@blamejs/core 0.18.49 → 0.18.51

package/lib/mail-sieve.js

@@ -43,9 +43,10 @@
  *   parse time (require 'comparator-NAME' not in KNOWN_CAPABILITIES).
  *
  *   Match-type wildcards: `:matches` uses `*` (any sequence) and `?`
- *   (one byte), per RFC 5228 §2.7.1. Both wildcards are converted to
- *   a bounded RegExp built from escaped literal byte segments — no
- *   user-controlled backtracking surface.
+ *   (one byte), per RFC 5228 §2.7.1. The pattern is matched directly
+ *   against the value rather than translated into a regular
+ *   expression, so a script author cannot spend the delivery thread's
+ *   CPU by writing a pattern that a backtracking engine explores.
  *
  *   The interpreter does NOT execute multi-script chains, sieve
  *   `include`s (RFC 6609), `notify` actions (RFC 5435), or `vacation`
@@ -63,7 +64,6 @@ var safeSieve = require("./safe-sieve");
 var { defineClass } = require("./framework-error");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
-var codepointClass = require("./codepoint-class");
 
 var MailSieveError = defineClass("MailSieveError", { alwaysPermanent: true });
 
@@ -124,22 +124,64 @@ function _envelopeAddresses(env, key) {
 
 // ---- match-type ---------------------------------------------------------
 
-function _escapeRe(s) {
-  return codepointClass.escapeRegExp(s);
+// RFC 5228 §2.7.1 — `*` matches any sequence, `?` matches exactly one. Matched
+// directly rather than translated into a regular expression.
+//
+// The translation is the obvious implementation and it is a denial of service.
+// `*` becomes `.*`, so a pattern with N stars hands a backtracking engine N
+// independent `.*` groups, and on a subject that never supplies the trailing
+// literal the engine tries every way of dividing the subject between them: the
+// cost is polynomial in the subject length with degree N. Three stars measured
+// x7.7 per doubling of the subject, and ten stars — which a mailbox owner can
+// type without meaning anything by it — did not finish on a 64-character
+// Subject. A Sieve script is USER-authored in most deployments, and the gas
+// budget does not help: gas counts operations, and one match is one operation
+// however long the engine spends inside it.
+//
+// This walks the two strings with a single remembered wildcard position to fall
+// back to. It is not linear: `*` followed by a long literal, matched against a
+// subject that keeps almost matching it, re-walks the literal from each new
+// alignment, so the worst case is the product of the two lengths. Measured at
+// 3.9ms for a 500-character pattern against 2,000 characters, 11.4ms at
+// 1,000 x 4,000, and 52.2ms at 2,000 x 8,000 — the quadratic shape, and a
+// bound that both the script size and the header size already cap.
+//
+// What it is NOT is a function of how many wildcards the pattern contains,
+// which is the property that mattered: the regex translation was polynomial
+// with degree equal to the wildcard count, so a tenth `*` cost another factor
+// of the subject length and a short Subject stopped returning at all.
+// `i;ascii-casemap` folds US-ASCII A-Z to a-z and leaves every other character
+// alone (RFC 4790 §9.2), which is also the only fold that preserves length.
+// `String.prototype.toLowerCase` does not: `"İ".toLowerCase()` is two
+// UTF-16 units, so folding the whole subject up front would shift every
+// position after it and leave `?` — which matches exactly one character —
+// facing two.
+function _asciiLower(ch) {
+  var c = ch.charCodeAt(0);
+  return (c >= 0x41 && c <= 0x5A) ? String.fromCharCode(c + 0x20) : ch;
 }
 
