@blamejs/core 0.15.67 → 0.15.68

package/lib/safe-buffer.js

@@ -798,6 +798,68 @@ function stripCrlf(s, replacement) {
   return s.replace(CRLF_RE_GLOBAL, replacement === undefined ? "" : replacement);
 }
 
+/**
+ * @primitive b.safeBuffer.foldHeaderText
+ * @signature b.safeBuffer.foldHeaderText(value, replacement?)
+ * @since     0.15.68
+ * @status    stable
+ * @related   b.safeBuffer.assertHeaderSafe, b.safeBuffer.stripCrlf
+ *
+ * Neutralize free-text bound for a CRLF-delimited protocol line: replace
+ * every CR and LF with <code>replacement</code> (default a single space) so
+ * the text folds onto one line, AND remove every NUL byte. Use this for a
+ * value that may LEGITIMATELY wrap — a multi-line SMTP 5xx reply folded into
+ * one diagnostic line — where <code>assertHeaderSafe</code> (reject) would
+ * be too strict. Unlike bare <code>stripCrlf</code>, this also strips NUL,
+ * which is never valid in an RFC 5322 header value and which downstream
+ * SMTP / mail parsers treat specially. Non-string input passes through
+ * unchanged.
+ *
+ * @example
+ *   b.safeBuffer.foldHeaderText("550 mailbox full\r\nX-Injected: evil");
+ *   // → "550 mailbox full X-Injected: evil"
+ */
+function foldHeaderText(value, replacement) {
+  if (typeof value !== "string") return value;
+  var rep = replacement === undefined ? " " : replacement;
+  return value.replace(CRLF_RE_GLOBAL, rep).split("\u0000").join("");
+}
+
+/**
+ * @primitive b.safeBuffer.assertHeaderSafe
+ * @signature b.safeBuffer.assertHeaderSafe(value, label, ErrorClass, code)
+ * @since     0.15.68
+ * @status    stable
+ * @related   b.safeBuffer.hasCrlf, b.safeBuffer.stripCrlf
+ *
+ * Throw when a string bound for a CRLF-delimited protocol line — an SMTP /
+ * RFC 5322 header value, an HTTP header — contains CR, LF, or a NUL byte,
+ * the canonical header-injection / smuggling vector. Route every
+ * <code>Name: value\r\n</code> builder's STRUCTURED fields (addresses,
+ * domains, identifiers, MTA names) through this; they can never
+ * legitimately carry those bytes. For free-text that may legitimately wrap
+ * (a multi-line SMTP reply folded into one diagnostic line), fold it with
+ * <code>stripCrlf</code> instead of rejecting. Throws
+ * <code>new ErrorClass(code, ...)</code> so each caller reports in its own
+ * error domain (the <code>validateOpts</code> convention). A non-string
+ * value passes through untouched — callers type-check separately.
+ *
+ * @example
+ *   b.safeBuffer.assertHeaderSafe("rcpt@example.com", "to", MailError, "mail/bad-header");
+ *   // → "rcpt@example.com"
+ *
+ *   b.safeBuffer.assertHeaderSafe("rcpt\r\nBcc: evil@x", "to", MailError, "mail/bad-header");
+ *   // → throws MailError("mail/bad-header")
+ */
+function assertHeaderSafe(value, label, ErrorClass, code) {
+  if (typeof value === "string" &&
+      (CRLF_RE.test(value) || value.indexOf("\u0000") !== -1)) {
+    throw new ErrorClass(code,
+      label + ": must not contain CR, LF, or NUL (header injection)");
+  }
+  return value;
+}
+
 module.exports = {
   normalizeText:         normalizeText,
   toBuffer:              toBuffer,
@@ -809,6 +871,8 @@ module.exports = {
   isHex:                 isHex,
   hasCrlf:               hasCrlf,
   stripCrlf:             stripCrlf,
+  foldHeaderText:        foldHeaderText,
+  assertHeaderSafe:      assertHeaderSafe,
   stripTrailingHspace:   stripTrailingHspace,
   indexAfterOpenTag:     indexAfterOpenTag,
   HEX_RE:                HEX_RE,

package/lib/safe-icap.js

@@ -77,6 +77,7 @@
 
 var C                  = require("./constants");
 var { defineClass }    = require("./framework-error");
+var pick               = require("./pick");
 var gateContract       = require("./gate-contract");
 
 var SafeIcapError = defineClass("SafeIcapError", { alwaysPermanent: true });
@@ -395,6 +396,10 @@ function _parseHeaderLine(line, maxValueBytes) {
 }
 
