@blamejs/core 0.15.12 → 0.15.14

package/lib/mcp.js

@@ -152,7 +152,7 @@ function refuse(res, code, message, id) {
 function _readBearer(req) {
   var h = req.headers && req.headers.authorization;
   if (typeof h !== "string") return null;
-  if (h.length > C.BYTES.kib(8)) return null;
+  if (safeBuffer.byteLengthOf(h) > C.BYTES.kib(8)) return null;
   var m = /^Bearer\s+([A-Za-z0-9._~+/=-]+)$/.exec(h.trim());
   return m ? m[1] : null;
 }
@@ -636,10 +636,12 @@ function _validateValueAgainstSchema(value, schema, path) {
     }
     if (typeof schema.pattern === "string") {
       // Schema-supplied pattern — operator-controlled at registration
-      // time, not request-controlled. Cap value length first per the
-      // codebase-patterns regex-bound rule so a 10MB string doesn't
-      // ReDoS the validator.
-      if (value.length > 4096) return path + ": value exceeds 4 KiB cap before regex test";    // 4 KiB regex-input cap
+      // time, not request-controlled. Cap the input LENGTH first per the
+      // codebase-patterns regex-bound rule so a huge string can't ReDoS the
+      // validator. This is a CHARACTER cap, not a byte cap: regex matching
+      // cost scales with the number of code units the engine scans, so 4096
+      // chars is the correct ReDoS bound regardless of UTF-8 byte size.
+      if (value.length > 4096) return path + ": value exceeds 4096-char cap before regex test";    // ReDoS char cap (not bytes)
       try {
         var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern from registered tool author, not request input; bounded above
         if (!pat.test(value)) return path + ": does not match pattern";

package/lib/mdoc.js

@@ -53,6 +53,8 @@ var C = require("./constants");
 var cbor = require("./cbor");
 var cose = require("./cose");
 var bCrypto = require("./crypto");
+var x509Chain = require("./x509-chain");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -65,11 +67,14 @@ var TAG_ENCODED_CBOR = 24;                             // RFC 8949 §3.4.5.1 emb
 var ALLOWED_TAGS = [0, 1, TAG_ENCODED_CBOR, 1004];
 var DIGEST_ALGS = { "SHA-256": "sha256", "SHA-384": "sha384", "SHA-512": "sha512" };
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  throw new MdocError("mdoc/bad-input", "mdoc: " + what + " must be a Buffer / Uint8Array of CBOR");
-}
+// mdoc inputs are CBOR byte strings, never text (allowString:false).
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    MdocError,
+  typeCode:      "mdoc/bad-input",
+  messagePrefix: "mdoc: ",
+  messageSuffix: " must be a Buffer / Uint8Array of CBOR",
+  allowString:   false,
+});
 
 // validityInfo dates are tdate (Tag 0, an RFC 3339 string) or epoch
 // (Tag 1). Returns epoch-ms; fails closed on a malformed value.
@@ -124,17 +129,28 @@ function _mapGet(m, k) { return m instanceof Map ? m.get(k) : (m ? m[k] : undefi
  */
 async function verifyIssuerSigned(issuerSigned, opts) {
   validateOpts.requireObject(opts, "mdoc.verifyIssuerSigned", MdocError);
-  validateOpts(opts, ["algorithms", "trustAnchorsPem", "expectedDocType", "at", "maxBytes", "maxDepth"], "mdoc.verifyIssuerSigned");
+  validateOpts(opts, ["algorithms", "trustAnchorsPem", "allowUntrustedIssuer", "expectedDocType", "at", "maxBytes", "maxDepth"], "mdoc.verifyIssuerSigned");
   if (!Array.isArray(opts.algorithms) || opts.algorithms.length === 0) {
     throw new MdocError("mdoc/algorithms-required", "mdoc.verifyIssuerSigned: opts.algorithms is required");
   }
-  var at = new Date();
-  if (opts.at !== undefined && opts.at !== null) {
-    if (!(opts.at instanceof Date) || !isFinite(opts.at.getTime())) {
-      throw new MdocError("mdoc/bad-at", "mdoc.verifyIssuerSigned: opts.at must be a valid Date");
-    }
-    at = opts.at;
+  // Issuer authentication is the WHOLE point of verifyIssuerSigned. The signer
+  // cert rides in the attacker-supplied x5chain, so verifying the COSE_Sign1
+  // against that embedded key only proves the MSO is self-consistent — a forged
+  // mDL (attacker keypair, self-signed leaf, self-signed MSO) passes unless the
+  // chain is anchored to a configured trust root. Require trustAnchorsPem by
+  // default; an operator who genuinely wants trust-anchor-free verification must
+  // opt in EXPLICITLY (and gets issuerTrusted:false on the result so the
+  // unauthenticated posture is visible). Fail closed — never silently accept an
+  // unanchored issuer.
+  var hasAnchors = opts.trustAnchorsPem !== undefined && opts.trustAnchorsPem !== null;
+  if (!hasAnchors && opts.allowUntrustedIssuer !== true) {
+    throw new MdocError("mdoc/trust-anchors-required",
+      "mdoc.verifyIssuerSigned: opts.trustAnchorsPem is required to authenticate the issuer " +
+      "(the x5chain signer cert is attacker-controlled); pass trustAnchorsPem, or set " +
+      "allowUntrustedIssuer:true to explicitly accept an unauthenticated issuer");
   }
+  validateOpts.optionalDate(opts.at, "mdoc.verifyIssuerSigned: opts.at", MdocError, "mdoc/bad-at");
+  var at = (opts.at !== undefined && opts.at !== null) ? opts.at : new Date();
   var decodeOpts = { allowedTags: ALLOWED_TAGS, maxBytes: opts.maxBytes, maxDepth: opts.maxDepth };
 
