@blamejs/core 0.15.13 → 0.15.15

package/lib/webhook.js

@@ -48,6 +48,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
 var bCrypto = require("./crypto");
 var httpClient = require("./http-client");
 var safeBuffer = require("./safe-buffer");
@@ -57,6 +58,8 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var numericChecks = require("./numeric-checks");
 var requestHelpers = require("./request-helpers");
+// Lazy — ssrf-guard pulls in the DNS/network stack; only touched on send().
+var ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
 var validateOpts = require("./validate-opts");
 var { WebhookError } = require("./framework-error");
 // b.webhook.dispatcher — durable signed-webhook delivery store. Lives in its
@@ -428,6 +431,18 @@ function signer(opts) {
       allowedProtocols: httpOpts.allowedProtocols || safeUrl.ALLOW_HTTP_TLS,
       errorClass:       WebhookError,
     });
+    // SSRF gate at the webhook layer: refuse private / loopback / link-local /
+    // cloud-metadata destinations up front, before the retry loop. httpClient
+    // also enforces this on every request, but checking here fails fast (no
+    // wasted retries) and keeps the SSRF boundary explicit at the send() API
+    // rather than relying on the transport's internal gate. allowInternal
+    // mirrors the operator's http opts (its affirmative waiver).
+    try {
+      await ssrfGuard().checkUrl(url, { allowInternal: httpOpts.allowInternal === true });
+    } catch (e) {
+      if (e && e.isSsrfError) throw _err("SSRF_REFUSED", "webhook.signer.send: " + e.message);
+      throw e;
+    }
     _validateBody(body);
     var signed = sign(body, { kid: input.kid });
     var mergedHeaders = Object.assign({}, input.headers || {}, signed.headers);
@@ -645,7 +660,7 @@ function verifier(opts) {
       throw _failure("MISSING_TIMESTAMP", "webhook: t= field missing from signature header", "missing-timestamp", ctxReq);
     }
     var ts = Number(parsed.t);
-    if (!isFinite(ts) || ts < 0 || Math.floor(ts) !== ts) {
+    if (!numericBounds.isNonNegativeFiniteInt(ts)) {
       throw _failure("BAD_TIMESTAMP", "webhook: t= field is not a non-negative integer, got " + JSON.stringify(parsed.t), "bad-timestamp", ctxReq);
     }
     if (parsed.id === null || parsed.id.length === 0) {

package/lib/websocket.js

@@ -573,7 +573,7 @@ function _negotiatePermessageDeflate(reqHeader) {
       "server_max_window_bits": true,     "client_max_window_bits": true,
     };
     var ok = true;
-    for (var k in p) { if (Object.prototype.hasOwnProperty.call(p, k) && !KNOWN[k]) { ok = false; break; } }
+    for (var k in p) { if (Object.prototype.hasOwnProperty.call(p, k) && !Object.prototype.hasOwnProperty.call(KNOWN, k)) { ok = false; break; } }
     if (!ok) continue;
     // Always negotiate WITH no_context_takeover in BOTH directions, so
     // every message uses a fresh zlib state. Echo any client window-

package/lib/worm.js

@@ -102,7 +102,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, ["store", "mode", "defaultRetentionMs", "clock"], "worm.create");
   var mode = opts.mode || "compliance";
-  if (!MODES[mode]) throw new WormError("worm/bad-mode", "worm.create: mode must be 'compliance' or 'governance'");
+  if (!Object.prototype.hasOwnProperty.call(MODES, mode)) throw new WormError("worm/bad-mode", "worm.create: mode must be 'compliance' or 'governance'");
   var store = opts.store || _memStore();
   ["get", "set", "delete", "has", "keys"].forEach(function (m) {
     if (typeof store[m] !== "function") throw new WormError("worm/bad-store", "worm.create: store adapter must implement " + m + "()");

