@blamejs/core 0.17.0 → 0.17.1

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.17.x
 
+- v0.17.1 (2026-07-17) — **Profile, posture, and capability name lookups across the content-safety and mail-protocol guards reject a prototype-member name instead of running under it, the mTLS CA can generate a CRL after a fingerprint-only revocation, and a hostile MIME filename no longer crashes attachment extraction.** A second family of guards resolved a profile, posture, or capability name against a plain-object lookup table with a truthiness or in-operator guard, so a name that is an inherited Object.prototype member (constructor, __proto__, toString) slipped the guard and the gate ran under the inherited member instead of refusing the unknown name. The shared profile resolver (b.gateContract.makeProfileResolver, which the guard family composes), the iCal and vCard content guards, the dark-patterns posture check, the JMAP capability allowlist, and the IMAP/POP3/ManageSieve command guards now all resolve names through an own-property check. Separately, b.mtlsCa.generateCrl crashed with a null-serial error once any certificate had been revoked by fingerprint (the mode the require-mTLS gate pins on), dropping every serial-keyed revocation from the published CRL; and b.safeMime.extractAttachments threw an uncaught URIError on a hostile Content-Disposition filename with a malformed percent-escape, crashing the caller. **Fixed:** *mTLS CA generates a CRL after a fingerprint-only revocation* — b.mtlsCa.revoke accepts a certificate fingerprint (the value the require-mTLS gate pins on and generateClientCert surfaces for exactly this use), which is stored without a serial number. b.mtlsCa.generateCrl then mapped the whole revocation registry into CRL entries and handed the null serial to the CRL encoder, which threw -- aborting CRL generation entirely. Because one fingerprint-only revocation broke every subsequent CRL build, all serial-keyed revocations were silently dropped from the published CRL and it could never be regenerated, going stale for external CRL-based revocation checking. generateCrl now projects out fingerprint-only entries (which a standard X.509 CRL cannot represent) before encoding and reports how many were omitted; fingerprint-only revocations remain enforced through the mTLS gate, and the CRL publishes every serial-keyed revocation. · *A hostile MIME filename no longer crashes attachment extraction* — b.safeMime.extractAttachments decoded an RFC 2231 / RFC 5987 extended filename parameter (filename*=charset''percent-encoded) with an unguarded percent-decode, so a malformed escape -- a truncated %, a non-hex %ZZ, or a sequence that decodes to invalid UTF-8 -- threw an uncaught URIError that escaped the parser's typed-error contract and crashed the caller (for example a mail store extracting attachments). A one-line hostile Content-Disposition header was a trivial denial of service. The decode now degrades to the still-encoded filename on failure, matching the framework's handling of every other percent-decode site, so a hostile filename yields a best-effort name that downstream filename guards still vet rather than a crash. **Security:** *Guard profile, posture, and capability lookups reject a prototype-member name* — A group of content-safety and mail-protocol guards resolved a caller- or request-supplied profile / posture / capability name against a plain-object lookup table using a truthiness check (var caps = TABLE[name]; if (!caps)) or the prototype-chain-aware in operator. A name that names an inherited Object.prototype member -- constructor, __proto__, toString -- is truthy (or present via the prototype chain), so it slipped the guard and the gate ran under the inherited member instead of refusing the unknown name. The shared resolver b.gateContract.makeProfileResolver (composed by the idempotency-key, mail-compose, message-id and other guards) now guards both its posture and profile lookups with hasOwnProperty; b.safeIcal, b.safeVcard, b.darkPatterns, b.guardJmap (capability allowlist and profile/posture), and the b.guardImapCommand / b.guardPop3Command / b.guardManageSieveCommand command guards do the same. An unknown or prototype-member name is now rejected with the guard's typed error; supported names are unaffected. This extends the same own-property hardening applied to the crypto algorithm-table lookups in 0.17.0 to the guard-family profile resolvers.
+
 - v0.17.0 (2026-07-17) — **Algorithm and key-type lookups across the crypto verifiers reject a prototype-member name instead of accepting it, the ZIP reader honors the operator's decompression-ratio policy, and signed S3/GCS query parameters transmit the space encoding they were signed with.** A family of verifiers resolved an algorithm, hash, or key-type name against a plain-object lookup table with a truthiness or `in`-operator guard, so a name that is an inherited Object.prototype member (constructor, __proto__, toString, valueOf) slipped the guard and resolved to the inherited member: b.jwk thumbprinted an attacker-crafted key to a predictable digest, b.vc and b.contentCredentials emitted a real signature under a bogus algorithm, and b.sdJwtVc accepted an attacker-controlled hash name from an unsigned issuer payload. All of them now reject a name that is not an own property of the table. Separately, b.archive's ZIP reader silently capped the decompression ratio at its composed default and ignored the operator's configured bomb policy, refusing legitimate highly-compressible entries; and b.storage's SigV4 (and the GCS V4 presigner) signed a query space as %20 but transmitted it as +, so a signed parameter carrying a space was rejected as a signature mismatch. **Fixed:** *ZIP extraction honors the operator's decompression-ratio policy* — b.archive's random-access ZIP reader composed b.safeDecompress for each DEFLATE entry without forwarding the reader's own expansion-ratio cap, so the decompression inherited safeDecompress's stricter default ratio and silently overrode the operator's configured bomb policy. A ZIP entry that legitimately compressed better than the default ratio (logs, JSON, telemetry, zero-padded or sparse binaries) was refused even when the operator's policy permitted it. The reader now forwards its configured maximum expansion ratio into the decode, so the actual-bytes ratio re-check uses the same cap the declared-size gate already enforced. · *Signed S3 and GCS query parameters transmit the space encoding they were signed with* — b.storage's SigV4 request signing (S3, R2, MinIO, and the S3-compatible backends) and the GCS V4 presigner sign the canonical query string, which encodes a space as %20 per the AWS/GCS specification, but transmitted the request via the WHATWG URL serializer, which encodes a space as +. A signed query parameter carrying a literal space -- a response-content-disposition filename or a list prefix -- was therefore signed over %20 but sent as +, so the storage server re-canonicalized to different bytes and rejected the request with a signature mismatch. The signer now aligns the wire query to the signed canonical encoding (rewriting a bare + back to %20) at each signing sink, so the transmitted query is byte-identical to what the signature commits to. **Security:** *Crypto algorithm and key-type lookups reject a prototype-member name* — Several verifiers resolved a caller- or attacker-supplied algorithm / hash / key-type name against a plain-object lookup table using a truthiness check (`var v = TABLE[name]; if (!v) reject`) or the prototype-chain-aware `in` operator. A name that names an inherited Object.prototype member -- constructor, __proto__, toString, valueOf, toLocaleString -- is truthy (or present via the prototype chain), so it slipped the guard and resolved to the inherited member. The observed consequences: b.jwk.thumbprint / canonicalize accepted an unsupported kty and thumbprinted the key to a single predictable digest; b.vc.issue (JOSE) and b.contentCredentials.signCose emitted a real signature under a bogus algorithm id; and b.sdJwtVc.present accepted an attacker-controlled _sd_alg read from the unsigned issuer payload. b.tsa and the SD-JWT hash-disclosure path returned a raw runtime error rather than a typed rejection. Every one of these table lookups now checks Object.prototype.hasOwnProperty before indexing, so a name that is not an own member of the table is rejected with the primitive's typed error. Supported algorithm and key-type names are unaffected.
 
