@blamejs/blamejs-shop 0.5.21 → 0.5.22

package/lib/operator-help-center.js

@@ -164,7 +164,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("operatorHelpCenter: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  textGuard.freeText(s, "operatorHelpCenter: title", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "operatorHelpCenter: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -179,7 +179,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("operatorHelpCenter: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "operatorHelpCenter: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "operatorHelpCenter: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -290,7 +290,7 @@ function _queryStr(s) {
   if (s.length > MAX_QUERY_LEN) {
     throw new TypeError("operatorHelpCenter: query must be <= " + MAX_QUERY_LEN + " characters");
   }
-  textGuard.freeText(s, "operatorHelpCenter: query", { zeroWidth: "reject" });
+  textGuard.freeText(s, "operatorHelpCenter: query", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/operator-inbox.js

@@ -248,7 +248,7 @@ function _subject(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_SUBJECT_LEN) {
     throw new TypeError("operatorInbox: subject must be a non-empty string <= " + MAX_SUBJECT_LEN + " chars");
   }
-  textGuard.freeText(s, "operatorInbox: subject");
+  textGuard.freeText(s, "operatorInbox: subject", { bidiMarks: "allow" });
   return s;
 }
 
@@ -256,7 +256,7 @@ function _body(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_BODY_LEN) {
     throw new TypeError("operatorInbox: body must be a non-empty string <= " + MAX_BODY_LEN + " chars");
   }
-  textGuard.freeText(s, "operatorInbox: body");
+  textGuard.freeText(s, "operatorInbox: body", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/operator-roles.js

@@ -185,7 +185,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("operatorRoles: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  textGuard.freeText(s, "operatorRoles: title", { singleLine: "reject" });
+  textGuard.freeText(s, "operatorRoles: title", { singleLine: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/order-notes.js

@@ -95,7 +95,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("orderNotes: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "orderNotes: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "orderNotes: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -131,7 +131,7 @@ function _resolution(s) {
   if (s.length > MAX_RESOLUTION_LEN) {
     throw new TypeError("orderNotes: resolution must be <= " + MAX_RESOLUTION_LEN + " characters");
   }
-  textGuard.freeText(s, "orderNotes: resolution", { zeroWidth: "reject" });
+  textGuard.freeText(s, "orderNotes: resolution", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/order-ratings.js

@@ -130,7 +130,7 @@ function _comment(s) {
   if (s.length > MAX_COMMENT_LEN) {
     throw new TypeError("orderRatings: comment must be <= " + MAX_COMMENT_LEN + " chars");
   }
-  textGuard.freeText(s, "orderRatings: comment");
+  textGuard.freeText(s, "orderRatings: comment", { bidiMarks: "allow" });
   return s;
 }
 
@@ -138,7 +138,7 @@ function _flagReason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_FLAG_REASON_LEN) {
     throw new TypeError("orderRatings: reason must be a non-empty string <= " + MAX_FLAG_REASON_LEN + " chars");
   }
-  textGuard.freeText(s, "orderRatings: reason");
+  textGuard.freeText(s, "orderRatings: reason", { bidiMarks: "allow" });
   return s;
 }
 
@@ -146,7 +146,7 @@ function _responseText(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_RESPONSE_LEN) {
     throw new TypeError("orderRatings: response must be a non-empty string <= " + MAX_RESPONSE_LEN + " chars");
   }
-  textGuard.freeText(s, "orderRatings: response");
+  textGuard.freeText(s, "orderRatings: response", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/payment-methods.js

@@ -140,7 +140,7 @@ function _label(s) {
   if (s.length > MAX_LABEL_LEN) {
     throw new TypeError("paymentMethods: label must be <= " + MAX_LABEL_LEN + " characters");
   }
-  textGuard.freeText(s, "paymentMethods: label", { singleLine: "reject" });
+  textGuard.freeText(s, "paymentMethods: label", { singleLine: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/payment-retries.js

@@ -229,7 +229,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("paymentRetries: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "paymentRetries: reason", { zeroWidth: "reject" });
+  textGuard.freeText(s, "paymentRetries: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/pixel-events.js

