@blamejs/core 0.15.15 → 0.15.17

package/lib/mail-auth.js

@@ -1102,6 +1102,11 @@ async function _fetchDmarcRecord(domain, dnsLookup) {
 // throw on malformed v= / unrecognized np= or psd= values rather than
 // silently dropping — operators with a typo'd record otherwise see the
 // fallback policy applied without warning.
+// RFC 7489 §6.3 — p= (and DMARCbis sp=/np=) take exactly one of
+// none|quarantine|reject. p= is REQUIRED; a record without a valid p=
+// carries no usable policy (treat as if no record were published rather
+// than defaulting any unrecognized value to "deliver").
+var DMARC_VALID_P = { none: 1, quarantine: 1, reject: 1 };
 var DMARCBIS_VALID_NP = { none: 1, quarantine: 1, reject: 1 };
 var DMARCBIS_VALID_PSD = { y: 1, n: 1, u: 1 };
 
@@ -1115,8 +1120,22 @@ function _parseDmarcRecord(text) {
     var key = pairs[i][0];
     var val = pairs[i][1];
     if (key === "v")     policy.v = val;
-    else if (key === "p")     policy.p = val.toLowerCase();
-    else if (key === "sp")    policy.sp = val.toLowerCase();
+    else if (key === "p") {
+      var pVal = val.toLowerCase();
+      if (!Object.prototype.hasOwnProperty.call(DMARC_VALID_P, pVal)) {
+        throw new MailAuthError("mail-auth/dmarcbis-bad-tag",
+          "DMARC p= must be one of none|quarantine|reject, got " + JSON.stringify(val));
+      }
+      policy.p = pVal;
+    }
+    else if (key === "sp") {
+      var spVal = val.toLowerCase();
+      if (!Object.prototype.hasOwnProperty.call(DMARC_VALID_P, spVal)) {
+        throw new MailAuthError("mail-auth/dmarcbis-bad-tag",
+          "DMARC sp= must be one of none|quarantine|reject, got " + JSON.stringify(val));
+      }
+      policy.sp = spVal;
+    }
     else if (key === "pct")   policy.pct = parseInt(val, 10);
     else if (key === "adkim") policy.adkim = val.toLowerCase();
     else if (key === "aspf")  policy.aspf = val.toLowerCase();
@@ -1141,6 +1160,16 @@ function _parseDmarcRecord(text) {
     throw new MailAuthError("mail-auth/dmarc-bad-version",
       "DMARC record version must be DMARC1, got " + JSON.stringify(policy.v));
   }
+  // RFC 7489 §6.3 — p= is REQUIRED. A record syntactically valid in
+  // every other respect but missing p= publishes no usable policy; the
+  // receiver MUST treat it as if no record were found rather than
+  // synthesizing a permissive default. Fail closed here so the caller
+  // can route the missing-policy case (none/permerror) instead of
+  // delivering an unauthenticated message.
+  if (policy.p === null) {
+    throw new MailAuthError("mail-auth/dmarc-missing-policy",
+      "DMARC record has no required p= tag (RFC 7489 §6.3)");
+  }
   return policy;
 }
 
