@blamejs/core 0.15.12 → 0.15.14

package/lib/mail-auth.js

@@ -46,7 +46,10 @@ var zlib = require("node:zlib");
 var net = require("node:net");
 var nodeCrypto = require("node:crypto");
 var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
+var structuredFields = require("./structured-fields");
+var markupEscape = require("./markup-escape").markupEscape;
 var bCrypto = require("./crypto");
 var C = require("./constants");
 var dkim = require("./mail-dkim");
@@ -109,22 +112,11 @@ function _getDefaultResolver() {
   return _defaultResolver;
 }
 
+// TXT resolution reuses the shared reshape in networkDnsResolver.resolveTxt,
+// passing this module's own resolver so TXT shares the resolver (and cache)
+// used for A / MX / PTR below.
 async function _safeResolveTxt(qname, operatorLookup) {
-  if (operatorLookup) return operatorLookup(qname, "TXT");
-  var r = await _getDefaultResolver().queryTxt(qname);
-  var out = [];
-  for (var i = 0; i < r.rrs.length; i += 1) {
-    var rr = r.rrs[i];
-    if (rr && rr.type === 16) {                                                  // IANA DNS qtype TXT
-      out.push(Array.isArray(rr.decoded) ? rr.decoded : [String(rr.decoded)]);
-    }
-  }
-  if (out.length === 0) {
-    var err = new Error("no TXT records for " + qname);
-    err.code = "ENODATA";
-    throw err;
-  }
-  return out;
+  return networkDnsResolver().resolveTxt(qname, operatorLookup, _getDefaultResolver());
 }
 
 async function _safeResolveA(qname, family /* 4|6 */, operatorLookup) {
@@ -1082,15 +1074,11 @@ async function _spfEvaluateDomain(domain, ip, dnsLookup, lookups, ctx) {
 
