@blamejs/blamejs-shop 0.5.5 → 0.5.7

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.spf + b.mail.dmarc + b.mail.arc — inbound mail authentication
@@ -54,6 +56,7 @@ var bCrypto = require("./crypto");
 var C = require("./constants");
 var numericBounds = require("./numeric-bounds");
 var dkim = require("./mail-dkim");
+var ARC_AMS_REUSE = require("./mail-arc-reuse-token");
 var mimeParse = require("./mime-parse");
 var safeXml = require("./parsers/safe-xml");
 var ipUtils = require("./ip-utils");
@@ -291,7 +294,7 @@ function _ipv4InCidr(ip, cidr) {
   var slash = cidr.indexOf("/");
   var net = slash === -1 ? cidr : cidr.slice(0, slash);
   var mask = slash === -1 ? 32 : parseInt(cidr.slice(slash + 1), 10);             // IPv4 max prefix
-  if (mask < 0 || mask > 32) return false;                                       // IPv4 max prefix
+  if (!isFinite(mask) || mask < 0 || mask > 32) return false;                     // IPv4 max prefix
   var ipInt = _ipv4ToInt(ip);
   var netInt = _ipv4ToInt(net);
   if (ipInt === null || netInt === null) return false;
@@ -806,8 +809,24 @@ async function spfVerify(opts) {
     throw new MailAuthError("mail-auth/spf-bad-ip",
       "spf.verify: ip must be a string");
   }
+  var mailFromStr = opts.mailFrom ? String(opts.mailFrom) : "";
+  // A MAIL FROM addr-spec has exactly one '@' (RFC 5322 §3.4.1). split("@")[1]
+  // on a multi-@ string takes the LEFTMOST segment, so the SPF check would
+  // authorize a domain the attacker controls rather than the envelope sender's
+  // real domain (CWE-290). A multi-@ MAIL FROM is malformed — return a permanent
+  // SPF error (a RESULT, not a throw). spfVerify runs inside b.mail.inbound.verify,
+  // whose contract is that message-derived faults surface as a permerror/temperror
+  // verdict, never a throw: a throw here is caught by mail-server-mx as a pipeline
+  // temperror, which onTemperror:"accept" would let through — skipping SPF/DMARC
+  // gating for the spoofed From. Returning permerror (domain null → SPF cannot
+  // align) keeps the pipeline running so DMARC still gates the From header.
+  if (mailFromStr && mailFromStr.indexOf("@") !== mailFromStr.lastIndexOf("@")) {
+    return { result: "permerror", domain: null,
+             explanation: "mailFrom has more than one '@' (not a valid addr-spec)",
+             lookupCount: 0 };
+  }
   var domain = opts.mailFrom
-    ? String(opts.mailFrom).split("@")[1]
+    ? mailFromStr.split("@")[1]
     : opts.helo;
   if (typeof domain !== "string" || domain.length === 0) {
     throw new MailAuthError("mail-auth/spf-bad-domain",
@@ -1176,8 +1195,13 @@ function _parseDmarcRecord(text) {
 
