@blamejs/core 0.15.12 → 0.15.14

package/lib/middleware/daily-byte-quota.js

@@ -107,7 +107,6 @@ function create(opts) {
   }
   var bytesPerDay = opts.bytesPerDay;
   var getKey = typeof opts.getKey === "function" ? opts.getKey : _defaultGetKey;
-  var auditOn = opts.audit !== false;
   // onDeny is the canonical hook across the deny-path middleware
   // family; onExceeded is the original name kept working as an alias.
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny
@@ -127,33 +126,14 @@ function create(opts) {
   });
   var backend = quota._backend;
 
-  function _shouldSkip(req) {
-    if (skipPaths.length === 0) return false;
-    var p = req.url || req.originalUrl || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < skipPaths.length; i++) {
-      if (typeof skipPaths[i] === "string" && p === skipPaths[i]) return true;
-      if (skipPaths[i] instanceof RegExp && skipPaths[i].test(p)) return true;
-    }
-    return false;
-  }
+  // exact:true preserves this guard's whole-path skip semantics (no descendant
+  // match); makeSkipMatcher strips the query + resolves url || originalUrl.
+  var _shouldSkip = requestHelpers().makeSkipMatcher(
+    { skipPaths: skipPaths, exact: true }, "middleware.dailyByteQuota");
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "middleware.daily_byte_quota." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit is best-effort */ }
-  }
+  var _emitAudit = audit().namespaced("middleware.daily_byte_quota", opts.audit);
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("middleware.daily_byte_quota." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("middleware.daily_byte_quota");
 
   return async function dailyByteQuotaMiddleware(req, res, next) {
     if (_shouldSkip(req)) return next();
@@ -207,13 +187,15 @@ function create(opts) {
     // is observed via writableLength as res.write / res.end fire.
     var inboundBytes = 0;
     if (req.headers && typeof req.headers === "object") {
-      // Approximate: each header line is "Name: Value\r\n". Sum the
-      // string lengths; the actual byte count differs only on multi-
-      // byte UTF-8, which is uncommon in standard headers.
+      // Each header line is "Name: Value\r\n". Count UTF-8 BYTES (not .length
+      // / UTF-16 code units) so a multibyte header value isn't under-accounted
+      // against the byte quota — matching the outbound counting below, which
+      // already uses Buffer.byteLength.
       var keys = Object.keys(req.headers);
       for (var hi = 0; hi < keys.length; hi++) {
         var v = req.headers[keys[hi]];
-        inboundBytes += keys[hi].length + 2 + (typeof v === "string" ? v.length : 0) + 2;        // ": " + "\r\n" overhead
+        inboundBytes += Buffer.byteLength(keys[hi], "utf8") + 2 +
+          (typeof v === "string" ? Buffer.byteLength(v, "utf8") : 0) + 2;                         // ": " + "\r\n" overhead
       }
     }
     if (req.headers && req.headers["content-length"]) {

package/lib/middleware/deny-response.js

@@ -147,6 +147,24 @@ function denyResponse(req, res, ctx) {
   return undefined;
 }
 
+// methodNotAllowed(res, allow) — write the bare HTTP 405 refusal the
+// single-file static-content middlewares (assetlinks / security.txt / web-app-
+// manifest) share: an `Allow` header plus a `text/plain` "Method Not Allowed"
+// body with an explicit Content-Length. Kept separate from denyResponse() (the
+// hook-aware, problem+json-capable refusal path) so the static handlers emit a
+// fixed, minimal response — `allow` is the comma-joined method list (e.g.
+// "GET, HEAD").
+function methodNotAllowed(res, allow) {
+  var bodyMsg = "Method Not Allowed";
+  res.writeHead(405, {                                                           // HTTP 405 status
+    "Allow":          allow,
+    "Content-Type":   "text/plain; charset=utf-8",
+    "Content-Length": Buffer.byteLength(bodyMsg),
+  });
+  res.end(bodyMsg);
+}
+
 module.exports = {
-  denyResponse: denyResponse,
+  denyResponse:     denyResponse,
+  methodNotAllowed: methodNotAllowed,
 };

package/lib/middleware/fetch-metadata.js

@@ -42,6 +42,10 @@ var audit = lazyRequire(function () { return require("../audit"); });
 var observability = lazyRequire(function () { return require("../observability"); });
 
 var DEFAULT_METHODS = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
+// Monotonic per-process counter giving each fetchMetadata mount a unique
+// idempotency id (see GATE_ID in create) so a stricter sub-route instance is
+// not silently disabled by an earlier lenient one sharing a global flag.
+var _fmGateSeq = 0;
 
