@blamejs/core 0.15.48 → 0.15.50

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.50 (2026-06-28) — **`b.mail.bimi` closes a VMC certificate authorization bypass, and the host/origin comparisons in `b.ssrfGuard`, `b.middleware.csrfProtect`, and `b.mail.dmarc` now canonicalize both sides so case, trailing-dot, and IDN differences cannot decide a security check.** Four security and correctness decisions compared a host, origin, or domain where one side was normalized and the other was not, so two values that denote the same host in different encodings reached different verdicts. The most serious was in b.mail.bimi.fetchAndVerifyMark: when a VMC/CMC certificate's URI Subject Alternative Name could not be parsed as a URL (for example, a host carrying userinfo), the matcher fell back to a raw substring search of the whole SAN string — so a CA-chained certificate whose real host was attacker-controlled but whose SAN contained the victim domain anywhere (in the userinfo or path) was accepted to vouch for that victim domain. The fallback is removed (an unparseable URI SAN now fails closed) and both the certificate host and the BIMI domain are canonicalized before comparison. b.ssrfGuard allow/deny lists compared the operator's entries verbatim against the URL parser's already-lowercased host, so a mixed-case or trailing-dot deny entry silently failed to block its host; both sides now canonicalize through canonicalizeHost. b.middleware.csrfProtect canonicalized the candidate Origin via the URL parser but built the same-origin baseline by raw concatenation of the Host header, refusing a legitimate same-origin request whose Host was mixed-case or carried an explicit default port; the baseline and allowedOrigins now go through the same canonicalizer. b.mail.dmarc strict alignment compared the From and SPF/DKIM authentication domains with only case-folding, failing an aligned message whose authentication domain carried a trailing dot or an IDN label; both are now canonicalized the same way the relaxed path already was. A new b.publicSuffix.canonicalDomain primitive provides the shared encoding-stable host form. **Added:** *b.publicSuffix.canonicalDomain — encoding-stable host form* — Returns the bare canonical host form of a domain (lowercase, single trailing dot stripped, IDN labels as their A-label/punycode form) for identity comparison, without walking the public-suffix list. Two values that denote the same host in different encodings return the same string; an invalid or hostile host returns the empty string and matches nothing. It is the shared building block for the DMARC-alignment and certificate SAN authorization comparisons above. **Fixed:** *CSRF Origin check no longer refuses a legitimate same-origin request* — b.middleware.csrfProtect canonicalized the incoming Origin/Referer through the URL parser but built the same-origin baseline by concatenating the raw Host header, and compared allowedOrigins verbatim. A legitimate same-origin POST whose Host header was mixed-case or carried an explicit default port (:80/:443) was refused as cross-origin. The baseline and each allowedOrigins entry now pass through the same origin canonicalizer as the candidate. · *DMARC strict alignment canonicalizes the compared domains* — b.mail.dmarc strict alignment (aspf=s / adkim=s) compared the From domain against the SPF/DKIM authentication domain with only case-folding, while the relaxed path already normalized via the public-suffix lookup. An aligned message whose authentication domain carried a trailing dot or an IDN label was wrongly failed. Both domains are now canonicalized identically before the strict comparison. **Security:** *BIMI VMC certificate SubjectAltName authorization bypass closed* — b.mail.bimi.fetchAndVerifyMark binds a verified mark certificate to the BIMI domain via its Subject Alternative Name. When a URI SAN could not be parsed as a URL (e.g. a host with userinfo, or a malformed/homograph URI), the matcher fell back to a raw substring search of the entire SAN string, so a CA-chained certificate whose actual host was attacker-controlled — but whose SAN contained the victim domain as a substring (in the userinfo or path) — was accepted to vouch for the victim domain. The substring fallback is removed: a URI SAN the URL parser refuses now fails closed, and both the certificate host and the BIMI domain are canonicalized (lowercase, trailing-dot strip, IDN A-label) before an exact host comparison. · *SSRF allow/deny lists now match the host case-insensitively* — b.ssrfGuard.createAllowlist compared each operator allow/deny entry verbatim against the URL parser's host, which is already lowercased. A mixed-case or trailing-dot denylist entry therefore failed to match its own host and did not block it. Both the host and each non-CIDR entry now canonicalize through canonicalizeHost before comparison, so a denylisted host is blocked regardless of the case or trailing-dot form the operator wrote.
+
+- v0.15.49 (2026-06-28) — **`b.crypto.httpSig` now canonicalizes `@query-param` names and values per RFC 9421 §2.2.8, so its HTTP Message Signatures interoperate with conformant peers.** b.crypto.httpSig built the signature base for a @query-param component from the raw on-wire query bytes — the name was matched with encodeURIComponent and the value was emitted verbatim, with no decode-then-reencode. RFC 9421 §2.2.8 requires both the name and the value to be canonicalized: parsed as application/x-www-form-urlencoded (so a '+' and a %20 both become a space, and hex case is normalized) and then re-encoded, with a space rendered as %20. Because the framework signed and verified with the same raw bytes, blamejs-to-blamejs round-trips still worked, but a signature covering a query parameter whose name or value required encoding (a space, a '+', mixed or lowercase percent-encoding) did not match the base a conformant peer constructs — and an emitted identifier could even carry a literal space that the verifier then could not parse. Sign now emits the canonical percent-encoded name and signs the canonical value, and both sign and verify resolve the value through the same canonicalizer; the framework's base now matches the RFC's own published §2.2.8 example vectors. The whole-query @query component (§2.2.7), which the RFC defines as the raw encoded query, is unchanged, and signatures over plain-ASCII parameter names and values are byte-identical to before. **Fixed:** *HTTP Message Signatures @query-param canonicalization (RFC 9421 §2.2.8)* — b.crypto.httpSig now canonicalizes a @query-param component's name and value per RFC 9421 §2.2.8 — decode as application/x-www-form-urlencoded then re-encode, so a '+'-encoded space becomes %20, a %20 and a '+' resolve identically, and percent-encoding hex case is normalized to uppercase. Previously the name was matched with encodeURIComponent and the value was emitted raw, so a signature covering a query parameter that required encoding did not match the signature base a conformant RFC 9421 peer builds, and an emitted ;name="..." identifier could carry a literal space the verifier could not parse. Sign emits the canonical name and signs the canonical value; verify resolves the value through the same canonicalizer and reproduces the received identifier per §2.5. The framework's signature base now matches the RFC's published §2.2.8 example vectors. The whole-query @query component (§2.2.7) stays the raw encoded query, and signatures over plain-ASCII parameters are byte-identical to before.
+
 - v0.15.48 (2026-06-28) — **`b.network.dns.tsig` now accepts a message it signed with a non-default Original ID, fixing a sign/verify digest mismatch that made the originalId option non-functional (RFC 8945).** b.network.dns.tsig.verify restores the Original ID carried in the TSIG RDATA into the DNS message header before computing the HMAC, so a signed message survives an on-wire ID rewrite by a forwarder. b.network.dns.tsig.sign digested the message's current header ID instead of the Original ID, so any message signed with the originalId option set to a value other than the message's header ID produced a MAC the framework's own verify rejected (BADSIG) — the advertised originalId option was effectively non-functional for any non-default value. sign() now digests the Original-ID form, matching verify(); when originalId equals the message's header ID (the default) the digest is byte-for-byte identical to before, so existing signatures and the reference vectors are unaffected. **Fixed:** *TSIG: a message signed with a non-default Original ID now verifies (RFC 8945)* — b.network.dns.tsig.verify restores the Original ID carried in the TSIG RDATA into the DNS message header before computing the HMAC, so a signed message survives an on-wire ID rewrite by a forwarder. b.network.dns.tsig.sign digested the message's current header ID instead of the Original ID, so any message signed with the originalId option set to a value other than the message's header ID produced a MAC the framework's own verify rejected (BADSIG). sign() now digests the Original-ID form, matching verify(); when originalId equals the message's header ID (the default) the digest is byte-for-byte identical to before, so existing signatures and the reference vectors are unaffected.
 
