@blamejs/core 0.15.49 → 0.15.50

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.50 (2026-06-28) — **`b.mail.bimi` closes a VMC certificate authorization bypass, and the host/origin comparisons in `b.ssrfGuard`, `b.middleware.csrfProtect`, and `b.mail.dmarc` now canonicalize both sides so case, trailing-dot, and IDN differences cannot decide a security check.** Four security and correctness decisions compared a host, origin, or domain where one side was normalized and the other was not, so two values that denote the same host in different encodings reached different verdicts. The most serious was in b.mail.bimi.fetchAndVerifyMark: when a VMC/CMC certificate's URI Subject Alternative Name could not be parsed as a URL (for example, a host carrying userinfo), the matcher fell back to a raw substring search of the whole SAN string — so a CA-chained certificate whose real host was attacker-controlled but whose SAN contained the victim domain anywhere (in the userinfo or path) was accepted to vouch for that victim domain. The fallback is removed (an unparseable URI SAN now fails closed) and both the certificate host and the BIMI domain are canonicalized before comparison. b.ssrfGuard allow/deny lists compared the operator's entries verbatim against the URL parser's already-lowercased host, so a mixed-case or trailing-dot deny entry silently failed to block its host; both sides now canonicalize through canonicalizeHost. b.middleware.csrfProtect canonicalized the candidate Origin via the URL parser but built the same-origin baseline by raw concatenation of the Host header, refusing a legitimate same-origin request whose Host was mixed-case or carried an explicit default port; the baseline and allowedOrigins now go through the same canonicalizer. b.mail.dmarc strict alignment compared the From and SPF/DKIM authentication domains with only case-folding, failing an aligned message whose authentication domain carried a trailing dot or an IDN label; both are now canonicalized the same way the relaxed path already was. A new b.publicSuffix.canonicalDomain primitive provides the shared encoding-stable host form. **Added:** *b.publicSuffix.canonicalDomain — encoding-stable host form* — Returns the bare canonical host form of a domain (lowercase, single trailing dot stripped, IDN labels as their A-label/punycode form) for identity comparison, without walking the public-suffix list. Two values that denote the same host in different encodings return the same string; an invalid or hostile host returns the empty string and matches nothing. It is the shared building block for the DMARC-alignment and certificate SAN authorization comparisons above. **Fixed:** *CSRF Origin check no longer refuses a legitimate same-origin request* — b.middleware.csrfProtect canonicalized the incoming Origin/Referer through the URL parser but built the same-origin baseline by concatenating the raw Host header, and compared allowedOrigins verbatim. A legitimate same-origin POST whose Host header was mixed-case or carried an explicit default port (:80/:443) was refused as cross-origin. The baseline and each allowedOrigins entry now pass through the same origin canonicalizer as the candidate. · *DMARC strict alignment canonicalizes the compared domains* — b.mail.dmarc strict alignment (aspf=s / adkim=s) compared the From domain against the SPF/DKIM authentication domain with only case-folding, while the relaxed path already normalized via the public-suffix lookup. An aligned message whose authentication domain carried a trailing dot or an IDN label was wrongly failed. Both domains are now canonicalized identically before the strict comparison. **Security:** *BIMI VMC certificate SubjectAltName authorization bypass closed* — b.mail.bimi.fetchAndVerifyMark binds a verified mark certificate to the BIMI domain via its Subject Alternative Name. When a URI SAN could not be parsed as a URL (e.g. a host with userinfo, or a malformed/homograph URI), the matcher fell back to a raw substring search of the entire SAN string, so a CA-chained certificate whose actual host was attacker-controlled — but whose SAN contained the victim domain as a substring (in the userinfo or path) — was accepted to vouch for the victim domain. The substring fallback is removed: a URI SAN the URL parser refuses now fails closed, and both the certificate host and the BIMI domain are canonicalized (lowercase, trailing-dot strip, IDN A-label) before an exact host comparison. · *SSRF allow/deny lists now match the host case-insensitively* — b.ssrfGuard.createAllowlist compared each operator allow/deny entry verbatim against the URL parser's host, which is already lowercased. A mixed-case or trailing-dot denylist entry therefore failed to match its own host and did not block it. Both the host and each non-CIDR entry now canonicalize through canonicalizeHost before comparison, so a denylisted host is blocked regardless of the case or trailing-dot form the operator wrote.
+
 - v0.15.49 (2026-06-28) — **`b.crypto.httpSig` now canonicalizes `@query-param` names and values per RFC 9421 §2.2.8, so its HTTP Message Signatures interoperate with conformant peers.** b.crypto.httpSig built the signature base for a @query-param component from the raw on-wire query bytes — the name was matched with encodeURIComponent and the value was emitted verbatim, with no decode-then-reencode. RFC 9421 §2.2.8 requires both the name and the value to be canonicalized: parsed as application/x-www-form-urlencoded (so a '+' and a %20 both become a space, and hex case is normalized) and then re-encoded, with a space rendered as %20. Because the framework signed and verified with the same raw bytes, blamejs-to-blamejs round-trips still worked, but a signature covering a query parameter whose name or value required encoding (a space, a '+', mixed or lowercase percent-encoding) did not match the base a conformant peer constructs — and an emitted identifier could even carry a literal space that the verifier then could not parse. Sign now emits the canonical percent-encoded name and signs the canonical value, and both sign and verify resolve the value through the same canonicalizer; the framework's base now matches the RFC's own published §2.2.8 example vectors. The whole-query @query component (§2.2.7), which the RFC defines as the raw encoded query, is unchanged, and signatures over plain-ASCII parameter names and values are byte-identical to before. **Fixed:** *HTTP Message Signatures @query-param canonicalization (RFC 9421 §2.2.8)* — b.crypto.httpSig now canonicalizes a @query-param component's name and value per RFC 9421 §2.2.8 — decode as application/x-www-form-urlencoded then re-encode, so a '+'-encoded space becomes %20, a %20 and a '+' resolve identically, and percent-encoding hex case is normalized to uppercase. Previously the name was matched with encodeURIComponent and the value was emitted raw, so a signature covering a query parameter that required encoding did not match the signature base a conformant RFC 9421 peer builds, and an emitted ;name="..." identifier could carry a literal space the verifier could not parse. Sign emits the canonical name and signs the canonical value; verify resolves the value through the same canonicalizer and reproduces the received identifier per §2.5. The framework's signature base now matches the RFC's published §2.2.8 example vectors. The whole-query @query component (§2.2.7) stays the raw encoded query, and signatures over plain-ASCII parameters are byte-identical to before.
 