   var top = cbor.decode(_bytes(issuerSigned, "issuerSigned"), decodeOpts);
@@ -265,6 +281,10 @@ async function verifyIssuerSigned(issuerSigned, opts) {
     deviceKey:    deviceKey,
     signerCert:   signerCert.toString(),
     alg:          verified.alg,
+    // true only when the signer chain was validated against a configured trust
+    // anchor; false on the explicit allowUntrustedIssuer opt-out so a caller
+    // can tell an authenticated issuer from a merely self-consistent MSO.
+    issuerTrusted: hasAnchors,
   };
 }
 
@@ -410,8 +430,10 @@ function _verifyChain(chainDer, anchorsPem, at) {
   throw new MdocError("mdoc/chain-loop", "mdoc.verifyIssuerSigned: certificate chain did not terminate");
 }
 function _issued(issuer, subject) {
-  try { return subject.checkIssued(issuer) && subject.verify(issuer.publicKey); }
-  catch (_e) { return false; }
+  // Enforces basicConstraints cA:TRUE on the issuer alongside the
+  // checkIssued + signature linkage — an IACA/DS chain cannot accept a
+  // non-CA cert as an issuer (basicConstraints bypass, CVE-2002-0862 class).
+  return x509Chain.issuerValidlyIssued(issuer, subject);
 }
 function _assertValidAt(cert, atMs) {
   if (atMs < cert.validFromDate.getTime() || atMs > cert.validToDate.getTime()) {

package/lib/metrics.js

@@ -39,7 +39,6 @@
 
 var C = require("./constants");
 var canonicalJson = require("./canonical-json");
-var nodeFs   = require("node:fs");
 var atomicFile = require("./atomic-file");
 var safeJson = require("./safe-json");
 var { defineClass } = require("./framework-error");
@@ -48,6 +47,7 @@ var numericBounds = require("./numeric-bounds");
 var requestHelpers = require("./request-helpers");
 var { resolveRoute, captureResponseStatus, HTTP_STATUS } = requestHelpers;
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 
 var MetricsError = defineClass("MetricsError", { alwaysPermanent: true });
 var log = boot("metrics");
@@ -353,10 +353,10 @@ function create(opts) {
   }
 
