@blamejs/blamejs-shop 0.5.4 → 0.5.6

package/lib/vendor/blamejs/test/layer-0-primitives/self-update.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.selfUpdate — poll / verify / swap / rollback tests.
@@ -60,6 +62,25 @@ function testPollRejectsBadOpts() {
             e && /selfupdate\/bad-releases-url/.test(e.code || "")); });
 }
 
+function testPollRejectsUnsafeAssetPattern() {
+  // A wrapped nested quantifier is catastrophic-backtracking (ReDoS)
+  // shaped; it must be refused at config-time, before any request runs.
+  // The releasesUrl is well-formed so the assetPattern screen is what
+  // fails — and the refusal happens before any .test() so nothing ever
+  // backtracks.
+  return Promise.resolve()
+    .then(function () {
+      return b.selfUpdate.poll({
+        releasesUrl:    "https://example.invalid/releases",
+        currentVersion: "1.0.0",
+        assetPattern:   /((a)+)+$/,
+      });
+    })
+    .then(function () { check("poll() ReDoS assetPattern should throw", false); },
+          function (e) { check("poll: rejects ReDoS-shaped assetPattern",
+            e && /selfupdate\/unsafe-asset-pattern/.test(e.code || "")); });
+}
+
 function testCompareTags() {
   var cmp = b.selfUpdate.compareTags;
   check("compareTags: public surface exposed",  typeof cmp === "function");
@@ -233,7 +254,8 @@ async function testSwapAndRollback() {
   fs.writeFileSync(to,      Buffer.from("OLD-BINARY"));
   fs.writeFileSync(newPath, Buffer.from("NEW-BINARY"));
 
-  var rs = await b.selfUpdate.swap({ from: newPath, to: to, backupTo: backupTo });
+  var newHash = nodeCrypto.createHash("sha3-512").update(Buffer.from("NEW-BINARY")).digest("hex");
+  var rs = await b.selfUpdate.swap({ from: newPath, to: to, backupTo: backupTo, expectedHash: newHash });
   check("swap: ok=true",                           rs.ok === true);
   check("swap: to has new bytes",                  fs.readFileSync(to, "utf8") === "NEW-BINARY");
   check("swap: backup has old bytes",              fs.readFileSync(backupTo, "utf8") === "OLD-BINARY");
@@ -255,9 +277,10 @@ async function testSwapMissingFromRefused() {
   var threw = null;
   try {
     await b.selfUpdate.swap({
-      from:     path.join(dir, "absent.bin"),
-      to:       path.join(dir, "to.bin"),
-      backupTo: path.join(dir, "to.bin.bak"),
+      from:         path.join(dir, "absent.bin"),
+      to:           path.join(dir, "to.bin"),
+      backupTo:     path.join(dir, "to.bin.bak"),
+      expectedHash: "00",   // present so validation passes; the existsSync(from) check fires first
     });
   } catch (e) { threw = e; }
   check("swap: missing-from refused",
@@ -265,6 +288,63 @@ async function testSwapMissingFromRefused() {
   try { fs.rmdirSync(dir); } catch (_e) { /* best-effort */ }
 }
 
