@blamejs/core 0.17.2 → 0.17.4

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.17.x
 
+- v0.17.4 (2026-07-17) — **Three fail-open holes closed: a raw cross-border write could evade the data-residency gate by wedging a comment or eliding whitespace, safe decompression returned undecompressed bytes for an unknown algorithm name, and the shared anti-replay helper admitted a replay when its store signalled a duplicate with a non-boolean value.** A raw SQL write submitted through b.db.runSql / b.db.prepare().run() could slip past the cross-border data-residency gate: the gate's write-detection matched tokens on whitespace boundaries, but SQL lets tokens abut with no whitespace when a comment or a quoted identifier sits between them, so INSERT/**/INTO, an INSERT whose quoted table name abuts INTO, and UPDATE/**/table all executed while the gate never engaged -- landing or moving a row across a residency boundary under a regulated posture. b.safeDecompress resolved its algorithm allowlist with a truthiness lookup, so an algorithm name that collides with an inherited object member (constructor, toString) reached the dispatch and returned the input undecompressed instead of refusing the unknown algorithm -- a fail-open for any caller that maps a client Content-Encoding onto the algorithm. And b.nonceStore.enforceReplay -- the anti-replay helper JWT and DPoP verification use -- detected a replay only when its store returned a literal false, so a store signalling a duplicate with another falsy value (a Redis SETNX null, a SQL INSERT rowcount of 0) let the replayed token through. **Added:** *b.safeSql.normalizeForScan* — A parse-only SQL normalizer that produces a copy whose token boundaries are real whitespace, so a scanner built with whitespace-anchored patterns cannot be evaded by a comment or a quoted-identifier boundary that lets two tokens abut. It collapses line and block comments to a single space and inserts a separating space where a quoted string or identifier follows a word character, in the same quote- and comment-aware single pass as the existing b.safeSql placeholder scanners (a comment marker inside a string literal is preserved, never collapsed). The executed SQL is never derived from this copy -- it only feeds a scanner. **Security:** *Data-residency gate catches a raw write that hides behind a comment or elided whitespace* — The cross-border data-residency gate that guards raw SQL writes (b.db.runSql, b.db.prepare().run()) detected the write and extracted its target table with regexes that assume tokens are separated by whitespace. SQL does not require whitespace between tokens when a comment or a quoted-identifier boundary separates them, so three forms that every engine executes as ordinary writes slipped the detection entirely and the gate never engaged: an INSERT whose double-quoted table name abuts INTO with no space, an INSERT with a block comment wedged between INSERT and INTO, and the same for UPDATE and its table. Under a regulated residency posture a row could therefore be inserted or moved across a residency boundary with no tag check (CWE-863; a GDPR Chapter V transfer-restriction bypass). The gate now normalizes a parse-only copy of the statement through the new b.safeSql.normalizeForScan before matching -- collapsing comments to a space and inserting a boundary where a quoted token abuts a word character -- so every write is detected and gated regardless of how its tokens are spaced. The executed SQL is unchanged. · *Safe decompression refuses an unknown algorithm instead of returning the input undecompressed* — b.safeDecompress resolved opts.algorithm against its allowlist of supported codecs (gzip, deflate, deflate-raw, brotli) with a truthiness lookup on a plain object. An algorithm name that names an inherited object member -- constructor, toString, valueOf -- read back a truthy inherited value, slipped the unsupported-algorithm refusal, and reached the dispatch, where invoking the inherited member returned the raw input buffer. The primitive therefore silently returned undecompressed bytes with no error, contrary to its contract that any algorithm outside the allowlist is refused -- a fail-open for a consumer that maps a client-supplied Content-Encoding token onto the algorithm, which also sidesteps the decompression-bomb size and ratio caps. The allowlist is now resolved with an own-property check, so any unsupported name -- however it collides with a built-in member -- is refused. · *Shared anti-replay helper fails closed on a non-boolean store result* — b.nonceStore.enforceReplay is the anti-replay helper that b.auth.jwt and b.auth.dpop route their replay defense through; it calls the store's checkAndInsert and treated the result as a replay only when it was the literal false. The recommended stores signal a duplicate with a different falsy value -- a Redis SET ... NX returns null and a SQL INSERT ... ON CONFLICT returns a rowcount of 0 -- so a store using either would have its duplicate signal missed and the replayed nonce admitted (a replay-protection bypass for a JWT or DPoP proof). enforceReplay now admits a nonce only on a truthy first-seen confirmation and treats every other result as a replay, matching the fail-closed check the framework's inline anti-replay consumers already use.
+
+- v0.17.3 (2026-07-17) — **A family of security guards that compared a token case-sensitively where the browser or HTTP stack matches it case-insensitively now normalize first, closing a CSP unsafe-keyword bypass and a cookie-prefix bypass and fixing several over-strict refusals of spec-compliant input.** Browsers, HTTP stacks, and URL parsers match a whole family of security-relevant tokens ASCII case-insensitively -- CSP source keywords and scheme sources, the __Secure-/__Host- cookie name prefixes, HTTP auth schemes, media types, and URL schemes. Several framework guards compared those tokens case-sensitively, so a mixed-case variant behaved differently in the guard than it does downstream. In the bypass direction this let a case-variant unsafe CSP keyword reach a header the browser still honors, and let a prefix-violating cookie past the invariant that keeps the browser from silently dropping it. In the over-strict direction it wrongly refused spec-compliant input (a lowercase auth scheme, a mixed-case media type, an uppercase URL scheme, a mixed-case operator allowlist entry). Every case now normalizes the token to ASCII lowercase before the membership, equality, or prefix test. Separately, two crypto algorithm-name lookups and a CBOR integer-boundary round-trip are corrected. **Fixed:** *Auth scheme, media type, and URL scheme comparisons accept spec-compliant case variants* — Three guards refused input that a case-insensitive downstream would accept. The CIBA notification endpoint (b.auth.ciba) matched the Authorization Bearer scheme case-sensitively, rejecting a spec-compliant 'bearer <token>' sender (RFC 7235 auth-schemes are case-insensitive); it now matches the scheme case-insensitively while comparing the token itself verbatim. The tus upload middleware's creation-with-upload path compared the application/offset+octet-stream media type as an exact string, so a compliant 'Application/Offset+Octet-Stream' (or a variant carrying a parameter) created the upload but silently dropped the body; it now compares the lowercased media type with parameters stripped (RFC 7231 §3.1.1.1). The NEL middleware required its collector URL to begin with a lowercase 'https://', rejecting an equivalent 'HTTPS://'; it now compares the scheme case-insensitively (RFC 3986). · *Redirect allowlist matches a mixed-case operator origin or host* — b.safeRedirect.resolve compared the parser-canonicalized (lowercased) origin and host of a candidate URL against the operator's