@blamejs/core 0.14.1 → 0.14.3

package/lib/router.js

@@ -62,11 +62,11 @@ var HTTP_STATUS = requestHelpers.HTTP_STATUS;
 // even when Node's nghttp2 vendor lags the upstream fix: tag every
 // session with `_blamejsGoawaySent` on the framework's GOAWAY emission,
 // and force-destroy on any subsequent frame activity.
-var WINDOW_UPDATE_FRAME_TYPE = 0x8;                                              // allow:raw-byte-literal — RFC 7540 §6.9 frame type
+var WINDOW_UPDATE_FRAME_TYPE = 0x8;                                              // RFC 7540 §6.9 frame type
 // Per-stream WINDOW_UPDATE rate cap. Above this rate the framework
 // destroys the stream; legitimate clients never burst this fast on a
 // healthy connection.
-var WINDOW_UPDATE_RATE_CAP = 100;                                                // allow:raw-byte-literal — frames per second per stream
+var WINDOW_UPDATE_RATE_CAP = 100;                                                // frames per second per stream
 var WINDOW_UPDATE_RATE_WINDOW_MS = C.TIME.seconds(1);
 
 // Cap on operator-defined route patterns. A route registration that
@@ -287,7 +287,7 @@ var MIME_TYPES = {
 // time and overrides "replay-cache" → "refuse" with an audit row.
 var TLS_0RTT_VALID_POSTURES = ["refuse", "replay-cache"];
 var TLS_0RTT_REPLAY_WINDOW_MS = C.TIME.seconds(10);
-var TLS_0RTT_REPLAY_CACHE_CAP = 4096;                                            // allow:raw-byte-literal — entry count, not bytes
+var TLS_0RTT_REPLAY_CACHE_CAP = 4096;                                            // entry count, not bytes
 var TLS_0RTT_FAILCLOSED_POSTURES = ["pci-dss", "fapi2"];
 
 class Router {
@@ -671,7 +671,7 @@ class Router {
     var queryKeyCount = 0;
     for (var pair of parsed.searchParams) {
       queryKeyCount += 1;
-      if (queryKeyCount > 1000) {                                                                  // allow:raw-byte-literal — CVE-2026-21717 V8 HashDoS query-key cap
+      if (queryKeyCount > 1000) {                                                                  // CVE-2026-21717 V8 HashDoS query-key cap
         res.statusCode = 400;
         res.end("400 Bad Request: too many query keys");
         return;
@@ -1046,12 +1046,12 @@ class Router {
         allowHTTP1:               true,
         ALPNProtocols:             ["h2", "http/1.1"],
         settings:                  { enableConnectProtocol: true },
-        maxConcurrentStreams:      100,                                            // allow:raw-byte-literal — CVE-2023-44487 Rapid Reset cap
-        maxSessionMemory:          10,                                             // allow:raw-byte-literal — MB cap (Node default explicit)
-        maxHeaderListPairs:        100,                                            // allow:raw-byte-literal — CVE-2024-27983 CONTINUATION-flood cap
-        maxSettings:               32,                                             // allow:raw-byte-literal — SETTINGS-frame entry ceiling
-        peerMaxConcurrentStreams:  100,                                            // allow:raw-byte-literal — peer-side stream cap
-        maxOutstandingPings:       10,                                             // allow:raw-byte-literal — CVE-2019-9512 ping-flood cap (pin to Node default rather than letting it drift)
+        maxConcurrentStreams:      100,                                            // CVE-2023-44487 Rapid Reset cap
+        maxSessionMemory:          10,                                             // MB cap (Node default explicit)
+        maxHeaderListPairs:        100,                                            // CVE-2024-27983 CONTINUATION-flood cap
+        maxSettings:               32,                                             // SETTINGS-frame entry ceiling
+        peerMaxConcurrentStreams:  100,                                            // peer-side stream cap
+        maxOutstandingPings:       10,                                             // CVE-2019-9512 ping-flood cap (pin to Node default rather than letting it drift)
         unknownProtocolTimeout:    C.TIME.seconds(10),
       }, tlsOptions), requestHandler);
 

package/lib/safe-async.js

@@ -631,8 +631,8 @@ function makeScheduledFlush(delayMs, flushFn) {
 // opts.signal:      AbortSignal — cancels by refusing to dispatch
 //                   further items; in-flight promises run to settle.
 