 // Sec-Fetch-Dest request-destination vocabulary (Fetch Standard §3.2.6
 // "destination", https://fetch.spec.whatwg.org/#concept-request-destination;
@@ -81,7 +85,7 @@ function _validateDestList(list, label) {
   // the typo surfaces before it silently fails to match at request time.
   if (!Array.isArray(list)) return;
   for (var i = 0; i < list.length; i += 1) {
-    if (!KNOWN_DEST_SET[list[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_DEST_SET, list[i])) {
       throw new Error("middleware.fetchMetadata: " + label + "[" + i +
         "] is not a known Sec-Fetch-Dest value (got '" + String(list[i]) +
         "'). Known destinations: " + KNOWN_DESTINATIONS.join(", ") + ".");
@@ -165,6 +169,7 @@ function create(opts) {
     "allowSameSite", "allowCrossSite", "allowMissing",
     "allowedDest", "deniedDest", "allowStorageAccess", "strictDest",
     "allowedNavigate", "methods", "audit", "onDeny", "problemDetails",
+    "skipPaths", "skip",
   ], "middleware.fetchMetadata");
   validateOpts.optionalBoolean(opts.allowStorageAccess, "middleware.fetchMetadata: allowStorageAccess");
   validateOpts.optionalBoolean(opts.strictDest, "middleware.fetchMetadata: strictDest");
@@ -174,6 +179,11 @@ function create(opts) {
     _validateDestList(opts.deniedDest, "deniedDest");
   }
 
+  // Per-path exemption (string-prefix / RegExp / skip predicate), validated at
+  // create() — exempt a webhook / cookieless edge-cached route from the
+  // fetch-metadata gate without disabling the app-level mount.
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.fetchMetadata");
+
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
   var allowSameSite      = opts.allowSameSite !== false;
@@ -200,8 +210,26 @@ function create(opts) {
     }
   }
   var allowedNavigate = opts.allowedNavigate !== false;
+  // An empty methods array is truthy, so `opts.methods || DEFAULT_METHODS`
+  // would keep `[]` and `methods.indexOf(req.method) === -1` would be true for
+  // EVERY request — silently turning the gate into a pass-through. Reject a
+  // present-but-empty/garbage list at config time (fail-fast, don't degrade
+  // the gate to a no-op).
+  if (opts.methods !== undefined) {
+    if (!Array.isArray(opts.methods) || opts.methods.length === 0 ||
+        !opts.methods.every(function (m) { return typeof m === "string" && m.length > 0; })) {
+      throw new Error("middleware.fetchMetadata: opts.methods must be a non-empty array of HTTP method tokens (omit it for the POST/PUT/DELETE/PATCH default)");
+    }
+  }
   var methods         = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
   var auditOn         = opts.audit !== false;
+  // Per-instance idempotency id: a request carries a Set of gates that have
+  // already run. The OLD shared `req._fetchMetadataChecked` boolean let the
+  // FIRST fetch-metadata mount (e.g. the lenient app-level default) permanently
+  // disable a STRICTER instance layered on a sub-route. Keying by a unique id
+  // lets each distinct mount run once while the SAME instance mounted twice
+  // still no-ops.
+  var GATE_ID = "fm:" + (_fmGateSeq++);
 
   function _emitDenied(req, reason) {
     if (!auditOn) return;
@@ -217,9 +245,12 @@ function create(opts) {
   }
 
