@blamejs/core 0.18.49 → 0.18.51

package/lib/json-schema.js

@@ -52,6 +52,10 @@
 var numericBounds = require("./numeric-bounds");
 var rfc3339 = require("./rfc3339");
 var { defineClass } = require("./framework-error");
+var lazyRequire = require("./lazy-require");
+// Lazy: the screen is only reached by a schema that carries a `pattern`.
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
+var boundedMap = require("./bounded-map");
 
 var JsonSchemaError = defineClass("JsonSchemaError", { alwaysPermanent: true });
 
@@ -137,10 +141,52 @@ function _unescapePointerToken(t) { return t.replace(/~1/g, "/").replace(/~0/g,
 
 // --- registry: indexes every subschema by canonical URI + anchors ---
 
-function _Registry() { this.schemas = {}; this.dynamicAnchors = {}; this.baseByNode = new Map(); }
+// A ceiling on how many subschema POSITIONS one registry will index, across
+// every document added to it.
+//
+// This is the total-work half of the bound, and it is a different guarantee
+// from a depth ceiling: depth limits how far one path runs, and says nothing
+// about how many paths there are. The walk below cannot use identity tracking
+// instead, because it indexes each node by `base#pointer` and a shared object
+// legitimately has one entry per pointer that reaches it — skipping the second
+// visit would drop a `$ref` target rather than save work. So what gets bounded
+// is the number of entries, which is the thing that actually grows.
+//
+// A schema graph that reaches one object through a branching position —
+// `anyOf: [shared, shared]`, which is what building a schema out of reused
+// JavaScript objects produces, and which needs no `$ref` — has 2^depth pointers
+// over a handful of objects. A cyclic one has no end at all. Neither is refused
+// by a depth cap.
+//
+// Far above any authored schema: the JSON Schema meta-schema is on the order of
+// a hundred positions, and an OpenAPI document of a thousand endpoints is tens
+// of thousands. A schema that reaches this is not one someone wrote out.
+var MAX_REGISTRY_NODES = 100000;                            // subschema positions, not bytes
+
+// How deep a schema may nest before it is refused. This is the OTHER half of
+// the bound, and it is not the node ceiling in disguise: a chain ten thousand
+// levels deep is ten thousand positions, far under that ceiling, and still runs
+// the JavaScript stack out. What comes back then is `RangeError: Maximum call
+// stack size exceeded` — the engine's error, which says nothing about the
+// schema and is not catchable as a JsonSchemaError.
+//
+// It THROWS rather than stopping the walk. A walk that silently returns at the
+// ceiling leaves a node looking examined when its descendants were skipped,
+// which is how a pattern below one escapes screening entirely. Refusing is the
+// only reading that cannot be mistaken for completion.
+//
+// Well above anything authored — the JSON Schema meta-schema nests about a
+// dozen levels and an OpenAPI document a few dozen — and well below where the
+// stack gives out.
+var MAX_SCHEMA_NESTING = 1000;                              // nesting levels, not bytes
+
+function _Registry() {
+  this.schemas = {}; this.dynamicAnchors = {}; this.baseByNode = new Map();
+  this.nodesIndexed = 0;
+}
 
 _Registry.prototype.add = function (schema, baseUri) {
-  this._walk(schema, baseUri || "", "");
+  this._walk(schema, baseUri || "", "", null, 0);
   // A document retrieved from URI X is addressable by X even when its own
   // $id is a different (canonical) URI — register the retrieval URI too.
   if (baseUri && (_isObject(schema) || typeof schema === "boolean")) {
@@ -152,10 +198,43 @@ _Registry.prototype.add = function (schema, baseUri) {
 // Walk a schema document, registering $id base changes, $anchor and
 // $dynamicAnchor names, and indexing every subschema by its base URI +
 // JSON-pointer fragment.
-_Registry.prototype._walk = function (node, baseUri, pointer) {
+_Registry.prototype._walk = function (node, baseUri, pointer, path, depth) {
   if (!_isObject(node) && typeof node !== "boolean") return;
+  if (depth > MAX_SCHEMA_NESTING) {
+    throw new JsonSchemaError("json-schema/schema-too-deep",
+      "jsonSchema: schema nests deeper than " + MAX_SCHEMA_NESTING +
+      " levels — deeper than the walk can index without exhausting the stack");
+  }
+  this.nodesIndexed += 1;
+  if (this.nodesIndexed > MAX_REGISTRY_NODES) {
+    throw new JsonSchemaError("json-schema/schema-too-large",
+      "jsonSchema: schema indexes more than " + MAX_REGISTRY_NODES +
+      " subschema positions — a shared or cyclic schema graph reaches one " +
+      "object through many pointers; give the reused subschema an $id and " +
+      "reference it with $ref instead of embedding the same object twice");
+  }
   if (typeof node === "boolean") { this.schemas[baseUri + "#" + pointer] = node; return; }
 
