@blamejs/core 0.18.53 → 0.18.55

package/lib/middleware/headers.js

@@ -35,6 +35,7 @@
  *   });
  */
 
+var codepointClass = require("../codepoint-class");
 var lazyRequire = require("../lazy-require");
 var safeBuffer = require("../safe-buffer");
 
@@ -104,16 +105,12 @@ function _detectIssues(headers, opts) {
         });
         continue;
       }
-      for (var ci = 0; ci < v.length; ci += 1) {
-        var cc = v.charCodeAt(ci);
-        if (cc === 0x0D || cc === 0x0A || cc === 0x00) {                         // CR / LF / NUL forbidden in header value
-          issues.push({
-            kind: "header-value-control-byte", severity: "high", header: name,
-            snippet: "header `" + name + "` value contains CR / LF / NUL " +
-                     "— header-injection defense in depth",
-          });
-          break;
-        }
+      if (codepointClass.firstLineInjectionCharOffset(v) !== -1) {
+        issues.push({
+          kind: "header-value-control-byte", severity: "high", header: name,
+          snippet: "header `" + name + "` value contains CR / LF / NUL " +
+                   "— header-injection defense in depth",
+        });
       }
     }
   }

package/lib/middleware/require-mtls.js

@@ -272,7 +272,14 @@ function create(opts) {
         });
       }
     }
-    if (allowList && allowList.length > 0 && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
+    // Gated on "was an allowlist supplied", NOT on "is it non-empty". The
+    // derivation above already spells the two apart — `null` when the option is
+    // omitted, an array when it is given — and re-testing the length here
+    // collapsed them, so a pin built from configuration that returned zero
+    // entries admitted every client certificate instead of none. An allowlist
+    // that disappears when empty is a firewall rule set that opens when the
+    // last rule is deleted, and here that rule set is the front door.
+    if (allowList && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
       return _refuse(req, res, "fingerprint-not-allowed", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,

package/lib/network-dns-resolver.js

@@ -402,7 +402,21 @@ function create(opts) {
 
     if (parsed.rcode !== 0) {
       // RFC 1035 §4.1.1 — non-zero RCODE. Surface and refuse caching.
-      throw new ResolverError("resolver/nxdomain-or-error",
+      //
+      // NXDOMAIN and everything else are DIFFERENT ANSWERS and no longer share
+      // a code. NXDOMAIN (RCODE 3) means the name does not exist, which for a
+      // policy fetch or a blocklist is the ordinary case: no MTA-STS record, not
+      // on the list. SERVFAIL and REFUSED mean the question was not answered,
+      // and reading those as absence is a downgrade an attacker can arrange —
+      // break the lookup and the policy that would have refused you disappears.
+      //
+      // One code called `nxdomain-or-error` forced both readings on every
+      // caller, and both callers picked absence: `safeResolveTxt` could not
+      // match it at all so the commonest form of absence threw, and `b.mail.rbl`
+      // matched it and returned "not listed" for a lookup that failed.
+      var absent = parsed.rcode === 3;                                   // RFC 1035 §4.1.1 NXDOMAIN
+      throw new ResolverError(
+        absent ? "resolver/nxdomain" : "resolver/query-failed",
         "query: upstream RCODE=" + parsed.rcode + " for " + name + "/" + qtype);
     }
 
