@blamejs/core 0.15.12 → 0.15.14

package/lib/middleware/body-parser.js

@@ -115,6 +115,8 @@
  */
 
 var nodeFs = require("node:fs");
+var pick = require("../pick");
+var numericBounds = require("../numeric-bounds");
 var os = require("node:os");
 var nodePath = require("node:path");
 var nodeCrypto = require("node:crypto");
@@ -164,7 +166,6 @@ var BodyParserError = defineClass("BodyParserError", { withStatusCode: true });
 // Mirrors safe-json.js + safe-schema.js. Field names that match these
 // are refused at the parse boundary regardless of which sub-parser is
 // in play — consistent prototype-pollution defense across the framework.
-var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 // Materialize a header/parameter map from request-derived [key, value]
 // pairs WITHOUT a computed member write (`target[key] = value`). A
@@ -183,7 +184,7 @@ var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 function _mapFromPairs(pairs) {
   var safe = [];
   for (var i = 0; i < pairs.length; i++) {
-    if (POISONED_KEYS.has(pairs[i][0])) continue;
+    if (pick.isPoisonedKey(pairs[i][0])) continue;
     safe.push(pairs[i]);
   }
   return Object.assign(Object.create(null), Object.fromEntries(safe));
@@ -256,29 +257,31 @@ function _contentType(req) {
     // would slice through quoted commas/semicolons and corrupt the
     // multipart boundary. Use the shared quote-aware splitter that
     // tracks RFC 8941 §3.3.3 quoted-string state with backslash-escape.
-    var parts = structuredFields.splitTopLevel(rest, ";");
-    for (var i = 0; i < parts.length; i++) {
-      var p = parts[i].trim();
-      var eq = p.indexOf("=");
-      if (eq === -1) continue;
-      var k = p.slice(0, eq).trim().toLowerCase();
-      var v = p.slice(eq + 1).trim();
+    var kvps = structuredFields.parseKeyValuePieces(
+      structuredFields.splitTopLevel(rest, ";"));
+    structuredFields.forEachKeyValue(kvps, function (key, v) {
       var _unq = structuredFields.unquoteSfString(v);
       if (_unq !== null) v = _unq;
-      paramPairs.push([k, v]);
-    }
+      paramPairs.push([key, v]);
+    });
   }
   return { type: type, params: _mapFromPairs(paramPairs) };
 }
 
 function _typeMatches(actual, allowed) {
+  var ab = actual.split("/");
   for (var i = 0; i < allowed.length; i++) {
     var a = allowed[i].toLowerCase();
-    // Match either exact type or "type/*" prefix
+    // Exact match, or component-wise wildcard where `*` in either the type or
+    // subtype segment matches any value — so "*/*" (the raw() default) matches
+    // every type, "type/*" matches a whole type, and "*/json" matches a
+    // subtype across types. (A literal indexOf on "*/" never matched a real
+    // Content-Type, which made the "*/*" default reject every request.)
     if (a === actual) return true;
-    var slash = a.indexOf("/");
-    if (slash !== -1 && a.slice(slash + 1) === "*" &&
-        actual.indexOf(a.slice(0, slash + 1)) === 0) return true;
+    var pb = a.split("/");
+    if (pb.length === 2 && ab.length === 2 &&
+        (pb[0] === "*" || pb[0] === ab[0]) &&
+        (pb[1] === "*" || pb[1] === ab[1])) return true;
   }
   return false;
 }
@@ -430,26 +433,17 @@ function _bufferBody(req, limit) {
         return;
       }
     }
-    var collector = safeBuffer.boundedChunkCollector({
+    safeBuffer.collectStream(req, {
       maxBytes:    limit,
       errorClass:  BodyParserError,
       sizeCode:    "body-parser/too-large",
       sizeMessage: "request body exceeds limit",
+    }).then(resolve, function (e) {
+      // The drain-overflow guard (a second line of defense behind the
+      // Content-Length pre-check above) carries the 413 status code.
+      if (e && e.isBodyParserError) e.statusCode = HTTP_STATUS.PAYLOAD_TOO_LARGE;
+      reject(e);
     });
-    var done = false;
-    req.on("data", function (chunk) {
-      if (done) return;
-      try { collector.push(chunk); }
-      catch (e) {
-        done = true;
-        try { req.destroy(); } catch (_e) { /* socket already closed */ }
-        if (e && e.isBodyParserError) e.statusCode = HTTP_STATUS.PAYLOAD_TOO_LARGE;
-        reject(e);
-        return;
-      }
-    });
-    req.on("end", function () { if (!done) { done = true; resolve(collector.result()); } });
-    req.on("error", function (e) { if (!done) { done = true; reject(e); } });
   });
 }
 
