@blamejs/core 0.15.13 → 0.15.15

package/lib/parsers/safe-yaml.js

@@ -771,9 +771,27 @@ function parse(input, opts) {
   }
 
   function _stripEolComment(text) {
-    // Strip ` #...` comments (must be preceded by whitespace) at end of line.
-    var match = text.match(/^(.*?)(\s+#.*)?$/);
-    return safeBuffer.stripTrailingHspace(match && match[1] != null ? match[1] : text);
+    // Strip ` #...` comments (a YAML end-of-line comment must be preceded by
+    // whitespace) via a single linear scan. The previous /^(.*?)(\s+#.*)?$/
+    // backtracks polynomially on a long inline-whitespace run with no '#'
+    // (each position re-tries `\s+#`) — a ReDoS lever on attacker-supplied
+    // YAML. This finds the first whitespace-preceded '#' and cuts the
+    // preceding whitespace run, identical output without the catastrophic
+    // backtracking.
+    for (var i = 1; i < text.length; i++) {
+      if (text.charCodeAt(i) !== 0x23 /* # */) continue;
+      var prev = text.charCodeAt(i - 1);
+      // inline whitespace: space / tab / vtab / formfeed / CR
+      if (prev !== 0x20 && prev !== 0x09 && prev !== 0x0b && prev !== 0x0c && prev !== 0x0d) continue;
+      var end = i;
+      while (end > 0) {
+        var c = text.charCodeAt(end - 1);
+        if (c === 0x20 || c === 0x09 || c === 0x0b || c === 0x0c || c === 0x0d) end--;
+        else break;
+      }
+      return safeBuffer.stripTrailingHspace(text.slice(0, end));
+    }
+    return safeBuffer.stripTrailingHspace(text);
   }
 
   // ---- Block scalars (| literal, > folded) ----

package/lib/pipl-cn.js

@@ -108,14 +108,17 @@ function _requireRecordedAt(value, label) {
  * and determine the lawful mechanism the transfer requires. PIPL Art. 38(1)
  * permits three bases for moving personal information out of the PRC — the
  * CAC standard contract (SCC), a CAC security assessment (Art. 40), or
- * certification by a CAC-accredited body — but the Measures for Security
- * Assessment of Outbound Data Transfers make the security assessment
- * MANDATORY (the operator may NOT self-select the standard contract or
- * certification) when the exporter is a critical-information-infrastructure
- * operator (CIIO), exports "important data", handles personal information
- * of more than 1,000,000 individuals, or has cumulatively exported PI of
- * more than 100,000 individuals or sensitive PI of more than 10,000
- * individuals since 1 January of the preceding year.
+ * certification by a CAC-accredited body. Under the CAC Provisions on
+ * Promoting and Regulating Cross-Border Data Flows (effective 2024, which
+ * relaxed the 2022 thresholds) the security assessment is MANDATORY (the
+ * operator may NOT self-select the standard contract or certification) when
+ * the exporter is a critical-information-infrastructure operator (CIIO),
+ * exports "important data", or — counting cumulatively since 1 January of
+ * the current year — transfers the personal information of more than
+ * 1,000,000 individuals (non-sensitive) or the sensitive personal
+ * information of more than 10,000 individuals. The 100,000–1,000,000
+ * non-sensitive band is the standard-contract / certification tier, NOT a
+ * security-assessment trigger.
  *
  * The builder validates the operator-supplied facts, computes
  * `securityAssessmentRequired` against those thresholds, resolves the

package/lib/queue-local.js

@@ -406,7 +406,13 @@ function create(config) {
       .where("_id", jobId)
       .where("status", "inflight")
       .toSql();
-    await store.execute(doneBuilt.sql, doneBuilt.params);
+    var doneRes = await store.execute(doneBuilt.sql, doneBuilt.params);
+    // Only run the post-completion side effects if THIS call actually flipped
+    // the row inflight→done. If the status guard matched 0 rows the job was
+    // already completed or re-leased to another worker (its lease expired and
+    // sweepExpired re-queued it) — a stale completer must NOT re-enqueue the
+    // cron repeat (duplicate firing) or release flow children twice.
+    if ((doneRes.rowCount || 0) === 0) return false;
 