package/lib/ws-client.js

@@ -248,17 +248,13 @@ function connect(target, opts) {
   });
   // SSRF gate — refuse private / loopback / link-local / cloud-metadata /
   // reserved IP destinations by default. Symmetric to b.httpClient. The
-  // returned `ips` are pinned through tls.connect / net.connect so the
+  // validated `ips` are pinned through tls.connect / net.connect so the
   // actual TCP connect targets the validated address (closes the DNS-
   // rebinding TOCTOU window). Cloud-metadata IPs are unconditional
-  // hard-deny — `allowInternal: true` does not bypass them.
-  var hostnameForUrl = parsed.protocol === "wss:" ? "https:" : "http:";
-  var probeUrl = new nodeUrl.URL(hostnameForUrl + "//" + parsed.host + parsed.pathname + parsed.search);
-  ssrfGuard.checkUrl(probeUrl, {
-    allowInternal: opts.allowInternal,
-    errorClass:    WsClientError,
-  }).then(function (result) {
-    client._ssrfPinnedIps = result && result.ips;
+  // hard-deny — `allowInternal: true` does not bypass them. _prepareDial
+  // performs the (async) check + pinning before the dial and reruns it on
+  // every reconnect, so a urlFor-swapped target is validated too.
+  client._prepareDial().then(function () {
     client._dial();
   }).catch(function (e) {
     setImmediate(function () { client._handleSocketError(e); });
@@ -315,51 +311,50 @@ class WsClient extends EventEmitter {
   get subprotocol()            { return this._negotiatedSubprotocol; }
   get url()                    { return this._opts.target; }
 
-  _dial() {
-    var self = this;
+  // Resolve the dial target and re-validate it BEFORE any socket opens.
+  // urlFor may swap the URL and tlsOptsFor may rotate TLS material every
+  // dial (including reconnects). The resolved target is re-checked through
+  // ssrfGuard — AWAITED, because checkUrl is async: the prior code called it
+  // synchronously inside _dial and discarded the Promise, so a urlFor that
+  // pointed at a private / cloud-metadata address mid-reconnect was connected
+  // anyway (the SSRF rejection surfaced only as an unhandled rejection) and
+  // the connect was never pinned. Returns a Promise; sync throws from
+  // urlFor / tlsOptsFor become rejections (async fn) handled by the caller.
+  async _prepareDial() {
     var opts = this._opts;
-    this._readyState = "connecting";
-
-    // Per-dial overrides — urlFor swaps the target URL, tlsOptsFor
-    // overrides TLS material. Both fire every dial including reconnects
-    // so callers can rotate state. urlFor's result is re-validated
-    // through ssrfGuard so a hostile upstream can't direct the client
-    // at a private address mid-reconnect.
     var attempt = this._reconnectAttempt || 0;
-    var dialTarget = opts.target;
     var dialParsed = opts.parsedUrl;
     if (typeof opts.urlFor === "function") {
-      try {
-        var nextTarget = opts.urlFor(attempt);
-        if (typeof nextTarget === "string" && nextTarget.length > 0 && nextTarget !== dialTarget) {
-          dialParsed = _parseUrl(nextTarget);
-          dialTarget = nextTarget;
-          var probeProto = dialParsed.protocol === "wss:" ? "https:" : "http:";
-          var probeUrl = new nodeUrl.URL(probeProto + "//" + dialParsed.host + dialParsed.pathname + dialParsed.search);
-          var probe = ssrfGuard.checkUrl(probeUrl, {
-            allowInternal: opts.allowInternal,
-            errorClass:    WsClientError,
-          });
-          this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
-        }
-      } catch (e) {
-        return self._handleSocketError(e);
+      var nextTarget = opts.urlFor(attempt);
+      if (typeof nextTarget === "string" && nextTarget.length > 0 && nextTarget !== opts.target) {
+        dialParsed = _parseUrl(nextTarget);
       }
     }
-
     var dialTlsOpts = opts.tlsOpts;
     if (typeof opts.tlsOptsFor === "function") {
-      try {
-        var override = opts.tlsOptsFor(attempt);
-        if (override && typeof override === "object") {
-          dialTlsOpts = Object.assign({}, opts.tlsOpts || {}, override);
-        }
-      } catch (e) {
-        return self._handleSocketError(e);
+      var override = opts.tlsOptsFor(attempt);
+      if (override && typeof override === "object") {
+        dialTlsOpts = Object.assign({}, opts.tlsOpts || {}, override);
       }
     }
+    var probeProto = dialParsed.protocol === "wss:" ? "https:" : "http:";
+    var probeUrl = new nodeUrl.URL(probeProto + "//" + dialParsed.host + dialParsed.pathname + dialParsed.search);
+    var probe = await ssrfGuard.checkUrl(probeUrl, {
+      allowInternal: opts.allowInternal,
+      errorClass:    WsClientError,
+    });
+    this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
+    this._dialParsed    = dialParsed;
+    this._dialTlsOpts   = dialTlsOpts;
+  }
+
+  _dial() {
+    var self = this;
+    this._readyState = "connecting";
 