 function _alignmentCheck(fromDomain, authDomain, mode) {
   if (!fromDomain || !authDomain) return false;
-  var f = fromDomain.toLowerCase();
-  var a = authDomain.toLowerCase();
+  // Canonicalize both domains identically (lowercase + trailing-dot strip + IDN
+  // A-label) so strict alignment compares the same host form the relaxed PSL
+  // path already normalizes — a trailing-dot / U-label SPF auth-domain must not
+  // fail an otherwise-aligned message.
+  var f = publicSuffix.canonicalDomain(fromDomain);
+  var a = publicSuffix.canonicalDomain(authDomain);
+  if (!f || !a) return false;
   if (mode === "s") return f === a;                                              // strict
   // RFC 7489 §3.1.1 + DMARCbis §4.4 — relaxed alignment compares the
   // organizational domain (the public-suffix-tail registered name).
@@ -1203,6 +1227,15 @@ async function dmarcEvaluate(opts) {
     throw new MailAuthError("mail-auth/dmarc-bad-from",
       "dmarc.evaluate: opts.from must be the From-header email address");
   }
+  // An addr-spec has exactly one '@' (RFC 5322 §3.4.1). split("@")[1] on a
+  // multi-@ string (x@attacker@victim) silently takes the LEFTMOST segment
+  // (attacker), which can diverge from the rightmost-@ domain the inbound From
+  // parser gated on — so DMARC would authorize a different domain than the one
+  // displayed. Refuse a multi-@ From as malformed (CWE-290).
+  if (opts.from.indexOf("@") !== opts.from.lastIndexOf("@")) {
+    throw new MailAuthError("mail-auth/dmarc-bad-from",
+      "dmarc.evaluate: opts.from has more than one '@' (not a valid addr-spec)");
+  }
   var fromDomain = opts.from.split("@")[1];
   if (!fromDomain) {
     throw new MailAuthError("mail-auth/dmarc-bad-from",
@@ -1425,6 +1458,25 @@ function _parseHeaderLines(headerSection) {
 // limit how far an attacker can push junk headers.
 var ARC_MAX_HOPS = 50;                                                           // RFC 8617 §5.1.2 chain ceiling
 
+// Parse the ARC instance tag (i=) from an ARC header value (RFC 8617
+// §4.2.1). Strict by construction: the tag must follow a value boundary
+// (start / ";" / "," / whitespace), use no space around "=", and be 1-3
+// digits (instances are bounded to [1,50]). EVERY ARC-header instance read
+// — the indexing pass that drives the AMS/AS crypto checks, the AMS h=
+// retention test, the per-hop d= extraction, and the finalAr surfacing —
+// routes through this one parser so they can never disagree about which hop
+// a header belongs to. A looser parser in one place (e.g. allowing "i = 1"
+// with a space, or unbounded digits) lets an attacker inject an
+// ARC-Authentication-Results that the strict crypto pass ignores while a
+// permissive pass consumes it, forging the upstream auth-results surfaced as
+// finalAr on a chain that still verifies pass — with no signing key.
+function _arcInstanceOf(value) {
+  var m = String(value).match(/(?:^|[;,\s])i=(\d{1,3})\b/);
+  if (!m) return null;
+  var inst = parseInt(m[1], 10);
+  return (isFinite(inst) && inst >= 1) ? inst : null;
+}
+
 async function arcVerify(rfc822, opts) {
   if (typeof rfc822 !== "string" || rfc822.length === 0) {
     throw new MailAuthError("mail-auth/arc-bad-input",
@@ -1460,13 +1512,11 @@ async function arcVerify(rfc822, opts) {
     var value = khv.value.trim();
     if (name !== "arc-seal" && name !== "arc-message-signature" &&
         name !== "arc-authentication-results") continue;
-    // ARC hop instance per RFC 8617 §4.2.1 — bounded to 3 digits; the
-    // spec doesn't define a hard ceiling but operational use never
-    // exceeds 50 hops, and a 999-hop limit prevents pathological
-    // header values from chewing the verifier.
-    var iMatch = value.match(/(?:^|[;,\s])i=(\d{1,3})\b/);
-    var inst = iMatch ? parseInt(iMatch[1], 10) : null;
-    if (inst === null || !isFinite(inst) || inst < 1) continue;
+    // ARC hop instance per RFC 8617 §4.2.1 — parsed by the shared strict
+    // reader so the index this drives (and the AMS/AS crypto checks keyed on
+    // it) matches every other instance read in the verifier/evaluator.
+    var inst = _arcInstanceOf(value);
+    if (inst === null) continue;
     if (inst > maxInstanceSeen) maxInstanceSeen = inst;
     var slotKey = inst + ":" + name;
     if (seenSlot[slotKey]) { duplicate = true; continue; }
@@ -1759,7 +1809,9 @@ async function _verifyArc(rfc822, hop, allHops, kind, dnsLookup, dkim) {
   }
   // Current AS with b= emptied. RFC 8617 §5.1.2: canonicalization
   // includes the AS header with `b=` value stripped + no trailing CRLF.
-  var asUnsigned = sigValue.replace(/(\bb=)[^;]*/i, "$1");
+  // Use the shared tag-aware stripper (the `\bb=...` regex it replaced
+  // mis-zeroed a value containing `b=` inside another tag, e.g. `d=ab=x`).
+  var asUnsigned = dkim._stripBTagValue(sigValue);
   canonicalized += _canonRelaxedHeader("ARC-Seal", asUnsigned).replace(/\r\n$/, "");
 