     // Repeat-in-queue: cron-recurring job re-enqueues itself for the
     // next firing time. Failures (which take the fail() path) don't
@@ -513,9 +519,10 @@ function create(config) {
               [nowMs + retryDelayMs])
       .setRaw("finishedAt", "CASE WHEN " + attemptsLt + " THEN NULL ELSE ? END", [nowMs])
       .where("_id", jobId)
+      .where("status", "inflight")          // lease-ownership guard — a stale fail() must not clobber a job re-leased to another worker after this one's lease expired (mirrors complete()/extendLease)
       .toSql();
-    await store.execute(failBuilt.sql, failBuilt.params);
-    return true;
+    var failRes = await store.execute(failBuilt.sql, failBuilt.params);
+    return (failRes.rowCount || 0) > 0;
   }
 
   async function sweepExpired() {

package/lib/redact.js

@@ -278,12 +278,16 @@ function redact(value, opts) {
 function _redact(value, depth, maxDepth, marker, parentKey) {
   if (depth > maxDepth) return marker;
   if (value === null || value === undefined) return value;
+  // A sensitive parent key collapses the ENTIRE value — scalar OR composite —
+  // to the marker. Checking before the type branches is what stops a secret
+  // under e.g. `authorization: ["Bearer …"]` / `password: {…}` from slipping
+  // through the array/object branches (which recurse with parentKey=null), the
+  // way a scalar already does (CWE-532 telemetry egress).
+  if (parentKey && _isSensitiveFieldName(parentKey)) return marker;
   if (typeof value === "string") {
-    if (parentKey && _isSensitiveFieldName(parentKey)) return marker;
     return _redactValue(value);
   }
   if (typeof value === "number" || typeof value === "boolean") {
-    if (parentKey && _isSensitiveFieldName(parentKey)) return marker;
     return value;
   }
   if (Buffer.isBuffer(value) || value instanceof Uint8Array) {
@@ -513,7 +517,7 @@ function classifyDefaults(opts) {
         "redact.classifyDefaults: patterns[" + p + "] must be a string, got " +
         typeof patterns[p]);
     }
-    if (!CLASSIFIER_PATTERNS[patterns[p]] &&
+    if (!Object.prototype.hasOwnProperty.call(CLASSIFIER_PATTERNS, patterns[p]) &&
         !(opts.extra && opts.extra[patterns[p]])) {
       throw new DlpError("redact-dlp/unknown-pattern",
         "redact.classifyDefaults: unknown pattern '" + patterns[p] +

package/lib/request-helpers.js

@@ -44,6 +44,11 @@
 var structuredFields = require("./structured-fields");
 var pick = require("./pick");
 var codepointClass = require("./codepoint-class");
+var lazyRequire = require("./lazy-require");
+// Lazy — ssrf-guard pulls in the network/DNS stack, and request-helpers is
+// required very early in the boot graph. Only touched at middleware-construction
+// time by trustedClientIp(), never on the hot path.
+var _ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
 
