@blamejs/core 0.15.13 → 0.15.15

package/lib/middleware/csrf-protect.js

@@ -77,6 +77,9 @@ var audit = lazyRequire(function () { return require("../audit"); });
 var DEFAULT_FIELD_NAME    = "_csrf";
 var DEFAULT_HEADER_NAME   = "X-CSRF-Token";
 var DEFAULT_METHODS       = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
+// Per-process counter giving each csrfProtect mount a unique idempotency id so
+// a stricter sub-route instance is not silently disabled by an earlier one.
+var _csrfGateSeq = 0;
 
 // Default cookie name uses the RFC 6265bis __Host- prefix when the request
 // is over HTTPS. The prefix forces browsers to refuse the cookie unless
@@ -124,17 +127,6 @@ function _parseCookieHeader(header) {
   return Object.assign(Object.create(null), Object.fromEntries(pairs));
 }
 
-// `_isHttps` defers to `requestHelpers.requestProtocol` so the
-// per-middleware `trustProxy` opt gates whether X-Forwarded-Proto is
-// consulted. Without trustProxy, an attacker could otherwise forge
-// the header to force the Secure cookie attribute (and inversely,
-// suppress it) on direct-to-server connections.
-function _isHttpsFor(trustProxy) {
-  return function (req) {
-    return requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https";
-  };
-}
-
 function _formatSetCookie(name, value, opts) {
   var parts = [name + "=" + value];
   parts.push("Path=" + (opts.path || "/"));
@@ -275,7 +267,9 @@ function _writeReject(req, res, message, reason, onDeny, problemMode) {
  *     allowedOrigins:         string[],
  *     requireOrigin:          boolean,
  *     requireJsonContentType: boolean,
- *     trustProxy:             boolean|number,
+ *     trustedProxies:         string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto for the Secure-cookie decision
+ *     protocolResolver:       function(req): "http"|"https",  // own the HTTPS decision
+ *     trustProxy:             boolean|number,    // legacy; refused unless paired with trustedProxies/protocolResolver (spoofable)
  *     audit:                  boolean,
  *     skipStateless:          boolean,   // default false — skip validation for Authorization-header / cookieless (not-CSRF-able) requests
  *     onDeny:                 function(req, res, info): void,  // own the 403; info = { status, reason }
@@ -296,14 +290,31 @@ function create(opts) {
 
   validateOpts(opts, [
     "cookie", "tokenLookup", "fieldName", "headerName", "methods", "audit",
-    "trustProxy", "checkOrigin", "allowedOrigins", "requireJsonContentType",
+    "trustProxy", "trustedProxies", "protocolResolver",
+    "checkOrigin", "allowedOrigins", "requireJsonContentType",
     "requireOrigin", "skipStateless", "skipPaths", "skip", "onDeny", "problemDetails",
   ], "middleware.csrfProtect");
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _isHttps = _isHttpsFor(trustProxy);
+  // The Secure-cookie decision turns on whether the request is HTTPS, which
+  // behind a proxy comes from X-Forwarded-Proto. A bare trustProxy trusts that
+  // forgeable header from any caller — a direct request could suppress the
+  // Secure flag (cookie downgrade) or force it. Peer-gate it: declare your
+  // reverse proxies via trustedProxies, or own the decision via
+  // protocolResolver. A bare trustProxy is refused at construction.
+  var _proto;
+  try {
+    _proto = requestHelpers.trustedProtocol({
+      trustedProxies:   opts.trustedProxies,
+      protocolResolver: opts.protocolResolver,
+    });
+  } catch (e) { throw new Error("middleware.csrfProtect: " + e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_proto.peerGated) {
+    throw new Error("middleware.csrfProtect: trustProxy is spoofable for the Secure-cookie " +
+      "decision — a direct caller could forge X-Forwarded-Proto. Declare your reverse proxies " +
+      "via trustedProxies: [\"10.0.0.0/8\", …] or supply protocolResolver(req).");
+  }
+  function _isHttps(req) { return _proto.resolve(req) === "https"; }
 
