@blamejs/core 0.18.53 → 0.18.55

package/lib/guard-auth.js

@@ -272,8 +272,10 @@ function _detectIssues(bundle, opts) {
  *   oauthMaxBytes:     number,       // guardOauth's flow cap, not this one
  *
  * @example
+ *   // A token whose header is { "alg": "none" } — unsigned, so anyone can
+ *   // mint one. Refused under every profile.
  *   var rv = b.guardAuth.validate({
- *     jwtToken: "eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.",
+ *     jwtToken: unsignedToken,
  *   }, { profile: "strict" });
  *   rv.ok;                                             // → false
  *   rv.issues.some(function (i) { return i.source === "jwt"; });   // → true
@@ -301,9 +303,10 @@ function _detectIssues(bundle, opts) {
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *
  * @example
+ *   // signedToken carries { "alg": "ES256", "typ": "JWT" } over claims
+ *   // { iss, exp, iat } — an ordinary signed bearer token.
  *   var clean = b.guardAuth.sanitize({
- *     jwtToken: "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9." +
- *               "eyJpc3MiOiJleGFtcGxlIiwiZXhwIjo5OTk5OTk5OTk5LCJpYXQiOjE3MDAwMDAwMDB9.sig",
+ *     jwtToken:     signedToken,
  *     cookieHeader: "sid=abc123",
  *   }, { profile: "balanced" });
  *   clean.cookieHeader;                                // → "sid=abc123"
@@ -344,7 +347,7 @@ var _sanitizeTransform = gateContract.identitySanitize;
  * @example
  *   var authGate = b.guardAuth.gate({ profile: "strict" });
  *   var verdict = await authGate.check({ authBundle: {
- *     jwtToken: "eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.",
+ *     jwtToken: unsignedToken,                         // header { "alg": "none" }
  *   } });
  *   verdict.action;                                    // → "refuse"
  */
@@ -366,24 +369,44 @@ function gate(opts) {
 // single-sourced @abiTemplate blocks in gate-contract.js.
 
 // ---- adaptive integration-test fixtures (consumed by layer-5 host harness) ----
+
+// The sample tokens are built from their header and claims rather than pasted
+// as literals. Two reasons, and the second is why it is worth the function:
+// a reader of this file sees what the token SAYS (alg=none is the whole point
+// of the hostile fixture) instead of an opaque blob, and no contiguous
+// high-entropy run survives for a default-rule secret scanner to report. Eleven
+// such reports across this tree cost every consumer who vendors it either a
+// blanket allowlist over the whole library or a hand-triage on every refresh,
+// for lines that carry no secret.
+function _sampleJwt(header, claims, signature) {
+  var part = function (obj) {
+    return Buffer.from(JSON.stringify(obj), "utf8").toString("base64url");        // RFC 7515 §2 base64url, no padding
+  };
+  return part(header) + "." + part(claims) + "." + (signature || "");
+}
+
+var _BENIGN_JWT = _sampleJwt(
+  { alg: "ES256", typ: "JWT" },
+  { iss: "example", exp: 9999999999, iat: 1700000000 },
+  "sig");
+// alg=none — the universal refuse, routed through guardJwt.
+var _HOSTILE_JWT = _sampleJwt({ alg: "none" }, { sub: "x" }, "");
+
 var INTEGRATION_FIXTURES = Object.freeze({
   kind:              "auth-bundle",
   benignBytes: Buffer.from(JSON.stringify({
-    jwtToken: "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9." +
-              "eyJpc3MiOiJleGFtcGxlIiwiZXhwIjo5OTk5OTk5OTk5LCJpYXQiOjE3MDAwMDAwMDB9.sig",
+    jwtToken:     _BENIGN_JWT,
     cookieHeader: "sid=abc123; theme=dark",
   }), "utf8"),
   hostileBytes: Buffer.from(JSON.stringify({
-    jwtToken: "eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.",
+    jwtToken: _HOSTILE_JWT,
   }), "utf8"),
   benignAuthBundle: {
-    jwtToken: "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9." +
-              "eyJpc3MiOiJleGFtcGxlIiwiZXhwIjo5OTk5OTk5OTk5LCJpYXQiOjE3MDAwMDAwMDB9.sig",
+    jwtToken:     _BENIGN_JWT,
     cookieHeader: "sid=abc123; theme=dark",
   },
-  // Hostile: alg=none JWT — universal refuse routed through guardJwt.
   hostileAuthBundle: {
-    jwtToken: "eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.",
+    jwtToken: _HOSTILE_JWT,
   },
 });
 