-var PARALLEL_DEFAULT_CONCURRENCY = 8;                                              // allow:raw-byte-literal — worker pool count, not bytes
-var PARALLEL_MAX_CONCURRENCY = 256;                                                // allow:raw-byte-literal — worker pool ceiling, not bytes
+var PARALLEL_DEFAULT_CONCURRENCY = 8;                                              // worker pool count, not bytes
+var PARALLEL_MAX_CONCURRENCY = 256;                                                // worker pool ceiling, not bytes
 
 /**
  * @primitive b.safeAsync.parallel

package/lib/safe-dns.js

@@ -60,27 +60,27 @@ var { defineClass }    = require("./framework-error");
 
 var SafeDnsError = defineClass("SafeDnsError", { alwaysPermanent: true });
 
-// allow:raw-byte-literal — RFC 1035 §3.1 single-label cap (octet 0 high
+// RFC 1035 §3.1 single-label cap (octet 0 high
 // 2 bits reserved for compression pointer; label-length field is 6 bits).
 var DNS_MAX_LABEL_BYTES = 63;
 
-// allow:raw-byte-literal — RFC 1035 §3.1 wire-format name absolute cap
+// RFC 1035 §3.1 wire-format name absolute cap
 // (sum of all label-length bytes + label bytes + terminator).
 var DNS_MAX_NAME_BYTES = 255;
 
-// allow:raw-byte-literal — RFC 1035 §4.2.1 fixed header size.
+// RFC 1035 §4.2.1 fixed header size.
 var DNS_HEADER_BYTES = 12;
 
-// allow:raw-byte-literal — RFC 1035 §3.2.1 RR fixed prefix
+// RFC 1035 §3.2.1 RR fixed prefix
 // (TYPE 2 + CLASS 2 + TTL 4 + RDLENGTH 2 = 10 octets after NAME).
 var DNS_RR_FIXED_BYTES = 10;
 
-// allow:raw-byte-literal — RFC 6891 §6.1 OPT pseudo-RR upper bound for
+// RFC 6891 §6.1 OPT pseudo-RR upper bound for
 // EDNS0 payload size we'll accept. 64 KiB is the protocol absolute
 // max; resolver-side default is much smaller.
 var EDNS0_HARD_MAX = 65535;
 
-// allow:raw-byte-literal — RFC 1035 §3.2.2 record-type codes we route
+// RFC 1035 §3.2.2 record-type codes we route
 // through type-specific decoders. Anything not listed parses as raw
 // rdata bytes (operator inspects the RDLENGTH-bounded slice).
 var RTYPE_A     = 1;
@@ -89,30 +89,30 @@ var RTYPE_CNAME = 5;
 var RTYPE_SOA   = 6;
 var RTYPE_PTR   = 12;
 var RTYPE_MX    = 15;
-var RTYPE_TXT   = 16;                                                                                    // allow:raw-byte-literal — RFC 1035 §3.2.2 TXT record type code
+var RTYPE_TXT   = 16;                                                                                    // RFC 1035 §3.2.2 TXT record type code
 var RTYPE_AAAA  = 28;
 var RTYPE_SRV   = 33;
 var RTYPE_OPT   = 41;
 var RTYPE_DS    = 43;
 var RTYPE_RRSIG = 46;
-var RTYPE_DNSKEY = 48;                                                                                   // allow:raw-byte-literal — RFC 4034 DNSKEY record type code
+var RTYPE_DNSKEY = 48;                                                                                   // RFC 4034 DNSKEY record type code
 var RTYPE_TLSA  = 52;
 
 var RTYPE_NAMES = Object.freeze({
   1: "A", 2: "NS", 5: "CNAME", 6: "SOA", 12: "PTR", 15: "MX",
-  16: "TXT", 28: "AAAA", 33: "SRV", 41: "OPT", 43: "DS",                                                 // allow:raw-byte-literal — IANA DNS record type codes
-  46: "RRSIG", 47: "NSEC", 48: "DNSKEY", 50: "NSEC3", 52: "TLSA",                                        // allow:raw-byte-literal — IANA DNS record type codes
-  64: "SVCB", 65: "HTTPS",                                                                               // allow:raw-byte-literal — IANA DNS record type codes
+  16: "TXT", 28: "AAAA", 33: "SRV", 41: "OPT", 43: "DS",                                                 // IANA DNS record type codes
+  46: "RRSIG", 47: "NSEC", 48: "DNSKEY", 50: "NSEC3", 52: "TLSA",                                        // IANA DNS record type codes
+  64: "SVCB", 65: "HTTPS",                                                                               // IANA DNS record type codes
 });
 
