@blamejs/blamejs-shop 0.5.5 → 0.5.7

package/lib/vendor/blamejs/test/layer-0-primitives/mail-auth.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.spf + b.mail.dmarc + b.mail.arc — inbound mail
@@ -65,6 +67,18 @@ async function testSpfVerifyMockedDns() {
   });
   check("spf.verify(non-matching ip) → fail (-all)",
         rv2.result === "fail");
+
+  // A MAIL FROM addr-spec has exactly one '@'. split("@")[1] on a multi-@
+  // string (x@attacker.example@example.com) takes the LEFTMOST segment, so SPF
+  // would authorize attacker.example (which the attacker controls) instead of
+  // the envelope sender's real domain. A multi-@ MAIL FROM must surface as a
+  // permanent SPF error VERDICT, not a throw — spfVerify runs inside
+  // b.mail.inbound.verify, where a throw is caught as a pipeline temperror that
+  // onTemperror:"accept" would let through, skipping SPF/DMARC gating (CWE-290).
+  var spfMultiAt = await b.mail.spf.verify({ ip: "192.0.2.5",
+    mailFrom: "x@attacker.example@example.com", dnsLookup: dnsLookup });
+  check("spf.verify: a multi-@ MAIL FROM returns permerror (a verdict, not a throw)",
+        spfMultiAt.result === "permerror" && spfMultiAt.domain === null);
 }
 
 function testDmarcParse() {
@@ -92,6 +106,25 @@ async function testDmarcEvaluateAligned() {
         rv.alignment.spf === true && rv.alignment.dkim === true);
 }
 
+async function testDmarcStrictAlignmentCanonicalizesDomain() {
+  // Strict alignment (aspf=s) must canonicalize both domains (trailing dot /
+  // case / IDN A-label) the same way the relaxed PSL path does. The SPF auth
+  // domain can legitimately carry a trailing dot (FQDN form); comparing it raw
+  // against the From domain wrongly failed a perfectly aligned message.
+  var dnsLookup = async function (host) {
+    if (host === "_dmarc.example.com") return [["v=DMARC1; p=reject; aspf=s; adkim=s"]];
+    var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+  };
+  var rv = await b.mail.dmarc.evaluate({
+    from:    "alice@example.com",
+    spf:     { result: "pass", domain: "Example.COM." },   // trailing dot + mixed case — same domain
+    dkim:    [],
+    dnsLookup: dnsLookup,
+  });
+  check("dmarc strict alignment: a trailing-dot/mixed-case SPF auth-domain still aligns",
+        rv.alignment.spf === true);
+}
+
 async function testDmarcEvaluateUnaligned() {
   var dnsLookup = async function (host) {
     if (host === "_dmarc.example.com") {
@@ -165,6 +198,27 @@ async function testInboundVerifySpoofRejected() {
   check("inbound.verify: no authservId → no A-R header", v.authResults === null);
 }
 