 - v0.15.47 (2026-06-28) — **`b.mail.arc.verify` now returns chainStatus=pass for a cryptographically valid ARC chain — three defects in the ARC-Message-Signature verification path that made every real chain fail are fixed.** ARC-Message-Signature (AMS) verification reuses the DKIM verifier against a synthetic message, and three independent defects in that seam caused b.mail.arc.verify to reject every cryptographically valid ARC chain — its own and those from upstream relays. First, the AMS i= tag is an RFC 8617 instance number (1..50), not a DKIM Agent/User Identifier, but it was run through the RFC 6376 §3.5 AUID-must-be-a-subdomain-of-d= check, which permerrored every chain. Second, the synthetic renames the AMS header to DKIM-Signature so the DKIM verifier can find it, but the signature header was then canonicalized under that renamed field name instead of ARC-Message-Signature, so the b= signature never matched what the relay signed. Third, when sealing hop i>=2 the signer canonicalized a prior hop's ARC-Authentication-Results into the AMS instead of the current hop's, so multi-hop chains failed verification past the first hop. All three are fixed: arc.verify now confirms valid single- and multi-hop chains as cv=pass. The RFC 6376 §3.5 AUID/d= binding check remains a non-opt-out default on the public b.mail.dkim.verify path — the ARC reuse signal that skips it is framework-internal and cannot be set through the public options. **Fixed:** *ARC chain verification now succeeds for valid chains (it previously failed every one)* — b.mail.arc.verify reused the DKIM verifier to check each ARC-Message-Signature, and three defects in that path made it reject all cryptographically valid ARC chains. (1) The AMS i= instance number (RFC 8617 §4.1.2) was treated as a DKIM AUID and rejected by the RFC 6376 §3.5 AUID/d= binding check (permerror). (2) The synthetic message renames the AMS header to DKIM-Signature so the verifier can locate it, but the signature header was canonicalized under the renamed name rather than ARC-Message-Signature, so the b= value could never match the relay's signature. (3) For hops at instance 2 and beyond, b.mail.arc.sign canonicalized a prior hop's ARC-Authentication-Results into the AMS rather than the current hop's, breaking verification past the first hop. arc.verify now returns chainStatus=pass for valid single- and multi-hop chains; the DKIM AUID check stays enforced on the public DKIM verify path.

