@blamejs/core 0.16.27 → 0.16.29

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.29 (2026-07-13) — **Reject a backup manifest's absolute, drive-letter, or NTFS-stream path at validation and resolve every path through the framework path-safety primitive on both backup and restore, and stop a bound-key auth middleware from hanging when a required peer certificate is absent.** Two defects surfaced while covering the backup/restore path handling and the bound-key auth middleware. A backup manifest's file paths were checked only for a leading separator and .., so a Windows drive-letter path such as C:\Windows\evil, or a colon-bearing NTFS alternate-data-stream marker such as db.enc:evil, passed b.backupManifest.validate, and the backup and restore steps joined the caller- or manifest-declared relativePath and encryptedPath directly, without the framework's path-safety primitive -- so a path built from untrusted input could read a file outside dataDir on backup, or aim a restored file (or a blob read) outside the staging directory on restore. validate now rejects a colon anywhere (both the drive-letter prefix and the alternate-data-stream marker) alongside .. and a leading separator, and both b.backupBundle.create and b.restoreBundle resolve every manifest-declared path through b.safePath (which refuses traversal, absolute, drive-letter, UNC, NTFS alternate-data-stream, and reserved-name paths), so each sink is contained even if a path slips past the first-line check. Separately, b.middleware.requireBoundKey dereferenced req.peerCert.raw in its peer-certificate pinning branch when a fingerprint had been pre-attached by upstream mTLS but the certificate object was absent, throwing an uncaught TypeError that rejected the middleware promise -- the request hung with no response instead of a clean fail-closed denial; the branch now guards the certificate and denies. **Fixed:** *b.middleware.requireBoundKey fails closed instead of hanging when a required peer certificate is absent* — In the peer-certificate pinning branch, the middleware read req.peerCert.raw without checking that req.peerCert was present. When an upstream mTLS layer had pre-attached a peer fingerprint (req.peerFingerprint) but no certificate object, that read threw an uncaught TypeError, which rejected the middleware's promise -- the request received no response and hung, rather than a clean fail-closed 401/403. The branch now checks for the certificate before dereferencing it and denies when it is missing, so a peer-cert-pinned key without a usable certificate is refused, not stalled. **Security:** *Backup and restore resolve every filesystem path through b.safePath, and b.backupManifest.validate rejects an absolute, drive-letter, or NTFS-stream path* — A backup manifest's per-file relativePath and encryptedPath were validated only against .. and a leading / or \, so a Windows drive-absolute path (C:\...) or an NTFS alternate-data-stream marker (db.enc:evil) passed b.backupManifest.validate, and the backup, restore, and storage-adapter steps built their filesystem paths with a plain path join of the caller- or manifest-supplied values -- meaning a path built from untrusted input could read a file outside dataDir on backup, aim a decrypted-file write or an encrypted-blob read outside the intended directory on restore, or escape the storage root through the filesystem adapter. validate() now rejects a colon anywhere (covering both the drive-letter prefix and the alternate-data-stream marker) alongside .. and a leading separator, and every filesystem sink -- b.backupBundle.create (the source read), b.restoreBundle (the encrypted-blob read and the restore destination), and the b.backup.bundleAdapterStorage.fsAdapter key resolver -- resolves its path through b.safePath, which refuses traversal, absolute, drive-letter, UNC, NTFS alternate-data-stream, and Windows reserved-name components and contains the result under its base. (The object-store storage adapter builds an object key, not a filesystem path, and keeps its traversal/NUL check -- a colon is a legal object-key character.) Legitimate relative paths back up and restore unchanged.
+
