@blamejs/core 0.18.37 → 0.18.39

package/CHANGELOG.md

@@ -8,6 +8,60 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.39 (2026-08-19) — **A `PRAGMA trusted_schema` detector could be made to cost 100 ms by a run of spaces.** `b.guardSql`'s `trusted-schema` detector matched the optional `=` with `\s*=?\s*`. With the `=` absent those two whitespace runs are adjacent, so a run can be divided between them in as many ways as it is long — and every division is retried when the value that follows is not one the detector wants. `PRAGMA trusted_schema` followed by 16,000 spaces and a non-value took 100 ms, growing fourfold for each doubling of the run.
+
+Binding the `=` to the whitespace after it leaves exactly one way to consume the run. Same statements refused, same statements ignored, measured flat.
+
+Upgrade if you screen SQLite statements through `b.guardSql`. **Fixed:** *Vendored `@blamejs/pki` moves to 0.5.11* — The bundle backing `b.mtlsCa` and `b.auth.passkey`. In 0.5.11 the `pki.key`, `pki.path`, `pki.lint` and `pki.ocsp` verbs refuse an option they do not read rather than ignoring it, so a misspelled `password` on key export can no longer leave a private key unprotected — and they refuse an options object whose values come from a getter, since a getter is asked afresh on every read and the value the check saw need not be the one the verb uses.
+
+No framework call site passes an unread option, so nothing changes for callers going through `b.mtlsCa` or `b.auth.passkey`. Operators calling the vendored library directly should check their option names against the ones each verb documents. · *A sentence in the 0.18.38 notes described an implementation that was not shipped* — The summary said the `COPY` stream exclusion is "decided by reading the following word rather than by a lookahead". That describes an approach that was built and then withdrawn; the shipped code keeps the lookahead and moves it in front of the whitespace. The published release body was corrected at the time and the changelog now matches it. **Security:** *The trusted_schema detector is no longer quadratic in a whitespace run* — The pattern is now `\bPRAGMA\s+trusted_schema\s*(?:=\s*)?(?:on|1|true)\b`. The set of statements it refuses is unchanged — `=on`, `= on`, `  =  1`, a bare ` on`, `=TRUE` — and `PRAGMA trusted_schema = off` is still not a finding. Verified identical across 10,008 constructed inputs before the change landed.
+
+Cost at the ambiguous position, `PRAGMA trusted_schema` + n spaces + a character no value starts with:
+
+| n | before | after |
+| --- | --- | --- |
+| 4,000 | 6 ms | 0.01 ms |
+| 8,000 | 25 ms | 0.01 ms |
+| 16,000 | 100 ms | 0.02 ms |
+
+A cost regression check ships with it, asserting the run does not grow quadratically rather than pinning a wall-clock number.
+
+The other 31 detectors were swept the same way — every one stressed at its own ambiguous positions with six different fillers rather than at its trigger keyword — and none grows superlinearly. This was the only one. **References:** [SQLite PRAGMA trusted_schema](https://www.sqlite.org/pragma.html#pragma_trusted_schema) · [OWASP — Regular expression Denial of Service (ReDoS)](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)
+
+- v0.18.38 (2026-08-19) — **`COPY ... TO STDIN` was reported as a server-side file access whenever it carried more than one space.** `b.guardSql`'s `copy-file` detector finds a `COPY` that reads or writes a file on the database server, and excludes the client-streaming `STDIN` and `STDOUT` forms because those touch no file. The exclusion was a negative lookahead, and it only worked when the whitespace before the keyword was exactly one character: `COPY t TO STDIN` was quiet, `COPY t TO  STDIN` was reported critical.
+
+The exclusion is now tested before the whitespace is consumed, so the spacing no longer changes the verdict.
+
+No API changes. Upgrade if you pass SQL fragments through `b.guardSql`. **Changed:** *The content-safety gate now refuses a pattern built at runtime* — `blamejs/no-regex-in-content-safety` reported pattern literals only, so `new RegExp(source)` passed it unnoticed anywhere under `lib/**/safe-*.js` or `lib/**/guard-*.js`. It now reports `new RegExp(...)` and `RegExp(...)`, in both the bare and member spellings — `globalThis.RegExp(src)` puts a MemberExpression in the callee and an identifier-only check permits it silently.
+
