@blamejs/core 0.15.12 → 0.15.14

package/lib/guard-json.js

@@ -72,10 +72,11 @@
 
 var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
+var pick = require("./pick");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
+var safeBuffer = require("./safe-buffer");
 var { GuardJsonError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -87,14 +88,9 @@ var _err = GuardJsonError.factory;
 
 var BIDI_RE       = codepointClass.BIDI_RE;
 var C0_CTRL_RE    = codepointClass.C0_CTRL_RE;
-var ZW_RE         = codepointClass.ZERO_WIDTH_RE;
 var NULL_BYTE     = codepointClass.NULL_BYTE;
 var BOM_CHAR      = codepointClass.BOM_CHAR;
 
-// Prototype-pollution key denylist. Operator-supplied JSON containing
-// any of these keys at any depth is refused under strict.
-var POLLUTION_KEYS = Object.freeze(["__proto__", "constructor", "prototype"]);
-
 // Comment / NaN / Infinity / hex / single-quote markers — pre-parse
 // scan on the raw source. JSON.parse rejects most of these, but JSON5
 // / JSONC parsers accept and silently coerce; we surface the source
@@ -132,10 +128,7 @@ var PROFILES = Object.freeze({
     trailingCommaPolicy:    "reject",
     json5SyntaxPolicy:      "reject",       // single-quoted / hex / unquoted-key
     bomPolicy:              "reject",
-    bidiPolicy:             "reject",
-    controlPolicy:          "reject",
-    nullBytePolicy:         "reject",
-    zeroWidthPolicy:        "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     numericPrecisionPolicy: "reject",
     requireTopLevelKeyAllowlist: false,     // operator opts in via topLevelKeyAllowlist
     topLevelKeyAllowlist:   null,
@@ -192,26 +185,12 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode:          "enforce",
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
   maxRuntimeMs:  C.TIME.seconds(10),
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr": Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
 });
 
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
+
 // ---- Helpers ----
 
 function _resolveOpts(opts) {
@@ -225,7 +204,10 @@ function _resolveOpts(opts) {
 }
 
 function _isPollutionKey(key) {
-  return POLLUTION_KEYS.indexOf(key) !== -1;
+  // The framework's single prototype-pollution predicate (core JS vectors
+  // plus any operator-registered defense-in-depth extensions) — strict JSON
+  // refuses / strips every key it names, at any depth.
+  return pick.isPoisonedKey(key);
 }
 
 // _scanPollutionKeys — walks parsed JSON tree counting prototype-
@@ -248,12 +230,19 @@ function _scanTree(value, opts, ctx) {
     return ctx;
   }
   if (value === null || typeof value !== "object") {
-    if (typeof value === "string" && value.length > opts.maxStringLength) {
-      ctx.stringTooLongHits.push({
-        kind: "string-too-long",
-        snippet: "string length " + value.length +
-                 " exceeds maxStringLength " + opts.maxStringLength,
-      });
+    // maxStringLength is a BYTE cap (profiles set it via C.BYTES.*). Measure
+    // UTF-8 byte length, not value.length (UTF-16 code units) — otherwise a
+    // multibyte string (emoji / CJK / accented) under-enforces the cap by up
+    // to ~3x and the snippet mislabels the count.
+    if (typeof value === "string") {
+      var strBytes = safeBuffer.byteLengthOf(value);
+      if (strBytes > opts.maxStringLength) {
+        ctx.stringTooLongHits.push({
+          kind: "string-too-long",
+          snippet: "string byte length " + strBytes +
+                   " exceeds maxStringLength " + opts.maxStringLength + " bytes",
+        });
+      }
     }
     return ctx;
   }
@@ -382,31 +371,19 @@ function _scanRawSource(text, opts) {
       });
     }
   }
-  // Bidi / null / control via shared codepoint class.
-  issues.push.apply(issues, codepointClass.detectCharThreats(text, opts, "json"));
-  if (opts.zeroWidthPolicy !== "allow" && opts.zeroWidthPolicy !== "strip" &&
-      ZW_RE.test(text)) {                                                // allow:regex-no-length-cap — text bounded by maxBytes above
-    issues.push({
-      kind: "zero-width", severity: "warn", ruleId: "json.zero-width",
-      snippet: "zero-width / invisible-formatting char in JSON source",
-    });
-  }
+  // Bidi / null / control / zero-width via the shared codepoint class. JSON
+  // source treats an invisible-formatting char as a `warn` (cosmetic, not a
+  // structural threat) — passed as the zero-width severity.
+  issues.push.apply(issues, codepointClass.detectCharThreats(text, opts, "json", "warn"));
   return issues;
 }
 