   // Verify the AS signature.
@@ -1793,15 +1845,23 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
       // canonicalizes it via h=). Pre-v0.8.17 stripped every AAR
       // unconditionally, breaking verification on chains that
       // included AAR in h= (Microsoft + Google interop).
-      var instMatch = /\bi\s*=\s*(\d+)/.exec(khv.value);
-      if (!instMatch || parseInt(instMatch[1], 10) !== hop.instance) continue;
+      var aarInst = _arcInstanceOf(khv.value);
+      if (aarInst === null || aarInst !== hop.instance) continue;
     }
     rebuilt.push(line);
   }
   rebuilt.unshift(renamedHeader);
   var synthetic = rebuilt.join("\r\n") + (sep === -1 ? "" :
     rfc822.slice(headerEnd));
-  var rv = await dkim.verify(synthetic, { dnsLookup: dnsLookup });
+  // The AMS i= tag is an RFC 8617 §4.1.2 instance number, not a DKIM AUID;
+  // signal the verifier (via the shared internal reuse token) to skip the
+  // §3.5 AUID/d= binding check that would otherwise permerror every ARC chain
+  // and to canonicalize the signature header under its ARC-Message-Signature
+  // name. The token is exported from no public surface, so this reuse is
+  // unreachable from b.mail.dkim.verify.
+  var verifyOpts = { dnsLookup: dnsLookup };
+  verifyOpts[ARC_AMS_REUSE] = true;
+  var rv = await dkim.verify(synthetic, verifyOpts);
   if (!Array.isArray(rv) || rv.length === 0) {
     return { result: "permerror", errors: ["ams: dkim verifier returned no results"] };
   }
@@ -1941,12 +2001,14 @@ async function arcEvaluate(rfc822, opts) {
     var name = khv.key;
     var value = khv.value.trim();
     if (name === "arc-seal") {
-      var iMatch = value.match(/(?:^|[;,\s])i=(\d+)/);                            // allow:regex-no-length-cap — header bounded by RFC 5322 998
+      var sealInst = _arcInstanceOf(value);
       var dMatch = value.match(/(?:^|[;,\s])d=([^\s;]+)/);                        // allow:regex-no-length-cap — header bounded by RFC 5322 998
-      if (iMatch && dMatch) hopDomains[parseInt(iMatch[1], 10)] = dMatch[1].toLowerCase();
+      if (sealInst !== null && dMatch) hopDomains[sealInst] = dMatch[1].toLowerCase();
     } else if (name === "arc-authentication-results") {
-      var arIMatch = value.match(/\bi\s*=\s*(\d+)/);                              // allow:regex-no-length-cap — header bounded by RFC 5322 998
-      if (arIMatch) hopAr[parseInt(arIMatch[1], 10)] = value;
+      // Same strict instance reader as the indexing pass — finalAr must be the
+      // AAR the crypto pass actually indexed, never one a looser parser admits.
+      var arInst = _arcInstanceOf(value);
+      if (arInst !== null) hopAr[arInst] = value;
     }
   }
 