package/lib/http-message-signature.js

@@ -152,6 +152,54 @@ function _resolveDerivedComponent(name, msg) {
   }
 }
 
+// The WHATWG application/x-www-form-urlencoded percent-encode set leaves ONLY
+// these (all ASCII) bytes UNescaped: ALPHA / DIGIT / "*" / "-" / "." / "_".
+// Note "~" (0x7E) IS encoded here (unlike RFC 3986 unreserved) and "*" (0x2A)
+// is NOT — which is why encodeURIComponent (survivor set differs by ! ' ( ) *
+// ~) cannot be reused. Membership is a single-char lookup in this set string.
+var _QP_SURVIVORS =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789*-._";
+
+// _canonQueryParamPart — RFC 9421 §2.2.8 canonicalization of a single
+// @query-param name or value. Two stages:
+//   (1) parse per WHATWG application/x-www-form-urlencoded PARSING (§5.1):
+//       "+" -> SP, "%XX" -> decoded byte. This collapses the "+"-for-space and
+//       "%20"-for-space wire forms to the same decoded byte, and normalizes
+//       hex case.
+//   (2) re-encode per byte over UTF-8 WITHOUT the form serializer's
+//       space-as-plus rule, so SP -> "%20" (NOT "+"). RFC 9421 §2.2.8's own
+//       worked example is the governing interop vector: a wire value
+//       "with+plus+whitespace" canonicalizes to "with%20plus%20whitespace".
+//       The form serializer (URLSearchParams.toString) emits "+" and is
+//       deliberately not used for output; encodeURIComponent has the wrong
+//       survivor set. Every non-survivor byte is percent-encoded UPPERCASE.
+// Malformed input degrades to the raw token rather than throwing mid-base
+// build (defensive request-shape reader — return default, don't throw).
+function _canonQueryParamPart(rawToken) {
+  var decoded;
+  try {
+    // Parse the token as a single form value. The form parser splits pairs on
+    // "&" only (the first "=" is consumed by the "k=" prefix), so a literal "&"
+    // in a caller-supplied decoded name (e.g. "a&b") must be escaped first or
+    // it would split the token and silently drop everything after it. A "%26"
+    // already present (an encoded "&") is left as-is and decodes normally.
+    decoded = new URLSearchParams("k=" + rawToken.replace(/&/g, "%26")).get("k");
+    if (decoded === null) decoded = "";
+  } catch (_e) {
+    return rawToken;
+  }
+  var bytes = Buffer.from(decoded, "utf8");
+  var out = "";
+  for (var i = 0; i < bytes.length; i++) {
+    var b = bytes[i];
+    var ch = String.fromCharCode(b);
+    out += _QP_SURVIVORS.indexOf(ch) !== -1
+      ? ch
+      : "%" + b.toString(16).toUpperCase().padStart(2, "0");
+  }
+  return out;
+}
+
 // _resolveQueryParam — RFC 9421 §2.2.8 — covered identifier of the
 // shape `"@query-param";name="k"` (the name parameter selects which
 // query-string parameter participates in the signature base).
@@ -162,21 +210,46 @@ function _resolveQueryParam(msg, paramName) {
       "httpSig: @query-param;name=" + JSON.stringify(paramName) + " but URL has no query");
   }
   var pairs = search.split("&");
-  // RFC 9421 §2.2.8 — names compare without percent-decoding (server
-  // and signer must agree on the literal bytes). The framework follows
-  // the spec strictly: literal compare on encoded names.
-  var encName = encodeURIComponent(paramName);
+  // RFC 9421 §2.2.8 — canonicalize BOTH the requested name and each wire name
+  // token (decode then re-encode) and compare canonical forms, so "+"/"%20"/
+  // hex-case/"*"-vs-"%2A" wire variations all match; return the canonicalized
+  // value (§2.2.8 step 2).
+  var wantName = _canonQueryParamPart(paramName);
   for (var i = 0; i < pairs.length; i++) {
     var eq = pairs[i].indexOf("=");
     var rawName = eq === -1 ? pairs[i] : pairs[i].slice(0, eq);
-    if (rawName === encName || rawName === paramName) {
-      return eq === -1 ? "" : pairs[i].slice(eq + 1);
+    if (_canonQueryParamPart(rawName) === wantName) {
+      return _canonQueryParamPart(eq === -1 ? "" : pairs[i].slice(eq + 1));
     }
   }
   throw _err("MISSING_QUERY_PARAM",
     "httpSig: @query-param;name=" + JSON.stringify(paramName) + " not present in URL");
 }
 
