@blamejs/core 0.18.49 → 0.18.50

package/CHANGELOG.md

@@ -8,6 +8,34 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.50 (2026-08-22) — **Five places let someone else choose how much CPU your server spends on one match.** A Sieve `:matches` wildcard, a JSONPath `match()` filter and a JSON Schema `pattern` each took a pattern from outside the framework and ran it on a backtracking engine. A Sieve rule with five wildcards spent 452ms on a 60-character Subject; a JSONPath filter spent 7 seconds on a 29-character value; a schema pattern spent 1.5 seconds on 28 characters and doubled with every two more. Two more were the same cost from the other direction, a fixed pattern against attacker-shaped input: a DKIM tag scan and a scanner-reply trim, both quadratic. All five now refuse the shape or match without backtracking. **Security:** *`b.mail.sieve` matches `:matches` wildcards without a regular expression* — RFC 5228 `:matches` uses `*` for any sequence and `?` for one character. Translating that into a regular expression turns each `*` into `.*`, and a backtracking engine facing several of them tries every way of dividing the subject between them. The cost is polynomial in the subject length with degree equal to the number of wildcards.
+
+Measured on the shipped path, `b.mail.sieve.runScript` with `if header :matches "Subject" ...` and a subject that never supplies the pattern's trailing literal: three wildcards grew by a factor of 7.7 for each doubling of the subject, and ten wildcards — which a script author can type without meaning anything by it — did not finish on a 64-character Subject.
+
+The `maxGas` budget did not bound it. Gas counts operations, and one match is one operation however long the engine spends inside it: five wildcards cost 452ms for three gas units.
+
+This matters because of who writes the script. Sieve is a user-level filtering language, so in most deployments the pattern comes from the mailbox owner rather than from you. The wildcard is now matched directly against the value, walking both strings with a single remembered wildcard position, so the work is bounded by their lengths rather than by how the pattern is shaped. Every pattern decides exactly as it did before, checked across 42,976 pattern/subject/case combinations against the previous implementation.
+
+One deliberate change of behaviour comes with it. `:comparator "i;ascii-casemap"` now folds US-ASCII `A-Z` only, which is what RFC 4790 §9.2 defines it as; the regular expression it replaced carried JavaScript's `i` flag and folded the whole of Unicode. The narrower fold is also the only one that preserves length: `"İ".toLowerCase()` is two UTF-16 units, so folding a subject up front shifts every position after it and leaves `?`, which matches exactly one character, facing two. A script relying on non-ASCII case folding under `i;ascii-casemap` was relying on something the comparator does not promise. · *`b.jsonPath` refuses a catastrophic `match()` or `search()` pattern* — The second argument of an RFC 9535 `match()` or `search()` filter is an I-Regexp (RFC 9485), which is a general regular-expression language: a filter can carry `(a+)+$` as easily as `a+`. `$[?match(@.name, "(a+)+$")]` against a 29-character value that fails the match took 7 seconds.
+
+The node ceilings on descendant walks and running nodelists never saw it, because the whole cost is inside one match on one node.
+
+The pattern is now screened with `b.guardRegex.assertSafe` before it can run, which is what the framework already does wherever else it compiles a caller-supplied pattern — `b.flag` targeting conditions and MCP tool schemas both go through the same screen. A refusal raises `json-path/unsafe-pattern` rather than being folded into a false test result: a malformed I-Regexp yields false per RFC 9535 §2.4.6, and a refused one must not wear those clothes, or the caller is left with a filter that silently matches nothing. · *A folded DKIM-Signature header made the submission listener spend its CPU on a trim* — `b.mail.server.submission` reads the `d=` tag out of each DKIM-Signature header, and trimmed each tag with `/^\s+|\s+$/`. That is the quadratic trim: the `\s+$` alternative is retried from every start position when the whitespace run does not reach the end of the string.