allowedOrigins/allowedHosts entries verbatim. A mixed-case operator entry such as 'Example.COM' or 'HTTPS://Example.com' therefore silently never matched, and a legitimate redirect fell through to the fallback. The operator entries are now canonicalized to lowercase before the comparison. This only makes the operator's intended allowlist work; because the attacker-controlled target is already normalized by the parser, it never widens the allowlist. · *Streaming-hash and OPRF suite selection reject an unknown algorithm name cleanly* — b.crypto.hashStream (and b.crypto.hashFile, which composes it) and b.crypto.oprf.suite resolved a caller-supplied algorithm/suite name against a plain-object lookup table with a truthiness check. A name colliding with an inherited Object.prototype member -- 'constructor' or '__proto__' -- read back a truthy inherited value and slipped the guard: hashStream then threw a synchronous TypeError from a function documented to return a rejected Promise (an unhandled exception for a caller wired only to .catch()), and oprf.suite returned a malformed suite object instead of throwing its documented bad-suite error. Both now resolve the name through an own-property check, matching the guarding used for the SRI algorithm table, so any unknown name is refused with the documented error. · *Deterministic CBOR re-encodes a negative integer at the -2^53 boundary as an integer* — The CBOR decoder returned the negative integer at the -2^53 boundary as a plain Number, but that value is one below the safe-integer range, so the deterministic encoder's integer branch re-emitted it as a float -- breaking round-trip and falsely tripping the requireDeterministic check on a value that is canonically an integer. The decoder now promotes a negative integer that is not a safe integer to a BigInt, so the encoder re-emits the integer head (RFC 8949 §3). **Security:** *CSP builder refuses unsafe keywords and catch-all schemes in any case* — b.csp.build screened its source tokens ('unsafe-inline', 'unsafe-eval', 'unsafe-hashes', the catch-all '*'/'https:', and 'data:' in img/media/font) against its guard sets with a case-sensitive comparison. A User-Agent matches CSP keywords and scheme sources ASCII case-insensitively (CSP3 §2.3/§6.7.2), so a case-variant such as 'Unsafe-Inline', 'HTTPS:', or 'DATA:' slipped the guard and was emitted verbatim into a Content-Security-Policy header the browser still enforces -- reintroducing the exact XSS-defense hole the guard exists to refuse, without the required acknowledgement opt-in. The builder now lowercases each token before the membership test; the original case is still emitted for real hosts and paths, only the guard comparison is normalized. mergeDirectives routes added sources through the same guard, so a case-variant in a merged policy is refused too. · *Cookie name-prefix invariants hold for any case of __Secure-/__Host-* — Browsers apply the __Secure-/__Host- cookie name-prefix requirements (RFC 6265bis §4.1.3) case-insensitively -- they lowercase the cookie name before the prefix test. b.cookies.serialize and the CSRF middleware's cookie-name safety check compared the prefix case-sensitively, so a case-variant name like __host- or __SECURE- dodged the framework's Secure/Path=//no-Domain invariant while still being subject to the browser's enforcement -- the cookie would then be silently rejected by the browser (never set), defeating the middleware or session it belonged to. Both now compare a lowercased copy of the name, so a prefix-violating cookie is refused at the source for every case. The CSRF middleware, which builds its own Set-Cookie header rather than routing through serialize, additionally gained the __Secure- branch it was missing entirely.
+
 - v0.17.2 (2026-07-17) — **Recurrence expansion refuses to spin or crash on an out-of-range interval, the CIDR guard rejects the whole of the ULA and link-local IPv6 ranges, and a device-bound session assertion no longer accepts a far-future issued-at.** b.calendar.expandRecurrence accepted an unbounded, unvalidated recurrence interval; a large interval drove its date arithmetic past the representable range, which either spun the expansion loop forever at full CPU (a denial of service reachable from any JSCalendar event in a request body) or threw an uncaught error that crashed the caller. The expander now stops as soon as the date arithmetic overflows. b.guardCidr tested IPv6 reserved-range membership on whole hex nibbles, so it missed the parts of the ULA (fc00::/7) and link-local (fe80::/10) ranges that do not fall on a nibble boundary -- accepting fd00::/8 and several fe80::/10 sub-ranges as clean under the strict profile that is supposed to refuse them. And b.dbsc.verifyBindingAssertion bounded the assertion's issued-at only from below, so a far-future issued-at was accepted and never aged out of the replay window. **Security:** *Recurrence expansion refuses an out-of-range interval instead of hanging or crashing* — b.calendar.expandRecurrence validated a recurrence rule's frequency but not its interval, so a caller-supplied interval was used unbounded. A large interval drives the expander's date arithmetic past the representable ECMAScript date range and yields a non-finite date, with two consequences from the one root: with a by-set-position rule the outer loop computed a non-finite period whose inner day-enumeration ran zero times, so the shared step budget never decremented and the not-after break comparisons (which compare against a non-finite value) never fired -- an infinite loop pinning a CPU at 100%; without by-set-position, the loop advanced to a non-finite date and threw an uncaught error when serializing it. Because the rule passed validation, any attacker supplying a JSCalendar event (a JMAP request body, an imported calendar) could trigger it. The expander now stops stepping as soon as the date arithmetic overflows the representable range -- no further instances can exist -- so a hostile interval yields the finite instances that fit and returns, rather than hanging or crashing. · *CIDR guard rejects the full ULA and link-local IPv6 ranges under the strict profile* — b.guardCidr tested whether an IPv6 address falls in a reserved range by comparing hex-nibble prefixes with a string prefix match. Reserved membership is a bit-prefix relation, and the unique-local (fc00::/7, 7 bits) and link-local (fe80::/10, 10 bits) ranges end mid-nibble, so the nibble comparison covered only fc00-fcff and fe80-fe8f -- it missed fd00::/8 (the half of the ULA block that real deployments actually assign) and the fe90::/16 through febf::/16 sub-ranges of link-local. Under the strict profile, which refuses reserved ranges, those CIDRs were accepted as clean and sanitize normalized them into place instead of refusing them. The reserved-range check now compares the whole nibbles and then the remaining prefix bits of the boundary nibble under a mask -- the same bit-prefix relation the IPv4 path and the SSRF guard already use -- so the entire reserved range is caught; nibble-aligned ranges (documentation, multicast, loopback) are unaffected. · *Device-bound session assertions reject a far-future issued-at* — b.dbsc.verifyBindingAssertion enforced the assertion's issued-at only as a lower bound (refusing one older than the configured max age), with no upper bound. A forward-dated issued-at makes the age check compare a negative interval, which never trips, so an assertion carrying an issued-at far in the future was accepted and could not age out of the replay window on the default 300-second path. verifyBindingAssertion now also refuses an issued-at more than a small clock-skew allowance in the future, matching the future-issued-at bound the JWT, DPoP, and client-attestation verifiers already enforce.
 