@@ -2061,6 +2123,10 @@ function authResultsEmit(opts) {
 
   var version = (opts.version === undefined || opts.version === null)
     ? "1" : String(opts.version);
+  if (/[\r\n\0]/.test(version)) {
+    throw new MailAuthError("mail-auth/ar-bad-version",
+      "authResults.emit: version contains forbidden control characters");
+  }
   var head = opts.authservId + (version === "1" ? "" : " " + version);
 
   if (opts.results.length === 0) {
@@ -2239,6 +2305,14 @@ function _extractFromHeaders(headerBlock) {
     // not a single bare addr-spec.
     if (/[\s,;:<>]/.test(address)) address = null;
   }
+  // An RFC 5322 addr-spec has EXACTLY ONE '@' (local-part "@" domain). A second
+  // '@' (x@attacker@victim) is malformed: the rightmost-@ derivation below reads
+  // victim as the author domain, while a downstream leftmost-@ parser
+  // (dmarc.evaluate's split("@")[1]) reads attacker — so DMARC could authorize a
+  // domain the attacker controls while the displayed From is the victim's
+  // (CWE-290). Treat any address with more than one '@' as unparsable so the
+  // caller fails closed (permerror → reject).
+  if (address && address.indexOf("@") !== address.lastIndexOf("@")) address = null;
   var at = address ? address.lastIndexOf("@") : -1;
   var domain = (at > 0 && address && at < address.length - 1)
     ? address.slice(at + 1).toLowerCase()

package/lib/vendor/blamejs/lib/mail-bimi.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mail.bimi
@@ -52,6 +54,7 @@ var nodeCrypto = require("node:crypto");
 
 var asn1 = require("./asn1-der");
 var C = require("./constants");
+var pick = require("./pick");
 var httpClient = require("./http-client");
 var lazyRequire = require("./lazy-require");
 var networkDnsResolver = lazyRequire(function () { return require("./network-dns-resolver"); });
@@ -60,6 +63,7 @@ var markupTokenizer = require("./markup-tokenizer");
 var x509Chain = require("./x509-chain");
 var structuredFields = require("./structured-fields");
 var safeUrl = require("./safe-url");
+var publicSuffix = require("./public-suffix");
 var validateOpts = require("./validate-opts");
 var { defineClass, MailBimiError } = require("./framework-error");
 
@@ -571,7 +575,7 @@ function _parseTinyPsAttrs(src) {
   while ((m = re.exec(src)) !== null) {
     var name = m[1];
     var value = m[3] !== undefined ? m[3] : (m[4] !== undefined ? m[4] : (m[5] || ""));
-    attrs[name] = value;
+    if (!pick.isPoisonedKey(name)) attrs[name] = value;
   }
   return attrs;
 }
@@ -866,25 +870,37 @@ function _verifyCertChain(leaf, intermediates, anchors) {
 // is a comma-separated string like "URI:https://example.com, DNS:example.com";
 // accept either a URI:* matching the domain's hostname OR a DNS:*
 // exact match (compat - some VMC profiles emit DNS instead of URI).
+// _canonBimiHost — canonical host form for the SAN-vs-domain authorization
+// compare, via the one delimiter-safe canonicalizer (lowercase + trailing-dot
+// strip + IDN A-label, and crucially rejecting "/" "?" "#" which domainToASCII
+// truncates at — so a SAN like "victim.example/evil" can't masquerade as
+// "victim.example"). Returns "" for any non-host value, which then matches
+// nothing (fail closed).
+function _canonBimiHost(host) {
+  return publicSuffix.canonicalDomain(host == null ? "" : host);
+}
+
 function _subjectAltNameMatchesDomain(cert, domain) {
   var raw = cert.subjectAltName || "";
   var parts = raw.split(",").map(function (s) { return s.trim(); }).filter(Boolean);
   var found = parts.slice();
-  var dom = domain.toLowerCase();
+  var dom = _canonBimiHost(domain);
+  if (dom.length === 0) return { ok: false, found: found };
   for (var i = 0; i < parts.length; i += 1) {
     var p = parts[i];
     var lp = p.toLowerCase();
     if (lp.indexOf("dns:") === 0) {
-      var dns2 = lp.slice(4);
-      if (dns2 === dom) return { ok: true, found: found };
-    }
-    if (lp.indexOf("uri:") === 0) {
-      var uri = p.slice(4);
+      if (_canonBimiHost(p.slice(4)) === dom) return { ok: true, found: found };
+    } else if (lp.indexOf("uri:") === 0) {
       try {
-        var u = safeUrl.parse(uri, { allowedProtocols: ["https:", "http:"] });
-        if ((u.hostname || "").toLowerCase() === dom) return { ok: true, found: found };
+        var u = safeUrl.parse(p.slice(4), { allowedProtocols: ["https:", "http:"] });
+        if (_canonBimiHost(u.hostname) === dom) return { ok: true, found: found };
       } catch (_e) {
-        if (lp.indexOf(dom) !== -1) return { ok: true, found: found };
+        // A URI SAN the URL parser refuses (userinfo / malformed / homograph)
+        // is not a usable host binding — FAIL CLOSED. No substring fallback:
+        // the old `lp.indexOf(dom) !== -1` matched the domain anywhere in the
+        // raw SAN string (userinfo / path), so a CA-chained cert whose real
+        // host differed could vouch for an arbitrary victim domain.
       }
     }
   }

