@blamejs/core 0.17.4 → 0.17.5

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.17.x
 
+- v0.17.5 (2026-07-17) — **A tampered or over-filtered backup can no longer silently wipe the live data directory on restore, DNSSEC-strict resolution stays enforced when a stale answer is served, and a family of guards that matched a name against a lookup table now reject a prototype-member name instead of misclassifying it.** Restoring a backup whose manifest lists zero files -- because a tampered unsigned bundle stripped every entry, or an opts.filter matched nothing -- extracted an empty staging directory and swapped it over the live data directory: a silent, full data-directory wipe reported to the operator as a successful restore. The manifest validator now refuses an empty file list, and the restore path refuses to swap a zero-file extract over a non-empty data directory. Separately, b.network.dns.resolver's validate: true DNSSEC gate was skipped on the serve-stale path, so an upstream outage could downgrade a DNSSEC-strict lookup (including DANE TLSA resolution) to unauthenticated stale data; the gate now holds on the stale path too. And a group of guards resolved a host, scheme, tag, method, or agent name against a plain-object lookup table with a truthiness read, so a name colliding with an inherited object member (constructor) was misclassified -- over-rejected as reserved/forbidden, or, for the mail-server method catalogue, passed the catalogue gate unregistered. All now match against the table's own keys. **Security:** *Restore refuses a zero-file backup instead of wiping the data directory* — b.backupManifest.validate accepted a manifest with an empty files array. The bundle writer never emits one, but the validator is the single guard the restore path parses an untrusted manifest through, so a tampered unsigned bundle that stripped every file entry (while keeping the still-valid wrapped vault key, which needs no passphrase knowledge) parsed cleanly, extracted an empty staging directory, and had the atomic swap move that empty directory over the live data directory -- a silent, destructive wipe of every file, reported to the operator as a successful restore with a file count of zero. The validator now refuses an empty file list (fixing every consumer -- parse, create, serialize -- at once), so a tampered manifest is rejected before extraction. As defense in depth, b.restore.run now also refuses to swap a zero-file extract over a non-empty data directory, which additionally catches an opts.filter that matched no manifest entry; the swap is refused with the data directory left intact rather than destroyed. · *DNSSEC-strict resolution stays enforced on the serve-stale path* — b.network.dns.resolver's validate: true option refuses a response that is not DNSSEC-authenticated (AD=0), but the RFC 8767 serve-stale short-circuit returned a cached stale answer before that gate ran. An attacker who can force an upstream outage (denying the DoH endpoint) could therefore downgrade a DNSSEC-strict lookup -- including b.network.dns.resolver.queryTlsa for DANE, queryDs, or a CNAME chase -- to unauthenticated stale data cached earlier at AD=0, with the caller seeing a success rather than the documented validate-failed refusal. The AD-bit gate now applies on the serve-stale path too (the DNSSEC verdict is per-response), so a stale answer that was not authenticated is refused rather than served to a validating caller. · *Name-lookup guards reject a prototype-member name instead of misclassifying it* — A group of guards tested whether a caller- or peer-supplied name was in a fixed table -- a reserved-HELO-name set, a reserved-local-host set, a dangerous-URL-scheme denylist, a reserved agent-name set, a Tiny-PS forbidden-element set, an HTML void-element set, and the mail-server method catalogue -- with a plain-object truthiness read (TABLE[name]) that walks the prototype chain. A name that collides with an inherited object member -- constructor is the one that survives a lowercased key -- read the inherited value as truthy and was misclassified: over-rejected as reserved or forbidden (b.mail.helo, b.guardListUnsubscribe, b.guardAgentRegistry, b.mailBimi, b.htmlBalance), or, for the mail-server method catalogue, passed the catalogue gate as if it were a registered method (a fail-open at registration). Every site now matches against the table's own keys with an own-property check, so a prototype-member name is treated as any other unknown name; supported names are unaffected.
+
