@blamejs/blamejs-shop 0.5.20 → 0.5.21

package/lib/support-tickets.js

@@ -62,6 +62,7 @@ var DEFAULT_LIST_LIMIT  = 25;
 var EMAIL_NAMESPACE     = "support-ticket-email";
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var ALLOWED_AUTHORS    = ["customer", "operator", "system"];
 var ALLOWED_CATEGORIES = [
@@ -104,14 +105,9 @@ var LIST_ORDER_KEY = ["opened_at:desc", "id:desc"];
 // Refuse C0 control bytes + DEL. Newlines (LF/CR) + tab are tolerated
 // in body so multi-line customer narratives work; subject is single-
 // line by convention and refuses them.
-var CONTROL_BYTE_RE       = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
 // Zero-width + direction-override family (see orderNotes for the
 // same justification). Spelled via \u escapes so the file stays
 // ESLint no-irregular-whitespace clean.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -159,12 +155,7 @@ function _subject(s) {
   if (s.length > MAX_SUBJECT_LEN) {
     throw new TypeError("supportTickets: subject must be <= " + MAX_SUBJECT_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("supportTickets: subject contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("supportTickets: subject contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "supportTickets: subject", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -179,12 +170,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("supportTickets: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("supportTickets: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("supportTickets: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "supportTickets: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -205,7 +191,7 @@ function _tags(input) {
     if (t.length > MAX_TAG_LEN) {
       throw new TypeError("supportTickets: tags[" + i + "] must be <= " + MAX_TAG_LEN + " characters");
     }
-    if (CONTROL_BYTE_STRICT_RE.test(t) || ZERO_WIDTH_RE.test(t)) {
+    if (textGuard.hasCodepointThreat(t, { singleLine: "reject", zeroWidth: "reject" })) {
       throw new TypeError("supportTickets: tags[" + i + "] contains control / zero-width bytes");
     }
     out.push(t);
@@ -220,9 +206,7 @@ function _singleTag(t) {
   if (t.length > MAX_TAG_LEN) {
     throw new TypeError("supportTickets: tag must be <= " + MAX_TAG_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(t) || ZERO_WIDTH_RE.test(t)) {
-    throw new TypeError("supportTickets: tag contains control / zero-width bytes");
-  }
+  textGuard.freeText(t, "supportTickets: tag", { singleLine: "reject", zeroWidth: "reject" });
   return t;
 }
 
@@ -235,9 +219,7 @@ function _reason(r) {
   if (r.length > MAX_REASON_LEN) {
     throw new TypeError("supportTickets: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(r) || ZERO_WIDTH_RE.test(r)) {
-    throw new TypeError("supportTickets: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(r, "supportTickets: reason", { zeroWidth: "reject" });
   return r;
 }
 

package/lib/tax-remittance.js

@@ -86,6 +86,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var C = b.constants;
 
@@ -107,7 +108,6 @@ var DEFAULT_DAYS_LATE_MIN   = 1;
 var MAX_DAYS_LATE_MIN       = 3650;            // ~10 years
 var MS_PER_DAY              = C.TIME.days(1);
 
-var CONTROL_BYTE_RE         = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -182,7 +182,7 @@ function _shortText(s, label, max) {
     throw new TypeError("taxRemittance: " + label +
                         " must be a non-empty string <= " + max + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("taxRemittance: " + label + " must not contain control bytes");
   }
   return s;

package/lib/tenants.js

@@ -56,6 +56,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_SLUG_LEN     = 64;
 var MAX_NAME_LEN     = 200;
@@ -95,10 +96,6 @@ var THEME_SLUG_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
 // renders in operator dashboards; embedded control / direction-
 // override bytes are a slipping-class for visual-spoofing attacks
 // downstream.
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_UPDATE_COLUMNS = Object.freeze([
   "name", "default_currency", "default_locale", "theme_slug",
@@ -131,9 +128,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("tenants: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("tenants: name contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "tenants: name", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/text-guard.js

@@ -36,7 +36,11 @@
  *     - slugLabel(s, label, opts?) — lowercase URL-slug label
  *     - hostLabel(host, label?) — outbound host SSRF + by-name denylist
  *     - freeText(s, label, policy?) — dangerous-codepoint screen for
- *       unconstrained UTF-8 text fields
+ *       unconstrained UTF-8 text fields, throwing on a refusal
+ *     - hasCodepointThreat(s, policy?) — the same screen for a defensive
+ *       reader that DROPS a bad value instead of refusing the request
+ *     - firstCodepointThreat(s, policy?) — the one decision both run, so
+ *       the throwing and dropping paths cannot disagree
  *
  * @primitive textGuard
  * @related   b.money, b.ssrfGuard, b.safeUrl, shop.currencyRounding,
@@ -52,6 +56,41 @@ var b = require("./vendor/blamejs");
 // second copy of the tables.
 var codepointClass = b.codepointClass;
 