@@ -403,12 +403,20 @@ function _responseBody(s) {
   if (s.length > MAX_RESPONSE_BODY_LEN) {
     throw new TypeError("pixelEvents: response_body must be <= " + MAX_RESPONSE_BODY_LEN + " characters");
   }
-  // Response bodies from upstream providers are operator-observed
-  // already (the dispatch hook captured them); allow the full ASCII
-  // range minus the zero-width / bidi block so a malicious provider
-  // can't smuggle invisible bytes through the audit trail.
-  textGuard.freeText(s, "pixelEvents: response_body", { zeroWidth: "reject" });
-  return s;
+  // SCRUBBED, never refused. This string is whatever an upstream provider sent
+  // back, and `markDispatched` runs this validator BEFORE it transitions the
+  // event — so any refusal here leaves the row in `queued` and the scheduler
+  // re-sends the identical pixel on every tick, forever, because we disliked a
+  // byte in the reply. A provider must never be able to hold an event open by
+  // choosing its response body.
+  //
+  // The interest in this field is only that an operator reading the audit
+  // trail is not shown invisible characters. Removing them satisfies that
+  // without ever failing: the bidi overrides, the direction marks, the
+  // zero-width family and the Unicode Tags block all come out, and everything
+  // legible — including the tabs and newlines a real response is full of —
+  // stays exactly as the provider sent it.
+  return textGuard.scrubInvisible(s);
 }
 
 function _responseStatus(n) {

package/lib/plan-changes.js

@@ -115,7 +115,7 @@ function _optReason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("planChanges: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "planChanges: reason", { zeroWidth: "reject" });
+  textGuard.freeText(s, "planChanges: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/product-qa.js

@@ -131,7 +131,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("productQA: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "productQA: reason");
+  textGuard.freeText(s, "productQA: reason", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/push-notifications.js

@@ -195,7 +195,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("pushNotifications: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  textGuard.freeText(s, "pushNotifications: title", { zeroWidth: "reject" });
+  textGuard.freeText(s, "pushNotifications: title", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -206,7 +206,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("pushNotifications: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "pushNotifications: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "pushNotifications: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/reviews.js

@@ -75,7 +75,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("reviews: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  textGuard.freeText(s, "reviews: title");
+  textGuard.freeText(s, "reviews: title", { bidiMarks: "allow" });
   return s;
 }
 
@@ -87,7 +87,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("reviews: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "reviews: body");
+  textGuard.freeText(s, "reviews: body", { bidiMarks: "allow" });
   return s;
 }
 
@@ -284,7 +284,7 @@ function create(opts) {
         if (reason.length > MAX_REJECT_REASON_LEN) {
           throw new TypeError("reviews.reject: reason must be <= " + MAX_REJECT_REASON_LEN + " characters");
         }
-        textGuard.freeText(reason, "reviews.reject: reason");
+        textGuard.freeText(reason, "reviews.reject: reason", { bidiMarks: "allow" });
       }
       var ts = _now();
       var existing = (await query("SELECT id, status FROM reviews WHERE id = ?1", [id])).rows[0];

package/lib/seller-signup.js

@@ -154,7 +154,7 @@ function _businessName(s) {
   if (s.length > MAX_BUSINESS_NAME_LEN) {
     throw new TypeError("seller-signup: business_name must be <= " + MAX_BUSINESS_NAME_LEN + " characters");
   }
-  textGuard.freeText(s, "seller-signup: business_name", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "seller-signup: business_name", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -211,7 +211,7 @@ function _businessAddress(value) {
   if (encoded.length > MAX_ADDRESS_JSON_LEN) {
     throw new TypeError("seller-signup: business_address JSON must be <= " + MAX_ADDRESS_JSON_LEN + " characters serialised");
   }
-  textGuard.freeText(encoded, "seller-signup: business_address", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(encoded, "seller-signup: business_address", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return encoded;
 }
 
@@ -316,7 +316,7 @@ function _instructions(s) {
   if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("seller-signup: instructions contains control bytes");
   }
-  textGuard.freeText(s, "seller-signup: instructions", { zeroWidth: "reject" });
+  textGuard.freeText(s, "seller-signup: instructions", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -330,7 +330,7 @@ function _rejectReason(s) {
   if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("seller-signup: reason contains control bytes");
   }
-  textGuard.freeText(s, "seller-signup: reason", { zeroWidth: "reject" });
+  textGuard.freeText(s, "seller-signup: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/sidebar-widgets.js