   // Throw at create() — exactly one issuance source allowed.
   var hasCookie = opts.cookie != null && opts.cookie !== false;
@@ -318,8 +329,22 @@ function create(opts) {
 
   var fieldName  = opts.fieldName  || DEFAULT_FIELD_NAME;
   var headerName = (opts.headerName || DEFAULT_HEADER_NAME).toLowerCase();
+  // An empty methods array is truthy → `opts.methods || DEFAULT_METHODS` keeps
+  // `[]` and the method-gate matches nothing, silently disabling the primary
+  // CSRF check for all state-changing requests. Reject at config time.
+  if (opts.methods !== undefined) {
+    if (!Array.isArray(opts.methods) || opts.methods.length === 0 ||
+        !opts.methods.every(function (m) { return typeof m === "string" && m.length > 0; })) {
+      throw new Error("middleware.csrfProtect: opts.methods must be a non-empty array of HTTP method tokens (omit it for the POST/PUT/DELETE/PATCH default)");
+    }
+  }
   var methods    = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
   var auditOn    = opts.audit !== false;
+  // Per-instance idempotency id — a stricter sub-route csrf mount must not be
+  // silently disabled by an earlier lenient one sharing a global flag (token
+  // issue is idempotent and double-validate is safe, so per-instance re-run is
+  // sound).
+  var GATE_ID = "csrf:" + (_csrfGateSeq++);
 
   // Origin / Referer cross-check — second-line defense alongside the
   // double-submit token. If the request's Origin (or Referer when
@@ -452,6 +477,17 @@ function create(opts) {
       req.csrfToken = existing;
       return existing;
     }
+    // Cookie issuance is idempotent at the RESPONSE level, keyed by cookie
+    // name: a redundant mount (createApp wired csrf AND an operator re-mounted
+    // it with the same cookie name) must emit a single Set-Cookie, not one per
+    // instance. Enforcement stays per instance (each gate still validates the
+    // token below) — only the response-cookie resource is deduped, so a mount
+    // with a DIFFERENT cookie name still issues its own.
+    if (!req._csrfIssuedCookies) req._csrfIssuedCookies = Object.create(null);
+    if (Object.prototype.hasOwnProperty.call(req._csrfIssuedCookies, cookieName)) {
+      req.csrfToken = req._csrfIssuedCookies[cookieName];
+      return req.csrfToken;
+    }
     if (existing && !/^[a-f0-9]{64}$/.test(existing)) {
       // Audit-emit so operators see when a planted/short cookie is
       // refused — surfaces the attack class in compliance logs.
@@ -472,16 +508,19 @@ function create(opts) {
       maxAge:   cookieCfg.maxAge,
     });
     _appendSetCookie(res, setCookie);
+    req._csrfIssuedCookies[cookieName] = fresh;
     req.csrfToken = fresh;
     return fresh;
   }
 
   return function csrfProtect(req, res, next) {
-    // Idempotent: a second csrf mount this request (e.g. createApp wired
-    // it AND an operator mounted it again) is a no-op — the first instance
-    // already issued + validated.
-    if (req._csrfApplied) return next();
-    req._csrfApplied = true;
+    // Idempotent PER INSTANCE: the SAME mount running twice (createApp wired it
+    // AND an operator mounted it again) is a no-op, but a distinct stricter
+    // sub-route instance still runs — a shared global flag let the first
+    // (lenient) mount disable the second.
+    if (!req._csrfGates) req._csrfGates = Object.create(null);
+    if (req._csrfGates[GATE_ID]) return next();
+    req._csrfGates[GATE_ID] = true;
 
     // Issue/refresh the token on EVERY request (safe + state-changing)
     // when running in cookie mode — templates rendered after a POST

package/lib/middleware/daily-byte-quota.js

@@ -187,13 +187,15 @@ function create(opts) {
     // is observed via writableLength as res.write / res.end fire.
     var inboundBytes = 0;
     if (req.headers && typeof req.headers === "object") {
-      // Approximate: each header line is "Name: Value\r\n". Sum the
-      // string lengths; the actual byte count differs only on multi-
-      // byte UTF-8, which is uncommon in standard headers.
+      // Each header line is "Name: Value\r\n". Count UTF-8 BYTES (not .length
+      // / UTF-16 code units) so a multibyte header value isn't under-accounted
+      // against the byte quota — matching the outbound counting below, which
+      // already uses Buffer.byteLength.
       var keys = Object.keys(req.headers);
       for (var hi = 0; hi < keys.length; hi++) {
         var v = req.headers[keys[hi]];
-        inboundBytes += keys[hi].length + 2 + (typeof v === "string" ? v.length : 0) + 2;        // ": " + "\r\n" overhead
+        inboundBytes += Buffer.byteLength(keys[hi], "utf8") + 2 +
+          (typeof v === "string" ? Buffer.byteLength(v, "utf8") : 0) + 2;                         // ": " + "\r\n" overhead
       }
     }
     if (req.headers && req.headers["content-length"]) {

package/lib/middleware/fetch-metadata.js

@@ -42,6 +42,10 @@ var audit = lazyRequire(function () { return require("../audit"); });
 var observability = lazyRequire(function () { return require("../observability"); });
 
 var DEFAULT_METHODS = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
+// Monotonic per-process counter giving each fetchMetadata mount a unique
+// idempotency id (see GATE_ID in create) so a stricter sub-route instance is
+// not silently disabled by an earlier lenient one sharing a global flag.
+var _fmGateSeq = 0;
 
