@blamejs/core 0.15.11 → 0.15.13

package/lib/middleware/body-parser.js

@@ -115,6 +115,8 @@
  */
 
 var nodeFs = require("node:fs");
+var pick = require("../pick");
+var numericBounds = require("../numeric-bounds");
 var os = require("node:os");
 var nodePath = require("node:path");
 var nodeCrypto = require("node:crypto");
@@ -164,7 +166,6 @@ var BodyParserError = defineClass("BodyParserError", { withStatusCode: true });
 // Mirrors safe-json.js + safe-schema.js. Field names that match these
 // are refused at the parse boundary regardless of which sub-parser is
 // in play — consistent prototype-pollution defense across the framework.
-var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 // Materialize a header/parameter map from request-derived [key, value]
 // pairs WITHOUT a computed member write (`target[key] = value`). A
@@ -183,7 +184,7 @@ var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 function _mapFromPairs(pairs) {
   var safe = [];
   for (var i = 0; i < pairs.length; i++) {
-    if (POISONED_KEYS.has(pairs[i][0])) continue;
+    if (pick.isPoisonedKey(pairs[i][0])) continue;
     safe.push(pairs[i]);
   }
   return Object.assign(Object.create(null), Object.fromEntries(safe));
@@ -256,17 +257,13 @@ function _contentType(req) {
     // would slice through quoted commas/semicolons and corrupt the
     // multipart boundary. Use the shared quote-aware splitter that
     // tracks RFC 8941 §3.3.3 quoted-string state with backslash-escape.
-    var parts = structuredFields.splitTopLevel(rest, ";");
-    for (var i = 0; i < parts.length; i++) {
-      var p = parts[i].trim();
-      var eq = p.indexOf("=");
-      if (eq === -1) continue;
-      var k = p.slice(0, eq).trim().toLowerCase();
-      var v = p.slice(eq + 1).trim();
+    var kvps = structuredFields.parseKeyValuePieces(
+      structuredFields.splitTopLevel(rest, ";"));
+    structuredFields.forEachKeyValue(kvps, function (key, v) {
       var _unq = structuredFields.unquoteSfString(v);
       if (_unq !== null) v = _unq;
-      paramPairs.push([k, v]);
-    }
+      paramPairs.push([key, v]);
+    });
   }
   return { type: type, params: _mapFromPairs(paramPairs) };
 }
@@ -375,6 +372,19 @@ function _detectSmuggling(req) {
   return null;
 }
 
+// Generic, operator-safe status phrase for a client error body — used when the
+// thrown error is NOT a framework-classified BodyParserError (or is a 5xx), so
+// an internal exception's message (fs errno + tmp path, a parse hook's thrown
+// detail) is never echoed to the client (CWE-209 / CodeQL js/stack-trace-exposure).
+var _GENERIC_REASON = {};
+_GENERIC_REASON[HTTP_STATUS.BAD_REQUEST]            = "Bad Request";
+_GENERIC_REASON[HTTP_STATUS.PAYLOAD_TOO_LARGE]      = "Payload Too Large";
+_GENERIC_REASON[HTTP_STATUS.UNSUPPORTED_MEDIA_TYPE] = "Unsupported Media Type";
+_GENERIC_REASON[HTTP_STATUS.INTERNAL_SERVER_ERROR]  = "Internal Server Error";
+function _genericReason(status) {
+  return _GENERIC_REASON[status] || (status >= 500 ? "Internal Server Error" : "Bad Request");
+}
+
 function _writeError(res, status, message, code) {
   if (res.headersSent) return;
   var body = JSON.stringify({ error: message, code: code });
@@ -417,26 +427,17 @@ function _bufferBody(req, limit) {
         return;
       }
     }
-    var collector = safeBuffer.boundedChunkCollector({
+    safeBuffer.collectStream(req, {
       maxBytes:    limit,
       errorClass:  BodyParserError,
       sizeCode:    "body-parser/too-large",
       sizeMessage: "request body exceeds limit",
+    }).then(resolve, function (e) {
+      // The drain-overflow guard (a second line of defense behind the
+      // Content-Length pre-check above) carries the 413 status code.
+      if (e && e.isBodyParserError) e.statusCode = HTTP_STATUS.PAYLOAD_TOO_LARGE;
+      reject(e);
     });
-    var done = false;
-    req.on("data", function (chunk) {
-      if (done) return;
-      try { collector.push(chunk); }
-      catch (e) {
-        done = true;
-        try { req.destroy(); } catch (_e) { /* socket already closed */ }
-        if (e && e.isBodyParserError) e.statusCode = HTTP_STATUS.PAYLOAD_TOO_LARGE;
-        reject(e);
-        return;
-      }
-    });
-    req.on("end", function () { if (!done) { done = true; resolve(collector.result()); } });
-    req.on("error", function (e) { if (!done) { done = true; reject(e); } });
   });
 }
 