+
+The tag was believed to be bounded by the line cap. It is not, because the header is unfolded first. Every empty continuation line contributes one space to the joined value, so the lever is the number of folded lines rather than the length of any one of them, and the real bound is `maxMessageBytes` — 50 MiB by default. An authenticated client sending 40,000 empty continuation lines, a 120 KB message, produced a 40,000-character run and 446ms of backtracking on one header. Three megabytes would have bought minutes.
+
+The trim is now `String.prototype.trim`, which decides identically (the same WhiteSpace and LineTerminator set as `\s`) and does not backtrack. · *A virus-scanner reply with a long newline run cost the same shape* — The ClamAV INSTREAM reply is trimmed of trailing CR / LF / NUL before it is classified, and the trim was `/[\r\n\0]+$/`. Anchoring at `$` does not stop the engine retrying from every start position; it is what makes the scan quadratic. A reply carrying a long interior run of newlines took 1.2 seconds through the real scan path.
+
+The reply is capped, but by `maxResponseBytes`, which is 50 MiB on the strict profile and 300 MiB on permissive, so the cap was not what stood between a reply and the cost. The trim now walks backwards from the end.
+
+A local daemon is normally trusted, which makes this hardening rather than a hole — but `b.mail.scan` dials a host and a port, a scanning service can be remote, and a reply parser is the wrong place to assume the peer is well behaved. · *`b.jsonSchema` screens `pattern` and `patternProperties` when the schema compiles* — A `pattern` keyword is compiled and then run against the instance, so the schema author decides what each validation costs. `(a+)+$` against a 28-character string that fails took 1.5 seconds, doubling with every two characters added.
+
+The reasoning that left this unscreened was that a schema is operator-supplied and therefore trusted. The framework does not hold that assumption elsewhere: `b.mcp` already screens the `pattern` in a tool schema for exactly this shape before matching it against request input. A schema arrives from a registry, a tool manifest, an upload or a config file as readily as from your own source.
+
+Every pattern in a schema is now screened, and screened at `b.jsonSchema.compile` rather than on the first instance that reaches it — a bad schema should be refused while you are still looking at the schema, not on a request, through a validator you have already been handed and have no reason to doubt.
+
+The screen reads the compiled expression rather than the pattern text, which is what `b.safeJson` does with the same keyword and for the reason recorded there: the flags decide what the source means, so a text-only screen reads `(a|A)+` as two disjoint branches where the engine sees one branch twice.
+
 - v0.18.49 (2026-08-22) — **Comments in the shipped tree that answered a question you cannot ask.** A comment in `lib/` reaches anyone who opens the published package, and twenty of them were written for a reader who remembers the previous version or can look up an issue number that resolves nowhere outside this repository. They now say what the code does and why, in the present tense, keeping every reason they carried. No behaviour changes. **Changed:** *Comments that narrated a change now describe the code* — Fourteen comments across `lib/` were written against a version the reader has never seen: "this used to be opt-in", "it used to declare them in every profile anyway", "the legacy fallback was removed". Each is now a property of the design rather than a diff, and each keeps the reason it carried. The zero-width scan's comment still explains that an opt-in argument is an argument a caller can omit, and still names the six call sites that omitted it — it just no longer reads as a changelog entry pasted into the source.
 
