@blamejs/core 0.18.38 → 0.18.40

package/lib/network-dns-resolver.js

@@ -278,6 +278,22 @@ function create(opts) {
       throw new ResolverError("resolver/bad-input",
         "query: unknown qtype '" + type + "'");
     }
+    // Canonicalize BEFORE keying. A U-label and its A-label are one DNS name,
+    // so keying on the raw string splits it across two cache entries and sends
+    // a U-label upstream that no zone answers for; the same pass refuses a name
+    // carrying an empty label rather than letting the wire encoder decide. The
+    // check lives in b.network.dns so this layer and the transport cannot
+    // disagree about what counts as a name.
+    // Translated, not propagated: b.network.dns raises DnsError/`dns/bad-host`,
+    // and every other input refusal on this API is a ResolverError with a
+    // `resolver/*` code. Letting the transport's error class out through the
+    // resolver's surface would leave a caller that classifies by code or class
+    // unable to recognize a bad name as bad input.
+    try { name = networkDns._validateHostShape(name, "resolver.query"); }
+    catch (e) {
+      throw new ResolverError("resolver/bad-input",
+        "query: " + ((e && e.message) || "name is not a valid DNS name"));
+    }
     var validate = qopts.validate === true;
     var key = _key(name, qtype);
 
@@ -588,30 +604,14 @@ async function _wireLookup(name, qtype, timeoutMs) {
 }
 
 // _encodeWireQuery — assemble a wire-format DNS query for (name, qtype).
-// Mirrors the encoder in network-dns.js but accepts an explicit qtype
-// (the existing function hardcodes A/AAAA based on family).
+//
+// The encoder itself lives in network-dns.js. This was a byte-for-byte copy of
+// it, which meant the label validation added there — the 1..63 cap that stops a
+// hostname putting a forged compression pointer in the question section, and
+// the refusal to drop an empty label and ask for a neighbouring domain — would
+// have had to be added twice to hold.
 function _encodeWireQuery(name, qtype) {
-  var parts = name.split(".").filter(Boolean);
-  var nameLen = 1;
-  for (var i = 0; i < parts.length; i += 1) nameLen += 1 + Buffer.byteLength(parts[i], "ascii");
-  var buf = Buffer.alloc(12 + nameLen + 4);                                                              // RFC 1035 §4.1.1 header (12) + question tail (4) + name
-  var id = bCrypto.randomInt(0, 0x10000);                                                              // RFC 1035 §4.1.1 16-bit query ID space
-  buf.writeUInt16BE(id, 0);
-  buf.writeUInt16BE(0x0100, 2);                                                                          // RFC 1035 §4.1.1 RD=1 flags
-  buf.writeUInt16BE(1, 4);                                                                               // RFC 1035 §4.1.1 qdcount
-  var off = 12;                                                                                          // RFC 1035 §4.1.1 header end / question start
-  for (var p = 0; p < parts.length; p += 1) {
-    var s = parts[p];
-    buf.writeUInt8(Buffer.byteLength(s, "ascii"), off);
-    off += 1;
-    off += buf.write(s, off, "ascii");
-  }
-  buf.writeUInt8(0, off);
-  off += 1;
-  buf.writeUInt16BE(qtype, off);
-  off += 2;                                                                                              // RFC 1035 §4.1.2 QTYPE width
-  buf.writeUInt16BE(1, off);                                                                             // RFC 1035 §4.1.2 QCLASS=IN
-  return buf;
+  return networkDns._encodeDnsQuery(name, qtype).buf;
 }
 
