@blamejs/core 0.16.40 → 0.17.0

package/CHANGELOG.md

@@ -6,6 +6,10 @@ Pre-1.0 the surface is intentionally evolving — every release may
 change something operators depend on. Read each entry before
 upgrading across more than a few patches at a time.
 
+## v0.17.x
+
+- v0.17.0 (2026-07-17) — **Algorithm and key-type lookups across the crypto verifiers reject a prototype-member name instead of accepting it, the ZIP reader honors the operator's decompression-ratio policy, and signed S3/GCS query parameters transmit the space encoding they were signed with.** A family of verifiers resolved an algorithm, hash, or key-type name against a plain-object lookup table with a truthiness or `in`-operator guard, so a name that is an inherited Object.prototype member (constructor, __proto__, toString, valueOf) slipped the guard and resolved to the inherited member: b.jwk thumbprinted an attacker-crafted key to a predictable digest, b.vc and b.contentCredentials emitted a real signature under a bogus algorithm, and b.sdJwtVc accepted an attacker-controlled hash name from an unsigned issuer payload. All of them now reject a name that is not an own property of the table. Separately, b.archive's ZIP reader silently capped the decompression ratio at its composed default and ignored the operator's configured bomb policy, refusing legitimate highly-compressible entries; and b.storage's SigV4 (and the GCS V4 presigner) signed a query space as %20 but transmitted it as +, so a signed parameter carrying a space was rejected as a signature mismatch. **Fixed:** *ZIP extraction honors the operator's decompression-ratio policy* — b.archive's random-access ZIP reader composed b.safeDecompress for each DEFLATE entry without forwarding the reader's own expansion-ratio cap, so the decompression inherited safeDecompress's stricter default ratio and silently overrode the operator's configured bomb policy. A ZIP entry that legitimately compressed better than the default ratio (logs, JSON, telemetry, zero-padded or sparse binaries) was refused even when the operator's policy permitted it. The reader now forwards its configured maximum expansion ratio into the decode, so the actual-bytes ratio re-check uses the same cap the declared-size gate already enforced. · *Signed S3 and GCS query parameters transmit the space encoding they were signed with* — b.storage's SigV4 request signing (S3, R2, MinIO, and the S3-compatible backends) and the GCS V4 presigner sign the canonical query string, which encodes a space as %20 per the AWS/GCS specification, but transmitted the request via the WHATWG URL serializer, which encodes a space as +. A signed query parameter carrying a literal space -- a response-content-disposition filename or a list prefix -- was therefore signed over %20 but sent as +, so the storage server re-canonicalized to different bytes and rejected the request with a signature mismatch. The signer now aligns the wire query to the signed canonical encoding (rewriting a bare + back to %20) at each signing sink, so the transmitted query is byte-identical to what the signature commits to. **Security:** *Crypto algorithm and key-type lookups reject a prototype-member name* — Several verifiers resolved a caller- or attacker-supplied algorithm / hash / key-type name against a plain-object lookup table using a truthiness check (`var v = TABLE[name]; if (!v) reject`) or the prototype-chain-aware `in` operator. A name that names an inherited Object.prototype member -- constructor, __proto__, toString, valueOf, toLocaleString -- is truthy (or present via the prototype chain), so it slipped the guard and resolved to the inherited member. The observed consequences: b.jwk.thumbprint / canonicalize accepted an unsupported kty and thumbprinted the key to a single predictable digest; b.vc.issue (JOSE) and b.contentCredentials.signCose emitted a real signature under a bogus algorithm id; and b.sdJwtVc.present accepted an attacker-controlled _sd_alg read from the unsigned issuer payload. b.tsa and the SD-JWT hash-disclosure path returned a raw runtime error rather than a typed rejection. Every one of these table lookups now checks Object.prototype.hasOwnProperty before indexing, so a name that is not an own member of the table is rejected with the primitive's typed error. Supported algorithm and key-type names are unaffected.
+
 ## v0.16.x
 