-    var parsed = dialParsed;
+    // Target + TLS material were resolved and SSRF-validated by _prepareDial.
+    var parsed = this._dialParsed || this._opts.parsedUrl;
+    var dialTlsOpts = this._dialTlsOpts || this._opts.tlsOpts;
     var port = parsed.port ? parseInt(parsed.port, 10) :
                (parsed.protocol === "wss:" ? 443 : 80);                                  // TLS / HTTP default port
     var host = parsed.hostname;
@@ -422,8 +417,8 @@ class WsClient extends EventEmitter {
 
     this._handshakeTimer = setTimeout(function () {
       self._handleSocketError(new WsClientError("ws-client/handshake-timeout",
-        "Handshake exceeded " + opts.handshakeTimeoutMs + "ms"));
-    }, opts.handshakeTimeoutMs);
+        "Handshake exceeded " + self._opts.handshakeTimeoutMs + "ms"));
+    }, self._opts.handshakeTimeoutMs);
     if (typeof this._handshakeTimer.unref === "function") this._handshakeTimer.unref();
   }
 
@@ -590,6 +585,7 @@ class WsClient extends EventEmitter {
     this._reconnectAttempt = 0;
     this._fragmentChunks = [];
     this._fragmentOpcode = null;
+    this._fragmentBytes = 0;
 
     this._startHeartbeat();
     if (this._opts.auditOn) {
@@ -628,6 +624,14 @@ class WsClient extends EventEmitter {
   }
 