+async function testSwapHashMismatchRefused() {
+  // RED before the fix: swap() renamed `from` into place with no re-check, so an
+  // attacker who swapped `from` after selfUpdate.verify passed (or pointed verify
+  // at a different inode via a symlink) installed unverified bytes. swap() now
+  // re-hashes `from` against expectedHash (verify's hash) immediately before the
+  // install and refuses a mismatch.
+  var dir = _tmp("dir-tamper");
+  fs.mkdirSync(dir, { recursive: true });
+  var to       = path.join(dir, "blamejs.bin");
+  var backupTo = path.join(dir, "blamejs.bin.bak");
+  var newPath  = path.join(dir, "blamejs.bin.new");
+  fs.writeFileSync(to, Buffer.from("OLD-BINARY"));
+  // verify() checked these bytes...
+  var verifiedHash = nodeCrypto.createHash("sha3-512").update(Buffer.from("GOOD-BINARY")).digest("hex");
+  // ...but `from` was swapped to different bytes after verify.
+  fs.writeFileSync(newPath, Buffer.from("TAMPERED-BINARY"));
+  var threw = null;
+  try {
+    await b.selfUpdate.swap({ from: newPath, to: to, backupTo: backupTo, expectedHash: verifiedHash });
+  } catch (e) { threw = e; }
+  check("swap: from tampered after verify is refused (hash mismatch)",
+        threw && /selfupdate\/swap-hash-mismatch/.test(threw.code || ""));
+  check("swap: tampered bytes NOT installed", fs.readFileSync(to, "utf8") === "OLD-BINARY");
+  try { fs.unlinkSync(to);      } catch (_e) { /* best-effort */ }
+  try { fs.unlinkSync(newPath); } catch (_e) { /* best-effort */ }
+  try { fs.rmdirSync(dir);      } catch (_e) { /* best-effort */ }
+}
+
+async function testSwapSymlinkedFromRefused() {
+  // A symlinked `from` must be refused at read (O_NOFOLLOW): hashing the link
+  // TARGET while installing the link itself would let an attacker point the link
+  // at verified bytes, pass expectedHash, then repoint the installed link at
+  // unverified bytes. POSIX-only — Windows symlink creation needs privileges.
+  var dir = _tmp("dir-symlink");
+  fs.mkdirSync(dir, { recursive: true });
+  var real = path.join(dir, "real.bin");
+  var link = path.join(dir, "link.bin");
+  var to   = path.join(dir, "to.bin");
+  fs.writeFileSync(real, Buffer.from("REAL-BYTES"));
+  var madeLink = false;
+  try { fs.symlinkSync(real, link); madeLink = true; } catch (_e) { /* no symlink privilege */ }
+  if (!madeLink) {
+    check("swap: symlinked-from test skipped (no symlink privilege)", true);
+    try { fs.unlinkSync(real); fs.rmdirSync(dir); } catch (_e) { /* best-effort */ }
+    return;
+  }
+  var realHash = nodeCrypto.createHash("sha3-512").update(Buffer.from("REAL-BYTES")).digest("hex");
+  var threw = null;
+  try {
+    await b.selfUpdate.swap({ from: link, to: to, backupTo: path.join(dir, "to.bin.bak"), expectedHash: realHash });
+  } catch (e) { threw = e; }
+  check("swap: a symlinked from is refused (read with O_NOFOLLOW)",
+        threw && /selfupdate\/swap-read-failed/.test(threw.code || ""));
+  check("swap: symlinked from did not install", !fs.existsSync(to));
+  try { fs.unlinkSync(link); fs.unlinkSync(real); fs.rmdirSync(dir); } catch (_e) { /* best-effort */ }
+}
+
 async function testRollbackMissingBackupRefused() {
   var dir = _tmp("dir3");
   fs.mkdirSync(dir, { recursive: true });
@@ -300,12 +380,15 @@ async function run() {
     testSurface();
     testCompareTags();
     await testPollRejectsBadOpts();
+    await testPollRejectsUnsafeAssetPattern();
     await testPollAvailableAndUpToDate();
     await testPollArrayShape();
     await testPollNon2xxRefused();
     await testVerifyPassFail();
     await testSwapAndRollback();
     await testSwapMissingFromRefused();
+    await testSwapHashMismatchRefused();
+    await testSwapSymlinkedFromRefused();
     await testRollbackMissingBackupRefused();
   } finally {
     await _drainTcpHandles();

package/lib/vendor/blamejs/test/layer-0-primitives/server-timing.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.serverTiming — W3C Server-Timing response header builder.

package/lib/vendor/blamejs/test/layer-0-primitives/session-binding-unreadable-failclosed.test.js