 var HTTP_STATUS = Object.freeze({
   OK:                            0xC8,
@@ -214,15 +219,24 @@ function resolveActorWithOverride(callerOpts, baseOverride) {
  *
  * Resolve the originating client IP from a request. Default reads
  * only `req.socket.remoteAddress` — `X-Forwarded-For` is ignored
- * because without a sanitizing reverse proxy it's
- * attacker-forgeable. Behind a trusted proxy, operators opt in via
- * `trustProxy: true` (use the leftmost XFF hop) or
- * `trustProxy: <N>` (skip N trusted hops from the right and return
- * the Nth-from-rightmost). Returns `null` when no address can be
- * read — never throws.
+ * because without a sanitizing reverse proxy it's attacker-forgeable.
+ *
+ * For an access-control decision (allowlist, rate-limit key, IP-bound
+ * grant), pass `trustProxy` as a PREDICATE `function(addr) => boolean`
+ * naming your trusted reverse proxies. The header is then honored only
+ * when the immediate TCP peer is itself a trusted proxy, and the client
+ * is the first untrusted address walking the chain right-to-left. A
+ * direct attacker cannot forge it — this is the only peer-gated form.
+ *
+ * The legacy `trustProxy: true` (leftmost XFF hop) and `trustProxy: <N>`
+ * (Nth-from-rightmost) forms do NOT verify the peer: a client connecting
+ * directly can forge any value. They are safe only when an upstream you
+ * control terminates and rewrites X-Forwarded-For on every request — never
+ * for a security decision on an internet-facing listener. Prefer the
+ * predicate form. Returns `null` when no address can be read — never throws.
  *
  * @opts
- *   trustProxy: boolean | number   // false (default) | true | hop count
+ *   trustProxy: boolean | number | function   // false (default) | predicate (peer-gated) | legacy true/hop-count
  *
  * @example
  *   var req = {
@@ -232,30 +246,55 @@ function resolveActorWithOverride(callerOpts, baseOverride) {
  *   b.requestHelpers.clientIp(req);
  *   // → "10.0.0.1"   (forwarded headers ignored by default)
  *
- *   b.requestHelpers.clientIp(req, { trustProxy: true });
- *   // → "203.0.113.7"   (leftmost XFF hop)
+ *   var fromTrusted = function (a) { return a.indexOf("10.") === 0; };
+ *   b.requestHelpers.clientIp(req, { trustProxy: fromTrusted });
+ *   // → "203.0.113.7"   (peer 10.0.0.1 trusted; first untrusted hop)
  *
- *   b.requestHelpers.clientIp(req, { trustProxy: 1 });
- *   // → "10.0.0.5"   (1 trusted hop from the right)
+ *   var forged = { socket: { remoteAddress: "198.51.100.66" },
+ *                  headers: { "x-forwarded-for": "203.0.113.7" } };
+ *   b.requestHelpers.clientIp(forged, { trustProxy: fromTrusted });
+ *   // → "198.51.100.66"   (peer untrusted → forged header ignored)
  *
  *   b.requestHelpers.clientIp(undefined);
  *   // → null
  */
 function clientIp(req, opts) {
   if (!req) return null;
+  var socketAddr =
+    (req.socket && typeof req.socket.remoteAddress === "string" && req.socket.remoteAddress) ? req.socket.remoteAddress
+    : (req.connection && typeof req.connection.remoteAddress === "string" && req.connection.remoteAddress) ? req.connection.remoteAddress
+    : null;
   var trust = opts && opts.trustProxy;
   if (trust && req.headers) {
     var xff = req.headers["x-forwarded-for"];
     if (xff) {
       var hops = parseListHeader(xff);
-      if (trust === true) return hops[0];
-      if (typeof trust === "number" && trust >= 1 && hops.length >= trust) {
-        return hops[hops.length - trust];
+      if (hops.length) {
+        if (typeof trust === "function") {
+          // Peer-gated resolution: `trust(addr)` names the trusted reverse
+          // proxies. X-Forwarded-For is honored ONLY when the immediate TCP
+          // peer is itself a trusted proxy; the real client is then the first
+          // untrusted address walking the chain right-to-left (each hop is
+          // appended by the proxy that observed it). A direct attacker — whose
+          // socket peer is not a trusted proxy — cannot forge the result: the
+          // forgeable header is ignored and we fall through to the socket
+          // address. This is the only form safe for an access-control decision.
+          if (socketAddr && trust(socketAddr)) {
+            for (var i = hops.length - 1; i >= 0; i--) {
+              if (!trust(hops[i])) return hops[i];
+            }
+            return hops[0];   // entire chain trusted — earliest claimed client
+          }
+          // peer is not a trusted proxy → ignore forgeable XFF, fall through
+        } else if (trust === true) {
+          return hops[0];
+        } else if (typeof trust === "number" && trust >= 1 && hops.length >= trust) {
+          return hops[hops.length - trust];
+        }
       }
     }
   }
-  if (req.socket && typeof req.socket.remoteAddress === "string") return req.socket.remoteAddress;
-  if (req.connection && typeof req.connection.remoteAddress === "string") return req.connection.remoteAddress;
+  if (socketAddr) return socketAddr;
   // Express-shaped requests expose the resolved client address as `req.ip`
   // (Express derives it from the socket, honoring its own trust-proxy
   // setting) without a `socket.remoteAddress` surface. Fall back to it so a
@@ -266,6 +305,253 @@ function clientIp(req, opts) {
   return null;
 }
 
