@blamejs/core 0.16.40 → 0.17.1

package/CHANGELOG.md

@@ -6,6 +6,12 @@ Pre-1.0 the surface is intentionally evolving — every release may
 change something operators depend on. Read each entry before
 upgrading across more than a few patches at a time.
 
+## v0.17.x
+
+- v0.17.1 (2026-07-17) — **Profile, posture, and capability name lookups across the content-safety and mail-protocol guards reject a prototype-member name instead of running under it, the mTLS CA can generate a CRL after a fingerprint-only revocation, and a hostile MIME filename no longer crashes attachment extraction.** A second family of guards resolved a profile, posture, or capability name against a plain-object lookup table with a truthiness or in-operator guard, so a name that is an inherited Object.prototype member (constructor, __proto__, toString) slipped the guard and the gate ran under the inherited member instead of refusing the unknown name. The shared profile resolver (b.gateContract.makeProfileResolver, which the guard family composes), the iCal and vCard content guards, the dark-patterns posture check, the JMAP capability allowlist, and the IMAP/POP3/ManageSieve command guards now all resolve names through an own-property check. Separately, b.mtlsCa.generateCrl crashed with a null-serial error once any certificate had been revoked by fingerprint (the mode the require-mTLS gate pins on), dropping every serial-keyed revocation from the published CRL; and b.safeMime.extractAttachments threw an uncaught URIError on a hostile Content-Disposition filename with a malformed percent-escape, crashing the caller. **Fixed:** *mTLS CA generates a CRL after a fingerprint-only revocation* — b.mtlsCa.revoke accepts a certificate fingerprint (the value the require-mTLS gate pins on and generateClientCert surfaces for exactly this use), which is stored without a serial number. b.mtlsCa.generateCrl then mapped the whole revocation registry into CRL entries and handed the null serial to the CRL encoder, which threw -- aborting CRL generation entirely. Because one fingerprint-only revocation broke every subsequent CRL build, all serial-keyed revocations were silently dropped from the published CRL and it could never be regenerated, going stale for external CRL-based revocation checking. generateCrl now projects out fingerprint-only entries (which a standard X.509 CRL cannot represent) before encoding and reports how many were omitted; fingerprint-only revocations remain enforced through the mTLS gate, and the CRL publishes every serial-keyed revocation. · *A hostile MIME filename no longer crashes attachment extraction* — b.safeMime.extractAttachments decoded an RFC 2231 / RFC 5987 extended filename parameter (filename*=charset''percent-encoded) with an unguarded percent-decode, so a malformed escape -- a truncated %, a non-hex %ZZ, or a sequence that decodes to invalid UTF-8 -- threw an uncaught URIError that escaped the parser's typed-error contract and crashed the caller (for example a mail store extracting attachments). A one-line hostile Content-Disposition header was a trivial denial of service. The decode now degrades to the still-encoded filename on failure, matching the framework's handling of every other percent-decode site, so a hostile filename yields a best-effort name that downstream filename guards still vet rather than a crash. **Security:** *Guard profile, posture, and capability lookups reject a prototype-member name* — A group of content-safety and mail-protocol guards resolved a caller- or request-supplied profile / posture / capability name against a plain-object lookup table using a truthiness check (var caps = TABLE[name]; if (!caps)) or the prototype-chain-aware in operator. A name that names an inherited Object.prototype member -- constructor, __proto__, toString -- is truthy (or present via the prototype chain), so it slipped the guard and the gate ran under the inherited member instead of refusing the unknown name. The shared resolver b.gateContract.makeProfileResolver (composed by the idempotency-key, mail-compose, message-id and other guards) now guards both its posture and profile lookups with hasOwnProperty; b.safeIcal, b.safeVcard, b.darkPatterns, b.guardJmap (capability allowlist and profile/posture), and the b.guardImapCommand / b.guardPop3Command / b.guardManageSieveCommand command guards do the same. An unknown or prototype-member name is now rejected with the guard's typed error; supported names are unaffected. This extends the same own-property hardening applied to the crypto algorithm-table lookups in 0.17.0 to the guard-family profile resolvers.