 - v0.17.4 (2026-07-17) — **Three fail-open holes closed: a raw cross-border write could evade the data-residency gate by wedging a comment or eliding whitespace, safe decompression returned undecompressed bytes for an unknown algorithm name, and the shared anti-replay helper admitted a replay when its store signalled a duplicate with a non-boolean value.** A raw SQL write submitted through b.db.runSql / b.db.prepare().run() could slip past the cross-border data-residency gate: the gate's write-detection matched tokens on whitespace boundaries, but SQL lets tokens abut with no whitespace when a comment or a quoted identifier sits between them, so INSERT/**/INTO, an INSERT whose quoted table name abuts INTO, and UPDATE/**/table all executed while the gate never engaged -- landing or moving a row across a residency boundary under a regulated posture. b.safeDecompress resolved its algorithm allowlist with a truthiness lookup, so an algorithm name that collides with an inherited object member (constructor, toString) reached the dispatch and returned the input undecompressed instead of refusing the unknown algorithm -- a fail-open for any caller that maps a client Content-Encoding onto the algorithm. And b.nonceStore.enforceReplay -- the anti-replay helper JWT and DPoP verification use -- detected a replay only when its store returned a literal false, so a store signalling a duplicate with another falsy value (a Redis SETNX null, a SQL INSERT rowcount of 0) let the replayed token through. **Added:** *b.safeSql.normalizeForScan* — A parse-only SQL normalizer that produces a copy whose token boundaries are real whitespace, so a scanner built with whitespace-anchored patterns cannot be evaded by a comment or a quoted-identifier boundary that lets two tokens abut. It collapses line and block comments to a single space and inserts a separating space where a quoted string or identifier follows a word character, in the same quote- and comment-aware single pass as the existing b.safeSql placeholder scanners (a comment marker inside a string literal is preserved, never collapsed). The executed SQL is never derived from this copy -- it only feeds a scanner. **Security:** *Data-residency gate catches a raw write that hides behind a comment or elided whitespace* — The cross-border data-residency gate that guards raw SQL writes (b.db.runSql, b.db.prepare().run()) detected the write and extracted its target table with regexes that assume tokens are separated by whitespace. SQL does not require whitespace between tokens when a comment or a quoted-identifier boundary separates them, so three forms that every engine executes as ordinary writes slipped the detection entirely and the gate never engaged: an INSERT whose double-quoted table name abuts INTO with no space, an INSERT with a block comment wedged between INSERT and INTO, and the same for UPDATE and its table. Under a regulated residency posture a row could therefore be inserted or moved across a residency boundary with no tag check (CWE-863; a GDPR Chapter V transfer-restriction bypass). The gate now normalizes a parse-only copy of the statement through the new b.safeSql.normalizeForScan before matching -- collapsing comments to a space and inserting a boundary where a quoted token abuts a word character -- so every write is detected and gated regardless of how its tokens are spaced. The executed SQL is unchanged. · *Safe decompression refuses an unknown algorithm instead of returning the input undecompressed* — b.safeDecompress resolved opts.algorithm against its allowlist of supported codecs (gzip, deflate, deflate-raw, brotli) with a truthiness lookup on a plain object. An algorithm name that names an inherited object member -- constructor, toString, valueOf -- read back a truthy inherited value, slipped the unsupported-algorithm refusal, and reached the dispatch, where invoking the inherited member returned the raw input buffer. The primitive therefore silently returned undecompressed bytes with no error, contrary to its contract that any algorithm outside the allowlist is refused -- a fail-open for a consumer that maps a client-supplied Content-Encoding token onto the algorithm, which also sidesteps the decompression-bomb size and ratio caps. The allowlist is now resolved with an own-property check, so any unsupported name -- however it collides with a built-in member -- is refused. · *Shared anti-replay helper fails closed on a non-boolean store result* — b.nonceStore.enforceReplay is the anti-replay helper that b.auth.jwt and b.auth.dpop route their replay defense through; it calls the store's checkAndInsert and treated the result as a replay only when it was the literal false. The recommended stores signal a duplicate with a different falsy value -- a Redis SET ... NX returns null and a SQL INSERT ... ON CONFLICT returns a rowcount of 0 -- so a store using either would have its duplicate signal missed and the replayed nonce admitted (a replay-protection bypass for a JWT or DPoP proof). enforceReplay now admits a nonce only on a truthy first-seen confirmation and treats every other result as a replay, matching the fail-closed check the framework's inline anti-replay consumers already use.
 