+// _canonicalizeQueryParamIdentifiers — rewrite each covered identifier of the
+// shape `@query-param;name="X"` so the name is the canonical RFC 9421 §2.2.8
+// form. Applied once at sign() intake so the SAME canonical name appears in
+// both the signed base (component line + @signature-params terminator) and the
+// emitted Signature-Input header. Other components and other params (e.g. ;req)
+// pass through verbatim. The verifier does NOT re-canonicalize the identifier —
+// it reproduces Signature-Input byte-for-byte per §2.5 — but the shared
+// _resolveQueryParam canonicalizes the value on both sides.
+// Match the `;name="<sf-string body>"` parameter within a covered identifier.
+// The body is a tempered quoted-string run ([^"\\] | \\.) so an escaped quote
+// inside the name does not end it; linear, no backtracking. Only the name
+// parameter is rewritten — any other params (e.g. ;req) are left untouched.
+var _QP_NAME_PARAM_RE = /;name="((?:[^"\\]|\\.)*)"/;
+
+function _canonicalizeQueryParamIdentifiers(covered) {
+  return covered.map(function (raw) {
+    if (raw.indexOf("@query-param;") !== 0) return raw;
+    return raw.replace(_QP_NAME_PARAM_RE, function (_m, body) {
+      var nameVal = structuredFields.unescapeSfStringBody(body);
+      return ";name=" + _sfQuotedString(_canonQueryParamPart(nameVal));
+    });
+  });
+}
+
 // _resolveHeader — case-insensitive header lookup. RFC 9421 §2.1
 // requires obs-fold normalization (concat multi-values with ", ").
 function _resolveHeader(headers, name) {
@@ -331,7 +404,11 @@ function sign(msg, opts) {
     m.headers = Object.assign({}, m.headers, { "content-digest": digest });
   }
 
-  var base = _buildSignatureBase(opts.covered, params, m);
+  // Canonicalize @query-param identifier names (RFC 9421 §2.2.8) once, so the
+  // identical canonical name appears in BOTH the signed base and the emitted
+  // Signature-Input header below.
+  var covered = _canonicalizeQueryParamIdentifiers(opts.covered);
+  var base = _buildSignatureBase(covered, params, m);
   var sig;
   try {
     sig = nodeCrypto.sign(null, base, opts.privateKey);
@@ -340,7 +417,7 @@ function sign(msg, opts) {
   }
   var sigB64 = sig.toString("base64");
 