+async function testInboundVerifyMultiAtMailFromGatesNotThrows() {
+  // A multi-@ MAIL FROM (x@attacker@victim) must NOT throw out of the verify
+  // pipeline: a throw is caught by mail-server-mx as a temperror, which
+  // onTemperror:"accept" would let through, skipping SPF/DMARC gating for the
+  // spoofed From (CWE-290). It surfaces as an SPF permerror VERDICT, and the
+  // spoofed p=reject From is still gated to reject.
+  var dnsLookup = _inboundDns({
+    "_dmarc.spoofed.example/TXT": [["v=DMARC1; p=reject"]],
+  });
+  var v = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host",
+    mailFrom: "x@attacker.example@spoofed.example",
+    message: "From: ceo@spoofed.example\r\nSubject: urgent\r\n\r\nwire money\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: multi-@ MAIL FROM → spf permerror (no throw out of the pipeline)",
+        v.spf.result === "permerror");
+  check("inbound.verify: multi-@ MAIL FROM still gates the spoofed From → reject",
+        v.dmarc.result === "fail" && v.dmarc.recommendedAction === "reject");
+}
+
 async function testInboundVerifyGroupSyntaxFromRejected() {
   // DMARC bypass via RFC 5322 group syntax: `From: Recipients:alice@victim;`
   // carries no whitespace or comma but is not a bare addr-spec — the group
@@ -263,6 +317,30 @@ async function testInboundVerifyFromHeaderDiscipline() {
   });
   check("inbound.verify: comma-separated angle-addr list → multiple authors refused",
         twoAngle.from.count === 2 && twoAngle.dmarc.recommendedAction === "reject");
+
+  // Two '@' in ONE addr-spec (x@attacker@victim). The header.from parser takes
+  // the RIGHTMOST @ segment (victim) while the DMARC domain derivation takes the
+  // LEFTMOST (attacker) — so DMARC would authorize attacker.example (which the
+  // attacker controls) while the displayed From is victim.example. An addr-spec
+  // has exactly ONE @ (RFC 5322 §3.4.1); a multi-@ address is malformed and must
+  // yield no author domain → reject, closing the leftmost/rightmost split bypass.
+  var multiAt = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host", mailFrom: "x@attacker.example",
+    message: "From: x@attacker.example@victim.example\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: multi-@ From (x@a@b) → no author domain + reject (no @-split bypass)",
+        multiAt.from.domain === null && multiAt.dmarc.recommendedAction === "reject");
+
+  // The public dmarc.evaluate must reject a multi-@ From the same way, so a
+  // direct caller can't trigger the leftmost-@ derivation.
+  var badFromThrew = null;
+  try {
+    await b.mail.dmarc.evaluate({ from: "x@attacker.example@victim.example",
+      spf: { result: "pass", domain: "attacker.example" }, dkim: [], dnsLookup: dnsLookup });
+  } catch (e) { badFromThrew = e; }
+  check("dmarc.evaluate: a multi-@ From is refused as malformed (mail-auth/dmarc-bad-from)",
+        badFromThrew && /dmarc-bad-from/.test(badFromThrew.code || ""));
 }
 
 // RFC 7489 §6.6.2 — a fail verdict computed while SPF or DKIM returned
@@ -651,6 +729,211 @@ function testArcSignChain() {
     /timestamp|finite/);
 }
 