 // Sec-Fetch-Dest request-destination vocabulary (Fetch Standard §3.2.6
 // "destination", https://fetch.spec.whatwg.org/#concept-request-destination;
@@ -81,7 +85,7 @@ function _validateDestList(list, label) {
   // the typo surfaces before it silently fails to match at request time.
   if (!Array.isArray(list)) return;
   for (var i = 0; i < list.length; i += 1) {
-    if (!KNOWN_DEST_SET[list[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_DEST_SET, list[i])) {
       throw new Error("middleware.fetchMetadata: " + label + "[" + i +
         "] is not a known Sec-Fetch-Dest value (got '" + String(list[i]) +
         "'). Known destinations: " + KNOWN_DESTINATIONS.join(", ") + ".");
@@ -206,8 +210,26 @@ function create(opts) {
     }
   }
   var allowedNavigate = opts.allowedNavigate !== false;
+  // An empty methods array is truthy, so `opts.methods || DEFAULT_METHODS`
+  // would keep `[]` and `methods.indexOf(req.method) === -1` would be true for
+  // EVERY request — silently turning the gate into a pass-through. Reject a
+  // present-but-empty/garbage list at config time (fail-fast, don't degrade
+  // the gate to a no-op).
+  if (opts.methods !== undefined) {
+    if (!Array.isArray(opts.methods) || opts.methods.length === 0 ||
+        !opts.methods.every(function (m) { return typeof m === "string" && m.length > 0; })) {
+      throw new Error("middleware.fetchMetadata: opts.methods must be a non-empty array of HTTP method tokens (omit it for the POST/PUT/DELETE/PATCH default)");
+    }
+  }
   var methods         = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
   var auditOn         = opts.audit !== false;
+  // Per-instance idempotency id: a request carries a Set of gates that have
+  // already run. The OLD shared `req._fetchMetadataChecked` boolean let the
+  // FIRST fetch-metadata mount (e.g. the lenient app-level default) permanently
+  // disable a STRICTER instance layered on a sub-route. Keying by a unique id
+  // lets each distinct mount run once while the SAME instance mounted twice
+  // still no-ops.
+  var GATE_ID = "fm:" + (_fmGateSeq++);
 
   function _emitDenied(req, reason) {
     if (!auditOn) return;
@@ -223,9 +245,11 @@ function create(opts) {
   }
 
   return function fetchMetadata(req, res, next) {
-    // Idempotent: a second fetch-metadata mount this request is a no-op.
-    if (req._fetchMetadataChecked) return next();
-    req._fetchMetadataChecked = true;
+    // Idempotent PER INSTANCE: the same mount running twice on a request is a
+    // no-op, but a distinct (e.g. stricter sub-route) instance still evaluates.
+    if (!req._fetchMetadataGates) req._fetchMetadataGates = Object.create(null);
+    if (req._fetchMetadataGates[GATE_ID]) return next();
+    req._fetchMetadataGates[GATE_ID] = true;
     if (_shouldSkip(req)) return next();
     if (methods.indexOf(req.method) === -1) return next();
 