@@ -501,6 +515,12 @@ function create(opts) {
     queryCname:   _typed("CNAME"),
     queryMx:      _typed("MX"),
     queryNs:      _typed("NS"),
+    // PTR was the one common type with no helper, though it has been in
+    // QTYPE_BY_NAME all along. `b.mail.helo` called `resolver.queryPtr` for its
+    // forward-confirmed reverse DNS check, got `undefined`, and the resulting
+    // TypeError landed in a catch written for NXDOMAIN — so the check reported
+    // a clean "no reverse name" for every address instead of a broken call.
+    queryPtr:     _typed("PTR"),
     queryTxt:     _typed("TXT"),
     querySrv:     _typed("SRV"),
     queryTlsa:    _typed("TLSA"),
@@ -533,12 +553,31 @@ function _defaultTransport(timeoutMs) {
 async function _wireLookup(name, qtype, timeoutMs) {
   var ms = typeof timeoutMs === "number" && isFinite(timeoutMs) && timeoutMs > 0
     ? timeoutMs : DEFAULT_TIMEOUT_MS;
-  var url = networkDns._getDohUrlForTest ? networkDns._getDohUrlForTest() : "https://cloudflare-dns.com/dns-query";
+  // Where the deployment's DoH actually points. This used to be a hardcoded
+  // public provider, so an operator who had configured DoH to their own
+  // resolver still had every resolver.query() leave for the public one — and
+  // any statement they made about that resolver (that it validates DNSSEC, that
+  // it serves a split-horizon zone) described a resolver the query never
+  // reached. b.mail.send.deliver's `policy.dnssecValidated` is exactly such a
+  // statement. The endpoint is read per lookup rather than captured at create,
+  // so a later useDnsOverHttps reaches the next query instead of a handle's
+  // whole lifetime being pinned to boot-time configuration.
+  var endpoint = networkDns.activeDohEndpoint();
+  var url = (endpoint && endpoint.url) || "https://cloudflare-dns.com/dns-query";
   // Encode a wire-format query for the target qtype.
   var qbuf = _encodeWireQuery(name, qtype);
   var b64 = bCrypto.toBase64Url(qbuf);
   var getUrl = url + (url.indexOf("?") === -1 ? "?" : "&") + "dns=" + b64;
-  var u = safeUrl.parse(getUrl, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
+  // RFC 8484 §4.1 — GET carries the query in the URL, POST in the body. An
+  // endpoint may accept only POST, and `useDnsOverHttps({ method })` says so;
+  // honouring the operator's URL while ignoring their method leaves that
+  // endpoint unusable. With no method configured the choice falls to URL
+  // length, using the threshold b.network.dns owns rather than a second copy
+  // of the number.
+  var maxGet = (endpoint && endpoint.getUrlMaxBytes) || 2048;                                            // RFC 9112 §3-conservative GET ceiling
+  var usePost = (endpoint && endpoint.method === "POST") ||
+                (!(endpoint && endpoint.method) && getUrl.length > maxGet);
+  var u = safeUrl.parse(usePost ? url : getUrl, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
   return new Promise(function (resolve, reject) {
     var settled = false;
     function _fail(err) {
@@ -555,13 +594,23 @@ async function _wireLookup(name, qtype, timeoutMs) {
     // Raw DoH wire-format request — bypasses b.httpClient envelope
     // because we need the raw binary response bytes for safeDns to
     // parse (httpClient assumes JSON/text shapes).
-    var req = https.request(Object.assign({                                                              // allow:raw-outbound-http-framework-internal — DoH wire-format response bytes; b.httpClient envelopes assume text/JSON, and httpClient → ssrfGuard → DNS → DoH would form a cycle
+    // The operator's CA travels with the endpoint. A private DoH resolver is
+    // usually issued by a private CA, so honouring the URL without the trust
+    // anchor that validates it would swap one unreachable endpoint for another.
+    var headers = { "accept": "application/dns-message" };
+    if (usePost) {
+      headers["content-type"]   = "application/dns-message";
+      headers["content-length"] = String(qbuf.length);
+    }
+    var reqOpts = Object.assign({
       hostname:   u.hostname,
       port:       u.port || 443,                                                                        // HTTPS port
       path:       u.pathname + u.search,
-      method:     "GET",
-      headers:    { "accept": "application/dns-message" },
-    }, networkTls().outboundPosture()), function (res) {
+      method:     usePost ? "POST" : "GET",
+      headers:    headers,
+    }, networkTls().outboundPosture());
+    if (endpoint && endpoint.ca) reqOpts.ca = endpoint.ca;
+    var req = https.request(reqOpts, function (res) {                                                    // allow:raw-outbound-http-framework-internal — DoH wire-format response bytes; b.httpClient envelopes assume text/JSON, and httpClient → ssrfGuard → DNS → DoH would form a cycle
       var collector = safeBuffer.boundedChunkCollector({
         maxBytes:    C.BYTES.kib(64),
         errorClass:  ResolverError,
@@ -599,6 +648,8 @@ async function _wireLookup(name, qtype, timeoutMs) {
       _fail(new ResolverError("resolver/upstream-failed",
         "DoH request failed: " + e.message));
     });
+    // POST carries the wire-format query as the body; GET carried it in the URL.
+    if (usePost) req.write(qbuf);
     req.end();
   });
 }
@@ -709,7 +760,19 @@ async function safeResolveTxt(qname, opts) {
   try {
     return await resolveTxt(qname, opts.dnsLookup);
   } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
+    // `resolver/nxdomain` belongs here and was the omission: it is how THIS
+    // framework's own resolver reports a name that does not exist, which is the
+    // commonest way a policy record is absent. Only ENOTFOUND / ENODATA were
+    // listed — the codes node's stub resolver uses — so the documented
+    // "absence is not an error" convention held for an operator-supplied
+    // `dnsLookup` and not for the resolver the module ships with.
+    //
+    // `resolver/query-failed` deliberately does NOT belong here. A lookup that
+    // was not answered is not a record that is not published, and treating it
+    // as one lets an attacker who can break the query delete the policy that
+    // would have refused them.
+    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA" ||
+              e.code === "resolver/nxdomain")) return null;
     var msg = "TXT lookup for " + qname + " failed: " + ((e && e.message) || String(e));
     if (typeof opts.errorFactory === "function") throw opts.errorFactory(opts.code, msg);
     throw e;