 One of them was wrong in a way worth naming: a note in the gate-contract context builder said a guard "serves bytes it used to examine", which reads as a past version's behaviour. It means bytes the guard would otherwise examine, and now says so. · *Issue numbers that resolve nowhere are gone; the upstream ones stay* — Six comments cited a bare `issue #100` / `#330` / `#430` / `#532`. Opened from the published tarball those name nothing an operator can look up, and the explanation beside them was already doing the work. The references are gone and the explanations stay.

package/lib/json-path.js

@@ -33,6 +33,11 @@
  */
 
 var { defineClass } = require("./framework-error");
+var lazyRequire = require("./lazy-require");
+// Lazy: guard-regex composes the parser in this file's sibling modules, and the
+// screen is only reached by a filter that calls match() or search().
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
+var boundedMap = require("./bounded-map");
 
 var JsonPathError = defineClass("JsonPathError", { alwaysPermanent: true });
 
@@ -573,7 +578,25 @@ function _evalFunctionValue(node, current, root) {
   return NOTHING;
 }
 
+// A filter runs once per candidate node, and the pattern is almost always the
+// same literal throughout a query, so translating and screening it per node
+// would put the cost of the analysis on the nodelist length. Screened once per
+// distinct (pattern, anchored) pair instead.
+//
+// Bounded, because the key comes from the query: an unbounded map keyed by
+// caller-supplied text is a slower way to spend the same memory. The framework's
+// own ceiling primitive owns the eviction, so the oldest entry goes rather than
+// the whole cache.
+var _filterRegexCache = boundedMap.boundedMap({ maxEntries: 256 });
+
+// Only an accepted pattern is stored: a refusal throws out of `query()` on the
+// first candidate node, so there is no second node to re-decide it for.
 function _iRegexpToJs(pattern, anchored) {
+  return boundedMap.getOrInsert(_filterRegexCache, (anchored ? "1" : "0") + pattern,
+    function () { return _buildFilterRegex(pattern, anchored); });
+}
+
+function _buildFilterRegex(pattern, anchored) {
   // I-Regexp (RFC 9485) is close to a JS regex subset. Translate the one
   // systematic difference — "." must not match line separators — and
   // (for match) anchor the whole input.
@@ -582,16 +605,43 @@ function _iRegexpToJs(pattern, anchored) {
     if (cls) return cls;
     return "[^\\n\\r]";
   });
-  // The pattern is the I-Regexp argument of an RFC 9535 match()/search()
-  // filter — translated (not raw) and used only as a boolean test.
-  return new RegExp(anchored ? "^(?:" + translated + ")$" : translated, "su");   // allow:dynamic-regex — translated I-Regexp from a match()/search() filter argument
+  var source = anchored ? "^(?:" + translated + ")$" : translated;
+  // I-Regexp is a general regular-expression language, so the argument of a
+  // match() or search() filter can be `(a+)+$` as easily as `a+`, and a
+  // backtracking engine will spend the caller's chosen amount of CPU deciding
+  // it. Being a boolean test is no protection: `.test()` is exactly where the
+  // backtracking happens, and the node caps above never see it because the
+  // whole blow-up is inside one call on one node. Measured before this screen:
+  // 7 seconds on a 29-character subject, doubling per added character.
+  //
+  // Screened with the same primitive the framework already uses wherever it
+  // compiles a caller-supplied pattern — b.flag targeting conditions and MCP
+  // tool schemas both go through it.
+  //
+  // Compiled first and screened on the COMPILED form, matching b.safeJson: the
+  // flags decide what the source means, so a source-only screen reads `(a|A)+`
+  // as two disjoint branches where the engine sees one branch twice. Compiling
+  // is safe on its own; the cost is in matching, which has not happened yet.
+  var re = new RegExp(source, "su");   // allow:dynamic-regex — translated I-Regexp, ReDoS-screened via guardRegex.assertSafe below, before it is returned to the caller that will run it
+  guardRegex().assertSafe(re, "jsonPath.filter.pattern",
+    JsonPathError, "json-path/unsafe-pattern");
+  return re;
 }
 function _evalFunctionLogical(node, current, root) {
   var input = _funcArgValue(node.args[0], current, root);
   var pat = _funcArgValue(node.args[1], current, root);
   if (typeof input !== "string" || typeof pat !== "string") return false;
   var re;
-  try { re = _iRegexpToJs(pat, node.name === "match"); } catch (_e) { return false; }
+  try { re = _iRegexpToJs(pat, node.name === "match"); }
+  catch (e) {
+    // A malformed I-Regexp yields Nothing, which RFC 9535 §2.4.6 renders as a
+    // false test result. A pattern REFUSED as catastrophic is a different
+    // answer and must not wear the same clothes: swallowing it would leave the
+    // caller with a filter that silently matches nothing and no way to tell
+    // that from a filter that matched nothing.
+    if (e && e.code === "json-path/unsafe-pattern") throw e;
+    return false;
+  }
   return re.test(input);
 }
 

package/lib/json-schema.js

@@ -52,6 +52,10 @@
 var numericBounds = require("./numeric-bounds");
 var rfc3339 = require("./rfc3339");
 var { defineClass } = require("./framework-error");
+var lazyRequire = require("./lazy-require");
+// Lazy: the screen is only reached by a schema that carries a `pattern`.
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
+var boundedMap = require("./bounded-map");
 
 var JsonSchemaError = defineClass("JsonSchemaError", { alwaysPermanent: true });
 
