@blamejs/core 0.15.61 → 0.15.62

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.62 (2026-06-29) — **ARC evaluation now reads each hop's instance with the same strict parser the signature checks use, so a crafted ARC-Authentication-Results header can no longer forge the upstream auth-results surfaced to downstream policy.** b.mail.arc.evaluate returns finalAr — the most recent hop's ARC-Authentication-Results, the receiver's view of the upstream authentication results — which operators may key downstream decisions on. The instance tag (i=) on each ARC header was parsed by three different regexes: the indexing pass that drives the AMS/AS signature checks required i= with no surrounding space and at most three digits, while the finalAr extraction and the AMS header-retention test accepted a looser form (a space around =, unbounded digits). When a sealer signs without covering ARC-Authentication-Results in its AMS h= (permitted by RFC 8617 and supported by the verifier), an attacker holding no key could append a second ARC-Authentication-Results written so the strict pass ignored it while the loose pass consumed it — forging finalAr on a chain that still verified as pass. All ARC instance reads now route through one strict parser, so the evaluation surfaces the same hop the signatures validated. The release also repairs the b.mail.arc.sign excludeAarFromAms option (it was read but rejected by option validation, so the documented opt-out was unreachable) and routes the ARC-Seal signature's b= stripping through the shared tag-aware helper. **Fixed:** *ARC finalAr is read from the strictly-indexed hop, not a looser rescan* — b.mail.arc.evaluate extracted finalAr (and validated the per-hop AMS header retention) with a regex that accepted ARC instance tags the signature-indexing pass rejected — a space around i= or more than three digits. A sealer that omits ARC-Authentication-Results from its AMS h= leaves the AAR outside signature coverage; an attacker could then inject a second ARC-Authentication-Results whose instance the strict crypto pass skipped but the finalAr pass accepted, presenting attacker-chosen upstream auth-results on a chain that still reported pass. Every ARC instance read now goes through a single strict parser, so finalAr is always the AAR the chain's signatures actually covered. · *b.mail.arc.sign accepts excludeAarFromAms again* — The excludeAarFromAms option was read when building the AMS h= list but was missing from the function's option allow-list, so passing it raised an unknown-option error — the documented opt-out could not be used. It is now accepted. · *ARC-Seal b= stripping uses the shared tag-aware helper* — The ARC-Seal verification stripped the signature's b= value with a regex that could mis-zero a value containing b= inside another tag; it now uses the same tag-aware stripper as DKIM, so canonicalization matches the signer in every case. **Detectors:** *ARC instance parsing must use the shared strict reader* — A check fails the build if any ARC instance (i=) parsing regex is added outside the single shared reader, preventing a future divergence between the signature-indexing pass and the finalAr / header-retention passes.
+
 - v0.15.61 (2026-06-29) — **The local and Redis job queues fence completion, failure, and lease extension on the lease the caller actually holds, so a worker finishing after its lease expired can no longer disturb a job another worker has since taken over.** On the local and Redis queue backends, complete(), fail(), and extendLease() identified a job only by its id. When a worker's lease expired, the sweep returned the job to the ready set and another worker leased and began running it; if the original worker then finished late, its complete() could mark the new worker's in-progress job done (and double-fire a cron repeat or re-release flow children), and its fail() could re-queue or dead-letter a job the new worker was still executing. Each lease now carries the job's attempts value (incremented once per lease), and complete(), fail(), and extendLease() act only when that value still matches — so a call from a worker that no longer holds the lease changes nothing. The generic consumer threads this automatically; the SQS backend already bound these actions to the message's receipt handle and is unchanged. **Fixed:** *Local and Redis queues bind complete/fail/extendLease to the held lease* — A long-running handler whose lease expired and was swept could have its job re-leased to a second worker; when the first worker finished, complete() marked the second worker's in-progress job done — double-firing a cron-recurring job's next enqueue and re-releasing its flow dependents — while fail() re-queued or dead-lettered the job the second worker was still running (re-executing or discarding in-flight work). The backends now fence each of these calls on the leased attempts value, which is bumped once per lease; only the worker that holds the current lease can complete, fail, or extend it. A stale call returns without mutating the queue. This brings the local and Redis backends to parity with the SQS backend, which already bound these actions to the message receipt handle.
 