 - v0.16.40 (2026-07-16) — **Four request-path fixes: the router no longer lets the Host header steer which route runs, per-route rate limits can no longer be evaded with a rotating query string, and the message-format and URI-template expanders no longer leak inherited object properties.** b.router derived the dispatch path from the client-controlled Host header, so a path-like Host value bled into the parsed pathname and could steer a request to a different route than its request line named -- a path-ACL bypass in front-proxied deployments. b.middleware.rateLimit in per-route scope fell back to the full request URL (query string included) when the router had not populated the path, letting a rotating throwaway query parameter mint a fresh bucket per request. And b.i18n message-format and b.uriTemplate resolved a template-derived variable name with a bare property read, so a name like {toString} or {constructor} returned an inherited Object.prototype member (or a prototype-polluted value) instead of treating the variable as absent. **Security:** *The Host header can no longer influence which route is dispatched* — b.router derived the request path it matches routes against (req.pathname) by parsing the Host header concatenated with the request URL. WHATWG URL parsing folds any path-like characters in the Host value into the parsed pathname, so a request whose request line was /x but whose Host header was trusted/admin dispatched as /admin/x while req.url stayed /x. Because req.pathname is what the route matcher and every path-scoped guard (auth, CSRF, mTLS) compare against, a client could steer which handler runs -- and a front proxy or WAF that authorizes on the visible request path is bypassed. The router now derives the path and query from the request URL alone, resolved against a fixed internal authority, so the Host header cannot perturb routing; a request target that is not origin-form (a single leading slash) -- an absolute-form, authority-form, asterisk-form, or network-path-reference target -- is rejected with 400 rather than coerced into a routable path. The request's real scheme and host remain available to the consumers (canonical URL, CORS, host allowlist) that legitimately need them. · *Per-route rate limits key on the path only, not the query string* — b.middleware.rateLimit with scope: "per-route" composed its bucket key from req.pathname, falling back to the full request URL when pathname was absent (a raw Node request handed to the middleware without the router populating it). The fallback included the query string, which is not part of route identity, so an attacker could rotate a throwaway parameter (?nonce=1, ?nonce=2, ...) to mint a fresh bucket per request from the same client and evade the limit. The per-route key now strips the query in the fallback, matching the path-normalization the other request-scoped guards already apply. · *Message-format and URI-template variable lookups are own-property only* — b.i18n message-format ({arg}, {n, plural, ...}, {s, select, ...}) and b.uriTemplate ({var} expansion) resolved a variable name parsed from the template with a bare property read of the caller's variables object. A template naming an inherited member -- {toString}, {constructor}, {valueOf}, {__proto__} -- therefore returned the Object.prototype member (a function's source, or a prototype-polluted value) instead of treating the variable as absent, leaking it into rendered output or an expanded URI. Both now resolve variables through an own-property check, so an inherited or polluted name renders empty (message-format argument) or is omitted per RFC 6570 (URI template), matching the own-property discipline the HTML template engine and the simple interpolator already enforce.

package/lib/archive-read.js

@@ -606,6 +606,14 @@ async function _decompressEntry(adapter, entry, dataStart, bombPolicy) {
       algorithm:          "deflate-raw",
       maxOutputBytes:     maxOutput,
       maxCompressedBytes: entry.compressedSize,
+      // Honor the reader's own expansion-ratio cap. Without this, the
+      // composition inherits safeDecompress's DEFAULT_MAX_RATIO (50),
+      // which silently overrides bombPolicy.maxExpansionRatio and refuses
+      // every entry compressing better than 50:1 even when the operator's
+      // policy (default 100) permits it. The declared-size ratio was
+      // already validated in _enforceBombPolicy; this re-check on the
+      // actual inflated bytes uses the SAME configured cap.
+      maxRatio:           bombPolicy.maxExpansionRatio,
     });
     if (decompressed.length !== entry.uncompressedSize) {
       throw new ArchiveReadError("archive-read/inflate-size-mismatch",

package/lib/auth/sd-jwt-vc.js

@@ -119,11 +119,11 @@ function _b64uDecodeBuf(s) {
 }
 
 function _hashDisclosure(disclosureStr, hashAlg) {
-  var nodeAlg = SUPPORTED_HASH_ALGS[hashAlg];
-  if (!nodeAlg) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "Unsupported hash algorithm: " + hashAlg);
   }
+  var nodeAlg = SUPPORTED_HASH_ALGS[hashAlg];
   var h = nodeCrypto.createHash(nodeAlg);
   h.update(disclosureStr, "ascii");
   return h.digest().toString("base64url");
@@ -338,12 +338,12 @@ function present(opts) {
   }
   var _sdAlg = (_issuerPayload && typeof _issuerPayload._sd_alg === "string")
     ? _issuerPayload._sd_alg : "sha-256";
-  var _sdNodeHash = SUPPORTED_HASH_ALGS[_sdAlg];
-  if (!_sdNodeHash) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, _sdAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "present: issuer credential declares _sd_alg \"" + _sdAlg +
       "\" which this framework version does not support");
   }
+  var _sdNodeHash = SUPPORTED_HASH_ALGS[_sdAlg];
 