 - v0.17.1 (2026-07-17) — **Profile, posture, and capability name lookups across the content-safety and mail-protocol guards reject a prototype-member name instead of running under it, the mTLS CA can generate a CRL after a fingerprint-only revocation, and a hostile MIME filename no longer crashes attachment extraction.** A second family of guards resolved a profile, posture, or capability name against a plain-object lookup table with a truthiness or in-operator guard, so a name that is an inherited Object.prototype member (constructor, __proto__, toString) slipped the guard and the gate ran under the inherited member instead of refusing the unknown name. The shared profile resolver (b.gateContract.makeProfileResolver, which the guard family composes), the iCal and vCard content guards, the dark-patterns posture check, the JMAP capability allowlist, and the IMAP/POP3/ManageSieve command guards now all resolve names through an own-property check. Separately, b.mtlsCa.generateCrl crashed with a null-serial error once any certificate had been revoked by fingerprint (the mode the require-mTLS gate pins on), dropping every serial-keyed revocation from the published CRL; and b.safeMime.extractAttachments threw an uncaught URIError on a hostile Content-Disposition filename with a malformed percent-escape, crashing the caller. **Fixed:** *mTLS CA generates a CRL after a fingerprint-only revocation* — b.mtlsCa.revoke accepts a certificate fingerprint (the value the require-mTLS gate pins on and generateClientCert surfaces for exactly this use), which is stored without a serial number. b.mtlsCa.generateCrl then mapped the whole revocation registry into CRL entries and handed the null serial to the CRL encoder, which threw -- aborting CRL generation entirely. Because one fingerprint-only revocation broke every subsequent CRL build, all serial-keyed revocations were silently dropped from the published CRL and it could never be regenerated, going stale for external CRL-based revocation checking. generateCrl now projects out fingerprint-only entries (which a standard X.509 CRL cannot represent) before encoding and reports how many were omitted; fingerprint-only revocations remain enforced through the mTLS gate, and the CRL publishes every serial-keyed revocation. · *A hostile MIME filename no longer crashes attachment extraction* — b.safeMime.extractAttachments decoded an RFC 2231 / RFC 5987 extended filename parameter (filename*=charset''percent-encoded) with an unguarded percent-decode, so a malformed escape -- a truncated %, a non-hex %ZZ, or a sequence that decodes to invalid UTF-8 -- threw an uncaught URIError that escaped the parser's typed-error contract and crashed the caller (for example a mail store extracting attachments). A one-line hostile Content-Disposition header was a trivial denial of service. The decode now degrades to the still-encoded filename on failure, matching the framework's handling of every other percent-decode site, so a hostile filename yields a best-effort name that downstream filename guards still vet rather than a crash. **Security:** *Guard profile, posture, and capability lookups reject a prototype-member name* — A group of content-safety and mail-protocol guards resolved a caller- or request-supplied profile / posture / capability name against a plain-object lookup table using a truthiness check (var caps = TABLE[name]; if (!caps)) or the prototype-chain-aware in operator. A name that names an inherited Object.prototype member -- constructor, __proto__, toString -- is truthy (or present via the prototype chain), so it slipped the guard and the gate ran under the inherited member instead of refusing the unknown name. The shared resolver b.gateContract.makeProfileResolver (composed by the idempotency-key, mail-compose, message-id and other guards) now guards both its posture and profile lookups with hasOwnProperty; b.safeIcal, b.safeVcard, b.darkPatterns, b.guardJmap (capability allowlist and profile/posture), and the b.guardImapCommand / b.guardPop3Command / b.guardManageSieveCommand command guards do the same. An unknown or prototype-member name is now rejected with the guard's typed error; supported names are unaffected. This extends the same own-property hardening applied to the crypto algorithm-table lookups in 0.17.0 to the guard-family profile resolvers.

