@blamejs/core 0.5.4 → 0.5.5

package/CHANGELOG.md

@@ -8,6 +8,7 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- **0.5.4** (2026-04-30) — close SSRF DNS-rebinding window with pinned outbound DNS
 - **0.5.3** (2026-04-30) — security cleanup: trustProxy primitive + Vary merge + HSTS gate
 - **0.5.2** (2026-04-30) — b.breakGlass: passkey factor + service-account bypass + admin tools
 - **0.5.1** (2026-04-30) — b.breakGlass: per-cell encryption + context binding + migrate

package/lib/middleware/security-headers.js

@@ -46,10 +46,16 @@ var DEFAULT_PERMISSIONS = [
   "screen-wake-lock=()", "sync-xhr=()", "usb=()", "web-share=()", "xr-spatial-tracking=()",
 ];
 
+// Strict CSP — no 'unsafe-inline' on script-src OR style-src. Operators
+// with inline styles / scripts wire `b.middleware.cspNonce()` and use
+// `{{ cspNonce }}` in their views (or req.cspNonce in handlers); the
+// nonce hooks into the policy via the `csp` opt or a custom value.
+// Operators in transitional environments who genuinely need inline
+// styles set `csp` explicitly to the loose form.
 var DEFAULT_CSP =
   "default-src 'self'; " +
   "script-src 'self'; " +
-  "style-src 'self' 'unsafe-inline'; " +
+  "style-src 'self'; " +
   "img-src 'self' data:; " +
   "font-src 'self'; " +
   "connect-src 'self'; " +

package/lib/ssrf-guard.js

@@ -94,6 +94,23 @@ var IPV6_PRIVATE_PREFIX   = _ipv6ToBytes("fc00::");
 var IPV6_LINK_LOCAL_PREFIX = _ipv6ToBytes("fe80::");
 var IPV6_DOC_PREFIX       = _ipv6ToBytes("2001:db8::");      // documentation
 var IPV6_V4_MAPPED_PREFIX = _ipv6ToBytes("::ffff:0:0");      // IPv4-mapped (::ffff:0:0/96)
+// Multicast ff00::/8 — RFC 4291 §2.7. Refused for outbound HTTP same as
+// IPv4 multicast 224/4 — there's no legitimate fetch from a multicast
+// destination on a production gateway.
+var IPV6_MULTICAST_PREFIX = _ipv6ToBytes("ff00::");
+// NAT64 well-known prefix 64:ff9b::/96 — RFC 6052. Translates to IPv4
+// embedded in the lower 32 bits; the framework refuses since the
+// underlying v4 address is what gets contacted and might be private.
+// (Operators with NAT64 deployments flip allowInternal.)
+var IPV6_NAT64_PREFIX     = _ipv6ToBytes("64:ff9b::");
+// 6to4 2002::/16 — RFC 3056. Carries an embedded IPv4 in bytes 2-5;
+// hostile use is to tunnel through to a v4 destination the v4 guard
+// would have refused. Refused.
+var IPV6_6TO4_PREFIX      = _ipv6ToBytes("2002::");
+// Discard prefix 100::/64 — RFC 6666. Dropped by routers; fetching
+// from it is operationally meaningless and a likely sign of mis-config
+// or attempted exfil to a sinkhole.
+var IPV6_DISCARD_PREFIX   = _ipv6ToBytes("100::");
 
 // ---- Cloud metadata addresses (string-equality, exact match) ----
 var CLOUD_METADATA_IPS = [
@@ -235,6 +252,20 @@ function classify(ip) {
   if (_ipv6PrefixMatch(IPV6_LINK_LOCAL_PREFIX, 10, bytes))  return "link-local";
   if (_ipv6PrefixMatch(IPV6_PRIVATE_PREFIX,     7, bytes))  return "private";
   if (_ipv6PrefixMatch(IPV6_DOC_PREFIX,        32, bytes))  return "reserved";
+  if (_ipv6PrefixMatch(IPV6_MULTICAST_PREFIX,   8, bytes))  return "reserved";
+  if (_ipv6PrefixMatch(IPV6_DISCARD_PREFIX,    64, bytes))  return "reserved";
+  // 6to4 (2002::/16) embeds a v4 address in bytes 2–5; classify the
+  // embedded v4 so a 6to4-wrapped private/metadata address is refused
+  // for the same reason its v4 form would be.
+  if (_ipv6PrefixMatch(IPV6_6TO4_PREFIX, 16, bytes)) {
+    var v4From6to4 = bytes[2] + "." + bytes[3] + "." + bytes[4] + "." + bytes[5];
+    return classify(v4From6to4) || "reserved";
+  }
+  // NAT64 well-known prefix (64:ff9b::/96) embeds v4 in bytes 12–15.
+  if (_ipv6PrefixMatch(IPV6_NAT64_PREFIX, 96, bytes)) {
+    var v4FromNat64 = bytes[12] + "." + bytes[13] + "." + bytes[14] + "." + bytes[15];
+    return classify(v4FromNat64) || "reserved";
+  }
   // IPv4-mapped addresses (::ffff:a.b.c.d/96): re-classify the v4 portion.
   if (_ipv6PrefixMatch(IPV6_V4_MAPPED_PREFIX, 96, bytes)) {
     var mappedV4 = bytes[12] + "." + bytes[13] + "." + bytes[14] + "." + bytes[15];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",