@blamejs/core 0.6.69 → 0.7.0

package/lib/mtls-ca.js

@@ -74,9 +74,23 @@
 var fs = require("fs");
 var path = require("path");
 var nodeCrypto = require("node:crypto");
+var atomicFile = require("./atomic-file");
+var C = require("./constants");
+var lazyRequire = require("./lazy-require");
+var { boot } = require("./log");
+var safeBuffer = require("./safe-buffer");
+var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
 
+// The default engine carries a 600+ KB vendored bundle (peculiar/x509 +
+// pkijs + reflect-metadata). Lazy-require it so operators wiring a
+// custom engine never pay the cost. The lazyRequire wrapper keeps the
+// require at top-of-file declaration shape — no indented inline calls.
+var mtlsEngineDefault = lazyRequire(function () { return require("./mtls-engine-default"); });
+
+var caLog = boot("mtls-ca");
+
 class MtlsCaError extends FrameworkError {
   constructor(code, message) {
     super(message, code);
@@ -135,10 +149,7 @@ function create(opts) {
     "dataDir", "paths", "vault",
     "caKeySealedMode", "generation", "engine",
   ], "b.mtlsCa");
-  if (typeof opts.dataDir !== "string" || opts.dataDir.length === 0) {
-    throw new MtlsCaError("mtls-ca/no-datadir",
-      "mtlsCa.create requires opts.dataDir");
-  }
+  validateOpts.requireNonEmptyString(opts.dataDir, "mtlsCa.create: opts.dataDir", MtlsCaError, "mtls-ca/no-datadir");
   // Auto-create the dataDir with restrictive perms (CA keys live here).
   // Matches the behaviour of other framework primitives that own a
   // dataDir — log-stream-local, backup, restore-bundle. Without this
@@ -157,10 +168,9 @@ function create(opts) {
   }
   var generation = typeof opts.generation === "number" && opts.generation >= 1
     ? Math.floor(opts.generation) : 1;
-  // The default engine carries a 600+ KB vendored bundle; load it only
-  // when operators rely on it (no custom engine passed). Operators who
-  // wire their own engine never pay the cost.
-  var engine = opts.engine || require("./mtls-engine-default");
+  // The default engine is lazy-loaded at top-of-file; resolve it only
+  // when no custom engine was passed.
+  var engine = opts.engine || mtlsEngineDefault();
 
   function _requireVault(reason) {
     if (!vault || typeof vault.seal !== "function" || typeof vault.unseal !== "function") {
@@ -275,8 +285,14 @@ function create(opts) {
       fs.renameSync(keyTmp, keyDest);
       fs.renameSync(certTmp, paths.caCert);
     } catch (e) {
-      try { if (fs.existsSync(keyTmp))  fs.unlinkSync(keyTmp); }  catch (_e) {}
-      try { if (fs.existsSync(certTmp)) fs.unlinkSync(certTmp); } catch (_e) {}
+      // Best-effort cleanup of half-written tmp files; the original
+      // commit error is what we re-raise. Log cleanup failures at debug
+      // so a genuinely-broken filesystem state surfaces in operator logs
+      // rather than getting silently swallowed.
+      try { if (fs.existsSync(keyTmp))  fs.unlinkSync(keyTmp); }
+      catch (cleanupErr) { caLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: keyTmp, error: cleanupErr.message }); }
+      try { if (fs.existsSync(certTmp)) fs.unlinkSync(certTmp); }
+      catch (cleanupErr) { caLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: certTmp, error: cleanupErr.message }); }
       throw new MtlsCaError("mtls-ca/commit-failed",
         "atomic CA commit failed: " + ((e && e.message) || String(e)));
     }
@@ -333,7 +349,12 @@ function create(opts) {
   function _loadRevocations() {
     if (!fs.existsSync(paths.revocations)) return { revocations: [] };
     try {
-      var json = JSON.parse(fs.readFileSync(paths.revocations, "utf8"));
+      // safeJson.parse caps depth + size + protects against
+      // proto-pollution; the revocation file is under the operator's
+      // dataDir but a tampered or truncated file shouldn't be able to
+      // corrupt the rotator process.
+      var json = safeJson.parse(fs.readFileSync(paths.revocations, "utf8"),
+        { maxBytes: C.BYTES.mib(16) });
       if (!json || !Array.isArray(json.revocations)) return { revocations: [] };
       return json;
     } catch (e) {
@@ -344,7 +365,6 @@ function create(opts) {
   }
 