+// Two invisible-codepoint groups this shop refuses that the framework catalog
+// does not carry yet. Built with codepointClass.charClass off a range table so
+// the escaping is the catalog's, not a second hand-spelled class:
+//
+//   U+007F DELETE — grouped with the C0 controls everywhere it matters, but
+//     outside the 0x00-0x1F block the framework's C0_CTRL_RANGES covers.
+//   U+2061-2064 FUNCTION APPLICATION / INVISIBLE TIMES / INVISIBLE SEPARATOR /
+//     INVISIBLE PLUS — zero-width invisible operators, the same spoofing class
+//     as U+2060 WORD JOINER, which the framework's ZERO_WIDTH_RANGES does have.
+//
+// Requested upstream (blamejs#580). When a vendor refresh lands them in the
+// catalog this supplement becomes dead weight and comes out — the drift test
+// in test/layer-1-state/text-guard.test.js fails the moment that happens, so
+// it cannot be silently carried forever.
+//
+// Kept as two classes rather than one so each joins the check whose refusal
+// message is already true of it.
+// allow:dynamic-regex — codepoints from a literal range table
+var DEL_RE = new RegExp("[" + codepointClass.charClass([0x007F]) + "]");
+// allow:dynamic-regex — codepoints from a literal range table
+var INVISIBLE_OP_RE = new RegExp("[" + codepointClass.charClass([[0x2061, 0x2064]]) + "]");
+// Global twin for the strip pass; the unglobbed one above is the presence test.
+// allow:dynamic-regex — codepoints from a literal range table
+var INVISIBLE_OP_RE_G = new RegExp("[" + codepointClass.charClass([[0x2061, 0x2064]]) + "]", "g");
+
+// Everything that ends a line or pads it out, for a value that must stay on
+// one. Tab / LF / CR sit outside the framework's C0 table on purpose — a
+// multi-line body needs them — so a single-line field asks for them here.
+// U+2028 / U+2029 are not control characters at all, but they terminate a
+// line for both a renderer and a JS string literal.
+// allow:dynamic-regex — codepoints from a literal range table
+var LINE_BREAK_RE = new RegExp(
+  "[" + codepointClass.charClass([0x0009, 0x000A, 0x000D, [0x2028, 0x2029]]) + "]"
+);
+
 // ---- shop validators ----------------------------------------------------
 
 // asciiUpperLetters(s, label, n?) — exactly `n` (default 3) ASCII
@@ -157,45 +196,105 @@ function hostLabel(host, label) {
   return h;
 }
 