 - v0.15.48 (2026-06-28) — **`b.network.dns.tsig` now accepts a message it signed with a non-default Original ID, fixing a sign/verify digest mismatch that made the originalId option non-functional (RFC 8945).** b.network.dns.tsig.verify restores the Original ID carried in the TSIG RDATA into the DNS message header before computing the HMAC, so a signed message survives an on-wire ID rewrite by a forwarder. b.network.dns.tsig.sign digested the message's current header ID instead of the Original ID, so any message signed with the originalId option set to a value other than the message's header ID produced a MAC the framework's own verify rejected (BADSIG) — the advertised originalId option was effectively non-functional for any non-default value. sign() now digests the Original-ID form, matching verify(); when originalId equals the message's header ID (the default) the digest is byte-for-byte identical to before, so existing signatures and the reference vectors are unaffected. **Fixed:** *TSIG: a message signed with a non-default Original ID now verifies (RFC 8945)* — b.network.dns.tsig.verify restores the Original ID carried in the TSIG RDATA into the DNS message header before computing the HMAC, so a signed message survives an on-wire ID rewrite by a forwarder. b.network.dns.tsig.sign digested the message's current header ID instead of the Original ID, so any message signed with the originalId option set to a value other than the message's header ID produced a MAC the framework's own verify rejected (BADSIG). sign() now digests the Original-ID form, matching verify(); when originalId equals the message's header ID (the default) the digest is byte-for-byte identical to before, so existing signatures and the reference vectors are unaffected.

