@blamejs/blamejs-shop 0.5.20 → 0.5.22

package/lib/vendor/blamejs/lib/network-tls.js

@@ -1610,6 +1610,23 @@ function _verifyOcspSignature(parsed, issuerPem) {
     throw new TlsTrustError("tls/ocsp-bad-issuer-key",
       "issuer public key parse failed: " + ((e && e.message) || String(e)));
   }
+  // RFC 6960 §4.2.1 — signatureAlgorithm identifies the algorithm the
+  // responder used, and the digest above is derived from it. node:crypto picks
+  // RSA or ECDSA from the KEY, not from that field, so a response declaring
+  // one and carrying the other verifies without anyone noticing the
+  // disagreement. That is not a forgery path — the issuer's private key is
+  // required either way — but it means the field steering the digest was never
+  // checked against the key doing the verifying. Require them to agree, so
+  // what the response claims and what was actually verified are the same
+  // thing.
+  var wantKeyType = (algOid === OID_RSA_SHA256 || algOid === OID_RSA_SHA384 ||
+                     algOid === OID_RSA_SHA512) ? "rsa" : "ec";
+  if (keyObj.asymmetricKeyType !== wantKeyType) {
+    throw new TlsTrustError("tls/ocsp-sig-alg-key-mismatch",
+      "OCSP signatureAlgorithm OID '" + algOid + "' declares a " + wantKeyType.toUpperCase() +
+      " signature but the issuer key is " + String(keyObj.asymmetricKeyType).toUpperCase() +
+      " (RFC 6960 §4.2.1 — the declared algorithm does not match the issuer key)");
+  }
   // ECDSA OCSP signatures use DER-encoded ECDSA-Sig-Value (the ASN.1
   // shape that node:crypto.verify accepts by default — no dsaEncoding
   // option needed).
@@ -2831,13 +2848,19 @@ function _ctVerifyInclusionPath(leafHash, leafIndex, treeSize, auditPath) {
 // prefix. Returns the computed roots (oldRoot, newRoot) so the caller
 // can compare against the operator-supplied STHs.
 function _ctVerifyConsistencyPath(m, n, consistencyProof, firstHash) {
-  if (typeof m !== "number" || m < 1 || Math.floor(m) !== m) {
+  // isFinite carries the weight here: Math.floor(Infinity) === Infinity, so an
+  // integer check alone accepts a tree of infinite size. The walk used to
+  // reject it downstream by running out of proof, but that was an accident of
+  // the loop rather than a decision, and the equal-sizes shortcut below has no
+  // loop to run out of. A tree size that is not a finite positive integer is
+  // refused here, once, for every path through this function.
+  if (typeof m !== "number" || !isFinite(m) || m < 1 || Math.floor(m) !== m) {
     throw new TlsTrustError("tls/ct-bad-first-size",
-      "ct.verifyConsistency: m (first tree size) must be a positive integer");
+      "ct.verifyConsistency: m (first tree size) must be a finite positive integer");
   }
-  if (typeof n !== "number" || n < m || Math.floor(n) !== n) {
+  if (typeof n !== "number" || !isFinite(n) || n < m || Math.floor(n) !== n) {
     throw new TlsTrustError("tls/ct-bad-second-size",
-      "ct.verifyConsistency: n (second tree size) must be an integer >= m");
+      "ct.verifyConsistency: n (second tree size) must be a finite integer >= m");
   }
   if (!Buffer.isBuffer(firstHash) || firstHash.length !== 32) {                  // RFC 9162 SHA-256 digest length
     throw new TlsTrustError("tls/ct-bad-first-hash",
@@ -2847,11 +2870,34 @@ function _ctVerifyConsistencyPath(m, n, consistencyProof, firstHash) {
     throw new TlsTrustError("tls/ct-bad-consistency-proof",
       "ct.verifyConsistency: consistencyProof must be an array of Buffers");
   }
-  // RFC 9162 §2.1.4.2 — algorithm is the same as the inclusion-proof
-  // walk, with the leaf-index seeded at the first-tree size minus 1 and
-  // the special case for m being a complete subtree.
+  // A tree is consistent with itself, and RFC 9162 §2.1.4 says so with an
+  // EMPTY proof: PROOF(m, D[m]) = SUBPROOF(m, D[m], true) = {}. The walk below
+  // is §2.1.4.2, which is written for a first tree strictly smaller than the
+  // second — run on m === n it looks for a sibling that the definition says is
+  // not there. That refused a conformant log's answer whenever the size was
+  // not a power of two (for a power of two the index bits happen to shift down
+  // to zero and the walk short-circuits), so an operator re-checking a pinned
+  // STH against an unchanged one was told the log was inconsistent. A false
+  // alarm on this check is worse than a quiet one: it is the alarm that
+  // teaches an operator to ignore it.
+  if (m === n) {
+    if (consistencyProof.length !== 0) {
+      throw new TlsTrustError("tls/ct-consistency-not-empty",
+        "ct.verifyConsistency: the proof for two equal tree sizes must be empty " +
+        "(RFC 9162 §2.1.4), got " + consistencyProof.length + " entries");
+    }
+    return firstHash;
+  }
+  // RFC 9162 §2.1.4.2 — the walk rebuilds BOTH roots from the same proof: the
+  // first tree's root (fr) and the second's (sr). Both must be checked. Only
+  // sr was, and firstHash reached the computation solely as the seed in the
+  // complete-subtree branch below — so whenever the pinned size was NOT a
+  // power of two, the operator's pinned root was never looked at, and a proof
+  // for some OTHER first tree of the same size verified. That is the whole
+  // premise of pinning an STH ("the tree I pinned is a prefix of the tree you
+  // are showing me"), and it was being taken on trust.
   var path = consistencyProof.slice();
-  var node;
+  var firstNode, secondNode;
   var fn = m - 1;
   var sn = n - 1;
   // Walk past the right-side bits — the consistency proof omits the
@@ -2860,14 +2906,15 @@ function _ctVerifyConsistencyPath(m, n, consistencyProof, firstHash) {
 