@@ -520,7 +514,7 @@ async function _parseUrlencoded(req, opts) {
   for (var i = 0; i < keys.length; i++) {
     var k = keys[i][0];
     var v = keys[i][1];
-    if (POISONED_KEYS.has(k)) {
+    if (pick.isPoisonedKey(k)) {
       throw new BodyParserError(
         "body-parser/urlencoded-poisoned-key",
         "urlencoded body contains forbidden key '" + k + "' (prototype-pollution defense)",
@@ -644,10 +638,10 @@ function _parseMultipartHeaders(rawHeaders) {
         true, HTTP_STATUS.BAD_REQUEST
       );
     }
-    var idx = line.indexOf(":");
-    if (idx === -1) continue;
-    var k = line.slice(0, idx).trim().toLowerCase();
-    var v = line.slice(idx + 1).trim();
+    var khv = structuredFields.parseKeyValuePiece(line, ":");
+    if (khv.value === null) continue;
+    var k = khv.key;
+    var v = khv.value.trim();
     for (var j = 0; j < v.length; j++) {
       var c = v.charCodeAt(j);
       if (c === 0 || c === 10 || c === 13) {                                      // NUL/LF/CR forbidden in field-value (RFC 9110 §5.5)
@@ -736,12 +730,8 @@ function _parseHeaderParams(headerValue, filenameCharsets) {
   // it last so Object.fromEntries' last-wins resolves it.
   var paramPairs = [["_value", parts[0].trim().toLowerCase()]];
   var extName = null;
-  for (var i = 1; i < parts.length; i++) {
-    var p = parts[i].trim();
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    var k = p.slice(0, eq).trim().toLowerCase();
-    var v = p.slice(eq + 1).trim();
+  var kvps = structuredFields.parseKeyValuePieces(parts, 1);
+  structuredFields.forEachKeyValue(kvps, function (k, v) {
     var _unq = structuredFields.unquoteSfString(v);
     if (_unq !== null) v = _unq;
     if (k.charAt(k.length - 1) === "*") {
@@ -751,10 +741,10 @@ function _parseHeaderParams(headerValue, filenameCharsets) {
         if (bareKey === "filename") extName = decoded;
         paramPairs.push([bareKey, decoded]);
       }
-      continue;
+      return;
     }
     paramPairs.push([k, v]);
-  }
+  });
   if (extName !== null) paramPairs.push(["filename", extName]);
   return _mapFromPairs(paramPairs);
 }
@@ -952,7 +942,7 @@ async function _parseMultipart(req, opts, ctParams) {
             // Read until \r\n\r\n.
             var headEnd = pending.indexOf("\r\n\r\n");
             if (headEnd === -1) {
-              if (pending.length > C.BYTES.kib(16)) {
+              if (safeBuffer.byteLengthOf(pending) > C.BYTES.kib(16)) {
                 done(new BodyParserError("body-parser/multipart-headers-too-large",
                   "multipart part headers exceed 16KB", true, 413));
                 return;
@@ -986,7 +976,7 @@ async function _parseMultipart(req, opts, ctParams) {
                 "multipart part missing form-data Content-Disposition", true, HTTP_STATUS.BAD_REQUEST));
               return;
             }
-            if (POISONED_KEYS.has(cd.name)) {
+            if (pick.isPoisonedKey(cd.name)) {
               done(new BodyParserError("body-parser/multipart-poisoned-field",
                 "multipart field '" + cd.name + "' is forbidden (prototype-pollution defense)",
                 true, HTTP_STATUS.BAD_REQUEST));
@@ -1654,12 +1644,9 @@ function _resolveStandaloneMultipartOpts(opts, ct) {
   }
   if (opts.maxFiles !== undefined) {
     var mf = opts.maxFiles;
-    var mfBad = typeof mf !== "number" || !isFinite(mf) || mf <= 0 || Math.floor(mf) !== mf;
-    if (mfBad) {
-      throw new BodyParserError("body-parser/bad-max-files",
-        "parsers.multipart: opts.maxFiles must be a positive integer",
-        true, HTTP_STATUS.BAD_REQUEST);
-    }
+    numericBounds.requirePositiveFiniteInt(mf,
+      "parsers.multipart: opts.maxFiles", BodyParserError, "body-parser/bad-max-files",
+      null, { permanent: true, statusCode: HTTP_STATUS.BAD_REQUEST });
     resolved.fileCount = mf;
   }
   // Pass-through overrides for the multipart-specific knobs the middleware
@@ -1705,5 +1692,7 @@ module.exports = {
   _contentType:     _contentType,
   _hasBody:         _hasBody,
   _sanitizeFilename: _sanitizeFilename,
-  POISONED_KEYS:    POISONED_KEYS,
+  // Sourced from the canonical pick primitive (no hand-rolled set); a fresh
+  // Set so the long-standing `instanceof Set` shape of this export is kept.
+  POISONED_KEYS:    new Set(pick.POISONED_KEYS),
 };