package/lib/mail-auth.js

@@ -1177,8 +1177,13 @@ function _parseDmarcRecord(text) {
 
 function _alignmentCheck(fromDomain, authDomain, mode) {
   if (!fromDomain || !authDomain) return false;
-  var f = fromDomain.toLowerCase();
-  var a = authDomain.toLowerCase();
+  // Canonicalize both domains identically (lowercase + trailing-dot strip + IDN
+  // A-label) so strict alignment compares the same host form the relaxed PSL
+  // path already normalizes — a trailing-dot / U-label SPF auth-domain must not
+  // fail an otherwise-aligned message.
+  var f = publicSuffix.canonicalDomain(fromDomain);
+  var a = publicSuffix.canonicalDomain(authDomain);
+  if (!f || !a) return false;
   if (mode === "s") return f === a;                                              // strict
   // RFC 7489 §3.1.1 + DMARCbis §4.4 — relaxed alignment compares the
   // organizational domain (the public-suffix-tail registered name).

package/lib/mail-bimi.js

@@ -60,6 +60,7 @@ var markupTokenizer = require("./markup-tokenizer");
 var x509Chain = require("./x509-chain");
 var structuredFields = require("./structured-fields");
 var safeUrl = require("./safe-url");
+var publicSuffix = require("./public-suffix");
 var validateOpts = require("./validate-opts");
 var { defineClass, MailBimiError } = require("./framework-error");
 
@@ -866,25 +867,37 @@ function _verifyCertChain(leaf, intermediates, anchors) {
 // is a comma-separated string like "URI:https://example.com, DNS:example.com";
 // accept either a URI:* matching the domain's hostname OR a DNS:*
 // exact match (compat - some VMC profiles emit DNS instead of URI).
+// _canonBimiHost — canonical host form for the SAN-vs-domain authorization
+// compare, via the one delimiter-safe canonicalizer (lowercase + trailing-dot
+// strip + IDN A-label, and crucially rejecting "/" "?" "#" which domainToASCII
+// truncates at — so a SAN like "victim.example/evil" can't masquerade as
+// "victim.example"). Returns "" for any non-host value, which then matches
+// nothing (fail closed).
+function _canonBimiHost(host) {
+  return publicSuffix.canonicalDomain(host == null ? "" : host);
+}
+
 function _subjectAltNameMatchesDomain(cert, domain) {
   var raw = cert.subjectAltName || "";
   var parts = raw.split(",").map(function (s) { return s.trim(); }).filter(Boolean);
   var found = parts.slice();
-  var dom = domain.toLowerCase();
+  var dom = _canonBimiHost(domain);
+  if (dom.length === 0) return { ok: false, found: found };
   for (var i = 0; i < parts.length; i += 1) {
     var p = parts[i];
     var lp = p.toLowerCase();
     if (lp.indexOf("dns:") === 0) {
-      var dns2 = lp.slice(4);
-      if (dns2 === dom) return { ok: true, found: found };
-    }
-    if (lp.indexOf("uri:") === 0) {
-      var uri = p.slice(4);
+      if (_canonBimiHost(p.slice(4)) === dom) return { ok: true, found: found };
+    } else if (lp.indexOf("uri:") === 0) {
       try {
-        var u = safeUrl.parse(uri, { allowedProtocols: ["https:", "http:"] });
-        if ((u.hostname || "").toLowerCase() === dom) return { ok: true, found: found };
+        var u = safeUrl.parse(p.slice(4), { allowedProtocols: ["https:", "http:"] });
+        if (_canonBimiHost(u.hostname) === dom) return { ok: true, found: found };
       } catch (_e) {
-        if (lp.indexOf(dom) !== -1) return { ok: true, found: found };
+        // A URI SAN the URL parser refuses (userinfo / malformed / homograph)
+        // is not a usable host binding — FAIL CLOSED. No substring fallback:
+        // the old `lp.indexOf(dom) !== -1` matched the domain anywhere in the
+        // raw SAN string (userinfo / path), so a CA-chained cert whose real
+        // host differed could vouch for an arbitrary victim domain.
       }
     }
   }