   _handleFrame(frame) {
+    // Once the connection has been torn down (e.g. a prior frame in the same
+    // parsed batch tripped maxMessageBytes and called _teardown, which sets
+    // _closed synchronously), drop any remaining buffered frames — processing
+    // them would emit a spurious cascade of protocol errors (a stray
+    // continuation after the fragment state reset). A graceful close keeps
+    // _closed false until the handshake completes, so the peer's CLOSE frame
+    // is still processed and the normal close code surfaces.
+    if (this._closed) return;
     // RFC 6455 §5.5: control frames MUST be <= 125 bytes AND non-fragmented.
     var isControl = frame.opcode === OPCODE_PING ||
                     frame.opcode === OPCODE_PONG ||
@@ -644,6 +648,17 @@ class WsClient extends EventEmitter {
         return;
       }
     }
+    // Fail the connection on any opcode outside the six RFC 6455 §5.2-defined
+    // values (CONT/TEXT/BINARY/CLOSE/PING/PONG). Without this, a reserved
+    // opcode (0x3-0x7, 0xB-0xF) from a malicious server fell through every
+    // branch to the FIN block and emitted a (stale/empty) message — a
+    // fragmented-message desync / frame-injection lever.
+    if (frame.opcode !== OPCODE_CONT && frame.opcode !== OPCODE_TEXT &&
+        frame.opcode !== OPCODE_BINARY && !isControl) {
+      this._handleSocketError(new WsClientError("ws-client/reserved-opcode",
+        "reserved/unknown WebSocket opcode 0x" + frame.opcode.toString(16) + " (RFC 6455 §5.2)"));
+      return;
+    }
     // Continuation frames MUST NOT carry rsv1 (RFC 7692 §6.1) — only
     // the first frame of a compressed message sets rsv1.
     if (frame.opcode === OPCODE_CONT && frame.rsv1) {
@@ -686,6 +701,7 @@ class WsClient extends EventEmitter {
       this._fragmentOpcode = frame.opcode;
       this._fragmentRsv1   = frame.rsv1 === true;
       this._fragmentChunks = [frame.payload];
+      this._fragmentBytes  = safeBuffer.byteLengthOf(frame.payload);
     } else if (frame.opcode === OPCODE_CONT) {
       if (this._fragmentOpcode == null) {
         this._handleSocketError(new WsClientError("ws-client/protocol-error",
@@ -693,6 +709,21 @@ class WsClient extends EventEmitter {
         return;
       }
       this._fragmentChunks.push(frame.payload);
+      this._fragmentBytes += safeBuffer.byteLengthOf(frame.payload);
+    }
+    // Enforce maxMessageBytes on the RUNNING fragment total, not only at FIN:
+    // a peer that streams continuation frames and never sets FIN would
+    // otherwise grow _fragmentChunks without bound, one maxFrameBytes-sized
+    // frame at a time (CWE-770 / CWE-400). The per-frame parser cap bounds a
+    // single frame, never the sum.
+    if (this._fragmentOpcode != null && this._fragmentBytes > this._opts.maxMessageBytes) {
+      this._fragmentChunks = [];
+      this._fragmentOpcode = null;
+      this._fragmentRsv1   = false;
+      this._fragmentBytes  = 0;
+      this._handleSocketError(new WsClientError("ws-client/message-too-big",
+        "incoming message exceeds maxMessageBytes (" + this._opts.maxMessageBytes + ")"));
+      return;
     }
     if (frame.fin) {
       var fullPayload = Buffer.concat(this._fragmentChunks);                              // allow:handrolled-buffer-collect — bounded by maxMessageBytes below
@@ -706,6 +737,7 @@ class WsClient extends EventEmitter {
       this._fragmentChunks = [];
       this._fragmentOpcode = null;
       this._fragmentRsv1 = false;
+      this._fragmentBytes = 0;
       if (this._negotiatedDeflate && firstFrameRsv1) {
         try {
           var zlib = require("node:zlib");                                                     // allow:inline-require — zlib only on deflate-negotiated path
@@ -926,7 +958,12 @@ class WsClient extends EventEmitter {
     this._reconnectTimer = setTimeout(function () {
       self._reconnectTimer = null;
       if (self._closed) return;                                                           // operator-cancelled in flight
-      self._dial();
+      // Re-resolve + re-validate the target (urlFor swap, DNS rebind) before
+      // reconnecting — awaited, so a now-private/metadata address is refused.
+      self._prepareDial().then(function () {
+        if (self._closed) return;
+        self._dial();
+      }).catch(function (e) { self._handleSocketError(e); });
     }, delay);
     if (typeof this._reconnectTimer.unref === "function") this._reconnectTimer.unref();
     this.emit("reconnecting", { attempt: this._reconnectAttempt, delayMs: delay });