+- v0.16.28 (2026-07-13) — **Fix a Sieve filter bypass where an explicit :comparator silently disabled a header/address/envelope test, plus a JSONPath normalized-path round-trip fault and a rejected daemon cwd option.** Three defects surfaced while covering the Sieve interpreter, JSONPath engine, and daemon supervisor. In b.mail.sieve, an explicit :comparator on a header, address, or envelope test silently disabled the whole test: the Sieve parser did not bind the comparator name to its tag, so the comparator string was consumed as the first positional argument (the header/address name) and every real argument shifted by one -- the test looked up a non-existent header, never matched, and the message fell through to implicit keep, so a discard / fileinto / redirect that should have fired instead delivered the message. The parser now binds :comparator to its tag (RFC 5228 §2.7.3), so the comparator is applied and the arguments stay aligned. b.jsonPath.paths emitted a normalized path containing raw control characters (only ' and \ were escaped), which the query parser then rejected, so a path returned by paths() did not round-trip through query(); control characters are now escaped per RFC 9535 §2.7. And b.daemon.start rejected its own documented cwd option with an unknown-option error; cwd is now accepted and forwarded as the detached child's working directory. **Fixed:** *b.jsonPath.paths emits a normalized path that round-trips through b.jsonPath.query* — A normalized path returned by paths() escaped only the single-quote and backslash characters inside a member name, leaving raw control characters (newline, tab, and the rest of U+0000 through U+001F) in the output. The query parser rejects an unescaped control character in a name selector, so such a path could not be fed back into query(). Control characters in a normalized-path name are now escaped as their short form (\b \t \n \f \r) or \uXXXX, per RFC 9535 §2.7, so paths() output round-trips. · *b.daemon.start accepts and applies the documented cwd option* — The start() options validator did not list cwd among the accepted options, so passing the documented cwd (the working directory for the detached child) was rejected with a daemon/bad-opts unknown-option error and the feature was unusable. cwd is now an accepted optional string and is forwarded to the detached child spawn as its working directory. **Security:** *b.mail.sieve applies an explicit :comparator instead of silently disabling the test* — A Sieve script that used an explicit :comparator on a header, address, or envelope test -- for example header :comparator "i;octet" :is "Subject" "..." -- silently stopped filtering. The parser did not attach the comparator's value string to the :comparator tag, so it was consumed as the first positional argument (the header or address name) and shifted the real name and key list by one position. The test then queried a non-existent header, never matched, and evaluation fell through to implicit keep, so a discard, fileinto, or reject the operator intended was not applied and the message was delivered anyway -- a filter bypass for any rule with an explicit comparator. The parser now binds :comparator to its tag per RFC 5228 §2.7.3, so the chosen comparator (i;octet exact vs the default i;ascii-casemap case-insensitive) is applied and the positional arguments stay aligned; a :comparator with no following comparator-name string is refused at parse time.
+
 - v0.16.27 (2026-07-12) — **Fix b.pubsub pattern subscriptions silently dropping every message for a single-wildcard pattern such as orders.*.created.** b.pubsub.subscribePattern with a * wildcard between dotted segments never matched any channel, so a pattern subscriber received nothing. The documented flagship pattern orders.*.created silently dropped orders.eu.created, and the same held for a.*.c, a.*.b.*.c, and any pattern whose wildcard sits between literal segments -- the source @example itself did not work. The segment matcher required a literal that follows a * to fit entirely before the next dot, but a trailing literal like .created contains a dot and legitimately begins before that boundary, so the match was rejected. The matcher now lets a post-wildcard literal begin at or before the next dot and matches it verbatim, while a single-segment * still never spans a dot -- so orders.*.created matches orders.eu.created but not orders.eu.fr.created or orders.created, and a pattern subscriber never receives a message from an extra path segment. Surfaced while covering the pub/sub matcher's branches. **Fixed:** *b.pubsub.subscribePattern matches a single-segment wildcard between literal segments* — A pattern with a * between dotted segments (the documented orders.*.created, or any a.*.c / a.*.b.*.c) matched no channel at all, so the pattern subscriber's handler never fired. The matcher rejected the literal that follows a wildcard unless it fit entirely before the next dot, but a trailing literal such as .created contains a dot and starts before that boundary, so a legitimate match was dropped. The literal after a wildcard is now allowed to begin at or before the next dot and is matched verbatim; the wildcard still matches exactly one non-dot segment, so orders.*.created matches orders.eu.created but not orders.eu.fr.created (two segments) or orders.created (none) -- a pattern subscription never widens to an extra path segment. Behaviour is now consistent with the documented example.
 