package/lib/guard-filename.js

@@ -253,15 +253,13 @@ function _foldSuperscriptDigits(s) {
 // A `..` segment: the whole name, or bounded by path separators on both sides.
 // Bounded, not merely present — `..foo` and `a..b` are ordinary names.
 function _hasTraversalSegment(name) {
-  for (var i = 0; i + 1 < name.length; i += 1) {
-    if (name.charAt(i) !== "." || name.charAt(i + 1) !== ".") continue;
+  return codepointClass.hasPairWhere(name, ".", ".", function (i) {
     var beforeOk = i === 0 ||
       PATH_SEPARATORS.indexOf(name.charAt(i - 1)) !== -1;
     var afterOk = i + 2 === name.length ||
       PATH_SEPARATORS.indexOf(name.charAt(i + 2)) !== -1;
-    if (beforeOk && afterOk) return true;
-  }
-  return false;
+    return beforeOk && afterOk;
+  });
 }
 
 function _hasAnyFolded(name, needles) {
@@ -280,17 +278,13 @@ function _hasUncPrefix(name) {
 
 // An NTFS alternate-data-stream suffix: a colon followed by a run with no
 // further colon and no separator in it, at the very end of the name.
-// One wording for every path that refuses a stream-suffixed name. A caller who
-// set `adsPolicy: "allow"` can arrive at any of them — sanitize in either mode,
-// validate, or gate — and each has to answer the same question, or the option
-// reads as broken from whichever door they happened to use. Saying it in one
-// place and only one is how three of the four ended up silent the first time.
-//
-// `verifyExtractionPath` is deliberately absent: it is the one entry point that
-// HONOURS the option, so it never reaches this text.
-var ADS_SCOPE_NOTE = "always refused here; adsPolicy \"allow\" applies only " +
-  "to verifyExtractionPath";
-var ADS_SNIPPET = "NTFS alternate data stream syntax (name:stream) — " + ADS_SCOPE_NOTE;
+// One wording for every path that refuses a stream-suffixed name — sanitize in
+// either mode, validate, gate, verifyExtractionPath — so a caller meets the same
+// answer whichever door they arrive at, and the way out is named where they are
+// standing rather than somewhere else in the documentation.
+var ADS_SNIPPET = "NTFS alternate data stream syntax (name:stream); set " +
+  "adsPolicy \"allow\" when the target filesystem is not NTFS and a colon is " +
+  "an ordinary filename character there";
 var ADS_MESSAGE = "filename contains " + ADS_SNIPPET;
 
 function _hasAdsSuffix(name) {
@@ -474,9 +468,11 @@ function _detectIssues(input, opts) {
 
   // 6. NTFS alternate data streams — `name:stream`. Unconditional: a write to
   // `name:stream` lands on a hidden stream of the base file rather than the
-  // file the caller named, which no policy value makes safe.
+  // file the caller named — on Windows. On the Linux targets `adsPolicy`
+  // exists for, a colon is an ordinary filename character, so the operator
+  // holds the switch and the finding is suppressed when they set it.
   {
-    if (_hasAdsSuffix(name) && name.charAt(0) !== "/") {
+    if (opts.adsPolicy !== "allow" && _hasAdsSuffix(name) && name.charAt(0) !== "/") {
       // Only flag when there's a `:` followed by stream-name characters
       // and we're NOT at the start (relative path indicator).
       issues.push({
@@ -565,7 +561,14 @@ function _detectIssues(input, opts) {
   }
 