+  // A node already on the ACTIVE PATH is a cycle, and a cycle with one
+  // reference per level never reaches the ceiling above: it does not branch, so
+  // it recurses straight down and exhausts the JavaScript stack while the count
+  // is still in the thousands, surfacing as a RangeError from the engine rather
+  // than the refusal this validator documents.
+  //
+  // The test is the path and not a depth cap, because deep is not the same as
+  // cyclic: a schema nesting four hundred levels with no cycle and no `$ref`
+  // compiles today, and a depth cap would refuse it — under a `ref-loop` code
+  // naming a reference chain it does not have. The path set answers the
+  // question actually being asked, and leaves depth alone.
+  path = path || new Set();
+  var isOwnAncestor = path.has(node);
+  if (isOwnAncestor) {
+    throw new JsonSchemaError("json-schema/ref-loop",
+      "jsonSchema: schema contains a cycle — a subschema is its own ancestor, " +
+      "so indexing it has no end; break the cycle with $id + $ref");
+  }
+  path.add(node);
+
   var thisBase = baseUri;
   if (typeof node.$id === "string") {
     thisBase = _resolveUri(node.$id, baseUri);
@@ -187,7 +266,7 @@ _Registry.prototype._walk = function (node, baseUri, pointer) {
   // Recurse. Keywords whose values are schemas vs maps-of-schemas vs
   // arrays-of-schemas are walked with the right shape.
   var self = this;
-  function child(key, sub, ptr) { self._walk(sub, thisBase, ptr); }
+  function child(key, sub, ptr) { self._walk(sub, thisBase, ptr, path, depth + 1); }
   SCHEMA_KEYWORDS.forEach(function (k) {
     if (node[k] !== undefined) child(k, node[k], pointer + "/" + k);
   });
@@ -203,6 +282,12 @@ _Registry.prototype._walk = function (node, baseUri, pointer) {
       node[k].forEach(function (sub, idx) { child(k, sub, pointer + "/" + k + "/" + idx); });
     }
   });
+
+  // Off the active path on the way out. A node reached again through a SIBLING
+  // branch is shared rather than cyclic, and indexing it under its second
+  // pointer is the correct thing to do — leaving it in the set would call that
+  // a cycle and refuse a schema that merely reuses a subschema.
+  path.delete(node);
 };
 
 _Registry.prototype.resolve = function (uri) {
@@ -251,7 +336,13 @@ var SCHEMA_KEYWORDS = ["additionalProperties", "propertyNames", "items",
   "unevaluatedProperties"];
 var SCHEMA_MAP_KEYWORDS = ["$defs", "definitions", "properties",
   "patternProperties", "dependentSchemas"];
-var SCHEMA_ARRAY_KEYWORDS = ["allOf", "anyOf", "oneOf", "prefixItems"];
+// `items` appears in BOTH lists on purpose. Draft 2020-12 makes it a single
+// schema, and the legacy tuple form makes it an array of them; each branch
+// checks the type it wants, so exactly one of them walks any given `items`.
+// Listed only as a single schema, an array-valued one was dropped at the
+// `_isObject` test at the top of the walk and never indexed at all — so the
+// subschemas inside a tuple were unreachable by `$ref`, and unbudgeted.
+var SCHEMA_ARRAY_KEYWORDS = ["allOf", "anyOf", "oneOf", "prefixItems", "items"];
 
 module.exports = _buildModule();
 