   return function fetchMetadata(req, res, next) {
-    // Idempotent: a second fetch-metadata mount this request is a no-op.
-    if (req._fetchMetadataChecked) return next();
-    req._fetchMetadataChecked = true;
+    // Idempotent PER INSTANCE: the same mount running twice on a request is a
+    // no-op, but a distinct (e.g. stricter sub-route) instance still evaluates.
+    if (!req._fetchMetadataGates) req._fetchMetadataGates = Object.create(null);
+    if (req._fetchMetadataGates[GATE_ID]) return next();
+    req._fetchMetadataGates[GATE_ID] = true;
+    if (_shouldSkip(req)) return next();
     if (methods.indexOf(req.method) === -1) return next();
 
     var headers = req.headers || {};

package/lib/middleware/idempotency-key.js

@@ -53,7 +53,7 @@ var cryptoField   = require("../crypto-field");
 var vault         = require("../vault");
 var { defineClass } = require("../framework-error");
 
-var audit          = lazyRequire(function () { return require("../audit"); });
+var auditEmit      = require("../audit-emit");
 var problemDetails = lazyRequire(function () { return require("../problem-details"); });
 var C              = require("../constants");
 
@@ -533,16 +533,8 @@ function dbStore(opts) {
 }
 
 function _validateStore(store, where) {
-  if (!store || typeof store !== "object") {
-    throw new IdempotencyError("idempotency/bad-store",
-      where + ": store must be an object", true);
-  }
-  if (typeof store.get !== "function" ||
-      typeof store.set !== "function" ||
-      typeof store.delete !== "function") {
-    throw new IdempotencyError("idempotency/bad-store",
-      where + ": store must implement { get, set, delete }", true);
-  }
+  validateOpts.requireMethods(store, ["get", "set", "delete"],
+    where + ": store", IdempotencyError, "idempotency/bad-store", true);
 }
 
 function _fingerprintRequest(req, bodyBytes, store) {
@@ -568,15 +560,7 @@ function _fingerprintRequest(req, bodyBytes, store) {
   return nodeCrypto.createHash("sha3-256").update(preimage).digest("hex");
 }
 
-function _emitAudit(action, metadata, outcome) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata,
-    });
-  } catch (_e) { /* best-effort */ }
-}
+var _emitAudit = auditEmit.emit;
 