 async function _fetchDmarcRecord(domain, dnsLookup) {
   var qname = "_dmarc." + domain.toLowerCase();
-  var records;
-  try {
-    records = await _safeResolveTxt(qname, dnsLookup);
-  } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
-    throw new MailAuthError("mail-auth/dmarc-lookup-failed",
-      "DMARC TXT lookup for " + qname + " failed: " +
-      ((e && e.message) || String(e)));
-  }
+  var records = await networkDnsResolver().safeResolveTxt(qname, {
+    dnsLookup:    dnsLookup,
+    errorFactory: function (code, msg) { return new MailAuthError(code, msg); },
+    code:         "mail-auth/dmarc-lookup-failed",
+  });
   if (!Array.isArray(records)) return null;
   var matches = [];
   for (var i = 0; i < records.length; i += 1) {
@@ -1120,14 +1108,12 @@ var DMARCBIS_VALID_PSD = { y: 1, n: 1, u: 1 };
 function _parseDmarcRecord(text) {
   var policy = { v: null, p: null, sp: null, np: null, psd: null,
                  pct: 100, adkim: "r", aspf: "r" };                              // RFC 7489 default pct
-  var pairs = text.split(";");                                                              // allow:bare-split-on-quoted-header — RFC 7489 §6.4 DMARC tag-list grammar: `tag-spec *( ";" tag-spec )` with tag-value = 0*( tval *( WSP / FWS ) ); NO quoted-string allowed
+  // RFC 7489 §6.4 DMARC tag-list grammar: `tag-spec *( ";" tag-spec )`,
+  // tag-value carries NO quoted-string — the naive split is correct.
+  var pairs = structuredFields.parseTagList(text);
   for (var i = 0; i < pairs.length; i += 1) {
-    var kv = pairs[i].trim();
-    if (kv.length === 0) continue;
-    var eq = kv.indexOf("=");
-    if (eq === -1) continue;
-    var key = kv.slice(0, eq).trim().toLowerCase();
-    var val = kv.slice(eq + 1).trim();
+    var key = pairs[i][0];
+    var val = pairs[i][1];
     if (key === "v")     policy.v = val;
     else if (key === "p")     policy.p = val.toLowerCase();
     else if (key === "sp")    policy.sp = val.toLowerCase();
@@ -1136,7 +1122,7 @@ function _parseDmarcRecord(text) {
     else if (key === "aspf")  policy.aspf = val.toLowerCase();
     else if (key === "np") {
       var npVal = val.toLowerCase();
-      if (!DMARCBIS_VALID_NP[npVal]) {
+      if (!Object.prototype.hasOwnProperty.call(DMARCBIS_VALID_NP, npVal)) {
         throw new MailAuthError("mail-auth/dmarcbis-bad-tag",
           "DMARC np= must be one of none|quarantine|reject, got " + JSON.stringify(val));
       }
@@ -1144,7 +1130,7 @@ function _parseDmarcRecord(text) {
     }
     else if (key === "psd") {
       var psdVal = val.toLowerCase();
-      if (!DMARCBIS_VALID_PSD[psdVal]) {
+      if (!Object.prototype.hasOwnProperty.call(DMARCBIS_VALID_PSD, psdVal)) {
         throw new MailAuthError("mail-auth/dmarcbis-bad-tag",
           "DMARC psd= must be one of y|n|u, got " + JSON.stringify(val));
       }
@@ -1417,10 +1403,10 @@ async function arcVerify(rfc822, opts) {
   var orderTrail = [];                       // [{ inst, name, idx }]
   for (var i = 0; i < headers.length; i += 1) {
     var line = headers[i];
-    var colonAt = line.indexOf(":");
-    if (colonAt === -1) continue;
-    var name = line.slice(0, colonAt).trim().toLowerCase();
-    var value = line.slice(colonAt + 1).trim();
+    var khv = structuredFields.parseKeyValuePiece(line, ":");
+    if (khv.value === null) continue;
+    var name = khv.key;
+    var value = khv.value.trim();
     if (name !== "arc-seal" && name !== "arc-message-signature" &&
         name !== "arc-authentication-results") continue;
     // ARC hop instance per RFC 8617 §4.2.1 — bounded to 3 digits; the
@@ -1734,9 +1720,9 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
   var rebuilt = [];
   for (var i = 0; i < headerLines.length; i += 1) {
     var line = headerLines[i];
-    var colonAt = line.indexOf(":");
-    if (colonAt === -1) { rebuilt.push(line); continue; }
-    var name = line.slice(0, colonAt).trim().toLowerCase();
+    var khv = structuredFields.parseKeyValuePiece(line, ":");
+    if (khv.value === null) { rebuilt.push(line); continue; }
+    var name = khv.key;
     if (name === "arc-message-signature" ||
         name === "arc-seal" ||
         name === "dkim-signature") {
@@ -1747,7 +1733,7 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
       // canonicalizes it via h=). Pre-v0.8.17 stripped every AAR
       // unconditionally, breaking verification on chains that
       // included AAR in h= (Microsoft + Google interop).
-      var instMatch = /\bi\s*=\s*(\d+)/.exec(line.slice(colonAt + 1));
+      var instMatch = /\bi\s*=\s*(\d+)/.exec(khv.value);
       if (!instMatch || parseInt(instMatch[1], 10) !== hop.instance) continue;
     }
     rebuilt.push(line);
@@ -1763,16 +1749,11 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
 }
 
 function _parseArcTagList(value) {
+  // RFC 8617 §4 ARC tag-list grammar (same as DKIM's): `tag-spec *( ";"
+  // tag-spec )`, tag-value contains no DQUOTE, FWS inside a value ignored.
+  var pairs = structuredFields.parseTagList(value, { stripValueWs: true });
   var tags = {};
-  var parts = String(value).split(";");                                                          // allow:bare-split-on-quoted-header — RFC 8617 §4 ARC tag-list grammar (same as the DKIM RFC's): `tag-spec *( ";" tag-spec )`, tag-value contains no DQUOTE
-
-  for (var i = 0; i < parts.length; i += 1) {
-    var p = parts[i].trim();
-    if (p.length === 0) continue;
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    tags[p.slice(0, eq).trim().toLowerCase()] = p.slice(eq + 1).trim().replace(/\s+/g, "");
-  }
+  for (var i = 0; i < pairs.length; i += 1) tags[pairs[i][0]] = pairs[i][1];
   return tags;
 }
 