 ## v0.16.x

package/lib/dark-patterns.js

@@ -266,11 +266,14 @@ function assertParity(signup, cancel, opts) {
       "darkPatterns.assertParity: resourceId differs between flows");
   }
   var postureName = opts.posture || "ftc-2024";
-  var posture = POSTURES[postureName];
-  if (!posture) {
+  // Own-property lookup: postureName is operator input, so a bare
+  // `POSTURES[postureName]` with a truthiness guard would let a prototype key
+  // ("constructor") resolve to an inherited member and run under it (fail-open).
+  if (!Object.prototype.hasOwnProperty.call(POSTURES, postureName)) {
     throw errorClass.factory("dark-patterns/bad-posture",
       "darkPatterns.assertParity: unknown posture " + postureName);
   }
+  var posture = POSTURES[postureName];
 
   var toleranceClicks   = typeof opts.toleranceClicks === "number"
     ? opts.toleranceClicks : posture.toleranceClicks;

package/lib/gate-contract.js

@@ -1190,12 +1190,20 @@ function makeProfileResolver(cfg) {
   var label      = _guardLabelFromError(ErrorClass);
   return function resolveProfile(opts) {
     opts = opts || {};
-    if (opts.posture && postures && postures[opts.posture]) {
+    // Own-property lookups only: opts.posture / opts.profile are attacker/
+    // operator input, so a bare bracket read would let a prototype key
+    // ("constructor" / "__proto__" / "toString") resolve to an inherited
+    // truthy member — the posture read would return it as the profile name,
+    // and `!profiles[p]` would treat it as a known profile and skip the
+    // bad-profile refusal, running the gate under a bogus profile (fail-open).
+    if (opts.posture && postures &&
+        Object.prototype.hasOwnProperty.call(postures, opts.posture) &&
+        postures[opts.posture]) {
       var pn = postures[opts.posture];
       return byObject ? profiles[pn] : pn;
     }
     var p = opts.profile || dft;
-    if (!profiles[p]) {
+    if (!Object.prototype.hasOwnProperty.call(profiles, p)) {
       throw ErrorClass.factory(codePrefix + "/bad-profile",
         label + ": unknown profile '" + p + "' (use " +
         Object.keys(profiles).join(" / ") + ")");