+
+- v0.17.0 (2026-07-17) — **Algorithm and key-type lookups across the crypto verifiers reject a prototype-member name instead of accepting it, the ZIP reader honors the operator's decompression-ratio policy, and signed S3/GCS query parameters transmit the space encoding they were signed with.** A family of verifiers resolved an algorithm, hash, or key-type name against a plain-object lookup table with a truthiness or `in`-operator guard, so a name that is an inherited Object.prototype member (constructor, __proto__, toString, valueOf) slipped the guard and resolved to the inherited member: b.jwk thumbprinted an attacker-crafted key to a predictable digest, b.vc and b.contentCredentials emitted a real signature under a bogus algorithm, and b.sdJwtVc accepted an attacker-controlled hash name from an unsigned issuer payload. All of them now reject a name that is not an own property of the table. Separately, b.archive's ZIP reader silently capped the decompression ratio at its composed default and ignored the operator's configured bomb policy, refusing legitimate highly-compressible entries; and b.storage's SigV4 (and the GCS V4 presigner) signed a query space as %20 but transmitted it as +, so a signed parameter carrying a space was rejected as a signature mismatch. **Fixed:** *ZIP extraction honors the operator's decompression-ratio policy* — b.archive's random-access ZIP reader composed b.safeDecompress for each DEFLATE entry without forwarding the reader's own expansion-ratio cap, so the decompression inherited safeDecompress's stricter default ratio and silently overrode the operator's configured bomb policy. A ZIP entry that legitimately compressed better than the default ratio (logs, JSON, telemetry, zero-padded or sparse binaries) was refused even when the operator's policy permitted it. The reader now forwards its configured maximum expansion ratio into the decode, so the actual-bytes ratio re-check uses the same cap the declared-size gate already enforced. · *Signed S3 and GCS query parameters transmit the space encoding they were signed with* — b.storage's SigV4 request signing (S3, R2, MinIO, and the S3-compatible backends) and the GCS V4 presigner sign the canonical query string, which encodes a space as %20 per the AWS/GCS specification, but transmitted the request via the WHATWG URL serializer, which encodes a space as +. A signed query parameter carrying a literal space -- a response-content-disposition filename or a list prefix -- was therefore signed over %20 but sent as +, so the storage server re-canonicalized to different bytes and rejected the request with a signature mismatch. The signer now aligns the wire query to the signed canonical encoding (rewriting a bare + back to %20) at each signing sink, so the transmitted query is byte-identical to what the signature commits to. **Security:** *Crypto algorithm and key-type lookups reject a prototype-member name* — Several verifiers resolved a caller- or attacker-supplied algorithm / hash / key-type name against a plain-object lookup table using a truthiness check (`var v = TABLE[name]; if (!v) reject`) or the prototype-chain-aware `in` operator. A name that names an inherited Object.prototype member -- constructor, __proto__, toString, valueOf, toLocaleString -- is truthy (or present via the prototype chain), so it slipped the guard and resolved to the inherited member. The observed consequences: b.jwk.thumbprint / canonicalize accepted an unsupported kty and thumbprinted the key to a single predictable digest; b.vc.issue (JOSE) and b.contentCredentials.signCose emitted a real signature under a bogus algorithm id; and b.sdJwtVc.present accepted an attacker-controlled _sd_alg read from the unsigned issuer payload. b.tsa and the SD-JWT hash-disclosure path returned a raw runtime error rather than a typed rejection. Every one of these table lookups now checks Object.prototype.hasOwnProperty before indexing, so a name that is not an own member of the table is rejected with the primitive's typed error. Supported algorithm and key-type names are unaffected.
+
 ## v0.16.x
 
