@blamejs/core 0.17.16 → 0.17.17

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.17.x
 
+- v0.17.17 (2026-07-23) — **Three verifier hardening fixes: timestamp trust anchors are required by default, OIDC id_token verification requires a configured issuer, and ed25519 DKIM uses the RFC 8463 raw-key format.** An audit of the signature-verifier surface found three verifiers that accepted or rejected the wrong thing. b.tsa.verifyToken authenticated a timestamp against a certificate embedded in the token itself and only ran the trust-anchor chain when the caller supplied one, so a self-signed token carrying the timestamping EKU was accepted as a valid timestamp; trust anchors are now required by default. b.auth.oauth's verifyIdToken skipped the CVE-2026-23552 cross-realm iss check entirely when the client was created without an issuer, so any OIDC id_token verified regardless of its issuer; an OIDC client must now be configured with an issuer to verify id_tokens. And the ed25519 DKIM verifier could not read the RFC 8463 raw 32-byte key format that every conformant sender publishes -- while the framework's own bootstrap published the non-standard SPKI form -- so ed25519, the default DKIM algorithm, was non-interoperable in both directions. **Fixed:** *ed25519 DKIM uses the RFC 8463 raw-key format on both sign and verify* — RFC 8463 §3-4 publishes an ed25519 DKIM public key as the raw 32-byte key, base64'd -- the form every conformant sender uses -- but the verifier wrapped that raw key in SubjectPublicKeyInfo PEM markers, which is not valid SPKI, so createPublicKey threw and a valid ed25519 signature returned permerror. Compounding it, b.mail.dkim.bootstrap published the key as SPKI DER (60 base64 chars) instead of the raw form (44 chars), so the framework's own default-algorithm signatures would not verify at a conformant receiver. The verifier now accepts a raw 32-byte key (wrapping it in the ed25519 SPKI header) and bootstrap publishes the raw key; RSA is unchanged. The same raw-key handling is applied on the ARC (b.mail.arc.verify) message-signature path. **Security:** *Timestamp verification requires a trust anchor by default* — b.tsa.verifyToken verified an RFC 3161 timestamp against the signer certificate embedded in the token -- which is attacker-controlled -- and ran the certificate-chain / trust-anchor check only when the caller passed trustAnchorsPem. With it omitted, a token whose self-signed leaf carried a critical, sole id-kp-timeStamping EKU was accepted as a valid timestamp: a forged proof that data existed at an arbitrary time (RFC 3161 §2.4.2 requires a trusted TSA). trustAnchorsPem is now required by default; an operator who deliberately wants trust-anchor-free verification sets allowUntrustedIssuer:true and the result carries issuerTrusted:false so the unauthenticated posture is visible (mirrors b.mdoc.verifyIssuerSigned). · *OIDC id_token verification requires a configured issuer* — b.auth.oauth.verifyIdToken wrapped the expected-issuer comparison -- the CVE-2026-23552 cross-realm / cross-issuer defense -- in a check that ran only when the client was configured with an issuer. An OIDC client (the default) created without an issuer therefore accepted an id_token with any iss, or none, as long as the signature, aud, and exp were valid: exactly the cross-realm acceptance the verifier exists to close, dangerous against a shared-signing-key multi-tenant OP. verifyIdToken now refuses to verify an OIDC id_token when no expected issuer is configured (OIDC Core §3.1.3.7); pass issuer to b.auth.oauth.create().
+
 - v0.17.16 (2026-07-23) — **A shared path-containment primitive backs both the strict resolver and static file serving.** b.safePath.resolve and b.staticServe each hand-rolled the same lexical traversal-containment check -- resolve a request path against a base and confirm it stays strictly inside. That core is now one primitive, b.safePath.confineToBase, which both compose: resolve layers its user-input strictness (reserved names, NTFS ADS markers, bidi, control chars) on top, while static serving composes only the bare containment and keeps its own separate basename gate. Static serving keeps that separation deliberately -- its containment barrier and its per-file guardFilename validation are distinct concerns -- and inherits the resolver's cross-platform-aware containment, which the runtime path module missed for a backslash traversal on a POSIX host. Static serving's basename policy is unchanged. **Added:** *b.safePath.confineToBase -- the lexical traversal-containment core* — b.safePath.confineToBase(base, rel, opts?) resolves rel against base using the target platform's path semantics and returns the confined absolute path, or null if it escapes. It is the containment barrier b.safePath.resolve layers its user-input strictness on top of, exposed for a consumer that wants ONLY traversal containment and applies its own, differently-calibrated filename validation -- so it does not reject a reserved name, NTFS ADS marker, or trailing dot the way resolve does for untrusted input. opts.platform forces windows path semantics on any host. **Changed:** *Static file serving composes the shared containment primitive* — b.staticServe's path-traversal barrier now composes b.safePath.confineToBase for its final lexical containment instead of a hand-rolled join + base-prefix check, so both the strict resolver and static serving route through one implementation. Static serving gains the cross-platform-aware containment (the runtime path module treats the other platform's separator as an ordinary filename character and missed a backslash traversal on a POSIX host). Serve behavior is unchanged: containment and the separate per-file guardFilename basename gate remain distinct steps, and static composes only the containment core rather than resolve so it does not fuse resolve's all-segment user-input strictness into the barrier (which would reject a legitimate colon-named intermediate directory that the basename gate permits). The basename policy itself is untouched.
 