@@ -469,10 +470,13 @@ async function _parseJson(req, opts) {
   }
   if (typeof opts.parseHook === "function") {
     try { parsed = opts.parseHook(parsed); }
-    catch (e) {
+    catch (_e) {
       throw new BodyParserError(
         "body-parser/json-hook",
-        "JSON parseHook failed: " + ((e && e.message) || String(e)),
+        // Operator parseHook threw — surface a fixed, safe message; the hook's
+        // own thrown detail (which may carry secrets) is the operator's to log,
+        // never echoed to the client (CWE-209).
+        "request body rejected by parse hook",
         true, HTTP_STATUS.BAD_REQUEST
       );
     }
@@ -504,7 +508,7 @@ async function _parseUrlencoded(req, opts) {
   for (var i = 0; i < keys.length; i++) {
     var k = keys[i][0];
     var v = keys[i][1];
-    if (POISONED_KEYS.has(k)) {
+    if (pick.isPoisonedKey(k)) {
       throw new BodyParserError(
         "body-parser/urlencoded-poisoned-key",
         "urlencoded body contains forbidden key '" + k + "' (prototype-pollution defense)",
@@ -628,10 +632,10 @@ function _parseMultipartHeaders(rawHeaders) {
         true, HTTP_STATUS.BAD_REQUEST
       );
     }
-    var idx = line.indexOf(":");
-    if (idx === -1) continue;
-    var k = line.slice(0, idx).trim().toLowerCase();
-    var v = line.slice(idx + 1).trim();
+    var khv = structuredFields.parseKeyValuePiece(line, ":");
+    if (khv.value === null) continue;
+    var k = khv.key;
+    var v = khv.value.trim();
     for (var j = 0; j < v.length; j++) {
       var c = v.charCodeAt(j);
       if (c === 0 || c === 10 || c === 13) {                                      // NUL/LF/CR forbidden in field-value (RFC 9110 §5.5)
@@ -720,12 +724,8 @@ function _parseHeaderParams(headerValue, filenameCharsets) {
   // it last so Object.fromEntries' last-wins resolves it.
   var paramPairs = [["_value", parts[0].trim().toLowerCase()]];
   var extName = null;
-  for (var i = 1; i < parts.length; i++) {
-    var p = parts[i].trim();
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    var k = p.slice(0, eq).trim().toLowerCase();
-    var v = p.slice(eq + 1).trim();
+  var kvps = structuredFields.parseKeyValuePieces(parts, 1);
+  structuredFields.forEachKeyValue(kvps, function (k, v) {
     var _unq = structuredFields.unquoteSfString(v);
     if (_unq !== null) v = _unq;
     if (k.charAt(k.length - 1) === "*") {
@@ -735,10 +735,10 @@ function _parseHeaderParams(headerValue, filenameCharsets) {
         if (bareKey === "filename") extName = decoded;
         paramPairs.push([bareKey, decoded]);
       }
-      continue;
+      return;
     }
     paramPairs.push([k, v]);
-  }
+  });
   if (extName !== null) paramPairs.push(["filename", extName]);
   return _mapFromPairs(paramPairs);
 }
@@ -936,7 +936,7 @@ async function _parseMultipart(req, opts, ctParams) {
             // Read until \r\n\r\n.
             var headEnd = pending.indexOf("\r\n\r\n");
             if (headEnd === -1) {
-              if (pending.length > C.BYTES.kib(16)) {
+              if (safeBuffer.byteLengthOf(pending) > C.BYTES.kib(16)) {
                 done(new BodyParserError("body-parser/multipart-headers-too-large",
                   "multipart part headers exceed 16KB", true, 413));
                 return;
@@ -970,7 +970,7 @@ async function _parseMultipart(req, opts, ctParams) {
                 "multipart part missing form-data Content-Disposition", true, HTTP_STATUS.BAD_REQUEST));
               return;
             }
-            if (POISONED_KEYS.has(cd.name)) {
+            if (pick.isPoisonedKey(cd.name)) {
               done(new BodyParserError("body-parser/multipart-poisoned-field",
