@blamejs/core 0.15.44 → 0.15.46

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.46 (2026-06-28) — **`b.auth.fidoMds3` now enforces basicConstraints cA:TRUE on every intermediate link of the MDS3 x5c chain, closing a bypass where a non-CA certificate spliced in as an intermediate could sign a forged FIDO metadata BLOB that fido-mds3 accepted.** fido-mds3's x5c chain validation checked each intermediate link with X509Certificate.checkIssued(), which validates the issuer/subject linkage and signature but does NOT enforce the basicConstraints CA bit; only the final tail-to-root anchor used the framework's cA-enforcing helper. An attacker holding a non-CA (cA:FALSE) end-entity certificate that legitimately chains to a trusted MDS3 root (and its private key) could splice it in as an intermediate, sign a forged leaf with it, and have fido-mds3 accept an attacker-authored MDS3 metadata BLOB as authentic — the classic basicConstraints bypass (CVE-2002-0862 class). Every intermediate link now routes through x509Chain.issuerValidlyIssued, which enforces basicConstraints cA:TRUE in addition to the issuance and signature linkage, matching the mdoc / tsa / bimi / content-credentials / S-MIME chain walkers. A codebase guard now fails the build if any chain walker uses a bare issuance checkIssued() instead. **Security:** *fido-mds3 x5c intermediate links enforce the CA bit (basicConstraints bypass closed)* — b.auth.fidoMds3 validated each intermediate x5c link with X509Certificate.checkIssued(), which does not enforce basicConstraints cA:TRUE, so a non-CA certificate inserted as an intermediate was accepted as an issuer. An attacker with a cA:FALSE end-entity cert chaining to a trusted MDS3 root could sign a forged leaf and have a forged FIDO metadata BLOB accepted as authentic (CVE-2002-0862 class). Each intermediate link now routes through x509Chain.issuerValidlyIssued (cA:TRUE + issuance + signature), the same hardened test the framework's other certificate-chain walkers already use. The default GlobalSign MDS3 root and operator-supplied caCertificate roots are both covered. **Detectors:** *Build guard: a cert-chain issuance link must use issuerValidlyIssued, not bare checkIssued* — A codebase guard now fails the build if a certificate-chain walker validates an issuance link with a bare X509Certificate.checkIssued() (which omits the basicConstraints CA check) instead of x509Chain.issuerValidlyIssued, so the basicConstraints bypass cannot reappear at a new walker. A self-signed-root check (cert.checkIssued(cert)) is not an issuance link and is unaffected.
+
+- v0.15.45 (2026-06-28) — **`b.selfUpdate.swap` now re-hashes the asset against the hash `verify` returned and refuses to install on a mismatch, closing the window where an asset swapped between verify and swap could be installed after the signature check passed.** selfUpdate.verify (signature-checks the asset and returns its hash) and selfUpdate.swap (renames the new asset into place) were two separate path-keyed operations with nothing binding the bytes swap installs to the bytes verify checked. An attacker able to write the asset path in the window between the two calls — or who pointed verify at a different inode via a symlink — could have the signature-verified bytes replaced before swap renamed the file into place, installing unverified code. swap now requires an expectedHash and re-hashes the from bytes against it immediately before the install, refusing with selfupdate/swap-hash-mismatch on any difference; the re-check runs right before the rename so the residual is a sub-millisecond window rather than the operator-controlled gap between verify and swap. Because swap now requires expectedHash, callers must pass the hash that verify returned (await verify(...) then swap({ ..., expectedHash: result.hash })). **Security:** *self-update install is bound to the signature-verified bytes (verify→swap TOCTOU closed)* — selfUpdate.swap renamed the new asset into place with no integrity re-check, so the bytes it installed were not bound to the bytes selfUpdate.verify had signature-checked: an attacker who could write the asset path between verify and swap (or repoint a symlink) could install unverified code. swap now re-hashes the from bytes against a required expectedHash (the hash verify returns) immediately before the install and refuses a mismatch (selfupdate/swap-hash-mismatch), with the check positioned right before the rename to minimize the residual window. A symlinked or differing-inode asset is caught the same way, because the install source is what gets re-hashed. **Migration:** *selfUpdate.swap requires expectedHash* — swap now requires an expectedHash option (refused at the call with selfupdate/bad-expected-hash if absent). Pass the hash that selfUpdate.verify returns: const v = await selfUpdate.verify({ assetPath, signaturePath, pubkeyPem }); await selfUpdate.swap({ from, to, backupTo, expectedHash: v.hash }). An optional hashAlgo (default sha3-512, matching verify's default) selects the digest when verify used a non-default algorithm.
+
 - v0.15.44 (2026-06-28) — **`b.fileUpload` now rejects the bare path tokens "." and ".." as upload IDs, closing a path traversal where a ".." id resolved to the staging directory's parent and a cancel or cleanup could recursively delete it.** b.fileUpload validated the uploadId with a character-class regex that permits the dot character, so the bare path tokens "." and ".." passed validation even though they are not ordinary identifiers. The uploadId is joined under the configured staging directory to locate an upload's files, so "." resolved to the staging directory itself and ".." to its parent: an operation keyed on a ".." uploadId acted OUTSIDE the staging directory. The most damaging path is cancelUpload (and finalize/expiry cleanup), which removes the upload directory with a recursive rmSync — keyed on ".." that would recursively delete the staging directory's parent; chunk writes for a ".." id also land outside staging. The validator now rejects "." and ".." before any filesystem operation. Every public method validates the uploadId there, so init, acceptChunk, finalize, status, and cancelUpload are all covered, and legitimate dotted IDs (for example "build.v2") are unaffected. **Security:** *Upload IDs of "." and ".." are refused (path-traversal / parent-directory deletion)* — fileUpload's uploadId regex allows the dot character, so the bare tokens "." and ".." passed validation and, joined under the staging directory, resolved to the staging directory or its parent. An operation keyed on a ".." id acted outside staging — most seriously cancelUpload / cleanup, whose recursive rmSync would have deleted the staging directory's parent, and chunk writes that would land outside staging. The validator now rejects "." and ".." up front; because every public method validates the id, init / acceptChunk / finalize / status / cancelUpload are all covered. Legitimate dotted IDs are unaffected. Operators who never pass caller-controlled upload IDs were not exposed.
 
 - v0.15.43 (2026-06-28) — **`b.auth.lockout`'s failed-attempt counter now accumulates with an atomic compare-and-set, so a brute-force attacker spreading failed logins across multiple nodes can no longer lose increments and stay under the lockout threshold.** b.auth.lockout tracked failed attempts with a cache read-modify-write: read the counter, increment it, write it back. On a multi-node deployment two concurrent failures for the same account on different nodes both read the same value, each added one, and one write clobbered the other — a lost update that let an attacker spreading attempts across nodes exceed maxAttempts without ever triggering the lockout, weakening brute-force protection on a cluster. The counter now runs the whole decision (window decay, increment, lockout-ladder) through the cache's atomic update() (compare-and-set, retried on the cluster backend under contention), so every failure is counted regardless of which node records it. The lockout's documented fail-open posture is preserved — a genuinely unreachable cache still allows the attempt and signals the error — but a cache backend that cannot perform an atomic update now surfaces loud at first use instead of silently disabling the lockout. **Security:** *Lockout failure counter is atomic across nodes (no lost increments)* — b.auth.lockout accumulated failed attempts with a non-atomic cache get -> increment -> set, so concurrent failures for one account across a multi-node deployment lost increments and an attacker could exceed maxAttempts without engaging the lockout. The counter now uses the cache's atomic compare-and-set update(), counting every failure across nodes, with the existing exponential lockout ladder and window-decay logic unchanged. The cache backing a lockout must support atomic update() (b.cache does; the create() check now requires it), and a backend that can't commit an atomic update surfaces loud at first use rather than silently disabling brute-force protection. A genuinely unreachable cache still fails open by design.

package/lib/auth/fido-mds3.js

@@ -234,14 +234,16 @@ function _validateChain(x5c, rootPems) {
     }
   }
   for (var c = 0; c < chain.length - 1; c++) {
-    if (!chain[c].checkIssued(chain[c + 1])) {
+    // issuerValidlyIssued enforces basicConstraints cA:TRUE on the issuing cert
+    // (chain[c+1]) in addition to the issuance + signature linkage — a non-CA
+    // cert spliced in as an intermediate cannot issue the next link (the classic
+    // basicConstraints bypass, CVE-2002-0862 class). Mirrors mdoc / tsa / bimi /
+    // content-credentials, which enforce cA:TRUE on every hop; only the
+    // tail-to-root anchor below previously did so.
+    if (!x509Chain.issuerValidlyIssued(chain[c + 1], chain[c])) {
       throw new FidoMds3Error("fido-mds3/chain-broken",
-        "x5c[" + c + "] not issued by x5c[" + (c + 1) + "]");
-    }
-    var issuerKey = chain[c + 1].publicKey;
-    if (!chain[c].verify(issuerKey)) {
-      throw new FidoMds3Error("fido-mds3/chain-bad-signature",
-        "x5c[" + c + "] signature does not verify against x5c[" + (c + 1) + "] public key");
+        "x5c[" + c + "] not validly issued by x5c[" + (c + 1) +
+        "] (issuer must be a CA whose signature over the subject verifies)");
     }
   }
   var tail = chain[chain.length - 1];

package/lib/self-update.js

@@ -28,9 +28,11 @@
  *        P-384 from the supplied PEM) and reports the bytes' hash for
  *        SBOM correlation. A mismatched signature throws and the swap
  *        never runs.
- *     4. `b.selfUpdate.swap({ from, to, backupTo })` performs the
- *        atomic install: copy the current `to` to `backupTo`, rename
- *        `from` → `to`, fsync both directories. Cross-device renames
+ *     4. `b.selfUpdate.swap({ from, to, backupTo, expectedHash })` performs
+ *        the atomic install: re-hash `from` and refuse unless it matches
+ *        `expectedHash` (the hash step 3 returned — binding the installed
+ *        bytes to the verified bytes), copy the current `to` to `backupTo`,
+ *        rename `from` → `to`, fsync both directories. Cross-device renames
  *        fall back to copy + unlink. Any failure rolls back from the
  *        backup. `b.selfUpdate.rollback({ to, backupTo })` restores
  *        the backup post-swap when a healthcheck reports the new
@@ -614,6 +616,18 @@ function _validateSwapOpts(opts, label) {
   if (label === "swap") {
     schema.from = { rule: "required-string", code: "selfupdate/bad-from",
                     label: "selfUpdate.swap: opts.from" };
+    // The bytes about to be installed are re-hashed and checked against the
+    // hash selfUpdate.verify returned, closing the verify -> swap window. The
+    // binding is mandatory — an optional integrity check is opt-in security.
+    schema.expectedHash = { rule: "required-string", code: "selfupdate/bad-expected-hash",
+                            label: "selfUpdate.swap: opts.expectedHash (the hash selfUpdate.verify returned)" };
+    schema.hashAlgo = function (value) {
+      if (value !== undefined &&
+          (typeof value !== "string" || ALLOWED_HASH_ALGS.indexOf(value) === -1)) {
+        throw new SelfUpdateError("selfupdate/bad-hash-algo",
+          "selfUpdate.swap: opts.hashAlgo must be one of " + ALLOWED_HASH_ALGS.join(", "));
+      }
+    };
   }
   schema.to       = { rule: "required-string", code: "selfupdate/bad-to",
                       label: "selfUpdate." + label + ": opts.to" };
@@ -664,24 +678,31 @@ async function _safeRollback(backupTo, to, hadOriginal) {
  * @since     0.6.0
  * @related   b.selfUpdate.verify, b.selfUpdate.rollback, b.atomicFile.copy
  *
- * Atomic install: copy the existing `to` to `backupTo`, rename `from`
- * → `to`, then fsync both directories. Cross-device renames fall back
- * to copy + unlink on the destination filesystem. On any failure the
- * original `to` is restored from `backupTo`. Throws SelfUpdateError on
- * a missing `from`, backup-copy failure, cross-device install failure,
+ * Atomic install: re-hash `from` and refuse unless it matches `expectedHash`
+ * (the hash selfUpdate.verify returned — this binds the installed bytes to the
+ * signature-verified bytes and closes the verify→swap window), copy the
+ * existing `to` to `backupTo`, rename `from` → `to`, then fsync both
+ * directories. Cross-device renames fall back to copy + unlink on the
+ * destination filesystem. On any failure the original `to` is restored from
+ * `backupTo`. Throws SelfUpdateError on a missing `from`, an
+ * expectedHash mismatch, backup-copy failure, cross-device install failure,
  * or rename failure.
  *
  * @opts
- *   from:     string,   // required — newly-installed asset path
- *   to:       string,   // required — target install path
- *   backupTo: string,   // required — backup path for the existing `to`
+ *   from:         string,   // required — newly-installed asset path
+ *   to:           string,   // required — target install path
+ *   backupTo:     string,   // required — backup path for the existing `to`
+ *   expectedHash: string,   // required — the hash selfUpdate.verify returned
+ *   hashAlgo:     string,   // sha3-512 (default) | sha-256 | sha-512 | shake256
  *
  * @example
+ *   var v = await b.selfUpdate.verify({ assetPath, signaturePath, pubkeyPem });
  *   try {
  *     await b.selfUpdate.swap({
- *       from:     "/tmp/blamejs-doc-missing.bin",
- *       to:       "/tmp/blamejs-doc-target.bin",
- *       backupTo: "/tmp/blamejs-doc-backup.bin",
+ *       from:         "/tmp/blamejs-doc-missing.bin",
+ *       to:           "/tmp/blamejs-doc-target.bin",
+ *       backupTo:     "/tmp/blamejs-doc-backup.bin",
+ *       expectedHash: v.hash,
  *     });
  *   } catch (e) {
  *     e.code;                 // → "selfupdate/missing-from"
@@ -698,6 +719,37 @@ async function swap(opts) {
       "selfUpdate.swap: from path does not exist: " + from);
   }
 
+  // Bind the installed object to the signature-verified bytes. Read `from` with
+  // O_NOFOLLOW (refuseSymlink) so a symlinked source is refused AT OPEN rather
+  // than followed — otherwise the bytes hashed (the link target) would differ
+  // from the object a by-path rename installs (the link itself). The verified
+  // bytes are then installed FROM MEMORY below, so the installed object is
+  // exactly what was hashed: no symlink-install surface and no time-of-check /
+  // time-of-use window between the hash and the install (which a by-path rename
+  // or re-read would reopen).
+  var swapAlg = opts.hashAlgo || DEFAULT_HASH_ALG;
+  var fromMode;
+  try { fromMode = (nodeFs.statSync(from).mode & 0o777); } catch (_m) { fromMode = 0o600; }
+  var fromBytes;
+  try {
+    fromBytes = atomicFile.fdSafeReadSync(from, {
+      maxBytes: typeof opts.maxBytes === "number" ? opts.maxBytes : C.BYTES.gib(1),
+      refuseSymlink: true,
+    });
+  } catch (e) {
+    throw new SelfUpdateError("selfupdate/swap-read-failed",
+      "selfUpdate.swap: failed to read from for the integrity re-check (a symlinked source is refused): " +
+      ((e && e.message) || String(e)));
+  }
+  var actualHash = nodeCrypto.createHash(swapAlg).update(fromBytes).digest("hex");
+  if (actualHash !== opts.expectedHash) {
+    _safeAuditEmit("selfupdate.swap.hash_mismatch", "denied", {
+      from: from, to: to, alg: swapAlg, expected: opts.expectedHash, actual: actualHash,
+    });
+    throw new SelfUpdateError("selfupdate/swap-hash-mismatch",
+      "selfUpdate.swap: from bytes do not match expectedHash (asset changed after verify?) — refusing to install");
+  }
+
   var toDir       = nodePath.dirname(to);
   var backupDir   = nodePath.dirname(backupTo);
   atomicFile.ensureDir(toDir);
@@ -716,53 +768,33 @@ async function swap(opts) {
     }
   }
 
-  // Step 3 — install. Rename is atomic on same FS; on cross-device we
-  // fall back to copy + unlink. Rollback failure on either branch
-  // surfaces as a DISTINCT error class and audit event so operators
-  // don't silently lose both binaries (the prior best-effort comment
-  // swallowed the rollback exception — SSDF RV.1 violation).
+  // Step 3 — install the verified in-memory bytes via an atomic temp+fsync+
+  // rename on the DESTINATION filesystem (atomicFile.write), so the installed
+  // object is exactly the bytes just hashed: cross-device is handled (the temp
+  // is created on the dest FS), there is no by-path re-read to race, and a
+  // symlinked source can't be moved into place. Roll back from the backup on
+  // failure; a rollback failure surfaces as a DISTINCT error class + audit
+  // event so operators don't silently lose both binaries (SSDF RV.1).
   try {
-    atomicFile.renameWithRetry(from, to);
+    await atomicFile.write(to, fromBytes, { fileMode: fromMode, overwrite: true });
   } catch (e) {
-    if (e && e.code === "EXDEV") {
-      // Cross-device — copy + unlink. Use atomicFile.copy for the safety
-      // net (temp+fsync+rename on dest FS); then remove the source.
-      try {
-        await atomicFile.copy(from, to, { fileMode: 0o600 });
-        try { nodeFs.unlinkSync(from); } catch (_u) { /* tmp source leak — operator-cleanable */ }
-      } catch (ce) {
-        // Roll back from backup if we have one. Rollback failure here
-        // is catastrophic — both the new asset (corrupt cross-device
-        // copy) AND the original (overwritten partial) are now
-        // unreachable. Surface to operator with a dedicated error.
-        var rbErrXdev = await _safeRollback(backupTo, to, hadOriginal);
-        if (rbErrXdev) {
-          throw new SelfUpdateError("selfupdate/swap-rollback-failed",
-            "selfUpdate.swap: cross-device install failed AND rollback ALSO " +
-            "failed — operator must manually restore from backupTo=" + backupTo +
-            ". install-error=" + ((ce && ce.message) || String(ce)) +
-            "; rollback-error=" + rbErrXdev.message);
-        }
-        throw new SelfUpdateError("selfupdate/cross-device",
-          "selfUpdate.swap: cross-device install failed: " + ((ce && ce.message) || String(ce)));
-      }
-    } else {
-      // Other rename failure — try to roll back. Same rollback-failure
-      // semantics as the cross-device branch.
-      var rbErr = await _safeRollback(backupTo, to, hadOriginal);
-      if (rbErr) {
-        throw new SelfUpdateError("selfupdate/swap-rollback-failed",
-          "selfUpdate.swap: rename " + from + " -> " + to + " failed AND " +
-          "rollback ALSO failed — operator must manually restore from " +
-          "backupTo=" + backupTo + ". rename-error=" + e.message +
-          "; rollback-error=" + rbErr.message);
-      }
-      throw new SelfUpdateError("selfupdate/swap-failed",
-        "selfUpdate.swap: rename " + from + " -> " + to + " failed: " + e.message);
+    var rbErr = await _safeRollback(backupTo, to, hadOriginal);
+    if (rbErr) {
+      throw new SelfUpdateError("selfupdate/swap-rollback-failed",
+        "selfUpdate.swap: install of " + to + " failed AND rollback ALSO failed — " +
+        "operator must manually restore from backupTo=" + backupTo +
+        ". install-error=" + ((e && e.message) || String(e)) +
+        "; rollback-error=" + rbErr.message);
     }
+    throw new SelfUpdateError("selfupdate/swap-failed",
+      "selfUpdate.swap: install of " + to + " failed: " + ((e && e.message) || String(e)));
   }
+  // Consume the source asset now that the verified bytes are installed
+  // (best-effort — the install already succeeded; a leftover temp is
+  // operator-cleanable).
+  try { nodeFs.unlinkSync(from); } catch (_u) { /* tmp source leak — operator-cleanable */ }
 
-  // Step 4 — fsync directories so the rename is durable.
+  // Step 4 — fsync directories so the install is durable.
   atomicFile.fsyncDir(toDir);
   if (backupDir !== toDir) atomicFile.fsyncDir(backupDir);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.44",
+  "version": "0.15.46",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:bf9b0dcd-010c-4ef3-b922-fb94a9cb440b",
+  "serialNumber": "urn:uuid:305da097-2160-4fd5-b1ce-47f87e378030",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-28T12:15:14.692Z",
+    "timestamp": "2026-06-28T15:04:50.786Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.44",
+      "bom-ref": "@blamejs/core@0.15.46",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.44",
+      "version": "0.15.46",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.44",
+      "purl": "pkg:npm/%40blamejs/core@0.15.46",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.44",
+      "ref": "@blamejs/core@0.15.46",
       "dependsOn": []
     }
   ]