package/lib/network-dns.js

@@ -437,6 +437,31 @@ function useDnsOverHttps(opts) {
   observability().safeEvent("network.dns.doh.set", 1, { url: url, method: method || "auto" });
 }
 
+// activeDohEndpoint() — where DoH queries go right now, or null when the
+// deployment is not on DoH (the operator chose DoT or the system resolver).
+//
+// b.network.dns.resolver runs its own wire-format request, because it needs the
+// raw response bytes for arbitrary record types and this module's DoH path
+// returns decoded addresses. Reading the endpoint from here is what keeps the
+// two agreeing: the resolver previously hardcoded a public provider, so a
+// deployment that had configured DoH to its own resolver — for split horizon,
+// for privacy, or because that resolver validates DNSSEC — had every
+// resolver.query() go to the public one instead, silently.
+// `getUrlMaxBytes` travels with it because the method is not always configured:
+// RFC 8484 §4.1 lets a client switch to POST when the GET URL would be too
+// long, and that threshold is this module's to choose. Returning it keeps the
+// resolver's decision identical to the one made here rather than a second
+// number that can drift.
+function activeDohEndpoint() {
+  if (!STATE.doh) return null;
+  return {
+    url:             STATE.doh.url,
+    method:          STATE.doh.method || null,
+    ca:              STATE.doh.ca || null,
+    getUrlMaxBytes:  DOH_GET_URL_MAX_BYTES,
+  };
+}
+
 function useDnsOverTls(opts) {
   opts = opts || {};
   validateOpts(opts, ["host", "port", "servername", "ca"], "dns.useDnsOverTls");
@@ -2259,6 +2284,7 @@ module.exports = {
   setLookupTimeoutMs:          setLookupTimeoutMs,
   setCacheTtlMs:               setCacheTtlMs,
   useDnsOverHttps:             useDnsOverHttps,
+  activeDohEndpoint:           activeDohEndpoint,
   useDnsOverTls:               useDnsOverTls,
   useSystemResolver:           useSystemResolver,
   useDesignatedResolvers:      useDesignatedResolvers,

