@blamejs/core 0.15.12 → 0.15.14

package/lib/static.js

@@ -42,6 +42,7 @@ var nodeFs = require("node:fs");
 var fsp = require("node:fs/promises");
 var nodeCrypto = require("node:crypto");
 var nodePath = require("node:path");
+var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var gateContract = require("./gate-contract");
 var lazyRequire = require("./lazy-require");
@@ -240,10 +241,16 @@ async function _readMeta(root, candidate) {
   var sri = nodeCrypto.createHash("sha384");
   var sha3 = nodeCrypto.createHash("sha3-512");
   await new Promise(function (resolve, reject) {
-    // The path handed to createReadStream is the confined output of
-    // `_assertInsideRoot(root, candidate)` above (lexical resolve +
-    // root-prefix containment), not the request-derived candidate.
-    var s = nodeFs.createReadStream(absPath);
+    // The path is the confined output of `_assertInsideRoot(root, candidate)`
+    // above (lexical resolve + root-prefix containment). Open it O_NOFOLLOW and
+    // stream from that fd: lexical confinement still leaves a window where a
+    // symlink swapped in at the final component after the check would be
+    // followed by a plain createReadStream (CWE-22 / CWE-367); O_NOFOLLOW refuses
+    // it. The open throws synchronously on a symlink (ELOOP) / missing file —
+    // reject the hash promise so the caller falls back exactly as on a read error.
+    var s;
+    try { s = nodeFs.createReadStream(absPath, { fd: atomicFile.openNoFollowSync(absPath) }); }
+    catch (e) { reject(e); return; }
     s.on("data", function (chunk) { sri.update(chunk); sha3.update(chunk); });
     s.on("end", resolve);
     s.on("error", reject);
@@ -399,7 +406,7 @@ function _shouldForceAttachment(contentType, ext, contentSafetyMap, allowSvgRend
     return true;
   }
   if (bare.indexOf("text/") === 0) return false;
-  if (SAFE_RENDER_RASTER_MIMES[bare]) return false;
+  if (Object.prototype.hasOwnProperty.call(SAFE_RENDER_RASTER_MIMES, bare)) return false;
   if (bare === "image/svg+xml") {
     if (!allowSvgRender) return true;
     if (!contentSafetyMap || typeof contentSafetyMap !== "object") return true;
@@ -489,84 +496,147 @@ function _httpDate(date) {
 }
 