                 "multipart field '" + cd.name + "' is forbidden (prototype-pollution defense)",
                 true, HTTP_STATUS.BAD_REQUEST));
@@ -1476,8 +1476,32 @@ function create(opts) {
       }
       var status = (e && typeof e.statusCode === "number") ? e.statusCode : HTTP_STATUS.BAD_REQUEST;
       var code   = (e && typeof e.code === "string") ? e.code : "body-parser/error";
-      var message = (e && e.message) ? e.message : String(e);
-      _writeError(res, status, message, code);
+      // Only a framework-classified 4xx BodyParserError carries a curated,
+      // operator-safe message (malformed JSON, poisoned key, smuggling). Any
+      // other thrown error — and every 5xx — gets a generic status phrase, so
+      // an internal exception (fs errno + tmp path, a parse hook's thrown
+      // secret) is never echoed to the client (CWE-209). The full diagnostic
+      // stays on the audit chain, redacted by safeEmit.
+      // Object(e) tolerates a non-object throw (throw null, or a string from
+      // an operator parse hook) without a truthiness guard on the caught
+      // binding — the caught value is always defined to CodeQL, so `e && …`
+      // reads as a dead sub-condition; this keeps the null-safety explicit.
+      var eo = Object(e);
+      var clientMessage = (eo.isBodyParserError === true && status < 500 && typeof eo.message === "string")
+        ? eo.message
+        : _genericReason(status);
+      try {
+        audit().safeEmit({
+          action:  "body-parser.error",
+          outcome: status >= 500 ? "failure" : "denied",
+          metadata: {
+            status:  status,
+            code:    code,
+            message: (e && e.message) ? String(e.message).slice(0, 256) : "",
+          },
+        });
+      } catch (_e) { /* audit best-effort — never mask the response */ }
+      _writeError(res, status, clientMessage, code);
     }
   };
 }
@@ -1501,9 +1525,11 @@ async function _parseJsonFromBuf(buf, opts) {
   }
   if (typeof opts.parseHook === "function") {
     try { parsed = opts.parseHook(parsed); }
-    catch (e) {
+    catch (_e) {
+      // Operator parseHook threw — fixed safe message; the hook's thrown
+      // detail (possible secrets) is never echoed to the client (CWE-209).
       throw new BodyParserError("body-parser/json-hook",
-        "JSON parseHook failed: " + ((e && e.message) || String(e)), true, HTTP_STATUS.BAD_REQUEST);
+        "request body rejected by parse hook", true, HTTP_STATUS.BAD_REQUEST);
     }
   }
   return parsed;
@@ -1612,12 +1638,9 @@ function _resolveStandaloneMultipartOpts(opts, ct) {
   }
   if (opts.maxFiles !== undefined) {
     var mf = opts.maxFiles;
-    var mfBad = typeof mf !== "number" || !isFinite(mf) || mf <= 0 || Math.floor(mf) !== mf;
-    if (mfBad) {
-      throw new BodyParserError("body-parser/bad-max-files",
-        "parsers.multipart: opts.maxFiles must be a positive integer",
-        true, HTTP_STATUS.BAD_REQUEST);
-    }
+    numericBounds.requirePositiveFiniteInt(mf,
+      "parsers.multipart: opts.maxFiles", BodyParserError, "body-parser/bad-max-files",
+      null, { permanent: true, statusCode: HTTP_STATUS.BAD_REQUEST });
     resolved.fileCount = mf;
   }
   // Pass-through overrides for the multipart-specific knobs the middleware
@@ -1663,5 +1686,7 @@ module.exports = {
   _contentType:     _contentType,
   _hasBody:         _hasBody,
   _sanitizeFilename: _sanitizeFilename,
-  POISONED_KEYS:    POISONED_KEYS,
+  // Sourced from the canonical pick primitive (no hand-rolled set); a fresh
+  // Set so the long-standing `instanceof Set` shape of this export is kept.
+  POISONED_KEYS:    new Set(pick.POISONED_KEYS),
 };