package/lib/network-smtp-policy.js

@@ -243,17 +243,49 @@ async function daneTlsa(domain, port, opts) {
   opts = opts || {};
   var p = typeof port === "number" ? port : 25;                                  // IANA SMTP port
   var qname = "_" + p + "._tcp." + domain.toLowerCase();
-  // node:dns has resolveTlsa() since Node 18.16.0.
-  if (typeof dnsPromises.resolveTlsa !== "function") {
-    throw new SmtpPolicyError("smtp/dane-unavailable",
-      "node:dns.resolveTlsa is not available on this runtime");
-  }
+
+  // `opts.resolver` is the caller's own resolver — the one whose DNSSEC posture
+  // `opts.dnssecValidated` is an assertion ABOUT. Falling back to node:dns here
+  // when one was supplied would mean the assertion described resolver A while
+  // the records arrived from resolver B, so a non-validating system resolver
+  // could hand over spoofed TLSA data that DANE then treats as authenticated.
+  // A supplied resolver that cannot answer TLSA is refused rather than bypassed.
   var records;
-  try { records = await dnsPromises.resolveTlsa(qname); }
-  catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return [];
-    throw new SmtpPolicyError("smtp/dane-lookup-failed",
-      "TLSA lookup for " + qname + " failed: " + ((e && e.message) || String(e)));
+  if (opts.resolver) {
+    if (typeof opts.resolver.queryTlsa !== "function") {
+      throw new SmtpPolicyError("smtp/dane-resolver-no-tlsa",
+        "dane.tlsa: opts.resolver was supplied but has no queryTlsa(name); the " +
+        "records must come from the resolver whose DNSSEC posture was asserted, " +
+        "so falling back to the system resolver is refused");
+    }
+    var rv;
+    try { rv = await opts.resolver.queryTlsa(qname); }
+    catch (e0) {
+      if (e0 && e0.code === "resolver/nxdomain") return [];                      // no TLSA published
+      throw new SmtpPolicyError("smtp/dane-lookup-failed",
+        "TLSA lookup for " + qname + " failed: " + ((e0 && e0.message) || String(e0)));
+    }
+    // b.network.dns decodes TLSA into { usage, selector, matchingType, certData };
+    // node:dns names the same fields certUsage / selector / match / data. Mapped
+    // here so the normalisation below has one shape to read.
+    records = ((rv && rv.rrs) || []).filter(function (r) {
+      return r && r.decoded && typeof r.decoded.usage === "number";
+    }).map(function (r) {
+      return { certUsage: r.decoded.usage, selector: r.decoded.selector,
+               match: r.decoded.matchingType, data: r.decoded.certData };
+    });
+  } else {
+    // node:dns has resolveTlsa() since Node 18.16.0.
+    if (typeof dnsPromises.resolveTlsa !== "function") {
+      throw new SmtpPolicyError("smtp/dane-unavailable",
+        "node:dns.resolveTlsa is not available on this runtime");
+    }
+    try { records = await dnsPromises.resolveTlsa(qname); }
+    catch (e) {
+      if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return [];
+      throw new SmtpPolicyError("smtp/dane-lookup-failed",
+        "TLSA lookup for " + qname + " failed: " + ((e && e.message) || String(e)));
+    }
   }
   // RFC 7672 §1.3 — TLSA records that are NOT DNSSEC-validated MUST
   // NOT be used. node:dns.resolveTlsa does not surface the AD bit

package/lib/network-tls.js

@@ -549,6 +549,23 @@ function _stripUnreachableCertCompression(merged, caller) {
   return merged;
 }
 
+// The key-agreement preference alone, as the string node:tls reads under
+// `ecdhCurve`. `applyToContext` is the whole-context form and also merges the
+// framework trust store, minimum version and certificate compression; a caller
+// that only wants the group policy — a listener building its own server context
+// — takes this instead, so it does not inherit a `ca` list it never asked for.
+//
+// An override is honoured, and a malformed one is REFUSED rather than replaced:
+// quietly substituting the default would start a listener on groups the
+// operator did not choose, with nothing said. Absent takes the framework
+// default (the ML-KEM hybrids with a classical X25519 fallback).
+function keyAgreementGroups(override, where) {
+  if (override !== undefined && override !== null) {
+    return _groupPreferenceString(override, where || "tls.keyAgreementGroups");
+  }
+  return STATE.tlsKeyShares.length > 0 ? STATE.tlsKeyShares.join(":") : null;
+}
+
 function applyToContext(opts) {
   opts = opts || {};
   validateOpts(opts, ["base"], "tls.applyToContext");
@@ -4138,6 +4155,7 @@ module.exports = {
   captureBaselineFingerprints: captureBaselineFingerprints,
   detectBaselineDrift: detectBaselineDrift,
   applyToContext:      applyToContext,
+  keyAgreementGroups:  keyAgreementGroups,
   buildOptions:        buildOptions,
   getCaPems:           getCaPems,
   ocsp:                ocsp,