 function _minTtl(rrs) {

package/lib/network-dns.js

@@ -13,6 +13,7 @@ var C = require("./constants");
 var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var safeBuffer = require("./safe-buffer");
+var publicSuffix = require("./public-suffix");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -129,25 +130,82 @@ function _labelsOf(host) {
 // is one longer and encodes to identical wire bytes, so measuring the raw
 // string would refuse a maximum-length name written absolutely while accepting
 // it written relatively.
+// Which character marks the root is not fixed: UTS #46 maps U+3002, U+FF0E and
+// U+FF61 to ".", so `example。` is as absolute as `example.` and canonicalization
+// turns one into the other. Every place that asks "does this name end in the
+// root?" has to agree, or a spelling is accepted by one rule and refused by the
+// next — the length cap measured a mapped marker as an extra character and
+// refused a maximum-length name that its ASCII spelling passes.
+function _endsWithRootMarker(host) {
+  if (typeof host !== "string" || host.length < 2) return false;
+  // Ask the primitive that owns the set. A second copy of these four characters
+  // drifts from it, and this module already learned that lesson once — the
+  // whole point of routing name questions through b.publicSuffix.
+  return publicSuffix._isRootMarker(host.charAt(host.length - 1));
+}
+
 function _hostLengthWithoutRoot(host) {
   if (typeof host !== "string") return 0;
-  return (host.length > 1 && host.charAt(host.length - 1) === ".")
-    ? host.length - 1
-    : host.length;
+  return _endsWithRootMarker(host) ? host.length - 1 : host.length;
 }
 
 function _validateHostShape(host, primitive) {
   if (typeof host !== "string" || host.length === 0) return host;
   if (net.isIP(host)) return host;
-  var labels = _labelsOf(host);
-  for (var i = 0; i < labels.length; i += 1) {
-    if (labels[i].length === 0) {
-      throw new DnsError("dns/bad-host",
-        primitive + ": host " + JSON.stringify(host) + " has an empty label — a " +
-        "name may carry one trailing root dot and no other empty label");
-    }
-  }
-  return host;
+  // The root zone. `. NS` is how the root servers are asked for, and the name
+  // encodes as the empty label list, which the wire encoder already handles.
+  // It is the one name that is nothing BUT a root marker, so it must not reach
+  // `canonicalDomain` — that refuses a bare root, correctly, since for every
+  // other name a lone marker means the name went missing.
+  //
+  // Any of the four spellings, asked of the primitive that owns the set rather
+  // than compared against a copy of it: this module already treats U+3002 /
+  // U+FF0E / U+FF61 as equivalent to "." at the END of a name, so a root zone
+  // that depended on which one the caller typed would be the same name
+  // resolving through one spelling and not another. All four normalize to the
+  // ASCII form, as every other name here does.
+  if (host.length === 1 && publicSuffix._isRootMarker(host)) return ".";
+  // The same rules the wire encoder enforces, applied at the entry point so the
+  // caller is told which primitive refused the name. Checking only here would
+  // leave the encoder reachable from paths that do not pass through a public
+  // entry; checking only there would name no primitive.
+  _dnsQueryLabels(host, primitive);
+  // No short-circuit for ASCII. Returning such a name unchanged kept whatever
+  // case it was typed in, so `Example.COM` and `example.com` took separate
+  // resolver-cache entries and made separate upstream queries while putting
+  // byte-identical questions on the wire — the encoder lowercases either way.
+  // One canonical form for every alphabet is what makes the cache key the NAME
+  // rather than a spelling of it.
+  //
+  // An internationalized name is returned in its A-label form so that every
+  // reader downstream sees the same name the wire will carry. Converting only
+  // at the encoder would let `resolve4` reach the domain while `resolveSecure`
+  // and `querySvcb` refused it at their LDH pass, which has no reading of a
+  // U-label — the same domain resolving through one entry point and not
+  // another.
+  //
+  // The root marker is carried across rather than dropped: a resolver reads it
+  // as "already fully qualified, do not apply the search list", and under an
+  // elevated ndots losing it can resolve — and cache — a different name
+  // entirely.
+  //
+  // The marker is NOT removed here. canonicalDomain strips exactly one and
+  // refuses a doubled one, and a strip on this side is invisible to it — it
+  // would take the first marker, canonicalDomain would take the second, and a
+  // name with an empty final label would be quietly rewritten into a real,
+  // separately-owned one and then cached under it. `example.com。。` resolved as
+  // `example.com` that way, while the plain `example.com..` spelling of the
+  // same mistake was still refused.
+  //
+  // Absoluteness is settled by ASKING canonicalDomain rather than by reading
+  // the last character: UTS #46 DELETES 294 code points outright (U+00AD,
+  // U+200B, U+FEFF, U+2060, the variation selectors), so `example.com.` with
+  // one of them appended still ends in a root the raw character does not show.
+  // Appending one more marker makes a doubled one, which canonicalDomain
+  // refuses — so a refusal here means the name already carried its root.
+  var absolute = publicSuffix.canonicalDomain(host + ".") === "";
+  var ascii = _dnsToALabel(host, primitive);
+  return absolute ? ascii + "." : ascii;
 }
 