   var disclosedNames = Array.isArray(opts.disclosedClaimNames)
     ? opts.disclosedClaimNames.slice() : [];

package/lib/content-credentials.js

@@ -595,7 +595,7 @@ function signCose(manifest, opts) {
   validateOpts.requireNonEmptyString(opts.privateKeyPem,
     "contentCredentials.signCose: privateKeyPem", ContentCredentialsError, "BAD_KEY");
   var algName = (opts.alg || "ml-dsa-87").toLowerCase();
-  if (!(algName in COSE_ALGS)) {
+  if (!Object.prototype.hasOwnProperty.call(COSE_ALGS, algName)) {
     throw ContentCredentialsError.factory("content-credentials/bad-alg",
       "contentCredentials.signCose: alg '" + algName +
       "' not in COSE alg registry. Known: " + Object.keys(COSE_ALGS).join(", "));

package/lib/jwk.js

@@ -58,8 +58,17 @@ function _requiredMembers(jwk) {
   if (typeof jwk.kty !== "string" || jwk.kty.length === 0) {
     throw new JwkError("jwk/bad-jwk", "jwk: 'kty' is required");
   }
+  // Own-property lookup only: `kty` is attacker-controlled, and a plain-object
+  // bracket read resolves inherited Object.prototype members (`__proto__`,
+  // `toString`, `valueOf`, `toLocaleString`, …). Those are truthy, so an
+  // unguarded `if (!names)` would treat them as supported key types — the
+  // zero-`length` prototype methods then iterate no required members and
+  // thumbprint the empty object, collapsing distinct inputs onto one
+  // predictable digest instead of the intended unsupported-kty refusal.
+  if (!Object.prototype.hasOwnProperty.call(REQUIRED, jwk.kty)) {
+    throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
+  }
   var names = REQUIRED[jwk.kty];
-  if (!names) throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
   var out = {};
   for (var i = 0; i < names.length; i++) {
     var n = names[i];
@@ -115,8 +124,16 @@ function canonicalize(jwk) {
  */
 function thumbprint(jwk, opts) {
   opts = opts || {};
-  var hash = HASHES[opts.hash || "sha256"];
-  if (!hash) throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  // Own-property lookup only — `opts.hash` is caller-controlled; a bare
+  // bracket read of the HASHES table resolves inherited members (`toString`,
+  // `constructor`, …) to truthy functions that slip past `!hash` and reach
+  // createHash as a non-string, leaking a raw ERR_INVALID_ARG_TYPE instead of
+  // the typed jwk/bad-hash refusal the primitive documents.
+  var hashName = opts.hash || "sha256";
+  if (!Object.prototype.hasOwnProperty.call(HASHES, hashName)) {
+    throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  }
+  var hash = HASHES[hashName];
   var canon = canonicalize(jwk);
   return nodeCrypto.createHash(hash).update(canon, "utf8").digest("base64url");
 }

package/lib/object-store/gcs.js

@@ -362,6 +362,13 @@ function create(config) {
 
     url.searchParams.set("X-Goog-Signature", signature);
 
+    // Final query mutation done — align the wire space encoding to the signed
+    // canonical query (GCS V4 signs "%20" but url.toString() would serialize a
+    // space as "+", so a spaced response-header override / prefix would be
+    // rejected as a signature mismatch). Must precede url.toString(); do not
+    // touch url.searchParams afterward (it re-serializes spaces back to "+").
+    sigv4.alignWireQueryToSigV4(url);
+
     var clientHeaders = {};
     if (opts.contentType) clientHeaders["Content-Type"] = opts.contentType;
 

package/lib/object-store/sigv4.js

@@ -120,6 +120,29 @@ function canonicalQueryString(searchParams) {
   }).join("&");
 }
 
