@blamejs/blamejs-shop 0.5.5 → 0.5.7

package/lib/vendor/blamejs/lib/mail-send-deliver.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mail.send.deliver
@@ -62,6 +64,7 @@
 
 var nodeDns       = require("node:dns").promises;
 var bCrypto       = require("./crypto");
+var safeBuffer    = require("./safe-buffer");
 var validateOpts  = require("./validate-opts");
 var lazyRequire   = require("./lazy-require");
 var { defineClass } = require("./framework-error");
@@ -115,10 +118,19 @@ function _classifySmtpOutcome(err, response) {
 // headers per RFC 3462. Returns a raw RFC 5322 message ready to hand
 // to whatever transport the operator uses for DSN delivery.
 function _buildDsnMessage(opts) {
-  var from = opts.dsnFrom;
-  var to = opts.originalFrom;
-  var failedRecipient = opts.recipient;
-  var reason = opts.reason || "permanent failure";
+  // CRLF/NUL header-injection guard. Structured fields (addresses, the
+  // reporting-MTA name, the enhanced status code) can never legitimately
+  // carry CR / LF / NUL, so reject — a bounce built from a hostile
+  // original sender, or from a malicious peer MX, must fail closed rather
+  // than smuggle DSN headers or forge report parts. The 5xx `reason` is
+  // echoed from the peer's SMTP reply and is legitimately multi-line, so
+  // fold it to a single line instead of rejecting.
+  var from = safeBuffer.assertHeaderSafe(opts.dsnFrom, "dsnFrom", DeliverError, "deliver/bad-dsn-field");
+  var to = safeBuffer.assertHeaderSafe(opts.originalFrom, "originalFrom", DeliverError, "deliver/bad-dsn-field");
+  var failedRecipient = safeBuffer.assertHeaderSafe(opts.recipient, "recipient", DeliverError, "deliver/bad-dsn-field");
+  var reportingMta = safeBuffer.assertHeaderSafe(opts.reportingMta, "reportingMta", DeliverError, "deliver/bad-dsn-field");
+  var statusCode = safeBuffer.assertHeaderSafe(opts.statusCode, "statusCode", DeliverError, "deliver/bad-dsn-field");
+  var reason = safeBuffer.foldHeaderText(opts.reason || "permanent failure", " ");
   var origHeaders = opts.originalHeaders || "";
   var boundary = "dsn-" + bCrypto.generateToken(12);
   var nowIso = new Date().toUTCString();
@@ -134,7 +146,7 @@ function _buildDsnMessage(opts) {
     "--" + boundary + "\r\n" +
     "Content-Type: text/plain; charset=utf-8\r\n" +
     "\r\n" +
-    "This is the mail delivery system at " + (opts.reportingMta || from) + ".\r\n" +
+    "This is the mail delivery system at " + (reportingMta || from) + ".\r\n" +
     "\r\n" +
     "Your message to " + failedRecipient + " could not be delivered:\r\n" +
     "\r\n" +
@@ -143,12 +155,16 @@ function _buildDsnMessage(opts) {
     "--" + boundary + "\r\n" +
     "Content-Type: message/delivery-status\r\n" +
     "\r\n" +
-    "Reporting-MTA: dns; " + (opts.reportingMta || from.split("@")[1] || "") + "\r\n" +
+    // Reporting-MTA is an informational DSN header naming our own reporting MTA
+    // (it falls back to the bounce-from's domain); it drives no auth decision or
+    // delivery routing, so the leftmost-@ segment is acceptable here.
+    // allow:leftmost-domain-informational
+    "Reporting-MTA: dns; " + (reportingMta || from.split("@")[1] || "") + "\r\n" +
     "Arrival-Date: " + nowIso + "\r\n" +
     "\r\n" +
     "Final-Recipient: rfc822; " + failedRecipient + "\r\n" +
     "Action: failed\r\n" +
-    "Status: " + (opts.statusCode || "5.0.0") + "\r\n" +
+    "Status: " + (statusCode || "5.0.0") + "\r\n" +
     "Diagnostic-Code: smtp; " + reason + "\r\n" +
     "\r\n" +
     "--" + boundary + "\r\n" +
@@ -300,6 +316,15 @@ async function _tryHost(envelope, mxHost, hostnameLocal, opts) {
 }
 
