@blamejs/core 0.5.4 → 0.5.6

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- **0.5.5** (2026-04-30) — strict default CSP + IPv6 special-range expansion
+- **0.5.4** (2026-04-30) — close SSRF DNS-rebinding window with pinned outbound DNS
 - **0.5.3** (2026-04-30) — security cleanup: trustProxy primitive + Vary merge + HSTS gate
 - **0.5.2** (2026-04-30) — b.breakGlass: passkey factor + service-account bypass + admin tools
 - **0.5.1** (2026-04-30) — b.breakGlass: per-cell encryption + context binding + migrate

package/lib/break-glass.js

@@ -39,6 +39,7 @@
  */
 var audit = require("./audit");
 var C = require("./constants");
+var cache = require("./cache");
 var clusterStorage = require("./cluster-storage");
 var { generateBytes, generateToken, kdf, sha3Hash, encryptPacked, decryptPacked } = require("./crypto");
 var cryptoField = require("./crypto-field");
@@ -76,6 +77,10 @@ var ALLOWED_REASON_STORAGE  = ["cleartext", "hmac", "both"];
 // Populated on first access per-table; invalidated on policy.set/delete.
 var policyCache = new Map();    // table -> policy
 var initialized = false;
+// Framework-wide trustProxy setting (set at init). When true, the
+// break-glass primitive consults X-Forwarded-For to populate the
+// grant row's `ip` field — same trust boundary as middleware.
+var _trustProxy = false;
 
 // Factor lockout — wrap auth.lockout so a hostile actor brute-forcing
 // TOTP codes against break-glass gets shut out after a few failures.
@@ -85,7 +90,6 @@ var _factorLockout = null;
 var _factorLockoutCache = null;
 function _ensureFactorLockout() {
   if (_factorLockout) return _factorLockout;
-  var cache = require("./cache");
   _factorLockoutCache = cache.create({
     namespace: "breakglass.factor",
     backend:   "memory",
@@ -305,10 +309,12 @@ async function migrate(table, opts) {
 
 function init(opts) {
   opts = opts || {};
-  validateOpts(opts, ["now"], "breakGlass.init");
+  validateOpts(opts, ["now", "trustProxy"], "breakGlass.init");
   initialized = true;
   policyCache.clear();
   _factorLockout = null;
+  _trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
+    ? opts.trustProxy : false;
 }
 
 function _resetForTest() {
@@ -320,6 +326,7 @@ function _resetForTest() {
   }
   _factorLockout = null;
   _factorLockoutCache = null;
+  _trustProxy = false;
 }
 
 function _requireInit() {
@@ -695,7 +702,11 @@ async function grant(opts) {
   var nowMs    = Date.now();
   var grantId  = "bg-" + generateToken(16);
   var sessionId = (opts.req && opts.req.session && opts.req.session.id) || null;
-  var ipFromReq = (opts.req && opts.req.socket && opts.req.socket.remoteAddress) || null;
+  // Honor the framework-wide trustProxy setting from init() — same
+  // boundary as middleware. Without trustProxy, X-Forwarded-For is
+  // ignored as attacker-forgeable, and the grant pins to the socket
+  // remoteAddress only.
+  var ipFromReq = requestHelpers.clientIp(opts.req, { trustProxy: _trustProxy });
 
   var grantRow = {
     _id:                grantId,

package/lib/middleware/security-headers.js

@@ -46,10 +46,16 @@ var DEFAULT_PERMISSIONS = [
   "screen-wake-lock=()", "sync-xhr=()", "usb=()", "web-share=()", "xr-spatial-tracking=()",
 ];
 