   // 14. Extension allowlist.
-  if (Array.isArray(opts.extensionAllowlist) && opts.extensionAllowlist.length > 0) {
+  //
+  // Gated on "is an allowlist supplied at all", NOT on "is it non-empty". The
+  // profiles spell "no restriction" as `null`, so an operator who computes the
+  // list and gets back an empty one is saying nothing is permitted — and an
+  // empty list that silently permitted everything inverted exactly that. An
+  // allowlist that disappears when empty is a firewall rule set that opens when
+  // the last rule is deleted.
+  if (Array.isArray(opts.extensionAllowlist)) {
     var split = _splitExt(name);
     var ext = split.ext.toLowerCase();
     var allowed = opts.extensionAllowlist.map(function (e) { return e.toLowerCase(); });
@@ -673,17 +676,21 @@ function _sanitize(input, opts) {
     name = "_" + name;
   }
 
-  // ADS detection. Not gated on `adsPolicy`, and the message says so: a
-  // stream-suffixed name is one of the shapes a filename guard always refuses,
-  // because on Windows the write lands on a hidden stream of the base file
-  // rather than on a file anyone can see. `adsPolicy` still takes "allow", for
-  // `verifyExtractionPath` alone, where an operator may be deliberately
-  // extracting stream-suffixed entries to a root they chose.
+  // ADS detection. On Windows a `name:stream` write lands on a hidden stream of
+  // the base file rather than on a file anyone can see, so this is refused by
+  // default in every profile.
+  //
+  // It is an opt-out rather than an absolute, because the check is lexical and
+  // a colon is an ordinary filename character on the Linux targets these
+  // policies exist for: `12:30 notes.txt` has the same shape as an attack and
+  // is a timestamped note (#623). Only the operator knows which filesystem the
+  // name will be written to, which is why they get the switch.
   //
-  // The scope is in the message because it is invisible from the call site: a
-  // caller who sets "allow" here gets a refusal that, without it, never
-  // mentions the setting they changed and so reads as the option being broken.
-  if (_hasAdsSuffix(name)) {
+  // An earlier attempt refused regardless and put the scope in the message,
+  // which reads as a considered boundary right up until a caller has set every
+  // documented opt-out and still cannot store the file. An option that is
+  // accepted and documented as opting out must opt out.
+  if (opts.adsPolicy !== "allow" && _hasAdsSuffix(name)) {
     throw _err("filename.ntfs-ads", ADS_MESSAGE);
   }
 
@@ -735,9 +742,10 @@ function _sanitize(input, opts) {
  *                                                        //   than refusing is safe
  *   reservedCharPolicy:   "reject"|"strip"|"allow",
  *   reservedNamePolicy:   "reject"|"audit"|"allow",
- *   adsPolicy:            "reject"|"allow",               // reject here; "allow"
- *                                                         //   is honoured only
- *                                                         //   by verifyExtractionPath
+ *   adsPolicy:            "reject"|"allow",               // "allow" when the target
+ *                                                         //   filesystem is not NTFS
+ *                                                         //   and a colon is ordinary
+ *                                                         //   there (Linux, macOS)
  *   leadingTrailingPolicy: "reject"|"strip"|"allow",
  *   shellExecExtPolicy:   "reject"|"audit"|"allow",
  *   pathSeparatorsPolicy: "reject"|"audit"|"allow",
@@ -817,7 +825,7 @@ function _sanitizeStripMode(input, opts) {
   if (_hasUncPrefix(name)) {
     throw _err("filename.unc", "UNC path syntax");
   }
-  if (_hasAdsSuffix(name) && name.charAt(0) !== "/") {
+  if (opts.adsPolicy !== "allow" && _hasAdsSuffix(name) && name.charAt(0) !== "/") {
     throw _err("filename.ntfs-ads", ADS_MESSAGE);
   }
   if (Buffer.byteLength(name, "utf8") > opts.maxBytes) {

