@blamejs/blamejs-shop 0.5.6 → 0.5.7

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- v0.5.7 (2026-07-03) — **Storefront redirect targets route through the framework open-redirect guard, closing a TAB-injection open redirect on return_to / redirect_to.** Closes an open-redirect (CWE-601) in the storefront's post-action redirects. The cookie-consent submit, currency and locale switchers, and the wishlist and compare toggles validated their return_to / redirect_to target with a hand-rolled leading-slash regex that accepted a horizontal TAB (0x09) at the second byte. A user agent strips ASCII TAB, CR, and LF from a URL before resolving it, so a target like /<TAB>/evil.example collapsed to the protocol-relative //evil.example and navigated the shopper off-origin under the shop's trust — a phishing bounce. Every request-derived redirect target now routes through the framework's b.safeRedirect.resolve primitive (exposed once as a shared same-origin helper), which rejects every control character including TAB, protocol-relative //host and \\host forms, and full URLs — only genuine same-origin relative paths survive; anything else falls back to a safe default. The two guards that already rejected control characters are consolidated onto the same primitive so there is one redirect-safety path to reason about, and a codebase check refuses any future hand-rolled leading-slash redirect guard. No operator action and no configuration change. **Security:** *Open-redirect on storefront return_to / redirect_to closed* — The post-action redirect guards (cookie consent, currency switch, locale switch, wishlist toggle, compare toggle, announcement dismiss) accepted a leading-slash target whose second byte was a control character. A horizontal TAB there is stripped by the browser before URL parsing, turning /<TAB>/evil.example into the protocol-relative //evil.example — an off-origin redirect an attacker could use to launder a phishing link through the shop's origin. All these targets now resolve through b.safeRedirect.resolve, which rejects control characters (TAB, CR, LF, NUL), protocol-relative and backslash forms, and off-origin absolute URLs; an invalid target falls back to a same-origin default. A codebase-patterns check prevents a hand-rolled leading-slash redirect guard from reappearing.
+
 - v0.5.6 (2026-07-03) — **Minimum Node is now 24.18.0; the vendored framework refresh brings a broad batch of request-path and mail-authentication security hardening.** Refreshes the vendored framework to 0.16.2 and raises the minimum supported Node.js to 24.18.0 — operators must run Node 24.18.0 or newer before upgrading. The floor moves with the framework, which requires 24.18.0 for its bundled SQLite 3.53.1, a backup-path fix, and the native OpenSSL 3.5 SLH-DSA surface. The refresh carries a large batch of security and correctness fixes that harden the request lifecycle the storefront and account portal already run on, at no code cost to the shop: the router refuses an encoded path separator or null byte and decodes the request path once, so a path-scoped security gate and the resource it guards can no longer disagree; res.redirect rejects a horizontal TAB that user agents strip before URL parsing, closing an open-redirect bypass; OAuth refresh-token and step-up replay gates treat any truthy store result as seen and bind grants to the authenticated principal; SAML Single-Logout fails closed when a verification key arrives without its algorithm; the mail-authentication builders (Authentication-Results, delivery-status, ARC) refuse CR/LF/NUL header injection and SPF evaluation fails closed on a malformed ip4 CIDR; file uploads enforce per-upload ownership and reject path-traversal ids; recursive parsers refuse pathologically deep input instead of overflowing the stack; and shared-cache counters (lockout, byte quotas, rate caps) accumulate with an atomic compare-and-set so distributed requests cannot lose increments. Every Node-version pin — engines, .nvmrc, the container base image, CI, and the docs — is synced to the new floor from the framework's own engines constraint. **Changed:** *Minimum Node.js raised to 24.18.0* — engines.node is now >=24.18.0 (was >=24.16.0). Operators must run Node 24.18.0 or newer. The floor is dictated by the vendored framework, which requires 24.18.0 for its bundled SQLite 3.53.1, a database backup-path fix, and the native OpenSSL 3.5 SLH-DSA sign/verify surface. The .nvmrc, the container base image, the CI runner pins, and the README/architecture docs are all synced to the new floor. · *Vendored framework refreshed to 0.16.2* — The framework the shop builds on is refreshed from 0.15.38 to 0.16.2. Beyond the request-path and mail hardening in this release's summary, the refresh includes: the router rejects percent-encoded path separators so a security middleware and the route it guards agree on the path; ARC and DKIM verification reject forged or body-length-truncated signatures; OCSP validation binds the response to the certificate's issuer; status-list verification binds the token type against replay; and OAuth authorization-URL builders refuse operator parameters that collide with framework-managed ones. These land in the request lifecycle the storefront and account portal already compose, with no shop code change required.
 