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.session.verify must FAIL CLOSED under a strict device-fingerprint policy
+ * (requireFingerprintMatch / maxAnomalyScore) when the sealed `data` column —
+ * which carries the bound fingerprint — cannot be decrypted (key-rotation skew,
+ * DB corruption, or a tamper of the independently-AEAD-sealed data cell).
+ *
+ * Pre-fix, cryptoField.unsealRow swallowed the decrypt failure and returned
+ * data=null, so storedFingerprint stayed null and the whole fingerprint gate
+ * (including the strict refusals) was SKIPPED — a session was accepted from ANY
+ * device even with requireFingerprintMatch:true. "Could not read the binding"
+ * was treated as "the binding matches".
+ */
+
+var helpers = require("../helpers");
+var b = helpers.b;
+var check = helpers.check;
+var setupTestDb = helpers.setupTestDb;
+var teardownTestDb = helpers.teardownTestDb;
+var fs = require("fs");
+var os = require("os");
+var path = require("path");
+
+function _makeReq(headers) {
+  return { headers: headers || {}, socket: {}, connection: {} };
+}
+
+async function run() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-binding-"));
+  try {
+    await setupTestDb(tmpDir);
+
+    // Wrap a real store so we can corrupt ONLY the sealed `data` cell on read —
+    // the userId column + lookup hash stay intact, so the row is still found,
+    // but its AEAD-sealed data (the fingerprint binding) no longer decrypts.
+    var real = b.session.stores.localDbThin({ file: path.join(tmpDir, "ses.db"), audit: false });
+    var corrupt = false;
+    var wrap = Object.assign({}, real, {
+      executeOne: async function (sql, p) {
+        var row = await real.executeOne(sql, p);
+        if (corrupt && row && typeof row.data === "string" && row.data.length > 8) {
+          var bytes = Buffer.from(row.data, "utf8");
+          bytes[bytes.length - 3] = bytes[bytes.length - 3] ^ 0xff;   // flip a ciphertext byte
+          row = Object.assign({}, row, { data: bytes.toString("utf8") });
+        }
+        return row;
+      },
+    });
+    b.session.useStore(wrap);
+
+    var devA = _makeReq({ "x-forwarded-for": "203.0.113.10", "user-agent": "deviceA" });
+    var s = await b.session.create({ userId: "u-strict", req: devA, data: { role: "admin" } });
+
+    // Sanity — strict verify from the bound device, binding readable, succeeds.
+    var okSame = await b.session.verify(s.token, { req: devA, requireFingerprintMatch: true });
+    check("strict verify from the bound device succeeds (binding readable)",
+          okSame && okSame.userId === "u-strict");
+
+    // Now make the sealed data cell undecryptable, and verify from a DIFFERENT
+    // device under the strict policy: it must FAIL CLOSED (the binding can't be
+    // read, so we cannot prove it matches), not silently skip the gate.
+    corrupt = true;
+    var devB = _makeReq({ "x-forwarded-for": "198.51.100.1", "user-agent": "deviceB" });
+    var verdict = await b.session.verify(s.token, { req: devB, requireFingerprintMatch: true });
+    check("strict verify FAILS CLOSED when the binding column can't be decrypted",
+          verdict === null);
+  } finally {
+    b.session.useStore(null);
+    await teardownTestDb(tmpDir);
+  }
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/session-destroy-all-store-backed.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.session.destroyAllForUser must succeed for a store-backed-only consumer

package/lib/vendor/blamejs/test/layer-0-primitives/session-device-binding-ipv6-canonical-and-no-store.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.sessionDeviceBinding — two regressions:

package/lib/vendor/blamejs/test/layer-0-primitives/session-device-binding.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.sessionDeviceBinding — bind sessions to a device fingerprint and

package/lib/vendor/blamejs/test/layer-0-primitives/session-extensions.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.session — v0.8.61 extensions:

package/lib/vendor/blamejs/test/layer-0-primitives/session-valid-from.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.session.bump / validFrom / check — per-subject valid-from boundary for

package/lib/vendor/blamejs/test/layer-0-primitives/shape-match.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Sanity tests for test/helpers/_shape-match.js. Not part of the

package/lib/vendor/blamejs/test/layer-0-primitives/sigv4-bucket-ops.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * sigv4-bucket-ops — bucket-level lifecycle ops for SigV4 backends.

package/lib/vendor/blamejs/test/layer-0-primitives/sigv4-multipart-sse.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * sigv4 — multipart upload + server-side encryption (SSE).

package/lib/vendor/blamejs/test/layer-0-primitives/slug.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.slug — URL-safe slug generation with diacritic strip + uniqueness.

package/lib/vendor/blamejs/test/layer-0-primitives/smtp-policy.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.smtp.policy — MTA-STS + DANE + TLS-RPT operator surface.
@@ -177,11 +179,13 @@ async function testTlsRptSubmitMixedRua() {
     policies: [{ type: "sts", domain: "example.com" }],
   });
   // Mock httpClient — capture the request rather than going to the wire.
+  // The framework httpClient resolves { statusCode, headers, body }; the
+  // fake mirrors that real contract so a 2xx is reported as success.
   var captured = null;
   var fakeHttp = {
     request: async function (req) {
       captured = req;
-      return { status: 202, body: Buffer.from("") };
+      return { statusCode: 202, headers: {}, body: Buffer.from("") };
     },
   };
   var rv = await b.network.smtp.tlsRpt.submit(report, {

package/lib/vendor/blamejs/test/layer-0-primitives/source-comment-blocks.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Source @module / @primitive comment-block gate.

package/lib/vendor/blamejs/test/layer-0-primitives/speculation-rules.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * speculation-rules — W3C Speculation Rules emitter middleware.