package/lib/vendor/blamejs/lib/mail-bounce.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mailBounce
@@ -812,7 +814,11 @@ function _parseDsn(rawMessage) {
 
 function _foldFieldValue(name, value) {
   // RFC 5322 §2.2.3 — long lines fold at WSP. Keep it simple: emit
-  // `Name: value` and let downstream MTAs handle further folding.
+  // `Name: value` and let downstream MTAs handle further folding. This
+  // choke point emits a single `Name: value` line, so reject CR / LF /
+  // NUL in the value — an embedded terminator would smuggle a new field
+  // or forge a report part.
+  safeBuffer.assertHeaderSafe(value, name, MailBounceError, "bounce/bad-dsn-field");
   return name + ": " + value + "\r\n";
 }
 
@@ -836,10 +842,21 @@ function _buildDsn(opts) {
       String(opts.status) + "'");
   }
 
+  // CRLF/NUL header-injection guard. Recipients and MTA names are
+  // structured fields that can never legitimately carry CR / LF / NUL, so
+  // reject — a DSN built from a hostile recipient or peer must fail closed
+  // rather than smuggle a header or forge a report part. Diagnostic-Code
+  // echoes the remote server's SMTP reply (free text, legitimately
+  // multi-line), so fold it to a single line instead of rejecting.
+  safeBuffer.assertHeaderSafe(opts.finalRecipient, "finalRecipient", MailBounceError, "bounce/bad-dsn-field");
+  if (opts.originalRecipient != null) {
+    safeBuffer.assertHeaderSafe(opts.originalRecipient, "originalRecipient", MailBounceError, "bounce/bad-dsn-field");
+  }
   var reportingMta   = opts.reportingMta || "dns; localhost";
   var arrivalDate    = opts.arrivalDate  || new Date().toUTCString();
   var originalMessage = opts.originalMessage || null;
-  var diagnosticCode = opts.diagnosticCode || null;
+  var diagnosticCode = opts.diagnosticCode != null
+    ? safeBuffer.foldHeaderText(String(opts.diagnosticCode), " ") : null;
   var remoteMta      = opts.remoteMta || null;
   var humanText      = opts.humanText || (
     "This is the mail system at " + reportingMta + ".\r\n\r\n" +
@@ -854,10 +871,10 @@ function _buildDsn(opts) {
   var lines = [];
   lines.push("MIME-Version: 1.0");
   lines.push('Content-Type: multipart/report; report-type=delivery-status; boundary="' + boundary + '"');
-  if (opts.from)    lines.push("From: " + opts.from);
-  if (opts.to)      lines.push("To: " + opts.to);
-  if (opts.subject) lines.push("Subject: " + opts.subject);
-  if (opts.messageId) lines.push("Message-ID: " + opts.messageId);
+  if (opts.from)    lines.push("From: " + safeBuffer.assertHeaderSafe(opts.from, "from", MailBounceError, "bounce/bad-dsn-field"));
+  if (opts.to)      lines.push("To: " + safeBuffer.assertHeaderSafe(opts.to, "to", MailBounceError, "bounce/bad-dsn-field"));
+  if (opts.subject) lines.push("Subject: " + safeBuffer.assertHeaderSafe(opts.subject, "subject", MailBounceError, "bounce/bad-dsn-field"));
+  if (opts.messageId) lines.push("Message-ID: " + safeBuffer.assertHeaderSafe(opts.messageId, "messageId", MailBounceError, "bounce/bad-dsn-field"));
   lines.push("");
 
