@blamejs/core 0.16.28 → 0.16.29

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.29 (2026-07-13) — **Reject a backup manifest's absolute, drive-letter, or NTFS-stream path at validation and resolve every path through the framework path-safety primitive on both backup and restore, and stop a bound-key auth middleware from hanging when a required peer certificate is absent.** Two defects surfaced while covering the backup/restore path handling and the bound-key auth middleware. A backup manifest's file paths were checked only for a leading separator and .., so a Windows drive-letter path such as C:\Windows\evil, or a colon-bearing NTFS alternate-data-stream marker such as db.enc:evil, passed b.backupManifest.validate, and the backup and restore steps joined the caller- or manifest-declared relativePath and encryptedPath directly, without the framework's path-safety primitive -- so a path built from untrusted input could read a file outside dataDir on backup, or aim a restored file (or a blob read) outside the staging directory on restore. validate now rejects a colon anywhere (both the drive-letter prefix and the alternate-data-stream marker) alongside .. and a leading separator, and both b.backupBundle.create and b.restoreBundle resolve every manifest-declared path through b.safePath (which refuses traversal, absolute, drive-letter, UNC, NTFS alternate-data-stream, and reserved-name paths), so each sink is contained even if a path slips past the first-line check. Separately, b.middleware.requireBoundKey dereferenced req.peerCert.raw in its peer-certificate pinning branch when a fingerprint had been pre-attached by upstream mTLS but the certificate object was absent, throwing an uncaught TypeError that rejected the middleware promise -- the request hung with no response instead of a clean fail-closed denial; the branch now guards the certificate and denies. **Fixed:** *b.middleware.requireBoundKey fails closed instead of hanging when a required peer certificate is absent* — In the peer-certificate pinning branch, the middleware read req.peerCert.raw without checking that req.peerCert was present. When an upstream mTLS layer had pre-attached a peer fingerprint (req.peerFingerprint) but no certificate object, that read threw an uncaught TypeError, which rejected the middleware's promise -- the request received no response and hung, rather than a clean fail-closed 401/403. The branch now checks for the certificate before dereferencing it and denies when it is missing, so a peer-cert-pinned key without a usable certificate is refused, not stalled. **Security:** *Backup and restore resolve every filesystem path through b.safePath, and b.backupManifest.validate rejects an absolute, drive-letter, or NTFS-stream path* — A backup manifest's per-file relativePath and encryptedPath were validated only against .. and a leading / or \, so a Windows drive-absolute path (C:\...) or an NTFS alternate-data-stream marker (db.enc:evil) passed b.backupManifest.validate, and the backup, restore, and storage-adapter steps built their filesystem paths with a plain path join of the caller- or manifest-supplied values -- meaning a path built from untrusted input could read a file outside dataDir on backup, aim a decrypted-file write or an encrypted-blob read outside the intended directory on restore, or escape the storage root through the filesystem adapter. validate() now rejects a colon anywhere (covering both the drive-letter prefix and the alternate-data-stream marker) alongside .. and a leading separator, and every filesystem sink -- b.backupBundle.create (the source read), b.restoreBundle (the encrypted-blob read and the restore destination), and the b.backup.bundleAdapterStorage.fsAdapter key resolver -- resolves its path through b.safePath, which refuses traversal, absolute, drive-letter, UNC, NTFS alternate-data-stream, and Windows reserved-name components and contains the result under its base. (The object-store storage adapter builds an object key, not a filesystem path, and keeps its traversal/NUL check -- a colon is a legal object-key character.) Legitimate relative paths back up and restore unchanged.
+
 - v0.16.28 (2026-07-13) — **Fix a Sieve filter bypass where an explicit :comparator silently disabled a header/address/envelope test, plus a JSONPath normalized-path round-trip fault and a rejected daemon cwd option.** Three defects surfaced while covering the Sieve interpreter, JSONPath engine, and daemon supervisor. In b.mail.sieve, an explicit :comparator on a header, address, or envelope test silently disabled the whole test: the Sieve parser did not bind the comparator name to its tag, so the comparator string was consumed as the first positional argument (the header/address name) and every real argument shifted by one -- the test looked up a non-existent header, never matched, and the message fell through to implicit keep, so a discard / fileinto / redirect that should have fired instead delivered the message. The parser now binds :comparator to its tag (RFC 5228 §2.7.3), so the comparator is applied and the arguments stay aligned. b.jsonPath.paths emitted a normalized path containing raw control characters (only ' and \ were escaped), which the query parser then rejected, so a path returned by paths() did not round-trip through query(); control characters are now escaped per RFC 9535 §2.7. And b.daemon.start rejected its own documented cwd option with an unknown-option error; cwd is now accepted and forwarded as the detached child's working directory. **Fixed:** *b.jsonPath.paths emits a normalized path that round-trips through b.jsonPath.query* — A normalized path returned by paths() escaped only the single-quote and backslash characters inside a member name, leaving raw control characters (newline, tab, and the rest of U+0000 through U+001F) in the output. The query parser rejects an unescaped control character in a name selector, so such a path could not be fed back into query(). Control characters in a normalized-path name are now escaped as their short form (\b \t \n \f \r) or \uXXXX, per RFC 9535 §2.7, so paths() output round-trips. · *b.daemon.start accepts and applies the documented cwd option* — The start() options validator did not list cwd among the accepted options, so passing the documented cwd (the working directory for the detached child) was rejected with a daemon/bad-opts unknown-option error and the feature was unusable. cwd is now an accepted optional string and is forwarded to the detached child spawn as its working directory. **Security:** *b.mail.sieve applies an explicit :comparator instead of silently disabling the test* — A Sieve script that used an explicit :comparator on a header, address, or envelope test -- for example header :comparator "i;octet" :is "Subject" "..." -- silently stopped filtering. The parser did not attach the comparator's value string to the :comparator tag, so it was consumed as the first positional argument (the header or address name) and shifted the real name and key list by one position. The test then queried a non-existent header, never matched, and evaluation fell through to implicit keep, so a discard, fileinto, or reject the operator intended was not applied and the message was delivered anyway -- a filter bypass for any rule with an explicit comparator. The parser now binds :comparator to its tag per RFC 5228 §2.7.3, so the chosen comparator (i;octet exact vs the default i;ascii-casemap case-insensitive) is applied and the positional arguments stay aligned; a :comparator with no following comparator-name string is refused at parse time.
 