 // _detectIssues — full validate path: raw-source pre-scan + parse +
 // tree walk.
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              snippet: "input is not a string" }];
-  }
-  if (input.length > opts.maxBytes) {
-    return [{ kind: "too-large", severity: "high", ruleId: "json.too-large",
-              snippet: "input " + input.length +
-                       " bytes exceeds maxBytes " + opts.maxBytes }];
-  }
+  var pre = gateContract.detectStringInput(input, opts, { name: "json", noun: "input", emptyMode: "skip", scanCodepoints: false, cap: { bytes: opts.maxBytes, kind: "too-large", snippet: function (byteLen, max) { return "input " + byteLen + " bytes exceeds maxBytes " + max; } } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // Raw-source pre-scan.
   issues = issues.concat(_scanRawSource(input, opts));
@@ -616,21 +593,13 @@ function _stripPollutionTree(value, opts, depth) {
  *   rv.ok;                                              // → false
  *   rv.issues.some(function (i) { return i.kind === "prototype-pollution-key"; });  // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxDepth", "maxKeysPerObject", "maxArrayLength",
-     "maxStringLength", "maxTotalNodes"],
-    "guardJson.validate", GuardJsonError, "json.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 snippet: "input is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the maxBytes/maxDepth/maxKeysPerObject/
+// maxArrayLength/maxStringLength/maxTotalNodes caps declared via `intOpts`.
+// Non-string input reduces to the same single `bad-input` issue _detectIssues
+// already emits, so the prior explicit early-return is subsumed. The
+// @primitive block above documents the resulting ABI.
 
 /**
  * @primitive  b.guardJson.parse
@@ -779,45 +748,65 @@ function _policyKeyForRuleId(ruleId) {
  *   var verdict = await jsonGate.check({ bytes: hostile });
  *   verdict.action;                                     // → "refuse"
  */
+// Disposition of each json finding = what the operator's policy for that class
+// selected. The RFC-deviation findings (comments / trailing commas / NaN /
+// JSON5 syntax / BOM / prototype-pollution / duplicate keys) sanitize by
+// re-parsing under a mitigation policy and refuse under `reject`; the bidi /
+// null / control char threats follow their shared policies; structural caps,
+// a parse failure, and an allowlist miss always refuse; the big-integer
+// precision and zero-width notes are audit-only. Exhaustive over every kind
+// _detectIssues emits (the gate-disposition coverage test enforces it).
+function _gateDispositionFor(issue, opts) {
+  var shared = gateContract.charThreatDisposition(issue, opts);
+  if (shared) return shared;
+  switch (issue.kind) {
+    case "bom-leading":
+    case "bom-mid-stream":              return gateContract.policyDisposition(opts.bomPolicy);
+    case "comment-block":
+    case "comment-line":                return gateContract.policyDisposition(opts.commentPolicy);
+    case "nan-infinity":                return gateContract.policyDisposition(opts.nanInfinityPolicy);
+    case "trailing-comma":              return gateContract.policyDisposition(opts.trailingCommaPolicy);
+    case "single-quoted-key":
+    case "hex-literal":                 return gateContract.policyDisposition(opts.json5SyntaxPolicy);
+    case "prototype-pollution-key":     return gateContract.policyDisposition(opts.pollutionPolicy);
+    case "duplicate-key":               return gateContract.policyDisposition(opts.duplicateKeyPolicy);
+    // zero-width is classified by charThreatDisposition above (its
+    // zeroWidthPolicy). numeric-precision-loss follows its own policy like every
+    // other RFC-deviation finding — under numericPrecisionPolicy:reject it
+    // refuses, not audits.
+    case "numeric-precision-loss":      return gateContract.policyDisposition(opts.numericPrecisionPolicy);
+    case "node-count-cap":
+    case "depth-cap":
+    case "string-too-long":
+    case "array-length-cap":
+    case "key-count-cap":
+    case "bad-input":
+    case "too-large":
+    case "parse-failed":
+    case "missing-allowlist":
+    case "top-level-key-not-allowlisted": return "refuse";
+    default:                            return null;
+  }
+}
+
 function gate(opts) {
   opts = _resolveOpts(opts);
-  return gateContract.buildGuardGate(
-    opts.name || "guardJson:" + (opts.profile || "default"),
-    opts,
-    async function (ctx) {
-      var text = gateContract.extractBytesAsText(ctx);
-      if (!text) return { ok: true, action: "serve" };
-      var rv = validate(text, opts);
-      if (rv.issues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = rv.issues.some(function (i) {
-        return i.severity === "critical" || i.severity === "high";
-      });
-      if (!hasCritical) return { ok: true, action: "audit-only", issues: rv.issues };
-
-      // Sanitize-eligibility: every reject-policy must be off.
-      var canSanitize = opts.pollutionPolicy !== "reject" &&
-                        opts.duplicateKeyPolicy !== "reject" &&
-                        opts.nanInfinityPolicy !== "reject" &&
-                        opts.commentPolicy !== "reject" &&
-                        opts.trailingCommaPolicy !== "reject" &&
-                        opts.json5SyntaxPolicy !== "reject" &&
-                        opts.bomPolicy !== "reject" &&
-                        opts.bidiPolicy !== "reject" &&
-                        opts.controlPolicy !== "reject" &&
-                        opts.nullBytePolicy !== "reject";
-      if (canSanitize) {
-        try {
-          var clean = parse(text, opts);
-          var emitted = JSON.stringify(clean);
-          return {
-            ok: true, action: "sanitize",
-            sanitized: Buffer.from(emitted, "utf8"),
-            issues: rv.issues,
-          };
-        } catch (_e) { /* fall through */ }
-      }
-      return { ok: false, action: "refuse", issues: rv.issues };
-    });
+  return gateContract.buildContentGate({
+    name:     opts.name || "guardJson:" + (opts.profile || "default"),
+    opts:     opts,
+    validate: module.exports.validate,
+    dispositionFor: _gateDispositionFor,
+    // A sanitize-disposition finding (a class set to a mitigation) is repaired in
+    // two passes: first the char-strip policies remove bidi / control / null /
+    // zero-width per policy (so a strip-policy char threat is excised even when
+    // it sits inside a string value), then a parse + re-serialize drops
+    // __proto__ / comments / NaN / trailing commas per the active policy. Under a
+    // reject policy the finding is already refuse-disposition, so this is not
+    // reached for that class.
+    produceSanitized: function (text, o) {
+      return JSON.stringify(parse(codepointClass.applyCharStripPolicies(text, o), o));
+    },
+  });
 }
 