+Three call sites carry a suppression with its reason recorded beside it. Two of them never match anything against input: `b.guardRegex` asks the parser whether an operator-supplied pattern compiles at all and discards the result, and `b.safeJson` compiles a schema `pattern` precisely so `assertSafe` can screen the compiled form. The third is `b.guardSql`'s detector table, described below. · *The SQL detectors stay on the platform engine, and the reason is now recorded* — These 32 detectors are built with `new RegExp` and run against a caller's SQL, which reads like something the content-safety rule should forbid. Moving them to `b.regexLinear` — whose cost is the length of the subject whatever the pattern says — was tried and measured, and it is worse:
+
+| subject | linear | platform |
+| --- | --- | --- |
+| 158-byte benign SELECT | 1.4 ms | 0.001 ms |
+| 4 KiB benign SELECT | 15.4 ms | 0.012 ms |
+
+The engine expands each `{0,4000}` span into thousands of states, so every ordinary fragment pays. The platform engine's worst case over these same patterns, on adversarial input built to defeat every lazy span, is 5 ms at 32 KiB — less than the linear engine charges for a benign 4 KiB one. The swap would have made every request cost more than the attack it was meant to prevent.
+
+What bounds these patterns is the patterns: every span is explicitly capped and none pairs two quantifiers over an overlapping alphabet. That is a property of this table rather than a general licence, and it is written where the table is defined so a new detector gets the same check.
+
+SECURITY.md is corrected to match. It named a build gate retired in 0.18.37, said no primitive in the family "contains a regular expression" where the enforced claim is that none SCREENS with one, and now states plainly that a runtime-built pattern is not yet reported by the gate. **Fixed:** *The COPY file-access detector no longer depends on how much whitespace precedes STDIN* — The pattern excluded the safe forms with `\s+(?!STDIN\b|STDOUT\b)`. `\s+` is greedy but backtracks: given two spaces it could give one back, leaving ` STDIN` in front of the lookahead, which then read as "not STDIN" and reported a statement that opens no file.
+
+```
+COPY t TO STDIN     quiet
+COPY t TO  STDIN    reported as "reads or writes a server-side file"
+COPY t TO   STDIN   reported
+COPY t TO \n STDIN  reported
+```
+
+The exclusion is now tested BEFORE the whitespace is consumed — `\b(?:TO|FROM)\b(?!\s+(?:STDIN|STDOUT)\b)\s+` — so it is evaluated once, at a fixed position, and cannot interact with that quantifier at all.
+
+The obvious repair is worse. Teaching the lookahead to skip whitespace where it stood, `\s+(?!\s*(?:STDIN|STDOUT)\b)`, gives the two quantifiers the same alphabet: every backtrack re-scans the remainder of the run, which measures 45 ms on a 16,000-space run and grows quadratically — a denial of service introduced into the primitive whose job is to prevent one. Moving the test in front of `\s+` measures flat, and a cost regression check now covers it.
+
+What the detector catches is unchanged, and the lookahead is kept rather than replaced with a scan for a specific reason: its backtracking is what finds the file in `COPY (SELECT x FROM STDOUT) TO '/tmp/x'`, where the first candidate is excluded and the one that matters appears later in the same statement. A scan that resumed past the excluded match would miss it, because every match has to begin at `COPY`. `COPY t TO '/etc/passwd'` fires, `COPY t TO STDINX` fires because the word does not end at `STDIN`, and `COPY t TO STDOUT; COPY u TO '/tmp/x'` fires on the second statement.
+
+Twenty regression checks cover the whitespace forms, the nested case and the boundary. **References:** [PostgreSQL COPY — TO/FROM STDIN and STDOUT stream to the client](https://www.postgresql.org/docs/current/sql-copy.html)
+
 - v0.18.37 (2026-08-19) — **The no-regex rule for content-safety primitives never covered lib/parsers, where 55 patterns were screening adversarial input.** SECURITY.md states that no `b.guard*` or `b.safe*` primitive contains a regular expression, so a screen costs the length of its input and the byte cap that bounds the input bounds the screen. The build gate enforcing that selected files with `lib/(safe-|guard-)[^/]+\.js` — top level only. Every nested primitive was therefore outside it, and all five of them are the ones that parse untrusted bytes: `b.parsers.yaml`, `b.parsers.toml`, `b.parsers.ini`, `b.parsers.env` and `b.parsers.xml`. Between them they carried 55 pattern literals.
 