package/lib/auth/ciba.js

@@ -632,11 +632,16 @@ function create(opts) {
     // node:http's normalization could re-introduce the unreachable
     // branch). Read lowercase only.
     var authzHeader = req.headers["authorization"];
-    if (!authzHeader || authzHeader.indexOf("Bearer ") !== 0) {
+    // RFC 7235 §2.1 — the auth-scheme token ("Bearer") is ASCII
+    // case-insensitive; match it case-insensitively so a spec-compliant
+    // `bearer <token>` sender isn't wrongly refused. The token that follows
+    // keeps its case (it is compared verbatim below).
+    var BEARER_PREFIX = "bearer ";
+    if (!authzHeader || authzHeader.slice(0, BEARER_PREFIX.length).toLowerCase() !== BEARER_PREFIX) {
       throw new AuthError("auth-ciba/missing-bearer",
         "ciba.parseNotification: Authorization: Bearer header missing");
     }
-    var presented = authzHeader.substring("Bearer ".length).trim();
+    var presented = authzHeader.slice(BEARER_PREFIX.length).trim();
     if (presented.length === 0 || !clientNotificationToken) {
       throw new AuthError("auth-ciba/bad-bearer",
         "ciba.parseNotification: empty bearer or no expected token configured");

package/lib/cbor.js

@@ -393,7 +393,18 @@ function _decodeItem(state, depth) {
     case 0: return _readArgument(state, ai);                                            // unsigned int
     case 1: {                                                                           // negative int
       var n = _readArgument(state, ai);
-      return (typeof n === "bigint") ? (-1n - n) : (-1 - n);
+      if (typeof n === "bigint") return -1n - n;
+      // The argument n is a safe Number, but a negative CBOR value is
+      // -1 - n, which reaches one below the safe range: n === 2^53-1
+      // yields -2^53, NOT a safe integer. The deterministic encoder's
+      // integer branch is |v| <= 2^53-1, so it would re-emit that value
+      // as a float — breaking round-trip and falsely tripping
+      // requireDeterministic on a canonical integer. Promote to BigInt
+      // when the value isn't a safe integer so encode() re-emits the
+      // integer head (RFC 8949 §3 — a negative-int argument is an
+      // integer, never a float).
+      var neg = -1 - n;
+      return Number.isSafeInteger(neg) ? neg : (-1n - BigInt(n));
     }
     case 2: {                                                                           // byte string
       var blen = _lenOf(_readArgument(state, ai));

package/lib/cookies.js

@@ -214,15 +214,25 @@ function serialize(name, value, attrs) {
   //   __Host-*   — MUST be Secure, Path=/, NO Domain
   //
   // Caught at the source so every caller (csrf-protect / session /
-  // operator) gets the same enforcement.
-  if (name.indexOf("__Secure-") === 0) {
+  // operator) gets the same enforcement. RFC 6265bis §5.4 requires user
+  // agents to match these prefixes case-INSENSITIVELY (the server-side
+  // description in §4.1.3 reads "case-sensitive", but the UA is what
+  // actually enforces the cookie-drop): Chromium and Firefox both
+  // lowercase the name before the prefix test, so `__host-` / `__SECURE-`
+  // get the same browser enforcement -- Secure, Path=/, no Domain -- as
+  // `__Host-` / `__Secure-`. Case-sensitive matching was itself the
+  // vulnerability CVE-2024-5699 (httpwg/http-extensions#2231). Compare a
+  // lowercased copy so a case-variant name can't dodge the invariant here
+  // and then be silently dropped by the browser.
+  var lowerName = name.toLowerCase();
+  if (lowerName.indexOf("__secure-") === 0) {
     if (attrs.secure !== true) {
       throw new CookieError("cookies/prefix-secure-required",
         "__Secure-* cookies MUST set Secure (RFC 6265bis §4.1.3.1) — got '" +
         name + "' without secure: true");
     }
   }
-  if (name.indexOf("__Host-") === 0) {
+  if (lowerName.indexOf("__host-") === 0) {
     if (attrs.secure !== true) {
       throw new CookieError("cookies/prefix-host-secure-required",
         "__Host-* cookies MUST set Secure (RFC 6265bis §4.1.3.2) — got '" +