package/lib/guard-imap-command.js

@@ -198,10 +198,18 @@ var LITERAL_SMUGGLE_RE = /\{[0-9]+\+?\}(?!\s*$)/;
 function validate(line, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every byte / literal cap compares against `undefined` (fails
+  // open). An unknown posture is ignored (falls through to profile/default);
+  // an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardImapCommandError("guard-imap-command/bad-profile",
       "guardImapCommand.validate: unknown profile '" + profileName + "'");

package/lib/guard-jmap.js

@@ -133,10 +133,18 @@ var CORE_CAPABILITIES = Object.freeze({
 function validate(rawBody, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every size / count cap compares against `undefined` (fails
+  // open). An unknown posture is ignored (falls through to profile/default)
+  // as before; an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardJmapError("guard-jmap/bad-profile",
       "guardJmap.validate: unknown profile '" + profileName + "'");
@@ -198,7 +206,15 @@ function validate(rawBody, opts) {
       throw new GuardJmapError("urn:ietf:params:jmap:error:invalidArguments",
         "guardJmap.validate: `using[" + ui + "]` must be a string capability URI");
     }
-    if (!Object.prototype.hasOwnProperty.call(CORE_CAPABILITIES, cap) && !serverCaps[cap]) {
+    // hasOwnProperty on both tables: `cap` is attacker-supplied (from the
+    // request body). A bare `serverCaps[cap]` bracket read resolves an
+    // inherited Object.prototype member (constructor / __proto__ / toString
+    // / ...) to a truthy value, letting a prototype-key capability pass the
+    // allowlist the server never advertised. Own-key AND truthy preserves
+    // the operator's "capability: false disables it" semantics.
+    var advertised = Object.prototype.hasOwnProperty.call(CORE_CAPABILITIES, cap) ||
+      (Object.prototype.hasOwnProperty.call(serverCaps, cap) && serverCaps[cap]);
+    if (!advertised) {
       throw new GuardJmapError("urn:ietf:params:jmap:error:unknownCapability",
         "guardJmap.validate: capability '" + cap + "' not advertised by this server");
     }

package/lib/guard-managesieve-command.js

@@ -202,10 +202,18 @@ var LITERAL_RE = /^\{([0-9]{1,10})(\+?)\}$/;
 function validate(line, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every line / script / script-name cap compares against
+  // `undefined` (fails open). An unknown posture is ignored (falls through
+  // to profile/default); an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardManageSieveCommandError("guard-managesieve-command/bad-profile",
       "guardManageSieveCommand.validate: unknown profile '" + profileName + "'");

package/lib/guard-pop3-command.js

@@ -155,10 +155,18 @@ var MSG_NUM_RE = /^[1-9][0-9]{0,9}$/;
 function validate(line, opts) {
   opts = opts || {};
   var profileName = typeof opts.profile === "string" ? opts.profile : DEFAULT_PROFILE;
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
+  // hasOwnProperty on both lookups: opts.profile / opts.posture are caller
+  // input, and a bare bracket read resolves an inherited Object.prototype
+  // key (constructor / __proto__ / toString / ...) to a truthy value —
+  // PROFILES["constructor"] is the Object function, so `if (!caps)` never
+  // fires and every line / username / password cap compares against
+  // `undefined` (fails open). An unknown posture is ignored (falls through
+  // to profile/default); an unknown profile throws bad-profile.
+  if (opts.posture && Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.posture)) {
     profileName = COMPLIANCE_POSTURES[opts.posture];
   }
-  var caps = PROFILES[profileName];
+  var caps = Object.prototype.hasOwnProperty.call(PROFILES, profileName)
+    ? PROFILES[profileName] : undefined;
   if (!caps) {
     throw new GuardPop3CommandError("guard-pop3-command/bad-profile",
       "guardPop3Command.validate: unknown profile '" + profileName + "'");