 - v0.17.3 (2026-07-17) — **A family of security guards that compared a token case-sensitively where the browser or HTTP stack matches it case-insensitively now normalize first, closing a CSP unsafe-keyword bypass and a cookie-prefix bypass and fixing several over-strict refusals of spec-compliant input.** Browsers, HTTP stacks, and URL parsers match a whole family of security-relevant tokens ASCII case-insensitively -- CSP source keywords and scheme sources, the __Secure-/__Host- cookie name prefixes, HTTP auth schemes, media types, and URL schemes. Several framework guards compared those tokens case-sensitively, so a mixed-case variant behaved differently in the guard than it does downstream. In the bypass direction this let a case-variant unsafe CSP keyword reach a header the browser still honors, and let a prefix-violating cookie past the invariant that keeps the browser from silently dropping it. In the over-strict direction it wrongly refused spec-compliant input (a lowercase auth scheme, a mixed-case media type, an uppercase URL scheme, a mixed-case operator allowlist entry). Every case now normalizes the token to ASCII lowercase before the membership, equality, or prefix test. Separately, two crypto algorithm-name lookups and a CBOR integer-boundary round-trip are corrected. **Fixed:** *Auth scheme, media type, and URL scheme comparisons accept spec-compliant case variants* — Three guards refused input that a case-insensitive downstream would accept. The CIBA notification endpoint (b.auth.ciba) matched the Authorization Bearer scheme case-sensitively, rejecting a spec-compliant 'bearer <token>' sender (RFC 7235 auth-schemes are case-insensitive); it now matches the scheme case-insensitively while comparing the token itself verbatim. The tus upload middleware's creation-with-upload path compared the application/offset+octet-stream media type as an exact string, so a compliant 'Application/Offset+Octet-Stream' (or a variant carrying a parameter) created the upload but silently dropped the body; it now compares the lowercased media type with parameters stripped (RFC 7231 §3.1.1.1). The NEL middleware required its collector URL to begin with a lowercase 'https://', rejecting an equivalent 'HTTPS://'; it now compares the scheme case-insensitively (RFC 3986). · *Redirect allowlist matches a mixed-case operator origin or host* — b.safeRedirect.resolve compared the parser-canonicalized (lowercased) origin and host of a candidate URL against the operator's allowedOrigins/allowedHosts entries verbatim. A mixed-case operator entry such as 'Example.COM' or 'HTTPS://Example.com' therefore silently never matched, and a legitimate redirect fell through to the fallback. The operator entries are now canonicalized to lowercase before the comparison. This only makes the operator's intended allowlist work; because the attacker-controlled target is already normalized by the parser, it never widens the allowlist. · *Streaming-hash and OPRF suite selection reject an unknown algorithm name cleanly* — b.crypto.hashStream (and b.crypto.hashFile, which composes it) and b.crypto.oprf.suite resolved a caller-supplied algorithm/suite name against a plain-object lookup table with a truthiness check. A name colliding with an inherited Object.prototype member -- 'constructor' or '__proto__' -- read back a truthy inherited value and slipped the guard: hashStream then threw a synchronous TypeError from a function documented to return a rejected Promise (an unhandled exception for a caller wired only to .catch()), and oprf.suite returned a malformed suite object instead of throwing its documented bad-suite error. Both now resolve the name through an own-property check, matching the guarding used for the SRI algorithm table, so any unknown name is refused with the documented error. · *Deterministic CBOR re-encodes a negative integer at the -2^53 boundary as an integer* — The CBOR decoder returned the negative integer at the -2^53 boundary as a plain Number, but that value is one below the safe-integer range, so the deterministic encoder's integer branch re-emitted it as a float -- breaking round-trip and falsely tripping the requireDeterministic check on a value that is canonically an integer. The decoder now promotes a negative integer that is not a safe integer to a BigInt, so the encoder re-emits the integer head (RFC 8949 §3). **Security:** *CSP builder refuses unsafe keywords and catch-all schemes in any case* — b.csp.build screened its source tokens ('unsafe-inline', 'unsafe-eval', 'unsafe-hashes', the catch-all '*'/'https:', and 'data:' in img/media/font) against its guard sets with a case-sensitive comparison. A User-Agent matches CSP keywords and scheme sources ASCII case-insensitively (CSP3 §2.3/§6.7.2), so a case-variant such as 'Unsafe-Inline', 'HTTPS:', or 'DATA:' slipped the guard and was emitted verbatim into a Content-Security-Policy header the browser still enforces -- reintroducing the exact XSS-defense hole the guard exists to refuse, without the required acknowledgement opt-in. The builder now lowercases each token before the membership test; the original case is still emitted for real hosts and paths, only the guard comparison is normalized. mergeDirectives routes added sources through the same guard, so a case-variant in a merged policy is refused too. · *Cookie name-prefix invariants hold for any case of __Secure-/__Host-* — Browsers apply the __Secure-/__Host- cookie name-prefix requirements (RFC 6265bis §4.1.3) case-insensitively -- they lowercase the cookie name before the prefix test. b.cookies.serialize and the CSRF middleware's cookie-name safety check compared the prefix case-sensitively, so a case-variant name like __host- or __SECURE- dodged the framework's Secure/Path=//no-Domain invariant while still being subject to the browser's enforcement -- the cookie would then be silently rejected by the browser (never set), defeating the middleware or session it belonged to. Both now compare a lowercased copy of the name, so a prefix-violating cookie is refused at the source for every case. The CSRF middleware, which builds its own Set-Cookie header rather than routing through serialize, additionally gained the __Secure- branch it was missing entirely.