-  emittedHeaders["Signature-Input"] = label + "=" + _serializeCovered(opts.covered) +
+  emittedHeaders["Signature-Input"] = label + "=" + _serializeCovered(covered) +
                                       _serializeSigParams(params);
   emittedHeaders["Signature"] = label + "=:" + sigB64 + ":";
 

package/lib/mail-auth.js

@@ -1177,8 +1177,13 @@ function _parseDmarcRecord(text) {
 
 function _alignmentCheck(fromDomain, authDomain, mode) {
   if (!fromDomain || !authDomain) return false;
-  var f = fromDomain.toLowerCase();
-  var a = authDomain.toLowerCase();
+  // Canonicalize both domains identically (lowercase + trailing-dot strip + IDN
+  // A-label) so strict alignment compares the same host form the relaxed PSL
+  // path already normalizes — a trailing-dot / U-label SPF auth-domain must not
+  // fail an otherwise-aligned message.
+  var f = publicSuffix.canonicalDomain(fromDomain);
+  var a = publicSuffix.canonicalDomain(authDomain);
+  if (!f || !a) return false;
   if (mode === "s") return f === a;                                              // strict
   // RFC 7489 §3.1.1 + DMARCbis §4.4 — relaxed alignment compares the
   // organizational domain (the public-suffix-tail registered name).

package/lib/mail-bimi.js

@@ -60,6 +60,7 @@ var markupTokenizer = require("./markup-tokenizer");
 var x509Chain = require("./x509-chain");
 var structuredFields = require("./structured-fields");
 var safeUrl = require("./safe-url");
+var publicSuffix = require("./public-suffix");
 var validateOpts = require("./validate-opts");
 var { defineClass, MailBimiError } = require("./framework-error");
 
@@ -866,25 +867,37 @@ function _verifyCertChain(leaf, intermediates, anchors) {
 // is a comma-separated string like "URI:https://example.com, DNS:example.com";
 // accept either a URI:* matching the domain's hostname OR a DNS:*
 // exact match (compat - some VMC profiles emit DNS instead of URI).
+// _canonBimiHost — canonical host form for the SAN-vs-domain authorization
+// compare, via the one delimiter-safe canonicalizer (lowercase + trailing-dot
+// strip + IDN A-label, and crucially rejecting "/" "?" "#" which domainToASCII
+// truncates at — so a SAN like "victim.example/evil" can't masquerade as
+// "victim.example"). Returns "" for any non-host value, which then matches
+// nothing (fail closed).
+function _canonBimiHost(host) {
+  return publicSuffix.canonicalDomain(host == null ? "" : host);
+}
+
 function _subjectAltNameMatchesDomain(cert, domain) {
   var raw = cert.subjectAltName || "";
   var parts = raw.split(",").map(function (s) { return s.trim(); }).filter(Boolean);
   var found = parts.slice();
-  var dom = domain.toLowerCase();
+  var dom = _canonBimiHost(domain);
+  if (dom.length === 0) return { ok: false, found: found };
   for (var i = 0; i < parts.length; i += 1) {
     var p = parts[i];
     var lp = p.toLowerCase();
     if (lp.indexOf("dns:") === 0) {
-      var dns2 = lp.slice(4);
-      if (dns2 === dom) return { ok: true, found: found };
-    }
-    if (lp.indexOf("uri:") === 0) {
-      var uri = p.slice(4);
+      if (_canonBimiHost(p.slice(4)) === dom) return { ok: true, found: found };
+    } else if (lp.indexOf("uri:") === 0) {
       try {
-        var u = safeUrl.parse(uri, { allowedProtocols: ["https:", "http:"] });
-        if ((u.hostname || "").toLowerCase() === dom) return { ok: true, found: found };
+        var u = safeUrl.parse(p.slice(4), { allowedProtocols: ["https:", "http:"] });
+        if (_canonBimiHost(u.hostname) === dom) return { ok: true, found: found };
       } catch (_e) {
-        if (lp.indexOf(dom) !== -1) return { ok: true, found: found };
+        // A URI SAN the URL parser refuses (userinfo / malformed / homograph)
+        // is not a usable host binding — FAIL CLOSED. No substring fallback:
+        // the old `lp.indexOf(dom) !== -1` matched the domain anywhere in the
+        // raw SAN string (userinfo / path), so a CA-chained cert whose real
+        // host differed could vouch for an arbitrary victim domain.
       }
     }
   }