 function _addHeader(headers, name, value) {
+  // A header named __proto__ / constructor / prototype would pollute or
+  // shadow the plain-object header map; drop it (ICAP headers are echoed
+  // from an untrusted upstream response).
+  if (pick.isPoisonedKey(name)) return;
   if (headers[name] === undefined) {
     headers[name] = value;
   } else if (Array.isArray(headers[name])) {

package/lib/session.js

@@ -510,6 +510,30 @@ async function create(opts) {
  *   var roles  = (info.data && info.data.roles) || [];
  *   // → { userId: "user-42", data: { roles: ["admin"] }, createdAt: ..., expiresAt: ..., lastActivity: ..., fingerprintDrift: false, fingerprintAnomalyScore: null }
  */
+// Evaluate the idle + absolute timeout floors against a session row.
+// Returns { action, metadata } describing the breach, or null if the session
+// is within both floors. Centralized so EVERY session-read path (verify,
+// touch, ...) enforces the floors identically — a refresh must never
+// resurrect a session that verify() would expire.
+function _timeoutFloorBreach(row, nowMs, opts) {
+  opts = opts || {};
+  var idleMs = opts.idleTimeoutMs !== undefined ? opts.idleTimeoutMs : DEFAULT_IDLE_TIMEOUT_MS;
+  var absMs = opts.absoluteTimeoutMs !== undefined ? opts.absoluteTimeoutMs : DEFAULT_ABSOLUTE_TIMEOUT_MS;
+  if (idleMs > 0) {
+    var lastActivity = Number(row.lastActivity);
+    if ((nowMs - lastActivity) > idleMs) {
+      return { action: "auth.session.expired_idle", metadata: { idleMs: nowMs - lastActivity, threshold: idleMs } };
+    }
+  }
+  if (absMs > 0) {
+    var createdAt = Number(row.createdAt);
+    if ((nowMs - createdAt) > absMs) {
+      return { action: "auth.session.expired_absolute", metadata: { ageMs: nowMs - createdAt, threshold: absMs } };
+    }
+  }
+  return null;
+}
+
 async function verify(token, verifyOpts) {
   if (typeof token !== "string" || token.length === 0) return null;
   verifyOpts = verifyOpts || {};
@@ -541,39 +565,15 @@ async function verify(token, verifyOpts) {
   // SP 800-63B-4). These shorten the effective lifetime even when the
   // operator picked a long ttlMs. Defaults: idle 30m, absolute 12h.
   // Operator opt-out by passing 0 (disables that timeout).
-  var idleMs = verifyOpts.idleTimeoutMs !== undefined
-    ? verifyOpts.idleTimeoutMs : DEFAULT_IDLE_TIMEOUT_MS;
-  var absMs = verifyOpts.absoluteTimeoutMs !== undefined
-    ? verifyOpts.absoluteTimeoutMs : DEFAULT_ABSOLUTE_TIMEOUT_MS;
-  if (idleMs > 0) {
-    var lastActivity = Number(row.lastActivity);
-    if ((nowMs - lastActivity) > idleMs) {
-      try {
-        audit.safeEmit({
-          action: "auth.session.expired_idle", outcome: "success",
-          metadata: { idleMs: nowMs - lastActivity, threshold: idleMs },
-        });
-      } catch (_ignored) { /* audit best-effort */ }
-      if (cluster.isLeader()) {
-        try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
-      }
-      return null;
-    }
-  }
-  if (absMs > 0) {
-    var createdAt = Number(row.createdAt);
-    if ((nowMs - createdAt) > absMs) {
-      try {
-        audit.safeEmit({
-          action: "auth.session.expired_absolute", outcome: "success",
-          metadata: { ageMs: nowMs - createdAt, threshold: absMs },
-        });
-      } catch (_ignored) { /* audit best-effort */ }
-      if (cluster.isLeader()) {
-        try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
-      }
-      return null;
+  var floorBreach = _timeoutFloorBreach(row, nowMs, verifyOpts);
+  if (floorBreach) {
+    try {
+      audit.safeEmit({ action: floorBreach.action, outcome: "success", metadata: floorBreach.metadata });
+    } catch (_ignored) { /* audit best-effort */ }
+    if (cluster.isLeader()) {
+      try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
     }
+    return null;
   }
   // Unseal sealed columns (userId, data) using the cryptoField pipeline
   // so we return cleartext to the caller — same shape as the previous
@@ -909,6 +909,21 @@ async function touch(token, opts) {
   if (sid === null) return false;
   var sidHash = _hashSid(sid);
   var nowMs = Date.now();
+  // A session past its idle / absolute timeout floor must not be resurrected
+  // by a refresh — enforce the floors (as verify does) before extending.
+  // Without this, touch() would reset lastActivity on a session verify()
+  // would have expired, defeating the floor.
+  var floorSel = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["createdAt", "lastActivity"])
+    .where("sidHash", sidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var floorRow = await _currentStore().executeOne(floorSel.sql, floorSel.params);
+  if (!floorRow) return false;
+  if (_timeoutFloorBreach(floorRow, nowMs, opts)) {
+    try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
+    return false;
+  }
   // Two SQL paths so the SET list stays static (no dynamic column
   // assembly) and matches the call shape clusterStorage expects.
   // extendBy resets expiresAt relative to NOW, not relative to the

