@blamejs/core 0.15.12 → 0.15.14

package/lib/restore-rollback.js

@@ -283,10 +283,16 @@ function list(opts) {
     var p = nodePath.join(rollbackRoot, name);
     var markerPath = p + ".marker.json";
     var marker = null;
-    if (nodeFs.existsSync(markerPath)) {
-      try { marker = safeJson.parse(nodeFs.readFileSync(markerPath, "utf8"), { maxBytes: C.BYTES.kib(64) }); }
-      catch (_e) { marker = null; }
-    }
+    // Capped fd-bound read (no existsSync check-then-read window): the fs read is
+    // now bounded to 64 KiB too, so a tampered multi-GB marker.json is refused
+    // BEFORE allocation (the parse-only cap let readFileSync slurp the whole file
+    // first). refuseSymlink: the marker lives under the operator's rollbackRoot,
+    // never a secret-mount. Any failure → marker:null, the best-effort behavior.
+    try {
+      marker = safeJson.parse(
+        atomicFile.fdSafeReadSync(markerPath, { maxBytes: C.BYTES.kib(64), encoding: "utf8", refuseSymlink: true }),
+        { maxBytes: C.BYTES.kib(64) });
+    } catch (_e) { marker = null; }
     var stat;
     try { stat = nodeFs.statSync(p); } catch (_e) { continue; }
     out.push({

package/lib/restore.js

@@ -59,9 +59,8 @@ var bCrypto = require("./crypto");
 var numericChecks = require("./numeric-checks");
 var restoreBundle = require("./restore-bundle");
 var restoreRollback = require("./restore-rollback");
-var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 var { FrameworkError } = require("./framework-error");
 
 class RestoreError extends FrameworkError {
@@ -74,17 +73,9 @@ class RestoreError extends FrameworkError {
 }
 
 function _validateStorage(storage) {
-  if (!storage || typeof storage !== "object") {
-    throw new RestoreError("restore/bad-storage",
-      "storage backend is required (use b.backup.diskStorage or pass a custom one)");
-  }
-  var required = ["readBundle", "listBundles", "hasBundle"];
-  for (var i = 0; i < required.length; i++) {
-    if (typeof storage[required[i]] !== "function") {
-      throw new RestoreError("restore/bad-storage",
-        "storage backend missing method '" + required[i] + "'");
-    }
-  }
+  validateOpts.requireMethods(storage,
+    ["readBundle", "listBundles", "hasBundle"],
+    "storage backend", RestoreError, "restore/bad-storage");
 }
 
 function create(opts) {
@@ -92,6 +83,7 @@ function create(opts) {
   validateOpts(opts, [
     "dataDir", "storage", "passphrase", "rollbackRoot", "audit",
     "maxPulledBytes", "maxPulledFiles",
+    "requireSignature", "expectedFingerprint", "verifySignature",
   ], "restore");
   validateOpts.requireNonEmptyString(opts.dataDir, "create: opts.dataDir", RestoreError, "restore/no-datadir");
   _validateStorage(opts.storage);
@@ -105,6 +97,19 @@ function create(opts) {
   var passphrase = opts.passphrase;
   var rollbackRoot = opts.rollbackRoot || (dataDir + ".rollbacks");
   var auditOn = opts.audit !== false;
+  // Manifest-signature policy. The framework signs bundles best-effort (an
+  // unsigned bundle is the documented CLI / standalone / worker case), so the
+  // non-opt-in integrity default is the per-blob AEAD path-binding below
+  // (which defeats the blob-remap attack on EVERY bundle, signed or not);
+  // requireSignature is the additional provenance policy operators under
+  // HIPAA/PCI opt into to mandate a verified signer. expectedFingerprint pins
+  // a signer; verifySignature:false allows a cold/cross-org restore. All
+  // three are threaded into restoreBundle.extract on every run — previously
+  // omitted entirely, so a present signature was never even verified and a
+  // requireSignature policy could not be enforced (CWE-347).
+  var requireSignature = opts.requireSignature === true;
+  var expectedFingerprint = opts.expectedFingerprint;
+  var verifySignature = opts.verifySignature;
 