+function testArcSignRejectsCrlfInjection() {
+  var nodeCrypto = require("crypto");
+  var arcKey = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  var arcKeyPem = arcKey.privateKey.export({ format: "pem", type: "pkcs8" });
+  var rfc822 = "From: a@x\r\nTo: b@y\r\nSubject: hi\r\n" +
+    "Date: Wed, 06 May 2026 12:00:00 +0000\r\nMessage-ID: <1@x>\r\n\r\nbody\r\n";
+  var base = {
+    rfc822: rfc822, instance: 1, authservId: "relay.example.com", domain: "relay.example.com",
+    selector: "arc", privateKey: arcKeyPem, algorithm: "rsa-sha256", cv: "none",
+    authResults: "spf=pass smtp.mailfrom=a@x",
+  };
+  function withField(k, v) { var o = {}; for (var kk in base) o[kk] = base[kk]; o[k] = v; return o; }
+  function threw(fn) { try { fn(); return null; } catch (e) { return e; } }
+
+  // authservId / domain / selector are interpolated verbatim into the ARC
+  // header block (ARC-Authentication-Results / ARC-Seal /
+  // ARC-Message-Signature). A CR/LF must not smuggle a new header — the
+  // authResults field was already guarded; these were not.
+  var e1 = threw(function () { b.mail.arc.sign(withField("authservId", "relay.example.com\r\nInjected: 1")); });
+  check("arc.sign: CRLF in authservId throws arc-sign/bad-authserv",
+    e1 && e1.code === "arc-sign/bad-authserv");
+  var e2 = threw(function () { b.mail.arc.sign(withField("domain", "relay.example.com\r\nInjected: 1")); });
+  check("arc.sign: CRLF in domain throws arc-sign/bad-domain",
+    e2 && e2.code === "arc-sign/bad-domain");
+  var e3 = threw(function () { b.mail.arc.sign(withField("selector", "arc\r\nInjected: 1")); });
+  check("arc.sign: CRLF in selector throws arc-sign/bad-selector",
+    e3 && e3.code === "arc-sign/bad-selector");
+  var e4 = threw(function () { b.mail.arc.sign(withField("authservId", "relay" + String.fromCharCode(0) + "x")); });
+  check("arc.sign: NUL in authservId throws arc-sign/bad-authserv",
+    e4 && e4.code === "arc-sign/bad-authserv");
+  // authResults is placed verbatim on the ARC-Authentication-Results line —
+  // a NUL is a header-smuggling byte just like CR/LF, so it must be rejected
+  // (the prior guard only checked CR/LF).
+  var e5 = threw(function () { b.mail.arc.sign(withField("authResults", "spf=pass" + String.fromCharCode(0) + "x")); });
+  check("arc.sign: NUL in authResults throws arc-sign/bad-auth-results",
+    e5 && e5.code === "arc-sign/bad-auth-results");
+}
+
+// A relay's own freshly-signed ARC chain MUST verify as cv=pass. The
+// ARC-Message-Signature carries i=<instance> — an RFC 8617 §4.1.2 instance
+// number (1..50), NOT a DKIM AUID. AMS verification reuses the DKIM verifier
+// on a synthetic message; the DKIM §3.5 AUID-subdomain check must not treat
+// the AMS instance number as an AUID, or every valid ARC chain permerrors.
+// (The prior ARC tests only asserted shape-failure modes with dummy b=AAAA
+// signatures — no real sign->verify roundtrip ever exercised the pass path,
+// which is how the instance/AUID collision shipped.)
+async function testArcRealRoundtripVerifiesPass() {
+  var nodeCrypto = require("crypto");
+  var arcKey = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  var arcKeyPem = arcKey.privateKey.export({ format: "pem", type: "pkcs8" });
+  var spkiB64 = arcKey.publicKey.export({ type: "spki", format: "der" }).toString("base64");
+  var dnsLookup = async function (qname) {
+    if (qname === "arc._domainkey.relay.example") {
+      return [["v=DKIM1; k=rsa; p=" + spkiB64]];
+    }
+    var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+  };
+
+  var rfc822 =
+    "From: alice@example.com\r\n" +
+    "To: bob@example.com\r\n" +
+    "Subject: hello arc\r\n" +
+    "Date: Wed, 06 May 2026 12:00:00 +0000\r\n" +
+    "Message-ID: <rt-1@example.com>\r\n" +
+    "\r\n" +
+    "body body body\r\n";
+
+  var hop1 = b.mail.arc.sign({
+    rfc822:        rfc822,
+    instance:      1,
+    authservId:    "relay.example",
+    domain:        "relay.example",
+    selector:      "arc",
+    privateKey:    arcKeyPem,
+    algorithm:     "rsa-sha256",
+    cv:            "none",
+    authResults:   "spf=pass smtp.mailfrom=alice@example.com",
+    headersToSign: ["From", "To", "Subject", "Date", "Message-ID"],
+  });
+
+  var rv = await b.mail.arc.verify(hop1.rfc822, { dnsLookup: dnsLookup });
+  check("arc.verify: valid single-hop chain → chainStatus=pass",
+        rv.chainStatus === "pass");
+  check("arc.verify: AMS instance i= not treated as a DKIM AUID (amsResult=pass)",
+        rv.hops && rv.hops[0] && rv.hops[0].amsResult === "pass");
+  check("arc.verify: ARC-Seal verifies (asResult=pass)",
+        rv.hops[0].asResult === "pass");
+
+  // Second hop sealed over the validated first hop (cv=pass) must also verify,
+  // proving the instance/AUID fix holds at i>=2 where i= is "2".
+  var hop2 = b.mail.arc.sign({
+    rfc822:        hop1.rfc822,
+    instance:      2,
+    authservId:    "relay.example",
+    domain:        "relay.example",
+    selector:      "arc",
+    privateKey:    arcKeyPem,
+    algorithm:     "rsa-sha256",
+    cv:            "pass",
+    authResults:   "spf=pass smtp.mailfrom=alice@example.com",
+    headersToSign: ["From", "To", "Subject", "Date", "Message-ID"],
+  });
+  var rv2 = await b.mail.arc.verify(hop2.rfc822, { dnsLookup: dnsLookup });
+  check("arc.verify: valid two-hop chain → chainStatus=pass",
+        rv2.chainStatus === "pass");
+  check("arc.verify: both hops' AMS verify (i=1 and i=2 instances)",
+        rv2.hops.length === 2 &&