 // RFC 6761 special-form classification works on the label LIST, so the
@@ -427,8 +485,99 @@ function _armRequestTimeout(req, ms, host, reject) {
   });
 }
 
+// RFC 1035 §2.3.4 — a label is 1..63 octets and an encoded name is at most 255.
+var DNS_MAX_LABEL_OCTETS = 63;
+var DNS_MAX_NAME_OCTETS = 255;
+
+// Split a host into the labels the wire encoder will write, refusing anything
+// the wire format cannot express. Every rejection here is a name that WOULD
+// have been encoded as some other question:
+//
+//   - An empty label. Dropping it turns `evil..example.com` into the real,
+//     separately-owned `evil.example.com`, so the query asks for a name the
+//     caller never passed and the answer is cached under the one they did.
+//   - A label over 63 octets. Its length goes into a single octet whose top two
+//     bits RFC 1035 §4.1.4 reserves: `11` marks a compression POINTER and `01`
+//     an unassigned label type (RFC 6891 §3). Writing the real length lets a
+//     192-octet label put a forged pointer in the question section, aiming the
+//     upstream resolver's name parser at an offset the hostname chose.
+//   - A name over 255 octets encoded.
+// One trailing root dot is legal and is the only thing removed; the bare root
+// encodes as the empty label list it already was.
+//
+// An internationalized name is CONVERTED rather than refused. The wire carries
+// A-labels, and `Buffer.write(s, "ascii")` keeps only a character's low byte,
+// so writing a U-label directly would query a different name — but refusing one
+// would fail a name that resolves perfectly well in its `xn--` form, which is
+// how its owner published it.
+// `publicSuffix.canonicalDomain` owns this conversion: raw `domainToASCII`
+// TRUNCATES at a URL delimiter ("a.com/evil" -> "a.com"), which would turn a
+// string that is not a bare host into a name the caller never asked for, and
+// canonicalDomain refuses those instead. It also refuses a name carrying an
+// empty label, which is the same answer this function gives for an ASCII one.
+function _dnsToALabel(host, primitive) {
+  var ascii = publicSuffix.canonicalDomain(host);
+  if (!ascii) {
+    throw new DnsError("dns/bad-host",
+      primitive + ": internationalized host has no A-label (xn--) form");
+  }
+  return ascii;
+}
+
+function _dnsQueryLabels(host, primitive) {
+  var h = String(host);
+  if (h.length === 0 || h === ".") return [];
+  // EVERY name goes through the domain primitive, ASCII or not. This side used
+  // to keep its own, shorter idea of a valid name — empty label, non-ASCII,
+  // label 1..63, 255 total — and each character it did not think of was one it
+  // encoded into a query label while b.publicSuffix refused the same string
+  // outright: a NUL byte, every URL delimiter, and `%`, `^`, `|`, `<` besides.
+  // A delimiter is the one that bites, because `domainToASCII` TRUNCATES at
+  // one, so `example.com/evil` can masquerade as a trusted prefix of itself.
+  //
+  // Mirroring the rule was tried first, and the list of near-misses above is
+  // what that produced. Asking the owner is the version that cannot drift.
+  var canonical = publicSuffix.canonicalDomain(h);
+  if (!canonical) {
+    throw new DnsError("dns/bad-host",
+      primitive + ": host is not a valid domain name (empty label, control " +
+      "byte, URL delimiter, or over the RFC 1035 length ceiling)");
+  }
+  h = canonical;