   if (fn === 0) {
     // m was a complete subtree — its root is the firstHash itself.
-    node = firstHash;
+    firstNode = firstHash;
   } else {
     if (path.length === 0) {
       throw new TlsTrustError("tls/ct-consistency-empty",
         "ct.verifyConsistency: consistency proof empty but first tree is not a complete subtree");
     }
-    node = path.shift();
+    firstNode = path.shift();
   }
+  secondNode = firstNode;
   while (sn > 0) {
     if (path.length === 0) {
       throw new TlsTrustError("tls/ct-consistency-short",
@@ -2879,15 +2926,34 @@ function _ctVerifyConsistencyPath(m, n, consistencyProof, firstHash) {
         "ct.verifyConsistency: consistency-proof entry is not a 32-byte Buffer");
     }
     if ((fn & 1) === 1 || fn === sn) {
-      node = _ctInnerHashFinal(sibling, node);
+      firstNode  = _ctInnerHashFinal(sibling, firstNode);
+      secondNode = _ctInnerHashFinal(sibling, secondNode);
       while ((fn & 1) === 0 && fn !== 0) { fn >>>= 1; sn >>>= 1; }
     } else {
-      node = _ctInnerHashFinal(node, sibling);
+      secondNode = _ctInnerHashFinal(secondNode, sibling);
     }
     fn >>>= 1;
     sn >>>= 1;
   }
-  return node;
+  // The rebuilt first root must be the one the operator pinned, or the proof
+  // connects their second root to a first tree they never saw.
+  if (firstNode.length !== firstHash.length ||
+      !bCrypto.timingSafeEqual(firstNode, firstHash)) {
+    throw new TlsTrustError("tls/ct-first-root-mismatch",
+      "ct.verifyConsistency: the proof rebuilds a first-tree root that is not the one supplied " +
+      "(RFC 9162 §2.1.4.2 — the proof does not connect the pinned tree to the new one)");
+  }
+  // Everything the peer sent must have been consumed. Its sibling walk above
+  // refuses an audit path with entries beyond the root for the same reason:
+  // a proof carrying material the verifier never looked at is not the proof
+  // the operator believes was checked, and silently ignoring the remainder
+  // means the two walkers disagree about what a well-formed proof is.
+  if (path.length !== 0) {
+    throw new TlsTrustError("tls/ct-consistency-long",
+      "ct.verifyConsistency: consistency proof has " + path.length +
+      " trailing entries beyond the second-tree root");
+  }
+  return secondNode;
 }
 