 /**
  * @primitive b.middleware.idempotencyKey

package/lib/middleware/network-allowlist.js

@@ -16,12 +16,12 @@
  * the wiki example default).
  *
  *   var fence = b.middleware.networkAllowlist({
- *     paths:        ["/admin", "/admin/", "/healthz/internal"],
- *     allowedCidrs: ["10.0.0.0/8", "192.168.0.0/16", "::1/128"],
- *     trustProxy:   true,         // honour x-forwarded-for; default false
- *     denyStatus:   404,          // default — reveal nothing about the gate
- *     denyBody:     "Not Found",  // default
- *     audit:        b.audit,      // default: null — emits network.gate.denied
+ *     paths:          ["/admin", "/admin/", "/healthz/internal"],
+ *     allowedCidrs:   ["10.0.0.0/8", "192.168.0.0/16", "::1/128"],
+ *     trustedProxies: ["10.0.0.0/8"], // peer-gate XFF to your proxy range
+ *     denyStatus:     404,            // default — reveal nothing about the gate
+ *     denyBody:       "Not Found",    // default
+ *     audit:          b.audit,        // default: null — emits network.gate.denied
  *   });
  *
  *   router.use(fence);
@@ -29,9 +29,11 @@
  * Behaviour:
  *   - The middleware is path-scoped: requests whose pathname doesn't
  *     start with any of `paths` pass through unchanged. Hot-path-cheap.
- *   - Requests on a gated path get their client IP resolved through
- *     b.requestHelpers.clientIp(req, { trustProxy }) — same trust
- *     model as every other middleware that reads client IP.
+ *   - Requests on a gated path get their client IP resolved peer-gated:
+ *     the socket address by default, or — when `trustedProxies` /
+ *     `clientIpResolver` is set — X-Forwarded-For honored only from a
+ *     trusted proxy peer. A bare `trustProxy` is refused at construction
+ *     because it would let a direct caller forge an allowed address.
  *   - The IP is checked against the CIDR allowlist using
  *     b.ssrfGuard.cidrContains. A miss returns denyStatus + denyBody
  *     and audits the rejection. Default 404 hides the gate's
@@ -84,38 +86,47 @@ function _validateCidr(cidr) {
  * authorization prevents unauthorized USERS from reaching sensitive
  * routes; this middleware adds a NETWORK-layer fence so a credential
  * leak doesn't compromise the gate. Path-scoped — requests outside
- * the configured prefixes pass through hot-path-cheap. Resolves
- * client IP via `b.requestHelpers.clientIp` (with `trustProxy`),
- * checks against the CIDR allowlist via `b.ssrfGuard.cidrContains`,
- * and refuses misses with HTTP 404 by default (hides the gate from
- * probes). Throws at create-time on malformed opts.
+ * the configured prefixes pass through hot-path-cheap. Checks the
+ * resolved client IP against the CIDR allowlist via
+ * `b.ssrfGuard.cidrContains` and refuses misses with HTTP 404 by
+ * default (hides the gate from probes). Throws at create-time on
+ * malformed opts.
+ *
+ * Client-IP resolution is peer-gated. By default only the socket
+ * address is used — X-Forwarded-For is attacker-forgeable, so trusting
+ * it bare would let a direct caller spoof an allowed IP through the
+ * gate. Behind a reverse proxy, declare it with `trustedProxies`
+ * (CIDRs — XFF is then honored only when the immediate peer is one of
+ * them) or own resolution entirely with `clientIpResolver(req)`. A bare
+ * `trustProxy` is refused at construction.
  *
  * @opts
  *   {
- *     paths:        string[],   // pathname prefixes, required
- *     allowedCidrs: string[],   // required
- *     deniedCidrs:  string[],
- *     trustProxy:   boolean,    // default false
- *     denyStatus:   number,     // default 404
- *     denyBody:     string,     // default "Not Found"
- *     audit:        object,
- *     onDeny:       function(req, res, info): void,  // own the refusal; info = { status, reason, clientIp, route }
- *     problemDetails: boolean,  // default false — emit RFC 9457 application/problem+json instead of text/plain
+ *     paths:           string[],   // pathname prefixes, required
+ *     allowedCidrs:    string[],   // required
+ *     deniedCidrs:     string[],
+ *     trustedProxies:  string[],   // CIDRs of your reverse proxies — peer-gates X-Forwarded-For
+ *     clientIpResolver: function(req): string|null,  // own client-IP resolution
+ *     denyStatus:      number,     // default 404
+ *     denyBody:        string,     // default "Not Found"
+ *     audit:           object,
+ *     onDeny:          function(req, res, info): void,  // own the refusal; info = { status, reason, clientIp, route }
+ *     problemDetails:  boolean,    // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
  *
  * @example
  *   var b = require("@blamejs/core");
  *   var app = b.router.create();
  *   app.use(b.middleware.networkAllowlist({
- *     paths:        ["/admin"],
- *     allowedCidrs: ["10.0.0.0/8", "::1/128"],
- *     trustProxy:   true,
+ *     paths:          ["/admin"],
+ *     allowedCidrs:   ["10.0.0.0/8", "::1/128"],
+ *     trustedProxies: ["10.0.0.0/8"],   // your reverse proxy's range
  *   }));
  */
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
-    "paths", "allowedCidrs", "deniedCidrs", "trustProxy",
+    "paths", "allowedCidrs", "deniedCidrs", "trustProxy", "trustedProxies", "clientIpResolver",
     "denyStatus", "denyBody", "audit", "onDeny", "problemDetails",
   ], "middleware.networkAllowlist");
 
