@blamejs/core 0.15.33 → 0.15.35

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.35 (2026-06-26) — **`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by.** The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{"route":"/api"}`) rather than `route=/api`. **Changed:** *shadowRegistry().snapshot() cardinality keys are canonical-JSON* — As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{"tenant":"a"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values. **Security:** *Label values can no longer forge extra Prometheus label pairs in the shadow registry* — b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render.
+
+- v0.15.34 (2026-06-26) — **`b.mail.crypto.pgp.verify` now accepts every valid RSA OpenPGP signature — one whose value happened to have a high zero byte (about 1 in 256) was being rejected.** An OpenPGP RSA signature is an integer modulo the key's modulus, and ~1 in 256 signatures have a value that begins with a zero byte. The MPI encoding strips those leading zero bytes (RFC 9580 §3.2), but b.mail.crypto.pgp.verify passed the stripped value straight to the RSA verification, which requires a signature exactly the modulus byte length — so a perfectly valid signature was intermittently reported invalid. The signature is now left-padded back to the modulus width before verification, exactly as the Ed25519 path already pads its components. Verification of every valid RSA signature is now reliable, including signatures produced by other OpenPGP implementations. Also includes internal test-tooling: two more guard-suite suppression classes were re-verified and their tokens retired. **Fixed:** *RSA OpenPGP signatures with a high zero byte now verify reliably* — b.mail.crypto.pgp.verify read the RSA signature MPI (whose leading zero bytes the OpenPGP wire format strips) and handed it to the RSA verification without restoring the stripped bytes. Node's RSA verify requires the signature to be exactly the modulus byte length, so a signature whose value had one or more high zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct. The signature is now left-padded to the modulus width before verification (the same correction the Ed25519 verification path already applied to its R/S components). This affects signatures the framework produces and signatures from other OpenPGP implementations alike. A deterministic regression test searches for a short-MPI signature and asserts it verifies. **Detectors:** *Two more suppression-marker classes re-verified and their tokens retired* — The raw-hash-compare and seal-without-aad guard classes were re-read and confirmed (a data-residency region tag compared with === — not a secret; and two intentional non-AEAD-bound seals — a non-regulated plain-mode column whose AAD is enforced by the posture seal-envelope floor where it matters, and a throwaway vault-readiness probe), then renamed to descriptive tokens with their old names added to the retired-token set. Test-suite tooling only.
+
 - v0.15.33 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the math-random-noncrypto, raw-new-url, and dynamic-require guard classes was re-read and confirmed (non-security jitter/sampling; URL parsing for shape/origin inspection or behind the safe wrapper; operator-supplied module loads), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.
 
 - v0.15.32 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired so the prior approval cannot be silently resurrected and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the process-exit, hand-rolled buffer-collect, and raw-outbound-http guard classes was re-read and confirmed (operator-opt-in exits; bounded protocol-framing / TLV assembly; framework-routed outbound calls), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.

package/lib/crypto-field.js

@@ -1090,7 +1090,7 @@ function sealRow(table, row, opts) {
       out[field] = vaultAad.seal(_encodeTyped(out[field]),
         _aadParts(s, table, field, out));
     } else {
-      // allow:seal-without-aad — plain-mode legacy table; operator
+      // allow:seal-without-aad-by-design — plain-mode legacy table; operator
       // opts into AAD via registerTable({aad:true})
       out[field] = vault.seal(_encodeTyped(out[field]));
     }

package/lib/external-db.js

@@ -1709,7 +1709,7 @@ function _crossBorderRegulated(posture) {
 
 function _residencyCompatible(primaryTag, replicaTag) {
   if (!primaryTag || !replicaTag) return true;
-  if (primaryTag === replicaTag) return true; // allow:raw-hash-compare — residency tag string, not a secret hash
+  if (primaryTag === replicaTag) return true; // allow:raw-hash-compare-nonsecret-tag — residency tag string, not a secret hash
   if (primaryTag === "unrestricted" || replicaTag === "unrestricted") return true;
   return false;
 }

package/lib/mail-crypto-pgp.js

@@ -865,11 +865,22 @@ function verify(opts) {
   var ok;
   if (parsed.pubAlg === PUB_ALG_RSA) {
     var rsaMpi = _readMpi(parsed.sigMpisBytes, 0);
+    // The signature is an integer in [0, n); when its value has one or more
+    // high zero bytes (~1/256 of signatures) the OpenPGP MPI encoding strips
+    // them (RFC 9580 §3.2), but node's RSA verify requires a signature exactly
+    // the modulus byte length. Left-pad the stripped MPI back to the modulus
+    // width — the same correction the Ed25519 branch applies to its R/S
+    // components below — or a valid signature is rejected.
+    var rsaSigBytes = rsaMpi.value;
+    var modLen = rsaPub.n.length;
+    if (rsaSigBytes.length < modLen) {
+      rsaSigBytes = Buffer.concat([Buffer.alloc(modLen - rsaSigBytes.length), rsaSigBytes]);
+    }
     try {
       ok = nodeCrypto.verify(hashName, hashInput, {
         key: publicKey,
         padding: nodeCrypto.constants.RSA_PKCS1_PADDING,
-      }, rsaMpi.value);
+      }, rsaSigBytes);
     } catch (e) {
       return _fail("mail-crypto/pgp/verify-error",
         "RSA verify threw: " + ((e && e.message) || String(e)));

package/lib/metrics.js

@@ -1352,6 +1352,14 @@ function shadowRegistry(opts) {
   var counters = Object.create(null);
   var gauges   = Object.create(null);
   var info     = Object.create(null);
+  // Maps a canonical-JSON cardinality key → the string-coerced, null-prototype
+  // label object that produced it, so the render path reads the structured
+  // labels directly instead of re-parsing the key. Re-parsing would both lose a
+  // label NAMED `constructor` / `prototype` / `__proto__` (all valid Prometheus
+  // label names) to a prototype-pollution-hardened JSON parse, and reintroduce a
+  // serialize-then-split round-trip. Populated only when a value is actually
+  // stored, so it stays bounded by the cardinality cap.
+  var labelSets = Object.create(null);
   var lastCardinalityAuditMs = 0;
 
   function _cardinalityHit(metric) {
@@ -1375,19 +1383,27 @@ function shadowRegistry(opts) {
     }
   }
 
-  function _labelKey(labels) {
-    if (!labels || typeof labels !== "object") return "";
-    var keys = Object.keys(labels).sort();                                                            // allow:bare-canonicalize-walk — label-set canonicalization for cardinality keying
-    var parts = [];
-    for (var i = 0; i < keys.length; i += 1) {
-      parts.push(keys[i] + "=" + String(labels[keys[i]]));
-    }
-    return parts.join(",");
+  function _coerceLabels(labels) {
+    // → { key, set }: the canonical-JSON cardinality key (collision-proof and
+    // injection-proof, matching the main registry's _labelsKey) plus the
+    // string-coerced, null-prototype label object it came from. The render path
+    // reads `set` directly rather than re-parsing `key`, so a `,` or `=` in a
+    // label VALUE can never forge extra label pairs and a label NAMED
+    // `constructor` / `prototype` / `__proto__` survives verbatim. The
+    // null-prototype object makes a `__proto__` label a normal own property
+    // rather than a prototype assignment.
+    if (!labels || typeof labels !== "object") return { key: "", set: null };
+    var keys = Object.keys(labels);
+    if (keys.length === 0) return { key: "", set: null };
+    var coerced = Object.create(null);
+    for (var i = 0; i < keys.length; i += 1) coerced[keys[i]] = String(labels[keys[i]]);
+    return { key: canonicalJson.stringify(coerced), set: coerced };
   }
 
   function inc(name, labels) {
     if (!counterSet[name]) return;
-    var lk = _labelKey(labels);
+    var ck = _coerceLabels(labels);
+    var lk = ck.key;
     if (!counters[name]) counters[name] = Object.create(null);
     var current = counters[name][lk];
     if (current === undefined) {
@@ -1396,6 +1412,7 @@ function shadowRegistry(opts) {
         return;
       }
       counters[name][lk] = 1;
+      if (ck.set) labelSets[lk] = ck.set;
     } else {
       counters[name][lk] = current + 1;
     }
@@ -1407,13 +1424,15 @@ function shadowRegistry(opts) {
       throw new MetricsError("metrics-shadow/bad-gauge-value",
         "shadowRegistry.set: '" + name + "' value must be a finite number");
     }
-    var lk = _labelKey(labels);
+    var ck = _coerceLabels(labels);
+    var lk = ck.key;
     if (!gauges[name]) gauges[name] = Object.create(null);
     if (gauges[name][lk] === undefined && Object.keys(gauges[name]).length >= cap) {
       _cardinalityHit(name);
       return;
     }
     gauges[name][lk] = value;
+    if (ck.set) labelSets[lk] = ck.set;
   }
 