 var DEFAULT_MAX_RESPONSE_BYTES = C.BYTES.kib(4);
 var DEFAULT_MAX_EDNS0_BYTES    = C.BYTES.kib(4);
-var DEFAULT_MAX_LABELS         = 127;                                                                    // allow:raw-byte-literal — RFC 1035 §2.3.4 label count cap (count, not bytes)
-var DEFAULT_MAX_POINTER_DEPTH  = 16;                                                                     // allow:raw-byte-literal — compression-pointer chain depth (count, not bytes)
+var DEFAULT_MAX_LABELS         = 127;                                                                    // RFC 1035 §2.3.4 label count cap (count, not bytes)
+var DEFAULT_MAX_POINTER_DEPTH  = 16;                                                                     // compression-pointer chain depth (count, not bytes)
 var DEFAULT_MAX_CNAME_DEPTH    = 8;
-var DEFAULT_MAX_ANSWER_RRS     = 64;                                                                     // allow:raw-byte-literal — RR count cap (count, not bytes)
-var DEFAULT_MAX_AUTHORITY_RRS  = 32;                                                                     // allow:raw-byte-literal — RR count cap (count, not bytes)
-var DEFAULT_MAX_ADDITIONAL_RRS = 32;                                                                     // allow:raw-byte-literal — RR count cap (count, not bytes)
+var DEFAULT_MAX_ANSWER_RRS     = 64;                                                                     // RR count cap (count, not bytes)
+var DEFAULT_MAX_AUTHORITY_RRS  = 32;                                                                     // RR count cap (count, not bytes)
+var DEFAULT_MAX_ADDITIONAL_RRS = 32;                                                                     // RR count cap (count, not bytes)
 var DEFAULT_MAX_TXT_RDATA      = C.BYTES.kib(64);
 
 var DEFAULT_PROFILE = "strict";
@@ -134,21 +134,21 @@ var PROFILES = Object.freeze({
     maxEdns0Bytes:    C.BYTES.kib(16),
     maxLabels:        DEFAULT_MAX_LABELS,
     maxPointerDepth:  DEFAULT_MAX_POINTER_DEPTH,
-    maxCnameDepth:    16,                                     // allow:raw-byte-literal — RR count, not bytes
-    maxAnswerRrs:     128,                                    // allow:raw-byte-literal — RR count
-    maxAuthorityRrs:  64,                                     // allow:raw-byte-literal — RR count
-    maxAdditionalRrs: 64,                                     // allow:raw-byte-literal — RR count
+    maxCnameDepth:    16,                                     // RR count, not bytes
+    maxAnswerRrs:     128,                                    // RR count
+    maxAuthorityRrs:  64,                                     // RR count
+    maxAdditionalRrs: 64,                                     // RR count
     maxTxtRdata:      C.BYTES.kib(128),
   },
   permissive: {
     maxResponseBytes: C.BYTES.kib(64),
     maxEdns0Bytes:    C.BYTES.kib(64),
     maxLabels:        DEFAULT_MAX_LABELS,
-    maxPointerDepth:  32,                                     // allow:raw-byte-literal — pointer chain count
-    maxCnameDepth:    32,                                     // allow:raw-byte-literal — chain count
-    maxAnswerRrs:     256,                                    // allow:raw-byte-literal — RR count
-    maxAuthorityRrs:  128,                                    // allow:raw-byte-literal — RR count
-    maxAdditionalRrs: 128,                                    // allow:raw-byte-literal — RR count
+    maxPointerDepth:  32,                                     // pointer chain count
+    maxCnameDepth:    32,                                     // chain count
+    maxAnswerRrs:     256,                                    // RR count
+    maxAuthorityRrs:  128,                                    // RR count
+    maxAdditionalRrs: 128,                                    // RR count
     maxTxtRdata:      C.BYTES.kib(512),
   },
 });
@@ -239,13 +239,13 @@ function parseResponse(buf, opts) {
   var question = [];
   for (var q = 0; q < qdcount; q += 1) {
     var qname = _readName(state, 0);
-    if (state.off + 4 > buf.length) {                                                                   // allow:raw-byte-literal — RFC 1035 question fixed tail (QTYPE 2 + QCLASS 2)
+    if (state.off + 4 > buf.length) {                                                                   // RFC 1035 question fixed tail (QTYPE 2 + QCLASS 2)
       throw new SafeDnsError("safe-dns/truncated-rr",
         "safeDns.parseResponse: question RR truncated mid-fixed-tail");
     }
     var qtype  = buf.readUInt16BE(state.off);
     var qclass = buf.readUInt16BE(state.off + 2);
-    state.off += 4;                                                                                     // allow:raw-byte-literal — RFC 1035 QTYPE 2 + QCLASS 2 advance
+    state.off += 4;                                                                                     // RFC 1035 QTYPE 2 + QCLASS 2 advance
     question.push({
       name:     qname,
       type:     qtype,
@@ -272,7 +272,7 @@ function parseResponse(buf, opts) {
 