+/**
+ * @primitive b.requestHelpers.trustedClientIp
+ * @signature b.requestHelpers.trustedClientIp(opts?)
+ * @since     0.15.14
+ * @related   b.requestHelpers.clientIp
+ *
+ * Build a peer-gated client-IP resolver for an access-control decision
+ * (allowlist, rate-limit key, IP-bound grant). The bare `trustProxy`
+ * forms of `clientIp` are forgeable; this is the shape every gate shares
+ * so the trust model is identical across them. Returns
+ * `{ resolve(req), peerGated }`: `resolve` reads the client IP, `peerGated`
+ * is true when `trustedProxies` or `clientIpResolver` was supplied — a
+ * gate uses it to refuse a bare `trustProxy` at construction (fail closed).
+ *
+ * With `clientIpResolver(req)` the operator owns resolution entirely. With
+ * `trustedProxies` (CIDRs of the reverse proxies), `X-Forwarded-For` is
+ * honored only when the immediate peer is one of them. With neither, only
+ * the socket address is used and forwarded headers are ignored.
+ *
+ * @opts
+ *   trustedProxies:   string | string[],          // CIDRs — peer-gate X-Forwarded-For
+ *   clientIpResolver: function(req): string|null,  // own resolution entirely
+ *
+ * @example
+ *   var tip = b.requestHelpers.trustedClientIp({ trustedProxies: ["10.0.0.0/8"] });
+ *   var ip  = tip.resolve(req);   // peer-gated; forged XFF from a direct caller ignored
+ */
+// Build the trusted-proxy predicate shared by trustedClientIp / trustedProtocol.
+// Validates each CIDR (a CIDR is valid iff it contains its own network address,
+// reusing the same matcher the predicate uses so format rules can't diverge) and
+// returns fn(addr)=>boolean, or null when no trustedProxies were given. `where`
+// names the calling helper for the error message.
+function _trustedProxyPredicate(trustedProxies, where) {
+  if (!trustedProxies || !trustedProxies.length) return null;
+  var ssrfGuard = _ssrfGuard();
+  for (var i = 0; i < trustedProxies.length; i++) {
+    var cidr = trustedProxies[i];
+    var slash = typeof cidr === "string" ? cidr.indexOf("/") : -1;
+    if (slash === -1 || !ssrfGuard.cidrContains(cidr, cidr.slice(0, slash))) {
+      throw new TypeError(where + ": trustedProxies[" + i + "] is not a valid CIDR, got " + JSON.stringify(cidr));
+    }
+  }
+  return function (addr) {
+    // Fold an IPv4-mapped IPv6 peer (::ffff:a.b.c.d, common on a dual-stack
+    // listener) to its dotted IPv4 form so it matches an IPv4 trustedProxies
+    // CIDR — cidrContains rejects a cross-family compare, so without this a
+    // mapped proxy peer reads as untrusted and X-Forwarded-* is ignored. Only
+    // the ::ffff:0:0/96 block folds (canonicalizeHost leaves NAT64 / 6to4 as
+    // IPv6), so this can't widen the trusted set.
+    var canon = ssrfGuard.canonicalizeHost(addr);
+    for (var j = 0; j < trustedProxies.length; j++) {
+      if (ssrfGuard.cidrContains(trustedProxies[j], canon)) return true;
+    }
+    return false;
+  };
+}
+
+function _normTrustedProxies(opts) {
+  return Array.isArray(opts.trustedProxies) ? opts.trustedProxies.slice()
+    : (typeof opts.trustedProxies === "string" && opts.trustedProxies.length ? [opts.trustedProxies] : []);
+}
+
+function trustedClientIp(opts) {
+  opts = opts || {};
+  var resolver = opts.clientIpResolver;
+  if (resolver != null && typeof resolver !== "function") {
+    throw new TypeError("trustedClientIp: clientIpResolver must be a function(req) => ip|null");
+  }
+  var predicate = _trustedProxyPredicate(_normTrustedProxies(opts), "trustedClientIp");
+  return {
+    peerGated: !!(resolver || predicate),
+    resolve: function (req) {
+      if (resolver) return resolver(req);