package/lib/backup/manifest.js

@@ -177,6 +177,14 @@ function validate(manifest) {
   }
   if (!Array.isArray(manifest.files)) {
     errors.push("files: required array");
+  } else if (manifest.files.length === 0) {
+    // A backup that describes zero files is never legitimate — the bundle
+    // writer refuses to emit one. Refuse it here too: this is the single
+    // guard the restore path parses an untrusted manifest through, and a
+    // tampered manifest that strips every entry (while keeping a valid
+    // wrapped vault key) would otherwise restore to an empty staging dir
+    // that the swap moves over the live dataDir — a silent destructive wipe.
+    errors.push("files: required non-empty array");
   } else {
     // Detect duplicate relativePath / encryptedPath — would corrupt restore
     var seenRel = Object.create(null);

package/lib/guard-agent-registry.js

@@ -102,7 +102,7 @@ function _checkName(name, profile) {
     throw new GuardAgentRegistryError("agent-registry/name-too-long",
       "guardAgentRegistry.validate: name exceeds maxNameBytes=" + profile.maxNameBytes);
   }
-  if (RESERVED_EXACT[name]) {
+  if (Object.prototype.hasOwnProperty.call(RESERVED_EXACT, name)) {
     throw new GuardAgentRegistryError("agent-registry/reserved-name",
       "guardAgentRegistry.validate: name '" + name + "' is framework-reserved");
   }