   return {
     id:         id,
-    rcode:      flags & 0x0f,                                                                            // allow:raw-byte-literal — RFC 1035 §4.1.1 RCODE mask
+    rcode:      flags & 0x0f,                                                                            // RFC 1035 §4.1.1 RCODE mask
     flags:      flags,
     question:   question,
     answer:     answer,
@@ -392,12 +392,12 @@ function _readName(state, pointerDepth) {
       }
       break;
     }
-    if ((byte & 0xc0) === 0xc0) {                                                                       // allow:raw-byte-literal — RFC 1035 §4.1.4 compression pointer mask
+    if ((byte & 0xc0) === 0xc0) {                                                                       // RFC 1035 §4.1.4 compression pointer mask
       if (off + 1 >= state.buf.length) {
         throw new SafeDnsError("safe-dns/truncated-name",
           "safeDns.readName: compression pointer truncated");
       }
-      var ptrOff = ((byte & 0x3f) << 8) | state.buf[off + 1];                                           // allow:raw-byte-literal — RFC 1035 §4.1.4 14-bit pointer offset
+      var ptrOff = ((byte & 0x3f) << 8) | state.buf[off + 1];                                           // RFC 1035 §4.1.4 14-bit pointer offset
       if (ptrOff >= state.buf.length) {
         throw new SafeDnsError("safe-dns/truncated-name",
           "safeDns.readName: compression pointer offset past message end");
@@ -405,12 +405,12 @@ function _readName(state, pointerDepth) {
       // First compression pointer ends the in-line label walk
       // (line break below). `jumped` can never already be true here;
       // assign unconditionally per Codex code-quality review.
-      afterPointerOff = off + 2;                                                                        // allow:raw-byte-literal — RFC 1035 §4.1.4 2-byte pointer width
+      afterPointerOff = off + 2;                                                                        // RFC 1035 §4.1.4 2-byte pointer width
       jumped = true;
       var subState = { off: ptrOff, buf: state.buf, caps: state.caps };
       var tailName = _readName(subState, pointerDepth + 1);
       if (tailName.length) labels.push(tailName);
-      totalBytes += 2;                                                                                  // allow:raw-byte-literal — RFC 1035 §4.1.4 2-byte pointer width
+      totalBytes += 2;                                                                                  // RFC 1035 §4.1.4 2-byte pointer width
       if (totalBytes > DNS_MAX_NAME_BYTES) {
         throw new SafeDnsError("safe-dns/oversize-name",
           "safeDns.readName: composite name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
@@ -450,9 +450,9 @@ function _readRr(state) {
       "safeDns.readRr: RR truncated mid-fixed-prefix");
   }
   var rtype   = state.buf.readUInt16BE(state.off);
-  var rclass  = state.buf.readUInt16BE(state.off + 2);                                                  // allow:raw-byte-literal — RFC 1035 §3.2.1 CLASS offset
-  var ttl     = state.buf.readUInt32BE(state.off + 4);                                                  // allow:raw-byte-literal — RFC 1035 §3.2.1 TTL offset
-  var rdlen   = state.buf.readUInt16BE(state.off + 8);                                                  // allow:raw-byte-literal — RFC 1035 §3.2.1 RDLENGTH offset
+  var rclass  = state.buf.readUInt16BE(state.off + 2);                                                  // RFC 1035 §3.2.1 CLASS offset
+  var ttl     = state.buf.readUInt32BE(state.off + 4);                                                  // RFC 1035 §3.2.1 TTL offset
+  var rdlen   = state.buf.readUInt16BE(state.off + 8);                                                  // RFC 1035 §3.2.1 RDLENGTH offset
   state.off += DNS_RR_FIXED_BYTES;
   if (state.off + rdlen > state.buf.length) {
     throw new SafeDnsError("safe-dns/malformed-rdlength",
@@ -464,65 +464,65 @@ function _readRr(state) {
   state.off += rdlen;
 