package/lib/middleware/bot-disclose.js

@@ -30,6 +30,7 @@ var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 var safeBuffer = require("../safe-buffer");
+var requestHelpers = require("../request-helpers");
 
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -93,17 +94,13 @@ function create(opts) {
   var actionBase = typeof opts.auditAction === "string" && opts.auditAction.length > 0
     ? opts.auditAction : "middleware.bot_disclose";
 
+  // null mountPaths = apply to every route; otherwise reuse the shared
+  // segment-boundary matcher (built once).
+  var _mountMatch = mountPaths
+    ? requestHelpers.makeSkipMatcher({ skipPaths: mountPaths }, "middleware.botDisclose")
+    : null;
   function _matches(req) {
-    if (!mountPaths) return true;                                                        // null = match every path
-    var p = req.url || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < mountPaths.length; i++) {
-      var m = mountPaths[i];
-      if (typeof m === "string" && (p === m || p.indexOf(m + "/") === 0)) return true;
-      if (m instanceof RegExp && m.test(p)) return true;
-    }
-    return false;
+    return _mountMatch ? _mountMatch(req) : true;
   }
 
   function _emitAudit(action, outcome, metadata) {

package/lib/middleware/bot-guard.js

@@ -71,17 +71,6 @@ function _coerceAgentPattern(r, where) {
     "in operator code)");
 }
 