@@ -288,6 +379,81 @@ function _buildModule() {
  *     properties: { n: { type: "integer" } }, required: ["n"] });
  *   v.validate({ n: 1 }).valid;   // → true
  */
+// Where a subschema can appear. Named rather than inferred, because a schema
+// also carries DATA — `const`, `enum`, `default` and `examples` hold instance
+// values — and a walk that recursed into everything would read a `pattern` key
+// inside a `const` value as a schema keyword and refuse a legal schema for the
+// shape of its example data.
+//
+// Missing a position here is safe in the direction that matters: the screen in
+// _compileRegex still runs on whatever is actually compiled, so a subschema
+// this walk does not reach is refused when it is used rather than never. The
+// walk buys an earlier refusal, not the refusal itself.
+// `additionalItems` and `contentSchema` are deliberately absent: this validator
+// does not evaluate either keyword, so a pattern inside one never compiles and
+// never runs. Screening there could only refuse a schema for a branch that has
+// no effect.
+var _SUBSCHEMA_KEYS = ["additionalProperties", "contains",
+  "else", "if", "items", "not", "propertyNames", "then",
+  "unevaluatedItems", "unevaluatedProperties"];
+var _SUBSCHEMA_LIST_KEYS = ["allOf", "anyOf", "oneOf", "prefixItems", "items"];
+var _SUBSCHEMA_MAP_KEYS = ["$defs", "definitions", "dependentSchemas",
+  "patternProperties", "properties"];
+
+// Walk the subschema positions for the two keywords that carry a regular
+// expression, and hand each to the same screen the compile site uses.
+//
+// Every object is visited ONCE, tracked by identity. The depth ceiling below is
+// not a substitute for that and never was: it limits how far a single path runs
+// and says nothing about how many paths there are. A schema graph reaching one
+// object through a branching position — `anyOf: [shared, shared]`, which is what
+// building a schema in JavaScript out of reused subschema objects produces, and
+// which needs no `$ref` — was walked once per path. Twenty-one objects cost
+// 2.6 seconds, doubling per added level, against a cap that allows 256; a cyclic
+// schema never returned. This screen exists so a pattern cannot make the
+// validator hang, and SECURITY.md promises a screen costs the length of its
+// input and never a function of its shape, so a walk that is itself a function
+// of shape contradicts the thing it was added to guarantee.
+//
+// Identity tracking bounds the total work by the number of distinct objects,
+// which is the length of the schema — so the promise holds without a separate
+// node budget.
+//
+// The nesting ceiling here THROWS, and that distinction is the whole point. A
+// ceiling that silently stopped walking would leave a node looking examined
+// when its descendants were skipped, so a later and shallower path would find
+// it already marked and skip it too — and a catastrophic pattern below it would
+// never be screened at all, which is the opposite of what this walk is for.
+// Refusing cannot be mistaken for completion.
+function _screenPatterns(node, seen, depth) {
+  if (!_isObject(node)) return;
+  if (depth > MAX_SCHEMA_NESTING) {
+    throw new JsonSchemaError("json-schema/schema-too-deep",
+      "jsonSchema: schema nests deeper than " + MAX_SCHEMA_NESTING +
+      " levels — deeper than the pattern screen can walk without exhausting " +
+      "the stack");
+  }
+  seen = seen || new WeakSet();
+  if (seen.has(node)) return;
+  seen.add(node);
+
+  if (typeof node.pattern === "string") _compileRegex(node.pattern);
+  if (_isObject(node.patternProperties)) {
+    Object.keys(node.patternProperties).forEach(function (p) { _compileRegex(p); });
+  }
+
+  var next = (depth || 0) + 1;
+  _SUBSCHEMA_KEYS.forEach(function (k) { _screenPatterns(node[k], seen, next); });
+  _SUBSCHEMA_LIST_KEYS.forEach(function (k) {
+    if (!Array.isArray(node[k])) return;
+    node[k].forEach(function (sub) { _screenPatterns(sub, seen, next); });
+  });
+  _SUBSCHEMA_MAP_KEYS.forEach(function (k) {
+    if (!_isObject(node[k])) return;
+    Object.keys(node[k]).forEach(function (name) { _screenPatterns(node[k][name], seen, next); });
+  });
+}
+
 function compile(schema, opts) {
   opts = opts || {};
   if (!_isObject(schema) && typeof schema !== "boolean") {
@@ -304,6 +470,15 @@ function compile(schema, opts) {
   var rootBase = (_isObject(schema) && typeof schema.$id === "string") ? _resolveUri(schema.$id, "") : "";
   registry.add(schema, rootBase);
 
+  // Screen every pattern the schema carries HERE, while the author is still
+  // looking at the schema. Compiling is where a bad schema should be refused;
+  // leaving it to the first instance means the refusal lands on a request, in
+  // a validator the caller has already been handed and treats as good.
+  _screenPatterns(schema);
+  if (_isObject(opts.schemas)) {
+    Object.keys(opts.schemas).forEach(function (uri) { _screenPatterns(opts.schemas[uri]); });
+  }
+
   var assertFormat = opts.assertFormat === true;
   var maxErrors = numericBounds.isPositiveFiniteInt(opts.maxErrors) ? opts.maxErrors : DEFAULT_MAX_ERRORS;
 