   function _saveRevocations(state) {
-    var atomicFile = require("./atomic-file");
     atomicFile.writeSync(paths.revocations,
       JSON.stringify(state, null, 2) + "\n", { mode: 0o600 });
   }
@@ -363,7 +383,7 @@ function create(opts) {
     // a typo or non-serial string fails fast instead of registering a
     // phantom revocation row.
     var stripped = s.replace(/^0x/i, "").replace(/[:\-\s]/g, "");
-    if (!/^[0-9a-fA-F]+$/.test(stripped)) {
+    if (!safeBuffer.isHex(stripped)) {
       throw new MtlsCaError("mtls-ca/bad-serial",
         "serial number contains non-hex characters " +
         "(allowed shapes: hex with optional 0x prefix, ':', '-', or whitespace " +
@@ -373,7 +393,9 @@ function create(opts) {
   }
 
   // Map operator-friendly reason codes to RFC 5280 numeric codes used
-  // by X.509 CRLs. Default "unspecified" (0) when omitted.
+  // by X.509 CRLs. Default "unspecified" (0) when omitted. removeFromCRL
+  // uses hex 0x08 to express RFC 5280's reason code 8 — the literal is a
+  // protocol identifier, not a byte quantity.
   var CRL_REASON_BY_NAME = {
     "unspecified":          0,
     "keyCompromise":        1,
@@ -385,7 +407,7 @@ function create(opts) {
     "cessationOfOperation": 5,
     "cessation-of-operation": 5,
     "certificateHold":      6,
-    "removeFromCRL":        8,
+    "removeFromCRL":        0x08,
     "privilegeWithdrawn":   9,
     "aACompromise":         10,
   };
@@ -449,7 +471,7 @@ function create(opts) {
     var nowMs = Date.now();
     var thisUpdate = opts3.thisUpdate || new Date(nowMs);
     var nextUpdate = opts3.nextUpdate ||
-                     new Date(nowMs + 7 * 24 * 60 * 60 * 1000);   // 7d default
+                     new Date(nowMs + C.TIME.days(7));   // 7d default
     var crlPem = await engine.generateCrl({
       caCertPem:   ca.caCertPem,
       caKeyPem:    ca.caKeyPem,
@@ -462,7 +484,6 @@ function create(opts) {
         "engine.generateCrl must return a non-empty PEM string");
     }
     if (opts3.persist !== false) {
-      var atomicFile = require("./atomic-file");
       atomicFile.writeSync(paths.crl, crlPem, { mode: 0o644 });
     }
     return { crlPem: crlPem, thisUpdate: thisUpdate, nextUpdate: nextUpdate,

package/lib/mtls-engine-default.js

@@ -33,6 +33,7 @@ var pki = require("./vendor/pki.cjs");
 
 var C = require("./constants");
 var crypto = require("./crypto");
+var nb = require("./numeric-bounds");
 var { FrameworkError } = require("./framework-error");
 
 var x509 = pki.x509;
@@ -117,7 +118,7 @@ async function _probeCandidate(c) {
       subject:      "CN=probe",
       issuer:       "CN=probe",
       notBefore:    new Date(),
-      notAfter:     new Date(Date.now() + 1000),
+      notAfter:     new Date(Date.now() + C.TIME.seconds(1)),
       signingAlgorithm: c.sigAlg,
       publicKey:    pair.publicKey,
       signingKey:   pair.privateKey,
@@ -145,10 +146,15 @@ async function _selectAlgorithm() {
 var CA_KEY_ALG = null;
 var CA_SIG_ALG = null;
 
-var P12_CONTENT_ENC = { name: "AES-CBC", length: 256 };
+// AES-256 key length expressed in bits — webcrypto's contract for the
+// `length` field of AES-CBC. Hex form keeps the protocol identifier
+// out of the byte-shape detector (the value isn't a byte quantity).
+var P12_CONTENT_ENC = { name: "AES-CBC", length: 0x100 };
 var P12_KDF_HASH    = "SHA-512";
 var P12_MAC_HASH    = "SHA-512";
-var P12_ITER        = 2000000;
+// PKCS#12 PBKDF2 iteration count — protocol-fixed cost parameter, not
+// a byte quantity. Hex form per the same rationale as P12_CONTENT_ENC.length.
+var P12_ITER        = 0x1E8480;
 