package/lib/middleware/network-allowlist.js

@@ -16,12 +16,12 @@
  * the wiki example default).
  *
  *   var fence = b.middleware.networkAllowlist({
- *     paths:        ["/admin", "/admin/", "/healthz/internal"],
- *     allowedCidrs: ["10.0.0.0/8", "192.168.0.0/16", "::1/128"],
- *     trustProxy:   true,         // honour x-forwarded-for; default false
- *     denyStatus:   404,          // default — reveal nothing about the gate
- *     denyBody:     "Not Found",  // default
- *     audit:        b.audit,      // default: null — emits network.gate.denied
+ *     paths:          ["/admin", "/admin/", "/healthz/internal"],
+ *     allowedCidrs:   ["10.0.0.0/8", "192.168.0.0/16", "::1/128"],
+ *     trustedProxies: ["10.0.0.0/8"], // peer-gate XFF to your proxy range
+ *     denyStatus:     404,            // default — reveal nothing about the gate
+ *     denyBody:       "Not Found",    // default
+ *     audit:          b.audit,        // default: null — emits network.gate.denied
  *   });
  *
  *   router.use(fence);
@@ -29,9 +29,11 @@
  * Behaviour:
  *   - The middleware is path-scoped: requests whose pathname doesn't
  *     start with any of `paths` pass through unchanged. Hot-path-cheap.
- *   - Requests on a gated path get their client IP resolved through
- *     b.requestHelpers.clientIp(req, { trustProxy }) — same trust
- *     model as every other middleware that reads client IP.
+ *   - Requests on a gated path get their client IP resolved peer-gated:
+ *     the socket address by default, or — when `trustedProxies` /
+ *     `clientIpResolver` is set — X-Forwarded-For honored only from a
+ *     trusted proxy peer. A bare `trustProxy` is refused at construction
+ *     because it would let a direct caller forge an allowed address.
  *   - The IP is checked against the CIDR allowlist using
  *     b.ssrfGuard.cidrContains. A miss returns denyStatus + denyBody
  *     and audits the rejection. Default 404 hides the gate's
@@ -84,38 +86,47 @@ function _validateCidr(cidr) {
  * authorization prevents unauthorized USERS from reaching sensitive
  * routes; this middleware adds a NETWORK-layer fence so a credential
  * leak doesn't compromise the gate. Path-scoped — requests outside
- * the configured prefixes pass through hot-path-cheap. Resolves
- * client IP via `b.requestHelpers.clientIp` (with `trustProxy`),
- * checks against the CIDR allowlist via `b.ssrfGuard.cidrContains`,
- * and refuses misses with HTTP 404 by default (hides the gate from
- * probes). Throws at create-time on malformed opts.
+ * the configured prefixes pass through hot-path-cheap. Checks the
+ * resolved client IP against the CIDR allowlist via
+ * `b.ssrfGuard.cidrContains` and refuses misses with HTTP 404 by
+ * default (hides the gate from probes). Throws at create-time on
+ * malformed opts.
+ *
+ * Client-IP resolution is peer-gated. By default only the socket
+ * address is used — X-Forwarded-For is attacker-forgeable, so trusting
+ * it bare would let a direct caller spoof an allowed IP through the
+ * gate. Behind a reverse proxy, declare it with `trustedProxies`
+ * (CIDRs — XFF is then honored only when the immediate peer is one of
+ * them) or own resolution entirely with `clientIpResolver(req)`. A bare
+ * `trustProxy` is refused at construction.
  *
  * @opts
  *   {
- *     paths:        string[],   // pathname prefixes, required
- *     allowedCidrs: string[],   // required
- *     deniedCidrs:  string[],
- *     trustProxy:   boolean,    // default false
- *     denyStatus:   number,     // default 404
- *     denyBody:     string,     // default "Not Found"
- *     audit:        object,
- *     onDeny:       function(req, res, info): void,  // own the refusal; info = { status, reason, clientIp, route }
- *     problemDetails: boolean,  // default false — emit RFC 9457 application/problem+json instead of text/plain
+ *     paths:           string[],   // pathname prefixes, required
+ *     allowedCidrs:    string[],   // required
+ *     deniedCidrs:     string[],
+ *     trustedProxies:  string[],   // CIDRs of your reverse proxies — peer-gates X-Forwarded-For
+ *     clientIpResolver: function(req): string|null,  // own client-IP resolution
+ *     denyStatus:      number,     // default 404
+ *     denyBody:        string,     // default "Not Found"
+ *     audit:           object,
+ *     onDeny:          function(req, res, info): void,  // own the refusal; info = { status, reason, clientIp, route }
+ *     problemDetails:  boolean,    // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
  *
  * @example
  *   var b = require("@blamejs/core");
  *   var app = b.router.create();
  *   app.use(b.middleware.networkAllowlist({
- *     paths:        ["/admin"],
- *     allowedCidrs: ["10.0.0.0/8", "::1/128"],
- *     trustProxy:   true,
+ *     paths:          ["/admin"],
+ *     allowedCidrs:   ["10.0.0.0/8", "::1/128"],
+ *     trustedProxies: ["10.0.0.0/8"],   // your reverse proxy's range
  *   }));
  */
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
-    "paths", "allowedCidrs", "deniedCidrs", "trustProxy",
+    "paths", "allowedCidrs", "deniedCidrs", "trustProxy", "trustedProxies", "clientIpResolver",
     "denyStatus", "denyBody", "audit", "onDeny", "problemDetails",
   ], "middleware.networkAllowlist");
 