@@ -172,7 +172,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("sidebarWidgets: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  textGuard.freeText(s, "sidebarWidgets: title", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "sidebarWidgets: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/sms-dispatcher.js

@@ -147,7 +147,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("smsDispatcher: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  textGuard.freeText(s, "smsDispatcher: name", { zeroWidth: "reject" });
+  textGuard.freeText(s, "smsDispatcher: name", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -267,7 +267,7 @@ function _optInText(s) {
   if (s.length > MAX_OPT_IN_TEXT_LEN) {
     throw new TypeError("smsDispatcher: opt_in_text must be <= " + MAX_OPT_IN_TEXT_LEN + " characters");
   }
-  textGuard.freeText(s, "smsDispatcher: opt_in_text", { zeroWidth: "reject" });
+  textGuard.freeText(s, "smsDispatcher: opt_in_text", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -322,7 +322,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("smsDispatcher: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "smsDispatcher: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "smsDispatcher: body", { zeroWidth: "reject", bidiMarks: "allow" });
   // Refuse the degenerate emoji-only shape. Walk the string by code
   // point so surrogate pairs in the SMP emoji blocks count as one
   // character.

package/lib/stock-receipts.js

@@ -171,7 +171,7 @@ function _reason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_REASON_LEN) {
     throw new TypeError("stockReceipts: reason must be a non-empty string <= " + MAX_REASON_LEN + " chars");
   }
-  textGuard.freeText(s, "stockReceipts: reason");
+  textGuard.freeText(s, "stockReceipts: reason", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/storefront-dashboards.js

@@ -163,7 +163,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("storefrontDashboards: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  textGuard.freeText(s, "storefrontDashboards: title", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "storefrontDashboards: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/storefront-forms.js

@@ -180,7 +180,7 @@ function _description(s) {
   if (typeof s !== "string" || s.length > MAX_DESCRIPTION_LEN) {
     throw new TypeError("storefrontForms: description must be a string ≤ " + MAX_DESCRIPTION_LEN + " chars");
   }
-  textGuard.freeText(s, "storefrontForms: description", { zeroWidth: "reject" });
+  textGuard.freeText(s, "storefrontForms: description", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/storefront-pages.js

@@ -131,7 +131,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("storefrontPages: title must be a non-empty string ≤ " + MAX_TITLE_LEN + " chars");
   }
-  textGuard.freeText(s, "storefrontPages: title", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "storefrontPages: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -139,7 +139,7 @@ function _body(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_BODY_LEN) {
     throw new TypeError("storefrontPages: body must be a non-empty string ≤ " + MAX_BODY_LEN + " chars");
   }
-  textGuard.freeText(s, "storefrontPages: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "storefrontPages: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/subscription-billing.js

@@ -143,7 +143,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("subscriptionBilling: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "subscriptionBilling: reason", { zeroWidth: "reject" });
+  textGuard.freeText(s, "subscriptionBilling: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/subscription-controls.js

@@ -139,7 +139,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("subscriptionControls: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(s, "subscriptionControls: reason", { zeroWidth: "reject" });
+  textGuard.freeText(s, "subscriptionControls: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/suggestion-box.js

@@ -201,7 +201,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("suggestionBox: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  textGuard.freeText(s, "suggestionBox: title", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "suggestionBox: title", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -219,7 +219,7 @@ function _body(s) {
   if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("suggestionBox: body must not contain control bytes");
   }
-  textGuard.freeText(s, "suggestionBox: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "suggestionBox: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -310,7 +310,7 @@ function _response(s) {
   if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("suggestionBox: response must not contain control bytes");
   }
-  textGuard.freeText(s, "suggestionBox: response", { zeroWidth: "reject" });
+  textGuard.freeText(s, "suggestionBox: response", { zeroWidth: "reject", bidiMarks: "allow" });
   // A status-only transition is allowed with response === "" (no
   // operator-visible reply, just a state change). Trim-then-check
   // for the operator-supplied case below in respondToSuggestion.
@@ -324,7 +324,7 @@ function _responder(s) {
   if (s.length > MAX_RESPONDER_LEN) {
     throw new TypeError("suggestionBox: responder must be <= " + MAX_RESPONDER_LEN + " characters");
   }
-  textGuard.freeText(s, "suggestionBox: responder", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "suggestionBox: responder", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/support-tickets.js