 - v0.16.40 (2026-07-16) — **Four request-path fixes: the router no longer lets the Host header steer which route runs, per-route rate limits can no longer be evaded with a rotating query string, and the message-format and URI-template expanders no longer leak inherited object properties.** b.router derived the dispatch path from the client-controlled Host header, so a path-like Host value bled into the parsed pathname and could steer a request to a different route than its request line named -- a path-ACL bypass in front-proxied deployments. b.middleware.rateLimit in per-route scope fell back to the full request URL (query string included) when the router had not populated the path, letting a rotating throwaway query parameter mint a fresh bucket per request. And b.i18n message-format and b.uriTemplate resolved a template-derived variable name with a bare property read, so a name like {toString} or {constructor} returned an inherited Object.prototype member (or a prototype-polluted value) instead of treating the variable as absent. **Security:** *The Host header can no longer influence which route is dispatched* — b.router derived the request path it matches routes against (req.pathname) by parsing the Host header concatenated with the request URL. WHATWG URL parsing folds any path-like characters in the Host value into the parsed pathname, so a request whose request line was /x but whose Host header was trusted/admin dispatched as /admin/x while req.url stayed /x. Because req.pathname is what the route matcher and every path-scoped guard (auth, CSRF, mTLS) compare against, a client could steer which handler runs -- and a front proxy or WAF that authorizes on the visible request path is bypassed. The router now derives the path and query from the request URL alone, resolved against a fixed internal authority, so the Host header cannot perturb routing; a request target that is not origin-form (a single leading slash) -- an absolute-form, authority-form, asterisk-form, or network-path-reference target -- is rejected with 400 rather than coerced into a routable path. The request's real scheme and host remain available to the consumers (canonical URL, CORS, host allowlist) that legitimately need them. · *Per-route rate limits key on the path only, not the query string* — b.middleware.rateLimit with scope: "per-route" composed its bucket key from req.pathname, falling back to the full request URL when pathname was absent (a raw Node request handed to the middleware without the router populating it). The fallback included the query string, which is not part of route identity, so an attacker could rotate a throwaway parameter (?nonce=1, ?nonce=2, ...) to mint a fresh bucket per request from the same client and evade the limit. The per-route key now strips the query in the fallback, matching the path-normalization the other request-scoped guards already apply. · *Message-format and URI-template variable lookups are own-property only* — b.i18n message-format ({arg}, {n, plural, ...}, {s, select, ...}) and b.uriTemplate ({var} expansion) resolved a variable name parsed from the template with a bare property read of the caller's variables object. A template naming an inherited member -- {toString}, {constructor}, {valueOf}, {__proto__} -- therefore returned the Object.prototype member (a function's source, or a prototype-polluted value) instead of treating the variable as absent, leaking it into rendered output or an expanded URI. Both now resolve variables through an own-property check, so an inherited or polluted name renders empty (message-format argument) or is omitted per RFC 6570 (URI template), matching the own-property discipline the HTML template engine and the simple interpolator already enforce.

package/lib/archive-read.js

@@ -606,6 +606,14 @@ async function _decompressEntry(adapter, entry, dataStart, bombPolicy) {
       algorithm:          "deflate-raw",
       maxOutputBytes:     maxOutput,
       maxCompressedBytes: entry.compressedSize,
+      // Honor the reader's own expansion-ratio cap. Without this, the
+      // composition inherits safeDecompress's DEFAULT_MAX_RATIO (50),
+      // which silently overrides bombPolicy.maxExpansionRatio and refuses
+      // every entry compressing better than 50:1 even when the operator's
+      // policy (default 100) permits it. The declared-size ratio was
+      // already validated in _enforceBombPolicy; this re-check on the
+      // actual inflated bytes uses the SAME configured cap.
+      maxRatio:           bombPolicy.maxExpansionRatio,
     });
     if (decompressed.length !== entry.uncompressedSize) {
       throw new ArchiveReadError("archive-read/inflate-size-mismatch",