 - v0.16.26 (2026-07-12) — **Stop b.db.exportCsv from crashing on an out-of-range timestamp value, and fix two CLI reporting faults (a vault-status stack trace and rollback-point metadata that never rendered).** Three defects surfaced while covering the db, cli, and http-client/mail-store error branches. b.db.exportCsv formatted a declared timestampFields column with new Date(v).toISOString(), which throws a RangeError for a finite millisecond value outside JavaScript's representable date range (beyond +/-8.64e15) and aborted the entire export; the one out-of-range value now degrades to its raw numeric string. The blamejs vault status command crashed with an uncaught VaultPassphraseError and a stack trace when the data directory did not exist, because the status path lacked the try/catch its sibling seal / unseal / rotate paths use; it now reports the same one-line reporter error. And blamejs restore list-rollbacks annotated each point from a non-existent recordedAt / bundleId, so the bundle id and timestamp never rendered; it now reads them from the fields b.restoreRollback.list returns (swappedAt, and bundleId / reason on the marker's operator metadata). **Fixed:** *b.db.exportCsv degrades an out-of-range timestamp value instead of aborting the export* — For a column named in timestampFields, exportCsv rendered a numeric value as new Date(value).toISOString(). A finite millisecond value beyond JavaScript's representable date range (greater than +/-8.64e15) produces an Invalid Date whose toISOString() throws a RangeError, which propagated out and aborted the whole export -- one out-of-range row could deny the entire CSV. Such a value now degrades to its raw numeric string, so the rest of the export completes. · *b.cli vault status reports a clean error when the data directory is absent* — The vault status subcommand called the sealable/unsealable preflight checks without the try/catch that its sibling seal / unseal / rotate subcommands use, so a missing or unreadable data directory raised an uncaught VaultPassphraseError -- the CLI shim printed a stack trace and exited on an unhandled rejection instead of the one-line "data-dir does not exist" reporter error the other vault subcommands give. The status path now catches the preflight error and reports it cleanly. · *b.cli restore list-rollbacks renders each rollback point's metadata* — The list-rollbacks row annotated each point with recordedAt and bundleId read from the top level of the point object, but b.restoreRollback.list returns { rollbackPath, swappedAt, marker } with the operator metadata (bundleId, reason) on marker.operator -- so those annotations were always empty. The listing now reads swappedAt from the point and bundleId / reason from the marker's operator metadata, so a rollback point's provenance is actually shown.

package/lib/backup/bundle.js

@@ -51,6 +51,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("../atomic-file");
+var safePath = require("../safe-path");
 var bCrypto = require("./crypto");
 var backupManifest = require("./manifest");
 var validateOpts = require("../validate-opts");
@@ -122,11 +123,20 @@ async function create(opts) {
       throw new BackupBundleError("backup-bundle/bad-include",
         "create: files[" + i + "] requires { relativePath: string }");
     }
-    if (entry.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(entry.relativePath)) {
+    if (entry.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(entry.relativePath) ||
+        entry.relativePath.indexOf(":") !== -1) {
+      // A colon anywhere is refused alongside '..' and a leading separator: it
+      // covers both a Windows drive prefix (C:\..., absolute) and an NTFS
+      // alternate-data-stream marker (db.enc:evil). This friendly pre-screen
+      // mirrors b.backupManifest.validate; safePath.resolve below is the
+      // authoritative sink for the residual classes (UNC, reserved name, etc.).
       throw new BackupBundleError("backup-bundle/bad-include",
-        "create: files[" + i + "].relativePath must be a relative path (got '" + entry.relativePath + "')");
+        "create: files[" + i + "].relativePath must be a relative path without '..', a leading separator, or a colon (got '" + entry.relativePath + "')");
     }
-    var srcPath = nodePath.join(dataDir, entry.relativePath);
+    // Resolve the source path THROUGH dataDir with safePath so a relativePath
+    // built from untrusted input can't read a file outside dataDir even if it
+    // slips the first-line check (UNC, reserved name, encoded separator, bidi).
+    var srcPath = safePath.resolve(dataDir, entry.relativePath);
     if (!nodeFs.existsSync(srcPath)) {
       if (entry.required) {
         throw new BackupBundleError("backup-bundle/missing-required",

