains control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("storefrontForms: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -184,12 +180,7 @@ function _description(s) {
   if (typeof s !== "string" || s.length > MAX_DESCRIPTION_LEN) {
     throw new TypeError("storefrontForms: description must be a string ≤ " + MAX_DESCRIPTION_LEN + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
-    throw new TypeError("storefrontForms: description contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("storefrontForms: description contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "storefrontForms: description", { zeroWidth: "reject" });
   return s;
 }
 
@@ -246,7 +237,7 @@ function _fields(input) {
         if (typeof opt !== "string" || !opt.length || opt.length > MAX_OPTION_LEN) {
           throw new TypeError("storefrontForms: fields[" + i + "].options[" + j + "] must be a non-empty string ≤ " + MAX_OPTION_LEN + " chars");
         }
-        if (CONTROL_BYTE_LINE_RE.test(opt) || ZERO_WIDTH_RE.test(opt)) {
+        if (textGuard.hasCodepointThreat(opt, { singleLine: "reject", zeroWidth: "reject" })) {
           throw new TypeError("storefrontForms: fields[" + i + "].options[" + j + "] contains control / zero-width characters");
         }
         if (Object.prototype.hasOwnProperty.call(seenOpts, opt)) {
@@ -275,9 +266,7 @@ function _submitTo(input) {
   if (typeof input.value !== "string" || !input.value.length || input.value.length > MAX_SUBMIT_TO_VALUE_LEN) {
     throw new TypeError("storefrontForms: submit_to.value must be a non-empty string ≤ " + MAX_SUBMIT_TO_VALUE_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(input.value) || ZERO_WIDTH_RE.test(input.value)) {
-    throw new TypeError("storefrontForms: submit_to.value contains control / zero-width characters");
-  }
+  textGuard.freeText(input.value, "storefrontForms: submit_to.value", { singleLine: "reject", zeroWidth: "reject" });
   if (input.kind === "email") {
     var v = b.guardEmail.validate(input.value, { profile: "strict" });
     if (!v.ok) {
@@ -329,9 +318,7 @@ function _ipHash(s) {
   if (typeof s !== "string" || !s.length || s.length > 256) {
     throw new TypeError("storefrontForms: ip_hash must be a non-empty string ≤ 256 chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("storefrontForms: ip_hash contains control bytes");
-  }
+  textGuard.freeText(s, "storefrontForms: ip_hash", { singleLine: "reject" });
   return s;
 }
 
@@ -358,7 +345,7 @@ function _validateValue(field, raw) {
     if (typeof raw !== "string" || raw.length > MAX_TEXT_VALUE_LEN) {
       return { ok: false, error: "text value must be a string ≤ " + MAX_TEXT_VALUE_LEN + " chars" };
     }
-    if (CONTROL_BYTE_LINE_RE.test(raw) || ZERO_WIDTH_RE.test(raw)) {
+    if (textGuard.hasCodepointThreat(raw, { singleLine: "reject", zeroWidth: "reject" })) {
       return { ok: false, error: "text value contains control / zero-width characters" };
     }
     return { ok: true, value: raw };
@@ -387,7 +374,7 @@ function _validateValue(field, raw) {
     if (typeof raw !== "string" || !raw.length || raw.length > MAX_TEXTAREA_VALUE_LEN) {
       return { ok: false, error: "textarea value must be a non-empty string ≤ " + MAX_TEXTAREA_VALUE_LEN + " chars" };
     }
-    if (CONTROL_BYTE_BLOCK_RE.test(raw) || ZERO_WIDTH_RE.test(raw)) {
+    if (textGuard.hasCodepointThreat(raw, { zeroWidth: "reject" })) {
       return { ok: false, error: "textarea value contains control / zero-width characters" };
     }
     return { ok: true, value: raw };

package/lib/storefront-pages.js

@@ -74,6 +74,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_SLUG_LEN              = 80;
 var MAX_TITLE_LEN             = 200;
@@ -112,15 +113,10 @@ var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 // body permits LF (Markdown is line-oriented); single-line fields
 // refuse LF / CR so they can't smuggle a second line into a page
 // header / meta tag.
-var CONTROL_BYTE_LINE_RE  = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BLOCK_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the promo-banners
 // + gift-options catalogues. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -135,12 +131,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("storefrontPages: title must be a non-empty string ≤ " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("storefrontPages: title contains control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("storefrontPages: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "storefrontPages: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -148,12 +139,7 @@ function _body(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_BODY_LEN) {
     throw new TypeError("storefrontPages: body must be a non-empty string ≤ " + MAX_BODY_LEN + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
-    throw new TypeError("storefrontPages: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("storefrontPages: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "storefrontPages: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -162,10 +148,10 @@ function _metaLine(s, label, maxLen) {
   if (typeof s !== "string" || s.length > maxLen) {
     throw new TypeError("storefrontPages: " + label + " must be a string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("storefrontPages: " + label + " contains control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("storefrontPages: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -239,7 +225,7 @@ function _esc(s) {
 // downgrade an inline link.
 function _safeLinkUrl(url) {
   if (typeof url !== "string" || !url.length || url.length > 2048) return null;
-  if (CONTROL_BYTE_LINE_RE.test(url) || ZERO_WIDTH_RE.test(url)) return null;
+  if (textGuard.hasCodepointThreat(url, { singleLine: "reject", zeroWidth: "reject" })) return null;
   if (url.charCodeAt(0) === 47 /* "/" */) {
     if (url.length > 1 && url.charCodeAt(1) === 47) return null;
     if (url.indexOf("..") !== -1) return null;