-// Bot-guard's "trust the proxy header" semantics for actor.ip — the
-// audit event records the apparent source even when behind a CDN, but
-// only when the operator opts in to trustProxy. Without the opt, we
-// stick to socket.remoteAddress so an attacker-forged XFF can't
-// pollute audit attribution.
-function _xffIpFor(trustProxy) {
-  return function (req) {
-    return requestHelpers.clientIp(req, { trustProxy: trustProxy });
-  };
-}
-
 /**
  * @primitive b.middleware.botGuard
  * @signature b.middleware.botGuard(req, res, next)
@@ -115,7 +104,10 @@ function _xffIpFor(trustProxy) {
  *     bodyOnBlock:   string,
  *     onDeny:        function(req, res, info): void,  // own the block response; info = { status, reason }
  *     problemDetails: boolean,          // default false — emit RFC 9457 application/problem+json instead of text/plain
- *     trustProxy:    boolean|number,
+ *     trustedProxies: string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-For / -Proto
+ *     clientIpResolver: function(req): string|null,    // own the audit-actor IP
+ *     protocolResolver: function(req): "http"|"https", // own the secure-context decision
+ *     trustProxy:    boolean|number,    // legacy; refused unless paired with trustedProxies/resolver (spoofable)
  *   }
  *
  * @example
@@ -131,11 +123,26 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "mode", "onlyForHtml", "allowedAgents", "blockedAgents",
-    "skipPaths", "statusOnBlock", "bodyOnBlock", "onDeny", "problemDetails", "trustProxy",
+    "skipPaths", "statusOnBlock", "bodyOnBlock", "onDeny", "problemDetails",
+    "trustProxy", "trustedProxies", "clientIpResolver", "protocolResolver",
   ], "middleware.botGuard");
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _xffIp = _xffIpFor(trustProxy);
+  // The single trustProxy opt drives two forwarded-header reads: the audit
+  // actor.ip (X-Forwarded-For) and the secure-context check (X-Forwarded-Proto,
+  // see _isSecureContext). Both are peer-gated — declare your reverse proxies
+  // via trustedProxies (CIDRs), or own resolution via clientIpResolver /
+  // protocolResolver. A bare trustProxy is refused: it would trust forgeable
+  // headers from any caller.
+  var _ipResolver, _proto;
+  try {
+    _ipResolver = requestHelpers.trustedClientIp({ trustedProxies: opts.trustedProxies, clientIpResolver: opts.clientIpResolver });
+    _proto      = requestHelpers.trustedProtocol({ trustedProxies: opts.trustedProxies, protocolResolver: opts.protocolResolver });
+  } catch (e) { throw new BotGuardError("bot-guard/bad-opt", e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_ipResolver.peerGated) {
+    throw new BotGuardError("bot-guard/bad-opt",
+      "trustProxy is spoofable — a direct caller could forge X-Forwarded-For / -Proto. Declare " +
+      "your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] or supply clientIpResolver / protocolResolver.");
+  }
+  var _xffIp = _ipResolver.resolve;
   var mode = opts.mode || "block";
   var onlyForHtml = opts.onlyForHtml !== false;
   var allowedAgents = (opts.allowedAgents || []).map(function (r, i) {
@@ -144,21 +151,13 @@ function create(opts) {
   var blockedAgents = DEFAULT_BLOCKED_AGENTS.concat((opts.blockedAgents || []).map(function (r, i) {
     return _coerceAgentPattern(r, "middleware.botGuard: blockedAgents[" + i + "]");
   }));
-  var skipPaths = opts.skipPaths || [];
   var statusOnBlock = opts.statusOnBlock || 403;
   var bodyOnBlock = opts.bodyOnBlock !== undefined ? opts.bodyOnBlock : "Forbidden";
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
 
-  function _shouldSkip(req) {
-    var path = req.pathname || req.url || "/";
-    for (var i = 0; i < skipPaths.length; i++) {
-      if (typeof skipPaths[i] === "string" ? path.indexOf(skipPaths[i]) === 0 : skipPaths[i].test(path)) {
-        return true;
-      }
-    }
-    return false;
-  }
+  // Path-exemption predicate (string-prefix or RegExp), validated at create().
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.botGuard");
 
   function _looksLikeApi(req) {
     var path = req.pathname || req.url || "/";
@@ -171,9 +170,10 @@ function create(opts) {
   // app, a LAN / *.local reverse-proxy deployment — the browser omits
   // Sec-Fetch-* entirely, so a missing Sec-Fetch-Mode is NORMAL there and
   // must not be read as a bot signal. The effective scheme honours
-  // X-Forwarded-Proto only under trustProxy (otherwise it is forgeable).
+  // X-Forwarded-Proto only from a trusted proxy peer (peer-gated), else the
+  // real TLS socket — a direct caller's forged header is ignored.
   function _isSecureContext(req) {
-    if (requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https") return true;
+    if (_proto.resolve(req) === "https") return true;
     var host = (req.headers && req.headers.host) || "";
     host = String(host).toLowerCase().replace(/:\d+$/, "");   // strip :port
     if (host.charAt(0) === "[") {                              // [::1] IPv6 literal