 - v0.5.5 (2026-06-27) — **Customers can change their subscription plan — proration-aware upgrades and downgrades from the account portal.** Adds a self-serve plan-change surface to the customer subscription portal. From /account/subscriptions a customer can switch an active subscription to any other plan in the same currency: the page previews the proration for each candidate plan and offers two timings. An immediate change applies now and prorates the rest of the current period — an upgrade is charged the prorated difference (recorded on the subscription invoice ledger), and a downgrade is issued the unused remainder as store credit. A next-billing-cycle change is queued and applied automatically when the period rolls over, with the new plan starting clean and no proration. The transition is exactly-once: the immediate path claims the plan switch atomically before recording the charge or credit, and the scheduled path claims each due change with a single guarded update, so a retry or an overlapping scheduler run cannot double-charge or double-credit. A downgrade that owes a credit is never applied without paying it — if the credit write fails the change rolls back and retries. The surface mounts automatically when subscriptions and store credit are composed (the default for a configured storefront); the scheduler runs on the existing cron, and the tables it uses already shipped, so there are no schema changes and no operator action is required. **Added:** *Self-serve subscription plan changes with proration* — Customers can change the plan on an active subscription from /account/subscriptions/:id/change. The page lists every plan in the subscription's currency (excluding the current and archived plans) with a proration preview, and offers an immediate switch or a switch at the next billing date. An immediate upgrade charges the prorated difference for the rest of the period and records it on the subscription invoice ledger; an immediate downgrade issues the unused remainder of the outgoing plan as store credit. A still-pending change is shown on the subscription with a one-click cancel. Cross-currency, same-plan, and archived-plan requests are refused server-side, and the surface enforces subscription ownership before any read or write. · *Scheduler applies next-billing-cycle changes automatically* — A change queued for the next billing cycle is applied without operator involvement: a minute-cadence tick flips every due change to its new plan, records the proration, and issues any owed credit. Each due change is claimed with a single guarded update so an overlapping or retried run cannot apply it twice, and a change that owes a credit is left queued rather than applied if no credit can be issued — the credit is never dropped. The scheduler is inert on a deploy without subscriptions or store credit composed. **Changed:** *Dunning step failures are logged with their cause* — When a dunning step (reminder send, retry-charge record, pause, or cancel) fails, the schedule still advances and the step is recorded as failed — but the underlying error is now written to the server log instead of being discarded, so an operator can see why a step failed rather than only that it did.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.5.6",
+  "version": "0.5.7",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/storefront.js

@@ -59,6 +59,25 @@ var _localeAls = new AsyncLocalStorage();
 // the client only ever sees a generic message + the correlating id.
 var _log = b.log.create({});
 