   // Part 1 - human-readable description.

package/lib/vendor/blamejs/lib/mail-crypto-pgp.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // codebase-patterns:allow-file raw-byte-literal — RFC 9580 OpenPGP packet
 // framing carries protocol-mandated byte-shape constants throughout (32-byte

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.crypto.smime

package/lib/vendor/blamejs/lib/mail-crypto.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.crypto

package/lib/vendor/blamejs/lib/mail-dav.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // codebase-patterns:allow-file raw-byte-literal — DAV is HTTP-shaped; every
 // numeric in this file is an HTTP status code (200 / 201 / 207 / 400 / 401

package/lib/vendor/blamejs/lib/mail-deploy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 /**

package/lib/vendor/blamejs/lib/mail-dkim.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * mail-dkim — DKIM-Signature header generation for outbound mail.
@@ -44,6 +46,7 @@ var structuredFields = require("./structured-fields");
 var nodeCrypto  = require("node:crypto");
 var safeBuffer  = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
+var ARC_AMS_REUSE = require("./mail-arc-reuse-token");
 var C           = require("./constants");
 var networkDnsResolver = lazyRequire(function () { return require("./network-dns-resolver"); });
 var { FrameworkError } = require("./framework-error");
@@ -684,7 +687,12 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   // of d=. A signature whose i= claims `@evil.example.com` while d=
   // is `example.org` is malformed and binds the signer's claim to a
   // domain the verifier wouldn't otherwise associate. Refuse.
-  if (typeof sigTags.i === "string" && sigTags.i.length > 0) {
+  // arcAmsReuse: the caller is b.mail.arc.verify reusing this verifier for an
+  // ARC-Message-Signature, whose i= is an RFC 8617 instance number, not a DKIM
+  // AUID — skip the AUID/d= binding check for it. The flag rides a Symbol key
+  // unreachable from the public string-opts surface, so the check stays a
+  // non-opt-out default for every real DKIM signature.
+  if (!verifyOpts.arcAmsReuse && typeof sigTags.i === "string" && sigTags.i.length > 0) {
     var iDomain = sigTags.i.indexOf("@") === -1
                     ? sigTags.i
                     : sigTags.i.slice(sigTags.i.indexOf("@") + 1);
@@ -745,6 +753,21 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   if (actualBh !== expectedBh) {
     return { result: "fail", errors: ["body hash mismatch"] };
   }
+  // RFC 6376 §8.2 — l= signs only the first lcap canonicalized octets, so any
+  // body delivered beyond lcap is UNSIGNED: the body hash above matched the
+  // prefix, but the recipient receives appended content the signer never
+  // authenticated (verified bytes ≠ delivered bytes, CWE-345). The framework
+  // already refuses l= at sign-time; on verify, a signature whose l= leaves
+  // appended content unsigned must not pass by default. An operator who must
+  // accept legacy l= senders opts in via verify({ acceptBodyLengthLimit: true }).
+  if (lcap !== undefined && !verifyOpts.acceptBodyLengthLimit) {
+    var fullCanon = canonBody === "simple" ? _canonBodySimple(body) : _canonBodyRelaxed(body);
+    if (lcap < Buffer.byteLength(fullCanon, "utf8")) {
+      return { result: "fail",
+               errors: ["DKIM-Signature l= leaves appended body content unsigned " +
+                        "(RFC 6376 §8.2 append-after-signature)"] };
+    }
+  }
 