@@ -148,10 +159,30 @@ function create(opts) {
     }
   }
 
+  // Client-IP resolution for an access-control gate must be peer-gated:
+  // a bare `trustProxy` honors X-Forwarded-For from any caller, so a client
+  // connecting directly can forge an allowed address and walk through the
+  // gate. Operators behind a reverse proxy declare it via `trustedProxies`
+  // (CIDRs of their proxies — XFF is then peer-gated) or own resolution
+  // entirely via `clientIpResolver`. We refuse, at construction, the
+  // spoofable combination of `trustProxy` without either.
+  var _ipResolver;
+  try {
+    _ipResolver = requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    });
+  } catch (e) { throw _err("BAD_OPT", e.message); }
+  var trustProxyOpt = opts.trustProxy === true || typeof opts.trustProxy === "number";
+  if (trustProxyOpt && !_ipResolver.peerGated) {
+    throw _err("BAD_OPT",
+      "trustProxy is spoofable for an access-control gate — X-Forwarded-For from a " +
+      "direct caller would be trusted. Declare your reverse proxies via " +
+      "trustedProxies: [\"10.0.0.0/8\", …] (peer-gated XFF) or supply clientIpResolver(req).");
+  }
+
   var paths        = opts.paths.slice();
   var allowedCidrs = opts.allowedCidrs.slice();
-  var trustProxy   = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
   var denyStatus   = typeof opts.denyStatus === "number" ? opts.denyStatus : 404;
   if (denyStatus < 400 || denyStatus >= 600 || Math.floor(denyStatus) !== denyStatus) {
     throw _err("BAD_OPT", "denyStatus must be a 4xx or 5xx integer, got " + denyStatus);
@@ -212,7 +243,7 @@ function create(opts) {
     var pathname = req.pathname || (req.url || "").split("?")[0];
     if (!_matchesPath(pathname)) return next();
 
-    var ip = requestHelpers.clientIp(req, { trustProxy: trustProxy });
+    var ip = _ipResolver.resolve(req);
     if (!ip) {
       // Fail closed: a request we can't even derive an IP for shouldn't
       // bypass the gate.

package/lib/middleware/rate-limit.js

@@ -118,17 +118,6 @@ function _conflictRefs(dialect, table) {
 var audit  = lazyRequire(function () { return require("../audit"); });
 var logger = lazyRequire(function () { return require("../log").boot("rate-limit"); });
 
-// `_clientIp` defers to `requestHelpers.clientIp`, threading the
-// per-middleware `trustProxy` opt. Default refuses forwarded headers
-// (returning the socket address only) — operators behind a sanitizing
-// reverse proxy opt in via `trustProxy: true` (or a hop count).
-function _clientIpFor(trustProxy) {
-  return function (req) {
-    var ip = requestHelpers.clientIp(req, { trustProxy: trustProxy });
-    return ip || "unknown";
-  };
-}
-
 // Reject NaN / Infinity / negative / non-positive / non-number at create
 // time so a misconfigured rate-limit can't silently degrade to "no
 // limit" or produce divide-by-zero verdicts at request time.
@@ -457,7 +446,9 @@ function _resolveBackend(opts) {
  *     limit:           number,
  *     windowMs:        number,
  *     pruneIntervalMs: number,
- *     trustProxy:      boolean|number,
+ *     trustedProxies:  string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-For for the IP key
+ *     clientIpResolver: function(req): string|null,  // own the rate-limit key's client IP
+ *     trustProxy:      boolean|number,   // legacy; refused with the default IP key (spoofable) — use trustedProxies
  *   }
  *
  * @example
@@ -475,15 +466,33 @@ function create(opts) {
   validateOpts(opts, [
     "keyFn", "statusOnLimit", "bodyOnLimit", "onDeny", "problemDetails",
     "header", "headerPrefix", "skipPaths", "scope",
-    "backend", "trustProxy", "algorithm",
+    "backend", "trustProxy", "trustedProxies", "clientIpResolver", "algorithm",
     // memory backend (token-bucket)
     "burst", "refillPerSecond",
     // memory backend (fixed-window) + cluster backend
     "max", "limit", "windowMs", "pruneIntervalMs",
   ], "middleware.rateLimit");
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _clientIp = _clientIpFor(trustProxy);
+  // Peer-gated client-IP resolution. The default key (and the audit-actor
+  // IP) is the client address; a bare trustProxy would let a caller forge
+  // X-Forwarded-For to evade their own limit or poison a victim's bucket.
+  // Operators behind a proxy declare trustedProxies (CIDRs) or own
+  // resolution via clientIpResolver. A bare trustProxy is refused when the
+  // default IP key is in use (no keyFn) — it would be spoofable.
+  var _ipResolver;
+  try {
+    _ipResolver = requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    });
+  } catch (e) { throw new Error("middleware.rateLimit: " + e.message); }
+  var trustProxyBare = opts.trustProxy === true || typeof opts.trustProxy === "number";
+  if (trustProxyBare && !_ipResolver.peerGated && !opts.keyFn) {
+    throw new Error("middleware.rateLimit: trustProxy is spoofable — a caller can forge " +
+      "X-Forwarded-For to evade the limit or poison another IP's bucket. Declare your " +
+      "reverse proxies via trustedProxies: [\"10.0.0.0/8\", …], supply clientIpResolver(req), " +
+      "or set your own keyFn.");
+  }
+  var _clientIp = function (req) { return _ipResolver.resolve(req) || "unknown"; };
   var keyFn = opts.keyFn || _clientIp;
   var statusOnLimit = opts.statusOnLimit || 429;
   var bodyOnLimit = opts.bodyOnLimit !== undefined ? opts.bodyOnLimit : "Too Many Requests";