@@ -1791,11 +1772,9 @@ function _parseDkimKeyRecord(records) {
 }
 
 function _canonRelaxedHeader(name, value) {
-  // RFC 6376 §3.4.2 — relaxed header canon: lowercase name, unfold,
-  // collapse internal WSP runs, strip trailing WSP.
-  var unfolded = String(value).replace(/\r?\n[ \t]+/g, " ");
-  var trimmed = unfolded.replace(/[ \t]+/g, " ").replace(/^[ \t]+|[ \t]+$/g, "");
-  return name.toLowerCase() + ":" + trimmed + "\r\n";
+  // RFC 6376 §3.4.2 relaxed header canon — shared with the DKIM signer/verifier
+  // so the DMARC/ARC paths reach a byte-identical canon (RFC 8617 §5.1.1).
+  return dkim.canonHeaderRelaxed(name, value);
 }
 
 function _pemFromB64KeyMaterial(b64) {
@@ -1897,10 +1876,10 @@ async function arcEvaluate(rfc822, opts) {
   var hopAr = {};
   for (var hi = 0; hi < headers.length; hi += 1) {
     var line = headers[hi];
-    var colonAt = line.indexOf(":");
-    if (colonAt === -1) continue;
-    var name = line.slice(0, colonAt).trim().toLowerCase();
-    var value = line.slice(colonAt + 1).trim();
+    var khv = structuredFields.parseKeyValuePiece(line, ":");
+    if (khv.value === null) continue;
+    var name = khv.key;
+    var value = khv.value.trim();
     if (name === "arc-seal") {
       var iMatch = value.match(/(?:^|[;,\s])i=(\d+)/);                            // allow:regex-no-length-cap — header bounded by RFC 5322 998
       var dMatch = value.match(/(?:^|[;,\s])d=([^\s;]+)/);                        // allow:regex-no-length-cap — header bounded by RFC 5322 998
@@ -2038,7 +2017,7 @@ function authResultsEmit(opts) {
     }
     var method = String(r.method || "").toLowerCase();
     var result = String(r.result || "").toLowerCase();
-    if (!AR_VALID_METHODS[method]) {
+    if (!Object.prototype.hasOwnProperty.call(AR_VALID_METHODS, method)) {
       throw new MailAuthError("mail-auth/ar-bad-method",
         "authResults.emit: unknown method '" + r.method + "'");
     }
@@ -2167,7 +2146,7 @@ function _countFromAuthors(value) {
 // (RFC 7489 §6.6.1 — a multi-author From is the header-duplication
 // spoofing shape and must not have "one" author picked from it).
 function _extractFromHeaders(headerBlock) {
-  var unfolded = headerBlock.replace(/\r?\n[ \t]+/g, " ");
+  var unfolded = structuredFields.unfoldHeaderContinuations(headerBlock);
   var lines = unfolded.split(/\r?\n/);
   var fromValues = [];
   for (var i = 0; i < lines.length; i += 1) {
@@ -2552,12 +2531,7 @@ function _shapeAggregateReport(parsed) {
 // before they reach here, but escaping is applied uniformly so a future
 // caller can't bypass it.
 function _xmlEscapeText(value) {
-  return String(value)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
+  return markupEscape(value, { apos: "&apos;" });
 }
 
 // Emit `<tag>escaped-text</tag>` when value is non-null/defined; emit
@@ -2984,9 +2958,9 @@ function dmarcParseForensicReport(input, opts) {
   var maxBytes = (typeof opts.maxBytes === "number" && isFinite(opts.maxBytes) && opts.maxBytes > 0)
     ? opts.maxBytes
     : DMARC_RUF_MAX_REPORT_BYTES;
-  if (asString.length > maxBytes) {
+  if (safeBuffer.byteLengthOf(asString) > maxBytes) {
     return _rufError("mail-auth/dmarc-ruf-too-large",
-      "dmarc.parseForensicReport: report exceeds " + maxBytes + " bytes (got " + asString.length + ")");
+      "dmarc.parseForensicReport: report exceeds " + maxBytes + " bytes (got " + safeBuffer.byteLengthOf(asString) + ")");
   }
 