   var decoded = null;
-  if (rtype === RTYPE_A && rdlen === 4) {                                                               // allow:raw-byte-literal — RFC 1035 §3.4.1 A record is 4 octets
-    decoded = rdata[0] + "." + rdata[1] + "." + rdata[2] + "." + rdata[3];                              // allow:raw-byte-literal — dotted-quad indices into 4-octet A rdata
-  } else if (rtype === RTYPE_AAAA && rdlen === 16) {                                                    // allow:raw-byte-literal — RFC 3596 §2.2 AAAA record is 16 octets
+  if (rtype === RTYPE_A && rdlen === 4) {                                                               // RFC 1035 §3.4.1 A record is 4 octets
+    decoded = rdata[0] + "." + rdata[1] + "." + rdata[2] + "." + rdata[3];                              // dotted-quad indices into 4-octet A rdata
+  } else if (rtype === RTYPE_AAAA && rdlen === 16) {                                                    // RFC 3596 §2.2 AAAA record is 16 octets
     decoded = _formatIpv6(rdata);
   } else if (rtype === RTYPE_CNAME || rtype === RTYPE_NS || rtype === RTYPE_PTR) {
     var subState = { off: rdataStart, buf: state.buf, caps: state.caps };
     decoded = _readName(subState, 0);
-  } else if (rtype === RTYPE_MX && rdlen >= 3) {                                                        // allow:raw-byte-literal — RFC 1035 §3.3.9 MX preference 2 + min exchange 1
+  } else if (rtype === RTYPE_MX && rdlen >= 3) {                                                        // RFC 1035 §3.3.9 MX preference 2 + min exchange 1
     var pref = rdata.readUInt16BE(0);
-    var mxState = { off: rdataStart + 2, buf: state.buf, caps: state.caps };                            // allow:raw-byte-literal — MX preference field width
+    var mxState = { off: rdataStart + 2, buf: state.buf, caps: state.caps };                            // MX preference field width
     var exchange = _readName(mxState, 0);
     decoded = { preference: pref, exchange: exchange };
   } else if (rtype === RTYPE_TXT) {
     decoded = _decodeTxt(rdata, rdlen, state.caps);
   } else if (rtype === RTYPE_SOA) {
     decoded = _decodeSoa(state.buf, rdataStart, rdlen, state.caps);
-  } else if (rtype === RTYPE_SRV && rdlen >= 7) {                                                       // allow:raw-byte-literal — RFC 2782 SRV fixed prefix 6 + min target 1
-    var srvState = { off: rdataStart + 6, buf: state.buf, caps: state.caps };                           // allow:raw-byte-literal — RFC 2782 priority 2 + weight 2 + port 2
+  } else if (rtype === RTYPE_SRV && rdlen >= 7) {                                                       // RFC 2782 SRV fixed prefix 6 + min target 1
+    var srvState = { off: rdataStart + 6, buf: state.buf, caps: state.caps };                           // RFC 2782 priority 2 + weight 2 + port 2
     var target = _readName(srvState, 0);
     decoded = {
       priority: rdata.readUInt16BE(0),
-      weight:   rdata.readUInt16BE(2),                                                                  // allow:raw-byte-literal — RFC 2782 weight offset
-      port:     rdata.readUInt16BE(4),                                                                  // allow:raw-byte-literal — RFC 2782 port offset
+      weight:   rdata.readUInt16BE(2),                                                                  // RFC 2782 weight offset
+      port:     rdata.readUInt16BE(4),                                                                  // RFC 2782 port offset
       target:   target,
     };
-  } else if (rtype === RTYPE_DS && rdlen >= 4) {                                                        // allow:raw-byte-literal — RFC 4034 §5.1 DS fixed prefix 4 + digest
+  } else if (rtype === RTYPE_DS && rdlen >= 4) {                                                        // RFC 4034 §5.1 DS fixed prefix 4 + digest
     decoded = {
       keyTag:     rdata.readUInt16BE(0),
       algorithm:  rdata.readUInt8(2),
       digestType: rdata.readUInt8(3),
-      digest:     rdata.slice(4),                                                                       // allow:raw-byte-literal — RFC 4034 §5.1 digest start
+      digest:     rdata.slice(4),                                                                       // RFC 4034 §5.1 digest start
     };
-  } else if (rtype === RTYPE_DNSKEY && rdlen >= 4) {                                                    // allow:raw-byte-literal — RFC 4034 §2.1 DNSKEY fixed prefix 4 + pubkey
+  } else if (rtype === RTYPE_DNSKEY && rdlen >= 4) {                                                    // RFC 4034 §2.1 DNSKEY fixed prefix 4 + pubkey
     decoded = {
       flags:     rdata.readUInt16BE(0),
       protocol:  rdata.readUInt8(2),
       algorithm: rdata.readUInt8(3),
-      publicKey: rdata.slice(4),                                                                        // allow:raw-byte-literal — RFC 4034 §2.1 publicKey start
+      publicKey: rdata.slice(4),                                                                        // RFC 4034 §2.1 publicKey start
     };
-  } else if (rtype === RTYPE_RRSIG && rdlen >= 18) {                                                    // allow:raw-byte-literal — RFC 4034 §3.1 RRSIG fixed prefix 18 + signer + signature
-    var rrsigState = { off: rdataStart + 18, buf: state.buf, caps: state.caps };                        // allow:raw-byte-literal — RFC 4034 §3.1 fixed prefix width
+  } else if (rtype === RTYPE_RRSIG && rdlen >= 18) {                                                    // RFC 4034 §3.1 RRSIG fixed prefix 18 + signer + signature
+    var rrsigState = { off: rdataStart + 18, buf: state.buf, caps: state.caps };                        // RFC 4034 §3.1 fixed prefix width
     var signer = _readName(rrsigState, 0);
     decoded = {
       typeCovered: rdata.readUInt16BE(0),
       algorithm:   rdata.readUInt8(2),
       labels:      rdata.readUInt8(3),
-      originalTtl: rdata.readUInt32BE(4),                                                               // allow:raw-byte-literal — RFC 4034 §3.1 originalTtl offset
-      sigExpiry:   rdata.readUInt32BE(8),                                                               // allow:raw-byte-literal — RFC 4034 §3.1 expiry offset
-      sigInception: rdata.readUInt32BE(12),                                                             // allow:raw-byte-literal — RFC 4034 §3.1 inception offset
-      keyTag:      rdata.readUInt16BE(16),                                                              // allow:raw-byte-literal — RFC 4034 §3.1 keyTag offset
+      originalTtl: rdata.readUInt32BE(4),                                                               // RFC 4034 §3.1 originalTtl offset
+      sigExpiry:   rdata.readUInt32BE(8),                                                               // RFC 4034 §3.1 expiry offset
+      sigInception: rdata.readUInt32BE(12),                                                             // RFC 4034 §3.1 inception offset
+      keyTag:      rdata.readUInt16BE(16),                                                              // RFC 4034 §3.1 keyTag offset
       signerName:  signer,
       signature:   state.buf.slice(rrsigState.off, rdataStart + rdlen),
     };
-  } else if (rtype === RTYPE_TLSA && rdlen >= 3) {                                                      // allow:raw-byte-literal — RFC 6698 §2.1 TLSA fixed prefix 3 + certData
+  } else if (rtype === RTYPE_TLSA && rdlen >= 3) {                                                      // RFC 6698 §2.1 TLSA fixed prefix 3 + certData
     decoded = {
       usage:        rdata.readUInt8(0),
       selector:     rdata.readUInt8(1),
       matchingType: rdata.readUInt8(2),
-      certData:     rdata.slice(3),                                                                     // allow:raw-byte-literal — RFC 6698 §2.1 certData start
+      certData:     rdata.slice(3),                                                                     // RFC 6698 §2.1 certData start
     };
   }
 