 - v0.15.60 (2026-06-29) — **`requireStepUp` binds the elevation grant to the authenticated principal, refusing a grant minted for a different user (cross-user step-up replay).** The b.middleware.requireStepUp gate accepts an operator-issued step-up elevation grant from the X-Step-Up-Grant header and verifies it with b.auth.stepUp.grant.verify. An elevation grant carries the subject it was minted for (payload.sub), but the middleware verified only the grant's signature, expiry, and scope — never that the grant's subject matched the request's authenticated principal. A grant minted for one user (and then leaked through a shared cache, a log line, a referrer, or a shared device) therefore satisfied the step-up requirement for ANY other authenticated user who presented it, elevating their session to the granted assurance level without ever completing a step-up ceremony. requireStepUp now passes the resolved principal as the grant's required subject, so the grant satisfies step-up only for the user it was issued to. The principal is resolved from whichever shape the authenticator populated — a session's req.user.id / req.user.userId, or the JWT subject (req.user.claims.sub / req.user.sub) set by bearerAuth with an external verifier — so a grant legitimately minted for a JWT subject still binds. A request with no resolvable principal cannot bind the grant and falls through to the claims-based challenge. **Security:** *Step-up elevation grants are bound to the authenticated principal* — requireStepUp's grant path called b.auth.stepUp.grant.verify with only the grant scope, not the subject, so any holder of a valid, unexpired, scope-matching elevation grant passed the step-up gate regardless of which user the request was authenticated as — a leaked or shared grant elevated a different user's session (cross-user step-up replay). The grant already binds a subject at mint time and the verifier supports a subject check; the middleware now supplies the request's principal as the required subject, refusing a grant whose subject does not match. The principal is read from whichever field the authenticator set — a session's id/userId or the JWT subject (claims.sub / sub) from bearerAuth's external verifier — so a grant minted for any of those binds correctly. A request with no authenticated principal cannot bind a grant and is handled by the normal claims-based step-up challenge. The grant verifier's signature/expiry/scope/jti-revocation checks are unchanged.

package/lib/mail-arc-sign.js

@@ -177,7 +177,7 @@ function sign(opts) {
   validateOpts(opts, [
     "rfc822", "instance", "authservId", "domain", "selector",
     "privateKey", "algorithm", "cv", "authResults",
-    "headersToSign", "timestamp", "audit",
+    "headersToSign", "timestamp", "audit", "excludeAarFromAms",
   ], "mail.arc.sign");
 
   validateOpts.requireNonEmptyString(opts.rfc822, "sign: rfc822",

package/lib/mail-auth.js

@@ -1456,6 +1456,25 @@ function _parseHeaderLines(headerSection) {
 // limit how far an attacker can push junk headers.
 var ARC_MAX_HOPS = 50;                                                           // RFC 8617 §5.1.2 chain ceiling
 
+// Parse the ARC instance tag (i=) from an ARC header value (RFC 8617
+// §4.2.1). Strict by construction: the tag must follow a value boundary
+// (start / ";" / "," / whitespace), use no space around "=", and be 1-3
+// digits (instances are bounded to [1,50]). EVERY ARC-header instance read
+// — the indexing pass that drives the AMS/AS crypto checks, the AMS h=
+// retention test, the per-hop d= extraction, and the finalAr surfacing —
+// routes through this one parser so they can never disagree about which hop
+// a header belongs to. A looser parser in one place (e.g. allowing "i = 1"
+// with a space, or unbounded digits) lets an attacker inject an
+// ARC-Authentication-Results that the strict crypto pass ignores while a
+// permissive pass consumes it, forging the upstream auth-results surfaced as
+// finalAr on a chain that still verifies pass — with no signing key.
+function _arcInstanceOf(value) {
+  var m = String(value).match(/(?:^|[;,\s])i=(\d{1,3})\b/);
+  if (!m) return null;
+  var inst = parseInt(m[1], 10);
+  return (isFinite(inst) && inst >= 1) ? inst : null;
+}
+
 async function arcVerify(rfc822, opts) {
   if (typeof rfc822 !== "string" || rfc822.length === 0) {
     throw new MailAuthError("mail-auth/arc-bad-input",
@@ -1491,13 +1510,11 @@ async function arcVerify(rfc822, opts) {
     var value = khv.value.trim();
     if (name !== "arc-seal" && name !== "arc-message-signature" &&
         name !== "arc-authentication-results") continue;
-    // ARC hop instance per RFC 8617 §4.2.1 — bounded to 3 digits; the
-    // spec doesn't define a hard ceiling but operational use never
-    // exceeds 50 hops, and a 999-hop limit prevents pathological
-    // header values from chewing the verifier.
-    var iMatch = value.match(/(?:^|[;,\s])i=(\d{1,3})\b/);
-    var inst = iMatch ? parseInt(iMatch[1], 10) : null;
-    if (inst === null || !isFinite(inst) || inst < 1) continue;
+    // ARC hop instance per RFC 8617 §4.2.1 — parsed by the shared strict
+    // reader so the index this drives (and the AMS/AS crypto checks keyed on
+    // it) matches every other instance read in the verifier/evaluator.
+    var inst = _arcInstanceOf(value);
+    if (inst === null) continue;
     if (inst > maxInstanceSeen) maxInstanceSeen = inst;
     var slotKey = inst + ":" + name;
     if (seenSlot[slotKey]) { duplicate = true; continue; }
@@ -1790,7 +1807,9 @@ async function _verifyArc(rfc822, hop, allHops, kind, dnsLookup, dkim) {
   }
   // Current AS with b= emptied. RFC 8617 §5.1.2: canonicalization
   // includes the AS header with `b=` value stripped + no trailing CRLF.
-  var asUnsigned = sigValue.replace(/(\bb=)[^;]*/i, "$1");
+  // Use the shared tag-aware stripper (the `\bb=...` regex it replaced
+  // mis-zeroed a value containing `b=` inside another tag, e.g. `d=ab=x`).
+  var asUnsigned = dkim._stripBTagValue(sigValue);
   canonicalized += _canonRelaxedHeader("ARC-Seal", asUnsigned).replace(/\r\n$/, "");
 