   // ---- Bisect top-level headers / body; require multipart/report ----

package/lib/mail-bimi.js

@@ -48,15 +48,17 @@
  *   RFC 9091 BIMI policy lookup, VMC + CMC fetch + chain validation, and Tiny-PS SVG profile enforcement for inbox brand-mark rendering.
  */
 
-var dns = require("node:dns");
 var nodeCrypto = require("node:crypto");
-var dnsPromises = dns.promises;
 
 var asn1 = require("./asn1-der");
 var C = require("./constants");
 var httpClient = require("./http-client");
 var lazyRequire = require("./lazy-require");
+var networkDnsResolver = lazyRequire(function () { return require("./network-dns-resolver"); });
 var safeBuffer = require("./safe-buffer");
+var markupTokenizer = require("./markup-tokenizer");
+var x509Chain = require("./x509-chain");
+var structuredFields = require("./structured-fields");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var { defineClass, MailBimiError } = require("./framework-error");
@@ -211,17 +213,12 @@ function recordShape(opts) {
 function parseRecord(text) {
   if (typeof text !== "string" || text.length === 0) return null;
   if (text.length > BIMI_RECORD_MAX_BYTES) return null;
-  // RFC 9091 4 - semicolon-separated, key=value, leading "v=BIMI1".
-  var parts = text.split(";");
+  // RFC 9091 §4 — semicolon-separated key=value (no DQUOTE), leading "v=BIMI1".
+  var pairs = structuredFields.parseTagList(text);
   var rv = { v: null, l: null, a: null };
-  for (var i = 0; i < parts.length; i += 1) {
-    var p = parts[i].trim();
-    if (p.length === 0) continue;
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    var k = p.slice(0, eq).trim().toLowerCase();
-    var v = p.slice(eq + 1).trim();
-    if (k === "v" || k === "l" || k === "a") rv[k] = v;
+  for (var i = 0; i < pairs.length; i += 1) {
+    var k = pairs[i][0];
+    if (k === "v" || k === "l" || k === "a") rv[k] = pairs[i][1];
   }
   if (rv.v !== BIMI_VERSION || !rv.l) return null;
   return rv;
@@ -264,16 +261,13 @@ async function fetchPolicy(domain, opts) {
   opts = opts || {};
   var selector = opts.selector || BIMI_DEFAULT_SELECTOR;
   var qname = selector + "._bimi." + domain;
-  var records;
-  try {
-    if (opts.dnsLookup) records = await opts.dnsLookup(qname, "TXT");
-    else records = await dnsPromises.resolveTxt(qname);
-  } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
-    throw new BimiError("mail-bimi/lookup-failed",
-      "bimi.fetchPolicy: TXT lookup for " + qname + " failed: " +
-      ((e && e.message) || String(e)));
-  }
+  // Secure DNS path (DoH/DNSSEC via the framework resolver) — not plaintext
+  // dnsPromises, which a spoofed BIMI TXT could exploit to mislead VMC discovery.
+  var records = await networkDnsResolver().safeResolveTxt(qname, {
+    dnsLookup:    opts.dnsLookup,
+    errorFactory: function (code, msg) { return new BimiError(code, msg); },
+    code:         "mail-bimi/lookup-failed",
+  });
   // RFC 9091 4.1 - a TXT lookup may return multiple chunks; pick
   // the first record that begins with v=BIMI1.
   for (var i = 0; i < (records || []).length; i += 1) {
@@ -406,7 +400,7 @@ function validateTinyPsSvg(svgBytes) {
       }
       // Any element name starting with "animate" is animation (covers
       // future SMIL extensions not in the static list above).
-      if (name.indexOf("animate") === 0 && !TINY_PS_FORBIDDEN_TAGS[name]) {
+      if (name.indexOf("animate") === 0 && !Object.prototype.hasOwnProperty.call(TINY_PS_FORBIDDEN_TAGS, name)) {
         _vio("element-forbidden",
           "<" + name + "> animation element is forbidden in Tiny-PS");
       }
@@ -499,10 +493,14 @@ function _tokenizeTinyPsSvg(s) {
     if (lt > pos) tokens.push({ type: "text", raw: s.slice(pos, lt) });
 