package/lib/mail.js

@@ -143,6 +143,14 @@ function _isAscii(s) {
  */
 function toAscii(domain) {
   if (typeof domain !== "string" || domain.length === 0) return null;
+  // domainToASCII silently TRUNCATES at a URL delimiter ("a.com/evil" -> "a.com"),
+  // so a string carrying one is not a bare host — return null rather than a
+  // misleading prefix. (":" / "@" / "[" / "]" already yield "", but reject them
+  // here too so every non-host character fails the same way.)
+  if (domain.indexOf("/") !== -1 || domain.indexOf("?") !== -1 ||
+      domain.indexOf("#") !== -1 || domain.indexOf("\\") !== -1 ||
+      domain.indexOf(":") !== -1 || domain.indexOf("@") !== -1 ||
+      domain.indexOf("[") !== -1 || domain.indexOf("]") !== -1) return null;
   var ascii;
   try { ascii = nodeUrl.domainToASCII(domain); }
   catch (_e) { return null; }
@@ -524,6 +532,7 @@ function _validateMessage(message) {
           var detected = fileType().detect(att.content);
           if (detected && detected.mime &&
               detected.mime.split("/")[0] !==
+              // allow:bare-split-on-quoted-header-token-grammar — split(";")[0] takes the Content-Type type/subtype, which precedes every parameter (RFC 9110 §8.3); a quoted ";" can only appear inside a later parameter value and so cannot affect [0].
               att.contentType.split(";")[0].trim().toLowerCase().split("/")[0]) {
             throw new MailError("mail/invalid-attachment",
               "attachments[" + i + "].contentType '" + att.contentType +

package/lib/middleware/csrf-protect.js

@@ -189,9 +189,6 @@ function _checkOriginAllowed(req, allowedOrigins, isHttpsFn, requireOrigin) {
     return null;
   }
 
-  var requestOrigin = (isHttpsFn && isHttpsFn(req) ? "https://" : "http://") +
-                      (headers.host || "");
-
   function _originOf(rawUrl) {
     try {
       var u = new URL(rawUrl);                                                   // allow:raw-new-url-parse-only — origin-shape inspection (NOT outbound). Intentionally tolerates file:// / data: which safeUrl.parse refuses.
@@ -199,12 +196,20 @@ function _checkOriginAllowed(req, allowedOrigins, isHttpsFn, requireOrigin) {
     } catch (_e) { return null; }
   }
 
+  // Canonicalize the same-origin baseline through the SAME _originOf the
+  // candidate Origin/Referer go through (lowercases the host, strips the
+  // default port), or a mixed-case / default-port Host header would not match
+  // an equivalent Origin and a legitimate same-origin request would be refused.
+  var requestOrigin = _originOf((isHttpsFn && isHttpsFn(req) ? "https://" : "http://") +
+                                (headers.host || ""));
+
   function _isAllowed(candidateOrigin) {
     if (!candidateOrigin) return false;
-    if (candidateOrigin === requestOrigin) return true;
+    if (requestOrigin !== null && candidateOrigin === requestOrigin) return true;
     if (Array.isArray(allowedOrigins)) {
       for (var i = 0; i < allowedOrigins.length; i += 1) {
-        if (candidateOrigin === allowedOrigins[i]) return true;
+        // Canonicalize each operator allowedOrigins entry the same way.
+        if (candidateOrigin === _originOf(allowedOrigins[i])) return true;
       }
     }
     return false;