package/lib/guard-list-unsubscribe.js

@@ -174,7 +174,7 @@ function _isRefusedAutoFetchHost(hostname, allowedHosts) {
   }
   if (lower.length === 0) return "missing-host";
   if (IPV4_LITERAL_RE.test(lower) || IPV6_LITERAL_RE.test(lower)) return "ip-literal";
-  if (RESERVED_LOCAL_HOSTS[lower]) return "reserved-local-host";
+  if (Object.prototype.hasOwnProperty.call(RESERVED_LOCAL_HOSTS, lower)) return "reserved-local-host";
   // Hostname suffix refusal — RFC 6761 reserved / mDNS / single-network.
   if (lower === "local" || lower.endsWith(".local")) return "reserved-local-suffix";
   if (lower === "lan" || lower.endsWith(".lan")) return "reserved-local-suffix";
@@ -277,7 +277,7 @@ function validate(headers, opts) {
       return _verdict("refuse", "URI '" + _trunc(u) + "' has no scheme (RFC 3986 §3.1)",
         { uris: classified, hasHttpsUri: hasHttpsUri, hasMailtoUri: hasMailtoUri, postHeaderOk: false });
     }
-    if (DANGEROUS_SCHEMES[scheme]) {
+    if (Object.prototype.hasOwnProperty.call(DANGEROUS_SCHEMES, scheme)) {
       return _verdict("refuse", "URI scheme '" + scheme + "' is on the always-refused list (XSS / file-read class)",
         { uris: classified, hasHttpsUri: hasHttpsUri, hasMailtoUri: hasMailtoUri, postHeaderOk: false });
     }

package/lib/html-balance.js

@@ -184,7 +184,7 @@ function check(html) {
       // Self-closing: `<foo />` or `<foo/>` or HTML5 void elements.
       var selfClose = html.charCodeAt(j - 1) === 0x2F /* / */;
       if (isClose) {
-        if (VOID_TAGS[tag]) {
+        if (Object.prototype.hasOwnProperty.call(VOID_TAGS, tag)) {
           // Stray closer for a void tag — surface as error.
           var pcv = _posToLineColumn(html, i);
           return {
@@ -221,7 +221,7 @@ function check(html) {
         stack.pop();
       } else {
         // Open tag (or self-closing).
-        if (selfClose || VOID_TAGS[tag]) {
+        if (selfClose || Object.prototype.hasOwnProperty.call(VOID_TAGS, tag)) {
           // No push.
         } else if (Object.prototype.hasOwnProperty.call(RAW_TEXT_TAGS, tag)) {
           // Skip raw-text content AND its closing tag entirely. Inside

package/lib/mail-bimi.js

@@ -398,7 +398,7 @@ function validateTinyPsSvg(svgBytes) {
 
     if (t.type === "tag") {
       var name = t.name;
-      if (TINY_PS_FORBIDDEN_TAGS[name]) {
+      if (Object.prototype.hasOwnProperty.call(TINY_PS_FORBIDDEN_TAGS, name)) {
         _vio("element-forbidden",
           "<" + name + "> is forbidden in Tiny-PS (script / style / animation / filter / image / foreign-content class)");
       }

package/lib/mail-helo.js

@@ -280,7 +280,12 @@ async function evaluate(ctx, opts) {
 
   // Not an address-literal; must be a domain.
   var lower = claimed.toLowerCase();
-  if (LOCALHOST_REFUSED[lower]) {
+  // Own-property membership test — a bare `LOCALHOST_REFUSED[lower]`
+  // walks the prototype chain, so a claim that collides with an
+  // Object.prototype key (`constructor`, `__proto__`, ...) reads the
+  // inherited value as truthy and gets mislabelled a reserved-name
+  // claim. Match the table strictly against its own keys.
+  if (Object.prototype.hasOwnProperty.call(LOCALHOST_REFUSED, lower)) {
     return _emit(auditImpl, "reject-shape", {
       shape:  "invalid",
       reason: "localhost-class claim '" + lower + "' refused (RFC 6761 §6.3 reserved name)",