package/lib/crypto-oprf.js

@@ -98,8 +98,17 @@ var SUITES = Object.keys(SUITE_IMPL);
  *   // out === s.oprf.evaluate(kp.secretKey, Buffer.from("user@example.com"))
  */
 function suite(name) {
-  var impl = SUITE_IMPL[String(name).toLowerCase()];
-  if (!impl) throw new OprfError("oprf/bad-suite", "crypto.oprf.suite: unknown suite '" + name + "'; expected one of " + SUITES.join(", "));
+  // Own-property guard, not a truthiness check: SUITE_IMPL is a plain object,
+  // so a bracket read with a prototype-chain name ("__proto__" → Object.prototype,
+  // "constructor" → the Object constructor) returns a truthy inherited value that
+  // an `if (!impl)` guard would accept as a "suite". Match the hasOwnProperty
+  // shape b.crypto.sri uses for its algorithm table so an unknown name — however
+  // it collides with Object.prototype — refuses cleanly with OprfError.
+  var key = String(name).toLowerCase();
+  if (!Object.prototype.hasOwnProperty.call(SUITE_IMPL, key)) {
+    throw new OprfError("oprf/bad-suite", "crypto.oprf.suite: unknown suite '" + name + "'; expected one of " + SUITES.join(", "));
+  }
+  var impl = SUITE_IMPL[key];
   // Expose only the modes the vendored @noble/curves implements (base +
   // verifiable). poprf is omitted rather than surfaced as an empty stub.
   return { name: impl.name, oprf: impl.oprf, voprf: impl.voprf };

package/lib/crypto.js

@@ -121,13 +121,20 @@ function hmac(key, data, algorithm) {
  */
 function hashStream(readable, algorithm) {
   var alg = (algorithm || STREAM_HASH_DEFAULT).toLowerCase();
-  var entry = STREAM_HASH_ALGORITHMS[alg];
-  if (!entry) {
+  // Own-property guard, not a truthiness check: STREAM_HASH_ALGORITHMS is a
+  // plain object, so a name colliding with an Object.prototype member
+  // ("constructor" → the Object constructor, "__proto__" → Object.prototype)
+  // would read back a truthy inherited value, slip past `if (!entry)`, and then
+  // throw ERR_INVALID_ARG_TYPE synchronously at createHash(entry.algorithm ===
+  // undefined) — a sync throw from a Promise-returning function. Refuse it here
+  // as the documented Promise.reject, matching b.crypto.sri's algorithm guard.
+  if (!Object.prototype.hasOwnProperty.call(STREAM_HASH_ALGORITHMS, alg)) {
     return Promise.reject(new TypeError(
       "crypto.hashStream: unsupported algorithm '" + algorithm +
       "' (allowed: " + Object.keys(STREAM_HASH_ALGORITHMS).join(", ") + ")"
     ));
   }
+  var entry = STREAM_HASH_ALGORITHMS[alg];
   if (!readable || typeof readable.pipe !== "function") {
     return Promise.reject(new TypeError(
       "crypto.hashStream: readable must be a Readable stream"

package/lib/csp.js

@@ -221,20 +221,28 @@ function build(directives, opts) {
           "csp.build: source '" + src + "' contains whitespace or ';' — a CSP source " +
           "must be a single token (directive-injection defense)");
       }
+      // A UA matches CSP source keywords ('unsafe-inline' ...) and scheme
+      // sources (https: / data:) ASCII case-INSENSITIVELY (CSP3 §2.3 /
+      // §6.7.2). Compare a lowercased copy against the (lowercase) guard sets
+      // so a case-variant token ("'Unsafe-Inline'" / "HTTPS:" / "DATA:") can't
+      // slip past and be emitted verbatim into a header the browser still
+      // honors. The ORIGINAL src is what gets emitted (hosts/paths stay
+      // case-preserved); only the guard comparison is normalized.
+      var srcLower = src.toLowerCase();
       if (!acknowledgeUnsafe && SCRIPT_DIRECTIVES.indexOf(name) !== -1 &&
-          UNSAFE_KEYWORDS.indexOf(src) !== -1) {
+          UNSAFE_KEYWORDS.indexOf(srcLower) !== -1) {
         throw new CspError("csp/unsafe-keyword",
           "csp.build: " + name + " contains " + src + "; pass acknowledgeUnsafe:true with a " +
           "documented justification to allow it (CSP3 §6.2.5.x — unsafe keywords are a " +
           "common XSS bypass surface)");
       }
-      if (CATCH_ALL_SOURCES.indexOf(src) !== -1) {
+      if (CATCH_ALL_SOURCES.indexOf(srcLower) !== -1) {
         throw new CspError("csp/catch-all-source",
           "csp.build: " + name + " contains catch-all source '" + src + "'; CSP3 best " +
           "practice refuses these (use an explicit allowlist instead)");
       }
       if (!allowDataImages && (name === "img-src" || name === "media-src" || name === "font-src") &&
-          src === "data:") {
+          srcLower === "data:") {
         throw new CspError("csp/data-source",
           "csp.build: " + name + " contains 'data:'; pass allowDataImages:true with a " +
           "documented reason (data: URLs sidestep most CSP defenses)");