package/lib/mail.js

@@ -143,6 +143,14 @@ function _isAscii(s) {
  */
 function toAscii(domain) {
   if (typeof domain !== "string" || domain.length === 0) return null;
+  // domainToASCII silently TRUNCATES at a URL delimiter ("a.com/evil" -> "a.com"),
+  // so a string carrying one is not a bare host — return null rather than a
+  // misleading prefix. (":" / "@" / "[" / "]" already yield "", but reject them
+  // here too so every non-host character fails the same way.)
+  if (domain.indexOf("/") !== -1 || domain.indexOf("?") !== -1 ||
+      domain.indexOf("#") !== -1 || domain.indexOf("\\") !== -1 ||
+      domain.indexOf(":") !== -1 || domain.indexOf("@") !== -1 ||
+      domain.indexOf("[") !== -1 || domain.indexOf("]") !== -1) return null;
   var ascii;
   try { ascii = nodeUrl.domainToASCII(domain); }
   catch (_e) { return null; }
@@ -524,6 +532,7 @@ function _validateMessage(message) {
           var detected = fileType().detect(att.content);
           if (detected && detected.mime &&
               detected.mime.split("/")[0] !==
+              // allow:bare-split-on-quoted-header-token-grammar — split(";")[0] takes the Content-Type type/subtype, which precedes every parameter (RFC 9110 §8.3); a quoted ";" can only appear inside a later parameter value and so cannot affect [0].
               att.contentType.split(";")[0].trim().toLowerCase().split("/")[0]) {
             throw new MailError("mail/invalid-attachment",
               "attachments[" + i + "].contentType '" + att.contentType +

package/lib/middleware/csrf-protect.js

@@ -189,9 +189,6 @@ function _checkOriginAllowed(req, allowedOrigins, isHttpsFn, requireOrigin) {
     return null;
   }
 
-  var requestOrigin = (isHttpsFn && isHttpsFn(req) ? "https://" : "http://") +
-                      (headers.host || "");
-
   function _originOf(rawUrl) {
     try {
       var u = new URL(rawUrl);                                                   // allow:raw-new-url-parse-only — origin-shape inspection (NOT outbound). Intentionally tolerates file:// / data: which safeUrl.parse refuses.
@@ -199,12 +196,20 @@ function _checkOriginAllowed(req, allowedOrigins, isHttpsFn, requireOrigin) {
     } catch (_e) { return null; }
   }
 
+  // Canonicalize the same-origin baseline through the SAME _originOf the
+  // candidate Origin/Referer go through (lowercases the host, strips the
+  // default port), or a mixed-case / default-port Host header would not match
+  // an equivalent Origin and a legitimate same-origin request would be refused.
+  var requestOrigin = _originOf((isHttpsFn && isHttpsFn(req) ? "https://" : "http://") +
+                                (headers.host || ""));
+
   function _isAllowed(candidateOrigin) {
     if (!candidateOrigin) return false;
-    if (candidateOrigin === requestOrigin) return true;
+    if (requestOrigin !== null && candidateOrigin === requestOrigin) return true;
     if (Array.isArray(allowedOrigins)) {
       for (var i = 0; i < allowedOrigins.length; i += 1) {
-        if (candidateOrigin === allowedOrigins[i]) return true;
+        // Canonicalize each operator allowedOrigins entry the same way.
+        if (candidateOrigin === _originOf(allowedOrigins[i])) return true;
       }
     }
     return false;

package/lib/public-suffix.js

@@ -97,14 +97,19 @@ function _normalizeInput(domain) {
         "publicSuffix: domain must not be a bare dot");
     }
   }
-  // Reject control / null / whitespace bytes outright. domainToASCII
-  // would silently rewrite some of them; we want hostile inputs to
-  // throw, not be coerced.
+  // Reject control / null / whitespace bytes AND the URL-structural delimiters
+  // domainToASCII silently TRUNCATES at — "/" (0x2F), "?" (0x3F), "#" (0x23),
+  // "\" (0x5C) reduce "example.com/evil" to "example.com" rather than failing,
+  // which would let a hostile host masquerade as a trusted prefix. ":" / "@" /
+  // "[" / "]" already make domainToASCII return "" (caught below), but reject
+  // them here too so every non-host character fails closed, not silently.
   for (var i = 0; i < s.length; i += 1) {
     var cp = s.charCodeAt(i);
-    if (cp < 0x21 || cp === 0x7f) {
+    if (cp < 0x21 || cp === 0x7f ||
+        cp === 0x2f || cp === 0x3f || cp === 0x23 || cp === 0x5c ||   // / ? # \
+        cp === 0x3a || cp === 0x40 || cp === 0x5b || cp === 0x5d) {   // : @ [ ]
       throw _err("public-suffix/invalid-domain",
-        "publicSuffix: domain contains control / whitespace byte");
+        "publicSuffix: domain contains a control byte or URL delimiter");
     }
   }
   // IDN-normalize — non-ASCII labels become xn--… via Node's UTS #46
@@ -395,9 +400,42 @@ function lookupSource() {
   return _sourceMeta;
 }
 