package/lib/middleware/bot-disclose.js

@@ -30,6 +30,7 @@ var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 var safeBuffer = require("../safe-buffer");
+var requestHelpers = require("../request-helpers");
 
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -93,17 +94,13 @@ function create(opts) {
   var actionBase = typeof opts.auditAction === "string" && opts.auditAction.length > 0
     ? opts.auditAction : "middleware.bot_disclose";
 
+  // null mountPaths = apply to every route; otherwise reuse the shared
+  // segment-boundary matcher (built once).
+  var _mountMatch = mountPaths
+    ? requestHelpers.makeSkipMatcher({ skipPaths: mountPaths }, "middleware.botDisclose")
+    : null;
   function _matches(req) {
-    if (!mountPaths) return true;                                                        // null = match every path
-    var p = req.url || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < mountPaths.length; i++) {
-      var m = mountPaths[i];
-      if (typeof m === "string" && (p === m || p.indexOf(m + "/") === 0)) return true;
-      if (m instanceof RegExp && m.test(p)) return true;
-    }
-    return false;
+    return _mountMatch ? _mountMatch(req) : true;
   }
 
   function _emitAudit(action, outcome, metadata) {

package/lib/middleware/bot-guard.js

@@ -144,21 +144,13 @@ function create(opts) {
   var blockedAgents = DEFAULT_BLOCKED_AGENTS.concat((opts.blockedAgents || []).map(function (r, i) {
     return _coerceAgentPattern(r, "middleware.botGuard: blockedAgents[" + i + "]");
   }));
-  var skipPaths = opts.skipPaths || [];
   var statusOnBlock = opts.statusOnBlock || 403;
   var bodyOnBlock = opts.bodyOnBlock !== undefined ? opts.bodyOnBlock : "Forbidden";
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
 
-  function _shouldSkip(req) {
-    var path = req.pathname || req.url || "/";
-    for (var i = 0; i < skipPaths.length; i++) {
-      if (typeof skipPaths[i] === "string" ? path.indexOf(skipPaths[i]) === 0 : skipPaths[i].test(path)) {
-        return true;
-      }
-    }
-    return false;
-  }
+  // Path-exemption predicate (string-prefix or RegExp), validated at create().
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.botGuard");
 
   function _looksLikeApi(req) {
     var path = req.pathname || req.url || "/";

package/lib/middleware/csrf-protect.js

@@ -67,6 +67,7 @@
  *   }
  */
 var lazyRequire = require("../lazy-require");
+var pick = require("../pick");
 var forms = require("../forms");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -111,7 +112,7 @@ function _parseCookieHeader(header) {
     if (eq === -1) continue;
     var k = p.slice(0, eq).trim();
     if (k.length === 0) continue;
-    if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+    if (pick.isPoisonedKey(k)) continue;
     if (seen.has(k)) continue;  // first-occurrence wins
     seen.add(k);
     var v = p.slice(eq + 1).trim();
@@ -296,7 +297,7 @@ function create(opts) {
   validateOpts(opts, [
     "cookie", "tokenLookup", "fieldName", "headerName", "methods", "audit",
     "trustProxy", "checkOrigin", "allowedOrigins", "requireJsonContentType",
-    "requireOrigin", "skipStateless", "onDeny", "problemDetails",
+    "requireOrigin", "skipStateless", "skipPaths", "skip", "onDeny", "problemDetails",
   ], "middleware.csrfProtect");
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
@@ -368,6 +369,13 @@ function create(opts) {
   // request always carries a Cookie header and is validated.
   var skipStateless = opts.skipStateless === true;
 