   // Verify the AS signature.
@@ -1824,8 +1843,8 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
       // canonicalizes it via h=). Pre-v0.8.17 stripped every AAR
       // unconditionally, breaking verification on chains that
       // included AAR in h= (Microsoft + Google interop).
-      var instMatch = /\bi\s*=\s*(\d+)/.exec(khv.value);
-      if (!instMatch || parseInt(instMatch[1], 10) !== hop.instance) continue;
+      var aarInst = _arcInstanceOf(khv.value);
+      if (aarInst === null || aarInst !== hop.instance) continue;
     }
     rebuilt.push(line);
   }
@@ -1980,12 +1999,14 @@ async function arcEvaluate(rfc822, opts) {
     var name = khv.key;
     var value = khv.value.trim();
     if (name === "arc-seal") {
-      var iMatch = value.match(/(?:^|[;,\s])i=(\d+)/);                            // allow:regex-no-length-cap — header bounded by RFC 5322 998
+      var sealInst = _arcInstanceOf(value);
       var dMatch = value.match(/(?:^|[;,\s])d=([^\s;]+)/);                        // allow:regex-no-length-cap — header bounded by RFC 5322 998
-      if (iMatch && dMatch) hopDomains[parseInt(iMatch[1], 10)] = dMatch[1].toLowerCase();
+      if (sealInst !== null && dMatch) hopDomains[sealInst] = dMatch[1].toLowerCase();
     } else if (name === "arc-authentication-results") {
-      var arIMatch = value.match(/\bi\s*=\s*(\d+)/);                              // allow:regex-no-length-cap — header bounded by RFC 5322 998
-      if (arIMatch) hopAr[parseInt(arIMatch[1], 10)] = value;
+      // Same strict instance reader as the indexing pass — finalAr must be the
+      // AAR the crypto pass actually indexed, never one a looser parser admits.
+      var arInst = _arcInstanceOf(value);
+      if (arInst !== null) hopAr[arInst] = value;
     }
   }
 

package/lib/mail-dkim.js

@@ -1323,6 +1323,7 @@ module.exports = {
   _canonHeaderRelaxedForTest: _canonHeaderRelaxed,
   _canonBodyRelaxedForTest:   _canonBodyRelaxed,
   _canonBodySimpleForTest:    _canonBodySimple,
+  _stripBTagValue:            _stripBTagValue,   // RFC 6376 §3.5 — tag-aware b= zeroing; shared by the ARC seal verifier (internal cross-module helper)
   _stripBTagValueForTest:     _stripBTagValue,
   // The header-block parser that produces the { name, value } pairs fed to the
   // canonicalizers. Exposed so a golden-vector test can pin its byte-exact

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.61",
+  "version": "0.15.62",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6303169a-86d7-4e03-92ca-da9cee671ab1",
+  "serialNumber": "urn:uuid:5422e8bb-3202-439f-86f2-ed91f656a2ba",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-29T17:23:08.793Z",
+    "timestamp": "2026-06-29T19:28:45.676Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.61",
+      "bom-ref": "@blamejs/core@0.15.62",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.61",
+      "version": "0.15.62",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.61",
+      "purl": "pkg:npm/%40blamejs/core@0.15.62",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.61",
+      "ref": "@blamejs/core@0.15.62",
       "dependsOn": []
     }
   ]