+  // The label caps below still belong here: canonicalDomain bounds the whole
+  // NAME at 253 octets but says nothing about a single label, and 1..63 is what
+  // the wire format can express — a longer one writes a length octet the
+  // receiving parser reads as a compression pointer.
+  var labels = h.split(".");
+  var total = 1;
+  for (var i = 0; i < labels.length; i += 1) {
+    var len = Buffer.byteLength(labels[i], "utf8");
+    if (labels[i].length === 0) {
+      throw new DnsError("dns/bad-host",
+        primitive + ": host has an empty label — a name may carry one trailing " +
+        "root dot and no other empty label");
+    }
+    if (len !== labels[i].length) {
+      throw new DnsError("dns/bad-host",
+        primitive + ": host label is not ASCII and has no A-label (xn--) form");
+    }
+    if (len > DNS_MAX_LABEL_OCTETS) {
+      throw new DnsError("dns/bad-host",
+        primitive + ": host label is " + len + " octets (RFC 1035 allows 1.." +
+        DNS_MAX_LABEL_OCTETS + ")");
+    }
+    total += 1 + len;
+  }
+  if (total > DNS_MAX_NAME_OCTETS) {
+    throw new DnsError("dns/bad-host",
+      primitive + ": host encodes to " + total + " octets (RFC 1035 allows at most " +
+      DNS_MAX_NAME_OCTETS + ")");
+  }
+  return labels;
+}
+
 function _encodeDnsQuery(host, qtype) {
-  var parts = host.split(".").filter(Boolean);
+  var parts = _dnsQueryLabels(host, "dns");
   var nameLen = 1;
   for (var i = 0; i < parts.length; i++) nameLen += 1 + Buffer.byteLength(parts[i], "ascii");
   var buf = Buffer.alloc(12 + nameLen + 4);
@@ -676,29 +825,9 @@ async function resolveSecure(host, type) {
       "resolveSecure requires DoH transport (call useDnsOverHttps " +
       "or rely on the default-on DoH posture)");
   }
-  if (typeof host !== "string" || host.length === 0 ||
-      _hostLengthWithoutRoot(host) > 253) {                                    // RFC 1035 hostname octet ceiling
-    throw new DnsError("dns/bad-host",
-      "resolveSecure host is malformed");
-  }
-  // RFC 1035 §2.3.4 LDH validation — labels are letters / digits /
-  // hyphen, hyphens not at edges, label length 1..63, total length
-  // 253. Pre-v0.8.32 the framework only checked total length;
-  // operator-supplied hosts containing `_` / `:` / spaces flowed
-  // through to the DoH endpoint and surfaced as opaque server
-  // errors.
-  var labels = _labelsOf(host);
-  for (var li = 0; li < labels.length; li += 1) {
-    var label = labels[li];
-    if (label.length === 0 || label.length > 63) {                                            // RFC 1035 max label length
-      throw new DnsError("dns/bad-host",
-        "resolveSecure host has invalid label (length 1..63 required, got " + label.length + ")");
-    }
-    if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label)) {
-      throw new DnsError("dns/bad-host",
-        "resolveSecure host label '" + label + "' violates RFC 1035 LDH rule (letters/digits/hyphen, no leading/trailing hyphen)");
-    }
-  }
+  // An operator-supplied host containing `_` / `:` / a space would otherwise
+  // flow through to the DoH endpoint and surface as an opaque server error.
+  _validateLdh(host, "resolveSecure", false);
   var family;
   if (type === "A")    family = 4;
   else if (type === "AAAA") family = 6;
@@ -1316,14 +1445,27 @@ function _parseSvcbRdata(msg, rdataOff, rdlen) {
   return { priority: priority, target: target, params: params };
 }
 