@@ -148,10 +159,30 @@ function create(opts) {
     }
   }
 
+  // Client-IP resolution for an access-control gate must be peer-gated:
+  // a bare `trustProxy` honors X-Forwarded-For from any caller, so a client
+  // connecting directly can forge an allowed address and walk through the
+  // gate. Operators behind a reverse proxy declare it via `trustedProxies`
+  // (CIDRs of their proxies — XFF is then peer-gated) or own resolution
+  // entirely via `clientIpResolver`. We refuse, at construction, the
+  // spoofable combination of `trustProxy` without either.
+  var _ipResolver;
+  try {
+    _ipResolver = requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    });
+  } catch (e) { throw _err("BAD_OPT", e.message); }
+  var trustProxyOpt = opts.trustProxy === true || typeof opts.trustProxy === "number";
+  if (trustProxyOpt && !_ipResolver.peerGated) {
+    throw _err("BAD_OPT",
+      "trustProxy is spoofable for an access-control gate — X-Forwarded-For from a " +
+      "direct caller would be trusted. Declare your reverse proxies via " +
+      "trustedProxies: [\"10.0.0.0/8\", …] (peer-gated XFF) or supply clientIpResolver(req).");
+  }
+
   var paths        = opts.paths.slice();
   var allowedCidrs = opts.allowedCidrs.slice();
-  var trustProxy   = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
   var denyStatus   = typeof opts.denyStatus === "number" ? opts.denyStatus : 404;
   if (denyStatus < 400 || denyStatus >= 600 || Math.floor(denyStatus) !== denyStatus) {
     throw _err("BAD_OPT", "denyStatus must be a 4xx or 5xx integer, got " + denyStatus);
@@ -212,7 +243,7 @@ function create(opts) {
     var pathname = req.pathname || (req.url || "").split("?")[0];
     if (!_matchesPath(pathname)) return next();
 
-    var ip = requestHelpers.clientIp(req, { trustProxy: trustProxy });
+    var ip = _ipResolver.resolve(req);
     if (!ip) {
       // Fail closed: a request we can't even derive an IP for shouldn't
       // bypass the gate.

package/lib/middleware/rate-limit.js

@@ -56,6 +56,7 @@
  *
  * Audit: every limit hit emits system.ratelimit.block with the key + path.
  */
+var boundedMap = require("../bounded-map");
 var C = require("../constants");
 var frameworkSchema = require("../framework-schema");
 var lazyRequire = require("../lazy-require");
@@ -117,17 +118,6 @@ function _conflictRefs(dialect, table) {
 var audit  = lazyRequire(function () { return require("../audit"); });
 var logger = lazyRequire(function () { return require("../log").boot("rate-limit"); });
 