package/lib/middleware/scim-server.js

@@ -4,6 +4,7 @@
 // + /Schemas surfaces backed by operator-supplied CRUD callbacks.
 
 var framework_error = require("../framework-error");
+var numericBounds   = require("../numeric-bounds");
 var pick            = require("../pick");
 var validateOpts    = require("../validate-opts");
 var safeJson        = require("../safe-json");
@@ -609,7 +610,7 @@ function _anyDependencyFailed(refs, plan, executed, bulkIdMap) {
 // RFC 7644 §3.7 — failOnErrors is an OPTIONAL integer >= 1. Absent /
 // non-conforming values mean "process every operation" (null).
 function _parseFailOnErrors(value) {
-  if (typeof value !== "number" || !isFinite(value) || Math.floor(value) !== value || value < 1) {
+  if (!numericBounds.isPositiveFiniteInt(value)) {
     return null;
   }
   return value;

package/lib/middleware/security-headers.js

@@ -210,7 +210,9 @@ function _validatePermissionsPolicy(value) {
  *     acceptCh:           string|false,
  *     criticalCh:         string|false,
  *     reportingEndpoints: object,
- *     trustProxy:         boolean|number,
+ *     trustedProxies:     string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto for HSTS
+ *     protocolResolver:   function(req): "http"|"https",  // own the HTTPS decision
+ *     trustProxy:         boolean|number,    // legacy; refused unless paired with trustedProxies/protocolResolver (spoofable)
  *     coopReportOnly:           string,  // default: off — monitor-mode COOP
  *     coepReportOnly:           string,  // default: off — monitor-mode COEP
  *     documentPolicyReportOnly: string,  // default: off — monitor-mode Document-Policy
@@ -231,6 +233,7 @@ function create(opts) {
     "hsts", "contentTypeOptions", "frameOptions", "referrerPolicy",
     "permissionsPolicy", "coop", "coep", "corp",
     "originAgentCluster", "dnsPrefetchControl", "csp", "trustProxy",
+    "trustedProxies", "protocolResolver",
     "reportingEndpoints", "documentPolicy", "criticalCh", "acceptCh",
     "coopReportOnly", "coepReportOnly", "documentPolicyReportOnly",
     "requireDocumentPolicy", "serviceWorkerAllowed",
@@ -238,8 +241,23 @@ function create(opts) {
   if (opts.permissionsPolicy && typeof opts.permissionsPolicy === "string") {
     _validatePermissionsPolicy(opts.permissionsPolicy);
   }
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
+  // HSTS is emitted only on HTTPS responses; behind a proxy that comes from
+  // X-Forwarded-Proto. A bare trustProxy trusts the forgeable header from any
+  // caller, so a direct request forging "http" could suppress HSTS on a real
+  // HTTPS response (SSL-strip window). Peer-gate it via trustedProxies, or own
+  // the decision via protocolResolver; a bare trustProxy is refused.
+  var _proto;
+  try {
+    _proto = requestHelpers.trustedProtocol({
+      trustedProxies:   opts.trustedProxies,
+      protocolResolver: opts.protocolResolver,
+    });
+  } catch (e) { throw new TypeError("middleware.securityHeaders: " + e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_proto.peerGated) {
+    throw new TypeError("middleware.securityHeaders: trustProxy is spoofable for the HSTS " +
+      "decision — a direct caller could forge X-Forwarded-Proto to suppress HSTS. Declare your " +
+      "reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] or supply protocolResolver(req).");
+  }
   var hsts = opts.hsts === undefined ? "max-age=63072000; includeSubDomains; preload" : opts.hsts;
   var ctOpts = opts.contentTypeOptions === undefined ? "nosniff" : opts.contentTypeOptions;
   var frameOpts = opts.frameOptions === undefined ? "DENY" : opts.frameOptions;
@@ -317,9 +335,9 @@ function create(opts) {
     // RFC 6797 §7.2: HSTS over plain HTTP is meaningless (UAs ignore
     // it). Skip the header on non-TLS requests so dev-over-HTTP doesn't
     // surface confusing "Strict-Transport-Security on http://" lines.
-    // requestProtocol respects trustProxy — operators behind a TLS
-    // terminator opt in to read X-Forwarded-Proto.
-    if (hsts && requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https") {
+    // Peer-gated protocol resolution — X-Forwarded-Proto honored only from a
+    // trusted proxy (trustedProxies / protocolResolver), else the TLS socket.
+    if (hsts && _proto.resolve(req) === "https") {
       res.setHeader("Strict-Transport-Security", hsts);
     }
     if (ctOpts)     res.setHeader("X-Content-Type-Options", ctOpts);