package/lib/backup/index.js

@@ -55,6 +55,7 @@ var os = require("node:os");
 var nodePath = require("node:path");
 var bCrypto = require("../crypto");
 var atomicFile = require("../atomic-file");
+var safePath = require("../safe-path");
 var C = require("../constants");
 var backupBundle = require("./bundle");
 var frameworkFiles = require("../framework-files");
@@ -2197,13 +2198,23 @@ bundleAdapterStorage.fsAdapter = function (fsOpts) {
   atomicFile.ensureDir(root);
 
   function _keyPath(key) {
-    // Refuse keys with traversal segments — defense in depth even
-    // though the storage layer also checks.
-    if (key.indexOf("..") !== -1 || key.indexOf("\0") !== -1) {
+    // Gate the key under Windows path semantics REGARDLESS of the host, then
+    // resolve the real on-disk path with the host's semantics. An fsAdapter
+    // store is portable — a bundle written on one OS is often read on another —
+    // and win32 splits on both `/` and `\`, so a key like `..\evil` (a harmless
+    // literal filename under POSIX, but a climb out of root when the same key is
+    // later interpreted on Windows) is refused everywhere. The gate is a strict
+    // superset of the host's, also refusing an absolute / drive-letter / UNC
+    // prefix, an NTFS alternate-data-stream marker, a Windows reserved name, and
+    // NUL / control bytes; defense in depth even though the storage layer also
+    // checks. A hand-rolled '..' + NUL substring check (the prior shape) missed
+    // the drive / ADS / reserved-name class the shared primitive handles, and a
+    // host-only resolve missed the cross-platform backslash-traversal class.
+    if (safePath.resolveOrNull(root, key, { platform: "win32" }) === null) {
       throw new BackupError("backup/bad-key",
-        "fsAdapter: key contains invalid characters: " + JSON.stringify(key));
+        "fsAdapter: key contains invalid or unsafe path characters: " + JSON.stringify(key));
     }
-    return nodePath.join(root, key);
+    return safePath.resolve(root, key);
   }
 
   return {

package/lib/backup/manifest.js

@@ -121,14 +121,19 @@ function _validateFileEntry(f, idx, errors) {
   }
   if (typeof f.relativePath !== "string" || f.relativePath.length === 0) {
     errors.push("files[" + idx + "].relativePath: required non-empty string");
-  } else if (f.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(f.relativePath)) {
-    // No traversal — when restored, relativePath joins under dataDir
-    errors.push("files[" + idx + "].relativePath: must be a relative path without '..' or leading separator");
+  } else if (f.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(f.relativePath) || f.relativePath.indexOf(":") !== -1) {
+    // No traversal — when restored, relativePath joins under dataDir. A colon
+    // anywhere is refused alongside '..' and a leading separator: it covers
+    // both a Windows drive prefix (C:\..., absolute — path.resolve would honor
+    // it and escape dataDir) and an NTFS alternate-data-stream marker
+    // (db.enc:evil), so validate() fails closed before restore, matching the
+    // safePath sink b.restoreBundle resolves both paths through.
+    errors.push("files[" + idx + "].relativePath: must be a relative path without '..', a leading separator, or a colon (drive letter / NTFS data-stream marker)");
   }
   if (typeof f.encryptedPath !== "string" || f.encryptedPath.length === 0) {
     errors.push("files[" + idx + "].encryptedPath: required non-empty string");
-  } else if (f.encryptedPath.indexOf("..") !== -1 || /^[/\\]/.test(f.encryptedPath)) {
-    errors.push("files[" + idx + "].encryptedPath: must be a relative path without '..' or leading separator");
+  } else if (f.encryptedPath.indexOf("..") !== -1 || /^[/\\]/.test(f.encryptedPath) || f.encryptedPath.indexOf(":") !== -1) {
+    errors.push("files[" + idx + "].encryptedPath: must be a relative path without '..', a leading separator, or a colon (drive letter / NTFS data-stream marker)");
   }
   if (typeof f.size !== "number" || !Number.isInteger(f.size) || f.size < 0) {
     errors.push("files[" + idx + "].size: required non-negative integer");