package/lib/auth/sd-jwt-vc.js

@@ -119,11 +119,11 @@ function _b64uDecodeBuf(s) {
 }
 
 function _hashDisclosure(disclosureStr, hashAlg) {
-  var nodeAlg = SUPPORTED_HASH_ALGS[hashAlg];
-  if (!nodeAlg) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "Unsupported hash algorithm: " + hashAlg);
   }
+  var nodeAlg = SUPPORTED_HASH_ALGS[hashAlg];
   var h = nodeCrypto.createHash(nodeAlg);
   h.update(disclosureStr, "ascii");
   return h.digest().toString("base64url");
@@ -338,12 +338,12 @@ function present(opts) {
   }
   var _sdAlg = (_issuerPayload && typeof _issuerPayload._sd_alg === "string")
     ? _issuerPayload._sd_alg : "sha-256";
-  var _sdNodeHash = SUPPORTED_HASH_ALGS[_sdAlg];
-  if (!_sdNodeHash) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, _sdAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "present: issuer credential declares _sd_alg \"" + _sdAlg +
       "\" which this framework version does not support");
   }
+  var _sdNodeHash = SUPPORTED_HASH_ALGS[_sdAlg];
 
   var disclosedNames = Array.isArray(opts.disclosedClaimNames)
     ? opts.disclosedClaimNames.slice() : [];

package/lib/content-credentials.js

@@ -595,7 +595,7 @@ function signCose(manifest, opts) {
   validateOpts.requireNonEmptyString(opts.privateKeyPem,
     "contentCredentials.signCose: privateKeyPem", ContentCredentialsError, "BAD_KEY");
   var algName = (opts.alg || "ml-dsa-87").toLowerCase();
-  if (!(algName in COSE_ALGS)) {
+  if (!Object.prototype.hasOwnProperty.call(COSE_ALGS, algName)) {
     throw ContentCredentialsError.factory("content-credentials/bad-alg",
       "contentCredentials.signCose: alg '" + algName +
       "' not in COSE alg registry. Known: " + Object.keys(COSE_ALGS).join(", "));

package/lib/dark-patterns.js

@@ -266,11 +266,14 @@ function assertParity(signup, cancel, opts) {
       "darkPatterns.assertParity: resourceId differs between flows");
   }
   var postureName = opts.posture || "ftc-2024";
-  var posture = POSTURES[postureName];
-  if (!posture) {
+  // Own-property lookup: postureName is operator input, so a bare
+  // `POSTURES[postureName]` with a truthiness guard would let a prototype key
+  // ("constructor") resolve to an inherited member and run under it (fail-open).
+  if (!Object.prototype.hasOwnProperty.call(POSTURES, postureName)) {
     throw errorClass.factory("dark-patterns/bad-posture",
       "darkPatterns.assertParity: unknown posture " + postureName);
   }
+  var posture = POSTURES[postureName];
 
   var toleranceClicks   = typeof opts.toleranceClicks === "number"
     ? opts.toleranceClicks : posture.toleranceClicks;

package/lib/gate-contract.js

@@ -1190,12 +1190,20 @@ function makeProfileResolver(cfg) {
   var label      = _guardLabelFromError(ErrorClass);
   return function resolveProfile(opts) {
     opts = opts || {};
-    if (opts.posture && postures && postures[opts.posture]) {
+    // Own-property lookups only: opts.posture / opts.profile are attacker/
+    // operator input, so a bare bracket read would let a prototype key
+    // ("constructor" / "__proto__" / "toString") resolve to an inherited
+    // truthy member — the posture read would return it as the profile name,
+    // and `!profiles[p]` would treat it as a known profile and skip the
+    // bad-profile refusal, running the gate under a bogus profile (fail-open).
+    if (opts.posture && postures &&
+        Object.prototype.hasOwnProperty.call(postures, opts.posture) &&
+        postures[opts.posture]) {
       var pn = postures[opts.posture];
       return byObject ? profiles[pn] : pn;
     }
     var p = opts.profile || dft;
-    if (!profiles[p]) {
+    if (!Object.prototype.hasOwnProperty.call(profiles, p)) {
       throw ErrorClass.factory(codePrefix + "/bad-profile",
         label + ": unknown profile '" + p + "' (use " +
         Object.keys(profiles).join(" / ") + ")");