 - v0.16.27 (2026-07-12) — **Fix b.pubsub pattern subscriptions silently dropping every message for a single-wildcard pattern such as orders.*.created.** b.pubsub.subscribePattern with a * wildcard between dotted segments never matched any channel, so a pattern subscriber received nothing. The documented flagship pattern orders.*.created silently dropped orders.eu.created, and the same held for a.*.c, a.*.b.*.c, and any pattern whose wildcard sits between literal segments -- the source @example itself did not work. The segment matcher required a literal that follows a * to fit entirely before the next dot, but a trailing literal like .created contains a dot and legitimately begins before that boundary, so the match was rejected. The matcher now lets a post-wildcard literal begin at or before the next dot and matches it verbatim, while a single-segment * still never spans a dot -- so orders.*.created matches orders.eu.created but not orders.eu.fr.created or orders.created, and a pattern subscriber never receives a message from an extra path segment. Surfaced while covering the pub/sub matcher's branches. **Fixed:** *b.pubsub.subscribePattern matches a single-segment wildcard between literal segments* — A pattern with a * between dotted segments (the documented orders.*.created, or any a.*.c / a.*.b.*.c) matched no channel at all, so the pattern subscriber's handler never fired. The matcher rejected the literal that follows a wildcard unless it fit entirely before the next dot, but a trailing literal such as .created contains a dot and starts before that boundary, so a legitimate match was dropped. The literal after a wildcard is now allowed to begin at or before the next dot and is matched verbatim; the wildcard still matches exactly one non-dot segment, so orders.*.created matches orders.eu.created but not orders.eu.fr.created (two segments) or orders.created (none) -- a pattern subscription never widens to an extra path segment. Behaviour is now consistent with the documented example.