package/lib/db-query.js

@@ -1430,6 +1430,29 @@ function _stripLeadingSqlComments(sql) {
   return s;
 }
 
+// _normalizeForWriteParse — the single parse-copy normalizer the residency
+// write-detection regexes run against. The regexes hand-roll SQL tokenization
+// with `\s+` (whitespace-separated) token boundaries, but SQL lets two tokens
+// abut with NO whitespace whenever a comment or a quoted-identifier boundary
+// separates them — so a real write escaped the whitespace-strict detection
+// entirely (the gate was skipped → a cross-border write landed ungated):
+//
+//   an INSERT whose quoted table name abuts INTO with no space
+//   an INSERT with a slash-star comment wedged between INSERT and INTO
+//   an UPDATE with a slash-star comment wedged between UPDATE and the table
+//
+// All are valid SQLite (the engine tokenizes the comment / quote as a
+// separator), so the executed statement writes rows while `_rawWriteTable`
+// returned null and the gate never engaged (CWE-863; GDPR Art. 44-46 transfer
+// restriction bypass). safeSql.normalizeForScan produces a parse-only copy
+// where every token boundary is real whitespace (comments collapsed to a space,
+// a separating space inserted where a quoted token abuts a word character);
+// leading comments then strip so the ^-anchored regexes see the statement head.
+// The executed SQL is unchanged; this copy only feeds the gate's parse.
+function _normalizeForWriteParse(sql) {
+  return _stripLeadingSqlComments(safeSql.normalizeForScan(sql));
+}
+
 // Non-anchored write-target scan for the writable-CTE / EXPLAIN-prefixed case.
 // A SQLite `WITH c AS (...) INSERT INTO residents ...` / `WITH ... UPDATE residents
 // SET ...` is a real write, but its effective verb is hidden behind the prefix so
@@ -1452,10 +1475,12 @@ function _firstResidencyWriteTarget(s) {
 }
 
 function _rawWriteTable(sql) {
-  // The ^-anchored regexes scan only the statement head (constant-time). Strip
-  // leading comments first so a commented-out head can't hide the write.
+  // The ^-anchored regexes scan only the statement head (constant-time).
+  // Normalize first so a leading OR internal comment, and a quoted table that
+  // abuts the keyword with no whitespace, can't hide the write from the
+  // whitespace-anchored detection (a gate-skip → cross-border-write bypass).
   if (typeof sql !== "string") return null;
-  var s = _stripLeadingSqlComments(sql);
+  var s = _normalizeForWriteParse(sql);
   if (_RAW_WRITE_KEYWORD_RE.test(s)) {  // allow:regex-no-length-cap
     var m = _RAW_TABLE_RE.exec(s);  // allow:regex-no-length-cap
     return m ? _unquoteIdent(m[1] || m[2]) : null;
@@ -1546,11 +1571,13 @@ function _assertRawWriteResidency(sql, boundParams) {
   if (!cryptoField.getPerRowResidency(table) && !cryptoField.getColumnResidency(table)) return;
   boundParams = _flattenRunParams(boundParams);
 
-  // Parse the comment-stripped head: a leading "/* x */" / "-- x" comment must
-  // not hide the INSERT/UPDATE body from the ^-anchored regexes below (that would
-  // let a residency-restricted write through the gate). The executed SQL is
+  // Normalize the parse copy the same way engagement did: a leading OR internal
+  // comment, and a quoted table/column that abuts the keyword with no whitespace,
+  // must not hide the INSERT/UPDATE body from the whitespace-anchored regexes
+  // below (that would let a residency-restricted write parse as unmodelled and,
+  // for the value it can't read, skip the tag check). The executed SQL is
   // unchanged; this normalized copy is only for residency parsing.
-  var norm = _stripLeadingSqlComments(sql);
+  var norm = _normalizeForWriteParse(sql);
 
   // The INSERT/UPDATE body regexes below scan with [\s\S]+; bound the input
   // first and fail CLOSED on an over-long statement - a residency write the

package/lib/middleware/csrf-protect.js

@@ -430,16 +430,30 @@ function create(opts) {
     if (["Lax", "Strict", "None"].indexOf(cookieCfg.sameSite) === -1) {
       throw new Error("middleware.csrfProtect: opts.cookie.sameSite must be Lax|Strict|None");
     }
-    // __Host- prefix safety: if operator picks a __Host- name, the
-    // Path/Domain/Secure constraints must be compatible. Path must be "/",
-    // no Domain (we never set one), Secure resolved per-request. Catch
-    // operator-side typos (e.g. __Host-csrf with a custom path) at boot.
-    if (cookieCfg.name && /^__Host-/.test(cookieCfg.name)) {
-      if (cookieCfg.path !== "/") {
-        throw new Error("middleware.csrfProtect: __Host-* cookie name requires path='/'");
-      }
-      if (cookieCfg.secure === false) {
-        throw new Error("middleware.csrfProtect: __Host-* cookie name requires secure (cannot be explicit false)");
+    // Cookie name-prefix safety (RFC 6265bis §4.1.3). csrf-protect builds its
+    // own Set-Cookie header rather than routing through b.cookies.serialize, so
+    // this boot check is the only enforcement point. §5.4 requires user agents
+    // to apply the prefix test case-INSENSITIVELY (the server-side §4.1.3
+    // description reads "case-sensitive", but the UA is what drops the cookie),
+    // so `__host-`/`__SECURE-` get the same browser enforcement as
+    // `__Host-`/`__Secure-` -- case-sensitive matching was itself CVE-2024-5699.
+    // Compare a lowercased copy so a case-variant name can't dodge the invariant
+    // here and then be silently rejected by the browser. Catch typos at boot.
+    //   __Host-*   — Path must be "/", no Domain (we never set one), Secure.
+    //   __Secure-* — Secure.
+    if (cookieCfg.name) {
+      var lowerCookieName = cookieCfg.name.toLowerCase();
+      if (lowerCookieName.indexOf("__host-") === 0) {
+        if (cookieCfg.path !== "/") {
+          throw new Error("middleware.csrfProtect: __Host-* cookie name requires path='/'");
+        }
+        if (cookieCfg.secure === false) {
+          throw new Error("middleware.csrfProtect: __Host-* cookie name requires secure (cannot be explicit false)");
+        }
+      } else if (lowerCookieName.indexOf("__secure-") === 0) {
+        if (cookieCfg.secure === false) {
+          throw new Error("middleware.csrfProtect: __Secure-* cookie name requires secure (cannot be explicit false)");
+        }
       }
     }
   }