@@ -288,6 +292,51 @@ function _buildModule() {
  *     properties: { n: { type: "integer" } }, required: ["n"] });
  *   v.validate({ n: 1 }).valid;   // → true
  */
+// Where a subschema can appear. Named rather than inferred, because a schema
+// also carries DATA — `const`, `enum`, `default` and `examples` hold instance
+// values — and a walk that recursed into everything would read a `pattern` key
+// inside a `const` value as a schema keyword and refuse a legal schema for the
+// shape of its example data.
+//
+// Missing a position here is safe in the direction that matters: the screen in
+// _compileRegex still runs on whatever is actually compiled, so a subschema
+// this walk does not reach is refused when it is used rather than never. The
+// walk buys an earlier refusal, not the refusal itself.
+// `additionalItems` and `contentSchema` are deliberately absent: this validator
+// does not evaluate either keyword, so a pattern inside one never compiles and
+// never runs. Screening there could only refuse a schema for a branch that has
+// no effect.
+var _SUBSCHEMA_KEYS = ["additionalProperties", "contains",
+  "else", "if", "items", "not", "propertyNames", "then",
+  "unevaluatedItems", "unevaluatedProperties"];
+var _SUBSCHEMA_LIST_KEYS = ["allOf", "anyOf", "oneOf", "prefixItems", "items"];
+var _SUBSCHEMA_MAP_KEYS = ["$defs", "definitions", "dependentSchemas",
+  "patternProperties", "properties"];
+
+// Walk the subschema positions for the two keywords that carry a regular
+// expression, and hand each to the same screen the compile site uses.
+// Depth-bounded by the ceiling the validator applies to `$ref` chains, so a
+// deeply nested schema cannot spend the walk instead of the match.
+function _screenPatterns(node, depth) {
+  depth = depth || 0;
+  if (depth > MAX_REF_DEPTH || !_isObject(node)) return;
+
+  if (typeof node.pattern === "string") _compileRegex(node.pattern);
+  if (_isObject(node.patternProperties)) {
+    Object.keys(node.patternProperties).forEach(function (p) { _compileRegex(p); });
+  }
+
+  _SUBSCHEMA_KEYS.forEach(function (k) { _screenPatterns(node[k], depth + 1); });
+  _SUBSCHEMA_LIST_KEYS.forEach(function (k) {
+    if (!Array.isArray(node[k])) return;
+    node[k].forEach(function (sub) { _screenPatterns(sub, depth + 1); });
+  });
+  _SUBSCHEMA_MAP_KEYS.forEach(function (k) {
+    if (!_isObject(node[k])) return;
+    Object.keys(node[k]).forEach(function (name) { _screenPatterns(node[k][name], depth + 1); });
+  });
+}
+
 function compile(schema, opts) {
   opts = opts || {};
   if (!_isObject(schema) && typeof schema !== "boolean") {
@@ -304,6 +353,15 @@ function compile(schema, opts) {
   var rootBase = (_isObject(schema) && typeof schema.$id === "string") ? _resolveUri(schema.$id, "") : "";
   registry.add(schema, rootBase);
 
+  // Screen every pattern the schema carries HERE, while the author is still
+  // looking at the schema. Compiling is where a bad schema should be refused;
+  // leaving it to the first instance means the refusal lands on a request, in
+  // a validator the caller has already been handed and treats as good.
+  _screenPatterns(schema);
+  if (_isObject(opts.schemas)) {
+    Object.keys(opts.schemas).forEach(function (uri) { _screenPatterns(opts.schemas[uri]); });
+  }
+
   var assertFormat = opts.assertFormat === true;
   var maxErrors = numericBounds.isPositiveFiniteInt(opts.maxErrors) ? opts.maxErrors : DEFAULT_MAX_ERRORS;
 