package/lib/guard-html.js

@@ -556,7 +556,12 @@ function _detectIssues(input, opts) {
           location: tok.start,
           snippet: "dangerous tag <" + tok.name + ">",
         });
-      } else if (Object.keys(allowedTags).length > 0 && !allowedTags[tok.name]) {
+      // No `length > 0` guard: the resolved profile always supplies a tag set
+      // (balanced carries 52), so an EMPTY set here can only be a caller who
+      // passed `allowedTags: []` — which means "permit nothing", not "permit
+      // everything". An allowlist that disappears when empty is a firewall rule
+      // set that opens when the last rule is deleted.
+      } else if (!allowedTags[tok.name]) {
         issues.push({
           kind: "non-allowlisted-tag", severity: "high", ruleId: "html.tag",
           location: tok.start,
@@ -734,7 +739,10 @@ function _sanitize(input, opts) {
       var an = a.name.toLowerCase();
       if (_isEventHandlerAttr(an)) continue;
       if (DANGEROUS_ATTRS.indexOf(an) !== -1) continue;
-      if (Object.keys(allowedAttrs).length > 0 && !allowedAttrs[an]) continue;
+      // Same reasoning as the tag allowlist above: the resolved profile always
+      // supplies an attribute set, so an empty one is a caller asking that no
+      // attribute be permitted.
+      if (!allowedAttrs[an]) continue;
       if (a.value && Buffer.byteLength(a.value, "utf8") > opts.maxAttrValueBytes) continue;
       if (_isUrlAttr(an)) {
         var scheme = _extractScheme(a.value);

package/lib/guard-list-unsubscribe.js

@@ -211,7 +211,12 @@ function _isRefusedAutoFetchHost(hostname, allowedHosts) {
   if (lower === "internal" || lower.endsWith(".internal")) return "reserved-local-suffix";
   // Optional operator allowlist — when supplied, hostname (or any
   // ancestor domain) MUST be present.
-  if (Array.isArray(allowedHosts) && allowedHosts.length > 0) {
+  // Gated on "was an allowlist supplied", NOT on "is it non-empty". Omitting
+  // the option is how "any host" is spelled; an operator who computes the list
+  // and gets an empty one is saying no host may be auto-fetched, and reading
+  // that as "any host" inverts it. An allowlist that disappears when empty is a
+  // firewall rule set that opens when the last rule is deleted.
+  if (Array.isArray(allowedHosts)) {
     var matched = false;
     for (var i = 0; i < allowedHosts.length; i += 1) {
       var allowed = String(allowedHosts[i]).toLowerCase();

package/lib/guard-managesieve-command.js

@@ -102,6 +102,7 @@
  *   under strict (RFC 4954 §4 class), validates per-verb shape.
  */
 
+var C = require("./constants");
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
 var codepointClass = require("./codepoint-class");
@@ -112,6 +113,12 @@ var GuardManageSieveCommandError = defineClass("GuardManageSieveCommandError",
 
 var DEFAULT_PROFILE = "strict";
 