+/**
+ * @primitive b.publicSuffix.canonicalDomain
+ * @signature b.publicSuffix.canonicalDomain(domain)
+ * @since     0.15.50
+ * @status    stable
+ * @related   b.publicSuffix.organizationalDomain, b.publicSuffix.publicSuffix
+ *
+ * Returns the bare canonical host form of `domain` for identity
+ * comparison: lowercase, a single trailing dot stripped, and IDN
+ * labels normalized to their A-label (punycode) form. Unlike
+ * `organizationalDomain` it does NOT walk the public-suffix list — it
+ * returns the input host itself in canonical form.
+ *
+ * Two values that denote the same host in different encodings (case,
+ * trailing dot, U-label vs A-label) return the SAME string, so an
+ * equality compare is encoding-stable — the building block for DMARC
+ * alignment and certificate SAN-vs-domain authorization checks, where
+ * one side normalizing differently from the other is a bypass.
+ *
+ * Non-throwing: returns `""` for any input that is not a valid host
+ * (control bytes, empty labels, over the 253-octet limit), so a
+ * hostile or garbage value canonicalizes to `""` and matches nothing.
+ *
+ * @example
+ *   var b = require("@blamejs/core");
+ *   b.publicSuffix.canonicalDomain("Example.COM.");   // → "example.com"
+ *   b.publicSuffix.canonicalDomain("a..b");             // → ""
+ */
+function canonicalDomain(domain) {
+  try { return _normalizeInput(domain); } catch (_e) { return ""; }
+}
+
 module.exports = {
   publicSuffix:         publicSuffix,
   organizationalDomain: organizationalDomain,
+  canonicalDomain:      canonicalDomain,
   isPublicSuffix:       isPublicSuffix,
   lookupSource:         lookupSource,
 };

package/lib/ssrf-guard.js

@@ -743,11 +743,17 @@ function createAllowlist(opts) {
       "ssrf-guard/empty-allowlist", {});
   }
   function _matches(list, hostOrIp) {
+    // Canonicalize BOTH the URL host and each non-CIDR operator entry before
+    // comparing: the URL parser already lowercases the host (and strips a
+    // trailing dot), so a mixed-case or trailing-dot operator entry compared
+    // raw silently failed to match — letting a denylisted host through.
+    var canonHost = canonicalizeHost(hostOrIp);
     for (var i = 0; i < list.length; i++) {
       var entry = list[i];
-      if (entry === hostOrIp) return true;
       if (entry.indexOf("/") !== -1) {
         try { if (cidrContains(entry, hostOrIp)) return true; } catch (_e) { /* ignore */ }
+      } else if (canonicalizeHost(entry) === canonHost) {
+        return true;
       }
     }
     return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.49",
+  "version": "0.15.50",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6cc185bb-1bd0-499d-9ebe-d97e6e5d7471",
+  "serialNumber": "urn:uuid:74c051d6-47fc-4a6b-a557-b70f7fd7afdf",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-28T23:40:14.484Z",
+    "timestamp": "2026-06-29T02:26:06.809Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.49",
+      "bom-ref": "@blamejs/core@0.15.50",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.49",
+      "version": "0.15.50",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.49",
+      "purl": "pkg:npm/%40blamejs/core@0.15.50",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.49",
+      "ref": "@blamejs/core@0.15.50",
       "dependsOn": []
     }
   ]