 - v0.17.15 (2026-07-23) — **The standalone multipart parser honors storage: memory and every other documented upload knob.** b.parsers.multipart(req, opts) is documented as a thin wrapper over the same engine b.middleware.bodyParser drives, but its option resolver carried a hand-maintained passthrough list that had drifted: storage ("disk" | "memory") and filenameCharsets were silently dropped, so a serverless / read-only-filesystem handler passing storage: "memory" got disk mode instead and threw when the parser tried to open a temp file. The passthrough is now derived from the parser's own defaults, so every documented knob reaches the standalone path and a future knob cannot silently vanish, and an invalid storage value throws at the call the same way the middleware does instead of falling through to disk. **Fixed:** *b.parsers.multipart honors storage: memory and filenameCharsets* — The standalone multipart parser's option resolver passed through a hand-maintained subset of the multipart knobs, omitting storage and filenameCharsets: b.parsers.multipart(req, { storage: "memory" }) silently used disk mode and then threw on a read-only / serverless filesystem, and a filename*=ISO-8859-1'' part could not be opted in via filenameCharsets. The passthrough is now derived from the parser's DEFAULTS so every documented knob reaches the standalone path (only the maxBytes/maxFiles aliases and the dispatch-only contentTypes are excluded), and an invalid storage value throws a TypeError at the call rather than falling back to disk -- matching b.middleware.bodyParser.

package/lib/auth/oauth.js

@@ -2027,6 +2027,16 @@ function create(opts) {
     if (typeof payload.nbf === "number" && payload.nbf - skewSec > now) {
       throw new OAuthError("auth-oauth/nbf-future", "ID token nbf is in the future");
     }
+    if (isOidc && !issuer) {
+      // An OIDC id_token carries an `iss` that MUST be validated against a
+      // configured expected issuer (OIDC Core §3.1.3.7). With no issuer set the
+      // iss comparison below would be skipped entirely — the CVE-2026-23552
+      // cross-realm acceptance this verifier exists to close. Fail closed
+      // rather than accept an id_token whose issuer can't be authenticated.
+      throw new OAuthError("auth-oauth/issuer-required",
+        "verifyIdToken: an OIDC client must be configured with `issuer` to validate the " +
+        "id_token's iss (OIDC Core 3.1.3.7 / cross-realm-JWT defense); pass issuer to b.auth.oauth.create()");
+    }
     if (issuer) {
       // CVE-2026-23552 — cross-realm / cross-issuer JWT acceptance. The
       // expected issuer is operator-supplied; payload.iss is attacker-

package/lib/mail-auth.js

@@ -1849,6 +1849,19 @@ async function _verifyArc(rfc822, hop, allHops, kind, dnsLookup, dkim) {
   var asUnsigned = dkim._stripBTagValue(sigValue);
   canonicalized += _canonRelaxedHeader("ARC-Seal", asUnsigned).replace(/\r\n$/, "");
 