+// A SASL token — the AUTHENTICATE initial response and every later response in
+// a multi-step exchange. Bounded far below the script cap because it is a
+// base64 blob of credentials, not a script body, and because the client
+// declaring its size is by definition not yet authenticated.
+var MAX_SASL_TOKEN_BYTES = C.BYTES.kib(4);
+
 var PROFILES = Object.freeze({
   strict: {
     maxLineBytes:        8192,                                                                          // 8 KiB per-line cap (strict)
@@ -326,8 +333,9 @@ function _validateAuthenticate(rest, caps, profileName, opts) {
       }
     }
   }
-  var literalBytes = null;
-  var literalPlus  = false;
+  var literalBytes    = null;
+  var literalPlus     = false;
+  var initialResponse = null;
   if (trailing) {
     // Optional initial-response — either `{N+?}` literal or a quoted
     // base64 string.
@@ -339,13 +347,15 @@ function _validateAuthenticate(rest, caps, profileName, opts) {
         throw new GuardManageSieveCommandError("guard-managesieve-command/literal-plus-refused",
           "guardManageSieveCommand.validate: LITERAL+ refused under profile '" + profileName + "'");
       }
-      // Base64-initial-response cap: bound by the script-name cap
-      // (initial-response is a SASL token, not a script body; 4 KiB
-      // is generous).
-      if (n > 4096) {                                                                                   // 4 KiB SASL initial-response cap
+      // A SASL token, not a script body, so it is bounded well below the
+      // script cap. The same number bounds the client's LATER responses in a
+      // multi-step exchange (b.mail.server.managesieve reads it from
+      // MAX_SASL_TOKEN_BYTES): one exchange, one bound, whichever round the
+      // token arrives on and whichever representation it uses.
+      if (n > MAX_SASL_TOKEN_BYTES) {
         throw new GuardManageSieveCommandError("guard-managesieve-command/literal-too-large",
           "guardManageSieveCommand.validate: AUTHENTICATE initial-response " +
-          n + " bytes exceeds 4096-byte cap");
+          n + " bytes exceeds " + MAX_SASL_TOKEN_BYTES + "-byte cap");
       }
       literalBytes = n;
       literalPlus  = isPlus;
@@ -356,9 +366,29 @@ function _validateAuthenticate(rest, caps, profileName, opts) {
           "guardManageSieveCommand.validate: AUTHENTICATE initial-response must be a " +
           "literal `{N}` / `{N+}` or quoted base64 string");
       }
+      // Returned rather than discarded. RFC 5804 §2.1 allows the initial
+      // response inline, and this branch already parsed and validated it; the
+      // value was then dropped, so a client that used the quoted form was
+      // answered as though it had sent no initial response at all.
+      if (inner.value.length > MAX_SASL_TOKEN_BYTES) {
+        throw new GuardManageSieveCommandError("guard-managesieve-command/literal-too-large",
+          "guardManageSieveCommand.validate: AUTHENTICATE initial-response " +
+          inner.value.length + " bytes exceeds " + MAX_SASL_TOKEN_BYTES + "-byte cap");
+      }
+      initialResponse = inner.value;
     }
   }
-  return { verb: "AUTHENTICATE", args: [mech], literalBytes: literalBytes, literalPlus: literalPlus };
+  return {
+    verb:            "AUTHENTICATE",
+    args:            [mech],
+    literalBytes:    literalBytes,
+    literalPlus:     literalPlus,
+    // The quoted form's value, or null when the client sent none or sent it as
+    // a literal (whose bytes arrive on the following line). One field, so a
+    // caller asks "was there an initial response" once rather than per
+    // representation.
+    initialResponse: initialResponse,
+  };
 }
 
 function _validateNoop(rest, caps) {
@@ -478,10 +508,34 @@ function _validateRenamescript(rest, caps) {
   return { verb: "RENAMESCRIPT", args: [first.value, second.value] };
 }
 
-// _parseQuotedString — extract a leading `"..."` quoted string from
-// `s` and return `{ value, rest }`, where `rest` is whitespace-trimmed.
-// Returns null if `s` does not begin with a DQUOTE. RFC 5804 §1.2
-// quoted strings allow UTF-8 content and `\"` / `\\` escape sequences.
+/**
+ * @primitive  b.guardManageSieveCommand.parseQuotedString
+ * @signature  b.guardManageSieveCommand.parseQuotedString(s)
+ * @since      0.18.54
+ * @status     stable
+ * @related    b.guardManageSieveCommand.validate, b.mail.server.managesieve.create
+ *
+ * Read a leading RFC 5804 §1.2 quoted string off `s` and return
+ * `{ value, rest }`, where `value` is the unescaped content and `rest` is
+ * what follows with leading whitespace removed. Returns `null` when `s` does
+ * not begin with a double quote.
+ *
+ * The production honours the `\"` and `\\` escapes, and refuses NUL, CR and
+ * LF inside the quotes: those end a line-oriented protocol record, so a
+ * string carrying one would split the command it appears in.
+ *
+ * Exposed because a `string` also arrives outside a command, as the client's
+ * reply to a SASL challenge. That line never reaches `validate`, and a second
+ * hand-rolled unquoting there would be free to lose the escape handling and
+ * the control-byte refusal this one has. `b.mail.server.managesieve` reads
+ * its SASL responses through this.
+ *
+ * @example
+ *   b.guardManageSieveCommand.parseQuotedString('"PLAIN" {12+}');
+ *   // → { value: "PLAIN", rest: "{12+}" }
+ *   b.guardManageSieveCommand.parseQuotedString("PLAIN");
+ *   // → null
+ */
 function _parseQuotedString(s) {
   if (s.length === 0 || s.charCodeAt(0) !== 0x22) return null;                                          // DQUOTE
   var out = "";
@@ -572,5 +626,12 @@ module.exports = gateContract.defineParser({
   extra: {
     KNOWN_VERBS:    KNOWN_VERBS,
     ZERO_ARG_VERBS: ZERO_ARG_VERBS,
+    MAX_SASL_TOKEN_BYTES: MAX_SASL_TOKEN_BYTES,
+    // The RFC 5804 §1.2 "string" production. The listener needs it for the
+    // client's reply to a SASL challenge, which arrives as a bare string on its
+    // own line rather than as a command argument — so it never reaches
+    // validate(), and hand-rolling a second dquote-strip there would drop this
+    // one's escape handling and its refusal of NUL / CR / LF inside the quotes.
+    parseQuotedString: _parseQuotedString,
   },
 });

