@blamejs/core 0.15.35 → 0.15.36

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.36 (2026-06-27) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** The codebase-patterns guard class that allows a bare comma/semicolon split on token-only RFC header grammars was re-verified from scratch and renamed to a descriptive token, with its old name recorded as retired. Each live marked site (RRULE, RFC 9421 component identifiers, TLS-RPT rua, SCIM attribute paths) was re-read and confirmed to split a grammar with no quoted-string members. Five marker comments that suppressed nothing were removed or turned into plain explanatory comments. No runtime code, public API, or wire format changed. **Detectors:** *Bare token-only header-split suppression class re-verified, renamed, and pruned of inert markers* — Each marked bare `.split(",")` / `.split(";")` on an RFC header value was re-read and confirmed to operate on a token-only grammar (no quoted-string members, so a quote-aware splitter is unnecessary): RFC 5545 RRULE, RFC 9421 signature component identifiers, RFC 8460 TLS-RPT rua, and RFC 7644 SCIM attribute paths. The guard class was renamed to a descriptive token and its old name added to the retired-token set. Five marker comments that the detector never actually evaluated (two sat on a date-normalizing `.replace`, three in header parsers the guard intentionally does not scan) were removed or converted to plain comments. This is test-suite tooling plus source-comment text; no shipped framework behavior changed.
+
 - v0.15.35 (2026-06-26) — **`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by.** The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{"route":"/api"}`) rather than `route=/api`. **Changed:** *shadowRegistry().snapshot() cardinality keys are canonical-JSON* — As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{"tenant":"a"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values. **Security:** *Label values can no longer forge extra Prometheus label pairs in the shadow registry* — b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render.
 
 - v0.15.34 (2026-06-26) — **`b.mail.crypto.pgp.verify` now accepts every valid RSA OpenPGP signature — one whose value happened to have a high zero byte (about 1 in 256) was being rejected.** An OpenPGP RSA signature is an integer modulo the key's modulus, and ~1 in 256 signatures have a value that begins with a zero byte. The MPI encoding strips those leading zero bytes (RFC 9580 §3.2), but b.mail.crypto.pgp.verify passed the stripped value straight to the RSA verification, which requires a signature exactly the modulus byte length — so a perfectly valid signature was intermittently reported invalid. The signature is now left-padded back to the modulus width before verification, exactly as the Ed25519 path already pads its components. Verification of every valid RSA signature is now reliable, including signatures produced by other OpenPGP implementations. Also includes internal test-tooling: two more guard-suite suppression classes were re-verified and their tokens retired. **Fixed:** *RSA OpenPGP signatures with a high zero byte now verify reliably* — b.mail.crypto.pgp.verify read the RSA signature MPI (whose leading zero bytes the OpenPGP wire format strips) and handed it to the RSA verification without restoring the stripped bytes. Node's RSA verify requires the signature to be exactly the modulus byte length, so a signature whose value had one or more high zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct. The signature is now left-padded to the modulus width before verification (the same correction the Ed25519 verification path already applied to its R/S components). This affects signatures the framework produces and signatures from other OpenPGP implementations alike. A deterministic regression test searches for a short-MPI signature and asserts it verifies. **Detectors:** *Two more suppression-marker classes re-verified and their tokens retired* — The raw-hash-compare and seal-without-aad guard classes were re-read and confirmed (a data-residency region tag compared with === — not a secret; and two intentional non-AEAD-bound seals — a non-regulated plain-mode column whose AAD is enforced by the posture seal-envelope floor where it matters, and a throwaway vault-readiness probe), then renamed to descriptive tokens with their old names added to the retired-token set. Test-suite tooling only.

package/lib/calendar.js

@@ -1119,7 +1119,7 @@ function _firstParamValue(prop, paramName) {
 
 function _icalRruleToJscal(rrule) {
   var out = { "@type": "RecurrenceRule", frequency: "daily" };
-  var parts = String(rrule).split(";");                                                                // allow:bare-split-on-quoted-header — RFC 5545 RRULE grammar has no quoted-string members; values are token-only
+  var parts = String(rrule).split(";");                                                                // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 RRULE grammar has no quoted-string members; values are token-only
   for (var i = 0; i < parts.length; i += 1) {
     var kv = parts[i].split("=");
     if (kv.length !== 2) continue;
@@ -1129,11 +1129,11 @@ function _icalRruleToJscal(rrule) {
     else if (key === "INTERVAL") out.interval = parseInt(val, 10);
     else if (key === "COUNT") out.count = parseInt(val, 10);
     else if (key === "UNTIL") out.until = _icalDateTimeToUtc(val);
-    else if (key === "BYDAY") out.byDay = val.split(",").map(function (d) {                            // allow:bare-split-on-quoted-header — RFC 5545 BYDAY values are token-only
+    else if (key === "BYDAY") out.byDay = val.split(",").map(function (d) {                            // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYDAY values are token-only
       return { "@type": "NDay", day: d.slice(-2).toLowerCase() };
     });
-    else if (key === "BYMONTH") out.byMonth = val.split(",");                                          // allow:bare-split-on-quoted-header — RFC 5545 BYMONTH values are integer-only
-    else if (key === "BYMONTHDAY") out.byMonthDay = val.split(",").map(function (n) { return parseInt(n, 10); }); // allow:bare-split-on-quoted-header — RFC 5545 BYMONTHDAY values are integer-only
+    else if (key === "BYMONTH") out.byMonth = val.split(",");                                          // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYMONTH values are integer-only
+    else if (key === "BYMONTHDAY") out.byMonthDay = val.split(",").map(function (n) { return parseInt(n, 10); }); // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYMONTHDAY values are integer-only
   }
   return out;
 }
@@ -1168,13 +1168,13 @@ function _utcDateTimeToIcal(s) {
   // JSCalendar UTCDateTime "2026-05-22T10:00:00.123Z" →
   // "20260522T100000Z" (RFC 5545 §3.3.5 form 2 has NO fractional
   // seconds; strict ICS consumers reject `T100000.123Z`).
-  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");                                          // allow:bare-split-on-quoted-header — not a header split
+  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");
 }
 
 function _localDateTimeToIcal(s) {
   // JSCalendar LocalDateTime "2026-05-22T09:00:00.123" →
   // "20260522T090000" (same fractional-second strip as the UTC form).
-  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");                                          // allow:bare-split-on-quoted-header — not a header split
+  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");
 }
 
 function _isUtcDateTime(s) {

package/lib/http-client-cache.js

@@ -212,7 +212,7 @@ function _buildCacheKey(method, url, varyHeaderValues) {
 // uncacheable.
 function _extractVaryValues(varyHeader, requestHeaders) {
   if (typeof varyHeader !== "string" || varyHeader.length === 0) return [];
-  var names = varyHeader.split(",").map(function (s) {                                          // allow:bare-split-on-quoted-header — RFC 9110 §12.5.5 Vary is a comma-list of field-names (token grammar); no quoted-string
+  var names = varyHeader.split(",").map(function (s) {                                          // RFC 9110 §12.5.5 Vary is a comma-list of field-names (token grammar); no quoted-string, so a bare split is correct
     return s.trim().toLowerCase();
   }).filter(function (s) { return s.length > 0; });
   if (names.indexOf("*") !== -1) return null;  // sentinel: "uncacheable"
@@ -262,7 +262,7 @@ function _evaluateStorage(method, statusCode, responseHeaders, sharedCache) {
 
   // Vary: * is uncacheable per RFC 9110 §12.5.5.
   if (typeof varyHeader === "string" && varyHeader.indexOf("*") !== -1) {
-    var trimmed = varyHeader.split(",").map(function (s) { return s.trim(); });                  // allow:bare-split-on-quoted-header — RFC 9110 §12.5.5 Vary field-names; token grammar only
+    var trimmed = varyHeader.split(",").map(function (s) { return s.trim(); });                  // RFC 9110 §12.5.5 Vary field-names; token grammar only, so a bare split is correct
     if (trimmed.indexOf("*") !== -1) {
       return { cacheable: false, reason: "vary-star", freshnessMs: -1, directives: directives, varyHeader: varyHeader };
     }

package/lib/http-message-signature.js

@@ -319,7 +319,7 @@ function sign(msg, opts) {
   // header isn't already supplied. Operators wanting to use the
   // RFC 9530 "sha-512" identifier (SHA-512 instead of SHA3-512) supply
   // the header themselves; the framework emits SHA3-512.
-  var coveredLower = opts.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header — opts.covered is operator-supplied component-id list (e.g. "content-digest;sf"); component identifiers are RFC 9421 §2.1 derived-field names with token-only grammar; no quoted-string
+  var coveredLower = opts.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header-token-grammar — opts.covered is operator-supplied component-id list (e.g. "content-digest;sf"); component identifiers are RFC 9421 §2.1 derived-field names with token-only grammar; no quoted-string
   if (coveredLower.indexOf("content-digest") !== -1 &&
       _resolveHeader(m.headers, "content-digest") === null) {
     if (m.body == null) {
@@ -451,7 +451,7 @@ function _parseSignature(headerValue, label) {
   if (headerValue.indexOf(prefix) !== 0) {
     // Multiple signature labels can appear; comma-separated. Find the
     // matching label.
-    var parts = headerValue.split(",");                                                        // allow:bare-split-on-quoted-header — RFC 9421 §2.4 Signature header values are `label=:b64:` form; base64 alphabet excludes `,` and the label tokens are RFC 8941 §3.3.4 sf-token (no DQUOTE in practice)
+    var parts = headerValue.split(",");                                                        // allow:bare-split-on-quoted-header-token-grammar — RFC 9421 §2.4 Signature header values are `label=:b64:` form; base64 alphabet excludes `,` and the label tokens are RFC 8941 §3.3.4 sf-token (no DQUOTE in practice)
     for (var i = 0; i < parts.length; i++) {
       var p = parts[i].trim();
       if (p.indexOf(prefix) === 0) {
@@ -519,7 +519,7 @@ function verify(msg, opts) {
   // If content-digest is covered, recompute and compare. RFC 9421 §B.2.5
   // mandates that verifiers re-run the digest over the body — a stale
   // header from a proxy would otherwise verify trivially.
-  var coveredLower = parsedInput.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header — same as sign() above: covered items are RFC 9421 §2.1 component-ids, token grammar
+  var coveredLower = parsedInput.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header-token-grammar — same as sign() above: covered items are RFC 9421 §2.1 component-ids, token grammar
   if (coveredLower.indexOf("content-digest") !== -1) {
     if (m.body == null) {
       return { valid: false, reason: "content-digest-no-body" };

package/lib/middleware/body-parser.js

@@ -351,7 +351,7 @@ function _detectSmuggling(req) {
   //    (RFC 9112 §6.1). Anything else is a smuggling vector or
   //    server-side decode error.
   if (typeof te === "string" && te.length > 0) {
-    var tokens = te.toLowerCase().split(",").map(function (t) { return t.trim(); });               // allow:bare-split-on-quoted-header — RFC 9112 §6.1 Transfer-Encoding values (chunked / gzip / deflate / identity) are token-only; no quoted-string in the grammar
+    var tokens = te.toLowerCase().split(",").map(function (t) { return t.trim(); });               // RFC 9112 §6.1 Transfer-Encoding values (chunked / gzip / deflate / identity) are token-only; no quoted-string in the grammar, so a bare split is correct
     var last = tokens[tokens.length - 1];
     if (last !== "chunked") {
       return {

package/lib/middleware/scim-server.js

@@ -237,8 +237,8 @@ async function _dispatch(req, res, basePath, bearer, opts, maxPageSize, bulkCfg)
       count:              pageSize,
       sortBy:             query.sortBy || null,
       sortOrder:          query.sortOrder || null,
-      attributes:         query.attributes ? query.attributes.split(",") : null,                  // allow:bare-split-on-quoted-header — RFC 7644 §3.9 attributes/excludedAttributes are SCIM attribute paths (URN-ish identifiers); grammar excludes DQUOTE
-      excludedAttributes: query.excludedAttributes ? query.excludedAttributes.split(",") : null,    // allow:bare-split-on-quoted-header — same SCIM attribute-name grammar
+      attributes:         query.attributes ? query.attributes.split(",") : null,                  // allow:bare-split-on-quoted-header-token-grammar — RFC 7644 §3.9 attributes/excludedAttributes are SCIM attribute paths (URN-ish identifiers); grammar excludes DQUOTE
+      excludedAttributes: query.excludedAttributes ? query.excludedAttributes.split(",") : null,    // allow:bare-split-on-quoted-header-token-grammar — same SCIM attribute-name grammar
     }, ctx);
     _writeJson(res, H.OK, {
       schemas:      [SCIM_MESSAGE_LIST],

package/lib/network-smtp-policy.js

@@ -613,7 +613,7 @@ async function tlsRptFetchPolicy(domain, opts) {
   var rua = [];
   for (var p = 0; p < pairs.length; p += 1) {
     if (pairs[p][0] === "rua") {
-      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
+      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header-token-grammar — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
       for (var u = 0; u < uris.length; u += 1) {
         var uri = uris[u].trim();
         if (uri.length > 0) rua.push(uri);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.35",
+  "version": "0.15.36",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ecbff4b1-ce1e-42ec-93f8-46f7c036e3e8",
+  "serialNumber": "urn:uuid:88f8b769-23a3-43f0-824e-6239b53c0528",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-27T06:52:37.069Z",
+    "timestamp": "2026-06-27T08:05:51.707Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.35",
+      "bom-ref": "@blamejs/core@0.15.36",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.35",
+      "version": "0.15.36",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.35",
+      "purl": "pkg:npm/%40blamejs/core@0.15.36",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.35",
+      "ref": "@blamejs/core@0.15.36",
       "dependsOn": []
     }
   ]