package/lib/backup/bundle.js

@@ -51,6 +51,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("../atomic-file");
+var safePath = require("../safe-path");
 var bCrypto = require("./crypto");
 var backupManifest = require("./manifest");
 var validateOpts = require("../validate-opts");
@@ -122,11 +123,20 @@ async function create(opts) {
       throw new BackupBundleError("backup-bundle/bad-include",
         "create: files[" + i + "] requires { relativePath: string }");
     }
-    if (entry.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(entry.relativePath)) {
+    if (entry.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(entry.relativePath) ||
+        entry.relativePath.indexOf(":") !== -1) {
+      // A colon anywhere is refused alongside '..' and a leading separator: it
+      // covers both a Windows drive prefix (C:\..., absolute) and an NTFS
+      // alternate-data-stream marker (db.enc:evil). This friendly pre-screen
+      // mirrors b.backupManifest.validate; safePath.resolve below is the
+      // authoritative sink for the residual classes (UNC, reserved name, etc.).
       throw new BackupBundleError("backup-bundle/bad-include",
-        "create: files[" + i + "].relativePath must be a relative path (got '" + entry.relativePath + "')");
+        "create: files[" + i + "].relativePath must be a relative path without '..', a leading separator, or a colon (got '" + entry.relativePath + "')");
     }
-    var srcPath = nodePath.join(dataDir, entry.relativePath);
+    // Resolve the source path THROUGH dataDir with safePath so a relativePath
+    // built from untrusted input can't read a file outside dataDir even if it
+    // slips the first-line check (UNC, reserved name, encoded separator, bidi).
+    var srcPath = safePath.resolve(dataDir, entry.relativePath);
     if (!nodeFs.existsSync(srcPath)) {
       if (entry.required) {
         throw new BackupBundleError("backup-bundle/missing-required",

package/lib/backup/index.js

@@ -55,6 +55,7 @@ var os = require("node:os");
 var nodePath = require("node:path");
 var bCrypto = require("../crypto");
 var atomicFile = require("../atomic-file");
+var safePath = require("../safe-path");
 var C = require("../constants");
 var backupBundle = require("./bundle");
 var frameworkFiles = require("../framework-files");
@@ -2197,13 +2198,23 @@ bundleAdapterStorage.fsAdapter = function (fsOpts) {
   atomicFile.ensureDir(root);
 
   function _keyPath(key) {
-    // Refuse keys with traversal segments — defense in depth even
-    // though the storage layer also checks.
-    if (key.indexOf("..") !== -1 || key.indexOf("\0") !== -1) {
+    // Gate the key under Windows path semantics REGARDLESS of the host, then
+    // resolve the real on-disk path with the host's semantics. An fsAdapter
+    // store is portable — a bundle written on one OS is often read on another —
+    // and win32 splits on both `/` and `\`, so a key like `..\evil` (a harmless
+    // literal filename under POSIX, but a climb out of root when the same key is
+    // later interpreted on Windows) is refused everywhere. The gate is a strict
+    // superset of the host's, also refusing an absolute / drive-letter / UNC
+    // prefix, an NTFS alternate-data-stream marker, a Windows reserved name, and
+    // NUL / control bytes; defense in depth even though the storage layer also
+    // checks. A hand-rolled '..' + NUL substring check (the prior shape) missed
+    // the drive / ADS / reserved-name class the shared primitive handles, and a
+    // host-only resolve missed the cross-platform backslash-traversal class.
+    if (safePath.resolveOrNull(root, key, { platform: "win32" }) === null) {
       throw new BackupError("backup/bad-key",
-        "fsAdapter: key contains invalid characters: " + JSON.stringify(key));
+        "fsAdapter: key contains invalid or unsafe path characters: " + JSON.stringify(key));
     }
-    return nodePath.join(root, key);
+    return safePath.resolve(root, key);
   }
 
