@blamejs/blamejs-shop 0.5.5 → 0.5.6

package/lib/vendor/blamejs/lib/i18n-messageformat.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * i18n-messageformat — ICU MessageFormat parser + evaluator.
@@ -63,6 +65,18 @@ function _err(code, message) {
   return new I18nMessageFormatError(code, message, true);
 }
 
+// Maximum case-nesting depth. The parser and the renderer both recurse
+// once per nested plural/select case body; a template like
+// `{a,select,x{{b,select,x{{c,select,...}}}}}` nested thousands deep would
+// otherwise overflow the V8 stack with an uncaught RangeError. Templates
+// usually come from operator translation files, but format()/parse() are
+// public and `b.i18n.t(key, vars, { messageFormat: true })` renders entries
+// that may be operator-supplied per-tenant, so a hostile template must fail
+// as a typed BAD_TEMPLATE rather than crashing the process. Real
+// translations nest 2-3 deep; 100 is far beyond any legitimate message yet
+// well under native overflow.
+var MAX_NESTING_DEPTH = 100;
+
 // ---- Parser ----
 //
 // AST node shapes:
@@ -89,6 +103,12 @@ function parse(template) {
 }
 
 function _parseSequence(state, topLevel) {
+  state.depth = (state.depth || 0) + 1;
+  if (state.depth > MAX_NESTING_DEPTH) {
+    throw _err("BAD_TEMPLATE",
+      "messageFormat.parse: case nesting too deep (max " +
+      MAX_NESTING_DEPTH + ")");
+  }
   var nodes = [];
   var lit = "";
   while (state.pos < state.src.length) {
@@ -146,6 +166,7 @@ function _parseSequence(state, topLevel) {
     state.pos += 1;
   }
   if (lit.length > 0) nodes.push({ type: "literal", value: lit });
+  state.depth -= 1;
   return nodes;
 }
 
@@ -322,18 +343,26 @@ function _pluralRules(locale, type) {
 
 function format(template, vars, locale) {
   var nodes = parse(template);
-  return _renderSequence(nodes, vars || {}, locale || "en", null);
+  return _renderSequence(nodes, vars || {}, locale || "en", null, 0);
 }
 
-function _renderSequence(nodes, vars, locale, hashContext) {
+function _renderSequence(nodes, vars, locale, hashContext, depth) {
+  depth = depth || 0;
+  // parse() already bounds AST nesting to MAX_NESTING_DEPTH, so this guard
+  // is defence-in-depth for any future caller that hands render a hand-built
+  // tree — it must still fail typed rather than overflow the stack.
+  if (depth > MAX_NESTING_DEPTH) {
+    throw _err("BAD_TEMPLATE",
+      "messageFormat: render nesting too deep (max " + MAX_NESTING_DEPTH + ")");
+  }
   var out = "";
   for (var i = 0; i < nodes.length; i++) {
-    out += _renderNode(nodes[i], vars, locale, hashContext);
+    out += _renderNode(nodes[i], vars, locale, hashContext, depth);
   }
   return out;
 }
 
-function _renderNode(node, vars, locale, hashContext) {
+function _renderNode(node, vars, locale, hashContext, depth) {
   if (node.type === "literal") return node.value;
   if (node.type === "hash") {
     return hashContext != null ? String(hashContext) : "#";
@@ -358,13 +387,13 @@ function _renderNode(node, vars, locale, hashContext) {
       var category = pr.select(adjusted);
       caseBody = node.cases[category] || node.cases.other;
     }
-    return _renderSequence(caseBody, vars, locale, adjusted);
+    return _renderSequence(caseBody, vars, locale, adjusted, depth + 1);
   }
   if (node.type === "select") {
     var sv = vars[node.name];
     var key = (sv === undefined || sv === null) ? "other" : String(sv);
     var body = node.cases[key] || node.cases.other;
-    return _renderSequence(body, vars, locale, hashContext);
+    return _renderSequence(body, vars, locale, hashContext, depth + 1);
   }
   return "";
 }

package/lib/vendor/blamejs/lib/i18n.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.i18n

package/lib/vendor/blamejs/lib/iab-mspa.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.iabMspa

package/lib/vendor/blamejs/lib/iab-tcf.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.iabTcf

package/lib/vendor/blamejs/lib/importmap-integrity.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.importmapIntegrity

package/lib/vendor/blamejs/lib/inbox.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.inbox

package/lib/vendor/blamejs/lib/incident-report.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.incident.report — generic 3-stage incident-reporting primitive.