package/lib/redact.js

@@ -527,8 +527,14 @@ function classifyDefaults(opts) {
         "redact.classifyDefaults: patterns[" + p + "] must be a string, got " +
         typeof patterns[p]);
     }
+    // Own-key on BOTH tables. `extra` is operator-supplied, so reading it
+    // plainly resolved "constructor" / "toString" / "valueOf" to inherited
+    // functions: the name passed as known, and the scanner then met a function
+    // where a pattern spec belongs and threw an untyped error at scan time.
+    // A DLP classifier must fail at boot on a name it cannot honour, never at
+    // the moment it is asked to look.
     if (!Object.prototype.hasOwnProperty.call(CLASSIFIER_PATTERNS, patterns[p]) &&
-        !(opts.extra && opts.extra[patterns[p]])) {
+        !(opts.extra && Object.prototype.hasOwnProperty.call(opts.extra, patterns[p]))) {
       throw new DlpError("redact-dlp/unknown-pattern",
         "redact.classifyDefaults: unknown pattern '" + patterns[p] +
         "'. Known: " + Object.keys(CLASSIFIER_PATTERNS).join(", "));
@@ -544,8 +550,12 @@ function classifyDefaults(opts) {
   var extra = opts.extra || {};
 
   function _resolve(name) {
-    var spec = CLASSIFIER_PATTERNS[name] || extra[name];
-    return spec;
+    // Own-key, matching the validation above: the names reaching here are
+    // already vetted, and reading through the prototype anyway would let a
+    // future caller that skips the vetting resolve a function as a spec.
+    if (Object.prototype.hasOwnProperty.call(CLASSIFIER_PATTERNS, name)) return CLASSIFIER_PATTERNS[name];
+    if (Object.prototype.hasOwnProperty.call(extra, name)) return extra[name];
+    return undefined;
   }
 
   return function classify(input) {

package/lib/retention.js

@@ -55,6 +55,9 @@ var { defineClass } = require("./framework-error");
 var audit = lazyRequire(function () { return require("./audit"); });
 var cryptoField = require("./crypto-field");
 var legalHold = lazyRequire(function () { return require("./legal-hold"); });
+// Lazy — compliance.js requires this module for its posture cascade, so the
+// dependency is mutual and neither may load the other at module scope.
+var compliance = lazyRequire(function () { return require("./compliance"); });
 
 var RetentionError = defineClass("RetentionError", { alwaysPermanent: true });
 var _err = RetentionError.factory;
@@ -648,10 +651,27 @@ function complianceFloor(posture, candidateTtlMs) {
   var floor = Object.prototype.hasOwnProperty.call(COMPLIANCE_RETENTION_FLOOR_MS, posture)
     ? COMPLIANCE_RETENTION_FLOOR_MS[posture] : undefined;
   if (floor === undefined) {
+    // "This regime sets no retention minimum" and "this is not a regime" are
+    // different facts, and the floor table only ever answered the first. Most
+    // postures the framework knows impose no minimum — GDPR Art. 5(1)(e) is
+    // storage LIMITATION, the opposite of a floor — so treating absence from
+    // this table as a typo reported 158 of the 169 postures b.compliance.set
+    // accepts as misspellings, and an operator who set one could not compute a
+    // TTL at all. The posture vocabulary lives in b.compliance; this table
+    // holds only the subset carrying a regulator-mandated minimum.
+    if (compliance().KNOWN_POSTURES.indexOf(posture) !== -1) return _atLeast(0, candidateTtlMs);
     throw new RetentionError("retention/unknown-posture",
-      "complianceFloor: unknown posture '" + posture + "'; expected one of " +
-      Object.keys(COMPLIANCE_RETENTION_FLOOR_MS).join(", "));
+      "complianceFloor: unknown posture '" + posture + "'; it is not in " +
+      "b.compliance.KNOWN_POSTURES. Postures carrying a retention minimum are " +
+      Object.keys(COMPLIANCE_RETENTION_FLOOR_MS).join(", ") + "; the rest resolve to 0");
   }
+  return _atLeast(floor, candidateTtlMs);
+}
+
+// The floor wins unless the operator's candidate is longer. A candidate that
+// is absent or not a positive finite number is no candidate at all, and the
+// floor stands alone.
+function _atLeast(floor, candidateTtlMs) {
   if (typeof candidateTtlMs !== "number" || !isFinite(candidateTtlMs) || candidateTtlMs <= 0) {
     return floor;
   }

package/lib/safe-mount-info.js

@@ -81,6 +81,22 @@ var SafeMountInfoError = defineClass("SafeMountInfoError", { alwaysPermanent: tr
 
 var DEFAULT_PATH = "/proc/self/mountinfo";
 
+// The default path is a Linux path, and reaching for it anywhere else is not
+// merely useless. A leading slash is DRIVE-relative on Windows, so the read
+// lands on C:\proc\self\mountinfo — a location an unprivileged local user can
+// create, because the default ACL on C:\ grants Authenticated Users the right
+// to add subdirectories. Whoever plants that file authors the entries
+// bestMatch() and isBindMount() answer from, which is to say they choose what
+// the framework believes about which filesystem a path is on.
+//
+// So off Linux there is no default: a caller who genuinely has a mountinfo
+// file elsewhere still passes opts.path, and everyone else is refused rather
+// than answered from a file anyone could have written. Platform is a parameter
+// so the Windows branch is reachable from a Linux CI host.
+function _defaultPathFor(platform) {
+  return platform === "linux" ? DEFAULT_PATH : null;
+}
+
 /**
  * @primitive b.safeMountInfo.parse
  * @signature b.safeMountInfo.parse(text, opts?)
@@ -187,12 +203,20 @@ function parse(text, opts) {
  * @related   b.safeMountInfo.parse, b.safeMountInfo.bestMatch
  *
  * Read + parse `/proc/self/mountinfo` in one call. Returns the same
- * array shape as `parse(text)`. On non-Linux platforms (where /proc
- * doesn't exist) returns `opts.fallback` (default `null`); audit
- * emission per `safe-mount-info.refused` with code `read-failed`.
+ * array shape as `parse(text)`.
+ *
+ * The default path is used on Linux only. Elsewhere there is no default and
+ * `opts.fallback` (default `null`) is returned without reading anything, with
+ * an audit emission of `safe-mount-info.refused` carrying code
+ * `no-default-path`. `/proc` is not simply absent off Linux — a leading slash
+ * is drive-relative on Windows, so the default names `C:\proc\self\mountinfo`,
+ * which an unprivileged local user can create; reading it would let whoever
+ * wrote it decide which filesystem a path appears to be on. A caller holding a
+ * mountinfo file elsewhere passes `opts.path`, which is honored on every
+ * platform and reports a read failure as `read-failed`.
  *
  * @opts
- *   path:     string,        // override path (default /proc/self/mountinfo)
+ *   path:     string,        // override path; on Linux defaults to /proc/self/mountinfo, elsewhere there is no default
  *   fallback: any,           // returned on read failure (default null)
  *   audit:    object,        // optional b.audit handle for refusal events
  *   strict:   boolean,       // forwarded to parse()
@@ -211,12 +235,20 @@ function read(opts) {
     "safeMountInfo.read");
   var path = typeof opts.path === "string" && opts.path.length > 0
     ? opts.path
-    : DEFAULT_PATH;
+    : _defaultPathFor(process.platform);
+  if (!path) {
+    _refuseEmit(opts, "safe-mount-info/no-default-path",
+      "/proc/self/mountinfo is a Linux path and this host is " + process.platform +
+      " — pass opts.path to name a mountinfo file explicitly.");
+    return ("fallback" in opts) ? opts.fallback : null;
+  }
   var text;
   try { text = nodeFs.readFileSync(path, "utf8"); }
   catch (e) {
+    // Name the file that was actually read. A caller who passed opts.path and
+    // is told "/proc/self/mountinfo unreadable" is looking at the wrong file.
     _refuseEmit(opts, "safe-mount-info/read-failed",
-      "/proc/self/mountinfo unreadable: " + ((e && e.message) || String(e)));
+      path + " unreadable: " + ((e && e.message) || String(e)));
     return ("fallback" in opts) ? opts.fallback : null;
   }
   return parse(text, opts);
@@ -305,4 +337,5 @@ module.exports = {
   isBindMount:            isBindMount,
   SafeMountInfoError:     SafeMountInfoError,
   DEFAULT_PATH:           DEFAULT_PATH,
+  _defaultPathForForTest: _defaultPathFor,
 };