+  // RFC 6376 §3.6.1 / RFC 8617 — the ARC key record's k= (DEFAULT "rsa" when
+  // absent) must match the seal's a= family. Without this, a record
+  // `p=<raw-32-byte-key>` with no k= is an RSA record that would be misread as
+  // Ed25519 and validate an a=ed25519-sha256 seal the record never authorized
+  // (a key-family confusion that marks a forged chain as cryptographically
+  // passing).
+  var asKFamily   = keyTags.k !== undefined ? String(keyTags.k).toLowerCase() : "rsa";
+  var asSigFamily = String(tags.a || "").toLowerCase().split("-")[0];
+  if (asKFamily !== asSigFamily) {
+    return { result: "permerror",
+      errors: [kind + ": key k=" + asKFamily + " does not match seal a=" + tags.a + " (RFC 6376 §3.6.1)"] };
+  }
+
   // Verify the AS signature.
   return _runVerify(canonicalized, tags.b, tags.a, keyTags.p, "as");
 }
@@ -1932,7 +1945,18 @@ function _canonRelaxedHeader(name, value) {
   return dkim.canonHeaderRelaxed(name, value);
 }
 
+// RFC 8410 Ed25519 SubjectPublicKeyInfo header prepended to a raw 32-byte key.
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
 function _pemFromB64KeyMaterial(b64) {
+  // RFC 8463 §3-4 publishes an ed25519 DKIM key as the RAW 32-byte key
+  // (base64'd), which is not valid SPKI DER; wrap it in the ed25519 SPKI header
+  // first. Already-SPKI ed25519 (44 bytes) / RSA SPKI (larger) pass through.
+  var raw = null;
+  try { raw = Buffer.from(b64, "base64"); } catch (_e) { raw = null; }
+  if (raw && raw.length === 32) {
+    b64 = Buffer.concat([ED25519_SPKI_PREFIX, raw]).toString("base64");
+  }
   var pem = "-----BEGIN PUBLIC KEY-----\n";
   for (var i = 0; i < b64.length; i += 64) {                                     // PEM wrap width
     pem += b64.slice(i, i + 64) + "\n";                                          // PEM wrap width