+  // Per-path exemption (string-prefix / RegExp / skip predicate), validated at
+  // create(). Lets one route (an RFC 8058 List-Unsubscribe-Post endpoint, a
+  // webhook, a bearer-token API path on the same app) opt out of the
+  // double-submit check while the app-level mount stays in place — the token is
+  // still issued for any later browser flow.
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.csrfProtect");
+
   // Cookie issuance config (only when opts.cookie is set).
   var cookieCfg = null;
   if (hasCookie) {
@@ -480,6 +488,9 @@ function create(opts) {
     // (e.g. error response) still need req.csrfToken populated.
     var expected = _issueIfNeeded(req, res);
 
+    // Exempt routes skip the double-submit check (token still issued above).
+    if (_shouldSkip(req)) return next();
+
     if (methods.indexOf(req.method) === -1) return next();
 
     // Stateless / token-authenticated requests are not CSRF-able — the

package/lib/middleware/daily-byte-quota.js

@@ -107,7 +107,6 @@ function create(opts) {
   }
   var bytesPerDay = opts.bytesPerDay;
   var getKey = typeof opts.getKey === "function" ? opts.getKey : _defaultGetKey;
-  var auditOn = opts.audit !== false;
   // onDeny is the canonical hook across the deny-path middleware
   // family; onExceeded is the original name kept working as an alias.
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny
@@ -127,33 +126,14 @@ function create(opts) {
   });
   var backend = quota._backend;
 
-  function _shouldSkip(req) {
-    if (skipPaths.length === 0) return false;
-    var p = req.url || req.originalUrl || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < skipPaths.length; i++) {
-      if (typeof skipPaths[i] === "string" && p === skipPaths[i]) return true;
-      if (skipPaths[i] instanceof RegExp && skipPaths[i].test(p)) return true;
-    }
-    return false;
-  }
+  // exact:true preserves this guard's whole-path skip semantics (no descendant
+  // match); makeSkipMatcher strips the query + resolves url || originalUrl.
+  var _shouldSkip = requestHelpers().makeSkipMatcher(
+    { skipPaths: skipPaths, exact: true }, "middleware.dailyByteQuota");
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "middleware.daily_byte_quota." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit is best-effort */ }
-  }
+  var _emitAudit = audit().namespaced("middleware.daily_byte_quota", opts.audit);
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("middleware.daily_byte_quota." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("middleware.daily_byte_quota");
 
   return async function dailyByteQuotaMiddleware(req, res, next) {
     if (_shouldSkip(req)) return next();

package/lib/middleware/deny-response.js

@@ -147,6 +147,24 @@ function denyResponse(req, res, ctx) {
   return undefined;
 }
 
+// methodNotAllowed(res, allow) — write the bare HTTP 405 refusal the
+// single-file static-content middlewares (assetlinks / security.txt / web-app-
+// manifest) share: an `Allow` header plus a `text/plain` "Method Not Allowed"
+// body with an explicit Content-Length. Kept separate from denyResponse() (the
+// hook-aware, problem+json-capable refusal path) so the static handlers emit a
+// fixed, minimal response — `allow` is the comma-joined method list (e.g.
+// "GET, HEAD").
+function methodNotAllowed(res, allow) {
+  var bodyMsg = "Method Not Allowed";
+  res.writeHead(405, {                                                           // HTTP 405 status
+    "Allow":          allow,
+    "Content-Type":   "text/plain; charset=utf-8",
+    "Content-Length": Buffer.byteLength(bodyMsg),
+  });
+  res.end(bodyMsg);
+}
+
 module.exports = {
-  denyResponse: denyResponse,
+  denyResponse:     denyResponse,
+  methodNotAllowed: methodNotAllowed,
 };

package/lib/middleware/fetch-metadata.js

@@ -165,6 +165,7 @@ function create(opts) {
     "allowSameSite", "allowCrossSite", "allowMissing",
     "allowedDest", "deniedDest", "allowStorageAccess", "strictDest",
     "allowedNavigate", "methods", "audit", "onDeny", "problemDetails",
+    "skipPaths", "skip",
   ], "middleware.fetchMetadata");
   validateOpts.optionalBoolean(opts.allowStorageAccess, "middleware.fetchMetadata: allowStorageAccess");
   validateOpts.optionalBoolean(opts.strictDest, "middleware.fetchMetadata: strictDest");
@@ -174,6 +175,11 @@ function create(opts) {
     _validateDestList(opts.deniedDest, "deniedDest");
   }
 