@@ -525,15 +583,42 @@ function _checkString(schema, s, ctx, emit) {
   }
 }
 
-var _regexCache = {};
+// Keyed by the schema's own pattern text, so a long-lived process compiling
+// many distinct schemas would otherwise grow this without bound. The
+// framework's own ceiling primitive owns the eviction.
+var _regexCache = boundedMap.boundedMap({ maxEntries: 512 });
 function _compileRegex(pattern, ctx) {
-  if (Object.prototype.hasOwnProperty.call(_regexCache, pattern)) return _regexCache[pattern];
+  if (_regexCache.has(pattern)) return _regexCache.get(pattern);
+  // `pattern` / `patternProperties` decide how much CPU each validation costs,
+  // because the compiled expression runs against the instance. `(a+)+$` against
+  // a run of `a` ending in anything else measured 1.5 seconds at 28 characters
+  // and doubles with every two more, so a schema is a denial-of-service lever
+  // as much as a contract.
+  //
+  // A schema is not automatically the operator's own source: it arrives from a
+  // registry, a tool manifest, an upload or a config file. b.mcp already
+  // screens the pattern in a tool schema for this shape before matching it
+  // against request input, and this is the same construct.
+  //
+  // Screened once per distinct pattern — the cache below means a schema pays
+  // for the analysis at its first use rather than per instance.
+  //
+  // Compiled first and screened AFTER, on the compiled form, which is what
+  // b.safeJson does with the same keyword and for the reason recorded there:
+  // the flags decide what the source means, so a screen reading the source
+  // alone reads `(a|A)+` as two disjoint branches where the engine sees one
+  // branch twice. Compiling a pathological pattern is safe on its own — the
+  // cost is in matching, which has not happened yet.
   var re = null;
-  try { re = new RegExp(pattern, "u"); }                    // allow:dynamic-regex — JSON Schema pattern is part of the (operator-trusted) schema, not instance data
+  try { re = new RegExp(pattern, "u"); }                    // allow:dynamic-regex — ReDoS-screened via guardRegex.assertSafe below, before the compiled form is returned to any caller
   catch (_e) {
-    try { re = new RegExp(pattern); } catch (_e2) { re = null; }
+    try { re = new RegExp(pattern); } catch (_e2) { re = null; }   // allow:dynamic-regex — same screen, non-unicode fallback for a pattern `u` rejects
+  }
+  if (re) {
+    guardRegex().assertSafe(re, "jsonSchema.pattern",
+      JsonSchemaError, "json-schema/unsafe-pattern");
   }
-  _regexCache[pattern] = re;
+  _regexCache.set(pattern, re);
   return re;
 }
 

package/lib/mail-scan.js

@@ -104,6 +104,26 @@ var CLAMAV_LENGTH_PREFIX_BYTES = 4;
 // ClamAV INSTREAM chunk size for streaming.
 var CLAMAV_CHUNK_BYTES = 65536;
 
+// Trailing CR / LF / NUL off a daemon reply, walked backwards from the end.
+//
+// The regex form of this, `/[\r\n\0]+$/`, is quadratic: `$` does not stop the
+// engine retrying from every start position, so a reply carrying a long
+// interior run of newlines costs O(n^2) — measured 135ms at 20k characters,
+// 538ms at 40k and 2207ms at 80k, and 1223ms through the real scan path.
+// The reply IS capped, but by `maxResponseBytes`, which is 50 MiB on the strict
+// profile and 300 MiB on permissive, so the cap is not what would save it.
+//
+// `String.prototype.trim` is not the substitute here: NUL is not whitespace.
+function _stripTrailingEol(s) {
+  var end = s.length;
+  while (end > 0) {
+    var c = s.charCodeAt(end - 1);
+    if (c !== 0x0D && c !== 0x0A && c !== 0x00) break;
+    end -= 1;
+  }
+  return end === s.length ? s : s.slice(0, end);
+}
+
 var PROFILES = Object.freeze({
   strict:     { timeoutMs: C.TIME.seconds(30),  maxMessageBytes: C.BYTES.mib(25),  maxResponseBytes: C.BYTES.mib(50) },   // operator-facing default mailbox cap
   balanced:   { timeoutMs: C.TIME.seconds(60),  maxMessageBytes: C.BYTES.mib(50),  maxResponseBytes: C.BYTES.mib(100) },  // operator-facing default mailbox cap
@@ -385,7 +405,7 @@ function create(opts) {
         if (done) return;
         done = true;
         clearTimeout(to);
-        var reply = collector.result().toString("utf8").replace(/[\r\n\0]+$/g, "");                // allow:regex-no-length-cap — trailing-trim anchored
+        var reply = _stripTrailingEol(collector.result().toString("utf8"));
         // ClamAV INSTREAM reply: "<id>: <verdict>" where verdict is
         // "stream: OK", "stream: <Sig.Name> FOUND", or "INSTREAM size
         // limit exceeded. ERROR". This is a security verdict classifier,