package/lib/safe-smtp.js

@@ -39,6 +39,7 @@
  */
 
 var { defineClass } = require("./framework-error");
+var guardSmtpCommand = require("./guard-smtp-command");
 
 var SafeSmtpError = defineClass("SafeSmtpError", { alwaysPermanent: true });
 
@@ -110,7 +111,14 @@ function dotUnstuff(buf) {
   }
   var out = Buffer.alloc(buf.length);
   var oi = 0;
-  for (var i = 0; i < buf.length; i += 1) {
+  // Offset 0 IS a line start. RFC 5321 §4.5.2 has the sender stuff a leading
+  // dot on any line of the body and grants the first line no exemption, but
+  // this only ever looked for a dot AFTER a CRLF — so a body beginning
+  // `..signature` was delivered with the extra dot still on it, and dotStuff,
+  // which does stuff offset 0, had a pair that would not undo it.
+  var start = 0;
+  if (buf.length >= 2 && buf[0] === 0x2e && buf[1] === 0x2e) start = 1;
+  for (var i = start; i < buf.length; i += 1) {
     out[oi++] = buf[i];
     // After \r\n, if the next byte is `.` followed by another non-CR
     // byte (i.e., not the terminator itself), strip the stuffing dot.
@@ -179,9 +187,96 @@ function dotStuff(buf) {
   return out.subarray(0, oi);
 }
 
+/**
+ * @primitive b.safeSmtp.createBodyScanner
+ * @signature b.safeSmtp.createBodyScanner()
+ * @since     0.18.55
+ * @status    stable
+ * @related   b.safeSmtp.findDotTerminator, b.guardSmtpCommand.detectBodySmuggling
+ *
+ * Watch a DATA body for its terminator and for the smuggling shape as it
+ * ARRIVES, in work proportional to each chunk rather than to everything
+ * received so far.
+ *
+ * A listener that answers "has the body ended yet?" by re-deriving the whole
+ * accumulated buffer on every chunk does O(n) work per chunk and O(n²) over the
+ * message. The byte cap still holds — the collector refuses a chunk that would
+ * cross it — but processor cost is not what a byte cap bounds, so a message
+ * inside the limit could still cost minutes. Measured before this existed:
+ * 1 MiB accepted in 143 ms and 8 MiB in 4949 ms, a growth of 4.67x for each
+ * doubling where linear would hold at 2.
+ *
+ * Each `push` scans only the new bytes plus a four-byte overlap from the
+ * previous chunk. Four is exact, not generous: the longest shape either screen
+ * matches spans five bytes (`\r\n.\r\n`, and the smuggling scan's widest
+ * lookahead), and a pattern of length L needs L-1 bytes of overlap to be caught
+ * across a boundary.
+ *
+ * @example
+ *   var scan = b.safeSmtp.createBodyScanner();
+ *   var seen = scan.push(chunk);
+ *   if (seen.smuggling)          refuse();
+ *   if (seen.terminatorAt !== -1) finish(collector.result(), seen.terminatorAt);
+ */
+function createBodyScanner() {
+  var OVERLAP = 4;                                    // longest matched shape (5) minus one
+  var consumed = 0;                                   // bytes pushed before the current chunk
+  var tail = Buffer.alloc(0);                         // last OVERLAP bytes of what came before
+  var sawSmuggling = false;
+  var terminatorAt = -1;
+  // The byte immediately before `tail`, which the next window will not contain.
+  // Classifying a leading LF needs it: overlap gives every other offset its
+  // predecessor, but never offset zero, and widening the overlap only changes
+  // which byte is stranded there.
+  var beforeTail = -1;
+
+  return {
+    push: function (chunk) {
+      if (!Buffer.isBuffer(chunk)) {
+        throw new SafeSmtpError("safe-smtp/bad-input",
+          "createBodyScanner.push: chunk must be a Buffer");
+      }
+      // Once a verdict is reached it stands: the terminator does not move and a
+      // smuggling shape does not un-happen. Later chunks are still counted so
+      // the reported offset stays absolute.
+      var window = tail.length === 0 ? chunk : Buffer.concat([tail, chunk]);
+      var windowStart = consumed - tail.length;
+
+      // `windowStart === 0`, NOT `consumed === 0`: with the overlap carried in,
+      // a window can still begin at body offset 0 after bytes have been
+      // consumed. One-byte chunks are the case — the first push is a lone `.`
+      // (too short to match), and the second window is `.\n` starting at 0 with
+      // one byte already consumed. Testing `consumed` there skipped the
+      // dot-at-body-start shape entirely.
+      if (!sawSmuggling &&
+          guardSmtpCommand.detectBodySmuggling(window, windowStart === 0,
+                                               beforeTail === 0x0d)) {
+        sawSmuggling = true;
+      }
+      if (terminatorAt === -1) {
+        var at = findDotTerminator(window);
+        if (at !== -1) terminatorAt = windowStart + at;
+      }
+
+      consumed += chunk.length;
+      // Capture the byte the next window will drop off its front, before the
+      // window itself goes out of scope. When the window is no longer than the
+      // overlap nothing is dropped, and the next window still starts at body
+      // offset 0, where there is no preceding byte to carry.
+      beforeTail = window.length > OVERLAP ? window[window.length - OVERLAP - 1] : -1;
+      tail = window.length <= OVERLAP ? window : window.subarray(window.length - OVERLAP);
+      return { smuggling: sawSmuggling, terminatorAt: terminatorAt };
+    },
+    // What the scanner has been shown, so a caller can check its own accounting
+    // against this one rather than keeping a second counter.
+    bytesSeen: function () { return consumed; },
+  };
+}
+
 module.exports = {
   findDotTerminator: findDotTerminator,
   dotUnstuff:        dotUnstuff,
   dotStuff:          dotStuff,
+  createBodyScanner: createBodyScanner,
   SafeSmtpError:     SafeSmtpError,
 };