   // 2. Canonicalize the headers in h= order, then the DKIM-Signature
   //    header itself with the b= value emptied (per §3.7).
@@ -781,9 +804,15 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   // name ends in `b` (`ab=`, `pub=`, `cb=` …). Anchor on the tag-list
   // structure instead.
   var unsignedSigValue = _stripBTagValue(sigHeader.value);
+  // The signature header is canonicalized under its true field name (§3.7).
+  // For the ARC reuse the header on the wire is ARC-Message-Signature, signed
+  // under that name; the synthetic renames it to DKIM-Signature only so this
+  // verifier finds it, so the canonical form must restore the real name or the
+  // b= value never matches what the relay signed.
+  var sigCanonName = verifyOpts.arcAmsReuse ? "ARC-Message-Signature" : "DKIM-Signature";
   canonicalizedHeaders += canonHeader === "simple"
-    ? _canonHeaderSimple("DKIM-Signature", " " + unsignedSigValue).replace(/\r\n$/, "")
-    : _canonHeaderRelaxed("DKIM-Signature", unsignedSigValue).replace(/\r\n$/, "");
+    ? _canonHeaderSimple(sigCanonName, " " + unsignedSigValue).replace(/\r\n$/, "")
+    : _canonHeaderRelaxed(sigCanonName, unsignedSigValue).replace(/\r\n$/, "");
 
   // 3. Verify the signature.
   var sigB64 = sigTags.b;
@@ -864,7 +893,7 @@ async function verify(rfc822, opts) {
   }
   opts = opts || {};
   validateOpts(opts, ["dnsLookup", "audit", "clockSkewMs", "maxSignatures",
-                       "minRsaBits"], "mail.dkim.verify");
+                       "minRsaBits", "acceptBodyLengthLimit"], "mail.dkim.verify");
   var auditOn = opts.audit !== false;
 
   // Bounded clock skew: refuse non-numeric / negative / infinite /
@@ -906,7 +935,16 @@ async function verify(rfc822, opts) {
     }
     maxSignatures = Math.floor(opts.maxSignatures);
   }
-  var verifyOpts = { minRsaBits: opts.minRsaBits };
+  var verifyOpts = { minRsaBits: opts.minRsaBits,
+                     acceptBodyLengthLimit: opts.acceptBodyLengthLimit === true };
+  // Framework-internal ARC reuse: the key is a Symbol owned by
+  // mail-arc-reuse-token (exported from no public surface), so only framework
+  // code that requires that module can set it. When present, the i= tag is an
+  // RFC 8617 instance number, not a DKIM AUID — the §3.5 AUID-subdomain check
+  // is skipped and the signature header is canonicalized under its real
+  // ARC-Message-Signature name. The public b.mail.dkim.verify path can never
+  // reach this, so the AUID check stays a non-opt-out default for real DKIM.
+  if (opts[ARC_AMS_REUSE] === true) verifyOpts.arcAmsReuse = true;
 
   var split = _splitHeadersBody(rfc822);
   var parsedHeaders = _parseHeaders(split.headers);
@@ -1287,6 +1325,7 @@ module.exports = {
   _canonHeaderRelaxedForTest: _canonHeaderRelaxed,
   _canonBodyRelaxedForTest:   _canonBodyRelaxed,
   _canonBodySimpleForTest:    _canonBodySimple,
+  _stripBTagValue:            _stripBTagValue,   // RFC 6376 §3.5 — tag-aware b= zeroing; shared by the ARC seal verifier (internal cross-module helper)
   _stripBTagValueForTest:     _stripBTagValue,
   // The header-block parser that produces the { name, value } pairs fed to the
   // canonicalizers. Exposed so a golden-vector test can pin its byte-exact

package/lib/vendor/blamejs/lib/mail-greylist.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.greylist

package/lib/vendor/blamejs/lib/mail-helo.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.helo
@@ -105,6 +107,7 @@ var { defineClass }    = require("./framework-error");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
 var gateContract       = require("./gate-contract");
+var guardRegex         = require("./guard-regex");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
@@ -210,6 +213,19 @@ async function evaluate(ctx, opts) {
   var selfNames = (opts.selfNames || []).map(function (n) { return String(n).toLowerCase(); });
   var auditImpl = opts.audit || audit();
 