+// Same-origin redirect-target guard shared by every post-action redirect
+// (return_to / redirect_to / next). Delegates to the framework open-redirect
+// (CWE-601) primitive rather than a hand-rolled path regex: it rejects
+// protocol-relative targets ("//host", "\\host"), refuses full URLs (no
+// base/allowlist is passed, so only same-origin relatives survive), and
+// rejects EVERY control char including a horizontal TAB. A hand-rolled
+// `/^\/[^/]/` guard misses the TAB: a user agent strips ASCII TAB/CR/LF from
+// a URL before resolving it, so a `Location: /\t/evil.example` collapses to
+// the protocol-relative `//evil.example` and navigates off-origin. Returns
+// the safe same-origin path (query/fragment preserved) or `fallback` — pass
+// "" as the fallback to use it as an accepted/rejected sentinel.
+function _sameOriginRedirect(raw, fallback) {
+  var fb = typeof fallback === "string" ? fallback : "/";
+  // A pathological over-length target (header bloat) falls back before the
+  // primitive even parses it.
+  if (typeof raw === "string" && raw.length > 2048) return fb;
+  return b.safeRedirect.resolve(raw, { fallback: fb });
+}
+
 // Generic 500 for an auth/ceremony route: log the real error server-side
 // (correlated by the framework request id) and return a fixed message to
 // the client so no internal error string (stack frame, DB column, vault
@@ -12485,10 +12504,7 @@ function mount(router, deps) {
     router.post("/announcements/:slug/dismiss", async function (req, res) {
       var slug = (req.params && typeof req.params.slug === "string") ? req.params.slug : "";
       var body = req.body || {};
-      var to = (typeof body.return_to === "string") ? body.return_to : "/";
-      if (to.charAt(0) !== "/" || to.charAt(1) === "/" || to.indexOf("\\") !== -1 || /[\x00-\x1f\x7f]/.test(to)) {
-        to = "/";
-      }
+      var to = _sameOriginRedirect(body.return_to, "/");
       if (/^[a-z0-9-]{1,64}$/.test(slug)) {
         // Durable record (best-effort — keyed on the cart session id; absent
         // a session the cookie still carries the dismissal for this browser).
@@ -13125,13 +13141,9 @@ function mount(router, deps) {
   // setting a cookie, so a hostile link can't 500 the route.
   router.get("/locale", function (req, res) {
     var q = req.query || {};
-    var to = (typeof q.to === "string") ? q.to : "/";
-    // Same-origin path only: must start with a single "/" (not "//" — a
-    // protocol-relative URL — and not a scheme). Anything else falls
-    // back to the home path.
-    if (to.charAt(0) !== "/" || to.charAt(1) === "/" || to.indexOf("\\") !== -1 || /[\x00-\x1f\x7f]/.test(to)) {
-      to = "/";
-    }
+    // Same-origin path only (rejects protocol-relative "//", backslash, and
+    // control chars including TAB); anything else falls back to home.
+    var to = _sameOriginRedirect(q.to, "/");
     var lang = (typeof q.lang === "string") ? q.lang : "";
     if (lang && LOCALE_COOKIE_RE.test(lang) && lang.length <= LOCALE_COOKIE_MAX && supportedTags.indexOf(lang) !== -1) {
       _setLocaleCookie(res, lang);
@@ -13898,7 +13910,7 @@ function mount(router, deps) {
       // slash, no scheme / host / protocol-relative `//`) so the switcher
       // can't be turned into an open redirect.
       var rawTo = typeof body.redirect_to === "string" ? body.redirect_to : "/";
-      var to = (/^\/(?!\/)/.test(rawTo)) ? rawTo : "/";
+      var to = _sameOriginRedirect(rawTo, "/");
       if (chosen === _ccyBase || _ccyOptions.indexOf(chosen) === -1) {
         _clearCurrencyCookie(res);
       } else {
@@ -14445,7 +14457,8 @@ function mount(router, deps) {
       // failure still lands the shopper somewhere sane.
       var rt = (req.body || {}).return_to;
       var dest = null;
-      if (typeof rt === "string" && /^\/[^/]/.test(rt)) dest = rt;
+      var safeRt = _sameOriginRedirect(rt, "");
+      if (safeRt) dest = safeRt;
 
       var notice;
       try {
@@ -17801,10 +17814,11 @@ function mount(router, deps) {
         var okKind = removed ? "removed" : "added";
         var rt = (req.body || {}).return_to;
         var dest;
-        if (typeof rt === "string" && /^\/[^/]/.test(rt)) {
+        var safeRt = _sameOriginRedirect(rt, "");
+        if (safeRt) {
           // Only thread the success marker when returning to the wishlist
           // page (the PDP heart toggle is its own visible cue).
-          dest = rt.indexOf("/account/wishlist") === 0 ? "/account/wishlist?ok=" + okKind : rt;
+          dest = safeRt.indexOf("/account/wishlist") === 0 ? "/account/wishlist?ok=" + okKind : safeRt;
         } else {
           var product = null;
           try { product = await deps.catalog.products.get(productId); } catch (_e) { product = null; }
@@ -22131,8 +22145,7 @@ function mount(router, deps) {
   // refused), capping length defensively. Anything else collapses to the
   // safe default the caller passes.
   function _consentReturnTo(raw, fallback) {
-    if (typeof raw === "string" && raw.length <= 512 && /^\/[^/]/.test(raw)) return raw;
-    return fallback;
+    return _sameOriginRedirect(raw, fallback);
   }
 
   // Translate a posted choice + per-category checkboxes into the four

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {