@blamejs/core 0.15.47 → 0.15.49

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.49 (2026-06-28) — **`b.crypto.httpSig` now canonicalizes `@query-param` names and values per RFC 9421 §2.2.8, so its HTTP Message Signatures interoperate with conformant peers.** b.crypto.httpSig built the signature base for a @query-param component from the raw on-wire query bytes — the name was matched with encodeURIComponent and the value was emitted verbatim, with no decode-then-reencode. RFC 9421 §2.2.8 requires both the name and the value to be canonicalized: parsed as application/x-www-form-urlencoded (so a '+' and a %20 both become a space, and hex case is normalized) and then re-encoded, with a space rendered as %20. Because the framework signed and verified with the same raw bytes, blamejs-to-blamejs round-trips still worked, but a signature covering a query parameter whose name or value required encoding (a space, a '+', mixed or lowercase percent-encoding) did not match the base a conformant peer constructs — and an emitted identifier could even carry a literal space that the verifier then could not parse. Sign now emits the canonical percent-encoded name and signs the canonical value, and both sign and verify resolve the value through the same canonicalizer; the framework's base now matches the RFC's own published §2.2.8 example vectors. The whole-query @query component (§2.2.7), which the RFC defines as the raw encoded query, is unchanged, and signatures over plain-ASCII parameter names and values are byte-identical to before. **Fixed:** *HTTP Message Signatures @query-param canonicalization (RFC 9421 §2.2.8)* — b.crypto.httpSig now canonicalizes a @query-param component's name and value per RFC 9421 §2.2.8 — decode as application/x-www-form-urlencoded then re-encode, so a '+'-encoded space becomes %20, a %20 and a '+' resolve identically, and percent-encoding hex case is normalized to uppercase. Previously the name was matched with encodeURIComponent and the value was emitted raw, so a signature covering a query parameter that required encoding did not match the signature base a conformant RFC 9421 peer builds, and an emitted ;name="..." identifier could carry a literal space the verifier could not parse. Sign emits the canonical name and signs the canonical value; verify resolves the value through the same canonicalizer and reproduces the received identifier per §2.5. The framework's signature base now matches the RFC's published §2.2.8 example vectors. The whole-query @query component (§2.2.7) stays the raw encoded query, and signatures over plain-ASCII parameters are byte-identical to before.
+
+- v0.15.48 (2026-06-28) — **`b.network.dns.tsig` now accepts a message it signed with a non-default Original ID, fixing a sign/verify digest mismatch that made the originalId option non-functional (RFC 8945).** b.network.dns.tsig.verify restores the Original ID carried in the TSIG RDATA into the DNS message header before computing the HMAC, so a signed message survives an on-wire ID rewrite by a forwarder. b.network.dns.tsig.sign digested the message's current header ID instead of the Original ID, so any message signed with the originalId option set to a value other than the message's header ID produced a MAC the framework's own verify rejected (BADSIG) — the advertised originalId option was effectively non-functional for any non-default value. sign() now digests the Original-ID form, matching verify(); when originalId equals the message's header ID (the default) the digest is byte-for-byte identical to before, so existing signatures and the reference vectors are unaffected. **Fixed:** *TSIG: a message signed with a non-default Original ID now verifies (RFC 8945)* — b.network.dns.tsig.verify restores the Original ID carried in the TSIG RDATA into the DNS message header before computing the HMAC, so a signed message survives an on-wire ID rewrite by a forwarder. b.network.dns.tsig.sign digested the message's current header ID instead of the Original ID, so any message signed with the originalId option set to a value other than the message's header ID produced a MAC the framework's own verify rejected (BADSIG). sign() now digests the Original-ID form, matching verify(); when originalId equals the message's header ID (the default) the digest is byte-for-byte identical to before, so existing signatures and the reference vectors are unaffected.
+
 - v0.15.47 (2026-06-28) — **`b.mail.arc.verify` now returns chainStatus=pass for a cryptographically valid ARC chain — three defects in the ARC-Message-Signature verification path that made every real chain fail are fixed.** ARC-Message-Signature (AMS) verification reuses the DKIM verifier against a synthetic message, and three independent defects in that seam caused b.mail.arc.verify to reject every cryptographically valid ARC chain — its own and those from upstream relays. First, the AMS i= tag is an RFC 8617 instance number (1..50), not a DKIM Agent/User Identifier, but it was run through the RFC 6376 §3.5 AUID-must-be-a-subdomain-of-d= check, which permerrored every chain. Second, the synthetic renames the AMS header to DKIM-Signature so the DKIM verifier can find it, but the signature header was then canonicalized under that renamed field name instead of ARC-Message-Signature, so the b= signature never matched what the relay signed. Third, when sealing hop i>=2 the signer canonicalized a prior hop's ARC-Authentication-Results into the AMS instead of the current hop's, so multi-hop chains failed verification past the first hop. All three are fixed: arc.verify now confirms valid single- and multi-hop chains as cv=pass. The RFC 6376 §3.5 AUID/d= binding check remains a non-opt-out default on the public b.mail.dkim.verify path — the ARC reuse signal that skips it is framework-internal and cannot be set through the public options. **Fixed:** *ARC chain verification now succeeds for valid chains (it previously failed every one)* — b.mail.arc.verify reused the DKIM verifier to check each ARC-Message-Signature, and three defects in that path made it reject all cryptographically valid ARC chains. (1) The AMS i= instance number (RFC 8617 §4.1.2) was treated as a DKIM AUID and rejected by the RFC 6376 §3.5 AUID/d= binding check (permerror). (2) The synthetic message renames the AMS header to DKIM-Signature so the verifier can locate it, but the signature header was canonicalized under the renamed name rather than ARC-Message-Signature, so the b= value could never match the relay's signature. (3) For hops at instance 2 and beyond, b.mail.arc.sign canonicalized a prior hop's ARC-Authentication-Results into the AMS rather than the current hop's, breaking verification past the first hop. arc.verify now returns chainStatus=pass for valid single- and multi-hop chains; the DKIM AUID check stays enforced on the public DKIM verify path.
 
 - v0.15.46 (2026-06-28) — **`b.auth.fidoMds3` now enforces basicConstraints cA:TRUE on every intermediate link of the MDS3 x5c chain, closing a bypass where a non-CA certificate spliced in as an intermediate could sign a forged FIDO metadata BLOB that fido-mds3 accepted.** fido-mds3's x5c chain validation checked each intermediate link with X509Certificate.checkIssued(), which validates the issuer/subject linkage and signature but does NOT enforce the basicConstraints CA bit; only the final tail-to-root anchor used the framework's cA-enforcing helper. An attacker holding a non-CA (cA:FALSE) end-entity certificate that legitimately chains to a trusted MDS3 root (and its private key) could splice it in as an intermediate, sign a forged leaf with it, and have fido-mds3 accept an attacker-authored MDS3 metadata BLOB as authentic — the classic basicConstraints bypass (CVE-2002-0862 class). Every intermediate link now routes through x509Chain.issuerValidlyIssued, which enforces basicConstraints cA:TRUE in addition to the issuance and signature linkage, matching the mdoc / tsa / bimi / content-credentials / S-MIME chain walkers. A codebase guard now fails the build if any chain walker uses a bare issuance checkIssued() instead. **Security:** *fido-mds3 x5c intermediate links enforce the CA bit (basicConstraints bypass closed)* — b.auth.fidoMds3 validated each intermediate x5c link with X509Certificate.checkIssued(), which does not enforce basicConstraints cA:TRUE, so a non-CA certificate inserted as an intermediate was accepted as an issuer. An attacker with a cA:FALSE end-entity cert chaining to a trusted MDS3 root could sign a forged leaf and have a forged FIDO metadata BLOB accepted as authentic (CVE-2002-0862 class). Each intermediate link now routes through x509Chain.issuerValidlyIssued (cA:TRUE + issuance + signature), the same hardened test the framework's other certificate-chain walkers already use. The default GlobalSign MDS3 root and operator-supplied caCertificate roots are both covered. **Detectors:** *Build guard: a cert-chain issuance link must use issuerValidlyIssued, not bare checkIssued* — A codebase guard now fails the build if a certificate-chain walker validates an issuance link with a bare X509Certificate.checkIssued() (which omits the basicConstraints CA check) instead of x509Chain.issuerValidlyIssued, so the basicConstraints bypass cannot reappear at a new walker. A self-signed-root check (cert.checkIssued(cert)) is not an issuance link and is unaffected.

package/lib/http-message-signature.js

@@ -152,6 +152,54 @@ function _resolveDerivedComponent(name, msg) {
   }
 }
 
+// The WHATWG application/x-www-form-urlencoded percent-encode set leaves ONLY
+// these (all ASCII) bytes UNescaped: ALPHA / DIGIT / "*" / "-" / "." / "_".
+// Note "~" (0x7E) IS encoded here (unlike RFC 3986 unreserved) and "*" (0x2A)
+// is NOT — which is why encodeURIComponent (survivor set differs by ! ' ( ) *
+// ~) cannot be reused. Membership is a single-char lookup in this set string.
+var _QP_SURVIVORS =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789*-._";
+
+// _canonQueryParamPart — RFC 9421 §2.2.8 canonicalization of a single
+// @query-param name or value. Two stages:
+//   (1) parse per WHATWG application/x-www-form-urlencoded PARSING (§5.1):
+//       "+" -> SP, "%XX" -> decoded byte. This collapses the "+"-for-space and
+//       "%20"-for-space wire forms to the same decoded byte, and normalizes
+//       hex case.
+//   (2) re-encode per byte over UTF-8 WITHOUT the form serializer's
+//       space-as-plus rule, so SP -> "%20" (NOT "+"). RFC 9421 §2.2.8's own
+//       worked example is the governing interop vector: a wire value
+//       "with+plus+whitespace" canonicalizes to "with%20plus%20whitespace".
+//       The form serializer (URLSearchParams.toString) emits "+" and is
+//       deliberately not used for output; encodeURIComponent has the wrong
+//       survivor set. Every non-survivor byte is percent-encoded UPPERCASE.
+// Malformed input degrades to the raw token rather than throwing mid-base
+// build (defensive request-shape reader — return default, don't throw).
+function _canonQueryParamPart(rawToken) {
+  var decoded;
+  try {
+    // Parse the token as a single form value. The form parser splits pairs on
+    // "&" only (the first "=" is consumed by the "k=" prefix), so a literal "&"
+    // in a caller-supplied decoded name (e.g. "a&b") must be escaped first or
+    // it would split the token and silently drop everything after it. A "%26"
+    // already present (an encoded "&") is left as-is and decodes normally.
+    decoded = new URLSearchParams("k=" + rawToken.replace(/&/g, "%26")).get("k");
+    if (decoded === null) decoded = "";
+  } catch (_e) {
+    return rawToken;
+  }
+  var bytes = Buffer.from(decoded, "utf8");
+  var out = "";
+  for (var i = 0; i < bytes.length; i++) {
+    var b = bytes[i];
+    var ch = String.fromCharCode(b);
+    out += _QP_SURVIVORS.indexOf(ch) !== -1
+      ? ch
+      : "%" + b.toString(16).toUpperCase().padStart(2, "0");
+  }
+  return out;
+}
+
 // _resolveQueryParam — RFC 9421 §2.2.8 — covered identifier of the
 // shape `"@query-param";name="k"` (the name parameter selects which
 // query-string parameter participates in the signature base).
@@ -162,21 +210,46 @@ function _resolveQueryParam(msg, paramName) {
       "httpSig: @query-param;name=" + JSON.stringify(paramName) + " but URL has no query");
   }
   var pairs = search.split("&");
-  // RFC 9421 §2.2.8 — names compare without percent-decoding (server
-  // and signer must agree on the literal bytes). The framework follows
-  // the spec strictly: literal compare on encoded names.
-  var encName = encodeURIComponent(paramName);
+  // RFC 9421 §2.2.8 — canonicalize BOTH the requested name and each wire name
+  // token (decode then re-encode) and compare canonical forms, so "+"/"%20"/
+  // hex-case/"*"-vs-"%2A" wire variations all match; return the canonicalized
+  // value (§2.2.8 step 2).
+  var wantName = _canonQueryParamPart(paramName);
   for (var i = 0; i < pairs.length; i++) {
     var eq = pairs[i].indexOf("=");
     var rawName = eq === -1 ? pairs[i] : pairs[i].slice(0, eq);
-    if (rawName === encName || rawName === paramName) {
-      return eq === -1 ? "" : pairs[i].slice(eq + 1);
+    if (_canonQueryParamPart(rawName) === wantName) {
+      return _canonQueryParamPart(eq === -1 ? "" : pairs[i].slice(eq + 1));
     }
   }
   throw _err("MISSING_QUERY_PARAM",
     "httpSig: @query-param;name=" + JSON.stringify(paramName) + " not present in URL");
 }
 