+      if (predicate) return clientIp(req, { trustProxy: predicate });
+      return clientIp(req, { trustProxy: false });
+    },
+  };
+}
+
+// IP-prefix masking constants — named so the bit-arithmetic stays readable.
+// /24 IPv4 is the original IP-geolocation bucket and matches the legacy
+// carrier-NAT pool stride; /64 IPv6 is the customer LAN every RIR allocates
+// (RFC 4291 §2.5.4), so tightening below it punishes IPv6 privacy-extension
+// address rotation.
+var IP_BITS_PER_BYTE      = 8;                                                                  // bits per byte; protocol constant, not a byte size
+var IPV4_OCTET_COUNT      = 4;
+var IPV4_OCTET_RANGE      = 256;                                                                // 0..255 inclusive; v4 octet domain
+var IPV4_TOTAL_BITS       = 32;                                                                 // IPv4 address width in bits
+var IPV4_DEFAULT_PREFIX   = 24;                                                                 // /24 carrier-NAT pool stride
+var IPV6_GROUP_COUNT      = 8;                                                                  // 8 16-bit groups in v6
+var IPV6_BYTE_COUNT       = 16;                                                                 // 16 bytes in v6
+var IPV6_DEFAULT_PREFIX   = 64;                                                                 // /64 customer LAN per RFC 4291 §2.5.4
+var IP_BYTE_MASK          = 0xff;
+var IP_HEX_RADIX          = 16;                                                                 // base-16 radix
+var V4_MAPPED_V6_PREFIX   = "::ffff:";
+
+function _maskIpv4(ip, prefix) {
+  // ip = "a.b.c.d"; prefix is bits to keep (1..32).
+  var parts = String(ip).split(".");
+  if (parts.length !== IPV4_OCTET_COUNT) return null;
+  var n = 0;
+  for (var i = 0; i < IPV4_OCTET_COUNT; i++) {
+    var oct = parseInt(parts[i], 10);
+    if (!Number.isInteger(oct) || oct < 0 || oct >= IPV4_OCTET_RANGE) return null;
+    n = (n * IPV4_OCTET_RANGE) + oct;
+  }
+  // Apply prefix mask.
+  var mask = prefix === 0 ? 0 : (-1 >>> (IPV4_TOTAL_BITS - prefix)) << (IPV4_TOTAL_BITS - prefix);
+  // Bitwise on 32-bit unsigned. JS coerces to 32-bit signed, so use
+  // unsigned right shift to recover.
+  var masked = (n & mask) >>> 0;
+  return ((masked >>> IP_BITS_PER_BYTE * 3) & IP_BYTE_MASK) + "." +
+         ((masked >>> IP_BITS_PER_BYTE * 2) & IP_BYTE_MASK) + "." +
+         ((masked >>> IP_BITS_PER_BYTE)     & IP_BYTE_MASK) + "." +
+         (masked & IP_BYTE_MASK) + "/" + prefix;
+}
+
+function _maskIpv6(ip, prefix) {
+  // Expand to 8 16-bit groups. Accept :: shorthand. Reject if invalid.
+  var raw = String(ip).toLowerCase();
+  // Strip an embedded zone id (fe80::1%eth0); not part of the address.
+  var pct = raw.indexOf("%");
+  if (pct !== -1) raw = raw.substring(0, pct);
+  var doubleColonAt = raw.indexOf("::");
+  var groups;
+  if (doubleColonAt === -1) {
+    groups = raw.split(":");
+    if (groups.length !== IPV6_GROUP_COUNT) return null;
+  } else {
+    var left = raw.substring(0, doubleColonAt).split(":");
+    var right = raw.substring(doubleColonAt + 2).split(":");
+    if (left.length === 1 && left[0] === "") left = [];
+    if (right.length === 1 && right[0] === "") right = [];
+    var fillCount = IPV6_GROUP_COUNT - left.length - right.length;
+    if (fillCount < 0) return null;
+    var middle = [];
+    for (var fi = 0; fi < fillCount; fi++) middle.push("0");
+    groups = left.concat(middle).concat(right);
+  }
+  // Each group is 1–4 hex chars.
+  var bytes = [];
+  for (var gi = 0; gi < IPV6_GROUP_COUNT; gi++) {
+    var g = groups[gi];
+    if (typeof g !== "string" || g.length === 0 || g.length > 4 || /[^0-9a-f]/.test(g)) return null;
