npm - @blamejs/core - Versions diffs - 0.15.10 → 0.15.11 - Mend

@blamejs/core 0.15.10 → 0.15.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/CHANGELOG.md +2 -0
package/lib/crypto-field.js +30 -0
package/lib/db-declare-row-policy.js +20 -1
package/lib/db.js +7 -0
package/lib/guard-csv.js +13 -4
package/lib/mail-bimi.js +16 -3
package/lib/mail.js +16 -9
package/lib/mcp.js +28 -6
package/lib/middleware/bot-disclose.js +7 -5
package/lib/middleware/speculation-rules.js +6 -4
package/lib/parsers/safe-env.js +6 -3
package/lib/parsers/safe-yaml.js +6 -6
package/lib/safe-buffer.js +69 -1
package/package.json +1 -1
package/sbom.cdx.json +6 -6

package/CHANGELOG.md CHANGED Viewed

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 ## v0.15.x
+- v0.15.11 (2026-06-14) — **Replaces a family of quadratic-time regexes that hostile input could use to stall a worker with linear scans, refuses a relocatable sealed-cell downgrade on the read side, fails closed when enabling row-level security behind a non-native driver, and scans the vendored crypto for known CVEs on every build.** Several text-handling primitives stripped trailing whitespace or extracted a mail address with a regex whose backtracking is quadratic in the input length on adversarial strings — a request body, a YAML document, a CSV cell, or a From header crafted as a long run of spaces could pin a worker's CPU. Each is now a linear character scan with identical output. The HTML-content check the MCP tool surface applies gained the vbscript: and data:text/html vectors it was missing. On the data-at-rest side, an AAD-bound (or per-row-key) column now refuses a plain, unbound vault cell on read — a relocatable envelope an attacker with write access could copy in from another row defeats the cross-row binding, so the field is nulled rather than surfaced; operators mid-migration opt back in with registerTable({ allowPlainMigration: true }). declareRowPolicy now treats row-level-security as enabled only on a value that unambiguously means true, so a non-native Postgres driver that returns the string "f" can no longer be read as "already on" and silently skip the ENABLE that protects the table's rows. Finally, because the framework's crypto is vendored rather than installed, npm audit and Dependabot never see it: every build now matches the vendored versions against the OSV vulnerability database, with a complementary Semgrep pass and workflow-file static analysis alongside. **Added:** *b.safeBuffer.indexAfterOpenTag(html, tagName)* — A linear helper that returns the offset just past a `<tag ...>` opening tag (case-insensitive), or -1 when absent or unterminated — the insertion point a response rewriter uses to splice content after <body> or <head> without a regex. It replaces the O(n^2) html.match(/<body[^>]*>/i) shape and is stricter than it: a real tag boundary is required after the name, so <bodyfoo> is not mistaken for <body>. **Security:** *Linear-time replacements across a family of quadratic regexes (ReDoS class)* — Several primitives located or stripped text with a regex whose backtracking is quadratic in V8 on adversarial input (CWE-1333): b.safeBuffer and the safe-env / safe-yaml / guard-csv parsers stripped trailing horizontal whitespace with /[ \t]+$/; b.mail extracted the address from a `Name <addr>` header with /<([^>]+)>/; the bot-disclosure and speculation-rules response middleware found the <body> insertion point with /<body[^>]*>/i; and the BIMI certificate-chain splitter walked PEM blocks with a lazy /BEGIN[\s\S]*?END/ scan. A crafted field — a long run of spaces, an unterminated bracket, a body carrying many <body starts with no closing >, a chain of BEGIN markers — could drive a worker's CPU to seconds of work. Each is now a linear scan: a shared b.safeBuffer.stripTrailingHspace (backward char walk), b.safeBuffer.indexAfterOpenTag (forward indexOf walk for the tag insertion point), a forward indexOf for address extraction, and an indexOf walk for the PEM split. Output is byte-identical (the tag-find is stricter — it no longer mistakes <bodyfoo> for <body>), and 400K-character adversarial inputs that took 8–85 seconds now complete in under 2 ms. · *MCP HTML-content check covers vbscript: and data:text/html* — The dangerous-markup check applied to text/html tool content matched <script>/<iframe>/<object>/<embed> and javascript: URLs but not the vbscript: scheme or data:text/html payloads. Both are now refused; data: URLs carrying non-HTML media (data:image/png and similar) are unaffected. · *AAD-bound columns refuse a plain sealed cell on read* — b.cryptoField.unsealRow now refuses a plain, unbound vault: envelope found on an AAD-bound (or per-row-key) column and nulls the field instead of returning it. A plain envelope carries no per-cell binding, so a writer who could place one — copied from anywhere under the same vault root — would otherwise relocate a value across rows or columns and defeat the copy-protection the AAD binding advertises. Operators migrating pre-AAD rows up to bound ciphertext opt into a bounded acceptance window with registerTable({ allowPlainMigration: true }) and clear it when migration completes. · *Row-level-security enablement fails closed on non-native drivers* — b.db.declareRowPolicy read pg_class.relrowsecurity to skip a redundant ENABLE ROW LEVEL SECURITY, but tested it with a bare truthiness check. A native pg driver returns a JS boolean; a proxy or ORM may return the string "f" for a disabled table — and "f" is truthy, so the check read it as already-enabled and silently skipped the ENABLE, leaving every row in the table unprotected while the migration reported success. RLS now counts as enabled only on a value that unambiguously means true (true, 1, or "t"/"true"/"1"/"on"/"yes"); every other shape re-issues ENABLE, a harmless no-op on an already-enabled table. · *Vendored-crypto CVE scanning, complementary SAST, and workflow static analysis in CI* — The framework ships zero npm runtime dependencies — its crypto (the noble suite, the WebAuthn server, the PKI layer) is vendored under lib/vendor/, where npm audit, Dependabot, and Socket cannot see it. Every build now generates a CycloneDX