@blamejs/core 0.6.63 → 0.6.65

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.65** (2026-05-03) — `b.scheduler.parseCron` rejects step values exceeding the field's range. Pre-fix `*/99999 * * * *` was silently accepted and degenerated to "minute 0 of every hour" (because the for-loop adding values stopped at the first iteration when `step > range`); an operator typing the typo got a once-per-hour schedule when they probably meant once per N minutes. Now `_parseCronField` rejects with `scheduler/invalid-cron` when `step > (range.max - range.min + 1)`. The bound is inclusive so `*/60 * * * *` (= "minute 0 of every hour" written with a redundant explicit step) still accepts. **Tests** — 4 new layer-0 assertions: `*/60` accepts, `*/61` rejects, `*/99999` rejects (the silent-degenerate case), `* */25 * * *` rejects (step > 24-hour range). Smoke 7230 → 7234 / wiki e2e 178 / Linux 86.9s / eslint clean / shellcheck clean.
+
+- **0.6.64** (2026-05-03) — `b.credentialHash.verify` now enforces the same 16-byte minimum payload that `hash()` enforces. Pre-fix the asymmetry was a real risk: `hash()` refused to *create* a hash shorter than 16 bytes (`length < 16` rejected with `credential-hash/bad-opt`), but `verify()` silently accepted any payload length, including 1-byte payloads where the collision space is **256** — a hand-crafted envelope `{ magic, algoId, SHAKE256(targetPassword, 1)[0] }` would verify against the target password in microseconds. A storage bug or attacker tampering that truncated the stored envelope produced a verifiable but catastrophically weak hash; an attacker with DB write access who couldn't replace the hash outright could *truncate* it to a nearly-cleartext-equivalent value. Both ends now refuse short payloads symmetrically via the new `SHAKE256_MIN_LENGTH = 16` constant; verify returns false (with `payload-too-short` observability label) when the envelope's payload is < 16 bytes. Legitimate truncation that keeps the payload ≥ 16 bytes still verifies (the framework's design intentionally supports XOF variable-length digests via `params: { length: N }`); the bound only refuses hashes too short to provide meaningful collision resistance. **Tests** — 4 new layer-0 assertions on `b.credentialHash.verify` (1-byte attack envelope rejected, 15-byte rejected, 16-byte accepts, hash() rejects length 15). Smoke 7226 → 7230 / wiki e2e 178 / Linux 86.5s / eslint clean / shellcheck clean.
+
 - **0.6.63** (2026-05-03) — `b.parsers.toml.parse` enforces `maxDepth` on dotted-key paths. Pre-fix the parser walked arbitrarily deep table headers (`[a.b.c.d.e…]`) without applying the existing `maxDepth` (which only ran inside `_parseValue` for inline tables / arrays); a 10,000-segment path built a tree deep enough to stack-overflow the recursive `_normalize` walker post-parse. An attacker submitting a malicious TOML config to `b.config` would crash the framework at boot or whenever the file was reloaded. Now `_parseDottedKey` rejects a path with more than `maxDepth` segments via the same `toml/too-deep` error code already used for value-side depth. **Tests** — 4 new layer-0 assertions: 99-segment path under default depth accepts, 150-segment path rejects with `toml/too-deep`, 10K-segment path rejects (no stack overflow), `maxDepth: 1000` opt allows a 500-segment path. Smoke 7222 → 7226 / wiki e2e 178 / Linux 85.6s / eslint clean / shellcheck clean.
 
 - **0.6.62** (2026-05-03) — URL-length DoS-shape gap closed in two places. **`b.safeSchema.string().url()`** was regex-only with no length cap, accepting arbitrarily long matching strings — same DoS class as v0.6.61's `.email()` gap; an operator chaining `.url()` on a request body would feed multi-megabyte URLs into downstream HTTP clients / SSRF gates / log lines. Now rejects with `string/url-too-long` at 8193+ chars. **`b.safeUrl.parse`** had the same gap at the framework's primary URL-validation surface (used by httpClient + ssrfGuard + every operator-supplied URL). The 8 KB cap now applies BEFORE handing the string to Node's `new URL()` parser; operator-supplied URLs feeding `b.httpClient.request({ url })` from request bodies / webhook configs are bounded. Operators with legitimate non-standard use (proxies, tunnels with embedded payloads) override via `opts.maxUrlLength`. Both bounds reference RFC 7230 §3.1.1's 8000-octet recommendation. **Tests** — 4 new layer-0 assertions on `string().url()` (8 KB / 8193 / 100K / error code) + 4 on `safeUrl.parse` (8192 accept / 8193 reject / error code / `maxUrlLength` opt override). Smoke 7215 → 7222 / wiki e2e 178 / Linux 85.5s / per-primitive integration 16 files / eslint clean / shellcheck clean.