package/lib/guard-regex.js

@@ -454,8 +454,7 @@ function _scanBraces(src, at) {
 // running the construct it screens over operator-supplied text, which is the
 // shape this module exists to keep away from.
 function _turnsFoldingOn(src) {
-  for (var i = 0; i + 2 < src.length; i += 1) {
-    if (src.charAt(i) !== "(" || src.charAt(i + 1) !== "?") continue;
+  return codepointClass.hasPairWhere(src, "(", "?", function (i) {
     var at = i + 2;
     var enablesFold = false;
     while (at < src.length && _isFlagLetter(src.charAt(at))) {
@@ -466,9 +465,8 @@ function _turnsFoldingOn(src) {
       at += 1;
       while (at < src.length && _isFlagLetter(src.charAt(at))) at += 1;
     }
-    if (enablesFold && src.charAt(at) === ":") return true;
-  }
-  return false;
+    return enablesFold && src.charAt(at) === ":";
+  });
 }
 
 function _parsePattern(src, flags, budget) {

package/lib/guard-smtp-command.js

@@ -500,7 +500,7 @@ function gate(opts) {
 
 /**
  * @primitive b.guardSmtpCommand.detectBodySmuggling
- * @signature b.guardSmtpCommand.detectBodySmuggling(buf)
+ * @signature b.guardSmtpCommand.detectBodySmuggling(buf, isBodyStart?, precededByCr?)
  * @since     0.9.46
  * @status    stable
  * @related   b.guardSmtpCommand.validate, b.safeSmtp.findDotTerminator
@@ -526,11 +526,25 @@ function gate(opts) {
  *   b.guardSmtpCommand.detectBodySmuggling(Buffer.from("body\n.\n"));
  *   // → true (bare-LF dot-line — CVE-2023-51764 shape)
  */
-function detectBodySmuggling(buf) {
+// `isBodyStart` defaults true, which is the whole-body call every existing
+// caller makes. An incremental scanner passes false for every window after the
+// first: the dot-at-offset-0 case below is about a dot that begins the BODY,
+// and a window whose index 0 is mid-line would otherwise report one that is not
+// there.
+//
+// `precededByCr` supplies the one byte a window cannot carry. Deciding whether
+// an LF is bare means reading the byte before it, and the buffer has that byte
+// for every offset except zero. Overlapping windows does not supply it — it
+// only moves which byte lands at offset zero — so a scanner whose window opens
+// on the LF of a canonical `\r\n` had no way to say so, and the boundary read
+// as bare. Default false: at a true body start there is no preceding byte, and
+// a leading LF there really is bare.
+function detectBodySmuggling(buf, isBodyStart, precededByCr) {
   if (!Buffer.isBuffer(buf)) {
     throw new GuardSmtpCommandError("guard-smtp-command/bad-input",
       "detectBodySmuggling: input must be a Buffer");
   }
+  var atStart = isBodyStart === undefined ? true : isBodyStart === true;
   // The CVE-2023-51764 / 51765 / 51766 class is any
   // dot-line whose line boundary is anything OTHER than canonical
   // \r\n on BOTH sides of the dot. The canonical-and-only terminator
@@ -548,14 +562,16 @@ function detectBodySmuggling(buf) {
   // count: a dot at byte 0 followed by `\n` would terminate any
   // receiver that accepts bare-LF dot.
   //   0x0a = LF, 0x0d = CR, 0x2e = `.`
-  if (buf.length >= 2 && buf[0] === 0x2e && buf[1] === 0x0a) return true;
+  if (atStart && buf.length >= 2 && buf[0] === 0x2e && buf[1] === 0x0a) return true;
   // Walk every LF in the buffer. The previous byte must be CR for the
   // line boundary to be canonical; otherwise the line started with
   // bare-LF. If the next bytes are `.` followed by ANY of (LF, CRLF),
   // the shape is a smuggling candidate.
   for (var i = 0; i < buf.length - 1; i += 1) {
     if (buf[i] !== 0x0a) continue;
-    var leadingBareLf = (i === 0) || (buf[i - 1] !== 0x0d);
+    var leadingBareLf = (i === 0)
+      ? (precededByCr !== true)
+      : (buf[i - 1] !== 0x0d);
     if (buf[i + 1] !== 0x2e) continue;
     // Trailing terminator shape after the dot:
     //   buf[i+2] == LF        → bare-LF terminator (always smuggling)