package/lib/vendor/blamejs/lib/ip-utils.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * lib/ip-utils.js — internal IP-address helpers shared across

package/lib/vendor/blamejs/lib/jobs.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * jobs — name → handler registry on top of lib/queue.

package/lib/vendor/blamejs/lib/jose-jwe-experimental.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.jose.jwe.experimental

package/lib/vendor/blamejs/lib/json-merge-patch.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.jsonMergePatch

package/lib/vendor/blamejs/lib/json-patch.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.jsonPatch

package/lib/vendor/blamejs/lib/json-path.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.jsonPath

package/lib/vendor/blamejs/lib/json-pointer.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.jsonPointer

package/lib/vendor/blamejs/lib/json-schema.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.jsonSchema
@@ -54,7 +56,17 @@ var { defineClass } = require("./framework-error");
 var JsonSchemaError = defineClass("JsonSchemaError", { alwaysPermanent: true });
 
 var DIALECT_2020_12 = "https://json-schema.org/draft/2020-12/schema";
-var MAX_REF_DEPTH = 10000;                                  // recursion-depth cap (count, not a byte size)
+// Subschema-validation nesting cap. ctx.depth is incremented on entry to
+// _validate and decremented in its finally, so it tracks the live nesting
+// depth (sibling keywords/properties do not accumulate) — the deepest the
+// instance×schema walk has recursed. validate(schema, requestBody) reaches
+// it with attacker input on BOTH sides: a recursive schema (items:{$ref:"#"})
+// against a deeply-nested array/object, or a deeply-nested allOf chain.
+// Left unbounded the walk overflows the V8 stack (~1000 levels) with an
+// uncaught RangeError before this guard fired — a pre-validation DoS. 256 is
+// far beyond any legitimate document yet well under native overflow, so the
+// typed json-schema/ref-loop error is what an operator sees.
+var MAX_REF_DEPTH = 256;                                    // recursion-depth cap (count, not a byte size)
 var DEFAULT_MAX_ERRORS = 100;                               // error-collection cap
 
 function _typeOf(v) {

package/lib/vendor/blamejs/lib/jsonapi.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.jsonApi

package/lib/vendor/blamejs/lib/jtd.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.jtd

package/lib/vendor/blamejs/lib/jwk.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.jwk

package/lib/vendor/blamejs/lib/keychain.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.keychain
@@ -647,9 +649,20 @@ async function store(opts) {
   }
 
   _validateFallbackFile(opts.fallbackFile, "keychain.store");
-  var doc = await _readFile(opts.fallbackFile, opts.passphrase);
-  doc.entries[_bindingKey(opts.service, opts.account)] = String(opts.password);
-  await _writeFile(opts.fallbackFile, doc, opts.passphrase);
+  // The lock sentinel lives beside fallbackFile, so its parent directory must
+  // exist before the FIRST writer can lock — otherwise the lock (added to
+  // serialize the RMW below) fails where the pre-lock atomicFile.write used to
+  // create the directory lazily on first store.
+  atomicFile.ensureDir(nodePath.dirname(opts.fallbackFile), 0o700);
+  // Serialize the read-modify-write so concurrent stores to the same
+  // fallbackFile can't each read the pre-update document and clobber one
+  // another's binding on write. atomicFile.lock is a cross-process file
+  // mutex; _removeFromFile serializes its RMW through the same lock.
+  await atomicFile.lock(opts.fallbackFile, async function () {
+    var doc = await _readFile(opts.fallbackFile, opts.passphrase);
+    doc.entries[_bindingKey(opts.service, opts.account)] = String(opts.password);
+    await _writeFile(opts.fallbackFile, doc, opts.passphrase);
+  });
   _emit("keychain.stored", "success", {
     service: opts.service, account: opts.account, backend: "file",
   }, auditOn);
@@ -816,13 +829,18 @@ async function remove(opts) {
     }
   }
 
+  // Validate a supplied fallbackFile (reject a relative path) BEFORE the
+  // exists check, so a relative path throws keychain/relative-fallback-file
+  // consistently with store/retrieve instead of silently no-op'ing.
+  if (opts.fallbackFile) {
+    _validateFallbackFile(opts.fallbackFile, "keychain.remove");
+  }
   if (!opts.fallbackFile || !atomicFile.exists(opts.fallbackFile)) {
     _emit("keychain.removed", "no-op", {
       service: opts.service, account: opts.account, backend: "file",
     }, auditOn);
     return false;
   }
-  _validateFallbackFile(opts.fallbackFile, "keychain.remove");
   var existed = await _removeFromFile(opts.fallbackFile, opts.service, opts.account, opts.passphrase);
   _emit("keychain.removed", existed ? "success" : "no-op", {
     service: opts.service, account: opts.account, backend: "file",
@@ -831,12 +849,16 @@ async function remove(opts) {
 }
 