-function _validateLdh(host, primitive) {
+// RFC 1035 §2.3.4 LDH validation — labels are letters / digits / hyphen, with
+// no hyphen at either edge. `allowUnderscore` additionally admits the leading
+// underscore that SVCB / HTTPS query targets carry ("_dns.resolver.arpa");
+// resolveSecure resolves ordinary hostnames and does not want it.
+//
+// This lives in one place because it did not: resolveSecure carried its own
+// copy of the loop, so the two drifted on which characters they accepted and a
+// rule added to either held for only half the primitives that need it.
+function _validateLdh(host, primitive, allowUnderscore) {
   if (typeof host !== "string" || host.length === 0 ||
       _hostLengthWithoutRoot(host) > 253) {                                    // RFC 1035 hostname octet ceiling
     throw new DnsError("dns/bad-host",
       primitive + ": host must be a non-empty RFC 1035 LDH name (length 1..253)");
   }
-  // Allow leading underscore on labels (SVCB / HTTPS query targets like
-  // "_dns.resolver.arpa" require it).
+  // The root zone has no labels at all — `_labelsOf(".")` yields one empty
+  // string, which the 1..63 rule below refuses. Without this, a name the shape
+  // check accepts is turned away here, so `. NS` works through the wire
+  // resolver and not through `querySvcb` / `queryHttps` / `resolveSecure`: the
+  // same name resolving through one entry point and not another, which is the
+  // defect this module already fixed once for internationalized names.
+  if (host === ".") return;
   var labels = _labelsOf(host);
   for (var li = 0; li < labels.length; li += 1) {
     var label = labels[li];
@@ -1331,9 +1473,13 @@ function _validateLdh(host, primitive) {
       throw new DnsError("dns/bad-host",
         primitive + ": host label length must be 1..63");
     }
-    if (!/^[A-Za-z0-9_](?:[A-Za-z0-9_-]*[A-Za-z0-9_])?$/.test(label)) {
+    var shaped = allowUnderscore
+      ? /^[A-Za-z0-9_](?:[A-Za-z0-9_-]*[A-Za-z0-9_])?$/.test(label)
+      : /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label);
+    if (!shaped) {
       throw new DnsError("dns/bad-host",
-        primitive + ": host label '" + label + "' violates LDH (allowed: letters/digits/underscore/hyphen, no leading/trailing hyphen)");
+        primitive + ": host label '" + label + "' violates LDH (allowed: letters/digits" +
+        (allowUnderscore ? "/underscore" : "") + "/hyphen, no leading/trailing hyphen)");
     }
   }
 }
@@ -1342,7 +1488,7 @@ async function _querySvcbLike(host, qtype, opts) {
   host = _validateHostShape(host, "dns.querySvcb");
   opts = opts || {};
   validateOpts(opts, ["transport"], "dns.querySvcb");
-  _validateLdh(host, "dns.querySvcb");
+  _validateLdh(host, "dns.querySvcb", true);                                   // SVCB targets carry a leading underscore
   if (opts.transport !== undefined && opts.transport !== "doh" &&
       opts.transport !== "dot" && opts.transport !== "system") {
     throw new DnsError("dns/bad-transport",
@@ -1488,7 +1634,16 @@ async function discoverEncrypted(opts) {
   }
   var insecureOnly = opts.insecureSystemResolverOnly !== false;
   var transport = insecureOnly ? "system" : undefined;
-  _validateLdh(name, "dns.discoverEncrypted");
+  // Canonicalize BEFORE the LDH pass. An LDH rule has no reading of a U-label,
+  // so running it on the raw name refuses an internationalized one here while
+  // the SVCB query underneath accepts it — the same name resolving through one
+  // entry point and not its own caller.
+  // Canonicalize BEFORE the LDH pass. An LDH rule has no reading of a U-label,
+  // so running it on the raw name refuses an internationalized one here while
+  // the SVCB query underneath accepts it — the same name resolving through one
+  // entry point and not its own caller.
+  name = _validateHostShape(name, "dns.discoverEncrypted");
+  _validateLdh(name, "dns.discoverEncrypted", true);                           // "_dns.resolver.arpa" per RFC 9462
   var startMs = _now();
   var records;
   try {
@@ -2107,6 +2262,13 @@ module.exports = {
   nodeLookup:                  nodeLookup,
   clearCache:                  _clearCache,
   DnsError:                    DnsError,
+  _encodeDnsQuery:             _encodeDnsQuery,
+  _validateHostShape:          _validateHostShape,
+  // Exported for the same reason as the shape check: it is the SECOND gate a
+  // public query passes, and a name that clears one and not the other resolves
+  // through some entry points and not others. Asserting it directly proves that
+  // without a test having to reach the network.
+  _validateLdh:                _validateLdh,
   _parseSvcbRdata:             _parseSvcbRdata,
   _decodeDnsAnswerRaw:         _decodeDnsAnswerRaw,
   _readDnsName:                _readDnsName,