 // buildProfile / compliancePosture / loadRulePack are assembled by
@@ -840,8 +829,8 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // exports (NAME / KIND / MIME_TYPES / EXTENSIONS / INTEGRATION_FIXTURES),
 // buildProfile / compliancePosture / loadRulePack wiring, plus the
 // per-guard inspection surface (validate / parse) and JSON extras
-// (POLLUTION_KEYS) passed through verbatim. The bespoke `gate` carries
-// JSON's sanitize-reparse-reserialize chain unchanged.
+// (POLLUTION_KEYS, surfaced from the framework's canonical pick.POISONED_KEYS).
+// The bespoke `gate` carries JSON's sanitize-reparse-reserialize chain unchanged.
 module.exports = gateContract.defineGuard({
   name:        "json",
   kind:        "content",
@@ -852,11 +841,14 @@ module.exports = gateContract.defineGuard({
   mimeTypes:   ["application/json", "application/ld+json", "application/vnd.api+json"],
   extensions:  [".json", ".jsonld"],
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
+  detect:      _detectIssues,
+  intOpts:     ["maxBytes", "maxDepth", "maxKeysPerObject", "maxArrayLength",
+                "maxStringLength", "maxTotalNodes"],
   gate:        gate,
   extra: {
+    _gateDispositionForTest: _gateDispositionFor,
     parse:          parse,
-    POLLUTION_KEYS: POLLUTION_KEYS,
+    POLLUTION_KEYS: pick.POISONED_KEYS,
   },
 });
 

package/lib/guard-jsonpath.js

@@ -50,11 +50,9 @@
  *   JSONPath content-safety guard — refuses user-supplied JSONPath query strings that exhibit dynamic-code-execution shapes BEFORE they reach a JSONPath evaluator.
  */
 