   // Preflight footprint caps. Defended against storage that returns a
   // tampered or oversized bundle: we cap both the storage-reported size
@@ -152,15 +157,7 @@ function create(opts) {
     return { totalBytes: totalBytes, fileCount: fileCount };
   }
 
-  function _emitAudit(action, info, outcome) {
-    if (!auditOn) return;
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome,
-      metadata: info || {},
-      reason:   info && info.reason ? info.reason : null,
-    });
-  }
+  var _emitAudit = auditEmit.gatedReasonEmitter({ audit: auditOn });
 
   async function list() { return await storage.listBundles(); }
 
@@ -288,6 +285,9 @@ function create(opts) {
         passphrase:       passphrase,
         filter:           runOpts.filter,
         progressCallback: runOpts.progressCallback,
+        requireSignature:    requireSignature,
+        expectedFingerprint: expectedFingerprint,
+        verifySignature:     verifySignature,
       });
     } catch (e) {
       _cleanupTmp();
@@ -300,6 +300,8 @@ function create(opts) {
       else if (code === "restore-bundle/missing-manifest")  mappedCode = "restore/missing-manifest";
       else if (code === "restore-bundle/missing-blob")      mappedCode = "restore/missing-blob";
       else if (code === "restore-bundle/size-mismatch")     mappedCode = "restore/size-mismatch";
+      else if (code === "restore-bundle/missing-signature") mappedCode = "restore/missing-signature";
+      else if (code === "restore-bundle/bad-signature")     mappedCode = "restore/bad-signature";
       _emitAudit("restore.failure",
         { bundleId: bundleId, reason: (e && e.message) || String(e) }, "failure");
       throw new RestoreError(mappedCode,

package/lib/retention.js

@@ -47,6 +47,7 @@ var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
 var sql = require("./sql");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
@@ -116,11 +117,8 @@ function _validateRule(rule) {
     throw _err("BAD_RULE",
       "rule.action string must be 'erase' / 'delete' / 'soft-delete', got " + JSON.stringify(action));
   }
-  if (rule.batchSize !== undefined &&
-      (typeof rule.batchSize !== "number" || !isFinite(rule.batchSize) ||
-       rule.batchSize <= 0 || Math.floor(rule.batchSize) !== rule.batchSize)) {
-    throw _err("BAD_RULE", "rule.batchSize must be a positive integer");
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(rule.batchSize,
+    "rule.batchSize", RetentionError, "BAD_RULE");
   if (rule.softDeleteField !== undefined &&
       (typeof rule.softDeleteField !== "string" || rule.softDeleteField.length === 0)) {
     throw _err("BAD_RULE", "rule.softDeleteField must be a non-empty string");
@@ -433,17 +431,29 @@ function create(opts) {
 