package/lib/guard-imap-command.js

@@ -198,10 +198,18 @@ var LITERAL_SMUGGLE_RE = /\{[0-9]+\+?\}(?!\s*$)/;
 function validate(line, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every byte / literal cap compares against `undefined` (fails
+  // open). An unknown posture is ignored (falls through to profile/default);
+  // an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardImapCommandError("guard-imap-command/bad-profile",
       "guardImapCommand.validate: unknown profile '" + profileName + "'");

package/lib/guard-jmap.js

@@ -133,10 +133,18 @@ var CORE_CAPABILITIES = Object.freeze({
 function validate(rawBody, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every size / count cap compares against `undefined` (fails
+  // open). An unknown posture is ignored (falls through to profile/default)
+  // as before; an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardJmapError("guard-jmap/bad-profile",
       "guardJmap.validate: unknown profile '" + profileName + "'");
@@ -198,7 +206,15 @@ function validate(rawBody, opts) {
       throw new GuardJmapError("urn:ietf:params:jmap:error:invalidArguments",
         "guardJmap.validate: `using[" + ui + "]` must be a string capability URI");
     }
-    if (!Object.prototype.hasOwnProperty.call(CORE_CAPABILITIES, cap) && !serverCaps[cap]) {
+    // hasOwnProperty on both tables: `cap` is attacker-supplied (from the
+    // request body). A bare `serverCaps[cap]` bracket read resolves an
+    // inherited Object.prototype member (constructor / __proto__ / toString
+    // / ...) to a truthy value, letting a prototype-key capability pass the
+    // allowlist the server never advertised. Own-key AND truthy preserves
+    // the operator's "capability: false disables it" semantics.
+    var advertised = Object.prototype.hasOwnProperty.call(CORE_CAPABILITIES, cap) ||
+      (Object.prototype.hasOwnProperty.call(serverCaps, cap) && serverCaps[cap]);
+    if (!advertised) {
       throw new GuardJmapError("urn:ietf:params:jmap:error:unknownCapability",
         "guardJmap.validate: capability '" + cap + "' not advertised by this server");
     }

package/lib/guard-managesieve-command.js

@@ -202,10 +202,18 @@ var LITERAL_RE = /^\{([0-9]{1,10})(\+?)\}$/;
 function validate(line, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every line / script / script-name cap compares against
+  // `undefined` (fails open). An unknown posture is ignored (falls through
+  // to profile/default); an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardManageSieveCommandError("guard-managesieve-command/bad-profile",
       "guardManageSieveCommand.validate: unknown profile '" + profileName + "'");

package/lib/guard-pop3-command.js

@@ -155,10 +155,18 @@ var MSG_NUM_RE = /^[1-9][0-9]{0,9}$/;
 function validate(line, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every line / username / password cap compares against
+  // `undefined` (fails open). An unknown posture is ignored (falls through
+  // to profile/default); an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardPop3CommandError("guard-pop3-command/bad-profile",
       "guardPop3Command.validate: unknown profile '" + profileName + "'");