SBOM of the vendored tree (each library carrying an npm purl) and runs it through OSV-Scanner, matching the exact pinned version against the OSV vulnerability database; a published CVE or GHSA affecting a vendored version fails the build so the copy is refreshed before merge. A Semgrep pass (registry security-audit + javascript packs at ERROR severity) runs alongside CodeQL as complementary SAST, and actionlint statically checks the workflow files. All three install the OSS tool from its upstream release, matching the existing secret-scan gate's posture. **Detectors:** *Quadratic trailing-whitespace and tag-find regex detectors* — Two codebase-pattern detectors refuse reintroduction of the quadratic shapes: the /[ \t]+$/ trailing-whitespace strip (as .replace, .test, or via the named TRAILING_HSPACE_RE export) outside the linear helper that owns it, and the str.match(/<tag[^>]*>/) document-tag find that the response middleware must route through b.safeBuffer.indexAfterOpenTag. Each is proven to fire on the removed shape and stay silent on the linear replacement, so the ReDoS class cannot creep back into a new parser, guard, or response rewriter.
 - v0.15.10 (2026-06-13) — **Makes S3 Object-Lock version erasure reachable through the object store, and pins the build toolchain's native binary to a reviewed hash.** The object store gains the versioned-delete surface its S3 Object Lock support always needed for real erasure. An unversioned delete on a versioning-enabled (Object-Lock) bucket only writes a delete-marker — the data version survives — so the framework's own delete could report success while a record protected for compliance, or one a data subject asked to erase, stayed on disk. b.objectStore / b.storage now carry a versionId: put and saveRaw return the version they created, deleteFile(key, { versionId, bypassGovernanceRetention }) targets a specific version (refused — not silently delete-markered — when it is under an active retention), and listVersions enumerates versions and delete-markers so an erasure workflow can find them. Backends with no version surface (the filesystem backend, and the current Azure and GCS adapters) refuse a versioned delete loudly rather than silently dropping the current object. Separately, the build toolchain's native bundler binary is now verified against a reviewed SHA-256 pin so a tampered or drifted binary is caught before it bundles the framework. **Added:** *Versioned object delete + listVersions for S3 Object-Lock erasure* — b.storage.deleteFile and the b.objectStore sigv4 backend now accept opts.versionId to erase a specific object version, and opts.bypassGovernanceRetention to lift a GOVERNANCE-mode retention for callers with the permission (COMPLIANCE stays immutable to everyone). b.storage.saveRaw and the backend put now return the versionId they created on a versioning-enabled bucket, and a new b.storage.listVersions(prefix) / backend listVersions enumerates every version and delete-marker (key, versionId, isLatest, deleteMarker, size, lastModified, etag) so a right-to-erasure or crypto-shred workflow can target prior versions. On a backend with no version surface, listVersions throws VERSIONS_UNSUPPORTED and a versioned delete throws VERSIONID_UNSUPPORTED rather than silently acting on the current object. · *b.localDb.thin reaches SQLite resource-limit parity (limits option)* — b.localDb.thin now opens its node:sqlite handle with the same parse-time statement-size cap as b.db and the CLI — a SQL statement over 1 MiB is rejected at parse time, the SQLITE_LIMIT_LENGTH floor that guards prepare()/exec() of raw SQL against an attacker-influenced megaquery (SQLite's default is 1 GB). The cap is on by default; a new limits option (e.g. { sqlLength: 2 * 1024 * 1024 } or other SQLITE_LIMIT_* keys) lets an operator raise or extend it. Previously the thin opener had no limits plumbing, so a consumer on that path could not reach parity with the rest of the framework's SQLite surface. **Fixed:** *S3 Object-Lock version erasure is reachable through the framework delete path* — On a versioning-enabled (Object-Lock) bucket, an unversioned DELETE only writes a delete-marker — the protected data version survives untouched — yet the framework's delete had no versionId surface, so it issued the unversioned form and reported success while the bytes the lock protects remained. A retention or legal hold could therefore look enforced to the framework caller while the operation WORM actually blocks was unreachable. The delete path now targets the exact version: deleting a version under a COMPLIANCE retention is refused (it throws, even with bypassGovernanceRetention), a no-retention version erases cleanly, and the enforcement is proven end-to-end against MinIO through the framework's own API. · *b.configDrift.verifyVendorIntegrity is now working-directory-independent* — The vendored-dependency integrity check resolved each manifest file path against process.cwd(), so it only worked when run from the application root. Run from anywhere else it read-failed every entry (reporting ok:false), and under a crafted working directory that happened to contain a clean vendor tree it could hash a different tree than the one actually loaded. It now resolves each file under the framework's own vendor directory by default — the tree loaded at runtime — and honors an explicit libVendorDir for verifying a deployed tree elsewhere, so the result no longer depends on where the process was started. **Security:** *Build toolchain native binary pinned to a reviewed hash* — The native bundler binary the build toolchain runs (esbuild's per-platform compiler, a development dependency that never ships in the runtime) is now verified against a SHA-256 pin captured by diffing the published package tarballs and hashing the binary. The build gate fails if the on-disk binary does not match the reviewed hash for its (version, platform); for a version that has not been reviewed it notes the gap and skips rather than trusting an unverified binary. A cross-artifact check keeps the version in agreement across package.json, the CI install step, and the hash map, so the gate can never quietly test a version