@@ -155,7 +155,7 @@ function _subject(s) {
   if (s.length > MAX_SUBJECT_LEN) {
     throw new TypeError("supportTickets: subject must be <= " + MAX_SUBJECT_LEN + " characters");
   }
-  textGuard.freeText(s, "supportTickets: subject", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "supportTickets: subject", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -170,7 +170,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("supportTickets: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  textGuard.freeText(s, "supportTickets: body", { zeroWidth: "reject" });
+  textGuard.freeText(s, "supportTickets: body", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 
@@ -219,7 +219,7 @@ function _reason(r) {
   if (r.length > MAX_REASON_LEN) {
     throw new TypeError("supportTickets: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  textGuard.freeText(r, "supportTickets: reason", { zeroWidth: "reject" });
+  textGuard.freeText(r, "supportTickets: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return r;
 }
 

package/lib/tenants.js

@@ -128,7 +128,7 @@ function _name(s) {
   if (s.length > MAX_NAME_LEN) {
     throw new TypeError("tenants: name must be <= " + MAX_NAME_LEN + " characters");
   }
-  textGuard.freeText(s, "tenants: name", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "tenants: name", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/text-guard.js

@@ -81,6 +81,32 @@ var INVISIBLE_OP_RE = new RegExp("[" + codepointClass.charClass([[0x2061, 0x2064
 // allow:dynamic-regex — codepoints from a literal range table
 var INVISIBLE_OP_RE_G = new RegExp("[" + codepointClass.charClass([[0x2061, 0x2064]]) + "]", "g");
 
+// The framework's BIDI_RE is the union of two groups that do NOT carry the
+// same risk, and refusing both is what broke right-to-left addresses:
+//
+//   OVERRIDES + ISOLATES — U+202A-202E and U+2066-2069. These reorder a RUN
+//     of surrounding text, which is the Trojan Source primitive: a value that
+//     displays as something other than what it says. Nothing legitimate in a
+//     shop's stored text needs them.
+//   MARKS — U+200E LEFT-TO-RIGHT MARK, U+200F RIGHT-TO-LEFT MARK, U+061C
+//     ARABIC LETTER MARK. These only resolve the direction of ADJACENT
+//     NEUTRAL characters — a house number inside an Arabic street name, a
+//     Latin brand inside a Hebrew sentence. They are how mixed-direction text
+//     is correctly authored, and an Arabic or Hebrew postal address routinely
+//     contains one. They cannot reverse a run.
+//
+// So the marks are ALLOWED by default and the overrides are refused. A field
+// that genuinely wants neither (a machine-readable identifier, a slug) asks
+// for `bidiMarks: "reject"`.
+// allow:dynamic-regex — codepoints from a literal range table
+var BIDI_OVERRIDE_RE = new RegExp(
+  "[" + codepointClass.charClass([[0x202A, 0x202E], [0x2066, 0x2069]]) + "]"
+);
+// allow:dynamic-regex — codepoints from a literal range table
+var BIDI_MARK_RE = new RegExp(
+  "[" + codepointClass.charClass([0x200E, 0x200F, 0x061C]) + "]"
+);
+
 // Everything that ends a line or pads it out, for a value that must stay on
 // one. Tab / LF / CR sit outside the framework's C0 table on purpose — a
 // multi-line body needs them — so a single-line field asks for them here.
@@ -205,7 +231,20 @@ function hostLabel(host, label) {
 // building a message just joins the two.
 //
 // Policies, each "reject" to enable and any other value to allow:
-//   bidi        — default "reject". Bidi overrides (CVE-2021-42574).
+//   bidi        — default "reject". Bidi OVERRIDES and ISOLATES only
+//                 (U+202A-202E, U+2066-2069) — the codepoints that reorder a
+//                 run of text (CVE-2021-42574).
+//   bidiMarks   — default "reject". U+200E / U+200F / U+061C, the direction
+//                 MARKS. These are legitimate in NATURAL-LANGUAGE text — an
+//                 Arabic postal address or a Hebrew gift message carries one
+//                 wherever a Latin word or number sits inside the line — and
+//                 illegitimate in a machine-readable value, where the only
+//                 reason for an invisible character is to make the value read
+//                 as something it is not. Neither case is the majority, so
+//                 the default is chosen by how each mistake fails: refusing a
+//                 mark that belonged is reported by the customer it turned
+//                 away, while accepting one that did not is silent. A prose
+//                 field therefore opts OUT with `bidiMarks: "allow"`.
 //   nullByte    — default "reject". U+0000.
 //   control     — default "reject". C0 controls + U+007F DELETE. Tab, LF and
 //                 CR are ALLOWED here: a multi-line body legitimately has
@@ -221,9 +260,12 @@ function hostLabel(host, label) {
 //                 systems, narrowed by policy.allowedScripts.
 function firstCodepointThreat(s, policy) {
   policy = policy || {};
-  if ((policy.bidi || "reject") === "reject" && codepointClass.BIDI_RE.test(s)) {
+  if ((policy.bidi || "reject") === "reject" && BIDI_OVERRIDE_RE.test(s)) {
     return "contains a Unicode bidi override (CVE-2021-42574 Trojan Source)";
   }
+  if ((policy.bidiMarks || "reject") === "reject" && BIDI_MARK_RE.test(s)) {
+    return "contains a Unicode bidi direction mark";
+  }
   if ((policy.nullByte || "reject") === "reject" &&
       s.indexOf(codepointClass.NULL_BYTE) !== -1) {
     return "contains a null byte";

