@blamejs/core 0.17.21 → 0.17.22

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.17.x
 
+- v0.17.22 (2026-07-25) — **`b.network.tls.checkServerIdentity9525` parses subjectAltName quote-aware, closing a hostname-verification bypass.** The strict RFC 9525 identity verifier parsed Node's subjectAltName string with a naive comma split, ignoring the JSON-quoted encoding Node emits for a SAN value that itself contains separators (the CVE-2021-44531/44532 remediation). A certificate whose single dNSName is a quoted blob such as `DNS:"x, DNS:victim.com, y"` was broken into pieces by the split, smuggling a clean `victim.com` token the certificate never asserts -- so checkServerIdentity9525 ACCEPTED a host that Node's own tls.checkServerIdentity REJECTS (ERR_TLS_CERT_ALTNAME_INVALID). The verifier now splits SAN entries on commas outside quotes and JSON-decodes quoted spans, matching Node's splitEscapedAltNames, so it asserts only the certificate's actual dNSName / IP values and is at least as strict as the function it advertises replacing. This path gates peer identity in b.crypto.spkiPinVerifier. **Security:** *checkServerIdentity9525 no longer accepts a hostname smuggled through a quoted subjectAltName* — Node renders a subjectAltName value that contains commas or control characters as a JSON-quoted string, so a single dNSName whose value is `x, DNS:victim.com, y` appears in cert.subjectaltname as `DNS:"x, DNS:victim.com, y"`. The verifier's SAN parser split that raw string on every comma, turning one entry into several and extracting a `DNS:victim.com` token the certificate does not actually present -- a hostname-verification bypass, since a strict RFC 9525 drop-in must be no weaker than the Node function it replaces (which rejects this cert). The parser now mirrors Node's splitEscapedAltNames: it splits only on commas outside quotes and JSON-decodes quoted spans, so each parsed dNSName is exactly one GeneralName and a smuggled name can no longer match. Malformed SAN quoting fails closed (asserts no identifiers). Operators using b.network.tls.checkServerIdentity9525 (directly or via b.crypto.spkiPinVerifier) should upgrade.
+
 - v0.17.21 (2026-07-25) — **`blamejs erase` treats only `--confirm true` as confirmation, so `--confirm false` no longer triggers the irreversible erase.** Three fixes to the blamejs command line. The `erase` subcommand (a cryptographic single-row erase) gated its irreversible action on a bare-truthiness check, so `--confirm false` -- a string -- counted as confirmation and the erase proceeded; the gate now accepts only `true` / "true", matching `audit purge`, and refuses anything else. A stray `-v` / `--version` token alongside a subcommand no longer short-circuits to the version print: `blamejs migrate up --db x -v` previously returned 0 after printing the version without running the migration, handing automation a false pass; the version flag is now honored only when it is the whole invocation. And `blamejs dev` now survives a crash of the watched child -- it stays up to hot-restart on the next file change instead of draining the event loop and exiting 0 -- and awaits the child's full termination on SIGINT/SIGTERM so a shutdown cannot orphan it. **Fixed:** *blamejs erase refuses --confirm false instead of performing the irreversible erase* — The erase subcommand confirmed its irreversible action with a bare-truthiness check, so the string `--confirm false` was treated as confirmation and the erase ran. Confirmation is now satisfied only by `--confirm true` (or the bare `--confirm`), matching the check `audit purge` already used; any other value -- including `false` -- is refused with a non-zero exit and no erase. A shared confirmation helper backs every destructive subcommand so the acknowledgement contract cannot drift between them. · *A stray -v / --version no longer turns a subcommand into a silent no-op* — The top-level version flag was evaluated before subcommand dispatch and returned 0 whenever `-v` / `--version` appeared anywhere in the arguments, so a consequential command such as `migrate up`, `seed run`, or `erase` alongside a stray `-v` printed the version and exited 0 without doing anything -- a false success for any script checking the exit code. The version flag is now honored only when the invocation carries no subcommand; otherwise the subcommand runs (or fails) as written. · *blamejs dev survives a watched-child crash and shuts the child down cleanly* — The dev supervisor held the event loop open with an unref'd timer, so when the watched child process crashed the supervisor drained the loop and exited 0 -- defeating crash-resilience (it should stay up and hot-restart on the next file change) and reporting success even though the app had crashed. It now holds a referenced heartbeat so a child crash leaves the supervisor running, and on SIGINT/SIGTERM it awaits the child's full termination (graceful signal, then escalation) before exiting, so a shutdown can no longer race ahead and orphan the child.
 