that was never diffed — closing a real drift where CI had been installing an older patch than package.json declared. The reviewed diff is benign: version strings plus an installer size-bound and error-message hardening, no new install hooks, files, or network paths, and no runtime-dependency impact. **Detectors:** *Object-store erasure guard, esbuild-pin agreement, + structural re-anchoring of the lint detectors* — A new guard locks the object-store delete path to the versioned-erasure contract: b.storage.deleteFile must thread versionId to the backend, so it can never silently revert to the WORM-blind unversioned delete. A second guard enforces that the esbuild build-tool version agrees across package.json, the CI install step, and the binary-hash map, so a future bump can't update one and leave the gate testing an unreviewed version. Separately, the framework's internal codebase-pattern lint detectors were re-anchored from fixed character spans to structural code boundaries, so they keep matching the code they guard as those functions grow rather than aging out of range; reviving them surfaced a few internal validation and transaction sites that now route through shared helpers (a required positive-integer-with-range validator and an async transaction wrapper) instead of hand-rolling the check. No public API change.
 - v0.15.9 (2026-06-13) — **Raises the Node floor to 24.16, adds SQLite parse-time resource caps, retries Windows rename locks on every atomic write and download, and ships a one-call secure logout that wipes client-side state.** This release moves the engines floor to the current Node 24 LTS patch level and adds three hardening primitives. node:sqlite handles now construct with SQLITE_LIMIT_* caps: a statement over 1 MiB is rejected at parse time (a DoS floor on the raw-SQL surface, complementary to the existing row-count gate) and ATTACH DATABASE is denied. Every final temp-to-destination rename — the file written by an atomic write, a downloaded file, a sealed vault key, a rotated log, an extracted archive entry — now routes through a single retry that rides out a transient Windows lock (antivirus, the search indexer, or a file-sync client briefly holding the destination), instead of surfacing the lock as a hard failure; the retry, previously hand-rolled and unreachable, is now the reusable b.atomicFile.renameWithRetry. And b.session.logout destroys a session and tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data header and expires the session cookie before destroying the row, the secure-default logout that previously had to be assembled by hand. **Added:** *b.session.logout — one-call secure logout* — `b.session.logout(res, token, opts?)` destroys the server-side session AND tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data response header (cookies + storage + cache + execution contexts by default) and expires the session cookie, then destroys the session row. `b.session.destroy` alone is a store operation with no response object, so it could not wipe the browser's cached pages, storage, or a stale tab still holding the now-revoked cookie — that wiring previously had to be mounted by hand. Pass `cookieName` to match a non-default cookie and `types` to choose the Clear-Site-Data directives. **Changed:** *Node engines floor raised to >=24.16.0* — The minimum supported Node is now 24.16.0 (the current Node 24 LTS patch level), up from 24.14.1. This is an LTS-currency bump — there are no Node CVE fixes between 24.14.1 and 24.16.0 (24.14.1 already carried the CVE-2026-21713 HMAC fix); it keeps the framework on the latest patched LTS and makes the node:sqlite resource-cap hardening below available everywhere. Pre-1.0, operators upgrade across the floor; Node 26 continues to satisfy it. **Fixed:** *b.watcher canonicalizes its root on Windows* — `b.watcher.create` now resolves its `root` to the real long path before watching. On Windows a root with an 8.3 short-name component (the system temp directory commonly resolves to one) made the native recursive backend deliver long-name event paths that no longer prefix-matched the watched root, which could abort the process under a strict libuv fs-event assertion. The watcher now canonicalizes the root (expanding short names and resolving symlinks), so events match the watched directory on Windows. **Security:** *SQLite parse-time statement-size cap* — Every node:sqlite database the framework opens — the main db handle and the CLI's handle — now constructs with a SQLITE_LIMIT_LENGTH cap: a SQL statement over 1 MiB is rejected at parse time. Because the query builder parameterizes every value, the size cap guards the raw-SQL surface (`b.db.runSql`) against an attacker-influenced megaquery the parser would otherwise process (SQLite's default is 1 GB); it is a parse-time DoS floor complementary to the existing row-count gate. Legitimate framework and operator statements are far under the cap. · *Windows rename-lock retry on every atomic rename and download* — On Windows a freshly-written file's destination is briefly held by antivirus, the search indexer, or a file-sync client (Dropbox, OneDrive), surfacing as a transient EPERM / EACCES / EBUSY on rename even though the temp file is fine. `b.atomicFile.writeSync` already retried this, but `b.httpClient.downloadStream` did not — a download into a cloud-synced or AV-scanned directory could fail hard on the lock. The retry is now the reusable `b.atomicFile.renameWithRetry`, and every final temp-to-destination rename in the framework routes through it: downloads, sealed vault keys, CA key/cert writes, log rotation, archive extraction, config-drift sidecars, the self-update binary swap, and restore/rollback moves. A non-transient error still throws immediately; POSIX renames are unaffected. **Detectors:** *Rename-retry, SQLite-limits, and Clear-Site-Data guards* — Three recurrence detectors ship with the fixes: a bare `nodeFs.renameSync` final rename that doesn't route through `atomicFile.renameWithRetry`; a main `DatabaseSync` handle constructed without the SQLITE_LIMIT_LENGTH `limits`; and a hand-rolled Clear-Site-Data header value that skips the shared RFC 9527 builder.