-// `_clientIp` defers to `requestHelpers.clientIp`, threading the
-// per-middleware `trustProxy` opt. Default refuses forwarded headers
-// (returning the socket address only) — operators behind a sanitizing
-// reverse proxy opt in via `trustProxy: true` (or a hop count).
-function _clientIpFor(trustProxy) {
-  return function (req) {
-    var ip = requestHelpers.clientIp(req, { trustProxy: trustProxy });
-    return ip || "unknown";
-  };
-}
-
 // Reject NaN / Infinity / negative / non-positive / non-number at create
 // time so a misconfigured rate-limit can't silently degrade to "no
 // limit" or produce divide-by-zero verdicts at request time.
@@ -178,11 +168,14 @@ function _memoryTokenBucketBackend(opts) {
   // microtask cost per request.
   function take(key, _cost) {
     var now = Date.now();
-    var b = buckets.get(key);
-    if (!b) {
-      b = { tokens: burst, lastRefillAt: now };
-      buckets.set(key, b);
-    } else {
+    // Insert a fresh full bucket on first sight; only an already-present
+    // bucket refills (a brand-new bucket starts at `burst`, so refilling
+    // it would be a no-op clamped to `burst` anyway).
+    var existed = buckets.has(key);
+    var b = boundedMap.getOrInsert(buckets, key, function () {
+      return { tokens: burst, lastRefillAt: now };
+    });
+    if (existed) {
       var elapsed = (now - b.lastRefillAt) / C.TIME.seconds(1);
       b.tokens = Math.min(burst, b.tokens + elapsed * refillPerSecond);
       b.lastRefillAt = now;
@@ -254,10 +247,15 @@ function _memoryFixedWindowBackend(opts) {
   function take(key, _cost) {
     var now = Date.now();
     var windowStart = Math.floor(now / windowMs) * windowMs;
-    var c = counters.get(key);
-    if (!c || c.windowStart !== windowStart) {
-      c = { windowStart: windowStart, count: 0 };
-      counters.set(key, c);
+    var c = boundedMap.getOrInsert(counters, key, function () {
+      return { windowStart: windowStart, count: 0 };
+    });
+    // A key carried over from a prior window re-seeds to the current
+    // window (count restarts) — getOrInsert only handles first-sight, so
+    // the rollover case resets the existing record in place.
+    if (c.windowStart !== windowStart) {
+      c.windowStart = windowStart;
+      c.count = 0;
     }
     c.count += 1;
     if (c.count <= max) {
@@ -448,7 +446,9 @@ function _resolveBackend(opts) {
  *     limit:           number,
  *     windowMs:        number,
  *     pruneIntervalMs: number,
- *     trustProxy:      boolean|number,
+ *     trustedProxies:  string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-For for the IP key
+ *     clientIpResolver: function(req): string|null,  // own the rate-limit key's client IP
+ *     trustProxy:      boolean|number,   // legacy; refused with the default IP key (spoofable) — use trustedProxies
  *   }
  *
  * @example
@@ -466,15 +466,33 @@ function create(opts) {
   validateOpts(opts, [
     "keyFn", "statusOnLimit", "bodyOnLimit", "onDeny", "problemDetails",
     "header", "headerPrefix", "skipPaths", "scope",
-    "backend", "trustProxy", "algorithm",
+    "backend", "trustProxy", "trustedProxies", "clientIpResolver", "algorithm",
     // memory backend (token-bucket)
     "burst", "refillPerSecond",
     // memory backend (fixed-window) + cluster backend
     "max", "limit", "windowMs", "pruneIntervalMs",
   ], "middleware.rateLimit");
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _clientIp = _clientIpFor(trustProxy);
+  // Peer-gated client-IP resolution. The default key (and the audit-actor
+  // IP) is the client address; a bare trustProxy would let a caller forge
+  // X-Forwarded-For to evade their own limit or poison a victim's bucket.
+  // Operators behind a proxy declare trustedProxies (CIDRs) or own
+  // resolution via clientIpResolver. A bare trustProxy is refused when the
+  // default IP key is in use (no keyFn) — it would be spoofable.
+  var _ipResolver;
+  try {
+    _ipResolver = requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    });
+  } catch (e) { throw new Error("middleware.rateLimit: " + e.message); }
+  var trustProxyBare = opts.trustProxy === true || typeof opts.trustProxy === "number";
+  if (trustProxyBare && !_ipResolver.peerGated && !opts.keyFn) {
+    throw new Error("middleware.rateLimit: trustProxy is spoofable — a caller can forge " +
+      "X-Forwarded-For to evade the limit or poison another IP's bucket. Declare your " +
+      "reverse proxies via trustedProxies: [\"10.0.0.0/8\", …], supply clientIpResolver(req), " +
+      "or set your own keyFn.");
+  }
+  var _clientIp = function (req) { return _ipResolver.resolve(req) || "unknown"; };
   var keyFn = opts.keyFn || _clientIp;
   var statusOnLimit = opts.statusOnLimit || 429;
   var bodyOnLimit = opts.bodyOnLimit !== undefined ? opts.bodyOnLimit : "Too Many Requests";
@@ -489,29 +507,12 @@ function create(opts) {
     ? opts.headerPrefix : "X-RateLimit-";
   var limitHeader = headerPrefix + "Limit";   // allow:hand-rolled-sql — HTTP response-header name (X-RateLimit-Limit), not a SQL LIMIT clause
   var remainingHeader = headerPrefix + "Remaining";
-  var skipPaths = opts.skipPaths || [];
-  // Throw at create(): each entry must be a string prefix or a RegExp.
-  // Anything else would crash _shouldSkip with TypeError on the first request.
-  for (var sp = 0; sp < skipPaths.length; sp++) {
-    if (typeof skipPaths[sp] !== "string" && !(skipPaths[sp] instanceof RegExp)) {
-      throw new Error("middleware.rateLimit: skipPaths[" + sp +
-        "] must be a string prefix or RegExp, got " + typeof skipPaths[sp]);
-    }
-  }
+  // Path-exemption predicate (string-prefix or RegExp), validated at create().
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.rateLimit");
   var scope = opts.scope || "global";
 
   var backend = _resolveBackend(opts);
 