 function _validateCreateOpts(opts) {
-  validateOpts.requireObject(opts, "staticServe.create", StaticServeError);
-  validateOpts.requireNonEmptyString(opts.root, "staticServe.create: root", StaticServeError, "BAD_OPT");
+  // Declarative per-field validation. shape() runs requireObject(opts)
+  // itself (same "opts must be an object" / BAD_OPT contract the inline
+  // requireObject produced), then dispatches each field. A field whose
+  // check is one of the rule tokens maps to the token directly; a field
+  // with a bespoke message (mountPath / hashedPathPattern), a
+  // duck-typed-handle shape (permissions / cache / fileType / retention /
+  // revokeStore — each carrying its own operator-facing description), a
+  // numeric bound, or an audit/observability shape uses the
+  // validator-function hatch so the exact thrown code + message + label
+  // are preserved. Cross-field business logic (root existence,
+  // allowedFileTypes↔fileType wiring, the contentSafety map, the
+  // mountType enum, the quota↔cache requirement) stays below shape.
+  validateOpts.shape(opts, {
+    root: "required-string",
+    mountPath: function (value, _label, errorClass, code) {
+      // empty string is operator-permissible: "no mount, root is request URL"
+      if (typeof value === "string" && value.length === 0) return;
+      if (value !== undefined && value !== null && typeof value !== "string") {
+        throw errorClass.factory(code, "staticServe.create: mountPath must be a string");
+      }
+    },
+    hashedPathPattern: function (value, _label, errorClass, code) {
+      if (value !== undefined && value !== null && !(value instanceof RegExp)) {
+        throw errorClass.factory(code, "staticServe.create: hashedPathPattern must be a RegExp");
+      }
+    },
+    // indexFile === null is the operator's "disable" sentinel; the helper
+    // returns null/undefined unchanged so we keep that semantic.
+    indexFile: "optional-string",
+    defaultMaxAge: function (value, label, errorClass, code) {
+      numericBounds.requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    contentTypes: "optional-plain-object",
+    // contentSafety — extension-keyed gate map. undefined → the framework
+    // wires b.guardAll.byExtension({ profile: "strict" }) so every shipped
+    // guard is ON by default; null is the explicit opt-out (audited at
+    // create() time); a plain { ext: gate } object validates each value is a
+    // gate (a .check fn). The label / code / message match the prior inline
+    // check exactly so a test asserting them still holds.
+    contentSafety: function (value, _label, errorClass, code) {
+      if (value === undefined || value === null) return;
+      validateOpts.optionalPlainObject(value,
+        "staticServe.create: contentSafety", errorClass, code,
+        "must be a plain { ext: gate } object, null to opt out, or " +
+        "undefined for the default-on b.guardAll wiring");
+      var safetyKeys = Object.keys(value);
+      for (var sk = 0; sk < safetyKeys.length; sk++) {
+        var ext = safetyKeys[sk];
+        var g = value[ext];
+        if (!g || typeof g.check !== "function") {
+          throw errorClass.factory(code,
+            "staticServe.create: contentSafety[" + JSON.stringify(ext) +
+            "] must be a gate (b.guardCsv.gate / b.guardHtml.gate / etc.)");
+        }
+      }
+    },
+    permissions: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "check", label, errorClass, code,
+        "must be a b.permissions instance (check fn)");
+    },
+    cache: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "get", label, errorClass, code,
+        "must be a b.cache instance (used for cluster-shared bandwidth + concurrency tracking)");
+    },
+    fileType: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "detect", label, errorClass, code,
+        "must be a b.fileType instance (magic-byte MIME detection)");
+    },
+    retention: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "isServable", label, errorClass, code,
+        "must expose isServable(absPath, ctx) → boolean (compliance retention check)");
+    },
+    revokeStore: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "isRevoked", label, errorClass, code,
+        "must expose isRevoked(key) and revoke(key) for force-revoke support");
+    },
+    allowedFileTypes: "optional-string-array",
+    audit: function (value, _label, errorClass, _code) {
+      validateOpts.auditShape(value, "staticServe.create", errorClass);
+    },
+    observability: function (value, _label, errorClass, _code) {
+      validateOpts.observabilityShape(value, "staticServe.create", errorClass);
+    },
+    onServe: "optional-function",
+    onError: "optional-function",
+    acceptRanges: "optional-boolean",
+    auditSuccess: "optional-boolean",
+    auditFailures: "optional-boolean",
+    safeAttachmentForRiskyMimes: "optional-boolean",
+    forceAttachmentForNonText: "optional-boolean",
+    safeRenderSvg: "optional-boolean",
+    safeRenderPdf: "optional-boolean",
+    maxBytesPerActorPerWindowMs: function (value, label, errorClass, code) {
+      numericBounds.requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    maxBytesAllActorsPerWindowMs: function (value, label, errorClass, code) {
+      numericBounds.requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    bandwidthWindowMs: function (value, label, errorClass, code) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    maxConcurrentDownloadsPerActor: function (value, label, errorClass, code) {
+      numericBounds.requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    maxIdleMs: function (value, label, errorClass, code) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    // maxRangeBytes — per-range byte cap (slowloris-range defense). A
+    // positive finite integer caps Range requests; Infinity is the
+    // documented opt-out, so the numericBounds finite-int helpers (which
+    // reject Infinity) can't be used directly here.
+    maxRangeBytes: function (value, label, errorClass, code) {
+      if (value === undefined || value === null || value === Infinity) return;
+      numericBounds.requirePositiveFiniteInt(value, label, errorClass, code);
+    },
+  }, "staticServe.create", StaticServeError, "BAD_OPT", {
+    // contentSafetyDisabledReason (audit-row string) and mountType (curated
+    // | user-content enum) carry dedicated cross-field validation below
+    // shape — the audit reason read and the enum throw whose exact message a
+    // test asserts. Listing them here keeps that bespoke logic the single
+    // validator rather than re-checking the same key inside shape.
+    allow: ["contentSafetyDisabledReason", "mountType"],
+  });
+
   if (!nodeFs.existsSync(opts.root)) {
     throw _err("BAD_OPT", "staticServe.create: root does not exist: " + opts.root);
   }
