@blamejs/core 0.15.12 → 0.15.14

package/lib/guard-yaml.js

@@ -69,7 +69,6 @@ var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var safeYamlLazy = lazyRequire(function () { return require("./parsers/safe-yaml"); });
 var { GuardYamlError } = require("./framework-error");
 
@@ -120,10 +119,7 @@ var PROFILES = Object.freeze({
     leadingZeroPolicy:      "reject",
     duplicateKeyPolicy:     "reject",
     mergeKeyPolicy:         "reject",
-    bidiPolicy:             "reject",
-    controlPolicy:          "reject",
-    nullBytePolicy:         "reject",
-    zeroWidthPolicy:        "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     safeCoreTagsAllowed:    false,
     maxBytes:               C.BYTES.mib(2),
     maxDepth:               8,                                                   // recursion depth, not byte size
@@ -177,37 +173,13 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode:          "enforce",
-  maxRuntimeMs:  C.TIME.seconds(10),
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr": Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
+  maxRuntimeMs: C.TIME.seconds(10),
 });
 
-// ---- Helpers ----
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
 
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardYamlError,
-    errCodePrefix:      "yaml",
-  });
-}
+// ---- Helpers ----
 
 function _isDangerousTag(tag) {
   for (var i = 0; i < DANGEROUS_TAG_PREFIXES.length; i += 1) {
@@ -237,16 +209,9 @@ function _scanTags(text) {
 }
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              snippet: "input is not a string" }];
-  }
-  if (input.length > opts.maxBytes) {
-    return [{ kind: "too-large", severity: "high", ruleId: "yaml.too-large",
-              snippet: "input " + input.length +
-                       " bytes exceeds maxBytes " + opts.maxBytes }];
-  }
+  var pre = gateContract.detectStringInput(input, opts, { name: "yaml", noun: "input", emptyMode: "skip", scanCodepoints: false, cap: { bytes: opts.maxBytes, kind: "too-large", snippet: function (byteLen, max) { return "input " + byteLen + " bytes exceeds maxBytes " + max; } } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // 1. Tag-injection scan.
   var tagHits = _scanTags(input);
@@ -496,21 +461,12 @@ function _detectDuplicateKeysYaml(text) {
  *   rv.ok;                                              // → false
  *   rv.issues.some(function (i) { return i.kind === "dangerous-tag"; });  // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxDepth", "maxAnchors", "maxAliasDepth",
-     "maxDocuments", "maxNodes", "maxScalarLength"],
-    "guardYaml.validate", GuardYamlError, "yaml.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 snippet: "input is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the positive-finite-int opt caps declared
+// via `intOpts`. A non-string input refuses through `_detectIssues`'s own
+// bad-input branch, so the result shape is unchanged. The @primitive block
+// above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardYaml.parse
@@ -548,7 +504,13 @@ function validate(input, opts) {
  *   safe.age;                                           // → 30
  */
 function parse(input, opts) {
-  opts = _resolveOpts(opts);
+  opts = gateContract.resolveProfileAndPosture(opts, {
+    profiles:           PROFILES,
+    compliancePostures: COMPLIANCE_POSTURES,
+    defaults:           DEFAULTS,
+    errorClass:         GuardYamlError,
+    errCodePrefix:      "yaml",
+  });
   if (typeof input !== "string") {
     throw _err("yaml.bad-input", "parse requires string input");
   }
@@ -605,7 +567,9 @@ module.exports = gateContract.defineGuard({
   mimeTypes:   ["application/yaml", "application/x-yaml", "text/yaml", "text/x-yaml"],
   extensions:  [".yml", ".yaml"],
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
+  detect:      _detectIssues,
+  intOpts:     ["maxBytes", "maxDepth", "maxAnchors", "maxAliasDepth",
+                "maxDocuments", "maxNodes", "maxScalarLength"],
   extra: {
     parse:                  parse,
     DANGEROUS_TAG_PREFIXES: DANGEROUS_TAG_PREFIXES,

package/lib/html-balance.js

@@ -110,7 +110,10 @@ function check(html) {
         html.charCodeAt(i + 1) === 0x21 /* ! */ &&
         html.charCodeAt(i + 2) === 0x2D &&
         html.charCodeAt(i + 3) === 0x2D) {
-      var endComment = html.indexOf("-->", i + 4);
+      // WHATWG comment end ("--!>" + abrupt "<!-->" / "<!--->"), not only
+      // "-->", so the structural scan agrees with a browser on where the
+      // comment ends (the comment-parser differential).
+      var endComment = markupTokenizer.htmlCommentEnd(html, i);
       if (endComment === -1) {
         var pos = _posToLineColumn(html, i);
         return {
@@ -121,7 +124,7 @@ function check(html) {
           column:  pos.column,
         };
       }
-      i = endComment + 3;
+      i = endComment;
       continue;
     }
 
@@ -218,7 +221,7 @@ function check(html) {
         // Open tag (or self-closing).
         if (selfClose || VOID_TAGS[tag]) {
           // No push.
-        } else if (RAW_TEXT_TAGS[tag]) {
+        } else if (Object.prototype.hasOwnProperty.call(RAW_TEXT_TAGS, tag)) {
           // Skip raw-text content AND its closing tag entirely. Inside
           // <script>/<style>/<textarea>/<title> the `<` characters are
           // text, not markup — re-entering the tag scanner on
@@ -294,6 +297,7 @@ function check(html) {
 // distinguish a structural problem from a content-safety reject.
 var lazyRequire = require("./lazy-require");
 var _guardHtml = lazyRequire(function () { return require("./guard-html"); });
+var markupTokenizer = require("./markup-tokenizer");
 