package/lib/safe-url.js

@@ -312,7 +312,11 @@ function _normalizePctPath(path) {
  */
 function parse(url, opts) {
   opts = opts || {};
-  var allowed = Array.isArray(opts.allowedProtocols) && opts.allowedProtocols.length > 0
+  // The documented default applies when the option is OMITTED. An explicitly
+  // empty list is a caller saying no protocol is acceptable, and widening that
+  // back to https: answers "none" with "one" — an allowlist that disappears
+  // when empty is a firewall rule set that opens when the last rule is deleted.
+  var allowed = Array.isArray(opts.allowedProtocols)
     ? opts.allowedProtocols
     : ALLOW_HTTP_TLS;
   var errClass = opts.errorClass;
@@ -531,7 +535,9 @@ function format(url) {
  */
 function canonicalize(input, opts) {
   opts = opts || {};
-  var allowedSchemes = Array.isArray(opts.allowedSchemes) && opts.allowedSchemes.length > 0
+  // Same reading as parse above: the default is for the OMITTED case. An empty
+  // list asked for nothing and used to receive all four schemes.
+  var allowedSchemes = Array.isArray(opts.allowedSchemes)
     ? opts.allowedSchemes
     : ALLOW_ANY;
 

package/lib/self-update.js

@@ -231,7 +231,10 @@ function _validatePollOpts(opts) {
         throw new SelfUpdateError("selfupdate/bad-releases-url",
           "selfUpdate.poll: opts.releasesUrl is not parseable as a URL");
       }
-      var allowedProtocols = Array.isArray(opts.allowedProtocols) && opts.allowedProtocols.length > 0
+      // The documented default is for the OMITTED case. An explicitly empty
+      // list says no protocol may be dialled, and widening it back to https:
+      // answers "none" with "one".
+      var allowedProtocols = Array.isArray(opts.allowedProtocols)
         ? opts.allowedProtocols.slice() : ["https:"];
       if (allowedProtocols.indexOf(parsedProto) === -1) {
         throw new SelfUpdateError("selfupdate/bad-releases-url",