package/lib/middleware/clear-site-data.js

@@ -113,7 +113,11 @@ function headerValue(types, label) {
   }
   for (var i = 0; i < types.length; i += 1) {
     var t = types[i];
-    if (typeof t !== "string" || !KNOWN_TYPES[t]) {
+    // hasOwnProperty, not `KNOWN_TYPES[t]`: a bracket lookup on the plain-object
+    // allowlist resolves inherited members ("toString" / "constructor" /
+    // "hasOwnProperty") to truthy functions, so those would pass validation and
+    // be emitted as bogus Clear-Site-Data directives (prototype shadowing).
+    if (typeof t !== "string" || !Object.prototype.hasOwnProperty.call(KNOWN_TYPES, t)) {
       throw new TypeError(
         label + ": unknown type '" + t +
         "' (expected one of: " + Object.keys(KNOWN_TYPES).join(", ") + ")");

package/lib/middleware/compression.js

@@ -328,6 +328,15 @@ function create(opts) {
       // Status precludes body? skip.
       if (NO_BODY_STATUS.has(statusCode)) { compress = false; return; }
 
+      // 206 Partial Content / any Content-Range response must pass through
+      // UNtransformed (RFC 7233 §4.1) — compressing it drops Content-Length but
+      // leaves Content-Range advertising an uncompressed byte interval over a
+      // now-compressed body, corrupting range-assembling clients.
+      if (statusCode === 206) { compress = false; return; }
+      var crRange = (headersObj && headersObj["content-range"]) ||
+                    (originalGetHeader && originalGetHeader("Content-Range"));
+      if (crRange) { compress = false; return; }
+
       // Already compressed by the handler / earlier middleware? skip.
       var existingCE = (headersObj && headersObj["content-encoding"]) ||
                        (originalGetHeader && originalGetHeader("Content-Encoding"));

package/lib/middleware/cors.js

@@ -58,15 +58,6 @@ var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 
-// CORS audit events use the proxy-aware client IP only when the
-// operator opts in via `trustProxy`. Default refuses forwarded
-// headers — same boundary as the rest of the v0.5.3 trustProxy sweep.
-function _xffIpFor(trustProxy) {
-  return function (req) {
-    return requestHelpers.clientIp(req, { trustProxy: trustProxy });
-  };
-}
-
 var CorsError = defineClass("CorsError", { alwaysPermanent: true });
 
 // allowList entries:
@@ -117,17 +108,18 @@ function _canonicalOrigin(input) {
 // supplied. Works for direct deployments (no proxy); operators behind
 // a TLS-terminating proxy that doesn't forward correct Host should set
 // opts.siteOrigin explicitly.
-function _inferRequestOrigin(req, trustProxy) {
+function _inferRequestOrigin(req, protoResolve) {
   if (!req || !req.headers) return null;
   var host = req.headers.host;
   if (!host) return null;
-  // Protocol resolution honors the operator's trustProxy opt — without
-  // it, X-Forwarded-Proto is ignored as attacker-forgeable.
-  var proto = requestHelpers.requestProtocol(req, { trustProxy: trustProxy });
+  // Peer-gated protocol resolution — X-Forwarded-Proto is honored only from a
+  // trusted proxy (else the TLS socket), so a direct caller can't forge the
+  // inferred origin's scheme to slip past the same-origin check.
+  var proto = protoResolve(req);
   return _canonicalOrigin(proto + "://" + host);
 }
 
-function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, strictNullOrigin) {
+function _isSameOrigin(req, originHeader, configuredSiteOrigins, protoResolve, strictNullOrigin) {
   // Origin: null arrives when a browser opaques the Origin (e.g.
   // Referrer-Policy: no-referrer on the page). Sec-Fetch-Site can
   // distinguish the same-origin case, but non-browser clients can forge
@@ -150,10 +142,10 @@ function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, str
     }
     return false;
   }
-  // Fall back to inferring from the request itself. trustProxy threads
-  // through so operators behind a TLS terminator with X-Forwarded-Proto
-  // can opt in to consult the header.
-  var reqOrigin = _inferRequestOrigin(req, trustProxy);
+  // Fall back to inferring from the request itself. The peer-gated protocol
+  // resolver threads through so operators behind a TLS terminator consult
+  // X-Forwarded-Proto only from a trusted peer.
+  var reqOrigin = _inferRequestOrigin(req, protoResolve);
   return reqOrigin !== null && reqOrigin === canonOrigin;
 }
 