package/lib/crypto-field.js CHANGED Viewed

@@ -331,6 +331,15 @@ function isRowSealed(value) {
  *                                          // threaded into AAD. Default "1". Bump
  *                                          // when the column layout changes to
  *                                          // invalidate all prior ciphertext.
+ *   allowPlainMigration: boolean,          // default false. On an aad / per-row-key
+ *                                          // table the read path refuses a PLAIN
+ *                                          // (unbound) vault: cell — a relocatable
+ *                                          // envelope an attacker could copy in from
+ *                                          // another row defeats the AAD copy-
+ *                                          // protection, so it is nulled, not surfaced.
+ *                                          // Set true ONLY for the bounded window while
+ *                                          // migrating pre-AAD rows up to AAD-bound
+ *                                          // ciphertext; clear it once migration ends.
  *
  * @example
  *   b.cryptoField.registerTable("patients", {
@@ -403,6 +412,13 @@ function registerTable(name, opts) {
     rowIdField:      rowIdField,
     schemaVersion:   schemaVersion,
     derivedHashMode: derivedHashMode,
+    // allowPlainMigration — read-side downgrade window. On an aad / per-row-key
+    // table the read path refuses a plain `vault:` cell (no AAD = relocatable,
+    // which would defeat the cross-row/cross-column copy-protection the AAD
+    // binding advertises). Operators with genuine pre-AAD rows opt into a
+    // bounded lazy-migration window with { allowPlainMigration: true }; a
+    // re-seal (sealRow) then re-emits the cell AAD-bound. Default closed.
+    allowPlainMigration: opts.allowPlainMigration === true,
   };
 }
@@ -1240,6 +1256,20 @@ function unsealRow(table, row, actor, dbHandle) {
           unsealed = _decodeTyped(vaultAad.unseal(out[field],
             _aadParts(s, table, field, out)));
         } else if (typeof out[field] === "string" && out[field].startsWith(VAULT_PREFIX)) {
+          // A plain `vault:` cell (no AAD) on an AAD-bound / per-row-key table
+          // is a downgrade: plain vault.seal carries no AAD, so a DB-write
+          // attacker could relocate such a cell from another row/column into
+          // this one and the read would silently accept it — defeating the
+          // cross-row/cross-column copy-protection the AAD binding advertises.
+          // Refuse (throw -> catch nulls the field + audits) unless the table
+          // opted into the documented pre-AAD lazy-migration window.
+          if ((s.aad || perRowKeyTables[table]) && !s.allowPlainMigration) {
+            throw new CryptoFieldError("crypto-field/aad-downgrade-refused",
+              "unsealRow: '" + table + "'.'" + field + "' is AAD-bound but the stored " +
+              "cell is a plain (unbound) vault envelope — refusing a relocatable-seal " +
+              "downgrade (set registerTable({ allowPlainMigration: true }) for a " +
+              "documented pre-AAD migration window)");
+          }
           unsealed = _decodeTyped(vault.unseal(out[field]));
         } else {
           // Not a sealed value — pass through.

package/lib/db-declare-row-policy.js CHANGED Viewed

@@ -73,6 +73,18 @@ function _err(code, message) {
   return new DeclareRowPolicyError(code, message);
 }
+// _isRlsEnabled — fail-closed coercion of pg_class.relrowsecurity. Native pg
+// drivers return a JS boolean; a proxy / ORM / non-native driver may return
+// "t"/"f", "true"/"false", or 1/0. RLS counts as enabled ONLY on a value that
+// unambiguously means true; every other shape (including the truthy string
+// "f") reads as not-enabled, so ENABLE is (re-)issued rather than silently
+// skipped — a skipped ENABLE would leave the table's rows unprotected.
+function _isRlsEnabled(v) {
+  if (v === true || v === 1) return true;
+  if (typeof v === "string") return /^(t|true|1|on|yes)$/i.test(v.trim());
+  return false;
+}
 function _validateIdent(where, value) {
   try {
     safeSql.validateIdentifier(value, { allowReserved: true });
@@ -227,7 +239,14 @@ function declareRowPolicy(opts) {
         "source table '" + spec.schema + "." + spec.table +
         "' not found (does it exist? does the migration role have visibility?)");
     }
-    if (!rows[0].relrowsecurity) {
+    // relrowsecurity is a Postgres boolean. Native pg drivers return true/false,
+    // but a proxy / ORM / non-native driver may hand back "t"/"f", "true"/"false",
+    // or 1/0. The string "f" is TRUTHY, so a bare `!rows[0].relrowsecurity` would
+    // read "f" as "already enabled" and silently SKIP ENABLE — leaving the table's
+    // rows unprotected while the migration reports success. Treat RLS as enabled
+    // ONLY on a value that unambiguously means true; anything else fails closed and
+    // (re-)issues ENABLE, which is a harmless no-op on an already-enabled table.
+    if (!_isRlsEnabled(rows[0].relrowsecurity)) {
       var enableStmt = sql.enableRowLevelSecurity(tableRef, { dialect: "postgres" });
       await xdb.query(enableStmt.sql, enableStmt.params);
     }