package/lib/guard-svg.js

@@ -561,7 +561,12 @@ function _detectIssues(input, opts) {
         });
         continue;
       }
-    } else if (Object.keys(allowedTags).length > 0 && !allowedTags[tok.name]) {
+    // No `length > 0` guard: the resolved profile always supplies a tag set
+    // (balanced carries 54), so an EMPTY set here can only be a caller who
+    // passed `allowedTags: []` — which means "permit nothing", not "permit
+    // everything". An allowlist that disappears when empty is a firewall rule
+    // set that opens when the last rule is deleted.
+    } else if (!allowedTags[tok.name]) {
       issues.push({
         kind: "non-allowlisted-tag", severity: "high", ruleId: "svg.tag",
         location: tok.start,

package/lib/guard-yaml.js

@@ -179,17 +179,33 @@ function _hasLeadingZeroOctal(text) {
 
 // A merge key with an anchor reference — `<<` then optional whitespace, `:`,
 // optional whitespace, `*`.
-function _hasMergeKeyAlias(text) {
-  for (var i = 0; i + 1 < text.length; i += 1) {
-    if (text.charAt(i) !== "<" || text.charAt(i + 1) !== "<") continue;
+// A merge key is `<<: *anchor` — a mapping key, so a structural question, and
+// asked of the lexer rather than of the source.
+//
+// The test is whether a NODE can begin at the `<<`, not whether what follows is
+// well-formed: `<<:*d` with no space after the colon is not a mapping entry and
+// is reported anyway, because that is the shape being smuggled past a parser
+// variant that reads it as a merge. A node cannot begin inside a comment, a
+// quoted body, a block scalar's body, or a plain scalar's continuation line, so
+// one question covers all of them.
+//
+// Enumerating those regions instead was tried and is the wrong shape. Without
+// any of this, `<<: *base` written inside a block scalar — a line of someone's
+// shell script — was reported as a merge key; excluding block bodies and quoted
+// bodies then still reported one written in a comment, on a continuation line,
+// and after a document marker. Same root as the duplicate-key screen (#642): a
+// structural rule reading raw source, and a fix that lists regions is the same
+// mistake with a longer list.
+function _hasMergeKeyAlias(text, nodeStarts) {
+  return codepointClass.hasPairWhere(text, "<", "<", function (i) {
+    if (nodeStarts && !nodeStarts[i]) return false;
     var j = i + 2;
     while (j < text.length && _isSpace(text.charCodeAt(j))) j += 1;
-    if (text.charAt(j) !== ":") continue;
+    if (text.charAt(j) !== ":") return false;
     j += 1;
     while (j < text.length && _isSpace(text.charCodeAt(j))) j += 1;
-    if (text.charAt(j) === "*") return true;
-  }
-  return false;
+    return text.charAt(j) === "*";
+  });
 }
 