package/lib/mail-dkim.js

@@ -645,10 +645,21 @@ async function _safeResolveTxt(qname, operatorLookup) {
 
 function _resetDkimKeyCacheForTest() { DKIM_KEY_CACHE.clear(); }
 
+// RFC 8410 Ed25519 SubjectPublicKeyInfo header (algorithm id + BIT STRING
+// wrapper) prepended to a raw 32-byte key to form valid SPKI DER.
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
 function _pemFromB64KeyMaterial(b64) {
-  // RSA: SubjectPublicKeyInfo DER in base64. Ed25519: raw 32-byte key
-  // OR SPKI DER. Wrap in PEM markers so node:crypto.createPublicKey
-  // accepts it.
+  // RSA: SubjectPublicKeyInfo DER in base64. Ed25519: RFC 8463 §3-4 publishes
+  // the RAW 32-byte key (base64'd) — the canonical form every conformant
+  // ed25519 sender uses — which is NOT valid SPKI DER; wrap it in the ed25519
+  // SPKI header first. An already-SPKI ed25519 key (44 bytes) or an RSA SPKI
+  // key (larger) is passed through unchanged.
+  var raw = null;
+  try { raw = Buffer.from(b64, "base64"); } catch (_e) { raw = null; }
+  if (raw && raw.length === 32) {
+    b64 = Buffer.concat([ED25519_SPKI_PREFIX, raw]).toString("base64");
+  }
   var pem = "-----BEGIN PUBLIC KEY-----\n";
   // 64-char wrap (PEM convention).
   for (var i = 0; i < b64.length; i += 64) {                                     // PEM wrap width
@@ -1113,18 +1124,18 @@ async function verify(rfc822, opts) {
         errors: ["DKIM key record missing p="] });
       continue;
     }
-    // RFC 6376 §3.6.1 — k= tag declares the key's algorithm family.
-    // Default is "rsa" when absent. If the key's k= disagrees with the
-    // signature's a= family, the operator who published the key intends
-    // a different algorithm; refuse rather than guess.
-    if (keyTags.k !== undefined) {
-      var kFamily   = String(keyTags.k).toLowerCase();
-      var sigFamily = String(alg || "").toLowerCase().split("-")[0];
-      if (kFamily !== sigFamily) {
-        results.push({ d: d, s: s, alg: alg, result: "permerror",
-          errors: ["DKIM key k=" + kFamily + " does not match signature a=" + alg + " (RFC 6376 §3.6.1)"] });
-        continue;
-      }
+    // RFC 6376 §3.6.1 — k= tag declares the key's algorithm family, DEFAULT
+    // "rsa" when absent. If it disagrees with the signature's a= family the
+    // operator who published the key intends a different algorithm; refuse
+    // rather than guess. The default matters: a record `p=<raw-32-byte-key>`
+    // with no k= is an RSA record, and must NOT be read as an Ed25519 key just
+    // because the bytes are 32 long (a key-family confusion).
+    var kFamily   = keyTags.k !== undefined ? String(keyTags.k).toLowerCase() : "rsa";
+    var sigFamily = String(alg || "").toLowerCase().split("-")[0];
+    if (kFamily !== sigFamily) {
+      results.push({ d: d, s: s, alg: alg, result: "permerror",
+        errors: ["DKIM key k=" + kFamily + " does not match signature a=" + alg + " (RFC 6376 §3.6.1)"] });
+      continue;
     }
     var rv = _verifySingleSignature(rfc822, parsedHeaders, sigHeaders[i], keyTags, sigTags, verifyOpts);
     results.push(Object.assign({ d: d, s: s, alg: alg }, rv));
@@ -1310,7 +1321,17 @@ function _bootstrapSingle(algorithm, domain, selector, rsaBits) {
   }
   var publicKeyPemObj = nodeCrypto.createPublicKey({ key: keyPair.publicKey, type: "spki", format: "der" });
   var publicKeyPem    = publicKeyPemObj.export({ type: "spki", format: "pem" });
-  var pBase64         = Buffer.from(keyPair.publicKey).toString("base64");
+  // RFC 8463 §3-4: an ed25519 DKIM key MUST be published as the RAW 32-byte key
+  // (base64'd), not SPKI DER — the SPKI form (60 base64 chars) does not verify
+  // at a conformant receiver. The raw key is the trailing 32 bytes of the SPKI
+  // encoding. RSA keeps the SPKI DER form (RFC 6376).
+  var pBase64;
+  if (k === "ed25519") {
+    var spkiDer = Buffer.from(keyPair.publicKey);
+    pBase64 = spkiDer.subarray(spkiDer.length - 32).toString("base64");
+  } else {
+    pBase64 = Buffer.from(keyPair.publicKey).toString("base64");
+  }
   var dnsName         = selector + "._domainkey." + domain;
   // RFC 6376 §3.6.1 record syntax: v=DKIM1; k=<alg>; p=<base64>
   // The optional t/s/g/n/h/k tags omitted (operator can re-edit

package/lib/tsa.js

@@ -567,9 +567,13 @@ function _assertValidAt(cert, atMs) {
  * <code>id-ct-TSTInfo</code>, the message imprint equals the hash of
  * <code>opts.data</code> (or <code>opts.hash</code>), a sent nonce
  * round-trips, the signer cert's extendedKeyUsage is a critical, sole
- * <code>id-kp-timeStamping</code>, and the CMS signature verifies. Pass
- * <code>opts.trustAnchorsPem</code> to also verify the certificate
- * chain and validity at the asserted time.
+ * <code>id-kp-timeStamping</code>, and the CMS signature verifies. The
+ * signer certificate is embedded in the token (and therefore
+ * attacker-controlled), so <code>opts.trustAnchorsPem</code> is
+ * <strong>required by default</strong> — without it a self-signed token
+ * would pass on its self-contained signature alone. To accept an
+ * unauthenticated timestamp, set <code>opts.allowUntrustedIssuer:true</code>;
+ * the result then carries <code>issuerTrusted:false</code>.
  *
  * @opts
  *   {
@@ -577,17 +581,18 @@ function _assertValidAt(cert, atMs) {
  *     hash:            Buffer,    // OR a pre-computed digest (with hashAlg)
  *     hashAlg:         string,    // default "SHA-512" — must match the imprint
  *     nonce:           Buffer,    // require the token nonce to match (from buildRequest)
- *     trustAnchorsPem: string|string[], // PEM root(s) — enables chain + validity verification
+ *     trustAnchorsPem: string|string[], // PEM trust root(s) to authenticate the TSA — REQUIRED unless allowUntrustedIssuer
+ *     allowUntrustedIssuer: boolean,     // accept a token with no trust anchor (result carries issuerTrusted:false)
  *     at:              Date,      // validity instant for chain check (default: genTime); must be a valid Date
  *   }
  *
  * @example
- *   var out = b.tsa.verifyToken(resp.token, { data: tarball, hashAlg: "SHA-512", nonce: req.nonce });
- *   // → { genTime, policy, serialHex, accuracy, hashAlg, signerCertPem }
+ *   var out = b.tsa.verifyToken(resp.token, { data: tarball, hashAlg: "SHA-512", nonce: req.nonce, trustAnchorsPem: caPem });
+ *   // → { genTime, policy, serialHex, accuracy, hashAlg, signerCertPem, issuerTrusted: true }
  */
 function verifyToken(token, opts) {
   validateOpts.requireObject(opts, "tsa.verifyToken", TsaError);
-  validateOpts(opts, ["data", "hash", "hashAlg", "nonce", "trustAnchorsPem", "at"], "tsa.verifyToken");
+  validateOpts(opts, ["data", "hash", "hashAlg", "nonce", "trustAnchorsPem", "allowUntrustedIssuer", "at"], "tsa.verifyToken");
   if (opts.data == null && opts.hash == null) {
     throw new TsaError("tsa/no-data", "tsa.verifyToken: pass opts.data or opts.hash to bind the token");
   }
@@ -654,10 +659,25 @@ function verifyToken(token, opts) {
       "tsa.verifyToken: no certificate in the token both carries the timestamping EKU and verifies the signature");
   }
 