package/lib/theme-assets.js

@@ -257,7 +257,7 @@ function _altText(s) {
       MAX_ALT_TEXT_LEN + " chars (or null)"
     );
   }
-  textGuard.freeText(s, "themeAssets: alt_text", { singleLine: "reject", zeroWidth: "reject" });
+  textGuard.freeText(s, "themeAssets: alt_text", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.18.21",
-      "tag": "v0.18.21",
+      "version": "0.18.24",
+      "tag": "v0.18.24",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -599,15 +599,15 @@
         "package.json": "lib/vendor/blamejs/package.json",
         "sbom.cdx.json": "lib/vendor/blamejs/sbom.cdx.json"
       },
-      "bundler": "signed release tarball blamejs-core-0.18.21.tgz from github.com/blamejs/blamejs — SHA3-512 digest and ML-DSA-65 signature verified against keys/vendor-blamejs-pqc-pub.json before unpacking",
-      "bundledAt": "2026-08-10",
+      "bundler": "signed release tarball blamejs-core-0.18.24.tgz from github.com/blamejs/blamejs — SHA3-512 digest and ML-DSA-65 signature verified against keys/vendor-blamejs-pqc-pub.json before unpacking",
+      "bundledAt": "2026-08-11",
       "hashes": {
-        "CHANGELOG.md": "sha256:8604c2e45b6e3575b1cc2df0021fd97ce959a8b6e269d129388fe365bbe69f47",
+        "CHANGELOG.md": "sha256:2ac9860b3cc5e84c9103557a9610d3e60af5f9a3f648d22aa127c55f9c72cf0e",
         "LICENSE": "sha256:812075be5abe785284e823a97d09b5d1515b0221e3128059e1f5065de3c907d5",
         "LTS-CALENDAR.md": "sha256:fbdf074ca0d9544bf10fff87c8947ba38aa5ac0500267796dc8f0c92822aacbe",
         "MIGRATING.md": "sha256:7bee6f55c28f017d4083132dbe45e0e63bcdb7ad3086b95b02551eaa4cc052bc",
-        "NOTICE": "sha256:73a48bab0eb79e491df655fb57d4ec690da51228a8698c1c828c3870fbd22c31",
-        "README.md": "sha256:3c2b7909d68c10b80560b1fcc94ae70f79ef760fdfa6d7fe914c62035bfac842",
+        "NOTICE": "sha256:979a65f58486faf2defacd821fa97476149a3a4efe1ddea8f6b53b3283175fe5",
+        "README.md": "sha256:4ea822a1e856e860ea6d24b01a6dbb34252d519f78707eccdcb0a6de3d3775e8",
         "bin/blamejs.js": "sha256:59798e63ad43c0afdf03ab88aaae105fa1f525c2703d80903eee48717db567c4",
         "index.js": "sha256:2d2c81c19e4177450b701dba05f582a8b6ef9581d202f01ec04d912556266a2f",
         "lib/_test/crypto-fixtures.js": "sha256:16055e38d3c1a3065735e50fe43e81de1ed5d90cf72d7fb90ac263d07deb7ced",
@@ -1019,7 +1019,7 @@
         "lib/network-nts.js": "sha256:947e1887f339ef1bb20891d5c9531e2969653b162886b576c9b8a723d6b62002",
         "lib/network-proxy.js": "sha256:392e79ddc58ae7125cd7a8abec872df50ffee76170ea40ff6847d581b2a405a3",
         "lib/network-smtp-policy.js": "sha256:b8b88766be9dd1a0e4dfe60b21f97fe8b166d76328ecbbbb4e1349bfb2335e95",