package/lib/storefront.js

@@ -39,6 +39,7 @@ var REGISTRY_OCCASIONS = giftRegistryModule.OCCASIONS;
 var { AsyncLocalStorage } = require("node:async_hooks");   // allow:non-shop-require — Node-core per-request context (no npm dep); the framework itself composes it in db-role-context / log. No b.* request-context primitive exists to wrap it.
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // Per-request locale context store. The storefront's locale middleware
 // resolves the request's locale + chrome strings once and seeds this
@@ -2141,7 +2142,6 @@ function _clampPage(page, total, pageSize) {
 var SEARCH_MAX_FACET_KEYS   = 32;
 var SEARCH_MAX_FACET_VALUES = 64;
 var SEARCH_MAX_VALUE_LEN    = 256;
-var SEARCH_CONTROL_BYTE_RE  = /[\x00-\x1f\x7f]/;
 // Global twin for strip-all replaces (the non-global one above is used for
 // presence tests; `.replace` needs the `g` flag to clear every byte).
 var SEARCH_CONTROL_BYTE_RE_G = /[\x00-\x1f\x7f]/g;
@@ -2162,7 +2162,7 @@ function _parseSearchFilters(url, facetDefs) {
     if (!Object.prototype.hasOwnProperty.call(known, rawKey)) return;
     if (typeof rawVal !== "string") return;
     if (!rawVal.length || rawVal.length > SEARCH_MAX_VALUE_LEN) return;
-    if (SEARCH_CONTROL_BYTE_RE.test(rawVal)) return;
+    if (textGuard.hasCodepointThreat(rawVal, { singleLine: "reject" })) return;
     if (!Object.prototype.hasOwnProperty.call(out, rawKey)) {
       if (keyCount >= SEARCH_MAX_FACET_KEYS) return;
       out[rawKey] = [];

package/lib/subscription-billing.js

@@ -75,6 +75,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -94,10 +95,6 @@ var DEFAULT_LIST_LIMIT      = 100;
 // sibling subscription-controls primitive — operator-authored prose
 // flows into receipt emails + the operator dashboard, so the same
 // "no direction-override / no invisible glyph" floor applies.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -146,9 +143,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("subscriptionBilling: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("subscriptionBilling: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "subscriptionBilling: reason", { zeroWidth: "reject" });
   return s;
 }
 
@@ -164,7 +159,7 @@ function _shortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("subscriptionBilling: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("subscriptionBilling: " + label + " contains control bytes");
   }
   return s;

package/lib/subscription-controls.js

@@ -51,6 +51,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var C = b.constants;
 
@@ -123,10 +124,6 @@ var MAX_QUANTITY         = 1000000;
 // prose. Refuses C0 / DEL and the LRM/RLM/ZWJ/ZWNJ family so a
 // malicious reason can't smuggle direction-override / invisible
 // content into the operator dashboard.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -142,9 +139,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("subscriptionControls: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("subscriptionControls: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "subscriptionControls: reason", { zeroWidth: "reject" });
   return s;
 }
 

package/lib/suggestion-box.js

@@ -119,6 +119,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -168,11 +169,6 @@ var ORDER_KEY_NEWEST          = ["created_at:desc", "id:desc"];
 var ORDER_KEY_TOP_VOTED       = ["vote_count:desc", "id:desc"];
 var ORDER_KEY_MOST_DISCUSSED  = ["comment_count:desc", "id:desc"];
 
-var CONTROL_BYTE_BODY_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE          = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -205,12 +201,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("suggestionBox: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("suggestionBox: title must not contain control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("suggestionBox: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "suggestionBox: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -225,12 +216,10 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("suggestionBox: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("suggestionBox: body must not contain control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("suggestionBox: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "suggestionBox: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -307,9 +296,7 @@ function _sessionIdRaw(s) {
   if (s.length > 256) {
     throw new TypeError("suggestionBox: session_id must be <= 256 characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("suggestionBox: session_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "suggestionBox: session_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -320,12 +307,10 @@ function _response(s) {
   if (s.length > MAX_RESPONSE_LEN) {
     throw new TypeError("suggestionBox: response must be <= " + MAX_RESPONSE_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("suggestionBox: response must not contain control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("suggestionBox: response contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "suggestionBox: response", { zeroWidth: "reject" });
   // A status-only transition is allowed with response === "" (no
   // operator-visible reply, just a state change). Trim-then-check
   // for the operator-supplied case below in respondToSuggestion.
@@ -339,9 +324,7 @@ function _responder(s) {
   if (s.length > MAX_RESPONDER_LEN) {
     throw new TypeError("suggestionBox: responder must be <= " + MAX_RESPONDER_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("suggestionBox: responder contains control / zero-width characters");
-  }
+  textGuard.freeText(s, "suggestionBox: responder", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -925,7 +908,7 @@ function create(opts) {
       if (typeof input.email_hash !== "string" || !input.email_hash.length || input.email_hash.length > 256) {
         throw new TypeError("suggestionBox." + method + ": email_hash must be a non-empty string <= 256 chars when provided");
       }
-      if (CONTROL_BYTE_STRICT_RE.test(input.email_hash) || ZERO_WIDTH_RE.test(input.email_hash)) {
+      if (textGuard.hasCodepointThreat(input.email_hash, { singleLine: "reject", zeroWidth: "reject" })) {
         throw new TypeError("suggestionBox." + method + ": email_hash contains control / zero-width bytes");
       }
       emailHash = input.email_hash;