   function _registerMetric(metric) {
-    if (metrics.has(metric.name)) {
+    boundedMap.requireAbsent(metrics, metric.name, function () {
       throw new MetricsError("metrics/duplicate",
         "metric '" + metric.name + "' already registered");
-    }
+    });
     metrics.set(metric.name, metric);
     return metric;
   }
@@ -388,19 +388,20 @@ function create(opts) {
         }
         var resolved = _resolveLabels(defaultLabels, labelNames, arg.labels);
         var key = _labelsKey(resolved);
-        var entry = values.get(key);
-        if (!entry) {
-          if (values.size >= cardinalityCap) {
+        var entry = boundedMap.getOrInsert(values, key, function () {
+          return { labels: resolved, value: 0 };
+        }, {
+          maxSize: cardinalityCap,
+          onFull: function () {
             if (!capWarned) {
               log("metric '" + fullName + "' hit labelCardinalityCap (" + cardinalityCap +
                   ") — dropping new label combinations. Reduce label cardinality or raise the cap.");
               capWarned = true;
             }
-            return;
-          }
-          entry = { labels: resolved, value: 0 };
-          values.set(key, entry);
-        }
+            return null;
+          },
+        });
+        if (!entry) return;
         entry.value += arg.value;
       },
       reset: function () { values.clear(); capWarned = false; },
@@ -428,19 +429,18 @@ function create(opts) {
     function _ensure(callLabels) {
       var resolved = _resolveLabels(defaultLabels, labelNames, callLabels);
       var key = _labelsKey(resolved);
-      var entry = values.get(key);
-      if (!entry) {
-        if (values.size >= cardinalityCap) {
+      return boundedMap.getOrInsert(values, key, function () {
+        return { labels: resolved, value: 0 };
+      }, {
+        maxSize: cardinalityCap,
+        onFull: function () {
           if (!capWarned) {
             log("metric '" + fullName + "' hit labelCardinalityCap (" + cardinalityCap + ")");
             capWarned = true;
           }
           return null;
-        }
-        entry = { labels: resolved, value: 0 };
-        values.set(key, entry);
-      }
-      return entry;
+        },
+      });
     }
 
     var instance = {
@@ -524,25 +524,26 @@ function create(opts) {
         }
         var resolved = _resolveLabels(defaultLabels, labelNames, arg.labels);
         var key = _labelsKey(resolved);
-        var entry = values.get(key);
-        if (!entry) {
-          if (values.size >= cardinalityCap) {
-            if (!capWarned) {
-              log("metric '" + fullName + "' hit labelCardinalityCap (" + cardinalityCap + ")");
-              capWarned = true;
-            }
-            return;
-          }
+        var entry = boundedMap.getOrInsert(values, key, function () {
           // counts[i] is the count for the [<=buckets[i]] bucket; counts[buckets.length] is +Inf.
-          entry = {
+          return {
             labels:    resolved,
             counts:    new Array(buckets.length + 1).fill(0),
             sum:       0,
             count:     0,
             exemplars: new Array(buckets.length + 1).fill(null),
           };
-          values.set(key, entry);
-        }
+        }, {
+          maxSize: cardinalityCap,
+          onFull: function () {
+            if (!capWarned) {
+              log("metric '" + fullName + "' hit labelCardinalityCap (" + cardinalityCap + ")");
+              capWarned = true;
+            }
+            return null;
+          },
+        });
+        if (!entry) return;
         for (var i = 0; i < buckets.length; i++) {
           if (arg.value <= buckets[i]) {
             entry.counts[i]++;
@@ -1065,8 +1066,20 @@ function snapshotRead(p) {
     MetricsError, "metrics-snapshot/bad-path");
   var raw;
   try {
-    raw = nodeFs.readFileSync(p, "utf8");
+    // Capped fd-bound read: the snapshot is parsed AFTER read, so the cap must
+    // precede the alloc — a hostile multi-GB file at the snapshot path would
+    // otherwise OOM the reader before safeJson's 4 MiB parse cap is consulted.
+    raw = atomicFile.fdSafeReadSync(p, {
+      maxBytes: C.BYTES.mib(4), encoding: "utf8", refuseSymlink: true,
+      errorFor: function (kind, detail) {
+        if (kind === "enoent") return new MetricsError("metrics-snapshot/not-found", "metrics.snapshot.read: " + p + " — not found");
+        if (kind === "too-large") return new MetricsError("metrics-snapshot/too-large", "metrics.snapshot.read: " + p + " exceeds " + detail.max + " bytes");
+        if (kind === "symlink") return new MetricsError("metrics-snapshot/symlink-refused", "metrics.snapshot.read: " + p + " is a symlink (refused)");
+        return undefined;
+      },
+    });
   } catch (e) {
+    if (e instanceof MetricsError) throw e;
     throw new MetricsError("metrics-snapshot/not-found",
       "metrics.snapshot.read: " + p + " — " + (e && e.message ? e.message : String(e)));
   }
@@ -1327,7 +1340,7 @@ function shadowRegistry(opts) {
   var gaugeSet   = _shadowSetOf(opts.gauges,   "gauges");
   var infoSet    = _shadowSetOf(opts.info,     "info");
   var cap = opts.cardinalityCap === undefined ? SHADOW_DEFAULT_CARDINALITY : opts.cardinalityCap;
-  if (typeof cap !== "number" || !isFinite(cap) || cap < 1 || Math.floor(cap) !== cap) {
+  if (!numericBounds.isPositiveFiniteInt(cap)) {
     throw new MetricsError("metrics-shadow/bad-cap",
       "shadowRegistry: cardinalityCap must be a positive integer");
   }