 - v0.17.20 (2026-07-24) — **`b.forms.validate` enforces required checkboxes server-side and rejects malformed field bounds, closing two validation gaps.** b.forms.validate previously let an unchecked required checkbox pass: the renderer emits the HTML `required` attribute for it, but the server-side validator skipped the check, so a client that omitted the box -- or any non-browser caller -- bypassed a constraint the form advertised. It now rejects an unchecked required checkbox, keeping backend validation in lock-step with what the form displays. Separately, a field whose numeric bound (min/max/minlength/maxlength) was not a finite number went silently unenforced -- a NaN comparison is always false -- so the bound became a no-op; validate now throws on such a spec at the entry point, the same way it already rejects a non-precompiled regex pattern. Two smaller fixes: a field rendered without an explicit type now emits type="text" (matching the widget it dispatches to) rather than an empty type attribute, and b.externalDb reports EXPLAIN statements as row-returning so a query plan's rows are not dropped by the local-execution row/no-row chooser. **Changed:** *b.forms.validate option reference corrected* — The validate() reference described length bounds as minLength/maxLength, but the option keys are the HTML-attribute spellings minlength/maxlength (the same keys the renderer reads); the reference and its example are corrected, and the example now uses a numeric min bound on its number field. · *Vendored Public Suffix List refreshed to the current snapshot* — The bundled Public Suffix List that backs domain classification (registrable-domain and public-suffix checks in URL, cookie, and SSRF handling) is updated to the latest upstream publicsuffix.org snapshot, so newly delegated public suffixes and private-domain entries are recognized. **Fixed:** *Required checkboxes are enforced server-side in b.forms.validate* — A checkbox marked required is rendered with the HTML `required` attribute, but validate() treated an unchecked box (which coerces to false) as satisfying the field, so an unchecked required checkbox passed. Any caller that skipped the box -- a scripted client, or a browser with the constraint stripped -- bypassed a documented requirement. validate() now returns an error for an unchecked required checkbox (honouring the field's errorMessages.required), so the backend enforces the same constraint the frontend shows. A form that relied on the previous pass-through for an unchecked required checkbox will now surface a validation error, which is the intended behaviour. · *A malformed numeric field bound is rejected instead of silently ignored* — When a field's min, max, minlength, or maxlength was not a finite number (a non-numeric string, NaN, or Infinity), its comparison could never fire -- a NaN comparison is always false -- so the bound was quietly unenforced while appearing to constrain the field. validate() now throws at the entry point when a defined bound is non-finite, matching how it already requires pattern to be a pre-compiled RegExp. Numeric-string bounds (e.g. min: "1") remain accepted. · *A typeless field renders type="text" instead of an empty type attribute* — b.forms.render dispatches a field with no explicit type to a text input, but the emitted markup carried type="" rather than type="text". The rendered type attribute now matches the widget dispatched, so the markup is self-consistent. · *b.externalDb reports EXPLAIN statements as row-returning* — statementReturnsRows classified a plain EXPLAIN (and an EXPLAIN ANALYZE wrapping a write) as producing no row set, so the local-execution path could route it to a no-row call and drop the query plan. EXPLAIN always returns plan rows to the caller; it is now reported as row-returning whenever its prefix resolves, while an unparseable EXPLAIN prefix stays fail-closed. This is distinct from the cross-border residency read/write classification, which is unchanged.

package/lib/network-tls.js

@@ -13,6 +13,7 @@ var atomicFile = require("./atomic-file");
 var bCrypto = require("./crypto");
 var C = require("./constants");
 var safeBuffer = require("./safe-buffer");
+var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
@@ -3071,6 +3072,49 @@ function _matchDnsNamePattern(pattern, host) {
   return true;
 }
 