@@ -185,7 +177,10 @@ function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, str
  *     maxAgeSeconds:    number,     // default 600
  *     refuseUnknown:    boolean,    // default true
  *     strictNullOrigin: boolean,    // default true
- *     trustProxy:       boolean|number,
+ *     trustedProxies:   string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto for same-origin inference
+ *     protocolResolver: function(req): "http"|"https",  // own the HTTPS decision
+ *     clientIpResolver: function(req): string|null,     // own the audit-actor IP
+ *     trustProxy:       boolean|number,    // legacy; refused unless paired with trustedProxies/resolver (spoofable)
  *     onDeny:           function(req, res, info): void,  // own every refusal; info = { status, reason, origin, header? }
  *     problemDetails:   boolean,    // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
@@ -205,11 +200,25 @@ function create(opts) {
   validateOpts(opts, [
     "origins", "siteOrigin", "methods", "headers", "exposeHeaders",
     "credentials", "maxAgeSeconds", "refuseUnknown", "trustProxy",
+    "trustedProxies", "clientIpResolver", "protocolResolver",
     "strictNullOrigin", "allowPrivateNetwork", "onDeny", "problemDetails",
   ], "middleware.cors");
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _xffIp = _xffIpFor(trustProxy);
+  // The request scheme feeds the same-origin determination, and a bare
+  // trustProxy trusts a forgeable X-Forwarded-Proto from any caller. Peer-gate
+  // both protocol and the audit-actor IP via trustedProxies (CIDRs) or own them
+  // via protocolResolver / clientIpResolver. A bare trustProxy is refused.
+  var _proto, _ip;
+  try {
+    _proto = requestHelpers.trustedProtocol({ trustedProxies: opts.trustedProxies, protocolResolver: opts.protocolResolver });
+    _ip    = requestHelpers.trustedClientIp({ trustedProxies: opts.trustedProxies, clientIpResolver: opts.clientIpResolver });
+  } catch (e) { throw new CorsError("cors/bad-opt", e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_proto.peerGated) {
+    throw new CorsError("cors/bad-opt",
+      "trustProxy is spoofable — a direct caller could forge X-Forwarded-Proto to alter the " +
+      "same-origin decision. Declare your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] " +
+      "or supply protocolResolver(req) / clientIpResolver(req).");
+  }
+  var _xffIp = _ip.resolve;
 
   // Build a canonicalized allowList at create() time. String entries
   // get parsed through _canonicalOrigin so case + default-port
@@ -296,7 +305,7 @@ function create(opts) {
     // Same-origin POST/PUT/etc. carry an Origin header per the Fetch
     // spec but should not be subject to CORS allow-listing — they're
     // the operator's own site talking to itself.
-    if (_isSameOrigin(req, origin, siteOrigins, trustProxy, strictNullOrigin)) return next();
+    if (_isSameOrigin(req, origin, siteOrigins, _proto.resolve, strictNullOrigin)) return next();
 
     var matched = _matchOrigin(origin, origins);
     if (!matched) {

package/lib/middleware/csrf-protect.js

@@ -67,6 +67,7 @@
  *   }
  */
 var lazyRequire = require("../lazy-require");
+var pick = require("../pick");
 var forms = require("../forms");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -76,6 +77,9 @@ var audit = lazyRequire(function () { return require("../audit"); });
 var DEFAULT_FIELD_NAME    = "_csrf";
 var DEFAULT_HEADER_NAME   = "X-CSRF-Token";
 var DEFAULT_METHODS       = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
+// Per-process counter giving each csrfProtect mount a unique idempotency id so
+// a stricter sub-route instance is not silently disabled by an earlier one.
+var _csrfGateSeq = 0;
 
 // Default cookie name uses the RFC 6265bis __Host- prefix when the request
 // is over HTTPS. The prefix forces browsers to refuse the cookie unless
@@ -111,7 +115,7 @@ function _parseCookieHeader(header) {
     if (eq === -1) continue;
     var k = p.slice(0, eq).trim();
     if (k.length === 0) continue;
-    if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+    if (pick.isPoisonedKey(k)) continue;
     if (seen.has(k)) continue;  // first-occurrence wins
     seen.add(k);
     var v = p.slice(eq + 1).trim();
@@ -123,17 +127,6 @@ function _parseCookieHeader(header) {
   return Object.assign(Object.create(null), Object.fromEntries(pairs));
 }
 