     if (s.startsWith("<!--", lt)) {
-      var endC = s.indexOf("-->", lt + 4);
+      // WHATWG comment end ("--!>" + abrupt "<!-->" / "<!--->"), matching a
+      // browser parsing inline SVG — so an element smuggled past an early
+      // terminator can't slip the Tiny-PS validation (mXSS differential).
+      // Fails closed on an unterminated comment.
+      var endC = markupTokenizer.htmlCommentEnd(s, lt);
       if (endC === -1) throw new Error("unterminated comment");   // allow:bare-error-throw — caught by outer try/catch and re-thrown as MailBimiError("bimi/svg-tiny-ps-violation")
-      tokens.push({ type: "comment", raw: s.slice(lt, endC + 3) });
-      pos = endC + 3;
+      tokens.push({ type: "comment", raw: s.slice(lt, endC) });
+      pos = endC;
       continue;
     }
     if (s.startsWith("<![CDATA[", lt)) {
@@ -542,32 +540,19 @@ function _tokenizeTinyPsSvg(s) {
       continue;
     }
 
-    var pp = lt + 1;
-    var inQuote = "";
-    while (pp < len) {
-      var ch = s.charAt(pp);
-      if (inQuote) {
-        if (ch === inQuote) inQuote = "";
-      } else {
-        if (ch === '"' || ch === "'") inQuote = ch;
-        else if (ch === ">") break;
-      }
-      pp += 1;
-    }
+    var pp = markupTokenizer.scanToTagEnd(s, lt + 1, len);
     if (pp >= len) throw new Error("unterminated start tag");   // allow:bare-error-throw — caught by outer try/catch and re-thrown as MailBimiError("bimi/svg-tiny-ps-violation")
     var raw = s.slice(lt, pp + 1);
     var inner = raw.slice(1, raw.length - 1);
     var selfClosing = inner.endsWith("/");
     if (selfClosing) inner = inner.slice(0, inner.length - 1);
 
-    var nameMatch = inner.match(/^([A-Za-z][A-Za-z0-9:_-]*)/);
-    var tagName = nameMatch ? nameMatch[1].toLowerCase() : "";
-    var attrSrc = nameMatch ? inner.slice(nameMatch[0].length) : "";
+    var bimiParts = markupTokenizer.splitTagNameAttrs(inner, /^([A-Za-z][A-Za-z0-9:_-]*)/);
 
     tokens.push({
       type:        "tag",
-      name:        tagName,
-      attrs:       _parseTinyPsAttrs(attrSrc),
+      name:        bimiParts.tagName,
+      attrs:       _parseTinyPsAttrs(bimiParts.attrSrc),
       raw:         raw,
       selfClosing: selfClosing,
     });
@@ -843,11 +828,10 @@ function _verifyCertChain(leaf, intermediates, anchors) {
 
     for (var ai = 0; ai < anchors.length; ai += 1) {
       var anchor = anchors[ai];
-      if (current.checkIssued(anchor)) {
-        try {
-          if (current.verify(anchor.publicKey)) return { ok: true };
-        } catch (_e) { /* fall through to next anchor */ }
-      }
+      // issuerValidlyIssued enforces basicConstraints cA:TRUE on the anchor
+      // in addition to the issuance + signature checks, so a non-CA cert
+      // cannot mint a VMC (basicConstraints bypass, CVE-2002-0862 class).
+      if (x509Chain.issuerValidlyIssued(anchor, current)) return { ok: true };
     }
     if (current.checkIssued(current)) {
       return { ok: false, reason: "self-signed root not in trust-anchor bundle" };
@@ -857,13 +841,9 @@ function _verifyCertChain(leaf, intermediates, anchors) {
     for (var ii = 0; ii < intermediates.length; ii += 1) {
       var cand = intermediates[ii];
       if (cand === current) continue;
-      if (current.checkIssued(cand)) {
-        try {
-          if (current.verify(cand.publicKey)) {
-            nextIssuer = cand;
-            break;
-          }
-        } catch (_e) { /* fall through */ }
+      if (x509Chain.issuerValidlyIssued(cand, current)) {
+        nextIssuer = cand;
+        break;
       }
     }
     if (nextIssuer === null) {