package/lib/mail-server-submission.js

@@ -198,7 +198,14 @@ function _extractDkimSignatures(headerBlock) {
 function _extractDkimDTag(sigValue) {
   var tags = sigValue.split(";");
   for (var i = 0; i < tags.length; i += 1) {
-    var t = tags[i].replace(/^\s+|\s+$/g, "");                                                          // allow:regex-no-length-cap — tag length bounded by header line cap // allow:duplicate-regex — trim shape
+    // Native trim, not `/^\s+|\s+$/`. The regex form is the classic quadratic
+    // trim: `\s+$` is retried from every start position when the run does not
+    // reach the end. The tag is NOT bounded by the line cap, because the header
+    // is unfolded first — every empty continuation line adds one space to the
+    // run, so 40,000 of them in a 120 KB message produced a 40,000-character
+    // run and 446ms of backtracking. `String.prototype.trim` uses the same
+    // WhiteSpace and LineTerminator set as `\s`, so this decides identically.
+    var t = tags[i].trim();
     if (t.length > 2 && t.charAt(0) === "d" && t.charAt(1) === "=") {
       return t.slice(2).replace(/\s+/g, "");                                                            // allow:regex-no-length-cap — value length bounded by tag length // allow:duplicate-regex — internal-WS strip
     }

package/lib/mail-sieve.js

@@ -43,9 +43,10 @@
  *   parse time (require 'comparator-NAME' not in KNOWN_CAPABILITIES).
  *
  *   Match-type wildcards: `:matches` uses `*` (any sequence) and `?`
- *   (one byte), per RFC 5228 §2.7.1. Both wildcards are converted to
- *   a bounded RegExp built from escaped literal byte segments — no
- *   user-controlled backtracking surface.
+ *   (one byte), per RFC 5228 §2.7.1. The pattern is matched directly
+ *   against the value rather than translated into a regular
+ *   expression, so a script author cannot spend the delivery thread's
+ *   CPU by writing a pattern that a backtracking engine explores.
  *
  *   The interpreter does NOT execute multi-script chains, sieve
  *   `include`s (RFC 6609), `notify` actions (RFC 5435), or `vacation`
@@ -63,7 +64,6 @@ var safeSieve = require("./safe-sieve");
 var { defineClass } = require("./framework-error");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
-var codepointClass = require("./codepoint-class");
 
 var MailSieveError = defineClass("MailSieveError", { alwaysPermanent: true });
 