@@ -525,15 +700,42 @@ function _checkString(schema, s, ctx, emit) {
   }
 }
 
-var _regexCache = {};
+// Keyed by the schema's own pattern text, so a long-lived process compiling
+// many distinct schemas would otherwise grow this without bound. The
+// framework's own ceiling primitive owns the eviction.
+var _regexCache = boundedMap.boundedMap({ maxEntries: 512 });
 function _compileRegex(pattern, ctx) {
-  if (Object.prototype.hasOwnProperty.call(_regexCache, pattern)) return _regexCache[pattern];
+  if (_regexCache.has(pattern)) return _regexCache.get(pattern);
+  // `pattern` / `patternProperties` decide how much CPU each validation costs,
+  // because the compiled expression runs against the instance. `(a+)+$` against
+  // a run of `a` ending in anything else measured 1.5 seconds at 28 characters
+  // and doubles with every two more, so a schema is a denial-of-service lever
+  // as much as a contract.
+  //
+  // A schema is not automatically the operator's own source: it arrives from a
+  // registry, a tool manifest, an upload or a config file. b.mcp already
+  // screens the pattern in a tool schema for this shape before matching it
+  // against request input, and this is the same construct.
+  //
+  // Screened once per distinct pattern — the cache below means a schema pays
+  // for the analysis at its first use rather than per instance.
+  //
+  // Compiled first and screened AFTER, on the compiled form, which is what
+  // b.safeJson does with the same keyword and for the reason recorded there:
+  // the flags decide what the source means, so a screen reading the source
+  // alone reads `(a|A)+` as two disjoint branches where the engine sees one
+  // branch twice. Compiling a pathological pattern is safe on its own — the
+  // cost is in matching, which has not happened yet.
   var re = null;
-  try { re = new RegExp(pattern, "u"); }                    // allow:dynamic-regex — JSON Schema pattern is part of the (operator-trusted) schema, not instance data
+  try { re = new RegExp(pattern, "u"); }                    // allow:dynamic-regex — ReDoS-screened via guardRegex.assertSafe below, before the compiled form is returned to any caller
   catch (_e) {
-    try { re = new RegExp(pattern); } catch (_e2) { re = null; }
+    try { re = new RegExp(pattern); } catch (_e2) { re = null; }   // allow:dynamic-regex — same screen, non-unicode fallback for a pattern `u` rejects
+  }
+  if (re) {
+    guardRegex().assertSafe(re, "jsonSchema.pattern",
+      JsonSchemaError, "json-schema/unsafe-pattern");
   }
-  _regexCache[pattern] = re;
+  _regexCache.set(pattern, re);
   return re;
 }
 

package/lib/mail-bimi.js

@@ -54,6 +54,7 @@ var nodeCrypto = require("node:crypto");
 
 var asn1 = require("./asn1-der");
 var C = require("./constants");
+var codepointClass = require("./codepoint-class");
 var pick = require("./pick");
 var httpClient = require("./http-client");
 var lazyRequire = require("./lazy-require");
@@ -87,6 +88,57 @@ var BIMI_RECORD_MAX_BYTES = C.BYTES.kib(2);
 // refused at validate-time before any tokenization.
 var TINY_PS_MAX_BYTES = C.BYTES.kib(32);
 