package/lib/mtls-ca.js

@@ -607,7 +607,21 @@ function create(opts) {
         "framework's bundled CA engine, which supports it");
     }
     var ca = await initCA();
-    var revocations = revocationStore.list();
+    var allRevocations = revocationStore.list();
+    // A standard X.509 CRL (RFC 5280 §5.1) is keyed by certificate serial
+    // number. revoke({ fingerprint }) — a first-class revocation mode, and the
+    // value the require-mtls gate pins on — stores no serial (serialNumber is
+    // null). Such an entry cannot be represented in a CRL, so project it out
+    // here rather than handing a null serial to the CRL encoder: the encoder
+    // throws on it, which would break CRL generation for the ENTIRE registry,
+    // dropping the serial-keyed certs that CAN be published from every fresh
+    // CRL (a fail-open for those certs' published revocation). Fingerprint-only
+    // revocations stay enforced through isRevoked()/the mTLS gate, which is
+    // fingerprint-aware; the count that could not be represented is surfaced.
+    var revocations = allRevocations.filter(function (r) {
+      return r && r.serialNumber != null;
+    });
+    var fingerprintOnlyOmitted = allRevocations.length - revocations.length;
     var nowMs = Date.now();
     var thisUpdate = opts3.thisUpdate || new Date(nowMs);
     var nextUpdate = opts3.nextUpdate ||
@@ -627,7 +641,9 @@ function create(opts) {
       atomicFile.writeSync(paths.crl, crlPem, { mode: 0o644 });
     }
     return { crlPem: crlPem, thisUpdate: thisUpdate, nextUpdate: nextUpdate,
-             entryCount: revocations.length, path: paths.crl };
+             entryCount: revocations.length,
+             fingerprintOnlyOmitted: fingerprintOnlyOmitted,
+             path: paths.crl };
   }
 
   return {

package/lib/safe-ical.js

@@ -281,14 +281,18 @@ function _resolveCaps(opts) {
   if (typeof opts.profile === "string") {
     name = opts.profile;
   } else if (typeof opts.compliancePosture === "string") {
-    name = COMPLIANCE_POSTURES[opts.compliancePosture] || "strict";
+    name = Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.compliancePosture)
+      ? COMPLIANCE_POSTURES[opts.compliancePosture] : "strict";
   }
-  var caps = PROFILES[name];
-  if (!caps) {
+  // Own-property lookup: `name` derives from attacker/operator opts.profile, so
+  // a bare `if (!PROFILES[name])` would let a prototype key ("constructor") pass
+  // as a known profile and run under an inherited member (fail-open).
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, name)) {
     throw new SafeIcalError("safe-ical/bad-opt",
       "safeIcal.parse: unknown profile '" + name +
       "' (expected strict|balanced|permissive)");
   }
+  var caps = PROFILES[name];
   return caps;
 }
 

package/lib/safe-mime.js

@@ -750,7 +750,18 @@ function _filenameFromHeaders(headers) {
       }
       if (/^[A-Za-z0-9_-]+'[A-Za-z0-9_-]*'/.test(raw)) {
         var enc = raw.split("'");
-        return decodeURIComponent(enc[2]);
+        // RFC 2231 / 5987 ext-value percent-decode. A hostile
+        // `filename*=UTF-8''%` (truncated %-escape, non-hex digits, or a
+        // %-escape sequence that isn't valid UTF-8) makes decodeURIComponent
+        // throw a raw URIError, which would escape the SafeMimeError contract
+        // and crash the attachment walk. Degrade to the still-encoded segment
+        // — best-effort, and downstream filename guards handle the raw form —
+        // matching every other decodeURIComponent site in the framework.
+        try {
+          return decodeURIComponent(enc[2]);
+        } catch (_e) {
+          return enc[2];
+        }
       }
       return raw;
     }

package/lib/safe-vcard.js

@@ -225,14 +225,18 @@ function _resolveCaps(opts) {
   if (typeof opts.profile === "string") {
     name = opts.profile;
   } else if (typeof opts.compliancePosture === "string") {
-    name = COMPLIANCE_POSTURES[opts.compliancePosture] || "strict";
+    name = Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.compliancePosture)
+      ? COMPLIANCE_POSTURES[opts.compliancePosture] : "strict";
   }
-  var caps = PROFILES[name];
-  if (!caps) {
+  // Own-property lookup: `name` derives from attacker/operator opts.profile, so
+  // a bare `if (!PROFILES[name])` would let a prototype key ("constructor") pass
+  // as a known profile and run under an inherited member (fail-open).
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, name)) {
     throw new SafeVcardError("safe-vcard/bad-opt",
       "safeVcard.parse: unknown profile '" + name +
       "' (expected strict|balanced|permissive)");
   }
+  var caps = PROFILES[name];
   return caps;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:cbebf8cd-986b-48a0-823b-7bd7981981bf",
+  "serialNumber": "urn:uuid:04849b6a-ae7a-43f3-939a-e67a488f6a49",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T06:14:29.525Z",
+    "timestamp": "2026-07-17T08:07:44.038Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.17.0",
+      "bom-ref": "@blamejs/core@0.17.1",
       "type": "application",
       "name": "blamejs",
-      "version": "0.17.0",
+      "version": "0.17.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.17.0",
+      "purl": "pkg:npm/%40blamejs/core@0.17.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.17.0",
+      "ref": "@blamejs/core@0.17.1",
       "dependsOn": []
     }
   ]