package/lib/db.js CHANGED Viewed

@@ -1402,6 +1402,13 @@ async function init(opts) {
       aad:             t.aad,
       rowIdField:      t.rowIdField,
       schemaVersion:   t.schemaVersion,
+      // The read-side pre-AAD migration opt-in must pass through too —
+      // otherwise a schema declaring { aad: true, allowPlainMigration: true }
+      // registers with the default (false) via this declarative db.init path,
+      // and legacy plain vault: cells are nulled on read despite the operator
+      // opting into the migration window. registerTable defaults this to false,
+      // so non-migrating tables are unaffected.
+      allowPlainMigration: t.allowPlainMigration,
     });
     tableMetadata[t.name] = {
       primaryKey:             _normalizePk(t),

package/lib/guard-csv.js CHANGED Viewed

@@ -56,6 +56,7 @@
 var codepointClass = require("./codepoint-class");
 var csv = require("./csv");
+var safeBuffer = require("./safe-buffer");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var numericBounds = require("./numeric-bounds");
@@ -432,7 +433,9 @@ function _stripIssues(text, opts) {
   out = out.replace(ZW_RE_G, "");
   if (opts.trailingWhitespacePolicy === "trim") {
     out = out.split("\n").map(function (line) {
-      return line.replace(/[ \t]+$/g, "");
+      // Linear per-line trailing-whitespace trim — .replace(/[ \t]+$/) is
+      // O(n^2) in V8 on adversarial input (untrusted CSV here).
+      return safeBuffer.stripTrailingHspace(line);
     }).join("\n");
   }
   return out;
@@ -521,9 +524,15 @@ function escapeCell(value, opts) {
   if (opts.bidiCharPolicy === "strip") str = str.replace(BIDI_RE_G, "");
   if (opts.trailingWhitespacePolicy === "trim") {
-    str = str.replace(/[ \t]+$/g, "");
-  } else if (opts.trailingWhitespacePolicy === "reject" && /[ \t]+$/.test(str)) {
-    throw _err("csv.trailing-whitespace", "cell has trailing whitespace");
+    // Linear strip — .replace(/[ \t]+$/) is O(n^2) on adversarial untrusted CSV.
+    str = safeBuffer.stripTrailingHspace(str);
+  } else if (opts.trailingWhitespacePolicy === "reject") {
+    // Linear "ends in space/tab?" check — /[ \t]+$/.test is ALSO O(n^2) (the
+    // engine scans from every offset when there is no trailing run).
+    var lastCode = str.length > 0 ? str.charCodeAt(str.length - 1) : 0;
+    if (lastCode === 0x20 || lastCode === 0x09) {
+      throw _err("csv.trailing-whitespace", "cell has trailing whitespace");
+    }
   }
   if (typeof value === "number" &&

package/lib/mail-bimi.js CHANGED Viewed

@@ -799,10 +799,23 @@ async function fetchAndVerifyMark(opts) {
 function _splitPemChain(pemText) {
   if (typeof pemText !== "string") return [];
+  // Linear indexOf walk over non-overlapping BEGIN..END blocks — NOT
+  // /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g. The
+  // lazy-quantifier scan re-walks from every BEGIN marker that has no
+  // matching END, which is superlinear on a chain of BEGIN-only markers;
+  // the indexOf walk advances monotonically and never re-scans.
+  var BEGIN = "-----BEGIN CERTIFICATE-----";
+  var END = "-----END CERTIFICATE-----";
   var out = [];
-  var re = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
-  var m;
-  while ((m = re.exec(pemText)) !== null) out.push(m[0]);
+  var from = 0;
+  for (;;) {
+    var b = pemText.indexOf(BEGIN, from);
+    if (b === -1) break;
+    var e = pemText.indexOf(END, b + BEGIN.length);
+    if (e === -1) break;   // unterminated final block — no further certs
+    out.push(pemText.slice(b, e + END.length));
+    from = e + END.length;
+  }
   return out;
 }

package/lib/mail.js CHANGED Viewed

@@ -313,10 +313,9 @@ function _normalizeRecipientList(value, label) {
         label + "[" + i + "] contains forbidden control characters", true);
     }
     // Accept "Name <email@addr>" form too — extract the angle-bracket
-    // address for validation; preserve the full string in the message.
-    var bracket = arr[i].match(/<([^>]+)>/);
-    var addr = bracket ? bracket[1] : arr[i];
-    if (!_isValidEmail(addr.trim())) {
+    // address for validation (linear, via _extractAddr); preserve the full
+    // string in the message.
+    if (!_isValidEmail(_extractAddr(arr[i]))) {
       throw new MailError("mail/invalid-recipient",
         label + " '" + arr[i] + "' is not a valid email address", true);
     }
@@ -423,9 +422,7 @@ function _validateMessage(message) {
     throw new MailError("mail/invalid-from",
       "message.from contains forbidden control characters", true);
   }
-  var fromBracket = message.from.match(/<([^>]+)>/);
-  var fromAddr = fromBracket ? fromBracket[1] : message.from;
-  if (!_isValidEmail(fromAddr.trim())) {
+  if (!_isValidEmail(_extractAddr(message.from))) {
     throw new MailError("mail/invalid-from",
       "message.from '" + message.from + "' is not a valid email address", true);
   }
@@ -557,8 +554,18 @@ function _mergeMessage(defaults, message) {
 function _extractAddr(s) {
   if (s === undefined || s === null) return s;
-  var m = String(s).match(/<([^>]+)>/);
-  return m ? m[1].trim() : String(s).trim();
+  s = String(s);
+  // Linear angle-bracket extraction — NOT s.match(/<([^>]+)>/), which is O(n^2)
+  // in V8 on a long run of '<' with no '>' (the engine retries the greedy
+  // [^>]+ from every '<' offset; 200K '<' ~ 11s). Recipient/from addresses on
+  // b.mail.send can be caller/request-supplied, so this is a reachable DoS.
+  // Mirrors the regex: the chars between the first '<' and the next '>'.
+  var lt = s.indexOf("<");
+  if (lt !== -1) {
+    var gt = s.indexOf(">", lt + 1);
+    if (gt > lt + 1) return s.slice(lt + 1, gt).trim();
+  }
+  return s.trim();
 }
 function _toArray(v) {