@@ -544,15 +544,15 @@ function _readRr(state) {
 // (::ffff:0:0/96) emit the trailing 32 bits as dotted-quad per
 // RFC 5952 §5.
 function _formatIpv6(rdata) {
-  var groups = new Array(8);                                                                            // allow:raw-byte-literal — RFC 4291 §2.2 8 IPv6 groups
-  for (var g = 0; g < 8; g += 1) groups[g] = rdata.readUInt16BE(g * 2);                                 // allow:raw-byte-literal — RFC 4291 §2.2 group byte stride
+  var groups = new Array(8);                                                                            // RFC 4291 §2.2 8 IPv6 groups
+  for (var g = 0; g < 8; g += 1) groups[g] = rdata.readUInt16BE(g * 2);                                 // RFC 4291 §2.2 group byte stride
 
   // RFC 5952 §5 — IPv4-mapped: first 80 bits zero, next 16 bits 0xFFFF.
   var isV4Mapped = true;
-  for (var z = 0; z < 5; z += 1) if (groups[z] !== 0) { isV4Mapped = false; break; }                    // allow:raw-byte-literal — RFC 5952 §5 v4-mapped zero-prefix groups
-  if (isV4Mapped && groups[5] !== 0xffff) isV4Mapped = false;                                           // allow:raw-byte-literal — RFC 5952 §5 v4-mapped marker group
+  for (var z = 0; z < 5; z += 1) if (groups[z] !== 0) { isV4Mapped = false; break; }                    // RFC 5952 §5 v4-mapped zero-prefix groups
+  if (isV4Mapped && groups[5] !== 0xffff) isV4Mapped = false;                                           // RFC 5952 §5 v4-mapped marker group
   if (isV4Mapped) {
-    var dotted = rdata[12] + "." + rdata[13] + "." + rdata[14] + "." + rdata[15];                       // allow:raw-byte-literal — RFC 5952 §5 trailing v4 octets
+    var dotted = rdata[12] + "." + rdata[13] + "." + rdata[14] + "." + rdata[15];                       // RFC 5952 §5 trailing v4 octets
     return "::ffff:" + dotted;
   }
 