package/lib/middleware/age-gate.js

@@ -38,6 +38,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var requestHelpers = require("../request-helpers");
 var denyResponse = require("./deny-response").denyResponse;
 
 var audit = lazyRequire(function () { return require("../audit"); });
@@ -106,7 +107,6 @@ function create(opts) {
     ? opts.consentRequired : null;
   var hasParentalConsent = typeof opts.hasParentalConsent === "function" ? opts.hasParentalConsent : null;
   var skipPaths = Array.isArray(opts.skipPaths) ? opts.skipPaths.slice() : [];
-  var auditOn = opts.audit !== false;
   var errorMessage = typeof opts.errorMessage === "string" && opts.errorMessage.length > 0
     ? opts.errorMessage : "service unavailable without parental consent";
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
@@ -123,29 +123,9 @@ function create(opts) {
     privacyPostureHeader = "X-Privacy-Posture";
   }
 
-  function _shouldSkip(req) {
-    if (skipPaths.length === 0) return false;
-    var p = req.url || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < skipPaths.length; i++) {
-      var s = skipPaths[i];
-      if (typeof s === "string" && (p === s || p.indexOf(s + "/") === 0)) return true;
-      if (s instanceof RegExp && s.test(p)) return true;
-    }
-    return false;
-  }
+  var _shouldSkip = requestHelpers.makeSkipMatcher({ skipPaths: skipPaths }, "middleware.ageGate");
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "middleware.age_gate." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("middleware.age_gate", opts.audit);
 
   return function ageGateMiddleware(req, res, next) {
     if (_shouldSkip(req)) return next();

package/lib/middleware/api-encrypt.js

@@ -98,8 +98,9 @@
 
 var bCrypto = require("../crypto");
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var lazyRequire = require("../lazy-require");
-var nonceStoreLib = require("../nonce-store");
+var nonceStore = require("../nonce-store");
 var requestHelpers = require("../request-helpers");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
@@ -313,7 +314,7 @@ function create(opts) {
     "apiEncrypt: pruneIntervalMs", ApiEncryptError, "BAD_OPT");
   var pruneIntervalMs = opts.pruneIntervalMs != null
     ? opts.pruneIntervalMs : Math.max(C.TIME.seconds(30), Math.floor(replayWindowMs / 2));
-  var nonceStore     = opts.nonceStore || nonceStoreLib.create({ backend: "memory" });
+  var store          = opts.nonceStore || nonceStore.create({ backend: "memory" });
   var exemptPaths    = Array.isArray(opts.exemptPaths) ? opts.exemptPaths.slice() : [];
   // contentTypes scoping — middleware only operates on requests whose
   // Content-Type is in this list. Default JSON; operators with more
@@ -344,12 +345,9 @@ function create(opts) {
       "apiEncrypt: sessionTtlMs must be a positive finite number (ms), got " +
       JSON.stringify(opts.sessionTtlMs), 500);
   }
-  if (typeof sessionMaxResponses !== "number" || !isFinite(sessionMaxResponses) ||
-      sessionMaxResponses <= 0 || Math.floor(sessionMaxResponses) !== sessionMaxResponses) {
-    throw _err("BAD_OPT",
-      "apiEncrypt: sessionMaxResponses must be a positive finite integer, got " +
-      JSON.stringify(opts.sessionMaxResponses), 500);
-  }
+  numericBounds.requirePositiveFiniteInt(sessionMaxResponses,
+    "apiEncrypt: sessionMaxResponses", ApiEncryptError, "BAD_OPT", null,
+    { permanent: true, statusCode: 500 });
   // sessionStore — duck-typed handle exposing { get, set, delete }. The
   // helper optionalObjectWithMethod only checks one method; here we need
   // three. Inline shape kept; not a generic enough pattern to warrant a
@@ -393,16 +391,7 @@ function create(opts) {
     } catch (_e) { /* audit best-effort */ }
   }
 