package/lib/credential-hash.js

@@ -93,6 +93,13 @@ function _emitEvent(name, value, labels) {
 // to the larger size; operators pass `{ params: { length: 64 } }`
 // to opt into the SHA3-512-comparable byte count if they need it.
 var SHAKE256_DEFAULT_LENGTH = 128;
+// Minimum payload length both hash() and verify() enforce. 16 bytes
+// (128 bits) is the floor below which the digest's collision space
+// becomes brute-forceable. The asymmetry between hash() (rejected < 16
+// at config time) and verify() (silently accepted any length) let a
+// truncated stored envelope verify with trivial work; both ends now
+// refuse short payloads symmetrically.
+var SHAKE256_MIN_LENGTH = 16;
 
 function _shake256(secret, length) {
   // crypto.kdf wraps SHAKE256 with arbitrary output length. That's the
@@ -200,9 +207,11 @@ async function hash(secret, opts) {
 
   if (algoId === C.CRED_HASH_IDS.SHAKE256) {
     var length = (opts && opts.params && opts.params.length) || SHAKE256_DEFAULT_LENGTH;
-    if (typeof length !== "number" || !isFinite(length) || length < 16 || Math.floor(length) !== length) {
+    if (typeof length !== "number" || !isFinite(length) ||
+        length < SHAKE256_MIN_LENGTH || Math.floor(length) !== length) {
       throw new CredentialHashError(
-        "credentialHash.hash: SHAKE256 length must be an integer >= 16, got " + JSON.stringify(length),
+        "credentialHash.hash: SHAKE256 length must be an integer >= " +
+        SHAKE256_MIN_LENGTH + ", got " + JSON.stringify(length),
         "credential-hash/bad-opt");
     }
     var env = _envelope(algoId, _shake256(secret, length));
@@ -246,6 +255,19 @@ async function verify(secret, envelope) {
   var algoName = ID_TO_NAME[decoded.algoId];
 
   if (decoded.algoId === C.CRED_HASH_IDS.SHAKE256) {
+    // Enforce the same minimum payload length that hash() enforces (16
+    // bytes / 128 bits). Without this, a storage bug or attacker
+    // tampering that truncates the stored envelope to just a few bytes
+    // produces a hash with catastrophically reduced collision space —
+    // a 1-byte payload has only 256 possible values, brute-forceable
+    // in microseconds. The asymmetry between hash() (rejects < 16) and
+    // verify() (accepted anything) was the silent gap; both ends now
+    // refuse weak digests symmetrically.
+    if (decoded.payload.length < SHAKE256_MIN_LENGTH) {
+      _emitEvent("credentialHash.verify", 1,
+        { outcome: "failure", reason: "payload-too-short", algo: algoName });
+      return false;
+    }
     var expected = _shake256(secret, decoded.payload.length);
     var ok = crypto.timingSafeEqual(expected, decoded.payload);
     _emitEvent("credentialHash.verify", 1,

package/lib/scheduler.js

@@ -123,6 +123,21 @@ function _parseCronField(text, range) {
         throw new SchedulerError("scheduler/invalid-cron",
           "bad step '" + stepStr + "' in cron field '" + range.name + "'", true);
       }
+      // Reject step > field-range, even though the for-loop below would
+      // silently produce a single-value schedule (e.g. `*/99999` for
+      // minutes degenerates to "minute 0 of every hour"). An operator
+      // typing `*/99999` clearly meant something else; silent acceptance
+      // hides the typo and produces a schedule that fires once per hour
+      // when the operator probably wanted once per N minutes for small N.
+      // The bound is `range.max - range.min + 1` so e.g. minutes (0-59)
+      // accepts step up to 60 (inclusive — `*/60` is "minute 0 of every
+      // hour" written with a redundant step).
+      var rangeSize = range.max - range.min + 1;
+      if (step > rangeSize) {
+        throw new SchedulerError("scheduler/invalid-cron",
+          "step '" + stepStr + "' exceeds field range (" + rangeSize +
+          ") in cron field '" + range.name + "'", true);
+      }
       part = part.slice(0, stepIdx);
     }
     var lo, hi;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.63",
+  "version": "0.6.65",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:192ac8a0-4291-44dd-a03a-44af6b4cce65",
+  "serialNumber": "urn:uuid:e379d7a4-43ef-4578-b4ba-31b6f69125f5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-03T14:04:51.705Z",
+    "timestamp": "2026-05-03T14:31:10.670Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.63",
+      "bom-ref": "@blamejs/core@0.6.65",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.63",
+      "version": "0.6.65",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.63",
+      "purl": "pkg:npm/%40blamejs/core@0.6.65",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.63",
+      "ref": "@blamejs/core@0.6.65",
       "dependsOn": []
     }
   ]