@blamejs/core 0.17.12 → 0.17.14

package/lib/ssrf-guard.js

@@ -820,6 +820,56 @@ function isPrivate(ip)       { return classify(ip) === "private"; }
  */
 function isLoopback(ip)      { return classify(ip) === "loopback"; }
 
+/**
+ * @primitive b.ssrfGuard.isLoopbackHost
+ * @signature b.ssrfGuard.isLoopbackHost(host)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.ssrfGuard.isExactLoopbackName, b.ssrfGuard.isLoopback, b.ssrfGuard.canonicalizeHost
+ *
+ * Hostname-aware loopback test. Unlike `isLoopback` (IP literals only) this
+ * canonicalizes `host` (strips `[]` brackets + trailing dots, folds an
+ * IPv4-mapped IPv6, lowercases) and returns `true` for a loopback IP literal
+ * OR the RFC 6761 §6.3 reserved names `localhost` and any `*.localhost`. Pure
+ * name-shape — never resolves DNS.
+ *
+ * @example
+ *   b.ssrfGuard.isLoopbackHost("localhost");     // → true
+ *   b.ssrfGuard.isLoopbackHost("[::1]");          // → true
+ *   b.ssrfGuard.isLoopbackHost("app.localhost");  // → true
+ *   b.ssrfGuard.isLoopbackHost("example.com");    // → false
+ */
+function isLoopbackHost(host) {
+  if (typeof host !== "string" || host.length === 0) return false;
+  var canon = canonicalizeHost(host);
+  if (net.isIP(canon)) return classify(canon) === "loopback";
+  return canon === "localhost" || /\.localhost$/.test(canon);
+}
+
+/**
+ * @primitive b.ssrfGuard.isExactLoopbackName
+ * @signature b.ssrfGuard.isExactLoopbackName(host)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.ssrfGuard.isLoopbackHost
+ *
+ * Like `isLoopbackHost` but WITHOUT the `*.localhost` subdomain reservation —
+ * accepts only the exact `localhost` name or a loopback IP literal. For the
+ * OAuth/OIDC cleartext-redirect loopback exception (RFC 9700 §4.1.1), which
+ * must not widen to a `*.localhost` name an attacker could register in a resolver.
+ *
+ * @example
+ *   b.ssrfGuard.isExactLoopbackName("localhost");     // → true
+ *   b.ssrfGuard.isExactLoopbackName("127.0.0.1");     // → true
+ *   b.ssrfGuard.isExactLoopbackName("app.localhost"); // → false
+ */
+function isExactLoopbackName(host) {
+  if (typeof host !== "string" || host.length === 0) return false;
+  var canon = canonicalizeHost(host);
+  if (net.isIP(canon)) return classify(canon) === "loopback";
+  return canon === "localhost";
+}
+
 /**
  * @primitive b.ssrfGuard.isLinkLocal
  * @signature b.ssrfGuard.isLinkLocal(ip)
@@ -958,6 +1008,8 @@ module.exports = {
   createAllowlist:  createAllowlist,
   isPrivate:        isPrivate,
   isLoopback:       isLoopback,
+  isLoopbackHost:   isLoopbackHost,
+  isExactLoopbackName: isExactLoopbackName,
   isLinkLocal:      isLinkLocal,
   isCloudMetadata:  isCloudMetadata,
   isReserved:       isReserved,

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-07-23T03:16:00.999Z"
+      "refreshedAt": "2026-07-23T22:29:23.692Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-07-23T03:16:00.999Z"
+      "refreshedAt": "2026-07-23T22:29:23.692Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-07-23T03:16:00.999Z"
+      "refreshedAt": "2026-07-23T22:29:23.692Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-07-23T03:16:00.999Z"
+      "refreshedAt": "2026-07-23T22:29:23.692Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-23T03:16:00.999Z"
+      "refreshedAt": "2026-07-23T22:29:23.692Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-23T03:16:00.999Z"
+      "refreshedAt": "2026-07-23T22:29:23.692Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -152,14 +152,14 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-07-22T00:00:00Z",
+      "bundledAt": "2026-07-23T00:00:00Z",
       "hashes": {
-        "server": "sha256:239445596e15e13c345bab8f5118a617ae3e61e4e1df437728c14cbf4aaef716",
-        "data_js": "sha256:0742bf237375961822070329cda24c866afd3c711262fafa748a40443ec18a6e"
+        "server": "sha256:04220f6e1c20c9af1edfcd891dd4663b2c92a020b13e698dd13b3630573520ca",
+        "data_js": "sha256:52428436de68a79537db52f2b0cb7ac0a1cc3e6397db87533c6e2f1bd2e12087"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-23T03:16:00.999Z"
+      "refreshedAt": "2026-07-23T22:29:23.692Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:2307ef65e070757ffb13442b377e45efb9fa1a10432d9b39618387720ab990ed"
       },
-      "refreshedAt": "2026-07-23T03:16:00.999Z"
+      "refreshedAt": "2026-07-23T22:29:23.692Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-07-22_17-32-17_UTC
-// COMMIT: 8ab4253fd2cbaf4c411bd7ccea56bff0db0e82cf
+// VERSION: 2026-07-23_18-24-27_UTC
+// COMMIT: 93b4eb174b2da9ee3f6effc363b579a96a65c93a
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -12918,11 +12918,6 @@ deployagent.space
 // Submitted by Peter Thomassen <peter@desec.io>
 dedyn.io
 
-// Deta : https://www.deta.sh/
-// Submitted by Aavash Shrestha <aavash@deta.sh>
-deta.app
-deta.dev
-
 // Deuxfleurs : https://deuxfleurs.fr
 // Submitted by Aeddis Desauw <ca@deuxfleurs.fr>
 deuxfleurs.eu
@@ -15210,6 +15205,10 @@ us.platform.sh
 *.platformsh.site
 *.tst.site
 
+// Playcode : https://playcode.io
+// Submitted by Ruslan Ianberdin <security@playcode.io>
+playcode.site
+
 // Pley AB : https://www.pley.com/
 // Submitted by Henning Pohl <infra@pley.com>
 pley.games