     try {
       var moreRows = true;
+      // Keyset pagination cursor. Without it the loop re-selects the SAME batch
+      // forever whenever a full batch of rows is NOT removed from the candidate
+      // set by its action — legal-hold-skipped, "warn"-stage, errored, and
+      // (critically) EVERY row under dryRun mutate nothing, so a LIMIT-from-the-
+      // top query returns the identical rows each pass and `rows.length ===
+      // batchSize` never goes false. Ordering by _id and advancing past the last
+      // row seen guarantees forward progress regardless of whether a row was
+      // actioned. (Deleted / anonymized rows are also simply skipped past.)
+      var lastId = null;
       while (moreRows) {
         var rows;
         // The candidate WHERE-clause: age + not-already-erased + not-on-legal-hold +
-        // (when soft-delete is configured) not-already-soft-deleted. Built
-        // through b.sql so the operator-supplied table / ageField / softDeleteField
-        // identifiers are quoted by construction and every value binds as a
-        // placeholder (the '' empty-string compare included — no embedded literal).
+        // (when soft-delete is configured) not-already-soft-deleted + keyset cursor.
+        // Built through b.sql so the operator-supplied table / ageField /
+        // softDeleteField identifiers are quoted by construction and every value
+        // binds as a placeholder (the '' empty-string compare included — no
+        // embedded literal).
         function _candidateBase() {
           var qb = sql.select(rule.table, SQL_OPTS)
             .where(rule.ageField, "<=", cutoff);
           if (rule.softDeleteField) qb.whereNull(rule.softDeleteField);
+          if (lastId !== null) qb.where("_id", ">", lastId);
+          qb.orderBy("_id", "asc");
           return qb;
         }
         var selStmt;
@@ -506,6 +516,10 @@ function create(opts) {
               reason: (e && e.message) || String(e) });
           }
         }
+        // Advance the keyset cursor past this batch so already-seen rows
+        // (including skipped / warned / errored / dry-run rows that stay in the
+        // candidate set) are never re-selected — the loop-termination guarantee.
+        lastId = rows[rows.length - 1]._id;
         if (rows.length < rule.batchSize) moreRows = false;
       }
     } catch (e) {

package/lib/router.js

@@ -36,6 +36,7 @@ var http  = require("node:http");
 var http2 = require("node:http2");
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
+var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var requestHelpers = require("./request-helpers");
 var lazyRequire = require("./lazy-require");
@@ -147,7 +148,11 @@ function _makeSchemaValidator(spec) {
       if (!qq.ok) return _writeValidationError(req, res, "query", qq.errors);
       req.query = qq.value;
     }
-    if (spec.body && req.body !== undefined) {
+    if (spec.body) {
+      // Validate even when req.body is undefined (no body parsed / empty POST):
+      // a required body schema must report the violation, not be silently
+      // skipped. safeParse(undefined) fails a non-optional schema and passes an
+      // optional()/default() one. Mirrors the always-run params/query checks.
       var bb = spec.body.safeParse(req.body);
       if (!bb.ok) return _writeValidationError(req, res, "body", bb.errors);
       req.body = bb.value;
@@ -1425,11 +1430,19 @@ function serveStatic(dir) {
     // that shares the root's name as a prefix — e.g. root `/srv/public`
     // vs `/srv/public-evil` — cannot satisfy the containment check.
     if (filePath !== root && !filePath.startsWith(root + nodePath.sep)) return next();
-    if (!nodeFs.existsSync(filePath) || nodeFs.statSync(filePath).isDirectory()) return next();
+    // Open the (lexically-confined) path ONCE with O_NOFOLLOW and bind existence,
+    // stat, and streaming to that single fd. The previous existsSync → statSync →
+    // statSync → createReadStream sequence was a triple check-then-read TOCTOU
+    // (CWE-367) on a request-derived pathname, and the plain createReadStream
+    // would follow a symlink swapped in after the lexical check (CWE-22).
+    // Opening before writeHead lets a refusal still fall through to next().
+    var fd;
+    try { fd = atomicFile.openNoFollowSync(filePath); } catch (_e) { return next(); }
+    var stat = nodeFs.fstatSync(fd);
+    if (stat.isDirectory()) { nodeFs.closeSync(fd); return next(); }
 
     var ext = nodePath.extname(filePath).toLowerCase();
     var mime = MIME_TYPES[ext] || "application/octet-stream";
-    var stat = nodeFs.statSync(filePath);
     var hasVersion = req.url && req.url.includes("?v=");
     var cacheControl = hasVersion
       ? "public, max-age=31536000, immutable"
@@ -1439,7 +1452,7 @@ function serveStatic(dir) {
       "Content-Length": stat.size,
       "Cache-Control":  cacheControl,
     });
-    nodeFs.createReadStream(filePath).pipe(res);
+    nodeFs.createReadStream(filePath, { fd: fd }).pipe(res);
   };
 }