+    var v = parseInt(g, IP_HEX_RADIX);
+    if (!Number.isInteger(v) || v < 0 || v > 0xffff) return null;
+    bytes.push((v >> IP_BITS_PER_BYTE) & IP_BYTE_MASK);
+    bytes.push(v & IP_BYTE_MASK);
+  }
+  // Apply prefix in bits.
+  var keepBytes = Math.floor(prefix / IP_BITS_PER_BYTE);
+  var keepBits  = prefix % IP_BITS_PER_BYTE;
+  for (var bi = 0; bi < IPV6_BYTE_COUNT; bi++) {
+    if (bi < keepBytes) continue;
+    if (bi === keepBytes && keepBits > 0) {
+      var m = (IP_BYTE_MASK << (IP_BITS_PER_BYTE - keepBits)) & IP_BYTE_MASK;
+      bytes[bi] = bytes[bi] & m;
+    } else {
+      bytes[bi] = 0;
+    }
+  }
+  // Re-emit as colon-hex (no compression — deterministic for hashing).
+  var out = [];
+  for (var oi = 0; oi < IPV6_BYTE_COUNT; oi += 2) {
+    out.push(((bytes[oi] << IP_BITS_PER_BYTE) | bytes[oi + 1]).toString(IP_HEX_RADIX));
+  }
+  return out.join(":") + "/" + prefix;
+}
+
+/**
+ * @primitive b.requestHelpers.ipPrefix
+ * @signature b.requestHelpers.ipPrefix(ip)
+ * @since     0.15.15
+ * @related   b.requestHelpers.clientIp, b.requestHelpers.trustedClientIp
+ *
+ * Mask a client IP to its subnet bucket: a <code>/24</code> for IPv4 (the
+ * carrier-NAT pool stride) and a <code>/64</code> for IPv6 (the customer-LAN
+ * prefix RIRs allocate, RFC 4291 §2.5.4). Returns the canonical
+ * <code>"network/prefix"</code> string, or <code>""</code> for a non-string /
+ * empty / unparseable input. An IPv4-mapped IPv6 address
+ * (<code>::ffff:1.2.3.4</code>) folds to its dotted form so it buckets the
+ * same regardless of how a proxy reported it.
+ *
+ * This is the masking the session device-fingerprint's built-in
+ * <code>clientIpPrefix</code> field hashes (so roaming carriers that flip the
+ * public IP within a subnet don't log a user out). Exposed so an operator who
+ * drops to a function-form fingerprint field — for a custom mask width, or to
+ * combine the prefix with other signals — reuses this exact algorithm instead
+ * of re-deriving the /24 + /64 masking (and silently diverging).
+ *
+ * @example
+ *   b.requestHelpers.ipPrefix("203.0.113.47");   // → "203.0.113.0/24"
+ *   b.requestHelpers.ipPrefix("2001:db8::1");     // → "2001:db8:0:0/64"
+ */
+function ipPrefix(ip) {
+  if (typeof ip !== "string" || ip.length === 0) return "";
+  // IPv4-mapped IPv6 (::ffff:1.2.3.4) — strip the wrapper so the v4 mask
+  // applies. Same bucket regardless of how the proxy reported it.
+  var lower = ip.toLowerCase();
+  if (lower.indexOf(V4_MAPPED_V6_PREFIX) === 0 && lower.indexOf(".") !== -1) {
+    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), IPV4_DEFAULT_PREFIX) || "";
+  }
+  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, IPV6_DEFAULT_PREFIX) || "";
+  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, IPV4_DEFAULT_PREFIX) || "";
+  return "";
+}
+
+/**
+ * @primitive b.requestHelpers.trustedProtocol
+ * @signature b.requestHelpers.trustedProtocol(opts?)
+ * @since     0.15.14
+ * @related   b.requestHelpers.requestProtocol, b.requestHelpers.trustedClientIp
+ *
+ * Peer-gated companion to trustedClientIp for the request scheme. The
+ * Secure-cookie / HSTS / secure-context decisions hinge on whether a request
+ * arrived over HTTPS; behind a TLS-terminating proxy that comes from
+ * X-Forwarded-Proto, which is forgeable unless the immediate peer is a trusted
+ * proxy. Returns `{ resolve(req)=>"http"|"https", peerGated }`. With
+ * `trustedProxies` (CIDRs) the header is honored only from a trusted peer; with
+ * `protocolResolver(req)` the operator owns the decision; with neither only the
+ * real TLS socket is consulted (forwarded headers ignored).