package/lib/mcp.js CHANGED Viewed

@@ -435,7 +435,28 @@ var PROMPT_INJECTION_MARKERS = [
   "</?(?:assistant|system|user|tool)>",
 ];
 var INJECTION_RE = new RegExp(PROMPT_INJECTION_MARKERS.join("|"), "i");                          // allow:dynamic-regex — composed from the const PROMPT_INJECTION_MARKERS list above; not operator-supplied input
-var DANGEROUS_HTML_RE = /<script\b|<iframe\b|<object\b|<embed\b|javascript:/i;
+// vbscript: and data:text/html are dangerous URL schemes the guard claims to
+// neutralize but the original alternation omitted (CodeQL js/incomplete-url-
+// scheme-check). data: is scoped to text/html so a benign data:image/png isn't
+// over-redacted. The alternation stays linear (no nested quantifier).
+var DANGEROUS_HTML_RE = /<script\b|<iframe\b|<object\b|<embed\b|javascript:|vbscript:|data:\s*text\/html/i;
+// Global variants for sanitize-mode redaction. A non-global .replace removes
+// only the LEFTMOST match, so on `data:text/html,<script>alert(1)</script>`
+// the leftmost `data:text/html` would be stripped and the executable
+// `<script>` left behind — sanitize mode returning runnable HTML. _redactAll
+// replaces EVERY dangerous token, repeating to a fixpoint in case removing one
+// abuts two halves into a new one. Input byte-length is bounded by the caller,
+// and [REDACTED] introduces no dangerous token, so the loop terminates quickly.
+var INJECTION_RE_G = new RegExp(PROMPT_INJECTION_MARKERS.join("|"), "gi");                        // allow:dynamic-regex — same const-composed source as INJECTION_RE
+var DANGEROUS_HTML_RE_G = /<script\b|<iframe\b|<object\b|<embed\b|javascript:|vbscript:|data:\s*text\/html/gi;
+function _redactAll(text, globalRe) {
+  var out = text;
+  var prev;
+  do { prev = out; out = out.replace(globalRe, "[REDACTED]"); } while (out !== prev);
+  return out;
+}
 function _toolResultSanitize(result, opts) {
   opts = opts || {};
@@ -475,14 +496,15 @@ function _toolResultSanitize(result, opts) {
       if (INJECTION_RE.test(regexInput)) {                                                       // allow:regex-no-length-cap regexInput byteLength bounded above
         issues.push({ kind: "prompt-injection", index: i });
         if (posture === "sanitize") {
-          // Strip the injection marker line — operators wanting
-          // structural redaction wire their own classifier.
-          t = t.replace(INJECTION_RE, "[REDACTED]");
+          // Strip EVERY injection marker — operators wanting structural
+          // redaction wire their own classifier. Global fixpoint redact so a
+          // second marker after the first isn't left behind.
+          t = _redactAll(t, INJECTION_RE_G);
         }
       }
       if (DANGEROUS_HTML_RE.test(regexInput)) {                                                  // allow:regex-no-length-cap regexInput byteLength bounded above
         issues.push({ kind: "dangerous-html", index: i });
-        if (posture === "sanitize") t = t.replace(DANGEROUS_HTML_RE, "[REDACTED]");
+        if (posture === "sanitize") t = _redactAll(t, DANGEROUS_HTML_RE_G);
       }
       cleaned.push({ type: "text", text: t });
     } else if (block.type === "image" || block.type === "resource_link" || block.type === "audio") {
@@ -922,7 +944,7 @@ function _elicitationGuard(opts) {
       }
       if (posture === "sanitize") {
         return Object.assign({}, elicitRequest, {
-          message: message.replace(INJECTION_RE, "[REDACTED]"),
+          message: _redactAll(message, INJECTION_RE_G),
         });
       }
     }

package/lib/middleware/bot-disclose.js CHANGED Viewed

@@ -29,6 +29,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var safeBuffer = require("../safe-buffer");
 var audit = lazyRequire(function () { return require("../audit"); });
@@ -140,11 +141,12 @@ function create(opts) {
       if (typeof ct !== "string" || ct.indexOf("text/html") === -1) return chunk;
       var body = Buffer.isBuffer(chunk) ? chunk.toString("utf8") :
         (typeof chunk === "string" ? chunk : "");
-      // Inject after <body> opening tag if present, else after <html>
-      // opening tag, else prepend.
-      var bodyMatch = body.match(/<body[^>]*>/i);
-      if (bodyMatch) {
-        var idx = bodyMatch.index + bodyMatch[0].length;
+      // Inject after the <body> opening tag if present, else prepend.
+      // Linear tag-find — NOT body.match(/<body[^>]*>/i), which is O(n^2)
+      // in V8 on a body carrying many `<body` starts with no closing `>`
+      // (rendered user content can produce exactly that).
+      var idx = safeBuffer.indexAfterOpenTag(body, "body");
+      if (idx !== -1) {
         body = body.slice(0, idx) + "\n" + bannerHtml + "\n" + body.slice(idx);
       } else {
         body = bannerHtml + "\n" + body;