 All 55 are gone, and the gate now covers nested paths. Nothing about the parsers' behaviour changes: each screen was differential-tested against the pattern it replaced before the call site was swapped.

package/NOTICE

@@ -68,7 +68,7 @@ Used for:    FIPS 203 ML-KEM (ml_kem_512 / ml_kem_768 / ml_kem_1024),
              reference implementation.
 --------------------------------------------------------------------------------
 Component:   @blamejs/pki
-Version:     0.5.10
+Version:     0.5.11
 Source:      https://github.com/blamejs/pki
 License:     Apache-2.0
 Copyright:   Copyright (c) blamejs contributors

package/README.md

@@ -322,7 +322,7 @@ All runtime dependencies are committed to the repo — no transitive npm install
 | [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) | 2.3.0 | [Paul Miller](https://github.com/paulmillr) | Browser (ESM) build only — SHAKE256 / SHA-3 / SHA-2 / HMAC / HKDF for the client half of a hybrid exchange. The server side reaches all of these through `node:crypto`, so there is no server bundle |
 | [`@noble/curves`](https://github.com/paulmillr/noble-curves) | 2.3.0 (bundles @noble/hashes 2.3.0) | [Paul Miller](https://github.com/paulmillr) | RFC 9497 Oblivious Pseudo-Random Function (OPRF / VOPRF / POPRF) over ristretto255 / P-256 / P-384 / P-521, behind `b.crypto.oprf` |
 | [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) | 0.7.0 (bundles @noble/hashes, @noble/curves, @noble/ciphers 2.3.0) | [Paul Miller](https://github.com/paulmillr) | Pure-JS FIPS 203 ML-KEM (`ml_kem_512` / `ml_kem_768` / `ml_kem_1024`), FIPS 204 ML-DSA (`ml_dsa_44/65/87`), FIPS 205 SLH-DSA (`slh_dsa_*`). First-class on both server-side and client-side via `b.pqcSoftware` — security-first defaults pin to the highest cat-5 levels (ML-KEM-1024, ML-DSA-87, SLH-DSA-SHAKE-256f); interoperable with Node's built-in WebCrypto ML-KEM that `b.crypto.encrypt` / `b.middleware.apiEncrypt` use. A browser (ESM) build ships beside it carrying the KEM suites only — a client half encapsulates and does not sign |
-| [`@blamejs/pki`](https://github.com/blamejs/pki) | 0.5.10 | [blamejs](https://github.com/blamejs) | Zero-dependency pure-JS X.509 / CRL / PKCS#12 / CSR / CMS toolkit backing `b.mtlsCa` — ML-DSA-87 (FIPS 204) post-quantum + ECDSA-P384 cert signing, PBMAC1 PKCS#12 packaging, chain validation (no openssl CLI) — and the WebAuthn attestation / assertion verification behind `b.auth.passkey` |
+| [`@blamejs/pki`](https://github.com/blamejs/pki) | 0.5.11 | [blamejs](https://github.com/blamejs) | Zero-dependency pure-JS X.509 / CRL / PKCS#12 / CSR / CMS toolkit backing `b.mtlsCa` — ML-DSA-87 (FIPS 204) post-quantum + ECDSA-P384 cert signing, PBMAC1 PKCS#12 packaging, chain validation (no openssl CLI) — and the WebAuthn attestation / assertion verification behind `b.auth.passkey` |
 | [`SecLists` 10k-most-common.txt](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt) | master snapshot | [Daniel Miessler / SecLists contributors](https://github.com/danielmiessler/SecLists) (CC-BY-3.0) | Top-10000 common-password dictionary read by `b.auth.password.policy()` for the NIST 800-63B §5.1.1.2 "previously breached" check |
 | [`prismjs`](https://prismjs.com/) | 1.30.0 | [Lea Verou + contributors](https://github.com/PrismJS/prism) | Syntax highlighting in the example wiki's code blocks (browser-side) |
 