+        rv2.hops[0].amsResult === "pass" && rv2.hops[1].amsResult === "pass");
+}
+
+async function testArcFinalArInstanceForgery() {
+  // arcEvaluate surfaces finalAr — "the receiver's view of upstream auth
+  // results" — for downstream policy. The instance tag (i=) of every ARC
+  // header MUST be parsed identically by the indexing pass (which drives the
+  // AMS/AS crypto checks) and by the finalAr extraction. When the sealer's AMS
+  // h= omits arc-authentication-results (RFC-permitted; the verifier supports
+  // it), an attacker holding no key can inject a SECOND
+  // ARC-Authentication-Results whose instance is written so the strict indexer
+  // ignores it ("i = 1" with a space) while a looser finalAr parser still
+  // consumes it — forging the upstream auth-results on a chain that still
+  // verifies pass. finalAr must come from the same strictly-indexed hop the
+  // crypto validated. RED before the unification: attacked.finalAr carries
+  // "FORGED"; the chain still reports pass.
+  var nodeCrypto = require("crypto");
+  var arcKey = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  var arcKeyPem = arcKey.privateKey.export({ format: "pem", type: "pkcs8" });
+  var spkiB64 = arcKey.publicKey.export({ type: "spki", format: "der" }).toString("base64");
+  var dnsLookup = async function (qname) {
+    if (qname === "arc._domainkey.relay-fa.example") return [["v=DKIM1; k=rsa; p=" + spkiB64]];
+    var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+  };
+  var rfc822 =
+    "From: alice@example.com\r\n" +
+    "To: bob@example.com\r\n" +
+    "Subject: hello arc\r\n" +
+    "Date: Wed, 06 May 2026 12:00:00 +0000\r\n" +
+    "Message-ID: <fa-1@example.com>\r\n" +
+    "\r\n" +
+    "body body body\r\n";
+  // Sign with AAR EXCLUDED from the AMS h= — the RFC-permitted sealer shape the
+  // forgery rides (the AAR is not signature-covered, so an injected sibling is
+  // invisible to the AMS/AS crypto).
+  var hop1 = b.mail.arc.sign({
+    rfc822:            rfc822,
+    instance:          1,
+    authservId:        "relay-fa.example",
+    domain:            "relay-fa.example",
+    selector:          "arc",
+    privateKey:        arcKeyPem,
+    algorithm:         "rsa-sha256",
+    cv:                "none",
+    authResults:       "spf=pass smtp.mailfrom=alice@example.com",
+    headersToSign:     ["From", "To", "Subject", "Date", "Message-ID"],
+    excludeAarFromAms: true,
+  });
+
+  var clean = await b.mail.arc.evaluate(hop1.rfc822, { dnsLookup: dnsLookup, trustedSealers: ["relay-fa.example"] });
+  check("arc.evaluate: AAR-excluded-from-AMS chain still verifies pass",
+        clean.chainStatus === "pass");
+  check("arc.evaluate: finalAr is the genuine upstream AAR",
+        typeof clean.finalAr === "string" && /spf=pass/.test(clean.finalAr) &&
+        clean.finalAr.indexOf("FORGED") === -1);
+
+  // Inject a SECOND ARC-Authentication-Results AFTER the genuine one, using
+  // "i = 1" (the space the strict indexer rejects) so the crypto pass never
+  // sees it but a loose finalAr parser would.
+  var FORGED = "ARC-Authentication-Results: i = 1; attacker.example; dkim=pass header.d=victim.example (FORGED)\r\n";
+  var idx = hop1.rfc822.indexOf("ARC-Authentication-Results:");
+  var aarEnd = hop1.rfc822.indexOf("\r\n", idx) + 2;
+  var injected = hop1.rfc822.slice(0, aarEnd) + FORGED + hop1.rfc822.slice(aarEnd);
+
+  var attacked = await b.mail.arc.evaluate(injected, { dnsLookup: dnsLookup, trustedSealers: ["relay-fa.example"] });
+  check("arc.evaluate: an injected loose-i= AAR does not change the crypto verdict (still pass)",
+        attacked.chainStatus === "pass");
+  check("arc.evaluate: finalAr is NOT forged by an injected loose-i= AAR",
+        typeof attacked.finalAr === "string" &&
+        attacked.finalAr.indexOf("FORGED") === -1 && /spf=pass/.test(attacked.finalAr));
+}
+
+function testArcSignExcludeAarFromAms() {
+  // RFC 8617 §5.1.1 — the AMS h= should cover arc-authentication-results so
+  // receivers that canonicalize it (M365, Gmail) verify the chain; the signer
+  // auto-prepends it. `excludeAarFromAms: true` opts out (deprecated). The opt
+  // was documented + read but absent from the validate allow-list, so passing
+  // it threw "unknown option" — the opt-out was unreachable. Assert both the
+  // default (AAR present in h=) and the opt-out (AAR absent).
+  var nodeCrypto = require("crypto");
+  var key = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  var keyPem = key.privateKey.export({ format: "pem", type: "pkcs8" });
+  var rfc822 = "From: a@x.example\r\nTo: b@y.example\r\nSubject: s\r\nDate: Wed, 06 May 2026 12:00:00 +0000\r\nMessage-ID: <e-1@x.example>\r\n\r\nbody\r\n";
+  var base = {
+    rfc822: rfc822, instance: 1, authservId: "x.example", domain: "x.example",
+    selector: "arc", privateKey: keyPem, algorithm: "rsa-sha256", cv: "none",
+    authResults: "spf=pass", headersToSign: ["From", "To", "Subject"],
+  };
+  var def = b.mail.arc.sign(base);
+  check("arc.sign: default AMS h= covers arc-authentication-results (auto-prepended)",
+        /h=[^;]*arc-authentication-results/i.test(def.ams));
+  var excluded = b.mail.arc.sign(Object.assign({}, base, { excludeAarFromAms: true }));
+  check("arc.sign: excludeAarFromAms is accepted (no longer an unknown-option throw)",
+        typeof excluded.ams === "string");
+  check("arc.sign: excludeAarFromAms omits arc-authentication-results from the AMS h=",
+        !/h=[^;]*arc-authentication-results/i.test(excluded.ams));
+}
+
 // ---- DMARCbis (B1) — psd= / np= / org-domain via PSL ----
 