-  if (typeof opts.mountPath === "string" && opts.mountPath.length === 0) {
-    // empty string is operator-permissible: "no mount, root is request URL"
-  } else if (opts.mountPath !== undefined && opts.mountPath !== null &&
-             typeof opts.mountPath !== "string") {
-    throw _err("BAD_OPT", "staticServe.create: mountPath must be a string");
-  }
-  if (opts.hashedPathPattern !== undefined && opts.hashedPathPattern !== null &&
-      !(opts.hashedPathPattern instanceof RegExp)) {
-    throw _err("BAD_OPT", "staticServe.create: hashedPathPattern must be a RegExp");
-  }
-  // indexFile === null is the operator's "disable" sentinel; the helper
-  // returns null/undefined unchanged so we keep that semantic.
-  validateOpts.optionalNonEmptyString(opts.indexFile,
-    "staticServe.create: indexFile", StaticServeError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.defaultMaxAge,
-    "staticServe.create: defaultMaxAge", StaticServeError, "BAD_OPT");
-  validateOpts.optionalPlainObject(opts.contentTypes,
-    "staticServe.create: contentTypes", StaticServeError, "BAD_OPT");
-  validateOpts.optionalObjectWithMethod(opts.permissions, "check",
-    "staticServe.create: permissions", StaticServeError, "BAD_OPT",
-    "must be a b.permissions instance (check fn)");
-  validateOpts.optionalObjectWithMethod(opts.cache, "get",
-    "staticServe.create: cache", StaticServeError, "BAD_OPT",
-    "must be a b.cache instance (used for cluster-shared bandwidth + concurrency tracking)");
-  validateOpts.optionalObjectWithMethod(opts.fileType, "detect",
-    "staticServe.create: fileType", StaticServeError, "BAD_OPT",
-    "must be a b.fileType instance (magic-byte MIME detection)");
-  validateOpts.optionalObjectWithMethod(opts.retention, "isServable",
-    "staticServe.create: retention", StaticServeError, "BAD_OPT",
-    "must expose isServable(absPath, ctx) → boolean (compliance retention check)");
-  validateOpts.optionalObjectWithMethod(opts.revokeStore, "isRevoked",
-    "staticServe.create: revokeStore", StaticServeError, "BAD_OPT",
-    "must expose isRevoked(key) and revoke(key) for force-revoke support");
-  validateOpts.optionalNonEmptyStringArray(opts.allowedFileTypes,
-    "staticServe.create: allowedFileTypes", StaticServeError, "BAD_OPT");
   if (Array.isArray(opts.allowedFileTypes) && opts.allowedFileTypes.length > 0 &&
       (!opts.fileType || typeof opts.fileType.detect !== "function")) {
     throw _err("BAD_OPT",
       "staticServe.create: allowedFileTypes is set but fileType primitive is not wired " +
       "(pass fileType: b.fileType so the framework can sniff magic bytes before serving)");
   }
-  validateOpts.auditShape(opts.audit, "staticServe.create", StaticServeError);
-  validateOpts.observabilityShape(opts.observability, "staticServe.create", StaticServeError);
-  validateOpts.optionalFunction(opts.onServe, "staticServe.create: onServe", StaticServeError);
-  validateOpts.optionalFunction(opts.onError, "staticServe.create: onError", StaticServeError);
-  // contentSafety — extension-keyed gate map. Default behaviour: when
-  // undefined, the framework wires b.guardAll.byExtension({ profile:
-  // "strict" }) automatically so every shipped guard is ON by default.
-  // Explicit opt-out: contentSafety: null (audited at create() time so
-  // a security review can reconstruct which deploys disabled the
-  // default-on protection).
+  // contentSafety — extension-keyed gate map; validated in the shape above
+  // (plain { ext: gate } object / null opt-out / undefined default-on).
+  // When undefined, the framework wires b.guardAll.byExtension({ profile:
+  // "strict" }) automatically so every shipped guard is ON by default;
+  // contentSafety: null is the explicit opt-out, audited at create() time so
+  // a security review can reconstruct which deploys disabled the default-on
+  // protection.
   // Example: contentSafety: { ".csv": b.guardCsv.gate({ profile: "strict" }) }
-  if (opts.contentSafety !== undefined && opts.contentSafety !== null) {
-    validateOpts.optionalPlainObject(opts.contentSafety,
-      "staticServe.create: contentSafety", StaticServeError, "BAD_OPT",
-      "must be a plain { ext: gate } object, null to opt out, or " +
-      "undefined for the default-on b.guardAll wiring");
-    var safetyKeys = Object.keys(opts.contentSafety);
-    for (var sk = 0; sk < safetyKeys.length; sk++) {
-      var ext = safetyKeys[sk];
-      var g = opts.contentSafety[ext];
-      if (!g || typeof g.check !== "function") {
-        throw _err("BAD_OPT",
-          "staticServe.create: contentSafety[" + JSON.stringify(ext) +
-          "] must be a gate (b.guardCsv.gate / b.guardHtml.gate / etc.)");
-      }
-    }
-  }
-  validateOpts.optionalBoolean(opts.acceptRanges, "staticServe.create: acceptRanges", StaticServeError);
-  validateOpts.optionalBoolean(opts.auditSuccess, "staticServe.create: auditSuccess", StaticServeError);
-  validateOpts.optionalBoolean(opts.auditFailures, "staticServe.create: auditFailures", StaticServeError);
-  validateOpts.optionalBoolean(opts.safeAttachmentForRiskyMimes,
-    "staticServe.create: safeAttachmentForRiskyMimes", StaticServeError);
   // mountType — config-time enum. A typo ("usercontent", "uploads")
   // would silently fall back to the curated default and serve untrusted
   // HTML inline, so THROW at boot rather than mis-type the mount.
@@ -576,22 +646,6 @@ function _validateCreateOpts(opts) {
       "staticServe.create: mountType must be 'curated' (default) or " +
       "'user-content'; got " + JSON.stringify(opts.mountType));
   }
-  validateOpts.optionalBoolean(opts.forceAttachmentForNonText,
-    "staticServe.create: forceAttachmentForNonText", StaticServeError);
-  validateOpts.optionalBoolean(opts.safeRenderSvg,
-    "staticServe.create: safeRenderSvg", StaticServeError);
-  validateOpts.optionalBoolean(opts.safeRenderPdf,
-    "staticServe.create: safeRenderPdf", StaticServeError);
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxBytesPerActorPerWindowMs,
-    "staticServe.create: maxBytesPerActorPerWindowMs", StaticServeError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxBytesAllActorsPerWindowMs,
-    "staticServe.create: maxBytesAllActorsPerWindowMs", StaticServeError, "BAD_OPT");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.bandwidthWindowMs,
-    "staticServe.create: bandwidthWindowMs", StaticServeError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxConcurrentDownloadsPerActor,
-    "staticServe.create: maxConcurrentDownloadsPerActor", StaticServeError, "BAD_OPT");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxIdleMs,
-    "staticServe.create: maxIdleMs", StaticServeError, "BAD_OPT");
   // Quotas require a cache for cluster-shared coordination.
   if ((opts.maxBytesPerActorPerWindowMs > 0 ||
        opts.maxBytesAllActorsPerWindowMs > 0 ||
@@ -701,20 +755,11 @@ async function integrity(absPath) {
 
 function create(opts) {
   opts = opts || {};
-  // The v0.6.x test surface called `validateOpts(opts, [...allowed], label)`
-  // for the unknown-key check. Preserve that gate in addition to the
-  // throw-at-config-time validation so tests catch typos.
-  validateOpts(opts, [
-    "root", "mountPath", "hashedPathPattern",
-    "indexFile", "defaultMaxAge", "contentTypes",
-    "permissions", "cache", "fileType", "retention", "revokeStore",
-    "allowedFileTypes", "audit", "observability", "onServe", "onError",
-    "acceptRanges", "auditSuccess", "auditFailures",
-    "maxBytesPerActorPerWindowMs", "maxBytesAllActorsPerWindowMs",
-    "bandwidthWindowMs", "maxConcurrentDownloadsPerActor", "maxIdleMs",
-    "contentSafety", "contentSafetyDisabledReason",
-    "mountType", "forceAttachmentForNonText", "safeRenderSvg", "safeRenderPdf",
-  ], "staticServe.create");
+  // The exhaustive shape() in _validateCreateOpts is the authoritative
+  // unknown-key gate: any opt not declared in its schema (nor listed in
+  // its options.allow pass-through) is rejected as an unknown opt, so the
+  // typo-catching the v0.6.x `validateOpts(opts, [...allowed])` call gave
+  // is now subsumed by the per-field validation below.
   _validateCreateOpts(opts);
   var cfg = validateOpts.applyDefaults(opts, DEFAULTS);
   var root            = nodePath.resolve(opts.root);
@@ -846,10 +891,21 @@ function create(opts) {
     // `_assertInsideRoot`, not the request-derived candidate.
     var confined = _assertInsideRoot(root, absPath);
     if (!confined) return { ok: false, reason: "read-failed" };
+    // Only the first 64 KiB is ever inspected, so read JUST that prefix from an
+    // O_NOFOLLOW fd: the previous fsp.readFile slurped the WHOLE file into memory
+    // just to sniff its header — a request-reachable OOM on a user-content mount
+    // — and followed a post-confinement symlink swap. A PREFIX read (not a
+    // maxBytes refusal) is required so a large but allowed file still serves.
     var sample;
-    try { sample = await fsp.readFile(confined, { flag: "r" }); }
-    catch (_e) { return { ok: false, reason: "read-failed" }; }
-    var detected = fileType.detect(sample.slice(0, C.BYTES.kib(64))) || {};
+    try {
+      var sniffFd = atomicFile.openNoFollowSync(confined);
+      try {
+        var sniffBuf = Buffer.alloc(C.BYTES.kib(64));
+        var sniffN = nodeFs.readSync(sniffFd, sniffBuf, 0, sniffBuf.length, 0);
+        sample = sniffBuf.slice(0, sniffN);
+      } finally { nodeFs.closeSync(sniffFd); }
+    } catch (_e) { return { ok: false, reason: "read-failed" }; }
+    var detected = fileType.detect(sample) || {};
     if (!detected.mime) return { ok: false, reason: "indeterminate" };
     if (allowedFileTypes.indexOf(detected.mime) === -1) {
       return { ok: false, reason: "not-allowed", detected: detected.mime };
@@ -1013,6 +1069,23 @@ function create(opts) {
           // creation can ever ride this code path.
           gateHandle = await fsp.open(gateConfined, gateOpenFlags, 0o600);
           var gateStat = await gateHandle.stat();
+          // Cap before Buffer.alloc(gateStat.size): the gate buffers the WHOLE
+          // file to inspect it, so a multi-GiB file on a user-content mount is a
+          // request-reachable OOM lever. A file too large for the gate to vet is
+          // refused (the gate's own "refuse" disposition) rather than buffered.
+          if (gateStat.size > C.BYTES.mib(16)) {
+            stats.failures += 1;
+            _emitObs("staticServe.content_safety_refused", 1, { route: urlPath });
+            try { await gateHandle.close(); } catch (_ce) { /* close best-effort */ }
+            if (auditFailures) {
+              emitAudit("staticServe.serve.failure", Object.assign({
+                outcome: "failure", reason: "content_safety_too_large",
+                resource: urlPath, ext: ext, sizeBytes: gateStat.size,
+              }, actorCtx));
+            }
+            return writeErr(res, HTTP.UNSUPPORTED_MEDIA_TYPE,
+              "content_safety_refused", "Unsupported Media Type");
+          }
           gateBuf = Buffer.alloc(gateStat.size);
           var gateRead = 0;
           while (gateRead < gateStat.size) {
@@ -1097,8 +1170,11 @@ function create(opts) {
         "precondition_failed", "Precondition Failed");
     }
 
-    // Conditional: If-Modified-Since (304)
-    var ifModSince = headersIn["if-modified-since"];
+    // Conditional: If-Modified-Since (304) — RFC 7232 §6: evaluated ONLY when
+    // If-None-Match is absent. Otherwise a changed-ETag resource rewritten
+    // within the same wall-clock second (mtime compared at second granularity)
+    // would be falsely reported 304 despite the content hash differing.
+    var ifModSince = !ifNone && headersIn["if-modified-since"];
     if (ifModSince) {
       var ims = Date.parse(ifModSince);
       if (isFinite(ims) && Math.floor(meta.mtimeMs / C.TIME.seconds(1)) <= Math.floor(ims / C.TIME.seconds(1))) {
@@ -1113,8 +1189,9 @@ function create(opts) {
       }
     }
 
-    // Conditional: If-Unmodified-Since (412)
-    var ifUnmodSince = headersIn["if-unmodified-since"];
+    // Conditional: If-Unmodified-Since (412) — RFC 7232 §6: evaluated ONLY
+    // when If-Match is absent.
+    var ifUnmodSince = !ifMatch && headersIn["if-unmodified-since"];
     if (ifUnmodSince) {
       var ius = Date.parse(ifUnmodSince);
       if (isFinite(ius) && Math.floor(meta.mtimeMs / C.TIME.seconds(1)) > Math.floor(ius / C.TIME.seconds(1))) {
@@ -1310,7 +1387,20 @@ function create(opts) {
     }
 
     var streamOpts = range ? { start: range.start, end: range.end } : {};
-    var fileStream = nodeFs.createReadStream(streamTarget, streamOpts);
+    // Open streamTarget (the re-confined _assertInsideRoot output) O_NOFOLLOW and
+    // stream from that fd, so a symlink swapped in at the final component after
+    // confinement is refused (ELOOP) rather than followed (CWE-22 / CWE-367).
+    // Headers are already committed here, so a sync refusal can't re-issue a 404
+    // — abort the connection instead of serving the swapped target.
+    var fileStream;
+    try {
+      fileStream = nodeFs.createReadStream(streamTarget,
+        Object.assign({ fd: atomicFile.openNoFollowSync(streamTarget) }, streamOpts));
+    } catch (_openErr) {
+      releaseSlot();
+      try { res.destroy(); } catch (_d) { /* already torn down */ }
+      return;
+    }
 
     // Idle timeout — close the connection if the client stalls. Pattern is
     // a deadline-style debounce (clearTimeout + setTimeout) tied directly

package/lib/storage.js

@@ -38,10 +38,12 @@
  *   Filesystem-and-cloud-backed object storage with sealed per-file encryption keys, classification routing, and residency enforcement.
  */
 var C = require("./constants");
+var safeBuffer = require("./safe-buffer");
 var { generateBytes, encryptPacked, decryptPacked } = require("./crypto");
 var objectStore = require("./object-store");
 var lazyRequire = require("./lazy-require");
 var numericBounds = require("./numeric-bounds");
+var codepointClass = require("./codepoint-class");
 var canonicalJson = require("./canonical-json");
 var { StorageError } = require("./framework-error");
 
@@ -950,7 +952,7 @@ function _validateAssemblyId(id) {
   for (var i = 0; i < id.length; i += 1) {
     var c = id.charCodeAt(i);
     // Refuse: C0 (0x00-0x1F), DEL (0x7F), slash, backslash, dot-prefix
-    if (c < 0x20 || c === 0x2F || c === 0x5C || c === 0x7F) {
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x2F || c === 0x5C) {
       throw _err("INVALID_ARGUMENT",
         "chunkScratch: assemblyId carries forbidden character at byte " + i, true);
     }
@@ -1083,7 +1085,7 @@ function chunkScratch(opts) {
     if (!Buffer.isBuffer(args.data)) {
       throw _err("INVALID_ARGUMENT", "chunkScratch.saveChunk: data must be a Buffer", true);
     }
-    if (args.data.length > maxChunkBytes) {
+    if (safeBuffer.byteLengthOf(args.data) > maxChunkBytes) {
       throw _err("INVALID_ARGUMENT",
         "chunkScratch.saveChunk: chunk exceeds maxChunkBytes (" + args.data.length + " > " + maxChunkBytes + ")", true);
     }