+// Node renders a SAN value that contains separators/control chars as a
+// JSON-quoted string (the CVE-2021-44531/44532 remediation), e.g. a single
+// dNSName whose value is `x, DNS:y.com` appears as `DNS:"x, DNS:y.com"`. A
+// naive split(",") would break that one entry into several and smuggle a
+// clean `DNS:y.com` token the certificate never asserted — a hostname
+// verification bypass. Split on commas OUTSIDE quotes and JSON-decode quoted
+// spans, mirroring Node's own splitEscapedAltNames, so each entry is exactly
+// one GeneralName.
+var _SAN_QUOTED_RE = /^"(?:[^"\\]|\\.)*"/;
+function _splitEscapedAltNames(altNames) {
+  var result = [];
+  var current = "";
+  var offset = 0;
+  while (offset !== altNames.length) {
+    var nextSep = altNames.indexOf(",", offset);
+    var nextQuote = altNames.indexOf('"', offset);
+    if (nextQuote !== -1 && (nextSep === -1 || nextQuote < nextSep)) {
+      current += altNames.substring(offset, nextQuote);
+      var match = _SAN_QUOTED_RE.exec(altNames.substring(nextQuote));
+      if (!match) {
+        // Malformed quoting — refuse to parse rather than guess.
+        throw new TlsTrustError("tls/altname-format",
+          "malformed quoted subjectAltName entry");
+      }
+      // match[0] is a JSON string literal (the `_SAN_QUOTED_RE` shape); route
+      // through the framework JSON primitive rather than raw JSON.parse.
+      current += safeJson.parse(match[0]);
+      offset = nextQuote + match[0].length;
+    } else if (nextSep !== -1) {
+      current += altNames.substring(offset, nextSep);
+      result.push(current);
+      current = "";
+      offset = nextSep + 1;
+      if (altNames.charAt(offset) === " ") offset += 1;   // skip the ", " gap
+    } else {
+      current += altNames.substring(offset);
+      offset = altNames.length;
+    }
+  }
+  result.push(current);
+  return result;
+}
+
 function _parseSanString(rawSubjectAltName) {
   // Node exposes the SAN as a comma-separated string of typed entries:
   //   "DNS:foo.example.com, DNS:*.example.com, IP Address:198.51.100.1,
@@ -3081,13 +3125,27 @@ function _parseSanString(rawSubjectAltName) {
   if (typeof rawSubjectAltName !== "string" || rawSubjectAltName.length === 0) {
     return { dns: dns, ips: ips };
   }
-  var entries = rawSubjectAltName.split(",");
+  var entries;
+  try {
+    entries = _splitEscapedAltNames(rawSubjectAltName);
+  } catch (_e) {
+    // Malformed SAN quoting → assert no identifiers (fail closed).
+    return { dns: dns, ips: ips };
+  }
   for (var i = 0; i < entries.length; i += 1) {
-    var raw = entries[i].trim();
-    var colon = raw.indexOf(":");
+    var entry = entries[i];
+    var colon = entry.indexOf(":");
     if (colon === -1) continue;
-    var kind = raw.slice(0, colon).trim();
-    var val  = raw.slice(colon + 1).trim();
+    // The GeneralName TYPE prefix is emitted by _splitEscapedAltNames exactly
+    // (no surrounding whitespace), and the value MUST be preserved EXACTLY —
+    // NOT trimmed. Trimming would strip leading/trailing control whitespace a
+    // decoded quoted value can carry: a dNSName that is a newline followed by
+    // "victim.com" decodes to "\nvictim.com", and a trim would reduce it to a
+    // bare "victim.com" that matches a name the certificate never asserts — a
+    // bypass. Node compares the decoded value verbatim, so an identifier with
+    // such characters simply fails the exact match and is rejected.
+    var kind = entry.slice(0, colon);
+    var val  = entry.slice(colon + 1);
     if (kind === "DNS") {
       dns.push(val);
     } else if (kind === "IP Address" || kind === "IP") {
@@ -3101,9 +3159,13 @@ function _parseSanString(rawSubjectAltName) {
 
 function _normalizeIpForCompare(ip) {
   // Lower-case + strip embedded brackets so "[::1]" / "::1" / "::0001"
-  // all compare equal.
+  // all compare equal. Do NOT trim surrounding whitespace: a valid IP never
+  // carries any, and trimming would let a smuggled SAN value like
+  // "1.2.3.4\n" (a decoded quoted entry) normalize to a clean IP and match a
+  // host the certificate never asserts — net.isIP rejects such a value, so
+  // preserving it verbatim fails closed.
   if (typeof ip !== "string") return null;
-  var s = ip.trim();
+  var s = ip;
   if (s.length >= 2 && s.charAt(0) === "[" && s.charAt(s.length - 1) === "]") {
     s = s.slice(1, -1);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.17.21",
+  "version": "0.17.22",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:5c9f188a-268c-45b5-b70b-b8a8c8fcd062",
+  "serialNumber": "urn:uuid:b4db0315-d0d2-43e1-b74d-de1c039039b7",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-25T13:10:41.119Z",
+    "timestamp": "2026-07-25T15:20:12.927Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.17.21",
+      "bom-ref": "@blamejs/core@0.17.22",
       "type": "application",
       "name": "blamejs",
-      "version": "0.17.21",
+      "version": "0.17.22",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.17.21",
+      "purl": "pkg:npm/%40blamejs/core@0.17.22",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.17.21",
+      "ref": "@blamejs/core@0.17.22",
       "dependsOn": []
     }
   ]