package/lib/public-suffix.js

@@ -97,14 +97,19 @@ function _normalizeInput(domain) {
         "publicSuffix: domain must not be a bare dot");
     }
   }
-  // Reject control / null / whitespace bytes outright. domainToASCII
-  // would silently rewrite some of them; we want hostile inputs to
-  // throw, not be coerced.
+  // Reject control / null / whitespace bytes AND the URL-structural delimiters
+  // domainToASCII silently TRUNCATES at — "/" (0x2F), "?" (0x3F), "#" (0x23),
+  // "\" (0x5C) reduce "example.com/evil" to "example.com" rather than failing,
+  // which would let a hostile host masquerade as a trusted prefix. ":" / "@" /
+  // "[" / "]" already make domainToASCII return "" (caught below), but reject
+  // them here too so every non-host character fails closed, not silently.
   for (var i = 0; i < s.length; i += 1) {
     var cp = s.charCodeAt(i);
-    if (cp < 0x21 || cp === 0x7f) {
+    if (cp < 0x21 || cp === 0x7f ||
+        cp === 0x2f || cp === 0x3f || cp === 0x23 || cp === 0x5c ||   // / ? # \
+        cp === 0x3a || cp === 0x40 || cp === 0x5b || cp === 0x5d) {   // : @ [ ]
       throw _err("public-suffix/invalid-domain",
-        "publicSuffix: domain contains control / whitespace byte");
+        "publicSuffix: domain contains a control byte or URL delimiter");
     }
   }
   // IDN-normalize — non-ASCII labels become xn--… via Node's UTS #46
@@ -395,9 +400,42 @@ function lookupSource() {
   return _sourceMeta;
 }
 
+/**
+ * @primitive b.publicSuffix.canonicalDomain
+ * @signature b.publicSuffix.canonicalDomain(domain)
+ * @since     0.15.50
+ * @status    stable
+ * @related   b.publicSuffix.organizationalDomain, b.publicSuffix.publicSuffix
+ *
+ * Returns the bare canonical host form of `domain` for identity
+ * comparison: lowercase, a single trailing dot stripped, and IDN
+ * labels normalized to their A-label (punycode) form. Unlike
+ * `organizationalDomain` it does NOT walk the public-suffix list — it
+ * returns the input host itself in canonical form.
+ *
+ * Two values that denote the same host in different encodings (case,
+ * trailing dot, U-label vs A-label) return the SAME string, so an
+ * equality compare is encoding-stable — the building block for DMARC
+ * alignment and certificate SAN-vs-domain authorization checks, where
+ * one side normalizing differently from the other is a bypass.
+ *
+ * Non-throwing: returns `""` for any input that is not a valid host
+ * (control bytes, empty labels, over the 253-octet limit), so a
+ * hostile or garbage value canonicalizes to `""` and matches nothing.
+ *
+ * @example
+ *   var b = require("@blamejs/core");
+ *   b.publicSuffix.canonicalDomain("Example.COM.");   // → "example.com"
+ *   b.publicSuffix.canonicalDomain("a..b");             // → ""
+ */
+function canonicalDomain(domain) {
+  try { return _normalizeInput(domain); } catch (_e) { return ""; }
+}
+
 module.exports = {
   publicSuffix:         publicSuffix,
   organizationalDomain: organizationalDomain,
+  canonicalDomain:      canonicalDomain,
   isPublicSuffix:       isPublicSuffix,
   lookupSource:         lookupSource,
 };

package/lib/ssrf-guard.js

@@ -743,11 +743,17 @@ function createAllowlist(opts) {
       "ssrf-guard/empty-allowlist", {});
   }
   function _matches(list, hostOrIp) {
+    // Canonicalize BOTH the URL host and each non-CIDR operator entry before
+    // comparing: the URL parser already lowercases the host (and strips a
+    // trailing dot), so a mixed-case or trailing-dot operator entry compared
+    // raw silently failed to match — letting a denylisted host through.
+    var canonHost = canonicalizeHost(hostOrIp);
     for (var i = 0; i < list.length; i++) {
       var entry = list[i];
-      if (entry === hostOrIp) return true;
       if (entry.indexOf("/") !== -1) {
         try { if (cidrContains(entry, hostOrIp)) return true; } catch (_e) { /* ignore */ }
+      } else if (canonicalizeHost(entry) === canonHost) {
+        return true;
       }
     }
     return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.48",
+  "version": "0.15.50",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:90ecb6b7-5585-460c-8b63-abf23c45b39f",
+  "serialNumber": "urn:uuid:74c051d6-47fc-4a6b-a557-b70f7fd7afdf",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-28T21:46:48.435Z",
+    "timestamp": "2026-06-29T02:26:06.809Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.48",
+      "bom-ref": "@blamejs/core@0.15.50",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.48",
+      "version": "0.15.50",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.48",
+      "purl": "pkg:npm/%40blamejs/core@0.15.50",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.48",
+      "ref": "@blamejs/core@0.15.50",
       "dependsOn": []
     }
   ]