 async function _deliverOne(envelope, recipient, ctx) {
+  // A recipient addr-spec has exactly one '@' (RFC 5322 §3.4.1). split("@")[1]
+  // on a multi-@ string (victim@internal.host@external.com) takes the LEFTMOST
+  // segment, so the MX lookup + delivery would route to a domain other than the
+  // intended one — a mis-delivery / exfiltration vector. Refuse a multi-@
+  // recipient as a permanent bad-address rather than route to the wrong host.
+  if (recipient.indexOf("@") !== recipient.lastIndexOf("@")) {
+    return { recipient: recipient, outcome: "permanent",
+             reason: "bad-address", reasonCode: "5.1.3" };
+  }
   var domain = recipient.split("@")[1];
   if (!domain) {
     return { recipient: recipient, outcome: "permanent",

package/lib/vendor/blamejs/lib/mail-server-imap.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.server.imap

package/lib/vendor/blamejs/lib/mail-server-jmap.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.server.jmap
@@ -395,18 +397,28 @@ function create(opts) {
             description: "Method '" + methodName + "' not implemented on this server" }, clientId]);
         continue;
       }
-      // Cross-tenant gate (RFC 8620 §3.6.1): if the call names an accountId,
-      // it MUST be one the actor is enumerated for. Rejected BEFORE the
-      // operator handler runs so a forged/foreign accountId never reaches
-      // the backend. Calls without an accountId (account-agnostic methods)
-      // pass through unchanged.
-      if (resolvedArgs && typeof resolvedArgs === "object" &&
-          resolvedArgs.accountId !== undefined && resolvedArgs.accountId !== null) {
-        var callAccountId = resolvedArgs.accountId;
-        if (typeof callAccountId !== "string" || !permittedAccounts[callAccountId]) {
+      // Cross-tenant gate (RFC 8620 §3.6.1): EVERY account-id argument the call
+      // names MUST be one the actor is enumerated for — not only `accountId`
+      // but also `fromAccountId` on /copy methods (Email/copy, CalendarEvent/copy
+      // — RFC 8620 §5.4), whose SOURCE account is read from. Checking only the
+      // destination accountId let a /copy name a foreign fromAccountId and copy
+      // (read) another tenant's data. Rejected BEFORE the operator handler runs.
+      // Account-agnostic methods (no *AccountId arg) pass through unchanged.
+      if (resolvedArgs && typeof resolvedArgs === "object") {
+        var argKeys = Object.keys(resolvedArgs);
+        var deniedAccountId; var deniedHit = false;
+        for (var aki = 0; aki < argKeys.length && !deniedHit; aki += 1) {
+          if (!/[Aa]ccountId$/.test(argKeys[aki])) continue;       // accountId, fromAccountId, ...
+          var accVal = resolvedArgs[argKeys[aki]];
+          if (accVal === undefined || accVal === null) continue;
+          if (typeof accVal !== "string" || !permittedAccounts[accVal]) {
+            deniedHit = true;
+            deniedAccountId = typeof accVal === "string" ? accVal : null;
+          }
+        }
+        if (deniedHit) {
           _emit("mail.server.jmap.account_not_found",
-            { method: methodName, accountId: typeof callAccountId === "string" ? callAccountId : null,
-              clientId: clientId }, "denied");
+            { method: methodName, accountId: deniedAccountId, clientId: clientId }, "denied");
           methodResponses.push(["error",
             { type: "urn:ietf:params:jmap:error:accountNotFound",
               description: "accountId is not accessible to this actor" }, clientId]);

package/lib/vendor/blamejs/lib/mail-server-managesieve.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.server.managesieve

package/lib/vendor/blamejs/lib/mail-server-mx.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.server.mx

package/lib/vendor/blamejs/lib/mail-server-net.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 // mail-server-net — the TCP-listener lifecycle shared by the mailbox / transfer

package/lib/vendor/blamejs/lib/mail-server-pop3.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.server.pop3

package/lib/vendor/blamejs/lib/mail-server-rate-limit.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.server.rateLimit

package/lib/vendor/blamejs/lib/mail-server-registry.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mail.serverRegistry

package/lib/vendor/blamejs/lib/mail-server-submission.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.server.submission

package/lib/vendor/blamejs/lib/mail-server-tls.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.server.tls

package/lib/vendor/blamejs/lib/mail-sieve.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 /**