package/lib/vc.js

@@ -69,6 +69,32 @@ var JOSE_ALGS = {
   "EdDSA": { nodeHash: null },
 };
 
+// RFC 7518 §3.4 binds each ECDSA alg to a specific curve. The verifier must
+// reject a signature whose header alg does not match the resolved key's type
+// / curve — otherwise the attacker picks the alg (hash + encoding) from the
+// header independent of the key an ECDSA curve/type confusion (CWE-347).
+var _ES_ALG_CURVE = { "ES256": "prime256v1", "ES384": "secp384r1", "ES512": "secp521r1" };
+
+function _assertJoseAlgKey(algName, key) {
+  var kt = key && key.asymmetricKeyType;
+  if (algName === "EdDSA") {
+    if (kt !== "ed25519" && kt !== "ed448") {
+      throw new VcError("vc/alg-key-mismatch",
+        "vc.verify: alg EdDSA requires an Ed25519/Ed448 key, got " + (kt || "?"));
+    }
+    return;
+  }
+  var wantCurve = _ES_ALG_CURVE[algName];
+  if (wantCurve) {
+    var gotCurve = key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve;
+    if (kt !== "ec" || gotCurve !== wantCurve) {
+      throw new VcError("vc/alg-key-mismatch",
+        "vc.verify: alg " + algName + " requires an EC " + wantCurve + " key, got " +
+        (kt || "?") + "/" + (gotCurve || "?"));
+    }
+  }
+}
+
 function _b64urlJson(obj) {
   return Buffer.from(JSON.stringify(obj), "utf8").toString("base64url");
 }
@@ -234,6 +260,9 @@ function _verifyJose(token, opts, expectedTyp) {
   }
   var params = JOSE_ALGS[header.alg];
   var pub = opts.publicKey ? _toKey(opts.publicKey, "public") : _toKey(opts.keyResolver(header), "public");
+  // Bind the header-declared alg to the resolved key's type/curve before
+  // verifying — reject an alg the attacker chose that doesn't match the key.
+  _assertJoseAlgKey(header.alg, pub);
   var signingInput = parts[0] + "." + parts[1];
   var sig = Buffer.from(parts[2], "base64url");
   var ok = params.nodeHash === null

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:5d539dfc9ef47121d4c09bd7256d76448a1f5ac47ee09ac44c78ff6a062af9ab"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:49411d893f5e9b0e2fcaa564b4ec7921f73a9a06229b5e53d49c1453ea1a365c"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -154,12 +154,12 @@
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
       "bundledAt": "2026-06-24T00:00:00Z",
       "hashes": {
-        "server": "sha256:42c4f3544726fa2feb4f304c889c5e391feb5d28080c9b6356ff82e267a93706",
-        "data_js": "sha256:c840d9ae5c6bf4a07967340a5c649df2c6a66a287db41e408461c46cc32348e6"
+        "server": "sha256:5afbeea28737514a69a0bdca7cd3818979e67c443444de4d19f2f8713cf5372e",
+        "data_js": "sha256:6ed61937db12f148494db7c336498740bf4458cd9f49ec73d887eda83529f207"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-06-24_06-18-09_UTC
-// COMMIT: 18ecca5d54471f21918798da451dd8d03a18f3c7
+// VERSION: 2026-07-02_09-58-14_UTC
+// COMMIT: d67b6cb8e70e9c76b0803809b66e7ffdd09484bd
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -14614,7 +14614,6 @@ polyspace.com
 // May First - People Link : https://mayfirst.org/
 // Submitted by Jamie McClelland <info@mayfirst.org>
 mayfirst.info
-mayfirst.org
 
 // McHost : https://mchost.ru
 // Submitted by Evgeniy Subbotin <e.subbotin@mchost.ru>
@@ -16411,7 +16410,6 @@ zabc.net
 
 // ===END PRIVATE DOMAINS===
 
-
 // ===BEGIN blamejs canary===
 // Honeytoken — vendor-data integrity defense (lib/vendor-data.js).
 _blamejs_canary_v0_9_8_.local