+  // Screen operator-supplied generic-rDNS patterns ONCE at build time —
+  // they are .test()'d per-match against attacker-controlled rDNS / claim
+  // names, so a catastrophic-backtracking shape would be a ReDoS lever.
+  if (Array.isArray(opts.genericRdnsPatterns)) {
+    for (var gi = 0; gi < opts.genericRdnsPatterns.length; gi += 1) {
+      var gre = opts.genericRdnsPatterns[gi];
+      if (gre instanceof RegExp) {
+        guardRegex.assertSafe(gre, "mail.helo.evaluate: genericRdnsPatterns[" + gi + "]",
+          MailHeloError, "mail-helo/unsafe-pattern");
+      }
+    }
+  }
+
   if (!ctx || typeof ctx !== "object") {
     throw new MailHeloError("mail-helo/bad-input",
       "evaluate: ctx must be a plain object");

package/lib/vendor/blamejs/lib/mail-journal.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 /**

package/lib/vendor/blamejs/lib/mail-mdn.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mailMdn
@@ -31,6 +33,7 @@
 var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var mimeParse = require("./mime-parse");
+var safeBuffer = require("./safe-buffer");
 var structuredFields = require("./structured-fields");
 var audit = lazyRequire(function () { return require("./audit"); });
 var C = require("./constants");
@@ -210,6 +213,20 @@ function build(opts) {
       "and opts.requireUserConfirmation is not explicitly false (RFC 3798 §2.1)");
   }
 
+  // CRLF/NUL header-injection guard. Every structured MDN field
+  // (recipients, message-id, envelope headers, reporting UA) is a
+  // single-line header value that can never legitimately carry CR / LF /
+  // NUL — an inbound message must not be able to smuggle headers into the
+  // return receipt. Guard before addressType() so a hostile address fails
+  // closed with the mdn error, not an address-parse error.
+  safeBuffer.assertHeaderSafe(opts.finalRecipient, "finalRecipient", MailMdnError, "mdn/bad-header-field");
+  safeBuffer.assertHeaderSafe(opts.originalMessageId, "originalMessageId", MailMdnError, "mdn/bad-header-field");
+  if (opts.originalRecipient != null) safeBuffer.assertHeaderSafe(opts.originalRecipient, "originalRecipient", MailMdnError, "mdn/bad-header-field");
+  if (opts.reportingUserAgent != null) safeBuffer.assertHeaderSafe(opts.reportingUserAgent, "reportingUserAgent", MailMdnError, "mdn/bad-header-field");
+  if (opts.from != null) safeBuffer.assertHeaderSafe(opts.from, "from", MailMdnError, "mdn/bad-header-field");
+  if (opts.to != null) safeBuffer.assertHeaderSafe(opts.to, "to", MailMdnError, "mdn/bad-header-field");
+  if (opts.subject != null) safeBuffer.assertHeaderSafe(opts.subject, "subject", MailMdnError, "mdn/bad-header-field");
+
   var boundary = _generateBoundary();
   var recipType = mimeParse.addressType(opts.finalRecipient);
   var origRecipType = opts.originalRecipient ? mimeParse.addressType(opts.originalRecipient) : recipType;

package/lib/vendor/blamejs/lib/mail-rbl.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.rbl

package/lib/vendor/blamejs/lib/mail-require-tls.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.requireTls

package/lib/vendor/blamejs/lib/mail-scan.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.scan