+// The SVG namespace, which a root element carrying a prefix must bind that
+// prefix to before the document is treated as a logo.
+var SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+
+// An XML namespace prefix is an NCName: XML 1.0's Name grammar without the
+// colon. These are the 5th-edition NameStartChar ranges and the characters
+// NameChar adds once a name has started, written as CODE POINTS rather than as
+// a regular-expression character class for two reasons. Most of the boundaries
+// do not render, so a literal class would put invisible characters in this
+// file; and the grammar reaches past the basic plane, where a class over UTF-16
+// code units cannot follow it.
+//
+// "Non-ASCII" is not the rule, and treating it as one is what this replaces.
+// NameStartChar deliberately omits the C1 controls, most punctuation and the
+// surrogate block, so a prefix built from those is not a name however faithfully
+// the document then declares it.
+var NCNAME_START_RANGES = [
+  [0x41, 0x5A], 0x5F, [0x61, 0x7A],
+  [0xC0, 0xD6], [0xD8, 0xF6], [0xF8, 0x2FF],
+  [0x370, 0x37D], [0x37F, 0x1FFF],
+  [0x200C, 0x200D], [0x2070, 0x218F], [0x2C00, 0x2FEF],
+  [0x3001, 0xD7FF], [0xF900, 0xFDCF], [0xFDF0, 0xFFFD],
+  [0x10000, 0xEFFFF],
+];
+
+var NCNAME_TAIL_RANGES = [
+  0x2D, 0x2E, [0x30, 0x39], 0xB7, [0x300, 0x36F], [0x203F, 0x2040],
+];
+
+// Stepped by CODE POINT, so an astral name character is read as the single
+// character it is, and a lone surrogate is read as itself — which is in no
+// range, so it is refused.
+function _isNcName(s) {
+  if (s.length === 0) return false;
+  var started = false;
+  for (var i = 0; i < s.length; ) {
+    var cp = s.codePointAt(i);
+    i += cp > 0xFFFF ? 2 : 1;
+    var ok = codepointClass.inRanges(cp, NCNAME_START_RANGES) ||
+             (started && codepointClass.inRanges(cp, NCNAME_TAIL_RANGES));
+    if (!ok) return false;
+    started = true;
+  }
+  return true;
+}
+
+// Superseded by _isNcName above. Not re-typed on the way out: two of this
+// class's bounds are characters that do not render, so what follows is left
+// exactly as it was rather than reconstructed from a reading of it.
+// var NC_NAME_RE = /^[A-Za-z_€-￿][A-Za-z0-9._€-￿-]*$/;
+
 // VMC / CMC fetch cap. Production VMCs are typically ~10-20 KiB;
 // 256 KiB is a generous ceiling that still bounds the download against
 // pathological responses. Operators with a stricter posture pass
@@ -571,7 +623,13 @@ function _tokenizeTinyPsSvg(s) {
 // values are still accepted (the SVG profile is permissive on quoting).
 function _parseTinyPsAttrs(src) {
   var attrs = {};
-  var re = /([A-Za-z_:][A-Za-z0-9:._-]*)\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/g;
+  // The lookbehind is what keeps this linear, and it is also what XML means: an
+  // attribute name starts after something that is not a name character. Without
+  // it the name can begin at every offset inside a long run of name characters,
+  // consuming the run each time before `\s*=\s*` fails — 397ms on a 32 KiB
+  // input against 0.6ms for a well-formed SVG of the same size. The bytes come
+  // from a logo fetched at a URL in the sender's own DNS record.
+  var re = /(?<![A-Za-z0-9:._-])([A-Za-z_:][A-Za-z0-9:._-]*)\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/g;
   var m;
   while ((m = re.exec(src)) !== null) {
     var name = m[1];
@@ -1002,17 +1060,232 @@ function _extractBimiCertPolicy(cert) {
   return rv;
 }
 