package/lib/mail-bounce.js

@@ -448,7 +448,7 @@ function handler(opts) {
   opts = opts || {};
   var vendor = opts.vendor;
   var customParser = typeof opts.parser === "function" ? opts.parser : null;
-  if (!customParser && (typeof vendor !== "string" || !VENDORS[vendor])) {
+  if (!customParser && (typeof vendor !== "string" || !Object.prototype.hasOwnProperty.call(VENDORS, vendor))) {
     throw _err("handler/bad-config",
       "mailBounce.handler requires { vendor } (one of " +
       Object.keys(VENDORS).join(", ") + ") or { parser }");
@@ -761,7 +761,7 @@ function _parseDsn(rawMessage) {
     throw _err("bounce/dsn-malformed",
       "mailBounce.dsn.parse: per-recipient group missing Final-Recipient");
   }
-  if (action && !DSN_ACTIONS[action]) {
+  if (action && !Object.prototype.hasOwnProperty.call(DSN_ACTIONS, action)) {
     throw _err("bounce/dsn-malformed",
       "mailBounce.dsn.parse: Action token '" + action + "' is not RFC 3464 §2.3.3");
   }
@@ -825,7 +825,7 @@ function _buildDsn(opts) {
   validateOpts.requireNonEmptyString(opts.finalRecipient,
     "mailBounce.dsn.build: opts.finalRecipient", MailBounceError, "bounce/dsn-malformed");
   var action = String(opts.action || "failed").toLowerCase();
-  if (!DSN_ACTIONS[action]) {
+  if (!Object.prototype.hasOwnProperty.call(DSN_ACTIONS, action)) {
     throw _err("bounce/dsn-malformed",
       "mailBounce.dsn.build: opts.action must be one of " +
       Object.keys(DSN_ACTIONS).join(" / ") + "; got '" + action + "'");

package/lib/mail-crypto-pgp.js

@@ -113,6 +113,7 @@
  *     band fingerprint pinning is the operator's responsibility)
  */
 var lazyRequire  = require("./lazy-require");
+var safeBuffer   = require("./safe-buffer");
 var audit        = lazyRequire(function () { return require("./audit"); });
 var nodeCrypto   = require("node:crypto");
 var validateOpts = require("./validate-opts");
@@ -1168,7 +1169,7 @@ function wkdFetch(email, opts) {
   var urls = wkdComputeUrl(email, { advancedHost: opts.advancedHost });
   return Promise.resolve(opts.httpsGet(urls.direct)).then(function (resp) {
     if (resp && resp.status === 200 && Buffer.isBuffer(resp.body) && resp.body.length > 0) {          // HTTP 200
-      if (resp.body.length > maxBytes) {
+      if (safeBuffer.byteLengthOf(resp.body) > maxBytes) {
         throw new MailCryptoError("mail-crypto/pgp/wkd-too-large",
           "wkd.fetch: key bytes " + resp.body.length + " exceed maxKeyBytes=" + maxBytes);
       }
@@ -1176,7 +1177,7 @@ function wkdFetch(email, opts) {
     }
     return Promise.resolve(opts.httpsGet(urls.advanced)).then(function (resp2) {
       if (resp2 && resp2.status === 200 && Buffer.isBuffer(resp2.body) && resp2.body.length > 0) {    // HTTP 200
-        if (resp2.body.length > maxBytes) {
+        if (safeBuffer.byteLengthOf(resp2.body) > maxBytes) {
           throw new MailCryptoError("mail-crypto/pgp/wkd-too-large",
             "wkd.fetch: key bytes " + resp2.body.length + " exceed maxKeyBytes=" + maxBytes);
         }