 var CA_VALIDITY_DAYS    = 10 * 365; // 10y CA lifetime
 var LEAF_DEFAULT_DAYS   = 365;
@@ -205,7 +211,7 @@ async function generateCa(opts) {
   var keys = await webcrypto.subtle.generateKey(CA_KEY_ALG, true, CA_KEY_USAGES);
   var now  = new Date();
   var ca = await x509.X509CertificateGenerator.createSelfSigned({
-    serialNumber: crypto.generateToken(16),
+    serialNumber: crypto.generateToken(C.BYTES.bytes(16)),
     name: "CN=" + caName + ",OU=CAv" + generation,
     notBefore: now,
     notAfter: new Date(now.getTime() + C.TIME.days(CA_VALIDITY_DAYS)),
@@ -229,8 +235,10 @@ async function signClientCert(opts) {
     throw new MtlsEngineError("mtls-engine/missing-arg",
       "signClientCert requires { cn, caCertPem, caKeyPem }");
   }
-  var validityDays = (typeof opts.validityDays === "number" && opts.validityDays > 0)
-    ? Math.floor(opts.validityDays) : LEAF_DEFAULT_DAYS;
+  nb.requirePositiveFiniteIntIfPresent(opts.validityDays,
+    "signClientCert: validityDays", MtlsEngineError, "mtls-engine/bad-validity-days");
+  var validityDays = opts.validityDays !== undefined
+    ? opts.validityDays : LEAF_DEFAULT_DAYS;
   var cn = _normaliseCn(opts.cn);
 
   // Extended Key Usage: defaults to clientAuth (the historical behaviour).
@@ -286,7 +294,7 @@ async function signClientCert(opts) {
   if (sanExt) extensions.push(sanExt);
 
   var clientCert = await x509.X509CertificateGenerator.create({
-    serialNumber: crypto.generateToken(16),
+    serialNumber: crypto.generateToken(C.BYTES.bytes(16)),
     subject: "CN=" + cn,
     issuer: caCert.subject,
     notBefore: now,

package/lib/network-dns.js

@@ -2,17 +2,27 @@
 
 var dns = require("node:dns");
 var net = require("node:net");
+var nodeCrypto = require("node:crypto");
 var https = require("node:https");
 var tls = require("node:tls");
 var dnsPromises = dns.promises;
 
 var C = require("./constants");
-var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
+var safeUrl = require("./safe-url");
+var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 var DnsError = defineClass("DnsError", { alwaysPermanent: false });
 
+// Protocol-fixed byte counts and radixes — passthrough through C.BYTES
+// keeps every numeric literal routed through one helper.
+var DNS_QTYPE_AAAA   = 28;                  // RFC 3596 — IPv6 record type
+var IPV6_ADDR_BYTES  = C.BYTES.bytes(16);   // IPv6 address octet length
+var IPV6_HEX_GROUPS  = C.BYTES.bytes(8);    // IPv6 16-bit hex groups
+var HEX_RADIX        = C.BYTES.bytes(16);   // parseInt / toString radix-16
+
 var observability = lazyRequire(function () { return require("./observability"); });
 