package/lib/vendor/blamejs/lib/mail-spam-score.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.spamScore

package/lib/vendor/blamejs/lib/mail-srs.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mail.srs
@@ -53,6 +55,7 @@
 
 var nodeCrypto    = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer    = require("./safe-buffer");
 var validateOpts  = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -193,6 +196,9 @@ function create(opts) {
   function rewrite(originalAddress, nowMs) {
     validateOpts.requireNonEmptyString(
       originalAddress, "srs.rewrite.address", SrsError, "srs/bad-address");
+    // The local-part is embedded verbatim into the SRS0 envelope address —
+    // refuse CR / LF / NUL so it can't be smuggled into a later MAIL FROM.
+    safeBuffer.assertHeaderSafe(originalAddress, "srs.rewrite.address", SrsError, "srs/bad-address");
     var at = originalAddress.lastIndexOf("@");
     if (at <= 0 || at === originalAddress.length - 1) {
       throw new SrsError("srs/bad-address",
@@ -221,6 +227,7 @@ function create(opts) {
   function srs1Rewrite(srsAddress) {
     validateOpts.requireNonEmptyString(
       srsAddress, "srs.srs1Rewrite.address", SrsError, "srs/bad-address");
+    safeBuffer.assertHeaderSafe(srsAddress, "srs.srs1Rewrite.address", SrsError, "srs/bad-address");
     var at = srsAddress.lastIndexOf("@");
     if (at <= 0 || at === srsAddress.length - 1) {
       throw new SrsError("srs/bad-address",
@@ -264,6 +271,7 @@ function create(opts) {
   function reverse(srsAddress, nowMs) {
     validateOpts.requireNonEmptyString(
       srsAddress, "srs.reverse.address", SrsError, "srs/bad-address");
+    safeBuffer.assertHeaderSafe(srsAddress, "srs.reverse.address", SrsError, "srs/bad-address");
     var at = srsAddress.lastIndexOf("@");
     if (at <= 0 || at === srsAddress.length - 1) {
       throw new SrsError("srs/bad-address",

package/lib/vendor/blamejs/lib/mail-store-fts.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module    b.mailStore.fts

package/lib/vendor/blamejs/lib/mail-store.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mailStore

package/lib/vendor/blamejs/lib/mail-unsubscribe.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * mail-unsubscribe — RFC 8058 / RFC 2369 / RFC 2919 List-* support.

package/lib/vendor/blamejs/lib/mail.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mail
@@ -143,6 +145,14 @@ function _isAscii(s) {
  */
 function toAscii(domain) {
   if (typeof domain !== "string" || domain.length === 0) return null;
+  // domainToASCII silently TRUNCATES at a URL delimiter ("a.com/evil" -> "a.com"),
+  // so a string carrying one is not a bare host — return null rather than a
+  // misleading prefix. (":" / "@" / "[" / "]" already yield "", but reject them
+  // here too so every non-host character fails the same way.)
+  if (domain.indexOf("/") !== -1 || domain.indexOf("?") !== -1 ||
+      domain.indexOf("#") !== -1 || domain.indexOf("\\") !== -1 ||
+      domain.indexOf(":") !== -1 || domain.indexOf("@") !== -1 ||
+      domain.indexOf("[") !== -1 || domain.indexOf("]") !== -1) return null;
   var ascii;
   try { ascii = nodeUrl.domainToASCII(domain); }
   catch (_e) { return null; }
@@ -524,6 +534,7 @@ function _validateMessage(message) {
           var detected = fileType().detect(att.content);
           if (detected && detected.mime &&
               detected.mime.split("/")[0] !==
+              // allow:bare-split-on-quoted-header-token-grammar — split(";")[0] takes the Content-Type type/subtype, which precedes every parameter (RFC 9110 §8.3); a quoted ";" can only appear inside a later parameter value and so cannot affect [0].
               att.contentType.split(";")[0].trim().toLowerCase().split("/")[0]) {
             throw new MailError("mail/invalid-attachment",
               "attachments[" + i + "].contentType '" + att.contentType +

package/lib/vendor/blamejs/lib/markup-escape.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 // markup-escape — the shared XML/HTML text + attribute escaper used wherever

package/lib/vendor/blamejs/lib/markup-tokenizer.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 // markup-tokenizer — neutral lexing helpers shared by the markup sanitizers