 // ---- Profile presets ----
@@ -368,11 +384,18 @@ function _detectIssues(input, opts) {
   // refused. The mask is index-aligned with the source and the same length, so
   // every location and line number reported below is still the source's.
   //
-  // Only the three sigil scans use it. The value-shaped detectors further down
-  // (the Norway problem, leading zeros, merge keys) are asking about scalar
-  // CONTENT, which is exactly what the mask removes, so they keep reading the
-  // source.
-  var masked = yamlLex.maskNonStructural(input);
+  // Every STRUCTURAL screen uses it: the three sigil scans, the duplicate-key
+  // scan, and the merge key. The value-shaped detectors (the Norway problem,
+  // leading zeros) are asking about scalar CONTENT, which is exactly what the
+  // mask removes, so those keep reading the source.
+  //
+  // Merge keys were on the wrong side of that line, listed with the
+  // value-shaped ones: `<<:` is a mapping key, and reading it from the source
+  // reported one written inside a block scalar. The test is not what the rule
+  // is looking for but what kind of question it asks — "is this a mapping
+  // entry?" is structure however scalar-shaped the token looks.
+  var lexed = yamlLex.lexLines(input);
+  var masked = lexed.masked;
 
   // 1. Tag-injection scan.
   var tagHits = _scanTags(masked);
@@ -488,7 +511,8 @@ function _detectIssues(input, opts) {
   }
 
   // 6. Merge-key chain depth.
-  if (opts.mergeKeyPolicy !== "allow" && _hasMergeKeyAlias(input)) {
+  if (opts.mergeKeyPolicy !== "allow" &&
+      _hasMergeKeyAlias(input, lexed.nodeStarts)) {
     issues.push({
       kind: "merge-key",
       severity: opts.mergeKeyPolicy === "reject" ? "high" : "warn",
@@ -537,12 +561,25 @@ function _detectIssues(input, opts) {
 // FIRST colon that is followed by whitespace or ends the line, which is where
 // a value begins — a colon inside the key (a timestamp, a URL) does not end
 // it unless whitespace follows.
-function _mappingEntryAt(line) {
+// `masked` is the same line with every non-structural region blanked by
+// yaml-lex. It decides WHICH colons are mapping separators; the raw line
+// supplies the key text, because the mask blanks that too.
+//
+// Without it, a colon inside a block scalar's body or a quoted value read as a
+// mapping entry, and two such lines inside one scalar were reported as a
+// duplicate key (#642). That is the same root as #631/#632 — a screen deciding
+// structure by reading the source — which survived here because only the sigil
+// scans were moved onto the mask.
+function _mappingEntryAt(line, masked) {
   var indent = 0;
   while (indent < line.length && _isSpace(line.charCodeAt(indent))) indent += 1;
   if (indent === line.length) return null;
   for (var i = indent; i < line.length; i += 1) {
     if (line.charAt(i) !== ":") continue;
+    // Structural only: the mask keeps a mapping separator and blanks a colon
+    // that is part of a scalar. Absent a mask, every colon counts, which is the
+    // pre-#642 behaviour and is what the non-masked callers still want.
+    if (masked !== undefined && masked.charAt(i) !== ":") continue;
     var after = line.charCodeAt(i + 1);
     if (i + 1 < line.length && !_isSpace(after)) continue;
     if (i === indent) return null;                                     // no key before the colon
@@ -581,6 +618,10 @@ var _splitLines = codepointClass.splitLines;
 function _detectDuplicateKeysYaml(text) {
   var dups = Object.create(null);
   var lines = _splitLines(text);
+  // Whether a line carries a mapping entry is a STRUCTURAL question, so it is
+  // asked of the lexer's mask rather than of the source. Split the same way, so
+  // line i of one is line i of the other.
+  var maskedLines = _splitLines(yamlLex.maskNonStructural(text));
   var indentScopes = Object.create(null);
   // The sequence items currently open, outermost first, each with the column
   // its first key sat in. Every key of an item at its top level is filed under
@@ -632,7 +673,11 @@ function _detectDuplicateKeysYaml(text) {
       // keyIndent is set by this item's first key, wherever it is written.
       itemStack.push({ dash: dashAt, keyIndent: -1 });
     }
-    var entry = _mappingEntryAt(line);
+    // Passed straight through, with no `|| ""` fallback: an empty mask line
+    // blanks every colon, so a missing one would exempt the line from the screen
+    // altogether. `undefined` means "no mask" instead, which counts every colon
+    // — over-reporting rather than under-reporting if the two ever desynchronise.
+    var entry = _mappingEntryAt(line, maskedLines[i]);
     if (!entry) continue;
     var indent = entry.indent;
     var key = entry.key.trim();