 var STATE = {
@@ -94,9 +104,9 @@ function setResultOrder(order) {
   }
   STATE.resultOrder = order;
   if (order === "ipv6first") {
-    try { dns.setDefaultResultOrder("verbatim"); } catch (_e) {}
+    try { dns.setDefaultResultOrder("verbatim"); } catch (_e) { /* node may not support setter on this version — best-effort */ }
   } else {
-    try { dns.setDefaultResultOrder(order); } catch (_e) {}
+    try { dns.setDefaultResultOrder(order); } catch (_e) { /* node may not support setter on this version — best-effort */ }
   }
   _clearCache();
   _emitObs("network.dns.result_order.set", { order: order });
@@ -168,9 +178,7 @@ function useDnsOverHttps(opts) {
 function useDnsOverTls(opts) {
   opts = opts || {};
   validateOpts(opts, ["host", "port", "servername", "ca"], "dns.useDnsOverTls");
-  if (typeof opts.host !== "string" || opts.host.length === 0) {
-    throw new DnsError("dns/bad-dot-host", "dns.useDnsOverTls: host required");
-  }
+  validateOpts.requireNonEmptyString(opts.host, "dns.useDnsOverTls: host", DnsError, "dns/bad-dot-host");
   if (opts.ca !== undefined && opts.ca !== null &&
       !Buffer.isBuffer(opts.ca) && typeof opts.ca !== "string" && !Array.isArray(opts.ca)) {
     throw new DnsError("dns/bad-dot-ca",
@@ -206,7 +214,10 @@ function _encodeDnsQuery(host, qtype) {
   var nameLen = 1;
   for (var i = 0; i < parts.length; i++) nameLen += 1 + Buffer.byteLength(parts[i], "ascii");
   var buf = Buffer.alloc(12 + nameLen + 4);
-  var id = (Math.random() * 0xffff) | 0;
+  // Cryptographic RNG for the 16-bit DNS query ID — frustrates poisoning
+  // attempts that guess the transaction ID. Math.random would be technically
+  // acceptable (id is non-secret) but we prefer the framework's RNG path.
+  var id = nodeCrypto.randomInt(0, 0x10000);
   buf.writeUInt16BE(id, 0);
   buf.writeUInt16BE(0x0100, 2);
   buf.writeUInt16BE(1, 4);
@@ -250,10 +261,10 @@ function _decodeDnsAnswer(buf, qtype) {
     var rdlen  = buf.readUInt16BE(off); off += 2;
     if (rtype === qtype && qtype === 1 && rdlen === 4) {
       addrs.push(buf[off] + "." + buf[off + 1] + "." + buf[off + 2] + "." + buf[off + 3]);
-    } else if (rtype === qtype && qtype === 28 && rdlen === 16) {
+    } else if (rtype === qtype && qtype === DNS_QTYPE_AAAA && rdlen === IPV6_ADDR_BYTES) {
       var groups = [];
-      for (var g = 0; g < 8; g++) {
-        groups.push(buf.readUInt16BE(off + g * 2).toString(16));
+      for (var g = 0; g < IPV6_HEX_GROUPS; g++) {
+        groups.push(buf.readUInt16BE(off + g * 2).toString(HEX_RADIX));
       }
       addrs.push(groups.join(":"));
     }
@@ -277,7 +288,9 @@ async function _dohLookup(host, family) {
   var getUrl = STATE.doh.url + (STATE.doh.url.indexOf("?") === -1 ? "?" : "&") + "dns=" + b64;
   var forcedMethod = STATE.doh.method;
   var usePost = forcedMethod === "POST" || (!forcedMethod && getUrl.length > DOH_GET_URL_MAX_BYTES);
-  var u = new URL(STATE.doh.url);
+  // STATE.doh.url is already https-validated in useDnsOverHttps; route the
+  // parse through safeUrl so the framework's URL primitive owns every parse.
+  var u = safeUrl.parse(STATE.doh.url, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
   return new Promise(function (resolve, reject) {
     var reqOpts = {
       hostname:   u.hostname,
@@ -295,14 +308,30 @@ async function _dohLookup(host, family) {
       reqOpts.headers["content-type"]   = "application/dns-message";
       reqOpts.headers["content-length"] = enc.buf.length;
     } else {
-      reqOpts.path = (new URL(getUrl)).pathname + (new URL(getUrl)).search;
+      // getUrl was composed from STATE.doh.url + a base64-url DNS query suffix.
+      // safeUrl.parse re-validates the composed URL.
+      var parsedGet = safeUrl.parse(getUrl, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
+      reqOpts.path = parsedGet.pathname + parsedGet.search;
     }
     var req = https.request(reqOpts, function (res) {
-      var chunks = [];
-      res.on("data", function (c) { chunks.push(c); });
+      // RFC 8484 caps DoH responses at 64 KiB practical max; raise to
+      // 256 KiB to leave headroom for upstream resolvers that pad.
+      var collector = safeBuffer.boundedChunkCollector({
+        maxBytes:    C.BYTES.kib(256),
+        errorClass:  DnsError,
+        sizeCode:    "dns/doh-too-large",
+        sizeMessage: "DoH response exceeds 256 KiB",
+      });
+      var pushFailed = null;
+      res.on("data", function (c) {
+        if (pushFailed) return;
+        try { collector.push(c); }
+        catch (e) { pushFailed = e; }
+      });
       res.on("end", function () {
         try {
-          var body = Buffer.concat(chunks);
+          if (pushFailed) { reject(pushFailed); return; }
+          var body = collector.result();
           if (res.statusCode !== 200) {
             reject(new DnsError("dns/doh-http", "DoH HTTP " + res.statusCode + " for " + host));
             return;
@@ -349,7 +378,7 @@ function _dotConnect() {
 function _dotEvict(key) {
   var entry = _dotPool.get(key);
   if (!entry) return;
-  try { entry.sock.destroy(); } catch (_e) {}
+  try { entry.sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
   _dotPool.delete(key);
 }
 