+  // Per-path exemption (string-prefix / RegExp / skip predicate), validated at
+  // create() — exempt a webhook / cookieless edge-cached route from the
+  // fetch-metadata gate without disabling the app-level mount.
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.fetchMetadata");
+
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
   var allowSameSite      = opts.allowSameSite !== false;
@@ -220,6 +226,7 @@ function create(opts) {
     // Idempotent: a second fetch-metadata mount this request is a no-op.
     if (req._fetchMetadataChecked) return next();
     req._fetchMetadataChecked = true;
+    if (_shouldSkip(req)) return next();
     if (methods.indexOf(req.method) === -1) return next();
 
     var headers = req.headers || {};

package/lib/middleware/idempotency-key.js

@@ -53,7 +53,7 @@ var cryptoField   = require("../crypto-field");
 var vault         = require("../vault");
 var { defineClass } = require("../framework-error");
 
-var audit          = lazyRequire(function () { return require("../audit"); });
+var auditEmit      = require("../audit-emit");
 var problemDetails = lazyRequire(function () { return require("../problem-details"); });
 var C              = require("../constants");
 
@@ -533,16 +533,8 @@ function dbStore(opts) {
 }
 
 function _validateStore(store, where) {
-  if (!store || typeof store !== "object") {
-    throw new IdempotencyError("idempotency/bad-store",
-      where + ": store must be an object", true);
-  }
-  if (typeof store.get !== "function" ||
-      typeof store.set !== "function" ||
-      typeof store.delete !== "function") {
-    throw new IdempotencyError("idempotency/bad-store",
-      where + ": store must implement { get, set, delete }", true);
-  }
+  validateOpts.requireMethods(store, ["get", "set", "delete"],
+    where + ": store", IdempotencyError, "idempotency/bad-store", true);
 }
 
 function _fingerprintRequest(req, bodyBytes, store) {
@@ -568,15 +560,7 @@ function _fingerprintRequest(req, bodyBytes, store) {
   return nodeCrypto.createHash("sha3-256").update(preimage).digest("hex");
 }
 
-function _emitAudit(action, metadata, outcome) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata,
-    });
-  } catch (_e) { /* best-effort */ }
-}
+var _emitAudit = auditEmit.emit;
 
 /**
  * @primitive b.middleware.idempotencyKey

package/lib/middleware/rate-limit.js

@@ -56,6 +56,7 @@
  *
  * Audit: every limit hit emits system.ratelimit.block with the key + path.
  */
+var boundedMap = require("../bounded-map");
 var C = require("../constants");
 var frameworkSchema = require("../framework-schema");
 var lazyRequire = require("../lazy-require");
@@ -178,11 +179,14 @@ function _memoryTokenBucketBackend(opts) {
   // microtask cost per request.
   function take(key, _cost) {
     var now = Date.now();
-    var b = buckets.get(key);
-    if (!b) {
-      b = { tokens: burst, lastRefillAt: now };
-      buckets.set(key, b);
-    } else {
+    // Insert a fresh full bucket on first sight; only an already-present
+    // bucket refills (a brand-new bucket starts at `burst`, so refilling
+    // it would be a no-op clamped to `burst` anyway).
+    var existed = buckets.has(key);
+    var b = boundedMap.getOrInsert(buckets, key, function () {
+      return { tokens: burst, lastRefillAt: now };
+    });
+    if (existed) {
       var elapsed = (now - b.lastRefillAt) / C.TIME.seconds(1);
       b.tokens = Math.min(burst, b.tokens + elapsed * refillPerSecond);
       b.lastRefillAt = now;
@@ -254,10 +258,15 @@ function _memoryFixedWindowBackend(opts) {
   function take(key, _cost) {
     var now = Date.now();
     var windowStart = Math.floor(now / windowMs) * windowMs;
-    var c = counters.get(key);
-    if (!c || c.windowStart !== windowStart) {
-      c = { windowStart: windowStart, count: 0 };
-      counters.set(key, c);
+    var c = boundedMap.getOrInsert(counters, key, function () {
+      return { windowStart: windowStart, count: 0 };
+    });
+    // A key carried over from a prior window re-seeds to the current
+    // window (count restarts) — getOrInsert only handles first-sight, so
+    // the rollover case resets the existing record in place.
+    if (c.windowStart !== windowStart) {
+      c.windowStart = windowStart;
+      c.count = 0;
     }
     c.count += 1;
     if (c.count <= max) {
@@ -489,29 +498,12 @@ function create(opts) {
     ? opts.headerPrefix : "X-RateLimit-";
   var limitHeader = headerPrefix + "Limit";   // allow:hand-rolled-sql — HTTP response-header name (X-RateLimit-Limit), not a SQL LIMIT clause
   var remainingHeader = headerPrefix + "Remaining";
-  var skipPaths = opts.skipPaths || [];
-  // Throw at create(): each entry must be a string prefix or a RegExp.
-  // Anything else would crash _shouldSkip with TypeError on the first request.
-  for (var sp = 0; sp < skipPaths.length; sp++) {
-    if (typeof skipPaths[sp] !== "string" && !(skipPaths[sp] instanceof RegExp)) {
-      throw new Error("middleware.rateLimit: skipPaths[" + sp +
-        "] must be a string prefix or RegExp, got " + typeof skipPaths[sp]);
-    }
-  }
+  // Path-exemption predicate (string-prefix or RegExp), validated at create().
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.rateLimit");
   var scope = opts.scope || "global";
 