@@ -1236,7 +1265,18 @@ async function dmarcEvaluate(opts) {
       }
     }
   } catch (e) {
-    return { result: "temperror", explanation: e.message,
+    // RFC 7489 §6.6.3 — a syntactically invalid / policy-less record is a
+    // PERMANENT error (permerror); only transient DNS resolution failures
+    // are temperror. The DMARC parser raises typed MailAuthError codes for
+    // the permanent cases (bad version, unrecognized tag value, missing
+    // required p=); anything else (DNS lookup) is transient. Either way the
+    // disposition is fail-closed — neither path yields recommendedAction
+    // "deliver".
+    var permanent = e && typeof e.code === "string" &&
+      (e.code === "mail-auth/dmarc-bad-version" ||
+       e.code === "mail-auth/dmarcbis-bad-tag" ||
+       e.code === "mail-auth/dmarc-missing-policy");
+    return { result: permanent ? "permerror" : "temperror", explanation: e.message,
              policy: null, alignment: { spf: false, dkim: false },
              orgDomain: orgDomain };
   }
@@ -1312,13 +1352,23 @@ async function dmarcEvaluate(opts) {
     sampleRoll = bCrypto.randomInt(0, 100);                                                     // pct sample roll
   }
   var sampled = !pass && pct < 100 && sampleRoll >= pct;
-  var recommendedAction = pass ? "deliver" :
-                          sampled
-                            ? (policy.p === "reject" ? "quarantine" :
-                               policy.p === "quarantine" ? "none" : "deliver")
-                            : (policy.p === "reject"     ? "reject" :
-                               policy.p === "quarantine" ? "quarantine" :
-                               "deliver");
+  // Disposition is driven by the validated p= value. policy.p is one of
+  // none|quarantine|reject (the parser fails closed on anything else, so a
+  // missing/typo'd policy never reaches here). "none" is monitor-only →
+  // deliver; reject/quarantine map to their disposition (sampled = the
+  // next-less-strict step per §6.6.4). The explicit "none" arm — rather
+  // than a catch-all "else → deliver" — keeps an unexpected value from
+  // silently delivering a failing message.
+  var recommendedAction;
+  if (pass) {
+    recommendedAction = "deliver";
+  } else if (policy.p === "none") {
+    recommendedAction = "deliver";
+  } else if (sampled) {
+    recommendedAction = policy.p === "reject" ? "quarantine" : "none";       // p is reject|quarantine here
+  } else {
+    recommendedAction = policy.p === "reject" ? "reject" : "quarantine";     // p is reject|quarantine here
+  }
 
   return {
     result:     pass ? "pass" : "fail",
@@ -1544,10 +1594,15 @@ async function arcVerify(rfc822, opts) {
     var asX  = asTags.x  ? parseInt(asTags.x, 10)  : null;
     var skewSec = Math.floor(arcClockSkewMs / 1000);                                          // sec divisor
     var timeFault = null;
-    if (amsT && isFinite(amsT) && amsT - skewSec > nowSec) timeFault = "ams-t-future";
-    if (amsX && isFinite(amsX) && amsX + skewSec < nowSec) timeFault = "ams-x-expired";
-    if (asT  && isFinite(asT)  && asT  - skewSec > nowSec) timeFault = "as-t-future";
-    if (asX  && isFinite(asX)  && asX  + skewSec < nowSec) timeFault = "as-x-expired";
+    // RFC 8617 §5.2 — a PRESENT t=/x= that is unparseable (parseInt → NaN) must
+    // FAIL CLOSED (a time fault), not silently skip the future/expiry check: a
+    // bare `isFinite(amsT) &&` lets a malformed timestamp slip the MUST-reject
+    // gate. Gate on the RAW tag's presence (amsTags.t/x) so an unparseable value
+    // becomes a fault, while an absent tag is correctly ignored.
+    if (amsTags.t && (!isFinite(amsT) || amsT - skewSec > nowSec)) timeFault = isFinite(amsT) ? "ams-t-future" : "ams-t-unparseable";
+    if (amsTags.x && (!isFinite(amsX) || amsX + skewSec < nowSec)) timeFault = isFinite(amsX) ? "ams-x-expired" : "ams-x-unparseable";
+    if (asTags.t  && (!isFinite(asT)  || asT  - skewSec > nowSec)) timeFault = isFinite(asT)  ? "as-t-future"  : "as-t-unparseable";
+    if (asTags.x  && (!isFinite(asX)  || asX  + skewSec < nowSec)) timeFault = isFinite(asX)  ? "as-x-expired" : "as-x-unparseable";
 
     // AMS — RFC 8617 §5.1.1. Same shape as a DKIM-Signature; reuses
     // the DKIM verifier by injecting a temporary message that has

package/lib/mail-bimi.js

@@ -819,6 +819,12 @@ function _verifyCertChain(leaf, intermediates, anchors) {
   while (depth < MAX_DEPTH) {
     var notBefore = Date.parse(current.validFrom);
     var notAfter  = Date.parse(current.validTo);
+    // Fail closed on a present-but-unparseable validity window: a NaN date
+    // would otherwise skip both window checks below and let the cert pass
+    // validation unchecked.
+    if (!isFinite(notBefore) || !isFinite(notAfter)) {
+      return { ok: false, reason: "cert validity dates unparseable" };
+    }
     if (isFinite(notBefore) && now < notBefore) {
       return { ok: false, reason: "cert not-yet-valid (notBefore=" + current.validFrom + ")" };
     }