-// `_isHttps` defers to `requestHelpers.requestProtocol` so the
-// per-middleware `trustProxy` opt gates whether X-Forwarded-Proto is
-// consulted. Without trustProxy, an attacker could otherwise forge
-// the header to force the Secure cookie attribute (and inversely,
-// suppress it) on direct-to-server connections.
-function _isHttpsFor(trustProxy) {
-  return function (req) {
-    return requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https";
-  };
-}
-
 function _formatSetCookie(name, value, opts) {
   var parts = [name + "=" + value];
   parts.push("Path=" + (opts.path || "/"));
@@ -274,7 +267,9 @@ function _writeReject(req, res, message, reason, onDeny, problemMode) {
  *     allowedOrigins:         string[],
  *     requireOrigin:          boolean,
  *     requireJsonContentType: boolean,
- *     trustProxy:             boolean|number,
+ *     trustedProxies:         string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto for the Secure-cookie decision
+ *     protocolResolver:       function(req): "http"|"https",  // own the HTTPS decision
+ *     trustProxy:             boolean|number,    // legacy; refused unless paired with trustedProxies/protocolResolver (spoofable)
  *     audit:                  boolean,
  *     skipStateless:          boolean,   // default false — skip validation for Authorization-header / cookieless (not-CSRF-able) requests
  *     onDeny:                 function(req, res, info): void,  // own the 403; info = { status, reason }
@@ -295,14 +290,31 @@ function create(opts) {
 
   validateOpts(opts, [
     "cookie", "tokenLookup", "fieldName", "headerName", "methods", "audit",
-    "trustProxy", "checkOrigin", "allowedOrigins", "requireJsonContentType",
-    "requireOrigin", "skipStateless", "onDeny", "problemDetails",
+    "trustProxy", "trustedProxies", "protocolResolver",
+    "checkOrigin", "allowedOrigins", "requireJsonContentType",
+    "requireOrigin", "skipStateless", "skipPaths", "skip", "onDeny", "problemDetails",
   ], "middleware.csrfProtect");
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _isHttps = _isHttpsFor(trustProxy);
+  // The Secure-cookie decision turns on whether the request is HTTPS, which
+  // behind a proxy comes from X-Forwarded-Proto. A bare trustProxy trusts that
+  // forgeable header from any caller — a direct request could suppress the
+  // Secure flag (cookie downgrade) or force it. Peer-gate it: declare your
+  // reverse proxies via trustedProxies, or own the decision via
+  // protocolResolver. A bare trustProxy is refused at construction.
+  var _proto;
+  try {
+    _proto = requestHelpers.trustedProtocol({
+      trustedProxies:   opts.trustedProxies,
+      protocolResolver: opts.protocolResolver,
+    });
+  } catch (e) { throw new Error("middleware.csrfProtect: " + e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_proto.peerGated) {
+    throw new Error("middleware.csrfProtect: trustProxy is spoofable for the Secure-cookie " +
+      "decision — a direct caller could forge X-Forwarded-Proto. Declare your reverse proxies " +
+      "via trustedProxies: [\"10.0.0.0/8\", …] or supply protocolResolver(req).");
+  }
+  function _isHttps(req) { return _proto.resolve(req) === "https"; }
 