package/lib/mail-crypto-smime.js

@@ -98,6 +98,7 @@ var lazyRequire  = require("./lazy-require");
 var audit        = lazyRequire(function () { return require("./audit"); });
 var nodeCrypto   = require("node:crypto");
 var validateOpts = require("./validate-opts");
+var x509Chain    = require("./x509-chain");
 var cms          = require("./cms-codec");
 var asn1         = require("./asn1-der");
 var pqcSoftware  = require("./pqc-software");
@@ -297,7 +298,8 @@ function verify(opts) {
   // verification failure (bad alg, missing signed-attrs, message-
   // digest mismatch, signature mismatch); reaching the next line
   // means the per-signer verify succeeded.
-  var siResult = _verifySignerInfo(sd.signerInfos[0], msgBytes, opts.signerPublicKey, opts.audit);
+  var siResult = _verifySignerInfo(sd.signerInfos[0], msgBytes, opts.signerPublicKey, opts.audit,
+    sd.encapContent && sd.encapContent.eContentType);
   // Trust-anchor chain validation when operator supplies roots. The
   // signer cert is in sd.certificates (its serialNumber matches the
   // sid's serialNumber); intermediate certs are also in
@@ -336,7 +338,7 @@ function verify(opts) {
 // signer's signature, masking real multi-signer envelopes as a single
 // false-failure). verifyAll now iterates `sd.signerInfos` directly and
 // calls this helper per index with the matching per-signer key.
-function _verifySignerInfo(si, msgBytes, signerPublicKey, auditHandle) {
+function _verifySignerInfo(si, msgBytes, signerPublicKey, auditHandle, eContentType) {
   var sigAlg = _oidToSigAlg(si.sigAlgOid);
   if (!sigAlg) {
     throw new MailCryptoError("mail-crypto/smime/bad-sig-alg",
@@ -365,6 +367,26 @@ function _verifySignerInfo(si, msgBytes, signerPublicKey, auditHandle) {
       "smime.verify: recomputed message digest does not match signedAttrs.messageDigest " +
       "(message was tampered or signed-attrs were swapped)");
   }
+  // RFC 5652 §11.1: when signedAttrs are present the contentType attribute
+  // MUST be present and MUST equal the SignedData eContentType. The TSA
+  // sibling enforces this; S/MIME omitted it, so a SignerInfo with a missing
+  // or mismatched contentType still verified — a cross-protocol content-type
+  // binding gap. The check runs over signedAttrs, which the signature below
+  // covers, so a tampered attribute also fails the signature.
+  if (eContentType) {
+    var ctOid = _extractContentTypeOid(si.signedAttrsRaw);
+    if (!ctOid) {
+      _audit(auditHandle, "mail.crypto.smime.verify_fail", "denied", { reason: "no-content-type-attr" });
+      throw new MailCryptoError("mail-crypto/smime/no-content-type-attr",
+        "smime.verify: signedAttrs missing the contentType attribute (RFC 5652 §11.1)");
+    }
+    if (ctOid !== eContentType) {
+      _audit(auditHandle, "mail.crypto.smime.verify_fail", "denied", { reason: "content-type-mismatch" });
+      throw new MailCryptoError("mail-crypto/smime/content-type-mismatch",
+        "smime.verify: signedAttrs.contentType (" + ctOid + ") does not match eContentType (" +
+        eContentType + ")");
+    }
+  }
   var ok;
   try {
     ok = sigAlg.pqc.verify(
@@ -471,7 +493,10 @@ function _verifyTrustChain(sd, trustAnchorCertsPem, signerPublicKey, auditHandle
     // Stop when we've reached a trust anchor.
     for (var ri = 0; ri < roots.length; ri += 1) {
       var r = roots[ri];
-      if (current.issuer === r.subject) {
+      // Enforce basicConstraints cA:TRUE on the issuing root in addition to
+      // the DN match + signature — a non-CA cert can never be a chain issuer
+      // (basicConstraints bypass, CVE-2002-0862 class).
+      if (current.issuer === r.subject && x509Chain.isCaCert(r)) {
         try {
           if (current.verify(r.publicKey)) {
             void auditHandle;
@@ -480,12 +505,12 @@ function _verifyTrustChain(sd, trustAnchorCertsPem, signerPublicKey, auditHandle
         } catch (_e) { /* fall through to next root */ }
       }
     }
-    // Find an intermediate whose subject == current.issuer.
+    // Find an intermediate whose subject == current.issuer (and that is a CA).
     var found = null;
     for (var hi = 0; hi < chain.length; hi += 1) {
       var h = chain[hi];
       if (h === current) continue;
-      if (h.subject === current.issuer) {
+      if (h.subject === current.issuer && x509Chain.isCaCert(h)) {
         try {
           if (current.verify(h.publicKey)) { found = h; break; }
         } catch (_e) { /* try next */ }
@@ -574,7 +599,8 @@ function verifyAll(opts) {
       throw new MailCryptoError("mail-crypto/smime/missing-key",
         "verifyAll: no public key supplied for SignerInfo serial " + serialHex);
     }
-    var siRes = _verifySignerInfo(si, msgBytes, pub, opts.audit);
+    var siRes = _verifySignerInfo(si, msgBytes, pub, opts.audit,
+      sd.encapContent && sd.encapContent.eContentType);
     results.push({
       serialHex: serialHex,
       sigAlgOid: si.sigAlgOid,
@@ -621,6 +647,42 @@ function _extractSerialHex(sidBytes) {
 