   var backend = _resolveBackend(opts);
 
-  function _shouldSkip(req) {
-    var path = req.pathname || req.url || "/";
-    for (var i = 0; i < skipPaths.length; i++) {
-      if (typeof skipPaths[i] === "string" ? path.indexOf(skipPaths[i]) === 0 : skipPaths[i].test(path)) {
-        return true;
-      }
-    }
-    return false;
-  }
-
   function _writeBlocked(req, res, k, verdict) {
     if (emitHeaders && typeof res.setHeader === "function") {
       res.setHeader(limitHeader, String(verdict.limit));

package/lib/middleware/scim-server.js

@@ -4,6 +4,7 @@
 // + /Schemas surfaces backed by operator-supplied CRUD callbacks.
 
 var framework_error = require("../framework-error");
+var pick            = require("../pick");
 var validateOpts    = require("../validate-opts");
 var safeJson        = require("../safe-json");
 var safeBuffer      = require("../safe-buffer");
@@ -516,7 +517,7 @@ function _walkBulkIdRefs(value, out) {
   if (value && typeof value === "object") {
     var keys = Object.keys(value);
     for (var k = 0; k < keys.length; k++) {
-      if (keys[k] === "__proto__" || keys[k] === "constructor" || keys[k] === "prototype") continue;
+      if (pick.isPoisonedKey(keys[k])) continue;
       _walkBulkIdRefs(value[keys[k]], out);
     }
   }
@@ -753,7 +754,7 @@ function _resolveBulkIdRefs(value, bulkIdMap) {
     var out = {};
     var keys = Object.keys(value);
     for (var k = 0; k < keys.length; k++) {
-      if (keys[k] === "__proto__" || keys[k] === "constructor" || keys[k] === "prototype") continue;
+      if (pick.isPoisonedKey(keys[k])) continue;
       out[keys[k]] = _resolveBulkIdRefs(value[keys[k]], bulkIdMap);
     }
     return out;

package/lib/middleware/security-headers.js

@@ -151,7 +151,15 @@ var PP_POLICY_RE =
   /^[a-z][a-z0-9-]*=(?:\*|\([^)]*\)|self)$/;
 function _validatePermissionsPolicy(value) {
   if (typeof value !== "string" || value.length === 0) return;
-  var parts = String(value).split(/\s*,\s*/);
+  // Split on the literal comma, then strip whitespace adjacent to each comma —
+  // the semantics of /\s*,\s*/ without that pattern's O(n^2) backtracking on a
+  // long comma-less run of whitespace. trimStart/trimEnd use the same Unicode
+  // whitespace set as \s.
+  var parts = String(value).split(",");
+  for (var s = 0; s < parts.length; s += 1) {
+    if (s > 0) parts[s] = parts[s].trimStart();
+    if (s < parts.length - 1) parts[s] = parts[s].trimEnd();
+  }
   for (var i = 0; i < parts.length; i += 1) {
     var p = parts[i];
     if (!p) continue;