package/lib/jwk.js

@@ -58,8 +58,17 @@ function _requiredMembers(jwk) {
   if (typeof jwk.kty !== "string" || jwk.kty.length === 0) {
     throw new JwkError("jwk/bad-jwk", "jwk: 'kty' is required");
   }
+  // Own-property lookup only: `kty` is attacker-controlled, and a plain-object
+  // bracket read resolves inherited Object.prototype members (`__proto__`,
+  // `toString`, `valueOf`, `toLocaleString`, …). Those are truthy, so an
+  // unguarded `if (!names)` would treat them as supported key types — the
+  // zero-`length` prototype methods then iterate no required members and
+  // thumbprint the empty object, collapsing distinct inputs onto one
+  // predictable digest instead of the intended unsupported-kty refusal.
+  if (!Object.prototype.hasOwnProperty.call(REQUIRED, jwk.kty)) {
+    throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
+  }
   var names = REQUIRED[jwk.kty];
-  if (!names) throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
   var out = {};
   for (var i = 0; i < names.length; i++) {
     var n = names[i];
@@ -115,8 +124,16 @@ function canonicalize(jwk) {
  */
 function thumbprint(jwk, opts) {
   opts = opts || {};
-  var hash = HASHES[opts.hash || "sha256"];
-  if (!hash) throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  // Own-property lookup only — `opts.hash` is caller-controlled; a bare
+  // bracket read of the HASHES table resolves inherited members (`toString`,
+  // `constructor`, …) to truthy functions that slip past `!hash` and reach
+  // createHash as a non-string, leaking a raw ERR_INVALID_ARG_TYPE instead of
+  // the typed jwk/bad-hash refusal the primitive documents.
+  var hashName = opts.hash || "sha256";
+  if (!Object.prototype.hasOwnProperty.call(HASHES, hashName)) {
+    throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  }
+  var hash = HASHES[hashName];
   var canon = canonicalize(jwk);
   return nodeCrypto.createHash(hash).update(canon, "utf8").digest("base64url");
 }

package/lib/mtls-ca.js

@@ -607,7 +607,21 @@ function create(opts) {
         "framework's bundled CA engine, which supports it");
     }
     var ca = await initCA();
-    var revocations = revocationStore.list();
+    var allRevocations = revocationStore.list();
+    // A standard X.509 CRL (RFC 5280 §5.1) is keyed by certificate serial
+    // number. revoke({ fingerprint }) — a first-class revocation mode, and the
+    // value the require-mtls gate pins on — stores no serial (serialNumber is
+    // null). Such an entry cannot be represented in a CRL, so project it out
+    // here rather than handing a null serial to the CRL encoder: the encoder
+    // throws on it, which would break CRL generation for the ENTIRE registry,
+    // dropping the serial-keyed certs that CAN be published from every fresh
+    // CRL (a fail-open for those certs' published revocation). Fingerprint-only
+    // revocations stay enforced through isRevoked()/the mTLS gate, which is
+    // fingerprint-aware; the count that could not be represented is surfaced.
+    var revocations = allRevocations.filter(function (r) {
+      return r && r.serialNumber != null;
+    });
+    var fingerprintOnlyOmitted = allRevocations.length - revocations.length;
     var nowMs = Date.now();
     var thisUpdate = opts3.thisUpdate || new Date(nowMs);
     var nextUpdate = opts3.nextUpdate ||
@@ -627,7 +641,9 @@ function create(opts) {
       atomicFile.writeSync(paths.crl, crlPem, { mode: 0o644 });
     }
     return { crlPem: crlPem, thisUpdate: thisUpdate, nextUpdate: nextUpdate,
-             entryCount: revocations.length, path: paths.crl };
+             entryCount: revocations.length,
+             fingerprintOnlyOmitted: fingerprintOnlyOmitted,
+             path: paths.crl };
   }
 
   return {

package/lib/object-store/gcs.js

@@ -362,6 +362,13 @@ function create(config) {
 
     url.searchParams.set("X-Goog-Signature", signature);
 
+    // Final query mutation done — align the wire space encoding to the signed
+    // canonical query (GCS V4 signs "%20" but url.toString() would serialize a
+    // space as "+", so a spaced response-header override / prefix would be
+    // rejected as a signature mismatch). Must precede url.toString(); do not
+    // touch url.searchParams afterward (it re-serializes spaces back to "+").
+    sigv4.alignWireQueryToSigV4(url);
+
     var clientHeaders = {};
     if (opts.contentType) clientHeaders["Content-Type"] = opts.contentType;
 

package/lib/object-store/sigv4.js

@@ -120,6 +120,29 @@ function canonicalQueryString(searchParams) {
   }).join("&");
 }
 
