@blamejs/core 0.6.69 → 0.7.0

package/lib/parsers/safe-env.js

@@ -56,13 +56,26 @@
 
 var C = require("../constants");
 var atomicFile = require("../atomic-file");
+var lazyRequire = require("../lazy-require");
+var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var safeJson = require("../safe-json");
 var { FrameworkError } = require("../framework-error");
 var { boot } = require("../log");
 
+// Lazy require for audit — eager-loading audit at top of file forms a
+// load cycle: vault.init → passphrase-source → safe-env → audit →
+// (transitively) vault, which leaves safe-env's module.exports
+// half-built when vault first reaches readVar. Defer audit resolution
+// until the first emit-driven call.
+var auditModule = lazyRequire(function () { return require("../audit"); });
+
 var log = boot("env");
 
+// parseInt radix — named so the call site doesn't carry a bare 16
+// integer literal that reads as a byte count.
+var RADIX_HEX = 0x10;
+
 class SafeEnvError extends FrameworkError {
   constructor(message, code, line) {
     super(line != null ? message + " at line " + line : message);
@@ -75,7 +88,7 @@ class SafeEnvError extends FrameworkError {
 
 var DEFAULTS = {
   maxBytes:       C.BYTES.kib(64),
-  maxKeys:        1000,
+  maxKeys:        1_000,
   keyShape:       /^[A-Z_][A-Z0-9_]*$/,
   applyToProcess: false,
   allowOverwrite: false,
@@ -89,10 +102,21 @@ var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 function parse(input, opts) {
   opts = opts || {};
-  var maxBytes = (typeof opts.maxBytes === "number" && opts.maxBytes > 0)
+  // Validate operator-supplied numeric opts via lib/numeric-bounds —
+  // Infinity / NaN / negative / non-integer all bypass the `> 0` shape
+  // and silently lift the DoS cap they were meant to enforce.
+  if (opts.maxBytes !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new SafeEnvError("env.parse: maxBytes must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxBytes), "env/bad-opt");
+  }
+  if (opts.maxKeys !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxKeys)) {
+    throw new SafeEnvError("env.parse: maxKeys must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxKeys), "env/bad-opt");
+  }
+  var maxBytes = opts.maxBytes !== undefined
     ? Math.min(opts.maxBytes, C.BYTES.mib(1)) : DEFAULTS.maxBytes;
-  var maxKeys = (typeof opts.maxKeys === "number" && opts.maxKeys > 0)
-    ? Math.min(opts.maxKeys, 100000) : DEFAULTS.maxKeys;
+  var maxKeys = opts.maxKeys !== undefined
+    ? Math.min(opts.maxKeys, 100_000) : DEFAULTS.maxKeys;
   var keyShape = opts.keyShape instanceof RegExp ? opts.keyShape : DEFAULTS.keyShape;
 
   input = safeBuffer.normalizeText(input, {
@@ -123,7 +147,7 @@ function parse(input, opts) {
     if (eqIdx < 0) {
       throw new SafeEnvError("missing '=' separator", "env/bad-line", lineNumber);
     }
-    var key = trimmed.substring(0, eqIdx).replace(/[ \t]+$/, "");
+    var key = trimmed.substring(0, eqIdx).replace(safeBuffer.TRAILING_HSPACE_RE, "");
     var rest = trimmed.substring(eqIdx + 1);
 
     if (key.length === 0) {
@@ -163,9 +187,9 @@ function parse(input, opts) {
       // (so a value like `KEY=color#red` keeps the literal `#`).
       var commentMatch = rest.match(/^([^\s#]*(?:[ \t]+[^#\s]+)*)\s+#.*$/);
       if (commentMatch) {
-        value = commentMatch[1].replace(/[ \t]+$/, "");
+        value = commentMatch[1].replace(safeBuffer.TRAILING_HSPACE_RE, "");
       } else {
-        value = rest.replace(/[ \t]+$/, "");
+        value = rest.replace(safeBuffer.TRAILING_HSPACE_RE, "");
       }
       // Reject `$VAR` style references — explicit error so operators
       // see the policy rather than silently getting unexpanded text.
@@ -209,10 +233,10 @@ function _decodeDoubleQuoted(rest, lineNumber) {
         case "$":  out += "$";  i += 2; continue;  // literal $ escape
         case "u": {
           var hex = rest.substring(i + 2, i + 6);
-          if (!/^[0-9a-fA-F]{4}$/.test(hex)) {
+          if (!safeBuffer.isHex(hex, 4)) {
             throw new SafeEnvError("bad \\u escape", "env/bad-escape", lineNumber);
           }
-          out += String.fromCharCode(parseInt(hex, 16));
+          out += String.fromCharCode(parseInt(hex, RADIX_HEX));
           i += 6;
           continue;
         }
@@ -493,11 +517,9 @@ function _hasNonEmptyDiff(d) {
 function _writeAuditRows(filepath, diff) {
   // Both audit.record and cluster.requireLeader sit downstream — if
   // we're a follower, audit.record will throw NotLeaderError. Catch
-  // silently: a follower's local config-load shouldn't crash because
+  // explicitly: a follower's local config-load shouldn't crash because
   // the cluster's audit chain belongs to the leader.
-  var audit;
-  try { audit = require("./../audit"); }
-  catch (_e) { return; /* audit module not loadable in this context */ }
+  var audit = auditModule();   // resolve the lazy-required audit module
 