package/lib/middleware/speculation-rules.js

@@ -66,6 +66,7 @@
 
 var validateOpts = require("../validate-opts");
 var safeBuffer = require("../safe-buffer");
+var safeJson = require("../safe-json");
 
 // Per W3C draft + Chromium implementation. `immediate` triggers the
 // speculation as soon as the rules are seen; `conservative` waits
@@ -129,7 +130,7 @@ function _validateRules(rules, label) {
         throw new TypeError(label + "." + actionKey + "[" + ei +
           "].where must be a `where` clause object (W3C draft, e.g. { href_matches: \"/path/*\" })");
       }
-      if (typeof rule.eagerness !== "string" || !EAGERNESS_LEVELS[rule.eagerness]) {
+      if (typeof rule.eagerness !== "string" || !Object.prototype.hasOwnProperty.call(EAGERNESS_LEVELS, rule.eagerness)) {
         throw new TypeError(label + "." + actionKey + "[" + ei +
           "].eagerness must be one of: " + Object.keys(EAGERNESS_LEVELS).join(", "));
       }
@@ -245,8 +246,10 @@ function create(opts) {
   }
 
   // Pre-built inline JSON. The body is small (rules objects are
-  // typically ~200 bytes); JSON.stringify once and cache.
-  var inlineJson = inline ? JSON.stringify(rulesObj) : null;
+  // typically ~200 bytes); stringify once and cache. Uses the
+  // <script>-safe serializer so a rules value containing "</script>"
+  // (or U+2028/U+2029) cannot break out of the injected element.
+  var inlineJson = inline ? safeJson.stringifyForScript(rulesObj) : null;
 
   return function speculationRules(req, res, next) {
     if (!inline) {

package/lib/middleware/tus-upload.js

@@ -399,7 +399,7 @@ function create(opts) {
 
   var extensions = Array.isArray(opts.extensions) ? opts.extensions.slice() : DEFAULT_EXTENSIONS.slice();
   for (var i = 0; i < extensions.length; i++) {
-    if (!KNOWN_EXTENSIONS[extensions[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_EXTENSIONS, extensions[i])) {
       throw new TusError("tus/bad-opts",
         "middleware.tusUpload: unknown extension '" + extensions[i] + "'");
     }
@@ -416,7 +416,7 @@ function create(opts) {
   var checksumAlgorithmSet = {};
   for (var j = 0; j < checksumAlgorithms.length; j++) {
     var algo = checksumAlgorithms[j];
-    if (!KNOWN_CHECKSUM_ALGORITHMS[algo]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_CHECKSUM_ALGORITHMS, algo)) {
       throw new TusError("tus/bad-opts",
         "middleware.tusUpload: unknown checksum algorithm '" + algo + "'");
     }