package/lib/mail-server-registry.js

@@ -197,12 +197,18 @@ function create(opts) {
         "register: '" + name + "' entry.maxHandlerMs must be a positive integer ≤ " +
         MAX_HANDLER_MS_CEILING + " (got " + entry.maxHandlerMs + ")");
     }
-    if (!catalogue[name] && entry.allowExperimental !== true) {
+    // Own-property membership, not `catalogue[name]` truthiness: the frozen
+    // plain-object catalogues (IMAP_VERBS / JMAP_METHODS / MANAGESIEVE_VERBS)
+    // inherit Object.prototype, so a handler name colliding with a prototype
+    // member (`constructor`, `toString`) would read a truthy inherited value
+    // and silently pass the catalogue gate without allowExperimental.
+    var inCatalogue = Object.prototype.hasOwnProperty.call(catalogue, name);
+    if (!inCatalogue && entry.allowExperimental !== true) {
       throw new MailServerRegistryError("mail-server-registry/unknown-method",
         "register: '" + name + "' is not in the " + opts.protocol + " catalogue; pass " +
         "allowExperimental: true to opt out of the catalogue gate (audited)");
     }
-    if (entry.allowExperimental === true && !catalogue[name]) {
+    if (entry.allowExperimental === true && !inCatalogue) {
       try {
         audit.safeEmit({
           action:   "mail.serverRegistry.experimental_registration",

package/lib/network-dns-resolver.js

@@ -323,7 +323,17 @@ function create(opts) {
     var filled;
     try { filled = await entry.promise; }
     finally { if (inflight.get(key) === entry) inflight.delete(key); }
-    if (filled.stale) return filled.result;
+    if (filled.stale) {
+      // The validate: true AD-bit gate holds on the serve-stale path too —
+      // otherwise an upstream outage silently downgrades a DNSSEC-strict
+      // lookup to unauthenticated stale data (the verdict is per-response,
+      // RFC 4035 §3.2.3, so a stale entry cached AD=0 must still be refused).
+      if (validate && !filled.result.validated) {
+        throw new ResolverError("resolver/validate-failed",
+          "query: validate: true but served-stale response was AD=0 for " + name + "/" + qtype);
+      }
+      return filled.result;
+    }
     if (validate && !filled.validated) {
       throw new ResolverError("resolver/validate-failed",
         "query: validate: true but upstream returned AD=0 for " + name + "/" + qtype);

package/lib/restore.js

@@ -310,6 +310,25 @@ function create(opts) {
         "extract failed: " + ((e && e.message) || String(e)));
     }
 
+    // Defense-in-depth: never swap a zero-file extract over a populated
+    // dataDir. A zero-file staging dir moved over the live dataDir is a
+    // silent full wipe. The manifest validator now refuses an empty
+    // manifest (the attacker path), but an opts.filter that matched no
+    // entry also yields fileCount 0 — an operator mistake that must not
+    // destroy live data with a success report. If the dataDir is already
+    // empty a zero-file swap is a harmless no-op, so gate on non-empty.
+    var dataDirEntries = [];
+    try { dataDirEntries = nodeFs.readdirSync(dataDir); } catch (_e) { dataDirEntries = []; }
+    if (extracted.fileCount === 0 && dataDirEntries.length > 0) {
+      _cleanupTmp();
+      _emitAudit("restore.failure",
+        { bundleId: bundleId, reason: "refusing zero-file restore over a non-empty dataDir" },
+        "failure");
+      throw new RestoreError("restore/empty-extract-refused",
+        "refusing to swap a zero-file restore over the non-empty dataDir '" + dataDir +
+        "' (a filter matched no manifest entry, or the manifest is empty) — this would wipe live data");
+    }
+
     // 3. Atomic swap. On swap failure, the stagingDir is preserved so
     // an operator can recover manually — we do NOT delete it here.
     var swapResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.17.4",
+  "version": "0.17.5",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:52cadd01-ca88-4b82-9fe0-e10eaf4be085",
+  "serialNumber": "urn:uuid:360eade5-cc2d-4f7b-b52b-9e326e021f8a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T12:31:35.543Z",
+    "timestamp": "2026-07-17T13:58:58.122Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.17.4",
+      "bom-ref": "@blamejs/core@0.17.5",
       "type": "application",
       "name": "blamejs",
-      "version": "0.17.4",
+      "version": "0.17.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.17.4",
+      "purl": "pkg:npm/%40blamejs/core@0.17.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.17.4",
+      "ref": "@blamejs/core@0.17.5",
       "dependsOn": []
     }
   ]