package/lib/daemon.js

@@ -100,6 +100,8 @@ function _validateStartOpts(opts) {
     },
     command: { rule: "optional-string", code: "daemon/bad-command",
                label: "daemon.start: opts.command (path to executable)" },
+    cwd: { rule: "optional-string", code: "daemon/bad-cwd",
+           label: "daemon.start: opts.cwd (working directory for the detached child)" },
     args: function (value) {
       if (value !== undefined && !Array.isArray(value)) {
         throw new DaemonError("daemon/bad-args",

package/lib/json-path.js

@@ -623,12 +623,34 @@ function query(doc, path) {
   return _evalSegments(ast.segments, doc).map(function (n) { return n.value; });
 }
 
+// RFC 9535 §2.7: a normalized-path name is single-quoted and MUST escape
+// `'`, `\`, and every control code (%x0-1F) — the latter as the named
+// short escape (\b \t \n \f \r) or \uXXXX. Emitting a raw control char
+// produces a path that no longer round-trips through the parser (which
+// rejects unescaped control characters in a string literal).
+function _normalizeName(name) {
+  var out = "";
+  for (var i = 0; i < name.length; i++) {
+    var ch = name.charAt(i), cc = name.charCodeAt(i);
+    if (ch === "'") out += "\\'";
+    else if (ch === "\\") out += "\\\\";
+    else if (cc === 0x08) out += "\\b";
+    else if (cc === 0x09) out += "\\t";
+    else if (cc === 0x0a) out += "\\n";
+    else if (cc === 0x0c) out += "\\f";
+    else if (cc === 0x0d) out += "\\r";
+    else if (cc < 0x20) out += "\\u" + ("0000" + cc.toString(16)).slice(-4);
+    else out += ch;
+  }
+  return out;
+}
+
 function _normalizedPath(tokens) {
   var out = "$";
   for (var i = 0; i < tokens.length; i++) {
     var t = tokens[i];
     if (typeof t === "number") out += "[" + t + "]";
-    else out += "['" + String(t).replace(/\\/g, "\\\\").replace(/'/g, "\\'") + "']";
+    else out += "['" + _normalizeName(String(t)) + "']";
   }
   return out;
 }

package/lib/middleware/require-bound-key.js

@@ -289,7 +289,7 @@ function create(opts) {
             keyId: record.id || null,
           });
         }
-      } else if (!bCrypto().isCertRevoked(req.peerCert.raw, pinned)) {
+      } else if (!(req.peerCert && req.peerCert.raw) || !bCrypto().isCertRevoked(req.peerCert.raw, pinned)) {
         // isCertRevoked returns true on MATCH against the deny-list
         // shape; we use it here as a fingerprint-set membership test
         // because it does the same constant-time hex/colon comparison

package/lib/restore-bundle.js

@@ -50,6 +50,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
+var safePath = require("./safe-path");
 var C = require("./constants");
 var backupCrypto = require("./backup/crypto");
 var backupManifest = require("./backup/manifest");
@@ -226,7 +227,11 @@ async function extract(opts) {
         continue;
       }
 