-// freeText(s, label, policy?) — the dangerous-codepoint screen for an
-// UNCONSTRAINED UTF-8 text field (customer note, review body, gift
-// message, product Q&A). Unlike the ASCII-allowlist validators above,
-// these fields legitimately carry arbitrary letters, so the codepoint
-// catalog is the right backing: bidi overrides (CVE-2021-42574 Trojan
-// Source), null bytes, and C0 control characters are refused by default;
-// zero-width / invisible formatting is refused when policy.zeroWidth is
-// "reject"; a mixed-script confusable (Cyrillic 'а' inside an otherwise
-// Latin label) is refused when policy.mixedScript is "reject". Throws
-// TypeError on a refused codepoint. Returns the input on success.
-function freeText(s, label, policy) {
-  var name = label || "value";
-  if (typeof s !== "string") {
-    throw new TypeError(name + " must be a string");
-  }
+// firstCodepointThreat(s, policy?) — the single decision both the throwing
+// screen (freeText) and the drop-silent one (hasCodepointThreat) run, so a
+// field guarded one way and a field guarded the other can never disagree
+// about what "dangerous" means. Returns a short reason string naming the
+// class, or null when the text is clean. The reason is the clause that
+// follows the field name in a refusal ("contains a null byte"), so a caller
+// building a message just joins the two.
+//
+// Policies, each "reject" to enable and any other value to allow:
+//   bidi        — default "reject". Bidi overrides (CVE-2021-42574).
+//   nullByte    — default "reject". U+0000.
+//   control     — default "reject". C0 controls + U+007F DELETE. Tab, LF and
+//                 CR are ALLOWED here: a multi-line body legitimately has
+//                 them. Use singleLine for a field that must not.
+//   singleLine  — off by default. Tab / LF / CR, plus U+2028 LINE SEPARATOR
+//                 and U+2029 PARAGRAPH SEPARATOR, which break a line without
+//                 being C0 at all. For a value rendered on one line — a URL,
+//                 a subject, a title, a header value.
+//   zeroWidth   — off by default. Zero-width / invisible formatting. Includes
+//                 U+00AD SOFT HYPHEN, which text pasted out of a hyphenating
+//                 word processor or PDF carries invisibly.
+//   mixedScript — off by default. Confusable / homograph across writing
+//                 systems, narrowed by policy.allowedScripts.
+function firstCodepointThreat(s, policy) {
   policy = policy || {};
-  var bidiP    = policy.bidi    || "reject";
-  var nullP    = policy.nullByte || "reject";
-  var controlP = policy.control || "reject";
-  if (bidiP === "reject" && codepointClass.BIDI_RE.test(s)) {
-    throw new TypeError(name + " contains a Unicode bidi override (CVE-2021-42574 Trojan Source)");
+  if ((policy.bidi || "reject") === "reject" && codepointClass.BIDI_RE.test(s)) {
+    return "contains a Unicode bidi override (CVE-2021-42574 Trojan Source)";
   }
-  if (nullP === "reject" && s.indexOf(codepointClass.NULL_BYTE) !== -1) {
-    throw new TypeError(name + " contains a null byte");
+  if ((policy.nullByte || "reject") === "reject" &&
+      s.indexOf(codepointClass.NULL_BYTE) !== -1) {
+    return "contains a null byte";
   }
-  if (controlP === "reject" && codepointClass.C0_CTRL_RE.test(s)) {
-    throw new TypeError(name + " contains a C0 control character");
+  if ((policy.control || "reject") === "reject" &&
+      (codepointClass.C0_CTRL_RE.test(s) || DEL_RE.test(s))) {
+    return "contains a C0 control character";
   }
-  if (policy.zeroWidth === "reject" && codepointClass.ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError(name + " contains a zero-width / invisible formatting character");
+  if (policy.singleLine === "reject" && LINE_BREAK_RE.test(s)) {
+    return "contains a line break or tab but must be a single line";
+  }
+  if (policy.zeroWidth === "reject" &&
+      (codepointClass.ZERO_WIDTH_RE.test(s) || INVISIBLE_OP_RE.test(s))) {
+    return "contains a zero-width / invisible formatting character";
   }
   if (policy.mixedScript === "reject") {
     var scripts = codepointClass.detectMixedScripts(s, policy.allowedScripts);
     if (scripts) {
-      throw new TypeError(
-        name + " mixes writing systems (" + scripts.join(", ") + ") — possible confusable / homograph"
-      );
+      return "mixes writing systems (" + scripts.join(", ") +
+             ") — possible confusable / homograph";
     }
   }
+  return null;
+}
+
+// hasCodepointThreat(s, policy?) — the non-throwing sibling of freeText, for
+// the defensive readers that DROP a bad value rather than refusing the
+// request (a link URL inside a rendered body, a header line being assembled).
+// A non-string is dangerous by definition here: the caller is about to render
+// or transmit it. Returns true when the text must not be used.
+function hasCodepointThreat(s, policy) {
+  if (typeof s !== "string") return true;
+  return firstCodepointThreat(s, policy) !== null;
+}
+
+// scrubInvisible(s) — remove every bidi override and invisible-formatting
+// codepoint and return the cleaned string. The third disposition, alongside
+// throwing and dropping: for a value that must be ACCEPTED whatever it
+// contains, because refusing it would hand an attacker a denial-of-service
+// against a legitimate user (a search query is the standing example — a
+// pasted BOM must not cost the shopper their search).
+//
+// Composes the framework's strip pass and then removes the codepoints the
+// catalog does not carry yet, so what this deletes is exactly what
+// hasCodepointThreat would have objected to under zeroWidth: "reject".
+// Control characters are deliberately NOT touched: a caller stripping those
+// usually wants to substitute a space to avoid welding two words together,
+// which is its own decision.
+function scrubInvisible(s) {
+  if (typeof s !== "string") return s;
+  var out = codepointClass.applyCharStripPolicies(s, {
+    bidiPolicy:      "strip",
+    zeroWidthPolicy: "strip",
+    tagsPolicy:      "strip",
+  });
+  return out.replace(INVISIBLE_OP_RE_G, "");
+}
+
+// freeText(s, label, policy?) — the dangerous-codepoint screen for an
+// UNCONSTRAINED UTF-8 text field (customer note, review body, gift
+// message, product Q&A). Unlike the ASCII-allowlist validators above,
+// these fields legitimately carry arbitrary letters, so the codepoint
+// catalog is the right backing. Throws TypeError on a refused codepoint;
+// returns the input on success. See firstCodepointThreat for the policies.
+function freeText(s, label, policy) {
+  var name = label || "value";
+  if (typeof s !== "string") {
+    throw new TypeError(name + " must be a string");
+  }
+  var reason = firstCodepointThreat(s, policy);
+  if (reason) throw new TypeError(name + " " + reason);
   return s;
 }
 