@@ -561,7 +561,7 @@ function _formatIpv6(rdata) {
   var bestLen   = 0;
   var curStart  = -1;
   var curLen    = 0;
-  for (var i = 0; i < 8; i += 1) {                                                                      // allow:raw-byte-literal — RFC 4291 §2.2 IPv6 group iteration
+  for (var i = 0; i < 8; i += 1) {                                                                      // RFC 4291 §2.2 IPv6 group iteration
     if (groups[i] === 0) {
       if (curStart === -1) curStart = i;
       curLen += 1;
@@ -571,7 +571,7 @@ function _formatIpv6(rdata) {
       curLen = 0;
     }
   }
-  var hex = groups.map(function (n) { return n.toString(16); });                                        // allow:raw-byte-literal — hex radix
+  var hex = groups.map(function (n) { return n.toString(16); });                                        // hex radix
   if (bestLen < 2) return hex.join(":");
   var head = hex.slice(0, bestStart).join(":");
   var tail = hex.slice(bestStart + bestLen).join(":");
@@ -602,15 +602,15 @@ function _decodeSoa(buf, rdataStart, rdlen, caps) {
   var state = { off: rdataStart, buf: buf, caps: caps };
   var mname = _readName(state, 0);
   var rname = _readName(state, 0);
-  if (state.off + 20 > rdataStart + rdlen) {                                                            // allow:raw-byte-literal — RFC 1035 §3.3.13 SOA tail = SERIAL 4 + REFRESH 4 + RETRY 4 + EXPIRE 4 + MINIMUM 4 = 20 octets
+  if (state.off + 20 > rdataStart + rdlen) {                                                            // RFC 1035 §3.3.13 SOA tail = SERIAL 4 + REFRESH 4 + RETRY 4 + EXPIRE 4 + MINIMUM 4 = 20 octets
     throw new SafeDnsError("safe-dns/malformed-rdlength",
       "safeDns.decodeSoa: SOA tail truncated");
   }
   var serial  = buf.readUInt32BE(state.off);
-  var refresh = buf.readUInt32BE(state.off + 4);                                                        // allow:raw-byte-literal — RFC 1035 §3.3.13 REFRESH offset
-  var retry   = buf.readUInt32BE(state.off + 8);                                                        // allow:raw-byte-literal — RFC 1035 §3.3.13 RETRY offset
-  var expire  = buf.readUInt32BE(state.off + 12);                                                       // allow:raw-byte-literal — RFC 1035 §3.3.13 EXPIRE offset
-  var minimum = buf.readUInt32BE(state.off + 16);                                                       // allow:raw-byte-literal — RFC 1035 §3.3.13 MINIMUM offset
+  var refresh = buf.readUInt32BE(state.off + 4);                                                        // RFC 1035 §3.3.13 REFRESH offset
+  var retry   = buf.readUInt32BE(state.off + 8);                                                        // RFC 1035 §3.3.13 RETRY offset
+  var expire  = buf.readUInt32BE(state.off + 12);                                                       // RFC 1035 §3.3.13 EXPIRE offset
+  var minimum = buf.readUInt32BE(state.off + 16);                                                       // RFC 1035 §3.3.13 MINIMUM offset
   return {
     mname: mname, rname: rname,
     serial: serial, refresh: refresh, retry: retry, expire: expire, minimum: minimum,
@@ -627,9 +627,9 @@ function _decodeOpt(rr, caps) {
       "safeDns.decodeOpt: advertised buffer size=" + advertised +
       " exceeds maxEdns0Bytes=" + caps.maxEdns0Bytes);
   }
-  var extendedRcode = (rr.ttl >>> 24) & 0xff;                                                           // allow:raw-byte-literal — RFC 6891 §6.1.3 extended RCODE upper byte
-  var version       = (rr.ttl >>> 16) & 0xff;                                                           // allow:raw-byte-literal — RFC 6891 §6.1.3 version byte
-  var dnssecOk      = (rr.ttl & 0x8000) !== 0;                                                          // allow:raw-byte-literal — RFC 4035 §3.2.1 DO bit
+  var extendedRcode = (rr.ttl >>> 24) & 0xff;                                                           // RFC 6891 §6.1.3 extended RCODE upper byte
+  var version       = (rr.ttl >>> 16) & 0xff;                                                           // RFC 6891 §6.1.3 version byte
+  var dnssecOk      = (rr.ttl & 0x8000) !== 0;                                                          // RFC 4035 §3.2.1 DO bit
   return {
     advertisedUdpSize: advertised,
     extendedRcode:     extendedRcode,

package/lib/safe-ical.js

@@ -86,33 +86,33 @@ var SafeIcalError = defineClass("SafeIcalError", { alwaysPermanent: true });
 
 // RRULE caps are enforced regardless of profile — the recursion-DoS
 // class has no safe permissive posture.
-var RRULE_MAX_COUNT      = 10000;                                                                          // allow:raw-byte-literal — RFC 5545 §3.3.10 recurrence-count cap
-var RRULE_MAX_BY_ENTRIES = 24;                                                                             // allow:raw-byte-literal — BYxxx list-length cap
+var RRULE_MAX_COUNT      = 10000;                                                                          // RFC 5545 §3.3.10 recurrence-count cap
+var RRULE_MAX_BY_ENTRIES = 24;                                                                             // BYxxx list-length cap
 