+ *
+ * @opts
+ *   trustedProxies:   string | string[],
+ *   protocolResolver: function(req): "http"|"https",
+ *
+ * @example
+ *   var tp = b.requestHelpers.trustedProtocol({ trustedProxies: ["10.0.0.0/8"] });
+ *   tp.resolve(req);   // "https" only when X-Forwarded-Proto came via a trusted peer
+ */
+function trustedProtocol(opts) {
+  opts = opts || {};
+  var resolver = opts.protocolResolver;
+  if (resolver != null && typeof resolver !== "function") {
+    throw new TypeError("trustedProtocol: protocolResolver must be a function(req) => 'http'|'https'");
+  }
+  var predicate = _trustedProxyPredicate(_normTrustedProxies(opts), "trustedProtocol");
+  return {
+    peerGated: !!(resolver || predicate),
+    resolve: function (req) {
+      if (resolver) return resolver(req);
+      if (predicate) return requestProtocol(req, { trustProxy: predicate });
+      return requestProtocol(req, { trustProxy: false });
+    },
+  };
+}
+
 /**
  * @primitive b.requestHelpers.requestProtocol
  * @signature b.requestHelpers.requestProtocol(req, opts?)
@@ -274,14 +560,17 @@ function clientIp(req, opts) {
  *
  * Resolve the inbound transport scheme. Default returns `"https"`
  * when `req.socket.encrypted` is set, otherwise `"http"`. Behind a
- * trusted reverse proxy that terminates TLS, set `trustProxy: true`
- * to read the leftmost `X-Forwarded-Proto` hop instead — without
- * the explicit opt-in the framework refuses to pick up the
- * attacker-forgeable header. Always returns a string; on bad input
- * falls back to `"http"`.
+ * trusted reverse proxy that terminates TLS, pass `trustProxy` as a
+ * PREDICATE `function(addr)=>boolean` naming your proxies:
+ * `X-Forwarded-Proto` is then honored only when the immediate peer is
+ * a trusted proxy, so a direct caller can't forge it (use
+ * `b.requestHelpers.trustedProtocol` to build this). The legacy
+ * `trustProxy: true` reads the leftmost hop without checking the peer —
+ * forgeable, safe only behind an edge that rewrites the header. Always
+ * returns a string; on bad input falls back to `"http"`.
  *
  * @opts
- *   trustProxy: boolean   // false (default) | true
+ *   trustProxy: boolean | function   // false (default) | predicate (peer-gated) | legacy true
  *
  * @example
  *   var req = { socket: { encrypted: true } };
@@ -305,7 +594,22 @@ function requestProtocol(req, opts) {
     var fwd = req.headers["x-forwarded-proto"];
     if (typeof fwd === "string" && fwd.length > 0) {
       var hops = parseListHeader(fwd, { lowercase: true });
-      if (hops.length > 0) return hops[0];
+      if (hops.length > 0) {
+        if (typeof trust === "function") {
+          // Peer-gated: honor X-Forwarded-Proto only when the immediate TCP
+          // peer is a trusted proxy. A direct caller's forged header is
+          // ignored — fall through to the real TLS socket. The only form safe
+          // for a Secure-cookie / HSTS / secure-context decision.
+          var peer =
+            (req.socket && typeof req.socket.remoteAddress === "string" && req.socket.remoteAddress) ? req.socket.remoteAddress
+            : (req.connection && typeof req.connection.remoteAddress === "string" && req.connection.remoteAddress) ? req.connection.remoteAddress
+            : null;
+          if (peer && trust(peer)) return hops[0];
+          // peer not a trusted proxy → ignore forgeable header, fall through
+        } else {
+          return hops[0];   // legacy true/number — spoofable, see docstring
+        }
+      }
     }
   }
   if (req.socket && req.socket.encrypted) return "https";
@@ -611,8 +915,6 @@ function captureResponseStatus(res, onEnd) {
   return origEnd;
 }
 