-      var blobPath = nodePath.join(bundleDir, entry.encryptedPath);
+      // Resolve the manifest-declared encrypted-blob path THROUGH the base with
+      // safePath -- a tampered manifest could otherwise carry a traversal /
+      // absolute / drive-letter / NTFS-ADS encryptedPath and read a file outside
+      // the bundle. manifest.validate is a first-line check; this is the sink.
+      var blobPath = safePath.resolve(bundleDir, entry.encryptedPath);
       // Cap the read to the manifest's declared encryptedSize so an oversize-on-
       // disk blob is refused BEFORE it is read into memory (was: read fully, then
       // compare → an OOM window for a huge swapped blob). A valid blob is exactly
@@ -282,7 +287,10 @@ async function extract(opts) {
           " — bundle is corrupted or manifest tampered");
       }
 
-      var destPath = nodePath.join(stagingDir, entry.relativePath);
+      // Resolve the restore destination THROUGH the staging base with safePath
+      // so a tampered relativePath (traversal / absolute / drive-letter / ADS)
+      // cannot escape stagingDir when the decrypted file is written.
+      var destPath = safePath.resolve(stagingDir, entry.relativePath);
       atomicFile.ensureDir(nodePath.dirname(destPath));
       atomicFile.writeSync(destPath, plaintext, { fileMode: 0o600 });
 

package/lib/safe-sieve.js

@@ -429,7 +429,39 @@ function _parseScript(tokens, caps, requiredCaps) {
       }
       if (t.k === "tag") {
         consume("tag");
-        tags.push({ name: t.v });
+        // `:comparator <string>` binds the FOLLOWING string as its value
+        // (RFC 5228 section 2.7.3). It must be attached to the tag, NOT left in
+        // the positional stream -- otherwise the comparator name lands at
+        // positional[0] and shifts every real positional arg (the header/address
+        // name and the key list) by one, silently breaking the test so it never
+        // matches and the message falls through to implicit keep (a filter
+        // bypass). In the base grammar `:comparator` is the only value-taking tag.
+        if (t.v === "comparator") {
+          var cv = peek();
+          if (cv.k !== "str") {
+            throw new SafeSieveError("safe-sieve/parse-error",
+              "safeSieve.parse: :comparator must be followed by a comparator-name string");
+          }
+          consume("str");
+          // Validate the comparator name against the implemented set, exactly as
+          // `require ["comparator-<name>"]` does -- otherwise an unsupported
+          // comparator (e.g. i;unicode-casemap) would be accepted here and the
+          // interpreter would silently treat it as octet (exact) matching,
+          // bypassing the capability guard. Fail closed on anything not
+          // implemented.
+          var compCap = "comparator-" + cv.v;
+          if (!Object.prototype.hasOwnProperty.call(KNOWN_CAPABILITIES, compCap)) {
+            throw new SafeSieveError("safe-sieve/unknown-capability",
+              "safeSieve.parse: unknown comparator \"" + cv.v + "\"");
+          }
+          if (KNOWN_CAPABILITIES[compCap] === false) {
+            throw new SafeSieveError("safe-sieve/unimplemented-capability",
+              "safeSieve.parse: unimplemented comparator \"" + cv.v + "\"");
+          }
+          tags.push({ name: t.v, val: cv.v });
+        } else {
+          tags.push({ name: t.v });
+        }
         continue;
       }
       if (t.k === "num") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.27",
+  "version": "0.16.29",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:569a359f-c69b-4562-a2ec-f31668019c7f",
+  "serialNumber": "urn:uuid:1f6a9458-410d-4d84-986b-01af22e84765",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-13T07:47:49.374Z",
+    "timestamp": "2026-07-13T15:57:31.414Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.27",
+      "bom-ref": "@blamejs/core@0.16.29",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.27",
+      "version": "0.16.29",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.27",
+      "purl": "pkg:npm/%40blamejs/core@0.16.29",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.27",
+      "ref": "@blamejs/core@0.16.29",
       "dependsOn": []
     }
   ]