 function testDmarcParseBisTags() {
@@ -1496,11 +1779,13 @@ async function run() {
   testDmarcParseBisTags();
   testDmarcParseBisBadTag();
   await testDmarcEvaluateAligned();
+  await testDmarcStrictAlignmentCanonicalizesDomain();
   await testDmarcEvaluateUnaligned();
   await testDmarcEvaluateOrgDomainViaPsl();
   await testDmarcEvaluateNpPolicy();
   await testInboundVerifyAlignedPass();
   await testInboundVerifySpoofRejected();
+  await testInboundVerifyMultiAtMailFromGatesNotThrows();
   await testInboundVerifyGroupSyntaxFromRejected();
   await testInboundVerifyFromHeaderDiscipline();
   await testInboundVerifyTemperrorPrecedence();
@@ -1520,6 +1805,10 @@ async function run() {
   await testArcEvaluateBreakAt();
   testArcSignSurface();
   testArcSignChain();
+  testArcSignRejectsCrlfInjection();
+  await testArcRealRoundtripVerifiesPass();
+  await testArcFinalArInstanceForgery();
+  testArcSignExcludeAarFromAms();
   testDkimVerifySurface();
   await testDkimVerifyRoundTrip();
   await testDkimVerifyNoSignature();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-bimi-cert-validity-unparseable.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.bimi — VMC / CMC certificate validity-window enforcement when the