-        "lib/network-tls.js": "sha256:ef77f7f153636b28cd6b28ab8de60b14fa3d60fc675e2fc7fa4063033c513074",
+        "lib/network-tls.js": "sha256:0a2b52cf7d9e35d988ba0a6d3d0afd22536c7f68ff047f24981e0732964a4fa3",
         "lib/network-tsig.js": "sha256:233b008815bbbd60e6914e4a74b41de0d9136c27331bf00827ca4a983ddd29e2",
         "lib/network.js": "sha256:a4a4bd54396c0e162f1d5469d4d3e264a9f4537179446843589674e551ac1f29",
         "lib/nis2-report.js": "sha256:d54937f1fe996c5316756cfcf9095c67c8f955621c199079abb87862a82afd75",
@@ -1158,10 +1158,10 @@
         "lib/vc.js": "sha256:2f0e2a32bb52f53e4c38df64a2a658665cf5e442b56882d3b3bbdf31c7124132",
         "lib/vendor-data.js": "sha256:365b0dcca1198e4fad647b3873b82702fcf90a5ee2d8c7f25c78864cadb7d717",
         "lib/vendor/.vendor-data-pubkey": "sha256:73a935b8c72f55d821c22ddb8188453bab324f80d229d033a0a1549819a1f096",
-        "lib/vendor/MANIFEST.json": "sha256:f32f5ed3c3bc4b0475246cc2e8822749e9ed235d331e9e5eeb186e70b42e76d9",
+        "lib/vendor/MANIFEST.json": "sha256:75576b6fbcb07383d382c94fbf3fb317703d5cb4bf838b55801b93d7ead3de08",
         "lib/vendor/bimi-trust-anchors.data.js": "sha256:aa7a4d33b65a68422a2a2c1670177689f66fdcaa08bd2514d78798b827bd1608",
         "lib/vendor/bimi-trust-anchors.pem": "sha256:81ff9f5ab3c9774132c845684e783be95cf73146f8b670d964105f0a3765b4b4",
-        "lib/vendor/blamejs-pki.cjs": "sha256:067ac05899ef04f7851a8d010dc4289e7a01706d5fd2cdc1ce59860631bba284",
+        "lib/vendor/blamejs-pki.cjs": "sha256:96a873b733c95b53b8e2ced065a82192b6acabcede312cf68a45a128857cc3bc",
         "lib/vendor/browser/noble-ciphers.mjs": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e",
         "lib/vendor/browser/noble-hashes.mjs": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0",
         "lib/vendor/browser/noble-post-quantum.mjs": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9",
@@ -1188,8 +1188,8 @@
         "lib/ws-client.js": "sha256:348d01cd552fed583f05944d1853f71b0119105cb067c2e607b19ec9e6f47aee",
         "lib/x509-chain.js": "sha256:c2b5544202601a50230c7c652ff028e73e9d29a34d58db349beb5b5164b7b4d5",
         "lib/xml-c14n.js": "sha256:6239db09b021f032a78aa101fe295238db4ad91acc93ae13eef7d14efd797b94",
-        "package.json": "sha256:0feb395d6b015bdf53375147fd96972507ea80974bb81a93841a77aa95e5e0f6",
-        "sbom.cdx.json": "sha256:d659ac36810bd4f2c120e75c09ba0b1ae40c48a8a4a6aef36d9569cb3899dbe2"
+        "package.json": "sha256:ab52ca260fa6408d4910a3d9a726d442e61127e883e920c965e7ef31c9319a0d",
+        "sbom.cdx.json": "sha256:b47182cff49c56cc0534ba835f62bd8ddebcb659ae3d693bbfc1f4b059a427c7"
       }
     }
   }