+// _canonicalizeQueryParamIdentifiers — rewrite each covered identifier of the
+// shape `@query-param;name="X"` so the name is the canonical RFC 9421 §2.2.8
+// form. Applied once at sign() intake so the SAME canonical name appears in
+// both the signed base (component line + @signature-params terminator) and the
+// emitted Signature-Input header. Other components and other params (e.g. ;req)
+// pass through verbatim. The verifier does NOT re-canonicalize the identifier —
+// it reproduces Signature-Input byte-for-byte per §2.5 — but the shared
+// _resolveQueryParam canonicalizes the value on both sides.
+// Match the `;name="<sf-string body>"` parameter within a covered identifier.
+// The body is a tempered quoted-string run ([^"\\] | \\.) so an escaped quote
+// inside the name does not end it; linear, no backtracking. Only the name
+// parameter is rewritten — any other params (e.g. ;req) are left untouched.
+var _QP_NAME_PARAM_RE = /;name="((?:[^"\\]|\\.)*)"/;
+
+function _canonicalizeQueryParamIdentifiers(covered) {
+  return covered.map(function (raw) {
+    if (raw.indexOf("@query-param;") !== 0) return raw;
+    return raw.replace(_QP_NAME_PARAM_RE, function (_m, body) {
+      var nameVal = structuredFields.unescapeSfStringBody(body);
+      return ";name=" + _sfQuotedString(_canonQueryParamPart(nameVal));
+    });
+  });
+}
+
 // _resolveHeader — case-insensitive header lookup. RFC 9421 §2.1
 // requires obs-fold normalization (concat multi-values with ", ").
 function _resolveHeader(headers, name) {
@@ -331,7 +404,11 @@ function sign(msg, opts) {
     m.headers = Object.assign({}, m.headers, { "content-digest": digest });
   }
 
-  var base = _buildSignatureBase(opts.covered, params, m);
+  // Canonicalize @query-param identifier names (RFC 9421 §2.2.8) once, so the
+  // identical canonical name appears in BOTH the signed base and the emitted
+  // Signature-Input header below.
+  var covered = _canonicalizeQueryParamIdentifiers(opts.covered);
+  var base = _buildSignatureBase(covered, params, m);
   var sig;
   try {
     sig = nodeCrypto.sign(null, base, opts.privateKey);
@@ -340,7 +417,7 @@ function sign(msg, opts) {
   }
   var sigB64 = sig.toString("base64");
 
-  emittedHeaders["Signature-Input"] = label + "=" + _serializeCovered(opts.covered) +
+  emittedHeaders["Signature-Input"] = label + "=" + _serializeCovered(covered) +
                                       _serializeSigParams(params);
   emittedHeaders["Signature"] = label + "=:" + sigB64 + ":";
 

package/lib/network-tsig.js

@@ -232,9 +232,19 @@ function sign(message, opts) {
   var originalId = opts.originalId == null ? message.readUInt16BE(0) : opts.originalId;
   var algName = alg.name + ".";
 
+  // RFC 8945 §5.3.1/§5.3.2 — the canonical digest is over the message with the
+  // header ID set to the Original ID (verify() restores it before digesting,
+  // line ~363, so a forwarder may rewrite the on-wire ID). Digest the same
+  // Original-ID form here; when originalId == the message's current ID (the
+  // default) this is byte-identical to digesting `message` as-is.
+  var digestMessage = message;
+  if (originalId !== message.readUInt16BE(0)) {
+    digestMessage = Buffer.from(message);
+    digestMessage.writeUInt16BE(originalId, 0);
+  }
   var digest = Buffer.concat([
     _requestMacPrefix(opts.requestMac),
-    message,
+    digestMessage,
     _tsigVariables(opts.keyName, algName, time, fudge, error, otherData),
   ]);
   var mac = nodeCrypto.createHmac(alg.hash, secret).update(digest).digest();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.47",
+  "version": "0.15.49",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ec7300cc-c168-429f-b21e-63e86d219959",
+  "serialNumber": "urn:uuid:6cc185bb-1bd0-499d-9ebe-d97e6e5d7471",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-28T16:59:30.326Z",
+    "timestamp": "2026-06-28T23:40:14.484Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.47",
+      "bom-ref": "@blamejs/core@0.15.49",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.47",
+      "version": "0.15.49",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.47",
+      "purl": "pkg:npm/%40blamejs/core@0.15.49",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.47",
+      "ref": "@blamejs/core@0.15.49",
       "dependsOn": []
     }
   ]