 var PROFILES = Object.freeze({
   strict: Object.freeze({
     maxBytes:        C.BYTES.kib(256),
     maxLineBytes:    C.BYTES.kib(8),
-    maxLines:        16384,                                                                                // allow:raw-byte-literal — line count cap, not byte size
-    maxNestingDepth: 16,                                                                                   // allow:raw-byte-literal — nesting depth cap, not bytes
-    maxComponents:   4096,                                                                                 // allow:raw-byte-literal — total component count cap, not bytes
-    maxPropertiesPerComponent: 256,                                                                        // allow:raw-byte-literal — per-component prop count, not bytes
+    maxLines:        16384,                                                                                // line count cap, not byte size
+    maxNestingDepth: 16,                                                                                   // nesting depth cap, not bytes
+    maxComponents:   4096,                                                                                 // total component count cap, not bytes
+    maxPropertiesPerComponent: 256,                                                                        // per-component prop count, not bytes
   }),
   balanced: Object.freeze({
     maxBytes:        C.BYTES.mib(1),
     maxLineBytes:    C.BYTES.kib(32),
-    maxLines:        65536,                                                                                // allow:raw-byte-literal — line count cap, not byte size
-    maxNestingDepth: 32,                                                                                   // allow:raw-byte-literal — nesting depth cap, not bytes
-    maxComponents:   16384,                                                                                // allow:raw-byte-literal — total component count cap, not bytes
-    maxPropertiesPerComponent: 1024,                                                                       // allow:raw-byte-literal — per-component prop count, not bytes
+    maxLines:        65536,                                                                                // line count cap, not byte size
+    maxNestingDepth: 32,                                                                                   // nesting depth cap, not bytes
+    maxComponents:   16384,                                                                                // total component count cap, not bytes
+    maxPropertiesPerComponent: 1024,                                                                       // per-component prop count, not bytes
   }),
   permissive: Object.freeze({
     maxBytes:        C.BYTES.mib(4),
     maxLineBytes:    C.BYTES.kib(128),
-    maxLines:        262144,                                                                               // allow:raw-byte-literal — line count cap, not byte size
-    maxNestingDepth: 64,                                                                                   // allow:raw-byte-literal — nesting depth cap, not bytes
-    maxComponents:   65536,                                                                                // allow:raw-byte-literal — total component count cap, not bytes
-    maxPropertiesPerComponent: 4096,                                                                       // allow:raw-byte-literal — per-component prop count, not bytes
+    maxLines:        262144,                                                                               // line count cap, not byte size
+    maxNestingDepth: 64,                                                                                   // nesting depth cap, not bytes
+    maxComponents:   65536,                                                                                // total component count cap, not bytes
+    maxPropertiesPerComponent: 4096,                                                                       // per-component prop count, not bytes
   }),
 });
 
@@ -345,7 +345,7 @@ function _unfold(s, caps) {
       continue;
     }
     var firstChar = line.charCodeAt(0);
-    if (firstChar === 0x20 || firstChar === 0x09) {                                                       // allow:raw-byte-literal — SPACE / HTAB are RFC 5545 §3.1 fold markers
+    if (firstChar === 0x20 || firstChar === 0x09) {                                                       // SPACE / HTAB are RFC 5545 §3.1 fold markers
       if (unfolded.length === 0) {
         throw new SafeIcalError("safe-ical/bad-line",
           "safeIcal.parse: continuation line before any content line");
@@ -393,7 +393,7 @@ function _parseContentLine(line) {
   // value. Header-injection / log-poisoning defense.
   for (var k = 0; k < value.length; k++) {
     var cc = value.charCodeAt(k);
-    if ((cc < 0x20 && cc !== 0x09) || cc === 0x7F) {                                                      // allow:raw-byte-literal — C0 + DEL refusal
+    if ((cc < 0x20 && cc !== 0x09) || cc === 0x7F) {                                                      // C0 + DEL refusal
       throw new SafeIcalError("safe-ical/control-char-in-value",
         "safeIcal.parse: control char 0x" + cc.toString(16) +
         " in property value (header-injection defense)");
@@ -427,8 +427,8 @@ function _findUnquotedColon(line) {
   var inQ = false;
   for (var i = 0; i < line.length; i++) {
     var c = line.charCodeAt(i);
-    if (c === 0x22) { inQ = !inQ; continue; }                                                             // allow:raw-byte-literal — DQUOTE per RFC 5545 §3.1 quoted-string
-    if (c === 0x3A && !inQ) return i;                                                                     // allow:raw-byte-literal — colon separator per RFC 5545 §3.1
+    if (c === 0x22) { inQ = !inQ; continue; }                                                             // DQUOTE per RFC 5545 §3.1 quoted-string
+    if (c === 0x3A && !inQ) return i;                                                                     // colon separator per RFC 5545 §3.1
   }
   return -1;
 }
@@ -620,7 +620,7 @@ function _shapeComponent(comp) {
 
 function _preview(s) {
   if (typeof s !== "string") s = String(s);
-  return s.length > 64 ? s.slice(0, 64) + "..." : s;                                                       // allow:raw-byte-literal — log-preview length cap
+  return s.length > 64 ? s.slice(0, 64) + "..." : s;                                                       // log-preview length cap
 }
 
 module.exports = {