+// Is this leaf an SVG document — that is, does its root element come next once
+// everything XML permits ahead of a root has been stepped over?
+//
+// A prefix window cannot answer that. XML puts no length on the prologue, so
+// whichever number is chosen a legal document can put its root past it; the
+// first attempt here read 64 characters and dropped any logo carrying the usual
+// SVG 1.1 DOCTYPE, whose root sits at 154. What XML does bound is the KIND of
+// thing allowed before the root: whitespace (markup whitespace covers the
+// byte-order mark too), the declaration, processing instructions, comments and
+// a DOCTYPE. Stepping over those is both more permissive than any window and
+// stricter than a substring search, which called a document an SVG because a
+// comment mentioned one.
+//
+// Every branch advances the cursor past a complete construct, so the walk is
+// linear in the leaf and an unterminated construct ends it rather than
+// restarting a scan.
+// One past the `>` that closes a DOCTYPE declaration opening at `at`, or -1 if
+// it never closes.
+//
+// Every character the declaration can end on — `>`, and the `[`/`]` of the
+// internal subset — is also a character it may legally CONTAIN, inside a quoted
+// external identifier, a quoted entity value, or a comment. So none of them can
+// be located by searching for the next occurrence:
+//
+//   <!DOCTYPE svg SYSTEM "urn:logo>v1">        the `>` is in the URI
+//   <!DOCTYPE svg SYSTEM "urn:logo[v1">        the `[` opens no subset
+//   <!DOCTYPE svg [ <!ENTITY x "a]b"> ]>       the `]` is in the value
+//
+// Each of those was a separate defect while the ends were found with separate
+// searches. They are one defect: the declaration ends at the first `>` that is
+// not inside a quoted literal, a comment, or the subset. Reading it once, with
+// that rule, answers all of them and the ones not listed. Every branch advances,
+// so the walk is linear in the declaration.
+// One past a quoted literal opening at `j`; 0 when none opens there, -1 when
+// one opens and never closes. Same three-valued answer for the two helpers
+// below, so a caller reads them the same way.
+function _skipQuotedLiteral(text, j) {
+  var ch = text.charAt(j);
+  if (ch !== "\"" && ch !== "'") return 0;
+  var end = text.indexOf(ch, j + 1);
+  return end === -1 ? -1 : end + 1;
+}
+
+// One past a comment or a processing instruction opening at `j`. These are the
+// two constructs that may appear almost anywhere in a prologue and may contain
+// anything, so every scan that looks for a delimiter has to step over them —
+// and each must step over the SAME set. Teaching one scanner about processing
+// instructions and not its neighbour is what produced this function: the
+// declaration knew about them and the internal subset did not, so a legal
+// `<?meta value]?>` inside a subset ended it early.
+function _skipCommentOrPi(text, j) {
+  if (text.startsWith("<!--", j)) {
+    // XML rules, not HTML: a certificate payload is an XML document, and the
+    // HTML reader closes a comment at `--!>` and abruptly at `<!-->`, neither
+    // of which XML has. Reading one grammar with the other's rules disagrees
+    // about where the document begins — it would take the text after an early
+    // close for a root element, and would end a comment XML says is open.
+    var endComment = markupTokenizer.xmlCommentEnd(text, j);
+    return endComment === -1 ? -1 : endComment;
+  }
+  if (text.startsWith("<?", j)) {
+    var endPi = text.indexOf("?>", j + 2);
+    return endPi === -1 ? -1 : endPi + 2;
+  }
+  return 0;
+}
+
+function _endOfDoctype(text, at) {
+  var j = at + 9;                                        // past "<!DOCTYPE"
+  while (j < text.length) {
+    if (text.charAt(j) === ">") return j + 1;
+    if (text.charAt(j) === "[") {
+      var endSubset = _endOfInternalSubset(text, j);
+      if (endSubset === -1) return -1;
+      j = endSubset + 1;
+      continue;
+    }
+    var skipped = _skipQuotedLiteral(text, j);
+    if (skipped === 0) skipped = _skipCommentOrPi(text, j);
+    if (skipped === -1) return -1;
+    j = skipped === 0 ? j + 1 : skipped;
+  }
+  return -1;
+}
+
+// The index of the `]` that closes a DOCTYPE's internal subset, given the index
+// of its `[`, or -1 if it never closes. Same rule as the declaration around it:
+// quoted runs and comments are stepped over rather than searched through.
+function _endOfInternalSubset(text, at) {
+  var j = at + 1;
+  while (j < text.length) {
+    if (text.charAt(j) === "]") return j;
+    var skipped = _skipQuotedLiteral(text, j);
+    if (skipped === 0) skipped = _skipCommentOrPi(text, j);
+    if (skipped === -1) return -1;
+    j = skipped === 0 ? j + 1 : skipped;
+  }
+  return -1;
+}
+
+// The characters that can END a tag name: whitespace before the attributes, the
+// slash of an empty element, or the tag's own close. A closed set, unlike the
+// set of characters that may CONTINUE an XML name.
+function _endsTagName(text, at) {
+  var ch = text.charAt(at);
+  return ch === ">" || ch === "/" || markupTokenizer.isMarkupSpace(text.charCodeAt(at));
+}
+
+// Does the text between the root's name and its `>` read as a start tag?
+//
+// The one structural rule worth testing here is where a `/` may appear: XML
+// allows it in exactly one position, against the `>`, closing an empty element.