+// Reconcile the wire query with the signed canonical query. The WHATWG URL
+// serializes its query via application/x-www-form-urlencoded, which encodes a
+// space as "+"; SigV4 signs canonicalQueryString, which encodes a space as
+// "%20" (AWS: "encode the space character as %20 and not +"). Left
+// unreconciled, a signed query parameter carrying a literal space (a
+// response-content-disposition filename, a list prefix) is transmitted
+// (url.search / url.toString) as "+" while the signature commits to "%20", so
+// the server re-canonicalizes to different bytes and rejects the request with
+// SignatureDoesNotMatch. A bare "+" in url.search is ALWAYS an encoded space —
+// URLSearchParams serializes a literal "+" as "%2B" and parses "+" back to a
+// space, so canonicalQueryString already signed that position as "%20";
+// rewriting "+" to "%20" makes the transmitted query byte-identical to the
+// signed canonical query. Bare subresource tokens (?uploads / ?lifecycle) carry
+// no "+", so they pass through untouched. Mutates url.search in place (the
+// string setter preserves "%20"); callers MUST NOT touch url.searchParams
+// afterward — that re-serializes spaces back to "+".
+function _alignWireQueryToSigV4(url) {
+  var search = url.search;
+  if (search.indexOf("+") !== -1) {
+    url.search = search.replace(/\+/g, "%20");   // allow:regex-no-length-cap — single-char global replace, input bounded by maxUrlLength
+  }
+}
+
 function canonicalHeaders(headers) {
   var pairs = [];
   for (var k in headers) {
@@ -233,6 +256,10 @@ function signRequest(opts) {
     ", Signature=" + signature;
   headers["Authorization"] = auth;
 
+  // The URL just signed is the one the caller transmits — make its wire query
+  // byte-identical to the canonical query the signature commits to.
+  _alignWireQueryToSigV4(url);
+
   return { headers: headers, signature: signature, canonicalRequest: canon, stringToSign: sts };
 }
 
@@ -810,6 +837,9 @@ function create(config) {
     var signature = nodeCrypto.createHmac("sha256", signingKey).update(sts).digest("hex");
 
     url.searchParams.set("X-Amz-Signature", signature);
+    // Final query mutation done — align the wire space encoding to the signed
+    // "%20" form before serializing the URL the client will use.
+    _alignWireQueryToSigV4(url);
 
     var clientHeaders = {};
     if (opts.contentType) clientHeaders["Content-Type"] = opts.contentType;
@@ -994,6 +1024,7 @@ module.exports = {
   deriveSigningKey:     deriveSigningKey,
   canonicalQueryString: canonicalQueryString,
   canonicalHeaders:     canonicalHeaders,
+  alignWireQueryToSigV4: _alignWireQueryToSigV4,
   awsUriEncode:         awsUriEncode,
   sha256Hex:            sha256Hex,
   formatAmzDate:        _formatAmzDate,

package/lib/tsa.js

@@ -122,11 +122,11 @@ function _normHex(h) {
 // Resolve the message imprint: hash the data, or use a pre-computed hash.
 function _imprint(data, opts, fnName) {
   var hashName = opts.hashAlg || "SHA-512";
-  var h = IMPRINT_HASHES[hashName];
-  if (!h) {
+  if (!Object.prototype.hasOwnProperty.call(IMPRINT_HASHES, hashName)) {
     throw new TsaError("tsa/bad-hash-alg",
       fnName + ": hashAlg must be one of " + Object.keys(IMPRINT_HASHES).join(" / "));
   }
+  var h = IMPRINT_HASHES[hashName];
   var digest;
   if (opts.hashed) {
     digest = _bytes(data, "hash");

package/lib/vc.js

@@ -247,10 +247,10 @@ function _sign(doc, opts, joseTyp, coseTyp, coseContentType, fnName) {
     });
   }
   if (opts.securing === "jose") {
-    var params = JOSE_ALGS[opts.alg];
-    if (!params) {
+    if (!Object.prototype.hasOwnProperty.call(JOSE_ALGS, opts.alg)) {
       throw new VcError("vc/bad-alg", fnName + ": JOSE securing requires alg ES256/384/512 or EdDSA (got " + opts.alg + ")");
     }
+    var params = JOSE_ALGS[opts.alg];
     var key = _toKey(opts.privateKey, "private");
     var header = { alg: opts.alg, typ: joseTyp };
     if (typeof opts.kid === "string") header.kid = opts.kid;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.40",
+  "version": "0.17.0",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:450ccb8a-2242-4a61-a57f-516b6c8e1325",
+  "serialNumber": "urn:uuid:cbebf8cd-986b-48a0-823b-7bd7981981bf",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T03:08:43.327Z",
+    "timestamp": "2026-07-17T06:14:29.525Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.40",
+      "bom-ref": "@blamejs/core@0.17.0",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.40",
+      "version": "0.17.0",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.40",
+      "purl": "pkg:npm/%40blamejs/core@0.17.0",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.40",
+      "ref": "@blamejs/core@0.17.0",
       "dependsOn": []
     }
   ]