-  function _isExempt(req) {
-    var p = req.pathname || (req.url || "/").split("?")[0];
-    for (var i = 0; i < exemptPaths.length; i++) {
-      var rule = exemptPaths[i];
-      if (typeof rule === "string" ? p === rule || p.indexOf(rule + "/") === 0 : rule.test(p)) {
-        return true;
-      }
-    }
-    return false;
-  }
+  var _isExempt = requestHelpers.makeSkipMatcher({ skipPaths: exemptPaths }, "middleware.apiEncrypt");
 
   function _matchesContentType(req) {
     if (!contentTypes) return true;  // filtering disabled
@@ -443,7 +432,7 @@ function create(opts) {
     var now = Date.now();
     if (now - lastPruneAt < pruneIntervalMs) return;
     lastPruneAt = now;
-    nonceStore.purgeExpired().catch(function (e) {
+    store.purgeExpired().catch(function (e) {
       try {
         logger().warn("nonce-store prune failed: " + ((e && e.message) || String(e)));
       } catch (_e) { /* logger best-effort */ }
@@ -548,7 +537,7 @@ function create(opts) {
       var nonceHash = bCrypto.sha3Hash(nonce, "hex");
       var expireAt = now + replayWindowMs;
       var freshNonce;
-      try { freshNonce = await nonceStore.checkAndInsert(nonceHash, expireAt); }
+      try { freshNonce = await store.checkAndInsert(nonceHash, expireAt); }
       catch (_e) {
         _emitFailure(req, "nonce-store-error");
         return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
@@ -567,7 +556,7 @@ function create(opts) {
           _emitFailure(req, "shape");
           return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
-        if (typeof ctr !== "number" || !isFinite(ctr) || ctr < 0 || Math.floor(ctr) !== ctr) {
+        if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
           _emitFailure(req, "shape");
           return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
@@ -607,7 +596,7 @@ function create(opts) {
         _emitFailure(req, "shape");
         return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }
-      if (!isFinite(ctr) || ctr < 0 || Math.floor(ctr) !== ctr) {
+      if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
         _emitFailure(req, "shape");
         return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }
@@ -682,7 +671,7 @@ function create(opts) {
       // capacity.
       var ctrKey = "ctr:" + sid + ":" + ctr;
       var ctrFresh;
-      try { ctrFresh = await nonceStore.checkAndInsert(ctrKey, session.expiresAt); }
+      try { ctrFresh = await store.checkAndInsert(ctrKey, session.expiresAt); }
       catch (_e) {
         _emitFailure(req, "nonce-store-error");
         return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
@@ -779,7 +768,7 @@ function create(opts) {
 
   middleware.publishPublicKey = publishPublicKey;
   middleware.close = function () {
-    if (typeof nonceStore.close === "function") nonceStore.close();
+    if (typeof store.close === "function") store.close();
     if (sessionStore && typeof sessionStore.close === "function") sessionStore.close();
   };
   // Expose for tests / operator dashboards. Counts are 0 in per-request mode.

package/lib/middleware/assetlinks.js

@@ -28,6 +28,7 @@
 var lazyRequire = require("../lazy-require");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response");
 var { defineClass } = require("../framework-error");
 
 var AssetlinksError = defineClass("AssetlinksError", { alwaysPermanent: true });
@@ -108,13 +109,7 @@ function create(opts) {
     var path = qIdx === -1 ? url : url.slice(0, qIdx);
     if (path !== "/.well-known/assetlinks.json") return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
-      var bodyMsg = "Method Not Allowed";
-      res.writeHead(405, {                                                       // HTTP 405 status
-        "Allow":          "GET, HEAD",
-        "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": Buffer.byteLength(bodyMsg),
-      });
-      res.end(bodyMsg);
+      denyResponse.methodNotAllowed(res, "GET, HEAD");
       return;
     }
     res.writeHead(200, {                                                         // HTTP 200 status

package/lib/middleware/bearer-auth.js

@@ -38,6 +38,7 @@ var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
+var codepointClass = require("../codepoint-class");
 var { AuthError } = require("../framework-error");
 
 var audit = lazyRequire(function () { return require("../audit"); });
@@ -164,7 +165,7 @@ function create(opts) {
     }
     for (var ri = 0; ri < realm.length; ri += 1) {
       var rcode = realm.charCodeAt(ri);
-      if (rcode < 32 || rcode === 127) {                                  // ASCII control codepoints
+      if (codepointClass.isForbiddenControlChar(rcode, { forbidTab: true })) {  // ASCII control codepoints
         throw new AuthError("auth-bearer/bad-realm",
           "realm contains control character at index " + ri);
       }