 /**
  * @primitive b.htmlBalance.checkSafe

package/lib/http-client-cache.js

@@ -47,6 +47,7 @@ var canonicalJson    = require("./canonical-json");
 var safeUrl          = require("./safe-url");
 var structuredFields = require("./structured-fields");
 var validateOpts     = require("./validate-opts");
+var numericBounds    = require("./numeric-bounds");
 var { HttpClientError } = require("./framework-error");
 
 // ---- Tunables ----------------------------------------------------------
@@ -393,18 +394,10 @@ function memoryStore(opts) {
   if (typeof opts !== "object") {
     throw _hcErr("httpclient/cache-bad-opts", "memoryStore: opts must be an object");
   }
-  if (opts.maxBytes !== undefined &&
-      (typeof opts.maxBytes !== "number" || !isFinite(opts.maxBytes) ||
-       opts.maxBytes <= 0 || Math.floor(opts.maxBytes) !== opts.maxBytes)) {
-    throw _hcErr("httpclient/cache-bad-opts",
-      "memoryStore: maxBytes must be a positive integer");
-  }
-  if (opts.maxEntries !== undefined &&
-      (typeof opts.maxEntries !== "number" || !isFinite(opts.maxEntries) ||
-       opts.maxEntries <= 0 || Math.floor(opts.maxEntries) !== opts.maxEntries)) {
-    throw _hcErr("httpclient/cache-bad-opts",
-      "memoryStore: maxEntries must be a positive integer");
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxBytes,
+    "memoryStore: maxBytes", HttpClientError, "httpclient/cache-bad-opts", { permanent: true });
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxEntries,
+    "memoryStore: maxEntries", HttpClientError, "httpclient/cache-bad-opts", { permanent: true });
   if (opts.evictionPolicy !== undefined && opts.evictionPolicy !== "lru") {
     throw _hcErr("httpclient/cache-bad-opts",
       "memoryStore: evictionPolicy must be 'lru' (got " + JSON.stringify(opts.evictionPolicy) + ")");

package/lib/http-client-cookie-jar.js

@@ -60,9 +60,9 @@
  *   }
  */
 
-var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var C                = require("./constants");
+var atomicFile       = require("./atomic-file");
 var numericBounds    = require("./numeric-bounds");
 var safeAsync        = require("./safe-async");
 var safeJson         = require("./safe-json");
@@ -170,10 +170,8 @@ function create(opts) {
   }
   var vault = opts.vault || null;
   if (persist === "vault") {
-    if (!vault || typeof vault.seal !== "function" || typeof vault.unseal !== "function") {
-      throw _err("BAD_OPT",
-        "cookieJar.create: persist: 'vault' requires opts.vault with seal/unseal (pass b.vault)");
-    }
+    validateOpts.requireMethods(vault, ["seal", "unseal"],
+      "cookieJar.create: persist: 'vault' opts.vault (pass b.vault)", CookieJarError, "BAD_OPT");
   }
   var filePath = null;
   if (persist === "file") {
@@ -441,7 +439,10 @@ function create(opts) {
     var rows = getAll();
     var serialized = JSON.stringify(rows);
     var blob = vault ? vault.seal(serialized) : serialized;
-    nodeFs.writeFileSync(filePath, blob);
+    // Atomic, symlink-refusing write: a bare writeFileSync follows a symlink
+    // planted at filePath (CWE-59) and can leave a torn jar if the process
+    // dies mid-write. writeSync stages into a no-follow exclusive temp + renames.
+    atomicFile.writeSync(filePath, blob, { fileMode: 0o600 });
   }
   var flushScheduler = safeAsync.makeScheduledFlush(flushDebounceMs, function () {
     if (!filePath) return;
@@ -477,18 +478,36 @@ function create(opts) {
   // Persist file may be operator-tampered (or vault-sealed) — route through
   // safeJson with an explicit byte cap so a maliciously-large file can't
   // OOM the process before the parse fails.
-  if (filePath && nodeFs.existsSync(filePath)) {
+  if (filePath) {
+    // Capped fd-bound read (no existsSync check-then-read window): the cap now
+    // precedes the file allocation so a maliciously-large persist file can't OOM
+    // the process before parse. refuseSymlink+inodeCheck: the jar file is
+    // operator-local + may hold a vault-sealed (secret) blob, and is never a
+    // k8s-style projected-secret mount. A MISSING file is the normal first run.
+    var raw = null;
     try {
-      var raw = nodeFs.readFileSync(filePath, "utf8");
-      var serialized = vault ? vault.unseal(raw) : raw;
-      if (serialized && serialized.length > 0) {
-        var rows = safeJson.parse(serialized, { maxBytes: C.BYTES.mib(16) });
-        setFromSerialized(rows);
-      }
+      raw = atomicFile.fdSafeReadSync(filePath, {
+        maxBytes: C.BYTES.mib(16), encoding: "utf8", refuseSymlink: true, inodeCheck: true,
+      });
     } catch (e) {
-      throw _err("LOAD_FAILED",
-        "cookieJar.create: failed to load persist file '" + filePath + "': " +
-        (e.message || String(e)));
+      if (e && e.code === "ENOENT") { raw = null; }   // first run — no persist file yet
+      else {
+        throw _err("LOAD_FAILED",
+          "cookieJar.create: failed to load persist file '" + filePath + "': " +
+          (e.message || String(e)));
+      }
+    }
+    if (raw !== null) {
+      try {
+        var serialized = vault ? vault.unseal(raw) : raw;
+        if (serialized && serialized.length > 0) {
+          setFromSerialized(safeJson.parse(serialized, { maxBytes: C.BYTES.mib(16) }));
+        }
+      } catch (e) {
+        throw _err("LOAD_FAILED",
+          "cookieJar.create: failed to load persist file '" + filePath + "': " +
+          (e.message || String(e)));
+      }
     }
   }