-  // (7) optional chain + validity. Accept a single PEM string or an
-  // array — never silently skip chain verification when the caller
-  // supplied an anchor in an unexpected shape (a fail-open).
-  if (opts.trustAnchorsPem !== undefined && opts.trustAnchorsPem !== null) {
+  // (7) Trust anchors REQUIRED by default. The signer certificate is embedded
+  // in the token (sd.certificates) and attacker-controlled, so verifying only
+  // the self-contained CMS signature + the timestamping EKU proves the token is
+  // self-consistent — a forged timestamp (attacker keypair, self-signed leaf
+  // with the timeStamping EKU) passes unless the chain is anchored to a
+  // configured trust root (RFC 3161 §2.4.2). Require trustAnchorsPem by default;
+  // an operator who genuinely wants trust-anchor-free verification must opt in
+  // EXPLICITLY (and gets issuerTrusted:false so the unauthenticated posture is
+  // visible). Mirrors b.mdoc.verifyIssuerSigned; fail closed.
+  var issuerTrusted = opts.trustAnchorsPem !== undefined && opts.trustAnchorsPem !== null;
+  if (!issuerTrusted && opts.allowUntrustedIssuer !== true) {
+    throw new TsaError("tsa/trust-anchors-required",
+      "tsa.verifyToken: opts.trustAnchorsPem is required to authenticate the timestamping TSA " +
+      "(the signer certificate is embedded in the token and attacker-controlled); pass trustAnchorsPem, " +
+      "or set allowUntrustedIssuer:true to explicitly accept an unauthenticated timestamp (issuerTrusted:false)");
+  }
+  // Accept a single PEM string or an array — never silently skip chain
+  // verification when the caller supplied an anchor in an unexpected shape.
+  if (issuerTrusted) {
     var anchors = typeof opts.trustAnchorsPem === "string" ? [opts.trustAnchorsPem] : opts.trustAnchorsPem;
     if (!Array.isArray(anchors) || anchors.length === 0 ||
         !anchors.every(function (a) { return typeof a === "string" && a.length > 0; })) {
@@ -678,6 +698,7 @@ function verifyToken(token, opts) {
     accuracy:      tst.accuracy,
     hashAlg:       imp.hashName,
     signerCertPem: new nodeCrypto.X509Certificate(signerCertDer).toString(),
+    issuerTrusted: issuerTrusted,
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.17.16",
+  "version": "0.17.17",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:361e1563-6d41-499d-b266-962cb2dc64ef",
+  "serialNumber": "urn:uuid:7533261e-9d68-4674-b24d-8a05ae89f2aa",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-24T03:55:41.218Z",
+    "timestamp": "2026-07-24T06:49:37.276Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.17.16",
+      "bom-ref": "@blamejs/core@0.17.17",
       "type": "application",
       "name": "blamejs",
-      "version": "0.17.16",
+      "version": "0.17.17",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.17.16",
+      "purl": "pkg:npm/%40blamejs/core@0.17.17",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.17.16",
+      "ref": "@blamejs/core@0.17.17",
       "dependsOn": []
     }
   ]