@@ -124,22 +124,64 @@ function _envelopeAddresses(env, key) {
 
 // ---- match-type ---------------------------------------------------------
 
-function _escapeRe(s) {
-  return codepointClass.escapeRegExp(s);
+// RFC 5228 §2.7.1 — `*` matches any sequence, `?` matches exactly one. Matched
+// directly rather than translated into a regular expression.
+//
+// The translation is the obvious implementation and it is a denial of service.
+// `*` becomes `.*`, so a pattern with N stars hands a backtracking engine N
+// independent `.*` groups, and on a subject that never supplies the trailing
+// literal the engine tries every way of dividing the subject between them: the
+// cost is polynomial in the subject length with degree N. Three stars measured
+// x7.7 per doubling of the subject, and ten stars — which a mailbox owner can
+// type without meaning anything by it — did not finish on a 64-character
+// Subject. A Sieve script is USER-authored in most deployments, and the gas
+// budget does not help: gas counts operations, and one match is one operation
+// however long the engine spends inside it.
+//
+// This walks the two strings with a single remembered wildcard position to fall
+// back to. It is not linear: `*` followed by a long literal, matched against a
+// subject that keeps almost matching it, re-walks the literal from each new
+// alignment, so the worst case is the product of the two lengths. Measured at
+// 3.9ms for a 500-character pattern against 2,000 characters, 11.4ms at
+// 1,000 x 4,000, and 52.2ms at 2,000 x 8,000 — the quadratic shape, and a
+// bound that both the script size and the header size already cap.
+//
+// What it is NOT is a function of how many wildcards the pattern contains,
+// which is the property that mattered: the regex translation was polynomial
+// with degree equal to the wildcard count, so a tenth `*` cost another factor
+// of the subject length and a short Subject stopped returning at all.
+// `i;ascii-casemap` folds US-ASCII A-Z to a-z and leaves every other character
+// alone (RFC 4790 §9.2), which is also the only fold that preserves length.
+// `String.prototype.toLowerCase` does not: `"İ".toLowerCase()` is two
+// UTF-16 units, so folding the whole subject up front would shift every
+// position after it and leave `?` — which matches exactly one character —
+// facing two.
+function _asciiLower(ch) {
+  var c = ch.charCodeAt(0);
+  return (c >= 0x41 && c <= 0x5A) ? String.fromCharCode(c + 0x20) : ch;
 }
 
-function _wildcardToRe(pattern, caseInsensitive) {
-  // RFC 5228 §2.7.1 — `*` matches any sequence, `?` matches one. Escape
-  // every other regex meta. Anchored both ends.
-  var out = "^";
-  for (var i = 0; i < pattern.length; i++) {
-    var c = pattern[i];
-    if (c === "*") out += ".*";
-    else if (c === "?") out += ".";
-    else out += _escapeRe(c);
-  }
-  out += "$";
-  return new RegExp(out, caseInsensitive ? "i" : "");                                                  // allow:dynamic-regex — built from operator Sieve `:matches` pattern; every meta-char except `*`/`?` is regex-escaped, so the resulting NFA is linear in input length (no polynomial-backtrack surface)
+function _wildcardMatches(pattern, subject, caseInsensitive) {
+  var pat = pattern, sub = subject;
+  var p = 0, s = 0;
+  var starP = -1, starS = 0;
+  function same(a, bChar) {
+    return caseInsensitive ? _asciiLower(a) === _asciiLower(bChar) : a === bChar;
+  }
+
+  while (s < sub.length) {
+    if (p < pat.length && (pat[p] === "?" || same(pat[p], sub[s]))) { p += 1; s += 1; continue; }
+    if (p < pat.length && pat[p] === "*") { starP = p; starS = s; p += 1; continue; }
+    // No match here. If a `*` came earlier, give it one more character and
+    // resume from just after it; otherwise the subject cannot match.
+    if (starP === -1) return false;
+    starS += 1;
+    s = starS;
+    p = starP + 1;
+  }
+  // Trailing stars can absorb the empty remainder; anything else cannot.
+  while (p < pat.length && pat[p] === "*") p += 1;
+  return p === pat.length;
 }
 
 function _matches(haystack, needle, matchType, comparator) {
@@ -155,7 +197,7 @@ function _matches(haystack, needle, matchType, comparator) {
       : haystack.indexOf(needle) !== -1;
   }
   if (matchType === "matches") {
-    return _wildcardToRe(needle, ci).test(haystack);
+    return _wildcardMatches(needle, haystack, ci);
   }
   throw new MailSieveError("mail-sieve/bad-match-type",
     "unknown match-type: " + matchType);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.49",
+  "version": "0.18.50",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a6344adf-71aa-4268-ba0f-0073a6ead16a",
+  "serialNumber": "urn:uuid:0535e946-47d0-4e95-879e-65d801bc533b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-22T18:41:08.842Z",
+    "timestamp": "2026-08-22T21:30:23.773Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.49",
+      "bom-ref": "@blamejs/core@0.18.50",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.49",
+      "version": "0.18.50",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.49",
+      "purl": "pkg:npm/%40blamejs/core@0.18.50",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.49",
+      "ref": "@blamejs/core@0.18.50",
       "dependsOn": []
     }
   ]