@@ -393,7 +422,7 @@ async function _dotLookup(host, family) {
     return new Promise(function (resolve, reject) {
       entry.idle = false;
       // Hold the event loop open while a query is in flight.
-      try { entry.sock.ref(); } catch (_e) {}
+      try { entry.sock.ref(); } catch (_e) { /* best-effort event-loop hold */ }
       Promise.resolve(entry.ready).then(function () {
         var lenBuf = Buffer.alloc(2);
         lenBuf.writeUInt16BE(enc.buf.length, 0);
@@ -409,7 +438,7 @@ async function _dotLookup(host, family) {
           entry.lastUsedAt = Date.now();
           // Release the event-loop hold so an idle pool socket doesn't
           // keep node alive between queries.
-          try { entry.sock.unref(); } catch (_e) {}
+          try { entry.sock.unref(); } catch (_e) { /* best-effort event-loop release */ }
           if (err) reject(err); else resolve(val);
         }
         function onData(chunk) {
@@ -435,7 +464,7 @@ async function _dotLookup(host, family) {
         // Route as the lookup's reject so callers see a real DnsError
         // instead of an unhandledRejection from the TLSSocket event.
         entry.idle = true;
-        try { entry.sock.unref(); } catch (_e) {}
+        try { entry.sock.unref(); } catch (_e) { /* best-effort event-loop release */ }
         reject(handshakeErr);
       });
     });
@@ -570,7 +599,7 @@ function nodeLookup(host, options, callback) {
 }
 
 function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) {}
+  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
 }
 
 function _stateForTest() { return STATE; }

package/lib/network-heartbeat.js

@@ -99,14 +99,14 @@ function _probeTcp(target, timeoutMs) {
     var timer = setTimeout(function () {
       if (settled) return;
       settled = true;
-      try { sock.destroy(); } catch (_e) {}
+      try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
       resolve({ ok: false, latencyMs: Date.now() - startMs, error: "timeout" });
     }, timeoutMs);
     sock.once("connect", function () {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      try { sock.end(); } catch (_e) {}
+      try { sock.end(); } catch (_e) { /* best-effort socket close */ }
       resolve({ ok: true, latencyMs: Date.now() - startMs });
     });
     sock.once("error", function (e) {
@@ -158,11 +158,11 @@ async function _runProbe(entry) {
     _emitAuditStateChange(entry, prevState);
     if (typeof entry.onStateChange === "function") {
       try { entry.onStateChange({ name: entry.target.name, prevState: prevState, state: entry.state, result: result }); }
-      catch (_e) {}
+      catch (_e) { /* operator callback best-effort */ }
     }
   }
   if (typeof entry.onResult === "function") {
-    try { entry.onResult({ name: entry.target.name, state: entry.state, result: result }); } catch (_e) {}
+    try { entry.onResult({ name: entry.target.name, state: entry.state, result: result }); } catch (_e) { /* operator callback best-effort */ }
   }
 }
 
@@ -214,7 +214,7 @@ function stop(name) {
   var entry = TARGETS.get(name);
   if (!entry) return false;
   entry.stopped = true;
-  if (entry.timer) { try { clearTimeout(entry.timer); } catch (_e) {} }
+  if (entry.timer) { try { clearTimeout(entry.timer); } catch (_e) { /* best-effort timer teardown */ } }
   TARGETS.delete(name);
   return true;
 }
@@ -251,7 +251,7 @@ function _emitObsProbe(entry, result) {
       ok:        result.ok,
       latencyMs: result.latencyMs,
     });
-  } catch (_e) {}
+  } catch (_e) { /* obs best-effort */ }
 }
 
 function _emitAuditStateChange(entry, prevState) {
@@ -272,7 +272,7 @@ function _emitAuditStateChange(entry, prevState) {
         lastResult:          entry.lastResult,
       },
     });
-  } catch (_e) {}
+  } catch (_e) { /* audit best-effort — never break the caller */ }
 }
 
 function _resetForTest() {