package/lib/middleware/speculation-rules.js CHANGED Viewed

@@ -65,6 +65,7 @@
  */
 var validateOpts = require("../validate-opts");
+var safeBuffer = require("../safe-buffer");
 // Per W3C draft + Chromium implementation. `immediate` triggers the
 // speculation as soon as the rules are seen; `conservative` waits
@@ -287,10 +288,11 @@ function create(opts) {
       if (headClose !== -1) {
         body = body.slice(0, headClose) + tag + body.slice(headClose);
       } else {
-        var bodyOpen = body.match(/<body[^>]*>/i);
-        if (bodyOpen) {
-          var idx = bodyOpen.index + bodyOpen[0].length;
-          body = body.slice(0, idx) + tag + body.slice(idx);
+        // Linear tag-find — NOT body.match(/<body[^>]*>/i) (O(n^2) in V8
+        // on a body with many `<body` starts and no closing `>`).
+        var bodyIdx = safeBuffer.indexAfterOpenTag(body, "body");
+        if (bodyIdx !== -1) {
+          body = body.slice(0, bodyIdx) + tag + body.slice(bodyIdx);
         } else {
           // No <head> or <body> — prepend so the rules at least
           // reach the parser. This matches the bot-disclose fallback.

package/lib/parsers/safe-env.js CHANGED Viewed

@@ -147,7 +147,7 @@ function parse(input, opts) {
     if (eqIdx < 0) {
       throw new SafeEnvError("missing '=' separator", "env/bad-line", lineNumber);
     }
-    var key = trimmed.substring(0, eqIdx).replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    var key = safeBuffer.stripTrailingHspace(trimmed.substring(0, eqIdx));
     var rest = trimmed.substring(eqIdx + 1);
     if (key.length === 0) {
@@ -186,10 +186,13 @@ function parse(input, opts) {
       // The comment marker MUST be preceded by whitespace to count
       // (so a value like `KEY=color#red` keeps the literal `#`).
       var commentMatch = rest.match(/^([^\s#]*(?:[ \t]+[^#\s]+)*)\s+#.*$/);
+      // stripTrailingHspace is a linear char-scan; .replace(/[ \t]+$/) is O(n^2)
+      // in V8 and the env parser only caps TOTAL bytes, not per-line, so a
+      // single huge-whitespace value line would otherwise hang the parser.
       if (commentMatch) {
-        value = commentMatch[1].replace(safeBuffer.TRAILING_HSPACE_RE, "");
+        value = safeBuffer.stripTrailingHspace(commentMatch[1]);
       } else {
-        value = rest.replace(safeBuffer.TRAILING_HSPACE_RE, "");
+        value = safeBuffer.stripTrailingHspace(rest);
       }
       // Reject `$VAR` style references — explicit error so operators
       // see the policy rather than silently getting unexpanded text.

package/lib/parsers/safe-yaml.js CHANGED Viewed

@@ -185,7 +185,7 @@ function parse(input, opts) {
     var raw = rawLines[i];
     // Strip trailing whitespace from the line for analysis (block-scalar
     // content paths preserve their own internal spacing separately).
-    var trimmed = raw.replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    var trimmed = safeBuffer.stripTrailingHspace(raw);
     var indent = 0;
     while (indent < raw.length && raw.charAt(indent) === " ") indent += 1;
     if (indent < raw.length && raw.charAt(indent) === "\t") {
@@ -332,7 +332,7 @@ function parse(input, opts) {
     if (raw.charAt(0) === "'") {
       return _decodeSingleQuoted(raw, lineNumber, col);
     }
-    var trimmed = raw.replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    var trimmed = safeBuffer.stripTrailingHspace(raw);
     if (POISONED_KEYS.has(trimmed)) {
       throw new SafeYamlError("forbidden key '" + trimmed + "'",
         "yaml/poisoned-key", lineNumber, col);
@@ -506,7 +506,7 @@ function parse(input, opts) {
       return sq;
     }
     // Plain scalar — strip trailing space, resolve type.
-    return _resolveScalar(t.replace(safeBuffer.TRAILING_HSPACE_RE, ""));
+    return _resolveScalar(safeBuffer.stripTrailingHspace(t));
   }
   // For quoted-string termination check on a single-line value.
@@ -622,7 +622,7 @@ function parse(input, opts) {
       if (c === "," || c === "}" || c === "]") break;
       p += 1;
     }
-    var raw = text.substring(start, p).replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    var raw = safeBuffer.stripTrailingHspace(text.substring(start, p));
     return { value: _resolveScalar(raw), nextPos: p };
   }
@@ -645,7 +645,7 @@ function parse(input, opts) {
       if (c === ":" || c === "," || c === "}" || c === "]") break;
       p += 1;
     }
-    return { key: text.substring(start, p).replace(safeBuffer.TRAILING_HSPACE_RE, ""), nextPos: p };
+    return { key: safeBuffer.stripTrailingHspace(text.substring(start, p)), nextPos: p };
   }
   function _findMatchingBracket(text, start, open, close, lineNumber, col) {
@@ -772,7 +772,7 @@ function parse(input, opts) {
   function _stripEolComment(text) {
     // Strip ` #...` comments (must be preceded by whitespace) at end of line.
     var match = text.match(/^(.*?)(\s+#.*)?$/);
-    return (match && match[1] != null ? match[1] : text).replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    return safeBuffer.stripTrailingHspace(match && match[1] != null ? match[1] : text);
   }
   // ---- Block scalars (| literal, > folded) ----