 async function _removeFromFile(fallbackFile, service, account, passphrase) {
-  var doc = await _readFile(fallbackFile, passphrase);
-  var bindingKey = _bindingKey(service, account);
-  if (!Object.prototype.hasOwnProperty.call(doc.entries, bindingKey)) return false;
-  delete doc.entries[bindingKey];
-  await _writeFile(fallbackFile, doc, passphrase);
-  return true;
+  // Same serialized read-modify-write as store: hold the file mutex across
+  // read -> delete -> write so a concurrent store/remove can't lose the edit.
+  return await atomicFile.lock(fallbackFile, async function () {
+    var doc = await _readFile(fallbackFile, passphrase);
+    var bindingKey = _bindingKey(service, account);
+    if (!Object.prototype.hasOwnProperty.call(doc.entries, bindingKey)) return false;
+    delete doc.entries[bindingKey];
+    await _writeFile(fallbackFile, doc, passphrase);
+    return true;
+  });
 }
 
 // ---- Test seam -------------------------------------------------------------

package/lib/vendor/blamejs/lib/lazy-require.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Lazy-require — cached deferred-load helper.

package/lib/vendor/blamejs/lib/legal-hold.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * legal-hold — subject-level litigation/regulatory hold registry.

package/lib/vendor/blamejs/lib/link-header.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.linkHeader

package/lib/vendor/blamejs/lib/local-db-thin.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.localDb.thin — lightweight node:sqlite wrapper for desktop-daemon-

package/lib/vendor/blamejs/lib/log-stream-cloudwatch.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * AWS CloudWatch Logs sink — PutLogEvents over HTTPS with SigV4.

package/lib/vendor/blamejs/lib/log-stream-local.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Local file-based log sink with append-only journaling + rotation.

package/lib/vendor/blamejs/lib/log-stream-otlp-grpc.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OTLP gRPC log sink — OpenTelemetry Protocol logs over gRPC.

package/lib/vendor/blamejs/lib/log-stream-otlp.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OTLP/HTTP-JSON log sink — OpenTelemetry Protocol logs over HTTP/JSON.

package/lib/vendor/blamejs/lib/log-stream-syslog.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Syslog log-stream sink — RFC 5424 framing over UDP / TCP / TLS.

package/lib/vendor/blamejs/lib/log-stream-webhook.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Generic webhook log sink — HTTP POST one event (or a batch) at a time.

package/lib/vendor/blamejs/lib/log-stream.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.logStream

package/lib/vendor/blamejs/lib/log.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.log

package/lib/vendor/blamejs/lib/lro.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.lro

package/lib/vendor/blamejs/lib/mail-agent.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.agent

package/lib/vendor/blamejs/lib/mail-arc-reuse-token.js

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * Internal handshake token shared between the DKIM verifier (mail-dkim) and
+ * the ARC verifier (mail-auth). b.mail.arc.verify validates an
+ * ARC-Message-Signature by reusing the DKIM verifier against a synthetic
+ * message; this Symbol, set on the verify-options object, tells the DKIM
+ * verifier that the signature is an AMS — its i= is an RFC 8617 §4.1.2
+ * instance number (not a DKIM AUID), and its signature header is canonicalized
+ * under ARC-Message-Signature rather than DKIM-Signature.
+ *
+ * It lives in its OWN module, exported from neither primitive's public surface,
+ * so the reuse signal is unreachable from b.mail.dkim / b.mail.arc. A caller of
+ * the public b.mail.dkim.verify cannot obtain it, so the RFC 6376 §3.5 AUID/d=
+ * binding check stays a non-opt-out default on real DKIM verification — the
+ * reuse is available only to framework code that requires this module directly.
+ */
+
+module.exports = Symbol("blamejs.mail.arcAmsReuse");

package/lib/vendor/blamejs/lib/mail-arc-sign.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.arc.sign — RFC 8617 ARC chain construction.
@@ -177,7 +179,7 @@ function sign(opts) {
   validateOpts(opts, [
     "rfc822", "instance", "authservId", "domain", "selector",
     "privateKey", "algorithm", "cv", "authResults",
-    "headersToSign", "timestamp", "audit",
+    "headersToSign", "timestamp", "audit", "excludeAarFromAms",
   ], "mail.arc.sign");
 