-var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardJsonpathError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -81,10 +79,7 @@ var RECURSIVE_DESCENT_RE = /\.\.\[?\*\]?/g;
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     filterExprPolicy:          "reject",
     scriptExprPolicy:          "reject",
     dynamicHintPolicy:         "reject",
@@ -96,10 +91,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     filterExprPolicy:          "reject",                                         // RCE class — refused at every profile
     scriptExprPolicy:          "reject",                                         // RCE class — refused at every profile
     dynamicHintPolicy:         "reject",                                         // RCE class — refused at every profile
@@ -111,10 +103,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:               "reject",                                          // BIDI refused at every profile
-    controlPolicy:             "reject",                                          // controls refused at every profile
-    nullBytePolicy:            "reject",                                          // null refused at every profile
-    zeroWidthPolicy:           "reject",                                          // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     filterExprPolicy:          "reject",                                          // RCE class refused at every profile
     scriptExprPolicy:          "reject",                                          // RCE class refused at every profile
     dynamicHintPolicy:         "reject",                                          // RCE class refused at every profile
@@ -127,35 +116,6 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardJsonpathError,
-    errCodePrefix:      "jsonpath",
-  });
-}
-
 function _hasDynamicHint(input) {
   for (var i = 0; i < DYNAMIC_HINTS.length; i += 1) {
     if (input.indexOf(DYNAMIC_HINTS[i]) !== -1) return DYNAMIC_HINTS[i];
@@ -164,26 +124,9 @@ function _hasDynamicHint(input) {
 }
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              ruleId: "jsonpath.bad-input",
-              snippet: "jsonpath is not a string" }];
-  }
-  if (input.length === 0) {
-    return [{ kind: "empty", severity: "high",
-              ruleId: "jsonpath.empty",
-              snippet: "jsonpath is empty" }];
-  }
-  if (Buffer.byteLength(input, "utf8") > opts.maxPatternBytes) {
-    return [{ kind: "pattern-cap", severity: "high",
-              ruleId: "jsonpath.pattern-cap",
-              snippet: "jsonpath exceeds maxPatternBytes " +
-                       opts.maxPatternBytes }];
-  }
-
-  var charThreats = codepointClass.detectCharThreats(input, opts, "jsonpath");
-  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+  var pre = gateContract.detectStringInput(input, opts, { name: "jsonpath", cap: { bytes: opts.maxPatternBytes, kind: "pattern-cap", snippet: "jsonpath exceeds maxPatternBytes " + opts.maxPatternBytes } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   if (opts.filterExprPolicy !== "allow" && FILTER_EXPR_RE.test(input)) {         // allow:regex-no-length-cap — input bounded by maxPatternBytes
     issues.push({
@@ -280,13 +223,10 @@ function _detectIssues(input, opts) {
  *   hostile.ok;                                        // → false
  *   hostile.issues.some(function (i) { return i.kind === "filter-expression"; });  // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxPatternBytes", "maxRecursiveDescents"],
-    "guardJsonpath.validate", GuardJsonpathError, "jsonpath.bad-opt");
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the numeric opts validated via `intOpts`.
+// The @primitive block above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardJsonpath.sanitize
@@ -327,13 +267,11 @@ function validate(input, opts) {
  *     e.code;                                          // → "jsonpath.filter-expression"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("jsonpath.bad-input", "sanitize requires string input");
-  }
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, { errorClass: GuardJsonpathError, codePrefix: "jsonpath" });
+// _sanitizeTransform — the guard-specific normalize applied by defineGuard's
+// generated sanitize AFTER resolve → detect → throw-on-refusal. JSONPath
+// expressions cannot be safely repaired, so the transform is pure pass-through:
+// input that survives the refusal gate is returned unchanged.
+function _sanitizeTransform(input) {
   return input;
 }
 
@@ -351,13 +289,7 @@ function sanitize(input, opts) {
 // Their wiki sections render from the single-sourced @abiTemplate blocks
 // in gate-contract.js, instantiated per guard by the page generator.
 
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:              "identifier",
-  benignBytes:       Buffer.from("$.users[*].name", "utf8"),
-  hostileBytes:      Buffer.from("$..[?(@.x)]", "utf8"),
-  benignIdentifier:  "$.users[*].name",
-  hostileIdentifier: "$..[?(@.x)]",
-});
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures("$.users[*].name", "$..[?(@.x)]");
 
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
@@ -370,10 +302,10 @@ module.exports = gateContract.defineGuard({
   kind:        "identifier",
   errorClass:  GuardJsonpathError,
   profiles:    PROFILES,
-  defaults:    DEFAULTS,
-  postures:    COMPLIANCE_POSTURES,
+  base:        256,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:           _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:          ["maxBytes", "maxPatternBytes", "maxRecursiveDescents"],
   ctxFields:   ["identifier", "jsonpath"],
 });