package/lib/vendor/blamejs/test/layer-0-primitives/mail-bimi.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.bimi — RFC 9091 BIMI policy lookup, VMC + CMC chain validation,

package/lib/vendor/blamejs/test/layer-0-primitives/mail-bounce.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * mail-bounce — vendor-shaped intake for bounce / complaint /
@@ -557,6 +559,64 @@ async function testDsnBuildMinimal() {
   check("dsn build: Status",                  /Status: 5\.1\.1/.test(raw));
 }
 
+async function testDsnBuildRejectsCrlfInjection() {
+  function threw(fn) { try { fn(); return null; } catch (e) { return e; } }
+
+  // Diagnostic-Code echoes the remote server's SMTP reply — free text,
+  // legitimately multi-line, so it is folded to one line: an embedded
+  // CR/LF cannot start a new delivery-status field or a report part.
+  var folded = b.mailBounce.dsn.build({
+    finalRecipient: "user@example.com",
+    action:         "failed",
+    status:         "5.1.1",
+    diagnosticCode: "smtp; 550 no user\r\nX-Injected: evil\r\nBcc: victim@evil.test",
+  });
+  check("dsn build: folded diagnosticCode cannot start a header line",
+    !/^X-Injected:/m.test(folded) && !/^Bcc:/m.test(folded));
+
+  // A NUL in the free-text diagnosticCode is stripped by the fold, not
+  // serialized into the Diagnostic-Code header line.
+  var nulDsn = b.mailBounce.dsn.build({
+    finalRecipient: "user@example.com", action: "failed", status: "5.1.1",
+    diagnosticCode: "smtp; 550 no user" + String.fromCharCode(0) + "evil",
+  });
+  check("dsn build: NUL in diagnosticCode stripped from output",
+    nulDsn.indexOf(String.fromCharCode(0)) === -1);
+
+  // Structured fields (recipients, MTA names, RFC 5322 envelope headers)
+  // fail closed on CR / LF / NUL.
+  var e1 = threw(function () {
+    b.mailBounce.dsn.build({ finalRecipient: "user@example.com\r\nBcc: victim@evil.test",
+      action: "failed", status: "5.1.1" });
+  });
+  check("dsn build: CRLF in finalRecipient throws bounce/bad-dsn-field",
+    e1 && e1.code === "bounce/bad-dsn-field");
+  var e2 = threw(function () {
+    b.mailBounce.dsn.build({ finalRecipient: "user@example.com", action: "failed",
+      status: "5.1.1", reportingMta: "mta.x\r\nX-Evil: 1" });
+  });
+  check("dsn build: CRLF in reportingMta throws bounce/bad-dsn-field",
+    e2 && e2.code === "bounce/bad-dsn-field");
+  var e3 = threw(function () {
+    b.mailBounce.dsn.build({ finalRecipient: "user@example.com", action: "failed",
+      status: "5.1.1", from: "mailer@x\r\nBcc: victim@evil.test" });
+  });
+  check("dsn build: CRLF in From throws bounce/bad-dsn-field",
+    e3 && e3.code === "bounce/bad-dsn-field");
+  var e4 = threw(function () {
+    b.mailBounce.dsn.build({ finalRecipient: "user@example.com", action: "failed",
+      status: "5.1.1", subject: "hi\r\nX-Evil: 1" });
+  });
+  check("dsn build: CRLF in Subject throws bounce/bad-dsn-field",
+    e4 && e4.code === "bounce/bad-dsn-field");
+  var e5 = threw(function () {
+    b.mailBounce.dsn.build({ finalRecipient: "user@example.com", action: "failed",
+      status: "5.1.1", remoteMta: "relay\r\nX-Evil: 1" });
+  });
+  check("dsn build: CRLF in remoteMta throws bounce/bad-dsn-field",
+    e5 && e5.code === "bounce/bad-dsn-field");
+}
+
 async function testDsnBuildRoundtrip() {
   var raw = b.mailBounce.dsn.build({
     originalRecipient: "alias@example.com",
@@ -662,6 +722,7 @@ async function run() {
   await testDsnParseRejectsEmpty();
   await testDsnParseRejectsBadAction();
   await testDsnBuildMinimal();
+  await testDsnBuildRejectsCrlfInjection();
   await testDsnBuildRoundtrip();
   await testDsnBuildUtf8();
   await testDsnBuildRejectsBadAction();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-canspam.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail commercial:true posture — CAN-SPAM Act §7704(a)(5) physical

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-pgp-experimental.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.crypto.pgp.experimental — PQC PGP encrypt/decrypt + WKD URL

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-pgp.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * pgp — RFC 9580 detached-signature sign + verify

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime-bad-validity.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.crypto.smime.checkCert — fail closed on unparseable validity.

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.crypto.smime — v1 surface coverage.

package/lib/vendor/blamejs/test/layer-0-primitives/mail-dav.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.dav — CalDAV (RFC 4791) + CardDAV (RFC 6352) HTTP route

package/lib/vendor/blamejs/test/layer-0-primitives/mail-deploy-tlsrpt.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.deploy TLS-RPT receiver — RFC 8460 aggregate-report ingest.

package/lib/vendor/blamejs/test/layer-0-primitives/mail-deploy.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/mail-dkim-numericdate-failclosed.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.dkim.verify — x= / t= present-but-unparseable must FAIL CLOSED.

package/lib/vendor/blamejs/test/layer-0-primitives/mail-dkim.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.mail.dkim — RFC 6376 (rsa-sha256) + RFC 8463 (ed25519-sha256)
@@ -508,6 +510,32 @@ async function testDkimVerifyIDomainSubdomainOfD() {
         /is not d= or a subdomain of d=/.test((rv[0].errors || []).join(",")));
 }
 