   validateOpts.requireNonEmptyString(opts.rfc822, "sign: rfc822",
@@ -188,12 +190,21 @@ function sign(opts) {
     throw new MailAuthError("arc-sign/bad-instance",
       "sign: instance must be an integer in [1, 50] — got " + JSON.stringify(opts.instance));
   }
-  validateOpts.requireNonEmptyString(opts.authservId,
-    "sign: authservId", MailAuthError, "arc-sign/bad-authserv");
-  validateOpts.requireNonEmptyString(opts.domain,
-    "sign: domain", MailAuthError, "arc-sign/bad-domain");
-  validateOpts.requireNonEmptyString(opts.selector,
-    "sign: selector", MailAuthError, "arc-sign/bad-selector");
+  // authservId / domain / selector / authResults are required non-empty
+  // strings AND are interpolated verbatim into the ARC header block
+  // (ARC-Authentication-Results / ARC-Seal / ARC-Message-Signature), so they
+  // can never carry a CR / LF / NUL — that would smuggle a header.
+  var arcHeaderFields = [
+    ["authservId",  opts.authservId,  "arc-sign/bad-authserv"],
+    ["domain",      opts.domain,      "arc-sign/bad-domain"],
+    ["selector",    opts.selector,    "arc-sign/bad-selector"],
+    ["authResults", opts.authResults, "arc-sign/bad-auth-results"],
+  ];
+  for (var fi = 0; fi < arcHeaderFields.length; fi += 1) {
+    var af = arcHeaderFields[fi];
+    validateOpts.requireNonEmptyString(af[1], "sign: " + af[0], MailAuthError, af[2]);
+    safeBuffer.assertHeaderSafe(af[1], af[0], MailAuthError, af[2]);
+  }
   if (!opts.privateKey || (typeof opts.privateKey !== "string" &&
       typeof opts.privateKey !== "object")) {
     throw new MailAuthError("arc-sign/missing-private-key",
@@ -216,12 +227,6 @@ function sign(opts) {
     throw new MailAuthError("arc-sign/cv-rule",
       "sign: i>=2 disallows cv=none — must be cv=pass or cv=fail (per RFC 8617 §5.1.1)");
   }
-  validateOpts.requireNonEmptyString(opts.authResults, "sign: authResults",
-    MailAuthError, "arc-sign/bad-auth-results");
-  if (safeBuffer.hasCrlf(opts.authResults)) {
-    throw new MailAuthError("arc-sign/bad-auth-results",
-      "sign: authResults contains CR/LF (header injection refused)");
-  }
   var headersToSign = opts.headersToSign || DEFAULT_HEADERS;
   if (!Array.isArray(headersToSign) || headersToSign.length === 0) {
     throw new MailAuthError("arc-sign/bad-headers",
@@ -310,10 +315,23 @@ function sign(opts) {
   // Synthesize a virtual entry at the top of parsedHeaders so the
   // header-name lookup below sees it; the canonicalizer reads
   // parsedHeaders[idx] like any other header.
+  //
+  // The AMS covers only THIS hop's AAR ("most recent" per §5.1.1). Prior
+  // hops' ARC-* headers must be excluded: the h= lookup picks the last
+  // matching header, so a prior-hop AAR left in scope would be signed
+  // instead of this hop's, and arc.verify — which strips every prior ARC
+  // header and keeps only the current instance's AAR — would reconstruct a
+  // different input and the AMS would never verify past the first hop.
+  var priorArcStripped = parsedHeaders.filter(function (ph2) {
+    var lc = ph2.name.toLowerCase();
+    return lc !== "arc-authentication-results" &&
+           lc !== "arc-message-signature" &&
+           lc !== "arc-seal";
+  });
   var amsParsedHeaders = [{
     name:  "ARC-Authentication-Results",
     value: " " + aarValue,
-  }].concat(parsedHeaders);
+  }].concat(priorArcStripped);
   var canonHeaders = "";
   var headerNamesLc = amsParsedHeaders.map(function (h) { return h.name.toLowerCase(); });
   for (var j = 0; j < headersToSign.length; j += 1) {

package/lib/vendor/blamejs/lib/mail-arf.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mailArf
@@ -39,6 +41,7 @@
 
 var lazyRequire   = require("./lazy-require");
 var mimeParse     = require("./mime-parse");
+var pick          = require("./pick");
 var C             = require("./constants");
 var safeBuffer    = require("./safe-buffer");
 var { MailArfError } = require("./framework-error");
@@ -237,6 +240,7 @@ function parse(rawMessage, opts) {
     var f = reportFields[fi];
     if (!f || !f.name) continue;
     var lcName = f.name.toLowerCase();
+    if (pick.isPoisonedKey(lcName)) continue;
     fieldMap[lcName] = f.value;
   }