-var Q_VALUE_RE = /(?:^|;|\s)q\s*=\s*([0-9]*\.?[0-9]+)/i;
-
 /**
  * @primitive b.requestHelpers.parseQualityList
  * @signature b.requestHelpers.parseQualityList(headerValue, opts?)
@@ -655,24 +957,30 @@ function parseQualityList(headerValue, opts) {
   if (typeof headerValue !== "string" || headerValue.length === 0) return [];
   opts = opts || {};
   var caseSensitive = opts.caseSensitive === true;
-  var parts = headerValue.split(",");
+  // Quote-aware split: a parameter value may be a quoted-string containing ','
+  // or ';' or 'q=' (RFC 7231 §5.3.1 / RFC 9110), which must not split an element
+  // or be mis-read as the q-value. splitUnquoted respects double-quoted runs.
+  var parts = structuredFields.splitUnquoted(headerValue, ",");
   var out = [];
   for (var i = 0; i < parts.length; i++) {
     var p = parts[i].trim();
     if (p.length === 0) continue;
-    var semi = p.indexOf(";");
-    var value, q;
-    if (semi === -1) {
-      value = caseSensitive ? p : p.toLowerCase();
-      q = 1;
-    } else {
-      var head = p.slice(0, semi).trim();
-      value = caseSensitive ? head : head.toLowerCase();
-      var rest = p.slice(semi + 1).trim();
-      var qm = rest.match(Q_VALUE_RE);
+    var segs = structuredFields.splitUnquoted(p, ";");
+    var head = segs[0].trim();
+    var value = caseSensitive ? head : head.toLowerCase();
+    var q = 1;
+    // The q parameter is the named token `q` separating media-type params from
+    // accept-ext; the FIRST `q` parameter is the quality. Only a parameter
+    // literally named `q` counts — never a `q=`-shaped substring of another
+    // parameter's name or quoted value.
+    for (var s = 1; s < segs.length; s++) {
+      var kv = structuredFields.parseKeyValuePiece(segs[s], "=", true);
+      if (kv.key !== "q") continue;
+      var qm = String(kv.value).trim().match(/^([0-9]*\.?[0-9]+)/);
       q = qm ? parseFloat(qm[1]) : 1;
       if (isNaN(q) || q < 0) q = 0;
       if (q > 1) q = 1;
+      break;
     }
     out.push({ value: value, q: q });
   }
@@ -890,7 +1198,10 @@ module.exports = {
   parseListHeader:           parseListHeader,
   // proxy-trust primitives (default refuses forwarded headers)
   clientIp:                  clientIp,
+  trustedClientIp:           trustedClientIp,
+  ipPrefix:                  ipPrefix,
   requestProtocol:           requestProtocol,
+  trustedProtocol:           trustedProtocol,
   appendVary:                appendVary,
   // CVE-2026-21710 wrap — safe alternative to req.headersDistinct
   safeHeadersDistinct:       safeHeadersDistinct,

package/lib/resource-access-lock.js

@@ -49,7 +49,7 @@ function create(opts) {
   validateOpts.requireNonEmptyString(opts.resource, "resource",
     ResourceAccessLockError, "resource-access-lock/no-resource");
   var startMode = opts.startMode || "open";
-  if (!VALID_MODES[startMode]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_MODES, startMode)) {
     throw new ResourceAccessLockError(
       "resource-access-lock/bad-start-mode",
       "startMode must be one of: " + Object.keys(VALID_MODES).join(" / "));
@@ -71,12 +71,12 @@ function create(opts) {
   function permits(action) {
     if (mode === "open") return true;
     if (mode === "locked") return false;
-    return !!READ_ACTIONS[action];
+    return !!Object.prototype.hasOwnProperty.call(READ_ACTIONS, action);
   }
 
   function set(newMode, ctx) {
     ctx = ctx || {};
-    if (!VALID_MODES[newMode]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_MODES, newMode)) {
       throw new ResourceAccessLockError(
         "resource-access-lock/bad-mode",
         "set: mode must be one of: " + Object.keys(VALID_MODES).join(" / "));