package/lib/middleware/nel.js

@@ -151,7 +151,7 @@ function create(opts) {
   // honor secure-origin report endpoints. Refusing at config-time so
   // an operator typo (`http://`) surfaces at boot, not as silent
   // never-fires-in-production.
-  if (opts.collectorUrl.slice(0, 8) !== "https://") {                                       // string-prefix length, not bytes
+  if (opts.collectorUrl.slice(0, 8).toLowerCase() !== "https://") {                         // RFC 3986 scheme is case-insensitive; string-prefix length, not bytes
     throw new TypeError(
       "middleware.nel: opts.collectorUrl must be https:// (browsers " +
       "ignore non-secure NEL collectors); got " + opts.collectorUrl);

package/lib/middleware/tus-upload.js

@@ -511,8 +511,12 @@ function create(opts) {
     if (expHdr) headers["Upload-Expires"] = expHdr;
 
     // creation-with-upload: append the body in the same request when
-    // Content-Type is application/offset+octet-stream.
-    var contentType = req.headers["content-type"];
+    // Content-Type is application/offset+octet-stream. RFC 7231 §3.1.1.1 —
+    // the media type is case-insensitive and may carry parameters, so compare
+    // the lowercased type/subtype (a compliant `Application/Offset+Octet-Stream`
+    // must still take the append path).
+    var rawContentType = req.headers["content-type"];
+    var contentType = rawContentType ? String(rawContentType).split(";")[0].trim().toLowerCase() : "";
     if (hasCreationWithBody && contentType === "application/offset+octet-stream") {
       var chunk;
       try { chunk = await _readChunk(req, maxChunkSize); }

package/lib/nonce-store.js

@@ -291,7 +291,15 @@ async function enforceReplay(store, jti, expireAtMs, opts) {
     throw new opts.errorClass(opts.storeFailedCode,
       "replayStore.checkAndInsert threw: " + ((e && e.message) || String(e)));
   }
-  if (inserted === false) {
+  // Fail CLOSED on ANY non-truthy result, not just a literal `false`. The
+  // recommended backends (Redis SETNX, SQL INSERT ... ON CONFLICT) signal a
+  // duplicate with a non-`false` falsy value — `SET ... NX` returns null, the
+  // SETNX command / an INSERT returns 0 — so an `=== false` compare would miss
+  // the replay and admit the token (fail open). Only a truthy result is a
+  // positive "first-seen" confirmation; anything else is treated as a replay.
+  // Mirrors the truthiness guard every inline consumer already uses
+  // (b.auth.oauth `!inserted`, api-encrypt `!freshNonce`, webhook `!fresh`).
+  if (!inserted) {
     throw new opts.errorClass(opts.replayCode,
       opts.tokenLabel + " jti='" + jti + "' has been seen before — replay refused");
   }

package/lib/safe-decompress.js

@@ -165,8 +165,14 @@ function safeDecompress(input, opts) {
      "windowBits", "audit", "ctx"],
     "safeDecompress");
 
-  // Algorithm — required, must be in allowlist
-  if (typeof opts.algorithm !== "string" || !_algorithms[opts.algorithm]) {
+  // Algorithm — required, must be in allowlist. Use an own-property check,
+  // not `!_algorithms[algo]`: a bare truthiness/`in` lookup inherits
+  // Object.prototype members, so a non-own key ("constructor", "toString",
+  // …) would resolve to a prototype function and get invoked below —
+  // `Object(buf)` returns the raw input, silently bypassing the allowlist
+  // and returning un-decompressed bytes (fail-open).
+  if (typeof opts.algorithm !== "string" ||
+      !Object.prototype.hasOwnProperty.call(_algorithms, opts.algorithm)) {
     throw new SafeDecompressError(
       "safe-decompress/unsupported-algorithm",
       "safeDecompress: algorithm must be one of " +

package/lib/safe-redirect.js

@@ -97,15 +97,23 @@ function resolve(rawTarget, opts) {
   try { parsed = safeUrl.parse(rawTarget, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS }); }
   catch (_e) { return fallback; }
 
+  // parsed.origin / host / hostname come lowercased from the WHATWG URL
+  // parser (scheme + host are case-insensitive per RFC 3986). Canonicalize
+  // each operator allowlist entry the same way before comparing, so a
+  // mixed-case operator entry ("HTTPS://Example.com" / "Example.COM") still
+  // matches instead of silently never matching and falling through to the
+  // fallback. The attacker-controlled rawTarget is already normalized, so
+  // this only makes the operator's intended allowlist work — never widens it.
   if (baseOrigin !== null && parsed.origin === baseOrigin) return rawTarget;
   if (allowedOrigins) {
     for (var i = 0; i < allowedOrigins.length; i += 1) {
-      if (parsed.origin === allowedOrigins[i]) return rawTarget;
+      if (parsed.origin === String(allowedOrigins[i]).toLowerCase()) return rawTarget;
     }
   }
   if (allowedHosts) {
     for (var j = 0; j < allowedHosts.length; j += 1) {
-      if (parsed.host === allowedHosts[j] || parsed.hostname === allowedHosts[j]) {
+      var allowedHost = String(allowedHosts[j]).toLowerCase();
+      if (parsed.host === allowedHost || parsed.hostname === allowedHost) {
         return rawTarget;
       }
     }