package/lib/mail-crypto-smime.js

@@ -829,6 +829,16 @@ function checkCert(opts) {
   var nowMs = Date.now();
   var notBeforeMs = Date.parse(cert.validFrom);
   var notAfterMs  = Date.parse(cert.validTo);
+  // Fail closed on a present-but-unparseable validity field — gating
+  // each comparison behind isFinite() alone let a NaN notBefore /
+  // notAfter skip both checks and pass validity. RFC 5280 §4.1.2.5
+  // makes both dates mandatory; a date a peer cannot parse must be
+  // refused at preflight, not accepted and left to fail interop later.
+  if (!isFinite(notBeforeMs) || !isFinite(notAfterMs)) {
+    throw new MailCryptoError("mail-crypto/smime/bad-validity",
+      "cert has unparseable validity dates (validFrom=" + cert.validFrom +
+      ", validTo=" + cert.validTo + ")");
+  }
   if (isFinite(notBeforeMs) && nowMs < notBeforeMs) {
     throw new MailCryptoError("mail-crypto/smime/expired-cert",
       "cert is not yet valid (notBefore=" + cert.validFrom + ", now=" +

package/lib/mail-dkim.js

@@ -482,6 +482,36 @@ function _parseDkimTagList(value) {
   return tags;
 }
 
+// RFC 6376 §3.5 — x= / t= / l= are unsigned decimal integers ("1*DIGIT").
+// parseInt() is too lenient here ("12abc" → 12, "0x10" → 0, " 12" → 12),
+// so a present-but-malformed value must not be coerced into a finite
+// number that then passes the downstream check. Returns the parsed integer,
+// or null when the value is not a well-formed unsigned integer — the caller
+// fails CLOSED on null. `maxDigits` bounds the digit count (a ReDoS-free
+// length cap; x=/t= are NumericDate, bounded to 12 digits).
+function _parseDkimUnsignedInt(raw, maxDigits) {
+  if (typeof raw !== "string") return null;
+  var len = raw.length;
+  // "1*DIGIT": non-empty, ASCII 0-9 only, length-capped. A char-code scan
+  // (no regex) keeps this linear and avoids a dynamic RegExp / a shared
+  // digit-pattern literal — maxDigits bounds x=/t=/l= to their NumericDate
+  // / octet-count headroom.
+  if (len === 0 || (maxDigits && len > maxDigits)) return null;
+  for (var i = 0; i < len; i++) {
+    var c = raw.charCodeAt(i);
+    if (c < 0x30 || c > 0x39) return null;   // not an ASCII digit
+  }
+  var n = parseInt(raw, 10);
+  if (!isFinite(n)) return null;
+  return n;
+}
+
+// x= / t= are NumericDate (seconds-since-epoch); 12 digits is ample headroom
+// past any realistic epoch and keeps the parse bounded.
+function _parseDkimNumericDate(raw) {
+  return _parseDkimUnsignedInt(raw, 12);
+}
+
 function _selectorTxtToKeyTags(txtRecords) {
   // DKIM key record is a TXT record at <selector>._domainkey.<domain>.
   // Format: "v=DKIM1; k=rsa; p=<base64>" (chunks may be split across
@@ -694,8 +724,16 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
     // the signature still validates against legitimate senders that
     // use l=, but flag in the result. The cap is octets of the
     // CANONICALIZED body (RFC 6376 §3.4.5), applied inside _bodyHashB64.
-    var parsedL = parseInt(sigTags.l, 10);
-    if (isFinite(parsedL) && parsedL >= 0) lcap = parsedL;
+    // l= is an unsigned decimal integer ("1*DIGIT" per §3.5); a
+    // present-but-unparseable value must FAIL CLOSED rather than fall
+    // through to lcap=undefined (hashing the whole body silently masks the
+    // malformed tag instead of refusing it).
+    var parsedL = _parseDkimUnsignedInt(sigTags.l, 18);
+    if (parsedL === null) {
+      return { result: "permerror",
+               errors: ["DKIM-Signature l= present but unparseable (RFC 6376 §3.5 — unsigned integer required)"] };
+    }
+    lcap = parsedL;
   }
 