   function setInfo(name, value) {
@@ -1449,22 +1468,21 @@ function shadowRegistry(opts) {
         for (var li = 0; li < lks.length; li += 1) {
           var lk = lks[li];
           if (lk === "") { out.push(metric + " " + labelMap[lk]); continue; }
-          // The label-key string was assembled by `_labelKey` from a
-          // single shadow-registry call's `labels` object — values
-          // are framework-internal (operator code that supplied them
-          // is bounded by guards upstream); split on `,` is safe.
-          // Not a header-value parse (which would need a quoted-
-          // string aware split per RFC 9110).
-          var lpairs = lk.split(",");                                                                // allow:bare-split-on-quoted-header — framework-internal label-key (assembled by _labelKey), not an HTTP header parse
+          // Read the structured label set kept alongside the canonical key (see
+          // _coerceLabels) rather than re-parsing the key. No serialize-then-
+          // split round-trip, so a `,` or `=` in a label value stays inside the
+          // value and can never forge extra label pairs; and a label NAMED
+          // `constructor` / `prototype` / `__proto__` survives instead of being
+          // stripped by a prototype-pollution-hardened parse.
+          var labelObj = labelSets[lk];
+          if (!labelObj || typeof labelObj !== "object") { out.push(metric + " " + labelMap[lk]); continue; }
+          var lnames = Object.keys(labelObj).sort();                                                 // allow:bare-canonicalize-walk — deterministic label ordering in the exposition line
           var formatted = [];
-          for (var pi = 0; pi < lpairs.length; pi += 1) {
-            var eqIdx = lpairs[pi].indexOf("=");
-            if (eqIdx === -1) continue;
-            var lname = lpairs[pi].slice(0, eqIdx);
-            var lvalue = lpairs[pi].slice(eqIdx + 1);
+          for (var pi = 0; pi < lnames.length; pi += 1) {
+            var lname = lnames[pi];
             if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(lname)) continue;                                   // allow:regex-no-length-cap — Prometheus label-name shape
             // Prometheus exposition: escape `\`, `"`, `\n` in label values.
-            lvalue = String(lvalue).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n"); // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus value escape shape
+            var lvalue = String(labelObj[lname]).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n"); // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus value escape shape
             formatted.push(lname + '="' + lvalue + '"');
           }
           out.push(metric + "{" + formatted.join(",") + "} " + labelMap[lk]);
@@ -1516,9 +1534,10 @@ function shadowRegistry(opts) {
   }
 
   function reset() {
-    counters = Object.create(null);
-    gauges   = Object.create(null);
-    info     = Object.create(null);
+    counters  = Object.create(null);
+    gauges    = Object.create(null);
+    info      = Object.create(null);
+    labelSets = Object.create(null);
     lastCardinalityAuditMs = 0;
   }
 

package/lib/middleware/idempotency-key.js

@@ -290,7 +290,7 @@ function dbStore(opts) {
   var sealEnabled = false;
   if (sealReq) {
     try {
-      // allow:seal-without-aad — vault-readiness probe; throwaway
+      // allow:seal-without-aad-by-design — vault-readiness probe; throwaway
       // sentinel value, not row-bound data
       vault.seal("__idempotency_seal_probe__");
       sealEnabled = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.33",
+  "version": "0.15.35",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:cfba44f6-db8e-47b3-b1dc-e142692c3a97",
+  "serialNumber": "urn:uuid:ecbff4b1-ce1e-42ec-93f8-46f7c036e3e8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-26T23:00:05.686Z",
+    "timestamp": "2026-06-27T06:52:37.069Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.33",
+      "bom-ref": "@blamejs/core@0.15.35",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.33",
+      "version": "0.15.35",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.33",
+      "purl": "pkg:npm/%40blamejs/core@0.15.35",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.33",
+      "ref": "@blamejs/core@0.15.35",
       "dependsOn": []
     }
   ]