+// Strict CSP — no 'unsafe-inline' on script-src OR style-src. Operators
+// with inline styles / scripts wire `b.middleware.cspNonce()` and use
+// `{{ cspNonce }}` in their views (or req.cspNonce in handlers); the
+// nonce hooks into the policy via the `csp` opt or a custom value.
+// Operators in transitional environments who genuinely need inline
+// styles set `csp` explicitly to the loose form.
 var DEFAULT_CSP =
   "default-src 'self'; " +
   "script-src 'self'; " +
-  "style-src 'self' 'unsafe-inline'; " +
+  "style-src 'self'; " +
   "img-src 'self' data:; " +
   "font-src 'self'; " +
   "connect-src 'self'; " +

package/lib/ssrf-guard.js

@@ -94,6 +94,23 @@ var IPV6_PRIVATE_PREFIX   = _ipv6ToBytes("fc00::");
 var IPV6_LINK_LOCAL_PREFIX = _ipv6ToBytes("fe80::");
 var IPV6_DOC_PREFIX       = _ipv6ToBytes("2001:db8::");      // documentation
 var IPV6_V4_MAPPED_PREFIX = _ipv6ToBytes("::ffff:0:0");      // IPv4-mapped (::ffff:0:0/96)
+// Multicast ff00::/8 — RFC 4291 §2.7. Refused for outbound HTTP same as
+// IPv4 multicast 224/4 — there's no legitimate fetch from a multicast
+// destination on a production gateway.
+var IPV6_MULTICAST_PREFIX = _ipv6ToBytes("ff00::");
+// NAT64 well-known prefix 64:ff9b::/96 — RFC 6052. Translates to IPv4
+// embedded in the lower 32 bits; the framework refuses since the
+// underlying v4 address is what gets contacted and might be private.
+// (Operators with NAT64 deployments flip allowInternal.)
+var IPV6_NAT64_PREFIX     = _ipv6ToBytes("64:ff9b::");
+// 6to4 2002::/16 — RFC 3056. Carries an embedded IPv4 in bytes 2-5;
+// hostile use is to tunnel through to a v4 destination the v4 guard
+// would have refused. Refused.
+var IPV6_6TO4_PREFIX      = _ipv6ToBytes("2002::");
+// Discard prefix 100::/64 — RFC 6666. Dropped by routers; fetching
+// from it is operationally meaningless and a likely sign of mis-config
+// or attempted exfil to a sinkhole.
+var IPV6_DISCARD_PREFIX   = _ipv6ToBytes("100::");
 
 // ---- Cloud metadata addresses (string-equality, exact match) ----
 var CLOUD_METADATA_IPS = [
@@ -235,6 +252,20 @@ function classify(ip) {
   if (_ipv6PrefixMatch(IPV6_LINK_LOCAL_PREFIX, 10, bytes))  return "link-local";
   if (_ipv6PrefixMatch(IPV6_PRIVATE_PREFIX,     7, bytes))  return "private";
   if (_ipv6PrefixMatch(IPV6_DOC_PREFIX,        32, bytes))  return "reserved";
+  if (_ipv6PrefixMatch(IPV6_MULTICAST_PREFIX,   8, bytes))  return "reserved";
+  if (_ipv6PrefixMatch(IPV6_DISCARD_PREFIX,    64, bytes))  return "reserved";
+  // 6to4 (2002::/16) embeds a v4 address in bytes 2–5; classify the
+  // embedded v4 so a 6to4-wrapped private/metadata address is refused
+  // for the same reason its v4 form would be.
+  if (_ipv6PrefixMatch(IPV6_6TO4_PREFIX, 16, bytes)) {
+    var v4From6to4 = bytes[2] + "." + bytes[3] + "." + bytes[4] + "." + bytes[5];
+    return classify(v4From6to4) || "reserved";
+  }
+  // NAT64 well-known prefix (64:ff9b::/96) embeds v4 in bytes 12–15.
+  if (_ipv6PrefixMatch(IPV6_NAT64_PREFIX, 96, bytes)) {
+    var v4FromNat64 = bytes[12] + "." + bytes[13] + "." + bytes[14] + "." + bytes[15];
+    return classify(v4FromNat64) || "reserved";
+  }
   // IPv4-mapped addresses (::ffff:a.b.c.d/96): re-classify the v4 portion.
   if (_ipv6PrefixMatch(IPV6_V4_MAPPED_PREFIX, 96, bytes)) {
     var mappedV4 = bytes[12] + "." + bytes[13] + "." + bytes[14] + "." + bytes[15];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",