-function _wildcardToRe(pattern, caseInsensitive) {
-  // RFC 5228 §2.7.1 — `*` matches any sequence, `?` matches one. Escape
-  // every other regex meta. Anchored both ends.
-  var out = "^";
-  for (var i = 0; i < pattern.length; i++) {
-    var c = pattern[i];
-    if (c === "*") out += ".*";
-    else if (c === "?") out += ".";
-    else out += _escapeRe(c);
-  }
-  out += "$";
-  return new RegExp(out, caseInsensitive ? "i" : "");                                                  // allow:dynamic-regex — built from operator Sieve `:matches` pattern; every meta-char except `*`/`?` is regex-escaped, so the resulting NFA is linear in input length (no polynomial-backtrack surface)
+function _wildcardMatches(pattern, subject, caseInsensitive) {
+  var pat = pattern, sub = subject;
+  var p = 0, s = 0;
+  var starP = -1, starS = 0;
+  function same(a, bChar) {
+    return caseInsensitive ? _asciiLower(a) === _asciiLower(bChar) : a === bChar;
+  }
+
+  while (s < sub.length) {
+    if (p < pat.length && (pat[p] === "?" || same(pat[p], sub[s]))) { p += 1; s += 1; continue; }
+    if (p < pat.length && pat[p] === "*") { starP = p; starS = s; p += 1; continue; }
+    // No match here. If a `*` came earlier, give it one more character and
+    // resume from just after it; otherwise the subject cannot match.
+    if (starP === -1) return false;
+    starS += 1;
+    s = starS;
+    p = starP + 1;
+  }
+  // Trailing stars can absorb the empty remainder; anything else cannot.
+  while (p < pat.length && pat[p] === "*") p += 1;
+  return p === pat.length;
 }
 
 function _matches(haystack, needle, matchType, comparator) {
@@ -155,7 +197,7 @@ function _matches(haystack, needle, matchType, comparator) {
       : haystack.indexOf(needle) !== -1;
   }
   if (matchType === "matches") {
-    return _wildcardToRe(needle, ci).test(haystack);
+    return _wildcardMatches(needle, haystack, ci);
   }
   throw new MailSieveError("mail-sieve/bad-match-type",
     "unknown match-type: " + matchType);

package/lib/markup-tokenizer.js

@@ -61,6 +61,92 @@ function splitTagNameAttrs(inner, tailChars) {
 var HTML_TAG_NAME_TAIL = codepointClass.ASCII_ALNUM + ":-";
 var XML_TAG_NAME_TAIL  = codepointClass.ASCII_ALNUM + ":-_";
 