+async function testDkimAuidCheckHasNoPublicOptOut() {
+  // The ARC verifier reuses this verifier and signals (via an internal token
+  // module) that an ARC-Message-Signature i= is an instance number, not an
+  // AUID — skipping the §3.5 AUID/d= binding check for that one case. That
+  // signal must NOT be reachable from the public DKIM surface, or an operator
+  // could disable a security default on real DKIM verification. Prove it: the
+  // token is not exposed on b.mail.dkim, and a forged same-description Symbol
+  // passed as an opt does NOT unlock the bypass — the AUID check still fires.
+  check("ARC reuse token is not on the public b.mail.dkim surface",
+        b.mail.dkim.ARC_AMS_REUSE === undefined);
+
+  var kp = _rsaKeypair();
+  var signer = b.mail.dkim.create({ domain: "example.org", selector: "s1", privateKey: kp.privateKey });
+  var msg = "From: alice@example.org\r\nTo: bob@example.com\r\nSubject: t\r\nDate: Sat, 01 Jan 2026 00:00:00 +0000\r\nMessage-ID: <m@example.org>\r\n\r\nhi\r\n";
+  var signed = signer.sign(msg);
+  signed = signed.replace("DKIM-Signature: v=1", "DKIM-Signature: v=1; i=user@evil.com");
+  var b64 = _spkiPemToB64(kp.publicKey);
+  var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + b64]]; };
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var forged = Symbol("blamejs.mail.arcAmsReuse");                 // same description, different identity
+  var rv = await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup, [forged]: true });
+  check("forged reuse Symbol does not bypass the AUID check on public verify",
+        rv[0] && rv[0].result === "permerror" &&
+        /is not d= or a subdomain of d=/.test((rv[0].errors || []).join(",")));
+}
+
 async function testDkimVerifyHonorsKeyHashRestriction() {
   // MAIL-12 — RFC 6376 §3.6.1 key h= tag restricts the hash family.
   // A key whose h= is "sha512" rejects a signature whose a= is
@@ -671,6 +699,105 @@ async function testDkimVerifyLTagCountsCanonicalizedOctets() {
         rv[0] && rv[0].result === "pass");
 }
 