+// Anywhere else outside a quoted value the text is not a start tag — both
+// `<x:svg xmlns:x="…"/garbage>` and `<x:svg xmlns:x="…"/ >` have a closing
+// bracket and a perfectly good namespace declaration, and neither is one.
+//
+// Quotes are tracked because a `/` inside an attribute value is data: every
+// namespace URI here contains several.
+//
+// This is deliberately NOT a full attribute-grammar check. The function it
+// serves decides WHICH ASN.1 leaf holds the logo; whether the document is
+// conformant is validateTinyPsSvg's question, and duplicating that here would
+// be a second, weaker parser drifting out of step with the real one.
+function _tagBodyIsWellFormed(text, from, tagEnd) {
+  var quote = "";
+  for (var i = from; i < tagEnd; i += 1) {
+    var ch = text.charAt(i);
+    if (quote) { if (ch === quote) quote = ""; continue; }
+    if (ch === "\"" || ch === "'") { quote = ch; continue; }
+    if (ch !== "/") continue;
+    // A slash outside a quoted value closes an empty element, and XML's
+    // EmptyElemTag is `S? '/>'` — the space may come BEFORE the slash and not
+    // after it, so the slash has to sit against the bracket.
+    return i + 1 === tagEnd;
+  }
+  // An unterminated quote means the tag never really ended either.
+  return quote === "";
+}
+
+function _svgRootFollowsPrologue(text) {
+  var i = 0;
+  for (;;) {
+    i = markupTokenizer.skipMarkupSpace(text, i);
+
+    // Comments and processing instructions, through the same definitions the
+    // two DOCTYPE scanners use. The XML declaration is a processing instruction
+    // as far as finding its end goes.
+    var aside = _skipCommentOrPi(text, i);
+    if (aside === -1) return false;
+    if (aside !== 0) { i = aside; continue; }
+
+    if (text.startsWith("<!DOCTYPE", i) || text.startsWith("<!doctype", i)) {
+      var endDoctype = _endOfDoctype(text, i);
+      if (endDoctype === -1) return false;
+      i = endDoctype;
+      continue;
+    }
+    break;
+  }
+
+  if (text.charAt(i) !== "<") return false;
+
+  // Read the whole root name and compare its LOCAL part.
+  //
+  // Two things this gets right that a `startsWith("<svg")` does not. `<svgfoo`
+  // and `<svg.foo` are different elements — and asking instead "does a name
+  // character follow?" is only as good as the character list, since XML's name
+  // grammar runs well past the ASCII set any such list holds, `.` alone being
+  // enough to let `<svg.foo` through. And an SVG may bind its own namespace to
+  // a prefix and write the root `<svg:svg>`, which is the same element.
+  //
+  // What is deliberately NOT done is resolving the prefix to a namespace URI. A
+  // logo that omits `xmlns` altogether is common and was accepted before, so
+  // requiring the binding here would reject real marks; this step is best-effort
+  // detection deciding which leaf to hand back, not validation.
+  var nameEnd = i + 1;
+  while (nameEnd < text.length && !_endsTagName(text, nameEnd)) nameEnd += 1;
+  if (nameEnd >= text.length) return false;          // the name never ends: truncated
+  // A qualified name is `prefix:local`, one colon, two parts.
+  // The start tag has to CLOSE. A tag name ends at the whitespace before the
+  // attributes, so a document whose bytes stop mid-tag still has a complete
+  // name — and, if it got as far as a namespace declaration, a perfectly good
+  // binding. That is a truncated document rather than a logo. scanToTagEnd
+  // reports the end of the input when it finds no `>`.
+  var tagEnd = markupTokenizer.scanToTagEnd(text, nameEnd, text.length);
+  if (tagEnd >= text.length) return false;
+  if (!_tagBodyIsWellFormed(text, nameEnd, tagEnd)) return false;
+
+  var parts = text.slice(i + 1, nameEnd).split(":");
+  if (parts.length > 2 || parts[parts.length - 1] !== "svg") return false;
+  // A prefix is an NCName, so a digit or a punctuation character cannot begin
+  // one. Without this a malformed name that declares a matching attribute —
+  // `<0ns:svg xmlns:0ns="...">` — would satisfy the binding check below, since
+  // attribute parsing is as permissive about names as this scan is.
+  if (parts.length === 2 && !_isNcName(parts[0])) return false;
+  // An unprefixed root is accepted without an `xmlns`: logos omit it, and the
+  // scanner this replaces accepted them.
+  if (parts.length === 1) return true;
+
+  // A prefix, though, means nothing until the root binds it. `<x:svg>` where
+  // `x` is another vocabulary is not an SVG, and one declared nowhere names
+  // nothing — so requiring the binding is what separates a namespaced root from
+  // arbitrary XML whose local name happens to read `svg`. It also settles the
+  // malformed names for free: `<a::svg` has too many parts, and `<a<:svg` and
+  // `<0ns:svg` declare no matching `xmlns:` attribute.
+  var attrs = markupTokenizer.parseAttrs(text.slice(nameEnd, tagEnd));
+  var wanted = "xmlns:" + parts[0];
+  for (var a = 0; a < attrs.length; a += 1) {
+    // The value is compared for what it DENOTES: an XML processor resolves
+    // `&#x73;vg` and `svg` to the same namespace, so comparing the lexical form
+    // would reject a root whose namespace is the SVG one.
+    if (attrs[a].name === wanted) {
+      return markupTokenizer.decodeCharRefs(attrs[a].value) === SVG_NAMESPACE;
+    }
+  }
+  return false;
+}
+
 function _scanForEmbeddedSvg(node, depthBudget) {
   if (!node) return null;
   if (depthBudget < 0) return null;
 