package/lib/public-suffix.js

@@ -74,6 +74,38 @@ function _err(code, message) {
   return new PublicSuffixError(code, message);
 }
 
+// The index of the first character that cannot appear in a host name, or -1.
+//
+// Control / NUL / whitespace bytes, DEL, and the URL-structural delimiters
+// domainToASCII silently TRUNCATES at — "/" (0x2F), "?" (0x3F), "#" (0x23),
+// "\" (0x5C) reduce "example.com/evil" to "example.com" rather than failing,
+// which would let a hostile host masquerade as a trusted prefix. ":" / "@" /
+// "[" / "]" already make domainToASCII return "", but they are rejected here
+// too so every non-host character fails closed rather than silently.
+//
+// Exported because it is the framework's definition of "a character that may
+// appear in a host", and the DNS wire encoder needs the same answer. When it
+// had its own — a shorter one — `b.network.dns` encoded `a\u0000.com` and
+// `example.com/evil` into query labels that this module refuses outright.
+function _firstNonHostCharacter(name) {
+  for (var i = 0; i < name.length; i += 1) {
+    var cp = name.charCodeAt(i);
+    if (cp < 0x21 || cp === 0x7f ||
+        cp === 0x2f || cp === 0x3f || cp === 0x23 || cp === 0x5c ||   // / ? # \
+        cp === 0x3a || cp === 0x40 || cp === 0x5b || cp === 0x5d) {   // : @ [ ]
+      return i;
+    }
+  }
+  return -1;
+}
+
+// The characters UTS #46 treats as a label separator, and therefore the ones
+// that can mark the root of an absolute name. Scanned against Node's own
+// mapping and found to be exactly this set across the BMP and the SMP.
+function _isRootMarker(ch) {
+  return ch === "." || ch === "。" || ch === "．" || ch === "｡";
+}
+
 // _normalizeInput — lowercase + IDN-normalize a candidate domain.
 // Returns a plain ASCII (punycode) string with no leading/trailing
 // dots and no empty labels. Throws PublicSuffixError on bad shape so
@@ -87,36 +119,41 @@ function _normalizeInput(domain) {
     throw _err("public-suffix/invalid-domain",
       "publicSuffix: domain must not be empty");
   }
-  if (domain.length > 253) {
-    // RFC 1035 §2.3.4 — 253 octets max for the wire form (255 minus
-    // length-byte + null). Anything longer is structurally invalid.
-    throw _err("public-suffix/invalid-domain",
-      "publicSuffix: domain exceeds 253-octet RFC 1035 limit");
-  }
-  // Strip a single trailing dot (FQDN form). Multiple trailing dots,
-  // leading dots, or embedded empty labels remain rejected below.
+  // Strip a single trailing root marker (FQDN form) BEFORE measuring. The
+  // absolute and relative spellings of one name encode to identical wire
+  // bytes, so measuring the marker would refuse a maximum-length name written
+  // absolutely while accepting it written relatively.
+  //
+  // Which character marks the root is not fixed: UTS #46 maps U+3002, U+FF0E
+  // and U+FF61 to "." as well, so `münchen.example。` is absolute too.
+  // Recognising all four here rather than only the ASCII dot is what lets the
+  // `rootStripped` guard below hold — exactly one marker comes off in total,
+  // and a second is an empty final label rather than something to remove.
+  //
+  // A marker that only APPEARS during conversion — because an IDNA-ignored
+  // code point trailed it — is handled by the post-conversion strip below,
+  // which the same guard keeps mutually exclusive with this one.
   var s = domain.toLowerCase();
-  if (s.charCodeAt(s.length - 1) === 46 /* "." */) {
+  var rootStripped = false;
+  if (_isRootMarker(s.charAt(s.length - 1))) {
     s = s.slice(0, -1);
+    rootStripped = true;
     if (s.length === 0) {
       throw _err("public-suffix/invalid-domain",
         "publicSuffix: domain must not be a bare dot");
     }
   }
-  // Reject control / null / whitespace bytes AND the URL-structural delimiters
-  // domainToASCII silently TRUNCATES at — "/" (0x2F), "?" (0x3F), "#" (0x23),
-  // "\" (0x5C) reduce "example.com/evil" to "example.com" rather than failing,
-  // which would let a hostile host masquerade as a trusted prefix. ":" / "@" /
-  // "[" / "]" already make domainToASCII return "" (caught below), but reject
-  // them here too so every non-host character fails closed, not silently.
-  for (var i = 0; i < s.length; i += 1) {
-    var cp = s.charCodeAt(i);
-    if (cp < 0x21 || cp === 0x7f ||
-        cp === 0x2f || cp === 0x3f || cp === 0x23 || cp === 0x5c ||   // / ? # \