@@ -213,9 +312,12 @@ module.exports = {
   applyCharStripPolicies: codepointClass.applyCharStripPolicies,
 
   // Shop validators.
-  asciiUpperLetters: asciiUpperLetters,
-  currencyCode:      currencyCode,
-  slugLabel:         slugLabel,
-  hostLabel:         hostLabel,
-  freeText:          freeText,
+  asciiUpperLetters:    asciiUpperLetters,
+  currencyCode:         currencyCode,
+  slugLabel:            slugLabel,
+  hostLabel:            hostLabel,
+  freeText:             freeText,
+  hasCodepointThreat:   hasCodepointThreat,
+  firstCodepointThreat: firstCodepointThreat,
+  scrubInvisible:       scrubInvisible,
 };

package/lib/theme-assets.js

@@ -84,6 +84,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_SLUG_LEN         = 80;
 var MAX_THEME_SLUG_LEN   = 80;
@@ -130,14 +131,10 @@ var SHA3_512_HEX_RE = /^[0-9a-f]{128}$/;
 var CONTENT_TYPE_RE = /^[A-Za-z0-9!#$&^_.+-]+\/[A-Za-z0-9!#$&^_.+-]+(?:\s*;\s*[A-Za-z0-9!#$&^_.+-]+\s*=\s*(?:"[^"\x00-\x1f]*"|[A-Za-z0-9!#$&^_.+-]+))*$/;
 
 // Refuse C0 control bytes + DEL in operator-authored text fields.
-var CONTROL_BYTE_LINE_RE = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the rest of the
 // shop primitives. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var MS_PER_DAY = b.constants.TIME.days(1);
 
@@ -181,9 +178,7 @@ function _contentType(s) {
       MAX_CONTENT_TYPE_LEN + " chars"
     );
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("themeAssets: content_type contains control bytes");
-  }
+  textGuard.freeText(s, "themeAssets: content_type", { singleLine: "reject" });
   if (!CONTENT_TYPE_RE.test(s)) {
     throw new TypeError(
       "themeAssets: content_type " + JSON.stringify(s) +
@@ -230,9 +225,7 @@ function _sourceUrl(s) {
       MAX_SOURCE_URL_LEN + " chars"
     );
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("themeAssets: source_url contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "themeAssets: source_url", { singleLine: "reject", zeroWidth: "reject" });
   if (s.charCodeAt(0) === 47 /* "/" */) {
     if (s.length > 1 && s.charCodeAt(1) === 47) {
       throw new TypeError(
@@ -264,12 +257,7 @@ function _altText(s) {
       MAX_ALT_TEXT_LEN + " chars (or null)"
     );
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
-    throw new TypeError("themeAssets: alt_text contains control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("themeAssets: alt_text contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "themeAssets: alt_text", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/translations.js

@@ -58,6 +58,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MAX_KIND_LEN          = 64;
 var MAX_RESOURCE_ID_LEN   = 128;
@@ -90,14 +91,10 @@ var LOCALE_RE = /^[a-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;
 // allowed (operators author multi-line page bodies) — the rest of
 // the C0 range would only reach the storefront as a smuggling
 // payload or a copy-paste accident from a terminal.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family. Spelled with \u-escapes
 // so ESLint's no-irregular-whitespace stays happy. Same defence the
 // rest of the shop uses on operator-authored strings.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -193,10 +190,10 @@ function _value(s, fnLabel) {
   if (s.length > MAX_VALUE_LEN) {
     throw new TypeError(fnLabel + ": value must be <= " + MAX_VALUE_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError(fnLabel + ": value contains forbidden control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError(fnLabel + ": value contains zero-width / direction-override characters");
   }
   return s;