-  function _shouldSkip(req) {
-    var path = req.pathname || req.url || "/";
-    for (var i = 0; i < skipPaths.length; i++) {
-      if (typeof skipPaths[i] === "string" ? path.indexOf(skipPaths[i]) === 0 : skipPaths[i].test(path)) {
-        return true;
-      }
-    }
-    return false;
-  }
-
   function _writeBlocked(req, res, k, verdict) {
     if (emitHeaders && typeof res.setHeader === "function") {
       res.setHeader(limitHeader, String(verdict.limit));

package/lib/middleware/scim-server.js

@@ -4,6 +4,8 @@
 // + /Schemas surfaces backed by operator-supplied CRUD callbacks.
 
 var framework_error = require("../framework-error");
+var numericBounds   = require("../numeric-bounds");
+var pick            = require("../pick");
 var validateOpts    = require("../validate-opts");
 var safeJson        = require("../safe-json");
 var safeBuffer      = require("../safe-buffer");
@@ -516,7 +518,7 @@ function _walkBulkIdRefs(value, out) {
   if (value && typeof value === "object") {
     var keys = Object.keys(value);
     for (var k = 0; k < keys.length; k++) {
-      if (keys[k] === "__proto__" || keys[k] === "constructor" || keys[k] === "prototype") continue;
+      if (pick.isPoisonedKey(keys[k])) continue;
       _walkBulkIdRefs(value[keys[k]], out);
     }
   }
@@ -608,7 +610,7 @@ function _anyDependencyFailed(refs, plan, executed, bulkIdMap) {
 // RFC 7644 §3.7 — failOnErrors is an OPTIONAL integer >= 1. Absent /
 // non-conforming values mean "process every operation" (null).
 function _parseFailOnErrors(value) {
-  if (typeof value !== "number" || !isFinite(value) || Math.floor(value) !== value || value < 1) {
+  if (!numericBounds.isPositiveFiniteInt(value)) {
     return null;
   }
   return value;
@@ -753,7 +755,7 @@ function _resolveBulkIdRefs(value, bulkIdMap) {
     var out = {};
     var keys = Object.keys(value);
     for (var k = 0; k < keys.length; k++) {
-      if (keys[k] === "__proto__" || keys[k] === "constructor" || keys[k] === "prototype") continue;
+      if (pick.isPoisonedKey(keys[k])) continue;
       out[keys[k]] = _resolveBulkIdRefs(value[keys[k]], bulkIdMap);
     }
     return out;