-        cp === 0x3a || cp === 0x40 || cp === 0x5b || cp === 0x5d) {   // : @ [ ]
-      throw _err("public-suffix/invalid-domain",
-        "publicSuffix: domain contains a control byte or URL delimiter");
-    }
+  if (s.length > 253) {
+    // A cheap bound on the INPUT, so a pathological string is refused before
+    // conversion. It is not the authoritative check: an internationalized name
+    // grows when it becomes A-labels, so the real test is on the converted form
+    // below. Every ASCII name is settled here, since conversion leaves it as-is.
+    throw _err("public-suffix/invalid-domain",
+      "publicSuffix: domain exceeds 253-octet RFC 1035 limit");
+  }
+  if (_firstNonHostCharacter(s) !== -1) {
+    throw _err("public-suffix/invalid-domain",
+      "publicSuffix: domain contains a control byte or URL delimiter");
   }
   // IDN-normalize — non-ASCII labels become xn--… via Node's UTS #46
   // implementation. Empty string back means the input was malformed
@@ -126,11 +163,55 @@ function _normalizeInput(domain) {
     throw _err("public-suffix/invalid-domain",
       "publicSuffix: domain failed IDN normalization");
   }
-  // No empty labels (`foo..bar`) and no leading dot.
+  // No empty labels (`foo..bar`) and no leading dot. This runs BEFORE the
+  // root-marker strip below, so a name carrying an empty final label cannot be
+  // turned into a valid one by removing a dot: `münchen.example。。` converts to
+  // a trailing `..` and is refused here rather than quietly becoming a
+  // different, real domain.
   if (ascii.indexOf("..") !== -1 || ascii.charCodeAt(0) === 46) {
     throw _err("public-suffix/invalid-domain",
       "publicSuffix: domain contains empty label");
   }
+  // RFC 1035 §2.3.4 — 253 octets max for the wire form (255 minus the leading
+  // length byte and the root's null). This is the AUTHORITATIVE check, and it
+  // has to run on the converted name: an internationalized label grows into its
+  // `xn--` form, so five 44-character labels are 224 characters going in and
+  // 254 octets coming out, with every individual label a legal 50. Measuring
+  // the input handed the caller a name that cannot be put on the wire, and a
+  // caller cannot tell — it looks like any other domain, and the DMARC walk
+  // stepped over the unqueryable target and applied an ancestor's policy.
+  //
+  // A trailing root marker is still present at this point and does not count:
+  // the wire form carries the root as a zero-length label, not a character.
+  var withoutRoot = ascii.charCodeAt(ascii.length - 1) === 46
+    ? ascii.length - 1 : ascii.length;
+  if (withoutRoot > 253) {
+    throw _err("public-suffix/invalid-domain",
+      "publicSuffix: domain exceeds 253-octet RFC 1035 limit once converted " +
+      "to A-labels (" + withoutRoot + " octets)");
+  }
+  // The root marker is stripped here when it was not an ASCII dot on the way
+  // in. UTS #46 maps U+3002, U+FF0E and U+FF61 to ".", so `münchen.example。`
+  // arrives with no trailing dot and leaves the conversion with one. Returning
+  // that from a function whose contract is to strip the trailing dot leaves
+  // every caller to compensate, and the ones that do not compare two spellings
+  // of the same absolute name as different names.
+  //
+  // At most ONE root marker is removed in total. A dot still here after one was
+  // already taken off means the name ended in two of them — an empty final
+  // label — and stripping the second would hand the caller a different, valid
+  // domain than the one they asked about.
+  if (ascii.charCodeAt(ascii.length - 1) === 46 /* "." */) {
+    if (rootStripped) {
+      throw _err("public-suffix/invalid-domain",
+        "publicSuffix: domain contains empty label");
+    }
+    ascii = ascii.slice(0, -1);
+    if (ascii.length === 0) {
+      throw _err("public-suffix/invalid-domain",
+        "publicSuffix: domain must not be a bare dot");
+    }
+  }
   return ascii;
 }
 
@@ -462,4 +543,9 @@ module.exports = {
   canonicalDomain:      canonicalDomain,
   isPublicSuffix:       isPublicSuffix,
   lookupSource:         lookupSource,
+  _firstNonHostCharacter: _firstNonHostCharacter,
+  // Exported for the same reason as the character predicate above: this is the
+  // framework's answer to "which characters mark the root of an absolute name",
+  // and a second copy of the set drifts from it.
+  _isRootMarker:          _isRootMarker,
 };