 function _findSctOid(rawDer) {
@@ -3087,6 +3153,15 @@ var ct = Object.freeze({
                    consistency: consistencyResult };
         }
       } catch (e) {
+        // A proof that rebuilds the wrong first tree is a different answer
+        // from a malformed one, and it is the answer that matters most here:
+        // it says the log's history before the pinned point does not match
+        // what was pinned. Composing the consistency check inside an
+        // inclusion check must not flatten that into "malformed proof".
+        if (e && e.code === "tls/ct-first-root-mismatch") {
+          return { valid: false, reason: "first-root-mismatch",
+                   error: e.message || String(e) };
+        }
         return { valid: false, reason: "consistency-walk-failed",
                  error: (e && e.message) || String(e) };
       }
@@ -3128,6 +3203,16 @@ var ct = Object.freeze({
       computed = _ctVerifyConsistencyPath(opts.firstSize, opts.secondSize,
         opts.proof || [], firstRoot);
     } catch (e) {
+      // A first root that does not rebuild is a distinct answer from a
+      // malformed proof: the proof is well-formed, it just describes a
+      // different tree than the one the operator pinned.
+      // `e` is already proven truthy by the guard on this branch, so the
+      // usual (e && e.message) shape would be dead here; the fallback below
+      // keeps it because a throw of a falsy value still reaches that one.
+      if (e && e.code === "tls/ct-first-root-mismatch") {
+        return { valid: false, reason: "first-root-mismatch",
+                 error: e.message || String(e) };
+      }
       return { valid: false, reason: "consistency-walk-failed",
                error: (e && e.message) || String(e) };
     }

package/lib/vendor/blamejs/lib/vendor/MANIFEST.json

@@ -21,7 +21,7 @@
         "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
         "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-10T18:39:35.028Z"
+      "refreshedAt": "2026-08-11T00:05:07.579Z"
     },
     "@noble/hashes": {
       "version": "2.3.0",
@@ -48,7 +48,7 @@
       "hashes": {
         "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
       },
-      "refreshedAt": "2026-08-10T18:39:35.028Z"
+      "refreshedAt": "2026-08-11T00:05:07.579Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -70,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-10T18:39:35.028Z",
+      "refreshedAt": "2026-08-11T00:05:07.579Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -114,7 +114,7 @@
         "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
         "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-10T18:39:35.028Z",
+      "refreshedAt": "2026-08-11T00:05:07.579Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -151,7 +151,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-08-10T18:39:35.028Z"
+      "refreshedAt": "2026-08-11T00:05:07.579Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -171,7 +171,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-10T18:39:35.028Z"
+      "refreshedAt": "2026-08-11T00:05:07.579Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -196,7 +196,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-10T18:39:35.028Z"
+      "refreshedAt": "2026-08-11T00:05:07.579Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -216,10 +216,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-10T18:39:35.028Z"
+      "refreshedAt": "2026-08-11T00:05:07.579Z"
     },
     "@blamejs/pki": {
-      "version": "0.4.13",
+      "version": "0.4.14",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -240,11 +240,11 @@
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
       "bundledAt": "2026-08-10T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.4.13:*:*:*:*:node.js:*:*",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.4.14:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:067ac05899ef04f7851a8d010dc4289e7a01706d5fd2cdc1ce59860631bba284"
+        "server": "sha256:96a873b733c95b53b8e2ced065a82192b6acabcede312cf68a45a128857cc3bc"
       },
-      "refreshedAt": "2026-08-10T18:39:35.028Z"
+      "refreshedAt": "2026-08-11T00:05:07.579Z"
     }
   }
 }