package/lib/x509-chain.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * @module b.x509Chain
+ * @nav    Crypto
+ * @title  X.509 chain (CA-bit issuer test)
+ *
+ * @intro
+ *   The basicConstraints-enforcing issuer test the framework's own
+ *   certificate-chain walkers route through (<code>b.tsa.verifyToken</code>,
+ *   <code>b.mail.bimi</code> VMC/CMC, <code>b.mail.crypto.smime</code>,
+ *   <code>b.mdoc</code>, <code>b.contentCredentials</code>,
+ *   <code>b.auth.fido</code>). It exists because node:crypto's
+ *   <code>X509Certificate.checkIssued()</code> validates the issuer/subject
+ *   DN match, the AKI/SKI linkage, and — only when a keyUsage extension is
+ *   present — keyCertSign, but it does <strong>not</strong> enforce
+ *   basicConstraints cA:TRUE. A leaf / end-entity certificate (cA:FALSE)
+ *   that omits keyUsage is therefore wrongly accepted as a signing CA for
+ *   the next certificate in the chain — the classic basicConstraints bypass
+ *   (CVE-2002-0862 class). Every in-tree walker routes its issuer test
+ *   through these helpers so the cA enforcement can never be forgotten in
+ *   one walker but present in another.
+ *
+ *   Exposed so a consumer validating an X.509 chain <em>outside</em> a TLS
+ *   handshake — an operator-uploaded CA bundle, a non-handshake PQ-signed
+ *   certificate — has the same hardened, fail-closed test instead of being
+ *   pushed toward the raw <code>checkIssued()</code> path this module
+ *   exists to prevent. Both helpers fail closed: any malformed input or
+ *   unsupported key type returns false rather than throwing.
+ *
+ * @card
+ *   basicConstraints cA:TRUE-enforcing X.509 issuer test, fail-closed —
+ *   the hardened alternative to node's checkIssued() for chains built
+ *   outside a TLS handshake.
+ */
+
+/**
+ * @primitive b.x509Chain.isCaCert
+ * @signature b.x509Chain.isCaCert(cert)
+ * @since     0.15.15
+ * @status    stable
+ * @related   b.x509Chain.issuerValidlyIssued
+ *
+ * True only when <code>cert</code> asserts basicConstraints cA:TRUE.
+ * node's <code>X509Certificate</code> exposes <code>.ca</code> (a boolean);
+ * a certificate with no basicConstraints extension or with cA:FALSE
+ * returns false. A missing cert or a non-boolean <code>.ca</code> (parse
+ * failure / unsupported runtime) fails closed to false.
+ *
+ * @example
+ *   var crypto = require("crypto");
+ *   var ca = new crypto.X509Certificate(caPem);
+ *   b.x509Chain.isCaCert(ca);   // → true only if basicConstraints cA:TRUE
+ */
+function isCaCert(cert) {
+  return !!cert && cert.ca === true;
+}
+
+/**
+ * @primitive b.x509Chain.issuerValidlyIssued
+ * @signature b.x509Chain.issuerValidlyIssued(issuer, subject)
+ * @since     0.15.15
+ * @status    stable
+ * @related   b.x509Chain.isCaCert
+ *
+ * True when <code>issuer</code> validly issued <code>subject</code> AND is
+ * itself a CA: the DN / AKI-SKI / keyUsage linkage (checkIssued), the
+ * cryptographic signature (verify), and basicConstraints cA:TRUE
+ * (isCaCert). The cA check runs first so a non-CA certificate is rejected
+ * before the expensive signature verification. Any exception (malformed
+ * cert, unsupported key type) fails closed to false.
+ *
+ * @example
+ *   var crypto = require("crypto");
+ *   var issuer  = new crypto.X509Certificate(issuerPem);
+ *   var subject = new crypto.X509Certificate(leafPem);
+ *   b.x509Chain.issuerValidlyIssued(issuer, subject);   // → boolean
+ */
+function issuerValidlyIssued(issuer, subject) {
+  try {
+    return isCaCert(issuer) &&
+      subject.checkIssued(issuer) &&
+      subject.verify(issuer.publicKey);
+  } catch (_e) {
+    return false;
+  }
+}
+
+module.exports = {
+  isCaCert:            isCaCert,
+  issuerValidlyIssued: issuerValidlyIssued,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.13",
+  "version": "0.15.15",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4df0908b-006e-466d-b6f7-6426f710546e",
+  "serialNumber": "urn:uuid:b3337d85-2941-4510-a9ff-2246e428aef5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-20T02:02:17.152Z",
+    "timestamp": "2026-06-22T03:24:08.024Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.13",
+      "bom-ref": "@blamejs/core@0.15.15",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.13",
+      "version": "0.15.15",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.13",
+      "purl": "pkg:npm/%40blamejs/core@0.15.15",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.13",
+      "ref": "@blamejs/core@0.15.15",
       "dependsOn": []
     }
   ]