package/lib/safe-buffer.js CHANGED Viewed

@@ -494,7 +494,74 @@ var TRAILING_HSPACE_RE = /[ \t]+$/;
  */
 function stripTrailingHspace(s) {
   if (typeof s !== "string") return s;
-  return s.replace(TRAILING_HSPACE_RE, "");
+  // Linear backward scan over trailing spaces/tabs — NOT s.replace(/[ \t]+$/).
+  // The `$`-after-greedy-`[ \t]+` regex is O(n^2) in V8 on adversarial input
+  // (a long run of spaces followed by a non-space: the engine retries the
+  // greedy match from every offset). normalizeText callers cap TOTAL bytes but
+  // not per-line, so a single ~500K-space value hangs (~85s). The char-scan is
+  // O(trailing-whitespace) and byte-identical to the regex on every input
+  // (JS `$` without /m matches only the absolute end, so a trailing \n is not
+  // stripped — the scan stops at it too).
+  var e = s.length;
+  while (e > 0) {
+    var c = s.charCodeAt(e - 1);
+    if (c === 0x20 || c === 0x09) { e -= 1; } else { break; }
+  }
+  return e === s.length ? s : s.slice(0, e);
+}
+/**
+ * @primitive b.safeBuffer.indexAfterOpenTag
+ * @signature b.safeBuffer.indexAfterOpenTag(html, tagName)
+ * @since     0.15.11
+ * @related   b.safeBuffer.stripTrailingHspace
+ *
+ * Find the offset in `html` just past the first `<tagName ...>` opening
+ * tag (case-insensitive), or `-1` when the tag is absent or unterminated.
+ * The insertion point a response rewriter uses to splice content right
+ * after `<body>` / `<head>` without a regex.
+ *
+ * This replaces the `html.match(/<body[^>]*>/i)` shape, which is O(n^2)
+ * in V8: a body carrying many `<body` starts with no closing `>` (e.g.
+ * rendered user content) makes the engine retry the greedy `[^>]*` from
+ * every offset — a `<body`-repeated 200K-char body benchmarks in
+ * seconds. This is a single forward `indexOf` walk: linear in the input,
+ * and stricter than the regex — it requires a real tag boundary after
+ * the name (whitespace, `>`, or `/`), so `<bodyfoo>` is not mistaken for
+ * `<body>`. Non-string input returns `-1`.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeBuffer.indexAfterOpenTag("<html><body class=x>hi", "body");
+ *   // → 19  (just past the '>' of <body class=x>)
+ *
+ *   b.safeBuffer.indexAfterOpenTag("<p>no body here</p>", "body");
+ *   // → -1
+ */
+function indexAfterOpenTag(html, tagName) {
+  if (typeof html !== "string" || typeof tagName !== "string" || tagName.length === 0) return -1;
+  var needle = "<" + tagName.toLowerCase();
+  var nlen = needle.length;
+  // One O(n) lowercase pass keeps the case-insensitive search linear; the
+  // forward indexOf walk below never re-scans a region it has passed.
+  var lower = html.toLowerCase();
+  var from = 0;
+  for (;;) {
+    var lt = lower.indexOf(needle, from);
+    if (lt === -1) return -1;
+    var after = lt + nlen;
+    var boundary = after < html.length ? html.charCodeAt(after) : -1;
+    // The char after "<tag" must end the tag name — '>' (0x3e), '/' (0x2f),
+    // or ASCII whitespace — else this is a longer name like "<bodyfoo".
+    if (boundary === 0x3e || boundary === 0x2f ||
+        boundary === 0x20 || boundary === 0x09 ||
+        boundary === 0x0a || boundary === 0x0d || boundary === 0x0c) {
+      var gt = html.indexOf(">", after);
+      if (gt === -1) return -1;   // unterminated opening tag — no insertion point
+      return gt + 1;
+    }
+    from = lt + 1;
+  }
 }
 /**
@@ -612,6 +679,7 @@ module.exports = {
   hasCrlf:               hasCrlf,
   stripCrlf:             stripCrlf,
   stripTrailingHspace:   stripTrailingHspace,
+  indexAfterOpenTag:     indexAfterOpenTag,
   HEX_RE:                HEX_RE,
   BASE64URL_RE:          BASE64URL_RE,
   BASE64_RE:             BASE64_RE,

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.10",
+  "version": "0.15.11",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json CHANGED Viewed

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:67b3105d-f49c-44bd-bf4e-afbb994d35e2",
+  "serialNumber": "urn:uuid:693c533d-2a9b-43e7-93e5-01669defbb95",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-14T03:47:28.687Z",
+    "timestamp": "2026-06-14T07:19:57.070Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.10",
+      "bom-ref": "@blamejs/core@0.15.11",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.10",
+      "version": "0.15.11",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.10",
+      "purl": "pkg:npm/%40blamejs/core@0.15.11",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.10",
+      "ref": "@blamejs/core@0.15.11",
       "dependsOn": []
     }
   ]