+// Reconcile the wire query with the signed canonical query. The WHATWG URL
+// serializes its query via application/x-www-form-urlencoded, which encodes a
+// space as "+"; SigV4 signs canonicalQueryString, which encodes a space as
+// "%20" (AWS: "encode the space character as %20 and not +"). Left
+// unreconciled, a signed query parameter carrying a literal space (a
+// response-content-disposition filename, a list prefix) is transmitted
+// (url.search / url.toString) as "+" while the signature commits to "%20", so
+// the server re-canonicalizes to different bytes and rejects the request with
+// SignatureDoesNotMatch. A bare "+" in url.search is ALWAYS an encoded space —
+// URLSearchParams serializes a literal "+" as "%2B" and parses "+" back to a
+// space, so canonicalQueryString already signed that position as "%20";
+// rewriting "+" to "%20" makes the transmitted query byte-identical to the
+// signed canonical query. Bare subresource tokens (?uploads / ?lifecycle) carry
+// no "+", so they pass through untouched. Mutates url.search in place (the
+// string setter preserves "%20"); callers MUST NOT touch url.searchParams
+// afterward — that re-serializes spaces back to "+".
+function _alignWireQueryToSigV4(url) {
+  var search = url.search;
+  if (search.indexOf("+") !== -1) {
+    url.search = search.replace(/\+/g, "%20");   // allow:regex-no-length-cap — single-char global replace, input bounded by maxUrlLength
+  }
+}
+
 function canonicalHeaders(headers) {
   var pairs = [];
   for (var k in headers) {
@@ -233,6 +256,10 @@ function signRequest(opts) {
     ", Signature=" + signature;
   headers["Authorization"] = auth;
 
+  // The URL just signed is the one the caller transmits — make its wire query
+  // byte-identical to the canonical query the signature commits to.
+  _alignWireQueryToSigV4(url);
+
   return { headers: headers, signature: signature, canonicalRequest: canon, stringToSign: sts };
 }
 
@@ -810,6 +837,9 @@ function create(config) {
     var signature = nodeCrypto.createHmac("sha256", signingKey).update(sts).digest("hex");
 
     url.searchParams.set("X-Amz-Signature", signature);
+    // Final query mutation done — align the wire space encoding to the signed
+    // "%20" form before serializing the URL the client will use.
+    _alignWireQueryToSigV4(url);
 
     var clientHeaders = {};
     if (opts.contentType) clientHeaders["Content-Type"] = opts.contentType;
@@ -994,6 +1024,7 @@ module.exports = {
   deriveSigningKey:     deriveSigningKey,
   canonicalQueryString: canonicalQueryString,
   canonicalHeaders:     canonicalHeaders,
+  alignWireQueryToSigV4: _alignWireQueryToSigV4,
   awsUriEncode:         awsUriEncode,
   sha256Hex:            sha256Hex,
   formatAmzDate:        _formatAmzDate,

package/lib/safe-ical.js

@@ -281,14 +281,18 @@ function _resolveCaps(opts) {
   if (typeof opts.profile === "string") {
     name = opts.profile;
   } else if (typeof opts.compliancePosture === "string") {
-    name = COMPLIANCE_POSTURES[opts.compliancePosture] || "strict";
+    name = Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.compliancePosture)
+      ? COMPLIANCE_POSTURES[opts.compliancePosture] : "strict";
   }
-  var caps = PROFILES[name];
-  if (!caps) {
+  // Own-property lookup: `name` derives from attacker/operator opts.profile, so
+  // a bare `if (!PROFILES[name])` would let a prototype key ("constructor") pass
+  // as a known profile and run under an inherited member (fail-open).
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, name)) {
     throw new SafeIcalError("safe-ical/bad-opt",
       "safeIcal.parse: unknown profile '" + name +
       "' (expected strict|balanced|permissive)");
   }
+  var caps = PROFILES[name];
   return caps;
 }
 