+// RFC 6376 §8.2 — the l= body-length tag covers only a PREFIX of the body, so an
+// attacker can append arbitrary unsigned content after the signed octets and the
+// body hash still matches. The verified bytes (the prefix) then diverge from the
+// bytes actually delivered to the recipient. A signature whose l= leaves appended
+// content unsigned must NOT pass by default; an operator who must accept legacy
+// l= senders opts in via acceptBodyLengthLimit.
+async function testDkimVerifyLTagAppendAfterSignatureRefused() {
+  var dkim = b.mail.dkim;
+  dkim._resetDkimKeyCacheForTest();
+  var kp = _rsaKeypair();
+  var pubB64 = _spkiPemToB64(kp.publicKey);
+  var DOMAIN = "lappend.example", SELECTOR = "lap1";
+
+  // Sign over ONLY the prefix "Hello\r\n" with l=<prefix canonicalized length>.
+  var signedPrefix = "Hello\r\n";
+  var canonPrefix = dkim._canonBodyRelaxedForTest(signedPrefix);
+  var lcap = Buffer.from(canonPrefix, "utf8").length;
+  var bh = nodeCrypto.createHash("sha256")
+    .update(Buffer.from(canonPrefix, "utf8").subarray(0, lcap)).digest("base64");
+
+  var fromValue = " Alice <alice@example.com>";
+  var unsignedSigValue = [
+    "v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+    "d=" + DOMAIN, "s=" + SELECTOR, "h=from", "bh=" + bh, "l=" + lcap, "b=",
+  ].join("; ");
+  var canonHeaders =
+    dkim._canonHeaderRelaxedForTest("From", fromValue) +
+    dkim._canonHeaderRelaxedForTest("DKIM-Signature", unsignedSigValue).replace(/\r\n$/, "");
+  var sig = nodeCrypto.createSign("RSA-SHA256").update(canonHeaders)
+    .sign(kp.privateKey).toString("base64");
+  var finalSigValue = unsignedSigValue.replace(/b=$/, "b=" + sig);
+
+  // DELIVER a body that appends attacker content AFTER the signed prefix. The bh
+  // still matches the first lcap octets, so without the §8.2 guard the verifier
+  // would return "pass" over a body the recipient never authenticated.
+  var deliveredBody = "Hello\r\nWIRE FRAUD: send funds to acct 999\r\n";
+  var message =
+    "From:" + fromValue + "\r\n" +
+    "DKIM-Signature: " + finalSigValue + "\r\n" +
+    "\r\n" + deliveredBody;
+
+  var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + pubB64]]; };
+
+  var rv2 = await dkim.verify(message, { dnsLookup: dnsLookup });
+  check("verify: l= with content appended past the signed prefix does NOT pass (RFC 6376 §8.2)",
+        rv2[0] && rv2[0].result === "fail");
+
+  // Opt-in escape hatch — an operator who must accept legacy l= senders.
+  var rvOptIn = await dkim.verify(message, { dnsLookup: dnsLookup, acceptBodyLengthLimit: true });
+  check("verify: acceptBodyLengthLimit:true restores legacy l= acceptance",
+        rvOptIn[0] && rvOptIn[0].result === "pass");
+}
+
+// ARC-Message-Signature verification reuses _verifySingleSignature via the
+// internal reuse token (lib/mail-arc-reuse-token), so it inherits the §8.2
+// append-after-l= refusal — and does NOT pass acceptBodyLengthLimit, so the
+// AMS path is unconditionally fail-closed for an appended-content l=. This
+// replicates what _verifyAmsViaDkim feeds the verifier (rename to
+// DKIM-Signature on the wire, signed under the ARC-Message-Signature name).
+async function testArcAmsLTagAppendRefused() {
+  var dkim = b.mail.dkim;
+  var ARC_AMS_REUSE = require("../../lib/mail-arc-reuse-token");
+  dkim._resetDkimKeyCacheForTest();
+  var kp = _rsaKeypair();
+  var pubB64 = _spkiPemToB64(kp.publicKey);
+
+  var signedPrefix = "Hello\r\n";
+  var canonPrefix = dkim._canonBodyRelaxedForTest(signedPrefix);
+  var lcap = Buffer.from(canonPrefix, "utf8").length;
+  var bh = nodeCrypto.createHash("sha256")
+    .update(Buffer.from(canonPrefix, "utf8").subarray(0, lcap)).digest("base64");
+
+  var fromValue = " Alice <alice@example.com>";
+  // i= is an RFC 8617 instance number (not a DKIM AUID); signed under the
+  // ARC-Message-Signature name, which the reuse path canonicalizes against.
+  var unsignedSigValue = [
+    "i=1", "a=rsa-sha256", "c=relaxed/relaxed",
+    "d=example.com", "s=arc", "h=from", "bh=" + bh, "l=" + lcap, "b=",
+  ].join("; ");
+  var canonHeaders =
+    dkim._canonHeaderRelaxedForTest("From", fromValue) +
+    dkim._canonHeaderRelaxedForTest("ARC-Message-Signature", unsignedSigValue).replace(/\r\n$/, "");
+  var sig = nodeCrypto.createSign("RSA-SHA256").update(canonHeaders)
+    .sign(kp.privateKey).toString("base64");
+  var finalSigValue = unsignedSigValue.replace(/b=$/, "b=" + sig);
+
+  var deliveredBody = "Hello\r\nappended unsigned content\r\n";
+  var synthetic =
+    "From:" + fromValue + "\r\n" +
+    "DKIM-Signature: " + finalSigValue + "\r\n" +
+    "\r\n" + deliveredBody;
+  var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + pubB64]]; };
+  var opts = { dnsLookup: dnsLookup };
+  opts[ARC_AMS_REUSE] = true;
+  var rv = await dkim.verify(synthetic, opts);
+  check("ARC AMS reuse path also refuses l= append-after-signature (RFC 6376 §8.2)",
+        rv[0] && rv[0].result === "fail");
+}
+
 async function run() {
   testDkimSurfaceAndValidation();
   testDkimCanonicalization();
@@ -691,12 +818,15 @@ async function run() {
   await testDkimVerifyRejectsSubBulkSenderRsa();
   await testDkimVerifyClockSkewBounded();
   await testDkimVerifyIDomainSubdomainOfD();
+  await testDkimAuidCheckHasNoPublicOptOut();
   await testDkimVerifyHonorsKeyHashRestriction();
   testDkimSignAuditsMissingHeaders();
   await testDkimVerifySignatureCountCapped();
   await testDkimKeyCacheLru();
   testDkimStripBTagValueAnchored();
   await testDkimVerifyLTagCountsCanonicalizedOctets();
+  await testDkimVerifyLTagAppendAfterSignatureRefused();
+  await testArcAmsLTagAppendRefused();
 }
 
 module.exports = { run: run };