package/lib/vendor/blamejs/lib/mcp-tool-registry.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.mcp.toolRegistry

package/lib/vendor/blamejs/lib/mcp.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mcp
@@ -648,10 +650,10 @@ function _validateValueAgainstSchema(value, schema, path) {
       // (a `(a+)+$` pattern blows up at ~40 input chars). Screen the tool
       // author's pattern through b.guardRegex so a ReDoS-shaped schema pattern
       // can't pin a CPU when matched against request input.
-      try { guardRegex().sanitize(schema.pattern, { profile: "strict" }); }
+      try { guardRegex().assertSafe(schema.pattern, path); }
       catch (_ge) { return path + ": schema pattern rejected as unsafe (ReDoS shape)"; }
       try {
-        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern is ReDoS-screened via guardRegex.sanitize (strict) above + input length-capped
+        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern is ReDoS-screened via guardRegex.assertSafe above + input length-capped
         if (!pat.test(value)) return path + ": does not match pattern";
       }
       catch (_e) { return path + ": invalid pattern in schema"; }

package/lib/vendor/blamejs/lib/mdoc.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mdoc

package/lib/vendor/blamejs/lib/metrics.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.metrics

package/lib/vendor/blamejs/lib/middleware/age-gate.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * ageGate middleware — request-level age classification + high-privacy

package/lib/vendor/blamejs/lib/middleware/ai-act-disclosure.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * ai-act-disclosure middleware — auto-inject the EU AI Act Article 50

package/lib/vendor/blamejs/lib/middleware/api-encrypt.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * api-encrypt — end-to-end PQC payload encryption for operator-

package/lib/vendor/blamejs/lib/middleware/assetlinks.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * assetlinks middleware — emits Digital Asset Links at

package/lib/vendor/blamejs/lib/middleware/asyncapi-serve.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * asyncapi-serve middleware — expose an AsyncAPI 3.0 document at a

package/lib/vendor/blamejs/lib/middleware/attach-user.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * attach-user middleware — populates req.user (and req.session) from a

package/lib/vendor/blamejs/lib/middleware/bearer-auth.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * bearer-auth middleware — extracts `Authorization: Bearer <token>`,

package/lib/vendor/blamejs/lib/middleware/body-parser.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * body-parser — request-body buffering + parsing middleware.

package/lib/vendor/blamejs/lib/middleware/bot-disclose.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * botDisclose middleware — California SB 1001 bot-disclosure.

package/lib/vendor/blamejs/lib/middleware/bot-guard.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Bot-guard middleware — fingerprint-based detection of obviously-non-
@@ -54,6 +56,7 @@ var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 var audit = lazyRequire(function () { return require("../audit"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 
 var BotGuardError = defineClass("BotGuardError", { alwaysPermanent: true });
 
@@ -64,7 +67,13 @@ var BotGuardError = defineClass("BotGuardError", { alwaysPermanent: true });
 // constructing patterns dynamically compile at their own call site so
 // the pattern source is visible in their code.
 function _coerceAgentPattern(r, where) {
-  if (r instanceof RegExp) return r;
+  if (r instanceof RegExp) {
+    // Screen the operator's pattern for catastrophic-backtracking (ReDoS)
+    // shapes ONCE at create()-time — it is later .test()'d against the
+    // attacker-controlled User-Agent on every request.
+    guardRegex().assertSafe(r, where, BotGuardError, "bot-guard/unsafe-pattern");
+    return r;
+  }
   throw new BotGuardError("bot-guard/bad-pattern",
     where + " must be a RegExp instance; got " + (typeof r) +
     " (compile the pattern at the call site so the source is visible " +

package/lib/vendor/blamejs/lib/middleware/clear-site-data.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.clearSiteData

package/lib/vendor/blamejs/lib/middleware/compose-pipeline.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.composePipeline

package/lib/vendor/blamejs/lib/middleware/compression.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * compression — gzip + brotli response compression.

package/lib/vendor/blamejs/lib/middleware/cookies.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware.cookies — inbound cookie-header threat detection.