   // 1. Body-hash check.
@@ -922,34 +960,49 @@ async function verify(rfc822, opts) {
     // attack). Both are in seconds-since-epoch per ABNF.
     var nowSec = Math.floor(Date.now() / C.TIME.seconds(1));
     var clockSkewSec = Math.floor(clockSkewMs / C.TIME.seconds(1));
+    // x= / t= are NumericDate (digits-only seconds-since-epoch per the
+    // §3.5 ABNF). A present-but-unparseable value must FAIL CLOSED — a NaN
+    // result silently skipping the expiry / future-date / ordering checks
+    // would let verification proceed to result:"pass" with NO expiry
+    // enforced (mirrors the SAML Conditions present-but-unparseable fix).
+    var xSec = null;
     if (sigTags.x !== undefined) {
-      var expSec = parseInt(sigTags.x, 10);
-      if (isFinite(expSec) && expSec + clockSkewSec < nowSec) {
+      xSec = _parseDkimNumericDate(sigTags.x);
+      if (xSec === null) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature x= present but unparseable (RFC 6376 §3.5 — NumericDate required)"] });
+        continue;
+      }
+      if (xSec + clockSkewSec < nowSec) {
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
-          errors: ["DKIM-Signature x=" + expSec + " has expired (RFC 6376 §3.5)"] });
+          errors: ["DKIM-Signature x=" + xSec + " has expired (RFC 6376 §3.5)"] });
         continue;
       }
     }
     if (sigTags.t !== undefined) {
-      var tSec = parseInt(sigTags.t, 10);
+      var tSec = _parseDkimNumericDate(sigTags.t);
+      if (tSec === null) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature t= present but unparseable (RFC 6376 §3.5 — NumericDate required)"] });
+        continue;
+      }
       // Allow up to 24h future-skew; beyond that, refuse — neither
       // operator clock drift nor delivery latency explains a future-
       // dated signing time of more than a day.
-      if (isFinite(tSec) && tSec - (24 * 60 * 60) > nowSec) {                                  // allow:raw-time-literal — 24h future-date sanity ceiling
+      if (tSec - (24 * 60 * 60) > nowSec) {                                                    // allow:raw-time-literal — 24h future-date sanity ceiling
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
           errors: ["DKIM-Signature t=" + tSec + " is more than 24h in the future (RFC 6376 §3.5 sanity)"] });
         continue;
       }
-      if (sigTags.x !== undefined) {
-        var xSec = parseInt(sigTags.x, 10);
-        if (isFinite(xSec) && isFinite(tSec) && xSec < tSec) {
-          results.push({ d: d || null, s: s || null, alg: alg || null,
-            result: "permerror",
-            errors: ["DKIM-Signature x= must be after t= (RFC 6376 §3.5)"] });
-          continue;
-        }
+      if (xSec !== null && xSec < tSec) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature x= must be after t= (RFC 6376 §3.5)"] });
+        continue;
       }
     }
     if (!d || !s) {

package/lib/mail.js

@@ -825,6 +825,16 @@ function smtpTransport(opts) {
   _refuseCtlBytes("host",       opts.host);
   _refuseCtlBytes("servername", opts.servername);
   var timeoutMs = opts.timeoutMs || C.TIME.seconds(15);
+  // Absolute transaction deadline — distinct from the per-socket IDLE
+  // timeout above. A slow-trickle MX that emits one byte just inside
+  // every idle window resets socket.setTimeout forever and never
+  // completes; this wall-clock bound fails the whole send regardless of
+  // trickle. Defaults well above timeoutMs so a normal multi-round-trip
+  // SMTP conversation (greeting → EHLO → STARTTLS → AUTH → MAIL/RCPT →
+  // DATA/BDAT) never trips it.
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxTransactionMs,
+    "smtp transport: opts.maxTransactionMs", MailError, "mail/smtp-misconfigured");
+  var maxTransactionMs = opts.maxTransactionMs || C.TIME.minutes(5);
   var tlsOpts = {
     rejectUnauthorized: rejectUnauthorized,
     minVersion: opts.minTlsVersion || "TLSv1.3",
@@ -875,6 +885,7 @@ function smtpTransport(opts) {
     useImplicitTLS:  useImplicitTLS,
     ehloName:        ehloName,
     timeoutMs:       timeoutMs,
+    maxTransactionMs: maxTransactionMs,
     tlsOpts:         tlsOpts,
     servername:      servername,
     dkimSigner:      opts.dkimSigner || null,
@@ -1043,6 +1054,7 @@ function _smtpSend(message, cfg) {
     var dataWireBytes = null;             // Buffer view of dataMessage for BDAT slicing
     var useBdat = false;                  // Decided post-EHLO based on peerSupportsChunking + cfg.chunkingEnabled
     var bodyMode = "7BIT";                // "7BIT" / "8BITMIME" / "BINARYMIME"
+    var txTimer = null;                   // Absolute transaction-deadline timer (cfg.maxTransactionMs)
 
     var fromAddr = _extractAddr(message.from);
     var toList   = _toArray(message.to).map(_extractAddr);
@@ -1081,9 +1093,13 @@ function _smtpSend(message, cfg) {
       }
     }
 
+    function clearTxTimer() {
+      if (txTimer) { try { clearTimeout(txTimer); } catch (_e) { /* best-effort */ } txTimer = null; }
+    }
     function fail(reason) {
       if (settled) return;
       settled = true;
+      clearTxTimer();
       try { if (socket) socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
       reject(new MailError("mail/smtp-failed",
         "SMTP send failed: " + reason, false));
@@ -1091,6 +1107,7 @@ function _smtpSend(message, cfg) {
     function done(ok, code) {
       if (settled) return;
       settled = true;
+      clearTxTimer();
       try { socket.end(); } catch (_e) { /* socket may already be torn down */ }
       if (ok) resolve({ transport: "smtp", deliveredAt: Date.now(), code: code });
       else reject(new MailError("mail/smtp-rejected",
@@ -1149,6 +1166,16 @@ function _smtpSend(message, cfg) {
 
     function onData(data) {
       buffer += data;
+      // Bound the framing accumulator. A hostile / broken MX that
+      // streams bytes without ever sending CRLF would otherwise grow
+      // `buffer` without limit and OOM the process. SMTP responses are
+      // tiny per spec; the 256 KiB cap is generous headroom. Measure
+      // bytes (not UTF-16 code units) so multibyte trickle can't slip a
+      // larger payload past a char-length check.
+      if (safeBuffer.byteLengthOf(buffer) > MAIL_RESPONSE_MAX_BYTES) {
+        fail("response-too-large");
+        return;
+      }
       var lines = buffer.split("\r\n");
       buffer = lines.pop();
       for (var i = 0; i < lines.length; i++) {
@@ -1233,6 +1260,7 @@ function _smtpSend(message, cfg) {
         // would corrupt NUL-bearing octets in transit.
         if (requiresBinaryMime && !peerSupportsBinaryMime) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/binarymime-not-advertised",
             "message has 8-bit binary content but peer does not advertise BINARYMIME (RFC 3030 §3)",
@@ -1245,6 +1273,7 @@ function _smtpSend(message, cfg) {
         // cap"; -1 means "SIZE not advertised" (no precheck).
         if (cfg.respectPeerSize && peerSizeCap > 0 && messageWireSize > peerSizeCap) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/peer-size-exceeded",
             "message wire size " + messageWireSize + " bytes exceeds peer SIZE cap " +
@@ -1341,6 +1370,7 @@ function _smtpSend(message, cfg) {
         // the chunked-body failure mode.
         if (code !== 250) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/bdat-chunk-rejected",
             "BDAT chunk rejected (code " + code + ", offset " + bdatOffset + "/" +
@@ -1360,6 +1390,15 @@ function _smtpSend(message, cfg) {
       }
     }
 
+    // Arm the absolute transaction deadline before opening the socket so
+    // a peer that connects but then trickles (or never responds) is
+    // bounded regardless of how it games the per-socket idle timer.
+    // unref so a pending deadline never keeps the process alive on its own.
+    txTimer = setTimeout(function () {
+      fail("transaction-timeout");
+    }, cfg.maxTransactionMs);
+    if (txTimer && typeof txTimer.unref === "function") txTimer.unref();
+
     try { connect(); }
     catch (e) { fail(e.message || String(e)); }
   });