+// The five entities XML predefines. Everything else in an attribute value is
+// either a numeric character reference or a reference to an entity a DTD
+// declared, which nothing here expands: an attribute value is compared, not
+// executed, and expanding declared entities is the door XXE comes through.
+var XML_PREDEFINED_REFS = {
+  amp: "&", lt: "<", gt: ">", quot: "\"", apos: "'",
+};
+
+var DEC_DIGITS_RE = /^[0-9]+$/;
+var HEX_DIGITS_RE = /^[0-9A-Fa-f]+$/;
+
+// U+10FFFF is six hex digits and 1114111 is seven decimal ones.
+var MAX_CHAR_REF_DIGITS = 7;   // digit count, not bytes
+
+// decodeCharRefs(s) — an attribute value with its numeric character references
+// and predefined entities resolved, so a value can be COMPARED against what it
+// denotes rather than against one spelling of it. `&#x73;vg` and `svg` are the
+// same namespace to an XML processor, and a scanner that compares the lexical
+// form disagrees with it.
+//
+// An unrecognized or malformed reference is left exactly as written rather than
+// dropped, so nothing a caller then matches on can be manufactured by deleting
+// characters. Returns the input unchanged when it holds no `&` at all.
+function decodeCharRefs(s) {
+  if (s.indexOf("&") === -1) return s;
+  var out = "";
+  var i = 0;
+  while (i < s.length) {
+    var amp = s.indexOf("&", i);
+    if (amp === -1) { out += s.slice(i); break; }
+    out += s.slice(i, amp);
+    var semi = s.indexOf(";", amp + 1);
+    if (semi === -1) { out += s.slice(amp); break; }
+    var body = s.slice(amp + 1, semi);
+    var decoded = null;
+    if (body.charAt(0) === "#") {
+      var hex = body.charAt(1) === "x" || body.charAt(1) === "X";
+      var digits = hex ? body.slice(2) : body.slice(1);
+      // XML puts no limit on leading zeros, so what gets bounded is the
+      // SIGNIFICANT digits, not the lexical run: a cap on the written form
+      // refuses `&#0000000104;`, which an XML processor resolves normally.
+      // Skipping the zeros is a plain index walk, so the unbounded part of the
+      // input never reaches a pattern. The largest code point is six hex digits
+      // or seven decimal ones, and a refused reference is left exactly as
+      // written, so bounding it cannot manufacture a match.
+      var firstSignificant = 0;
+      while (firstSignificant < digits.length - 1 &&
+             digits.charAt(firstSignificant) === "0") firstSignificant += 1;
+      var significant = digits.slice(firstSignificant);
+      var wellFormed = significant.length > 0 &&
+                       significant.length <= MAX_CHAR_REF_DIGITS &&
+                       (hex ? HEX_DIGITS_RE.test(significant) : DEC_DIGITS_RE.test(significant));
+      if (wellFormed) {
+        var cp = parseInt(significant, hex ? 16 : 10);
+        // A lone surrogate is not a character; neither is anything past the
+        // last plane, nor U+0000, which XML's Char production excludes. Each
+        // would either throw out of fromCodePoint or put a value in the string
+        // that no document can contain.
+        if (cp > 0 && cp <= 0x10FFFF && !(cp >= 0xD800 && cp <= 0xDFFF)) {
+          decoded = String.fromCodePoint(cp);
+        }
+      }
+    } else if (Object.prototype.hasOwnProperty.call(XML_PREDEFINED_REFS, body)) {
+      decoded = XML_PREDEFINED_REFS[body];
+    }
+    out += decoded === null ? s.slice(amp, semi + 1) : decoded;
+    i = semi + 1;
+  }
+  return out;
+}
+
+// xmlCommentEnd(s, lt) — the same question for an XML document, where the
+// answer is different. XML 1.0 §2.5 gives a comment exactly one terminator,
+// "-->": there is no "--!>" and no abrupt "<!-->" / "<!--->" close. So the two
+// grammars disagree in BOTH directions, and using the HTML reader on XML is a
+// parser differential either way — it ends a comment early and reads the text
+// after it as markup, and it ends one that XML says is still open.
+//
+// This module already names both tag-name grammars for the same reason; a
+// caller picks the one its document is written in rather than restating it.
+// Returns -1 when the comment is unterminated, as its HTML sibling does.
+function xmlCommentEnd(s, lt) {
+  var end = s.indexOf("-->", lt + 4);
+  return end === -1 ? -1 : end + 3;
+}
+
 // htmlCommentEnd(s, lt) — given that an HTML comment opens at index `lt`
 // (s.startsWith("<!--", lt)), return the index ONE PAST the comment's
 // terminator per the WHATWG HTML tokenizer, not just the legacy "-->" form.
@@ -233,6 +319,8 @@ module.exports = {
   scanToTagEnd: scanToTagEnd,
   splitTagNameAttrs: splitTagNameAttrs,
   htmlCommentEnd: htmlCommentEnd,
+  xmlCommentEnd: xmlCommentEnd,
+  decodeCharRefs: decodeCharRefs,
   HTML_TAG_NAME_TAIL: HTML_TAG_NAME_TAIL,
   XML_TAG_NAME_TAIL: XML_TAG_NAME_TAIL,
   isMarkupSpace: isMarkupSpace,

package/lib/vendor/MANIFEST.json

@@ -21,7 +21,7 @@
         "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
         "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "@noble/hashes": {
       "version": "2.3.0",
@@ -48,7 +48,7 @@
       "hashes": {
         "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -70,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z",
+      "refreshedAt": "2026-08-23T07:32:38.917Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -114,7 +114,7 @@
         "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
         "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z",
+      "refreshedAt": "2026-08-23T07:32:38.917Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -193,10 +193,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     },
     "@blamejs/pki": {
-      "version": "0.5.25",
+      "version": "0.5.28",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -216,12 +216,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-21T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.5.25:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-23T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.5.28:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:4e64654dfddb16742f615f24a4e8892286495d94ae29597cdc3e988122f3ef4a"
+        "server": "sha256:a11e84272034dc4065dac44f55b722b3b4e1803ddeb27b09cbe6d8644225209c"
       },
-      "refreshedAt": "2026-08-22T03:19:31.188Z"
+      "refreshedAt": "2026-08-23T07:32:38.917Z"
     }
   }
 }