package/lib/vendor/blamejs/lib/middleware/cors.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * CORS middleware — allow-list-only by default. No '*' wildcard support
@@ -52,6 +54,7 @@
 var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var audit = lazyRequire(function () { return require("../audit"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 var requestHelpers = require("../request-helpers");
 var safeUrl = require("../safe-url");
 var validateOpts = require("../validate-opts");
@@ -237,6 +240,10 @@ function create(opts) {
       }
       origins.push({ kind: "string", canonical: canonEntry, original: entry });
     } else if (entry instanceof RegExp) {
+      // Screen the operator's RegExp once at create() time for
+      // catastrophic-backtracking (ReDoS) shapes before it ever runs
+      // .test() against an attacker-controlled Origin header per request.
+      guardRegex().assertSafe(entry, "middleware.cors: origins[" + oi + "]", CorsError, "cors/unsafe-pattern");
       origins.push({ kind: "regex", pattern: entry });
     } else {
       throw new CorsError("cors/bad-origin",

package/lib/vendor/blamejs/lib/middleware/csp-nonce.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * csp-nonce — per-request CSP nonce + render integration.

package/lib/vendor/blamejs/lib/middleware/csp-report.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware.cspReport — Reporting-API endpoint for CSP / COEP /

package/lib/vendor/blamejs/lib/middleware/csrf-protect.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * csrf-protect — middleware that issues CSRF tokens to safe-method
@@ -189,9 +191,6 @@ function _checkOriginAllowed(req, allowedOrigins, isHttpsFn, requireOrigin) {
     return null;
   }
 
-  var requestOrigin = (isHttpsFn && isHttpsFn(req) ? "https://" : "http://") +
-                      (headers.host || "");
-
   function _originOf(rawUrl) {
     try {
       var u = new URL(rawUrl);                                                   // allow:raw-new-url-parse-only — origin-shape inspection (NOT outbound). Intentionally tolerates file:// / data: which safeUrl.parse refuses.
@@ -199,12 +198,20 @@ function _checkOriginAllowed(req, allowedOrigins, isHttpsFn, requireOrigin) {
     } catch (_e) { return null; }
   }
 
+  // Canonicalize the same-origin baseline through the SAME _originOf the
+  // candidate Origin/Referer go through (lowercases the host, strips the
+  // default port), or a mixed-case / default-port Host header would not match
+  // an equivalent Origin and a legitimate same-origin request would be refused.
+  var requestOrigin = _originOf((isHttpsFn && isHttpsFn(req) ? "https://" : "http://") +
+                                (headers.host || ""));
+
   function _isAllowed(candidateOrigin) {
     if (!candidateOrigin) return false;
-    if (candidateOrigin === requestOrigin) return true;
+    if (requestOrigin !== null && candidateOrigin === requestOrigin) return true;
     if (Array.isArray(allowedOrigins)) {
       for (var i = 0; i < allowedOrigins.length; i += 1) {
-        if (candidateOrigin === allowedOrigins[i]) return true;
+        // Canonicalize each operator allowedOrigins entry the same way.
+        if (candidateOrigin === _originOf(allowedOrigins[i])) return true;
       }
     }
     return false;

package/lib/vendor/blamejs/lib/middleware/daily-byte-quota.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * dailyByteQuota middleware — per-IP rolling 24-hour byte budget.

package/lib/vendor/blamejs/lib/middleware/db-role-for.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * dbRoleFor middleware — binds a request-time DB role.

package/lib/vendor/blamejs/lib/middleware/deny-response.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Shared deny-path response writer for the request-lifecycle

package/lib/vendor/blamejs/lib/middleware/dpop.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * dpop middleware — RFC 9449 Demonstrating Proof of Possession.

package/lib/vendor/blamejs/lib/middleware/error-handler.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Error-handler middleware — thin adapter over lib/error-page.

package/lib/vendor/blamejs/lib/middleware/fetch-metadata.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * fetch-metadata — Sec-Fetch-Site / Sec-Fetch-Mode / Sec-Fetch-Dest

package/lib/vendor/blamejs/lib/middleware/flag-context.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * flag-context middleware — extracts an OpenFeature evaluation context

package/lib/vendor/blamejs/lib/middleware/gpc.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware.gpc — Sec-GPC (Global Privacy Control) middleware.

package/lib/vendor/blamejs/lib/middleware/headers.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware.headers — inbound HTTP header threat detection.

package/lib/vendor/blamejs/lib/middleware/health.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * health — liveness / readiness / startup endpoint primitive.