package/lib/middleware/security-headers.js

@@ -151,7 +151,15 @@ var PP_POLICY_RE =
   /^[a-z][a-z0-9-]*=(?:\*|\([^)]*\)|self)$/;
 function _validatePermissionsPolicy(value) {
   if (typeof value !== "string" || value.length === 0) return;
-  var parts = String(value).split(/\s*,\s*/);
+  // Split on the literal comma, then strip whitespace adjacent to each comma —
+  // the semantics of /\s*,\s*/ without that pattern's O(n^2) backtracking on a
+  // long comma-less run of whitespace. trimStart/trimEnd use the same Unicode
+  // whitespace set as \s.
+  var parts = String(value).split(",");
+  for (var s = 0; s < parts.length; s += 1) {
+    if (s > 0) parts[s] = parts[s].trimStart();
+    if (s < parts.length - 1) parts[s] = parts[s].trimEnd();
+  }
   for (var i = 0; i < parts.length; i += 1) {
     var p = parts[i];
     if (!p) continue;
@@ -202,7 +210,9 @@ function _validatePermissionsPolicy(value) {
  *     acceptCh:           string|false,
  *     criticalCh:         string|false,
  *     reportingEndpoints: object,
- *     trustProxy:         boolean|number,
+ *     trustedProxies:     string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto for HSTS
+ *     protocolResolver:   function(req): "http"|"https",  // own the HTTPS decision
+ *     trustProxy:         boolean|number,    // legacy; refused unless paired with trustedProxies/protocolResolver (spoofable)
  *     coopReportOnly:           string,  // default: off — monitor-mode COOP
  *     coepReportOnly:           string,  // default: off — monitor-mode COEP
  *     documentPolicyReportOnly: string,  // default: off — monitor-mode Document-Policy
@@ -223,6 +233,7 @@ function create(opts) {
     "hsts", "contentTypeOptions", "frameOptions", "referrerPolicy",
     "permissionsPolicy", "coop", "coep", "corp",
     "originAgentCluster", "dnsPrefetchControl", "csp", "trustProxy",
+    "trustedProxies", "protocolResolver",
     "reportingEndpoints", "documentPolicy", "criticalCh", "acceptCh",
     "coopReportOnly", "coepReportOnly", "documentPolicyReportOnly",
     "requireDocumentPolicy", "serviceWorkerAllowed",
@@ -230,8 +241,23 @@ function create(opts) {
   if (opts.permissionsPolicy && typeof opts.permissionsPolicy === "string") {
     _validatePermissionsPolicy(opts.permissionsPolicy);
   }
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
+  // HSTS is emitted only on HTTPS responses; behind a proxy that comes from
+  // X-Forwarded-Proto. A bare trustProxy trusts the forgeable header from any
+  // caller, so a direct request forging "http" could suppress HSTS on a real
+  // HTTPS response (SSL-strip window). Peer-gate it via trustedProxies, or own
+  // the decision via protocolResolver; a bare trustProxy is refused.
+  var _proto;
+  try {
+    _proto = requestHelpers.trustedProtocol({
+      trustedProxies:   opts.trustedProxies,
+      protocolResolver: opts.protocolResolver,
+    });
+  } catch (e) { throw new TypeError("middleware.securityHeaders: " + e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_proto.peerGated) {
+    throw new TypeError("middleware.securityHeaders: trustProxy is spoofable for the HSTS " +
+      "decision — a direct caller could forge X-Forwarded-Proto to suppress HSTS. Declare your " +
+      "reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] or supply protocolResolver(req).");
+  }
   var hsts = opts.hsts === undefined ? "max-age=63072000; includeSubDomains; preload" : opts.hsts;
   var ctOpts = opts.contentTypeOptions === undefined ? "nosniff" : opts.contentTypeOptions;
   var frameOpts = opts.frameOptions === undefined ? "DENY" : opts.frameOptions;
@@ -309,9 +335,9 @@ function create(opts) {
     // RFC 6797 §7.2: HSTS over plain HTTP is meaningless (UAs ignore
     // it). Skip the header on non-TLS requests so dev-over-HTTP doesn't
     // surface confusing "Strict-Transport-Security on http://" lines.
-    // requestProtocol respects trustProxy — operators behind a TLS
-    // terminator opt in to read X-Forwarded-Proto.
-    if (hsts && requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https") {
+    // Peer-gated protocol resolution — X-Forwarded-Proto honored only from a
+    // trusted proxy (trustedProxies / protocolResolver), else the TLS socket.
+    if (hsts && _proto.resolve(req) === "https") {
       res.setHeader("Strict-Transport-Security", hsts);
     }
     if (ctOpts)     res.setHeader("X-Content-Type-Options", ctOpts);

package/lib/middleware/security-txt.js

@@ -27,6 +27,7 @@
 
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response");
 var { defineClass } = require("../framework-error");
 
 var SecurityTxtError = defineClass("SecurityTxtError", { alwaysPermanent: true });
@@ -143,12 +144,7 @@ function create(opts) {
                   (alsoAtRoot && path === "/security.txt");
     if (!matches) return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
-      res.writeHead(405, {                                                       // HTTP 405 status
-        "Allow":          "GET, HEAD",
-        "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": 18,                                                    // len of "Method Not Allowed"
-      });
-      res.end("Method Not Allowed");
+      denyResponse.methodNotAllowed(res, "GET, HEAD");
       return;
     }
     res.writeHead(200, {                                                         // HTTP 200 status