package/lib/money.js

@@ -412,7 +412,7 @@ function roundMinor(minor, step, mode) {
     throw new MoneyError("money/bad-minor-units",
       "minor must be an integer (BigInt or safe integer Number); got " + (typeof minor));
   }
-  if (!INCREMENT_MODES[mode]) {
+  if (!Object.prototype.hasOwnProperty.call(INCREMENT_MODES, mode)) {
     throw new MoneyError("money/bad-rounding-mode",
       "mode must be one of half-even | half-up | half-down | ceiling | floor; got " + String(mode));
   }

package/lib/mtls-ca.js

@@ -211,7 +211,7 @@ function create(opts) {
   var paths = _resolvePaths(opts.dataDir, opts.paths);
   var vault = opts.vault || null;
   var caKeySealedMode = (opts.caKeySealedMode || "required").toLowerCase();
-  if (!VALID_SEAL_MODES[caKeySealedMode]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_SEAL_MODES, caKeySealedMode)) {
     throw new MtlsCaError("mtls-ca/bad-mode",
       "caKeySealedMode must be 'required' or 'disabled' " +
       "(legacy 'auto' was removed — it defaulted to plaintext-on-disk)");
@@ -246,7 +246,7 @@ function create(opts) {
         current:    generation,
       };
     }
-    var pem = nodeFs.readFileSync(paths.caCert);
+    var pem = atomicFile.fdSafeReadSync(paths.caCert, { maxBytes: C.BYTES.mib(1) });
     var gen = parseGeneration(pem);
     return {
       exists:     true,
@@ -272,7 +272,9 @@ function create(opts) {
           "CA_KEY_SEALED='required' but " + paths.caKeySealed + " does not exist");
       }
       _requireVault("sealed CA key load");
-      var sealedBytes = nodeFs.readFileSync(paths.caKeySealed, "utf8").trim();
+      // Cap + fd-bound CA-private-key read. NO refuseSymlink: caKeySealed may be
+      // an operator-absolute path on a k8s/KMS secret volume that symlinks it.
+      var sealedBytes = atomicFile.fdSafeReadSync(paths.caKeySealed, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }).trim();
       var pem = vault.unseal(sealedBytes);
       if (!pem) {
         throw new MtlsCaError("mtls-ca/unseal-failed",
@@ -285,7 +287,9 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/plain-required",
         "caKeySealedMode='disabled' but " + paths.caKey + " does not exist");
     }
-    return nodeFs.readFileSync(paths.caKey);
+    // Cap + fd-bound plaintext CA-private-key read (disabled mode = dev opt-out).
+    // NO refuseSymlink (operator-absolute path may symlink).
+    return atomicFile.fdSafeReadSync(paths.caKey, { maxBytes: C.BYTES.kib(64) });
   }
 
   function loadCert() {
@@ -293,7 +297,7 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/missing-cert",
         "no CA cert on disk at " + paths.caCert);
     }
-    return nodeFs.readFileSync(paths.caCert);
+    return atomicFile.fdSafeReadSync(paths.caCert, { maxBytes: C.BYTES.mib(1) });
   }
 
   // Atomic commit: write .tmp + atomic rename for both key and cert.
@@ -446,7 +450,7 @@ function create(opts) {
         // safeJson.parse caps depth + size + protects against
         // proto-pollution; a tampered or truncated file shouldn't be able to
         // corrupt the rotator process.
-        var json = safeJson.parse(nodeFs.readFileSync(paths.revocations, "utf8"),
+        var json = safeJson.parse(atomicFile.fdSafeReadSync(paths.revocations, { maxBytes: C.BYTES.mib(16), encoding: "utf8" }),
           { maxBytes: C.BYTES.mib(16) });
         return (json && Array.isArray(json.revocations)) ? json.revocations : [];
       } catch (e) {

package/lib/network-dns-resolver.js

@@ -179,7 +179,7 @@ var QTYPE_BY_NAME = Object.freeze({
 function create(opts) {
   opts = opts || {};
   var profile     = opts.profile || (opts.posture && safeDns.compliancePosture(opts.posture)) || DEFAULT_PROFILE;
-  if (!safeDns.PROFILES[profile]) {
+  if (!Object.prototype.hasOwnProperty.call(safeDns.PROFILES, profile)) {
     throw new ResolverError("resolver/bad-profile",
       "create: unknown profile '" + profile + "'");
   }