package/lib/guard-regex.js

@@ -2321,6 +2321,12 @@ function _ambiguityFindings(src, flags) {
     // at all" and returned every finding false, so a quadratic pattern using
     // any of that syntax walked straight past this gate.
     var compiles = true;
+    // The result is discarded and the pattern is never run against a subject —
+    // this asks the parser whether `text` is a regular expression at all, which
+    // is the opposite direction from screening input with one. Nothing a caller
+    // supplies is matched here; a source that does not compile simply reports as
+    // not-a-regex.
+    // eslint-disable-next-line blamejs/no-regex-in-content-safety
     try { RegExp(text, typeof flags === "string" ? flags : ""); }
     catch (_e) { compiles = false; }
     if (compiles) {

package/lib/guard-sql.js

@@ -248,11 +248,32 @@ var MASK_SPACE = " ";
 
 function _re(source) {
   // Construct each detector regex from an ASCII source string so the
-  // source file embeds no attack-character literals. Case-insensitive;
-  // detectors are intentionally global-free (first match is enough).
-  return new RegExp(source, "i");                                       // allow:dynamic-regex — detector source is a compile-time ASCII literal table below
+  // source file embeds no attack-character literals. Case-insensitive, and
+  // deliberately NOT global: `.test()` on a `g` regex advances `lastIndex` and
+  // answers differently on the next call with the same input.
+  //
+  // These stay on the platform engine, and that was measured rather than
+  // assumed. Compiling all 32 on b.regexLinear — whose cost is the length of the
+  // subject whatever the pattern says — makes a BENIGN 4 KiB fragment cost 15 ms
+  // against 0.012 ms here, because the NFA expands each `{0,4000}` span into
+  // thousands of states. The platform engine's own worst case over these
+  // patterns is 5 ms at 32 KiB of adversarial SQL, so the swap would have made
+  // every request pay more than the attack it was meant to prevent.
+  //
+  // What bounds these is the patterns themselves: every span is explicitly
+  // capped, and none pairs two quantifiers over an overlapping alphabet. That is
+  // a property of THIS table, not a general licence — a new detector needs the
+  // same check before it is added.
+  //
+  // The suppression below is the ONE audited exception in the family, and it is
+  // recorded rather than assumed: the alternative was measured and is worse, the
+  // sources are a fixed compile-time table rather than anything a caller
+  // supplies, and the cost is covered by a regression check in guard-sql.test.js.
+  // eslint-disable-next-line blamejs/no-regex-in-content-safety
+  return new RegExp(source, "i");                                               // allow:dynamic-regex — compile-time ASCII literal table, every span bounded
 }
 
+
 // \b word-boundary + optional whitespace/paren tolerance baked into
 // each source string. `[\s]` spans the comment-collapsed single spaces.
 var DETECTORS = [
@@ -263,7 +284,31 @@ var DETECTORS = [
     reason: "COPY ... PROGRAM executes a shell command (Postgres RCE)" },
   { code: "sql.file-access", severity: "critical", kind: "copy-file",
     family: "floor", dialect: "postgres",
-    re: _re("\\bCOPY\\b[\\s\\S]{0,4000}?\\b(?:TO|FROM)\\b\\s+(?!STDIN\\b|STDOUT\\b)"),
+    // STDIN / STDOUT stream to the client and touch no server-side file, so
+    // they are excluded — and the exclusion is tested BEFORE the whitespace is
+    // consumed, which is the whole trick here.
+    //
+    // Written the other way round, after `\s+`, it is wrong: `\s+` is greedy but
+    // backtracks, so given two spaces it gives one back, leaves " STDIN" in
+    // front of a lookahead that only knows how to reject "STDIN", and reports a
+    // client-side `COPY t TO  STDIN` as a server-side file access. One space was
+    // quiet and two were critical.
+    //
+    // Teaching that lookahead to skip whitespace (`(?!\s*(?:STDIN|STDOUT)\b)`)
+    // fixes the verdict and introduces a worse problem: `\s+` and the `\s*`
+    // range over the same characters, so every backtrack re-scans the rest of
+    // the run — 45 ms on a 16k-space run, quadratic, in the one primitive whose
+    // job is to not be a denial of service.
+    //
+    // In front of `\s+` the lookahead is evaluated once, at a fixed position,
+    // and cannot interact with that quantifier at all. Measured flat.
+    //
+    // A lookahead rather than a scan-and-compare because its backtracking is
+    // what finds the file in `COPY (SELECT x FROM STDOUT) TO '/tmp/x'`: the
+    // first candidate is excluded and the one that matters comes later in the
+    // SAME statement, which a scan resuming past the excluded match would miss,
+    // since every match has to begin at COPY.
+    re: _re("\\bCOPY\\b[\\s\\S]{0,4000}?\\b(?:TO|FROM)\\b(?!\\s+(?:STDIN|STDOUT)\\b)\\s+"),
     reason: "COPY TO/FROM <file> reads or writes a server-side file" },
   { code: "sql.file-access", severity: "critical", kind: "large-object",
     family: "floor", dialect: "postgres",
@@ -333,7 +378,13 @@ var DETECTORS = [
     reason: "PRAGMA writable_schema lets a write corrupt the schema table" },
   { code: "sql.privilege-pivot", severity: "critical", kind: "trusted-schema",
     family: "floor", dialect: "sqlite",
-    re: _re("\\bPRAGMA\\s+trusted_schema\\s*=?\\s*(?:on|1|true)\\b"),
+    // `\s*=?\s*` was quadratic: with the `=` absent the two runs are adjacent,
+    // so a run of whitespace can be split between them in as many ways as it is
+    // long, and every split is retried when the value that follows does not
+    // match. `PRAGMA trusted_schema` + 16k spaces + a non-value took 100 ms and
+    // grew 4x per doubling. Binding the `=` to the whitespace after it leaves
+    // exactly one way to consume the run. Same language, measured flat.
+    re: _re("\\bPRAGMA\\s+trusted_schema\\s*(?:=\\s*)?(?:on|1|true)\\b"),
     reason: "PRAGMA trusted_schema=ON re-enables unsafe schema functions" },
   { code: "sql.privilege-pivot", severity: "critical", kind: "sqlite-key",
     family: "floor", dialect: "sqlite",