 // RFC 5652 §11.2 messageDigest OID.
 var OID_MESSAGE_DIGEST = "1.2.840.113549.1.9.4";
+// RFC 5652 §11.1 contentType signed-attribute OID.
+var OID_CONTENT_TYPE_ATTR = "1.2.840.113549.1.9.3";
+
+// Extract the contentType signed-attribute's OID value from a signedAttrs
+// SET, or null if absent / malformed. Mirrors _extractMessageDigest's walk
+// but the attribute value is an OID (the eContentType), not an OCTET STRING.
+function _extractContentTypeOid(signedAttrsRaw) {
+  var node;
+  try { node = asn1.readNode(signedAttrsRaw); }
+  catch (_e) { return null; }
+  if (node.tag !== asn1.TAG.SET) return null;
+  var attrs;
+  try { attrs = asn1.readSequence(node.value); }
+  catch (_e) { return null; }
+  for (var i = 0; i < attrs.length; i += 1) {
+    var attr = attrs[i];
+    if (attr.tag !== asn1.TAG.SEQUENCE) continue;
+    var children;
+    try { children = asn1.readSequence(attr.value); }
+    catch (_e) { continue; }
+    if (children.length < 2) continue;
+    var oid;
+    try { oid = asn1.readOid(children[0]); }
+    catch (_e) { continue; }
+    if (oid !== OID_CONTENT_TYPE_ATTR) continue;
+    var valuesSet = children[1];
+    if (valuesSet.tag !== asn1.TAG.SET) continue;
+    var valueChildren;
+    try { valueChildren = asn1.readSequence(valuesSet.value); }
+    catch (_e) { continue; }
+    if (valueChildren.length === 0) continue;
+    try { return asn1.readOid(valueChildren[0]); }
+    catch (_e) { return null; }
+  }
+  return null;
+}
 
 function _extractMessageDigest(signedAttrsRaw) {
   // signedAttrsRaw is `31 LL VV...` — the universal SET-tagged blob
@@ -821,4 +883,7 @@ module.exports = {
   // validation (a cert matches the verified signer key iff its SPKI public
   // key equals, or has as a suffix, the raw signer key bytes).
   _certKeyMatches:     _certKeyMatches,
+  // Exposed for tests — RFC 5652 §11.1 contentType signed-attr extraction
+  // (verify binds it to the eContentType).
+  _extractContentTypeOid: _extractContentTypeOid,
 };