package/lib/safe-mime.js

@@ -750,7 +750,18 @@ function _filenameFromHeaders(headers) {
       }
       if (/^[A-Za-z0-9_-]+'[A-Za-z0-9_-]*'/.test(raw)) {
         var enc = raw.split("'");
-        return decodeURIComponent(enc[2]);
+        // RFC 2231 / 5987 ext-value percent-decode. A hostile
+        // `filename*=UTF-8''%` (truncated %-escape, non-hex digits, or a
+        // %-escape sequence that isn't valid UTF-8) makes decodeURIComponent
+        // throw a raw URIError, which would escape the SafeMimeError contract
+        // and crash the attachment walk. Degrade to the still-encoded segment
+        // — best-effort, and downstream filename guards handle the raw form —
+        // matching every other decodeURIComponent site in the framework.
+        try {
+          return decodeURIComponent(enc[2]);
+        } catch (_e) {
+          return enc[2];
+        }
       }
       return raw;
     }

package/lib/safe-vcard.js

@@ -225,14 +225,18 @@ function _resolveCaps(opts) {
   if (typeof opts.profile === "string") {
     name = opts.profile;
   } else if (typeof opts.compliancePosture === "string") {
-    name = COMPLIANCE_POSTURES[opts.compliancePosture] || "strict";
+    name = Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.compliancePosture)
+      ? COMPLIANCE_POSTURES[opts.compliancePosture] : "strict";
   }
-  var caps = PROFILES[name];
-  if (!caps) {
+  // Own-property lookup: `name` derives from attacker/operator opts.profile, so
+  // a bare `if (!PROFILES[name])` would let a prototype key ("constructor") pass
+  // as a known profile and run under an inherited member (fail-open).
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, name)) {
     throw new SafeVcardError("safe-vcard/bad-opt",
       "safeVcard.parse: unknown profile '" + name +
       "' (expected strict|balanced|permissive)");
   }
+  var caps = PROFILES[name];
   return caps;
 }
 

package/lib/tsa.js

@@ -122,11 +122,11 @@ function _normHex(h) {
 // Resolve the message imprint: hash the data, or use a pre-computed hash.
 function _imprint(data, opts, fnName) {
   var hashName = opts.hashAlg || "SHA-512";
-  var h = IMPRINT_HASHES[hashName];
-  if (!h) {
+  if (!Object.prototype.hasOwnProperty.call(IMPRINT_HASHES, hashName)) {
     throw new TsaError("tsa/bad-hash-alg",
       fnName + ": hashAlg must be one of " + Object.keys(IMPRINT_HASHES).join(" / "));
   }
+  var h = IMPRINT_HASHES[hashName];
   var digest;
   if (opts.hashed) {
     digest = _bytes(data, "hash");

package/lib/vc.js

@@ -247,10 +247,10 @@ function _sign(doc, opts, joseTyp, coseTyp, coseContentType, fnName) {
     });
   }
   if (opts.securing === "jose") {
-    var params = JOSE_ALGS[opts.alg];
-    if (!params) {
+    if (!Object.prototype.hasOwnProperty.call(JOSE_ALGS, opts.alg)) {
       throw new VcError("vc/bad-alg", fnName + ": JOSE securing requires alg ES256/384/512 or EdDSA (got " + opts.alg + ")");
     }
+    var params = JOSE_ALGS[opts.alg];
     var key = _toKey(opts.privateKey, "private");
     var header = { alg: opts.alg, typ: joseTyp };
     if (typeof opts.kid === "string") header.kid = opts.kid;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.40",
+  "version": "0.17.1",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:450ccb8a-2242-4a61-a57f-516b6c8e1325",
+  "serialNumber": "urn:uuid:04849b6a-ae7a-43f3-939a-e67a488f6a49",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T03:08:43.327Z",
+    "timestamp": "2026-07-17T08:07:44.038Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.40",
+      "bom-ref": "@blamejs/core@0.17.1",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.40",
+      "version": "0.17.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.40",
+      "purl": "pkg:npm/%40blamejs/core@0.17.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.40",
+      "ref": "@blamejs/core@0.17.1",
       "dependsOn": []
     }
   ]