package/lib/safe-sql.js

@@ -494,6 +494,93 @@ function toPositional(sql, dialect) {
   return out;
 }
 
+/**
+ * @primitive b.safeSql.normalizeForScan
+ * @signature b.safeSql.normalizeForScan(sql)
+ * @since     0.17.4
+ * @status    stable
+ * @related   b.safeSql.countPlaceholders, b.safeSql.toPositional, b.safeSql.assertSingleStatement
+ *
+ * Produce a parse-only copy of `sql` whose token boundaries are real
+ * whitespace, so a regex tokenizer that assumes whitespace-separated tokens
+ * cannot be evaded. SQL lets two tokens abut with NO whitespace whenever a
+ * comment OR a quoted-identifier boundary separates them (an `INSERT` whose
+ * quoted table name abuts `INTO`, or a slash-star comment wedged between a
+ * keyword and the table); a keyword/table detector hand-rolled with `\s+`
+ * boundaries silently misses those forms even though the engine executes them.
+ * This scan replaces every line (`--`) and slash-star block comment with a
+ * single space and inserts a separating space wherever a quoted string /
+ * identifier (`'...'` / `"..."` / a backtick-quoted name) abuts a word
+ * character on either side — a word char directly before the opening quote OR
+ * directly after the closing quote. The same quote- and comment-aware single
+ * pass as `countPlaceholders` / `toPositional` (doubled-quote escapes
+ * respected), so a comment marker inside a string literal is copied verbatim,
+ * never collapsed. The executed SQL is unchanged — this copy only feeds a
+ * scanner.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeSql.normalizeForScan('INSERT INTO"t"(a) VALUES(?)');
+ *   // → 'INSERT INTO "t"(a) VALUES(?)'
+ *
+ *   b.safeSql.normalizeForScan('UPDATE"residents"SET x=1');
+ *   // → 'UPDATE "residents" SET x=1'
+ *
+ *   b.safeSql.normalizeForScan("SELECT 1-- note");
+ *   // → "SELECT 1 "
+ */
+function normalizeForScan(sql) {
+  var s = String(sql);
+  var out = "";
+  var i = 0;
+  var len = s.length;
+  while (i < len) {
+    var c = s.charAt(i);
+    var nx = i + 1 < len ? s.charAt(i + 1) : "";
+    if (c === "'" || c === '"' || c === "`") {
+      // A quoted token abutting a word character gets a separating space so the
+      // downstream whitespace-anchored tokenizer sees the boundary — on BOTH
+      // sides: before the opening quote when a word char precedes it
+      // (`INTO"t"`), and after the closing quote when a word char follows it
+      // (`"t"SET` / `UPDATE"residents"SET`). A quoted identifier separates
+      // tokens with no whitespace in either direction, so a one-sided boundary
+      // still lets a write hide from the scan. Between, copy the whole quoted
+      // run verbatim (doubled-quote escapes preserved) so a comment marker
+      // inside the literal is never collapsed.
+      if (out.length > 0 && /\w/.test(out.charAt(out.length - 1))) out += " ";
+      out += c;
+      i += 1;
+      while (i < len) {
+        var q = s.charAt(i);
+        out += q;
+        if (q === c) {
+          if (s.charAt(i + 1) === c) { out += c; i += 2; continue; }
+          i += 1; break;
+        }
+        i += 1;
+      }
+      if (i < len && /\w/.test(s.charAt(i))) out += " ";
+      continue;
+    }
+    if (c === "-" && nx === "-") {          // line comment → one space
+      i += 2;
+      while (i < len && s.charAt(i) !== "\n") i += 1;
+      out += " ";
+      continue;
+    }
+    if (c === "/" && nx === "*") {          // block comment → one space
+      i += 2;
+      while (i < len && !(s.charAt(i) === "*" && s.charAt(i + 1) === "/")) i += 1;
+      i += 2;
+      out += " ";
+      continue;
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+
 /**
  * @primitive b.safeSql.DEFAULT_IDENTIFIER_RE
  * @signature b.safeSql.DEFAULT_IDENTIFIER_RE
@@ -693,6 +780,7 @@ module.exports = {
   assertOneOf:         assertOneOf,
   countPlaceholders:   countPlaceholders,
   toPositional:        toPositional,
+  normalizeForScan:    normalizeForScan,
   SafeSqlError:        SafeSqlError,
   // Exposed so consumers can compose their own validators
   DEFAULT_IDENTIFIER_RE: DEFAULT_IDENTIFIER_RE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.17.2",
+  "version": "0.17.4",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2d2edd9e-40b2-4d7d-8170-e9e03ba03685",
+  "serialNumber": "urn:uuid:52cadd01-ca88-4b82-9fe0-e10eaf4be085",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T09:06:52.771Z",
+    "timestamp": "2026-07-17T12:31:35.543Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.17.2",
+      "bom-ref": "@blamejs/core@0.17.4",
       "type": "application",
       "name": "blamejs",
-      "version": "0.17.2",
+      "version": "0.17.4",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.17.2",
+      "purl": "pkg:npm/%40blamejs/core@0.17.4",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.17.2",
+      "ref": "@blamejs/core@0.17.4",
       "dependsOn": []
     }
   ]