package/lib/trust-badges.js

@@ -116,13 +116,9 @@ var EVENT_TYPES = Object.freeze(["impression", "click"]);
 var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 
 // Refuse C0 control bytes + DEL in single-line operator strings.
-var CONTROL_BYTE_LINE_RE = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — same catalogue as the
 // other operator-authored primitives.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Hash namespace — opaque per-primitive constant so a session_id_hash
 // emitted by trustBadges can't collide with one emitted by analytics
@@ -142,6 +138,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -184,10 +181,10 @@ function _line(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("trustBadges: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("trustBadges: " + label + " contains control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("trustBadges: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -201,7 +198,7 @@ function _httpsOrRootUrl(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("trustBadges: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject", zeroWidth: "reject" })) {
     throw new TypeError("trustBadges: " + label + " contains control / zero-width bytes");
   }
   if (s.charCodeAt(0) === 47 /* "/" */) {

package/lib/vendor-invoices.js

@@ -95,10 +95,6 @@ var CURRENCY_RE            = /^[A-Z]{3}$/;
 // as the sibling accounts-payable primitives — operator-rendered text
 // fields refuse these to keep the dashboard + printout safe from
 // header-injection + visual-spoofing attacks.
-var CONTROL_BYTE_RE        = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var INVOICE_STATUSES = Object.freeze([
   "received", "approved", "paid", "disputed", "voided",
@@ -107,6 +103,7 @@ var INVOICE_STATUSES = Object.freeze([
 var MAX_DUE_WITHIN_DAYS     = 3650;    // ~10 years — bound the predicate
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var MS_PER_DAY              = b.constants.TIME.days(1);
 
@@ -219,10 +216,10 @@ function _shortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("vendor-invoices: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("vendor-invoices: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("vendor-invoices: " + label + " contains zero-width / direction-override bytes");
   }
   return s;

package/lib/vendors.js

@@ -97,10 +97,6 @@ var PHONE_RE                = /^\+?[1-9]\d{1,14}$/;
 // direction-override bytes are a slipping-class for header injection
 // + visual-spoofing attacks downstream. Spelled with \u-escapes so
 // ESLint's no-irregular-whitespace stays happy.
-var CONTROL_BYTE_STRICT_RE  = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // Mutable columns for `updateVendor(slug, patch)`. Slug is immutable
 // — it's the public handle + the join-table key; mutating it would
@@ -119,6 +115,7 @@ var ALLOWED_UPDATE_COLUMNS = Object.freeze([
 
 // Framework handle (the vendored blamejs); index.js re-exports this as .framework.
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -159,12 +156,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("vendors: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("vendors: name contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("vendors: name contains zero-width / direction-override bytes");
-  }
+  textGuard.freeText(s, "vendors: name", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -186,9 +178,7 @@ function _payoutAddress(s) {
   if (s.length > MAX_PAYOUT_ADDRESS_LEN) {
     throw new TypeError("vendors: payout_address must be <= " + MAX_PAYOUT_ADDRESS_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("vendors: payout_address contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "vendors: payout_address", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -221,9 +211,7 @@ function _addressJson(value) {
   if (encoded.length > MAX_ADDRESS_JSON_LEN) {
     throw new TypeError("vendors: address JSON must be <= " + MAX_ADDRESS_JSON_LEN + " characters serialised");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(encoded) || ZERO_WIDTH_RE.test(encoded)) {
-    throw new TypeError("vendors: address contains control / zero-width bytes");
-  }
+  textGuard.freeText(encoded, "vendors: address", { singleLine: "reject", zeroWidth: "reject" });
   return encoded;
 }
 
@@ -265,9 +253,7 @@ function _orderId(s) {
   if (s.length > 256) {
     throw new TypeError("vendors: order_id must be <= 256 characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("vendors: order_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "vendors: order_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/webhook-receiver.js

@@ -79,6 +79,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 var SECRET_NAMESPACE   = "webhook-receiver-secret";
@@ -118,10 +119,6 @@ var MAX_REASON_LEN  = 1024;
 
 var SIGNATURE_HEX_RE = /^[0-9a-f]{64}$/i;     // 32 bytes of HMAC-SHA-256 = 64 hex chars
 
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE          = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var STATUSES = ["received", "processed", "failed"];
 
@@ -198,9 +195,7 @@ function _outcome(s) {
   if (s.length > MAX_OUTCOME_LEN) {
     throw new TypeError("webhookReceiver: outcome must be <= " + MAX_OUTCOME_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookReceiver: outcome contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookReceiver: outcome", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -215,9 +210,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("webhookReceiver: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("webhookReceiver: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "webhookReceiver: reason", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }