@blamejs/core 0.15.13 → 0.15.14

package/lib/webhook.js

@@ -48,6 +48,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
 var bCrypto = require("./crypto");
 var httpClient = require("./http-client");
 var safeBuffer = require("./safe-buffer");
@@ -57,6 +58,8 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var numericChecks = require("./numeric-checks");
 var requestHelpers = require("./request-helpers");
+// Lazy — ssrf-guard pulls in the DNS/network stack; only touched on send().
+var ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
 var validateOpts = require("./validate-opts");
 var { WebhookError } = require("./framework-error");
 // b.webhook.dispatcher — durable signed-webhook delivery store. Lives in its
@@ -428,6 +431,18 @@ function signer(opts) {
       allowedProtocols: httpOpts.allowedProtocols || safeUrl.ALLOW_HTTP_TLS,
       errorClass:       WebhookError,
     });
+    // SSRF gate at the webhook layer: refuse private / loopback / link-local /
+    // cloud-metadata destinations up front, before the retry loop. httpClient
+    // also enforces this on every request, but checking here fails fast (no
+    // wasted retries) and keeps the SSRF boundary explicit at the send() API
+    // rather than relying on the transport's internal gate. allowInternal
+    // mirrors the operator's http opts (its affirmative waiver).
+    try {
+      await ssrfGuard().checkUrl(url, { allowInternal: httpOpts.allowInternal === true });
+    } catch (e) {
+      if (e && e.isSsrfError) throw _err("SSRF_REFUSED", "webhook.signer.send: " + e.message);
+      throw e;
+    }
     _validateBody(body);
     var signed = sign(body, { kid: input.kid });
     var mergedHeaders = Object.assign({}, input.headers || {}, signed.headers);
@@ -645,7 +660,7 @@ function verifier(opts) {
       throw _failure("MISSING_TIMESTAMP", "webhook: t= field missing from signature header", "missing-timestamp", ctxReq);
     }
     var ts = Number(parsed.t);
-    if (!isFinite(ts) || ts < 0 || Math.floor(ts) !== ts) {
+    if (!numericBounds.isNonNegativeFiniteInt(ts)) {
       throw _failure("BAD_TIMESTAMP", "webhook: t= field is not a non-negative integer, got " + JSON.stringify(parsed.t), "bad-timestamp", ctxReq);
     }
     if (parsed.id === null || parsed.id.length === 0) {

package/lib/websocket.js

@@ -573,7 +573,7 @@ function _negotiatePermessageDeflate(reqHeader) {
       "server_max_window_bits": true,     "client_max_window_bits": true,
     };
     var ok = true;
-    for (var k in p) { if (Object.prototype.hasOwnProperty.call(p, k) && !KNOWN[k]) { ok = false; break; } }
+    for (var k in p) { if (Object.prototype.hasOwnProperty.call(p, k) && !Object.prototype.hasOwnProperty.call(KNOWN, k)) { ok = false; break; } }
     if (!ok) continue;
     // Always negotiate WITH no_context_takeover in BOTH directions, so
     // every message uses a fresh zlib state. Echo any client window-

package/lib/worm.js

@@ -102,7 +102,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, ["store", "mode", "defaultRetentionMs", "clock"], "worm.create");
   var mode = opts.mode || "compliance";
-  if (!MODES[mode]) throw new WormError("worm/bad-mode", "worm.create: mode must be 'compliance' or 'governance'");
+  if (!Object.prototype.hasOwnProperty.call(MODES, mode)) throw new WormError("worm/bad-mode", "worm.create: mode must be 'compliance' or 'governance'");
   var store = opts.store || _memStore();
   ["get", "set", "delete", "has", "keys"].forEach(function (m) {
     if (typeof store[m] !== "function") throw new WormError("worm/bad-store", "worm.create: store adapter must implement " + m + "()");

package/lib/ws-client.js

@@ -248,17 +248,13 @@ function connect(target, opts) {
   });
   // SSRF gate — refuse private / loopback / link-local / cloud-metadata /
   // reserved IP destinations by default. Symmetric to b.httpClient. The
-  // returned `ips` are pinned through tls.connect / net.connect so the
+  // validated `ips` are pinned through tls.connect / net.connect so the
   // actual TCP connect targets the validated address (closes the DNS-
   // rebinding TOCTOU window). Cloud-metadata IPs are unconditional
-  // hard-deny — `allowInternal: true` does not bypass them.
-  var hostnameForUrl = parsed.protocol === "wss:" ? "https:" : "http:";
-  var probeUrl = new nodeUrl.URL(hostnameForUrl + "//" + parsed.host + parsed.pathname + parsed.search);
-  ssrfGuard.checkUrl(probeUrl, {
-    allowInternal: opts.allowInternal,
-    errorClass:    WsClientError,
-  }).then(function (result) {
-    client._ssrfPinnedIps = result && result.ips;
+  // hard-deny — `allowInternal: true` does not bypass them. _prepareDial
+  // performs the (async) check + pinning before the dial and reruns it on
+  // every reconnect, so a urlFor-swapped target is validated too.
+  client._prepareDial().then(function () {
     client._dial();
   }).catch(function (e) {
     setImmediate(function () { client._handleSocketError(e); });
@@ -315,51 +311,50 @@ class WsClient extends EventEmitter {
   get subprotocol()            { return this._negotiatedSubprotocol; }
   get url()                    { return this._opts.target; }
 
-  _dial() {
-    var self = this;
+  // Resolve the dial target and re-validate it BEFORE any socket opens.
+  // urlFor may swap the URL and tlsOptsFor may rotate TLS material every
+  // dial (including reconnects). The resolved target is re-checked through
+  // ssrfGuard — AWAITED, because checkUrl is async: the prior code called it
+  // synchronously inside _dial and discarded the Promise, so a urlFor that
+  // pointed at a private / cloud-metadata address mid-reconnect was connected
+  // anyway (the SSRF rejection surfaced only as an unhandled rejection) and
+  // the connect was never pinned. Returns a Promise; sync throws from
+  // urlFor / tlsOptsFor become rejections (async fn) handled by the caller.
+  async _prepareDial() {
     var opts = this._opts;
-    this._readyState = "connecting";
-
-    // Per-dial overrides — urlFor swaps the target URL, tlsOptsFor
-    // overrides TLS material. Both fire every dial including reconnects
-    // so callers can rotate state. urlFor's result is re-validated
-    // through ssrfGuard so a hostile upstream can't direct the client
-    // at a private address mid-reconnect.
     var attempt = this._reconnectAttempt || 0;
-    var dialTarget = opts.target;
     var dialParsed = opts.parsedUrl;
     if (typeof opts.urlFor === "function") {
-      try {
-        var nextTarget = opts.urlFor(attempt);
-        if (typeof nextTarget === "string" && nextTarget.length > 0 && nextTarget !== dialTarget) {
-          dialParsed = _parseUrl(nextTarget);
-          dialTarget = nextTarget;
-          var probeProto = dialParsed.protocol === "wss:" ? "https:" : "http:";
-          var probeUrl = new nodeUrl.URL(probeProto + "//" + dialParsed.host + dialParsed.pathname + dialParsed.search);
-          var probe = ssrfGuard.checkUrl(probeUrl, {
-            allowInternal: opts.allowInternal,
-            errorClass:    WsClientError,
-          });
-          this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
-        }
-      } catch (e) {
-        return self._handleSocketError(e);
+      var nextTarget = opts.urlFor(attempt);
+      if (typeof nextTarget === "string" && nextTarget.length > 0 && nextTarget !== opts.target) {
+        dialParsed = _parseUrl(nextTarget);
       }
     }
-
     var dialTlsOpts = opts.tlsOpts;
     if (typeof opts.tlsOptsFor === "function") {
-      try {
-        var override = opts.tlsOptsFor(attempt);
-        if (override && typeof override === "object") {
-          dialTlsOpts = Object.assign({}, opts.tlsOpts || {}, override);
-        }
-      } catch (e) {
-        return self._handleSocketError(e);
+      var override = opts.tlsOptsFor(attempt);
+      if (override && typeof override === "object") {
+        dialTlsOpts = Object.assign({}, opts.tlsOpts || {}, override);
       }
     }
+    var probeProto = dialParsed.protocol === "wss:" ? "https:" : "http:";
+    var probeUrl = new nodeUrl.URL(probeProto + "//" + dialParsed.host + dialParsed.pathname + dialParsed.search);
+    var probe = await ssrfGuard.checkUrl(probeUrl, {
+      allowInternal: opts.allowInternal,
+      errorClass:    WsClientError,
+    });
+    this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
+    this._dialParsed    = dialParsed;
+    this._dialTlsOpts   = dialTlsOpts;
+  }
+
+  _dial() {
+    var self = this;
+    this._readyState = "connecting";
 
-    var parsed = dialParsed;
+    // Target + TLS material were resolved and SSRF-validated by _prepareDial.
+    var parsed = this._dialParsed || this._opts.parsedUrl;
+    var dialTlsOpts = this._dialTlsOpts || this._opts.tlsOpts;
     var port = parsed.port ? parseInt(parsed.port, 10) :
                (parsed.protocol === "wss:" ? 443 : 80);                                  // TLS / HTTP default port
     var host = parsed.hostname;
@@ -422,8 +417,8 @@ class WsClient extends EventEmitter {
 
     this._handshakeTimer = setTimeout(function () {
       self._handleSocketError(new WsClientError("ws-client/handshake-timeout",
-        "Handshake exceeded " + opts.handshakeTimeoutMs + "ms"));
-    }, opts.handshakeTimeoutMs);
+        "Handshake exceeded " + self._opts.handshakeTimeoutMs + "ms"));
+    }, self._opts.handshakeTimeoutMs);
     if (typeof this._handshakeTimer.unref === "function") this._handshakeTimer.unref();
   }
 
@@ -644,6 +639,17 @@ class WsClient extends EventEmitter {
         return;
       }
     }
+    // Fail the connection on any opcode outside the six RFC 6455 §5.2-defined
+    // values (CONT/TEXT/BINARY/CLOSE/PING/PONG). Without this, a reserved
+    // opcode (0x3-0x7, 0xB-0xF) from a malicious server fell through every
+    // branch to the FIN block and emitted a (stale/empty) message — a
+    // fragmented-message desync / frame-injection lever.
+    if (frame.opcode !== OPCODE_CONT && frame.opcode !== OPCODE_TEXT &&
+        frame.opcode !== OPCODE_BINARY && !isControl) {
+      this._handleSocketError(new WsClientError("ws-client/reserved-opcode",
+        "reserved/unknown WebSocket opcode 0x" + frame.opcode.toString(16) + " (RFC 6455 §5.2)"));
+      return;
+    }
     // Continuation frames MUST NOT carry rsv1 (RFC 7692 §6.1) — only
     // the first frame of a compressed message sets rsv1.
     if (frame.opcode === OPCODE_CONT && frame.rsv1) {
@@ -926,7 +932,12 @@ class WsClient extends EventEmitter {
     this._reconnectTimer = setTimeout(function () {
       self._reconnectTimer = null;
       if (self._closed) return;                                                           // operator-cancelled in flight
-      self._dial();
+      // Re-resolve + re-validate the target (urlFor swap, DNS rebind) before
+      // reconnecting — awaited, so a now-private/metadata address is refused.
+      self._prepareDial().then(function () {
+        if (self._closed) return;
+        self._dial();
+      }).catch(function (e) { self._handleSocketError(e); });
     }, delay);
     if (typeof this._reconnectTimer.unref === "function") this._reconnectTimer.unref();
     this.emit("reconnecting", { attempt: this._reconnectAttempt, delayMs: delay });

package/lib/x509-chain.js

@@ -0,0 +1,44 @@
+"use strict";
+
+// Internal X.509 path-validation helpers shared by the framework's
+// certificate-chain walkers (b.tsa.verifyToken, b.mail.bimi VMC/CMC,
+// b.mail.crypto.smime.verify). They exist because node:crypto's
+// X509Certificate.checkIssued() validates the issuer/subject DN match,
+// the AKI/SKI linkage, and — when a keyUsage extension is present —
+// keyCertSign, but it does NOT enforce basicConstraints cA:TRUE. A
+// leaf / end-entity certificate (cA:FALSE) that omits keyUsage is
+// therefore wrongly accepted as a signing CA for the next cert in the
+// chain — the classic basicConstraints bypass (CVE-2002-0862 class).
+// Every chain walker routes its issuer test through these helpers so the
+// cA enforcement can never be forgotten in one walker but present in
+// another.
+
+// True only when `cert` asserts basicConstraints cA:TRUE. node's
+// X509Certificate exposes `.ca` (a boolean); a cert with no
+// basicConstraints extension or with cA:FALSE returns false. A missing
+// cert or a non-boolean `.ca` (parse failure / unsupported runtime)
+// fails closed.
+function isCaCert(cert) {
+  return !!cert && cert.ca === true;
+}
+
+// True when `issuer` validly issued `subject` AND is itself a CA: the
+// DN / AKI-SKI / keyUsage linkage (checkIssued), the cryptographic
+// signature (verify), and basicConstraints cA:TRUE (isCaCert). The cA
+// check runs first so a non-CA cert is rejected before the expensive
+// signature verification. Any exception (malformed cert, unsupported
+// key type) fails closed to false.
+function issuerValidlyIssued(issuer, subject) {
+  try {
+    return isCaCert(issuer) &&
+      subject.checkIssued(issuer) &&
+      subject.verify(issuer.publicKey);
+  } catch (_e) {
+    return false;
+  }
+}
+
+module.exports = {
+  isCaCert:            isCaCert,
+  issuerValidlyIssued: issuerValidlyIssued,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.13",
+  "version": "0.15.14",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4df0908b-006e-466d-b6f7-6426f710546e",
+  "serialNumber": "urn:uuid:81a205f2-938f-47e5-9426-3245e2ac5859",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-20T02:02:17.152Z",
+    "timestamp": "2026-06-21T13:24:58.132Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.13",
+      "bom-ref": "@blamejs/core@0.15.14",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.13",
+      "version": "0.15.14",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.13",
+      "purl": "pkg:npm/%40blamejs/core@0.15.14",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.13",
+      "ref": "@blamejs/core@0.15.14",
       "dependsOn": []
     }
   ]