   // Throw at create() — exactly one issuance source allowed.
   var hasCookie = opts.cookie != null && opts.cookie !== false;
@@ -317,8 +329,22 @@ function create(opts) {
 
   var fieldName  = opts.fieldName  || DEFAULT_FIELD_NAME;
   var headerName = (opts.headerName || DEFAULT_HEADER_NAME).toLowerCase();
+  // An empty methods array is truthy → `opts.methods || DEFAULT_METHODS` keeps
+  // `[]` and the method-gate matches nothing, silently disabling the primary
+  // CSRF check for all state-changing requests. Reject at config time.
+  if (opts.methods !== undefined) {
+    if (!Array.isArray(opts.methods) || opts.methods.length === 0 ||
+        !opts.methods.every(function (m) { return typeof m === "string" && m.length > 0; })) {
+      throw new Error("middleware.csrfProtect: opts.methods must be a non-empty array of HTTP method tokens (omit it for the POST/PUT/DELETE/PATCH default)");
+    }
+  }
   var methods    = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
   var auditOn    = opts.audit !== false;
+  // Per-instance idempotency id — a stricter sub-route csrf mount must not be
+  // silently disabled by an earlier lenient one sharing a global flag (token
+  // issue is idempotent and double-validate is safe, so per-instance re-run is
+  // sound).
+  var GATE_ID = "csrf:" + (_csrfGateSeq++);
 
   // Origin / Referer cross-check — second-line defense alongside the
   // double-submit token. If the request's Origin (or Referer when
@@ -368,6 +394,13 @@ function create(opts) {
   // request always carries a Cookie header and is validated.
   var skipStateless = opts.skipStateless === true;
 
+  // Per-path exemption (string-prefix / RegExp / skip predicate), validated at
+  // create(). Lets one route (an RFC 8058 List-Unsubscribe-Post endpoint, a
+  // webhook, a bearer-token API path on the same app) opt out of the
+  // double-submit check while the app-level mount stays in place — the token is
+  // still issued for any later browser flow.
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.csrfProtect");
+
   // Cookie issuance config (only when opts.cookie is set).
   var cookieCfg = null;
   if (hasCookie) {
@@ -444,6 +477,17 @@ function create(opts) {
       req.csrfToken = existing;
       return existing;
     }
+    // Cookie issuance is idempotent at the RESPONSE level, keyed by cookie
+    // name: a redundant mount (createApp wired csrf AND an operator re-mounted
+    // it with the same cookie name) must emit a single Set-Cookie, not one per
+    // instance. Enforcement stays per instance (each gate still validates the
+    // token below) — only the response-cookie resource is deduped, so a mount
+    // with a DIFFERENT cookie name still issues its own.
+    if (!req._csrfIssuedCookies) req._csrfIssuedCookies = Object.create(null);
+    if (Object.prototype.hasOwnProperty.call(req._csrfIssuedCookies, cookieName)) {
+      req.csrfToken = req._csrfIssuedCookies[cookieName];
+      return req.csrfToken;
+    }
     if (existing && !/^[a-f0-9]{64}$/.test(existing)) {
       // Audit-emit so operators see when a planted/short cookie is
       // refused — surfaces the attack class in compliance logs.
@@ -464,22 +508,28 @@ function create(opts) {
       maxAge:   cookieCfg.maxAge,
     });
     _appendSetCookie(res, setCookie);
+    req._csrfIssuedCookies[cookieName] = fresh;
     req.csrfToken = fresh;
     return fresh;
   }
 
   return function csrfProtect(req, res, next) {
-    // Idempotent: a second csrf mount this request (e.g. createApp wired
-    // it AND an operator mounted it again) is a no-op — the first instance
-    // already issued + validated.
-    if (req._csrfApplied) return next();
-    req._csrfApplied = true;
+    // Idempotent PER INSTANCE: the SAME mount running twice (createApp wired it
+    // AND an operator mounted it again) is a no-op, but a distinct stricter
+    // sub-route instance still runs — a shared global flag let the first
+    // (lenient) mount disable the second.
+    if (!req._csrfGates) req._csrfGates = Object.create(null);
+    if (req._csrfGates[GATE_ID]) return next();
+    req._csrfGates[GATE_ID] = true;
 
     // Issue/refresh the token on EVERY request (safe + state-changing)
     // when running in cookie mode — templates rendered after a POST
     // (e.g. error response) still need req.csrfToken populated.
     var expected = _issueIfNeeded(req, res);
 
+    // Exempt routes skip the double-submit check (token still issued above).
+    if (_shouldSkip(req)) return next();
+
     if (methods.indexOf(req.method) === -1) return next();
 
     // Stateless / token-authenticated requests are not CSRF-able — the