   if (!node.constructed) {
     if (!node.value || node.value.length < 4) return null;
-    var prefix = node.value.slice(0, Math.min(node.value.length, 64)).toString("utf8");   /* display truncation length, not bytes */
-    if (prefix.indexOf("<svg") !== -1 || /<\?xml[\s\S]*<svg/.test(prefix)) {
-      return node.value.toString("utf8");
-    }
-    return null;
+    var text = node.value.toString("utf8");
+    return _svgRootFollowsPrologue(text) ? text : null;
   }
 
   var children;

package/lib/mail-scan.js

@@ -104,6 +104,26 @@ var CLAMAV_LENGTH_PREFIX_BYTES = 4;
 // ClamAV INSTREAM chunk size for streaming.
 var CLAMAV_CHUNK_BYTES = 65536;
 
+// Trailing CR / LF / NUL off a daemon reply, walked backwards from the end.
+//
+// The regex form of this, `/[\r\n\0]+$/`, is quadratic: `$` does not stop the
+// engine retrying from every start position, so a reply carrying a long
+// interior run of newlines costs O(n^2) — measured 135ms at 20k characters,
+// 538ms at 40k and 2207ms at 80k, and 1223ms through the real scan path.
+// The reply IS capped, but by `maxResponseBytes`, which is 50 MiB on the strict
+// profile and 300 MiB on permissive, so the cap is not what would save it.
+//
+// `String.prototype.trim` is not the substitute here: NUL is not whitespace.
+function _stripTrailingEol(s) {
+  var end = s.length;
+  while (end > 0) {
+    var c = s.charCodeAt(end - 1);
+    if (c !== 0x0D && c !== 0x0A && c !== 0x00) break;
+    end -= 1;
+  }
+  return end === s.length ? s : s.slice(0, end);
+}
+
 var PROFILES = Object.freeze({
   strict:     { timeoutMs: C.TIME.seconds(30),  maxMessageBytes: C.BYTES.mib(25),  maxResponseBytes: C.BYTES.mib(50) },   // operator-facing default mailbox cap
   balanced:   { timeoutMs: C.TIME.seconds(60),  maxMessageBytes: C.BYTES.mib(50),  maxResponseBytes: C.BYTES.mib(100) },  // operator-facing default mailbox cap
@@ -385,7 +405,7 @@ function create(opts) {
         if (done) return;
         done = true;
         clearTimeout(to);
-        var reply = collector.result().toString("utf8").replace(/[\r\n\0]+$/g, "");                // allow:regex-no-length-cap — trailing-trim anchored
+        var reply = _stripTrailingEol(collector.result().toString("utf8"));
         // ClamAV INSTREAM reply: "<id>: <verdict>" where verdict is
         // "stream: OK", "stream: <Sig.Name> FOUND", or "INSTREAM size
         // limit exceeded. ERROR". This is a security verdict classifier,

package/lib/mail-server-submission.js

@@ -198,7 +198,14 @@ function _extractDkimSignatures(headerBlock) {
 function _extractDkimDTag(sigValue) {
   var tags = sigValue.split(";");
   for (var i = 0; i < tags.length; i += 1) {
-    var t = tags[i].replace(/^\s+|\s+$/g, "");                                                          // allow:regex-no-length-cap — tag length bounded by header line cap // allow:duplicate-regex — trim shape
+    // Native trim, not `/^\s+|\s+$/`. The regex form is the classic quadratic
+    // trim: `\s+$` is retried from every start position when the run does not
+    // reach the end. The tag is NOT bounded by the line cap, because the header
+    // is unfolded first — every empty continuation line adds one space to the
+    // run, so 40,000 of them in a 120 KB message produced a 40,000-character
+    // run and 446ms of backtracking. `String.prototype.trim` uses the same
+    // WhiteSpace and LineTerminator set as `\s`, so this decides identically.
+    var t = tags[i].trim();
     if (t.length > 2 && t.charAt(0) === "d" && t.charAt(1) === "=") {
       return t.slice(2).replace(/\s+/g, "");                                                            // allow:regex-no-length-cap — value length bounded by tag length // allow:duplicate-regex — internal-WS strip
     }