package/lib/safe-json.js

@@ -837,6 +837,12 @@ function _patternMatcher(pattern) {
       // branch twice. That is the overlap the alternation rule exists to
       // catch, so `/^(?=(a|A)+$)a+$/i` would pass a source-only screen and
       // then run, under those flags, against a value from the wire.
+      // Compiled precisely so assertSafe can screen the COMPILED form, per the
+      // comment above: a source-only screen misreads `(a|A)+` under `i`. The
+      // pattern here is the operator's schema `pattern` keyword — the input
+      // being validated rather than the implementation of a screen — and it is
+      // refused before it ever runs against a value.
+      // eslint-disable-next-line blamejs/no-regex-in-content-safety
       var native = new RegExp(source, flags);
       // assertSafe builds `new ErrorClass(code, message)`; SafeJsonError takes
       // them the other way round, so the screen reports through its own error.

package/lib/vendor/MANIFEST.json

@@ -21,7 +21,7 @@
         "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
         "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-18T14:13:33.454Z"
+      "refreshedAt": "2026-08-19T07:22:41.105Z"
     },
     "@noble/hashes": {
       "version": "2.3.0",
@@ -48,7 +48,7 @@
       "hashes": {
         "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
       },
-      "refreshedAt": "2026-08-18T14:13:33.454Z"
+      "refreshedAt": "2026-08-19T07:22:41.105Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -70,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-18T14:13:33.454Z",
+      "refreshedAt": "2026-08-19T07:22:41.105Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -114,7 +114,7 @@
         "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
         "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-18T14:13:33.454Z",
+      "refreshedAt": "2026-08-19T07:22:41.105Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-18T14:13:33.454Z"
+      "refreshedAt": "2026-08-19T07:22:41.105Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-18T14:13:33.454Z"
+      "refreshedAt": "2026-08-19T07:22:41.105Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -193,10 +193,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-18T14:13:33.454Z"
+      "refreshedAt": "2026-08-19T07:22:41.105Z"
     },
     "@blamejs/pki": {
-      "version": "0.5.10",
+      "version": "0.5.11",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -216,12 +216,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-18T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.5.10:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-19T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.5.11:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:c7c7b82d0c5cd604e726c52332de66ff06ffb7877d4a44720d8bbd746c5d6023"
+        "server": "sha256:dfcaa10473eb0980958b1c6a4019114c69260191899edd5dc596605f21543249"
       },
-      "refreshedAt": "2026-08-18T14:13:33.454Z"
+      "refreshedAt": "2026-08-19T07:22:41.105Z"
     }
   }
 }