   return {

package/lib/backup/manifest.js

@@ -121,14 +121,19 @@ function _validateFileEntry(f, idx, errors) {
   }
   if (typeof f.relativePath !== "string" || f.relativePath.length === 0) {
     errors.push("files[" + idx + "].relativePath: required non-empty string");
-  } else if (f.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(f.relativePath)) {
-    // No traversal — when restored, relativePath joins under dataDir
-    errors.push("files[" + idx + "].relativePath: must be a relative path without '..' or leading separator");
+  } else if (f.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(f.relativePath) || f.relativePath.indexOf(":") !== -1) {
+    // No traversal — when restored, relativePath joins under dataDir. A colon
+    // anywhere is refused alongside '..' and a leading separator: it covers
+    // both a Windows drive prefix (C:\..., absolute — path.resolve would honor
+    // it and escape dataDir) and an NTFS alternate-data-stream marker
+    // (db.enc:evil), so validate() fails closed before restore, matching the
+    // safePath sink b.restoreBundle resolves both paths through.
+    errors.push("files[" + idx + "].relativePath: must be a relative path without '..', a leading separator, or a colon (drive letter / NTFS data-stream marker)");
   }
   if (typeof f.encryptedPath !== "string" || f.encryptedPath.length === 0) {
     errors.push("files[" + idx + "].encryptedPath: required non-empty string");
-  } else if (f.encryptedPath.indexOf("..") !== -1 || /^[/\\]/.test(f.encryptedPath)) {
-    errors.push("files[" + idx + "].encryptedPath: must be a relative path without '..' or leading separator");
+  } else if (f.encryptedPath.indexOf("..") !== -1 || /^[/\\]/.test(f.encryptedPath) || f.encryptedPath.indexOf(":") !== -1) {
+    errors.push("files[" + idx + "].encryptedPath: must be a relative path without '..', a leading separator, or a colon (drive letter / NTFS data-stream marker)");
   }
   if (typeof f.size !== "number" || !Number.isInteger(f.size) || f.size < 0) {
     errors.push("files[" + idx + "].size: required non-negative integer");

package/lib/middleware/require-bound-key.js

@@ -289,7 +289,7 @@ function create(opts) {
             keyId: record.id || null,
           });
         }
-      } else if (!bCrypto().isCertRevoked(req.peerCert.raw, pinned)) {
+      } else if (!(req.peerCert && req.peerCert.raw) || !bCrypto().isCertRevoked(req.peerCert.raw, pinned)) {
         // isCertRevoked returns true on MATCH against the deny-list
         // shape; we use it here as a fingerprint-set membership test
         // because it does the same constant-time hex/colon comparison

package/lib/restore-bundle.js

@@ -50,6 +50,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
+var safePath = require("./safe-path");
 var C = require("./constants");
 var backupCrypto = require("./backup/crypto");
 var backupManifest = require("./backup/manifest");
@@ -226,7 +227,11 @@ async function extract(opts) {
         continue;
       }
 
-      var blobPath = nodePath.join(bundleDir, entry.encryptedPath);
+      // Resolve the manifest-declared encrypted-blob path THROUGH the base with
+      // safePath -- a tampered manifest could otherwise carry a traversal /
+      // absolute / drive-letter / NTFS-ADS encryptedPath and read a file outside
+      // the bundle. manifest.validate is a first-line check; this is the sink.
+      var blobPath = safePath.resolve(bundleDir, entry.encryptedPath);
       // Cap the read to the manifest's declared encryptedSize so an oversize-on-
       // disk blob is refused BEFORE it is read into memory (was: read fully, then
       // compare → an OOM window for a huge swapped blob). A valid blob is exactly
@@ -282,7 +287,10 @@ async function extract(opts) {
           " — bundle is corrupted or manifest tampered");
       }
 
-      var destPath = nodePath.join(stagingDir, entry.relativePath);
+      // Resolve the restore destination THROUGH the staging base with safePath
+      // so a tampered relativePath (traversal / absolute / drive-letter / ADS)
+      // cannot escape stagingDir when the decrypted file is written.
+      var destPath = safePath.resolve(stagingDir, entry.relativePath);
       atomicFile.ensureDir(nodePath.dirname(destPath));
       atomicFile.writeSync(destPath, plaintext, { fileMode: 0o600 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.28",
+  "version": "0.16.29",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:85863bdc-58d9-420d-9ab0-d319a39c7432",
+  "serialNumber": "urn:uuid:1f6a9458-410d-4d84-986b-01af22e84765",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-13T10:50:02.597Z",
+    "timestamp": "2026-07-13T15:57:31.414Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.28",
+      "bom-ref": "@blamejs/core@0.16.29",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.28",
+      "version": "0.16.29",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.28",
+      "purl": "pkg:npm/%40blamejs/core@0.16.29",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.28",
+      "ref": "@blamejs/core@0.16.29",
       "dependsOn": []
     }
   ]