   function _safeRecord(action, metadata) {
     try {
@@ -559,7 +581,14 @@ function readVar(name, schema) {
   var type     = schema.type || "string";
   var required = schema.required === true;
   var hasDefault = "default" in schema;
-  var maxBytes = (typeof schema.maxBytes === "number" && schema.maxBytes > 0)
+  if (schema.maxBytes !== undefined && !numericBounds.isPositiveFiniteInt(schema.maxBytes)) {
+    throw new SafeEnvError(
+      "readVar: maxBytes must be a positive finite integer; got " +
+        numericBounds.shape(schema.maxBytes),
+      "env/bad-opt"
+    );
+  }
+  var maxBytes = (schema.maxBytes !== undefined)
     ? schema.maxBytes : READVAR_DEFAULT_MAX_BYTES;
   var strip    = schema.strip === true;
 

package/lib/parsers/safe-ini.js

@@ -31,18 +31,24 @@
  *   parsers.ini.parse(input, opts?)   -> object
  *   parsers.ini.IniSafeError          (with .code matching ini/...)
  *
- * Validation tier: A (config-time throw) — every malformed input
- * surfaces at parse time, never silently coerces to a usable shape.
+ * Input validation throws at parse time — every malformed input
+ * surfaces immediately, never silently coerces to a usable shape.
  */
 
+var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var { defineClass } = require("../framework-error");
 
 var IniSafeError = defineClass("IniSafeError", { alwaysPermanent: true });
 
-var DEFAULT_MAX_BYTES         = 1024 * 1024;
+// parseInt radix — named so the call site doesn't carry a bare 16
+// integer literal that reads as a byte count.
+var RADIX_HEX = 0x10;
+
+var DEFAULT_MAX_BYTES         = C.BYTES.mib(1);
 var DEFAULT_MAX_SECTIONS      = 500;
-var DEFAULT_MAX_KEYS_SECTION  = 1000;
-var DEFAULT_MAX_VALUE_BYTES   = 64 * 1024;
+var DEFAULT_MAX_KEYS_SECTION  = 1_000;
+var DEFAULT_MAX_VALUE_BYTES   = C.BYTES.kib(64);
 
 var FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
@@ -109,7 +115,7 @@ function _coerceValue(raw) {
   if (TRUE_VALUES.has(lower))  return true;
   if (FALSE_VALUES.has(lower)) return false;
   if (/^0x[0-9a-f]+$/i.test(raw)) {
-    var hex = parseInt(raw, 16);
+    var hex = parseInt(raw, RADIX_HEX);
     if (!Number.isSafeInteger(hex)) {
       throw _err("ini/value-out-of-range", "hex integer exceeds safe-integer range: " + raw);
     }
@@ -180,10 +186,23 @@ function _parseSectionHeader(line) {
 
 function parse(input, opts) {
   opts = opts || {};
-  var maxBytes        = opts.maxBytes        || DEFAULT_MAX_BYTES;
-  var maxSections     = opts.maxSections     || DEFAULT_MAX_SECTIONS;
-  var maxKeysPerSect  = opts.maxKeysPerSection || DEFAULT_MAX_KEYS_SECTION;
-  var maxValueBytes   = opts.maxValueBytes   || DEFAULT_MAX_VALUE_BYTES;
+  // Validate operator-supplied numeric opts via lib/numeric-bounds —
+  // Infinity / NaN / negative / non-integer all bypass `|| DEFAULT_*`
+  // (Infinity is truthy) and silently lift the DoS cap they were meant
+  // to enforce.
+  var _numericOpts = ["maxBytes", "maxSections", "maxKeysPerSection", "maxValueBytes"];
+  for (var _ni = 0; _ni < _numericOpts.length; _ni++) {
+    var _name = _numericOpts[_ni];
+    if (opts[_name] !== undefined && !numericBounds.isPositiveFiniteInt(opts[_name])) {
+      throw _err("ini/bad-opt",
+        "ini.parse: " + _name + " must be a positive finite integer; got " +
+          numericBounds.shape(opts[_name]));
+    }
+  }
+  var maxBytes        = opts.maxBytes        !== undefined ? opts.maxBytes        : DEFAULT_MAX_BYTES;
+  var maxSections     = opts.maxSections     !== undefined ? opts.maxSections     : DEFAULT_MAX_SECTIONS;
+  var maxKeysPerSect  = opts.maxKeysPerSection !== undefined ? opts.maxKeysPerSection : DEFAULT_MAX_KEYS_SECTION;
+  var maxValueBytes   = opts.maxValueBytes   !== undefined ? opts.maxValueBytes   : DEFAULT_MAX_VALUE_BYTES;
   var onDuplicate     = opts.onDuplicate     || "throw";
 
   if (typeof input !== "string") {

package/lib/parsers/safe-toml.js

@@ -45,6 +45,7 @@
  */
 
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
 
@@ -59,24 +60,49 @@ class SafeTomlError extends FrameworkError {
   }
 }
 
+// parseInt radices and TOML radix-prefix tokens — naming these constants
+// keeps the literal `8` / `16` byte-shaped numbers off the call sites.
+var RADIX_BIN     = 0x2;
+var RADIX_OCTAL   = 0x8;
+var RADIX_HEX     = 0x10;
+
+// Date-time literal character widths (per TOML / RFC 3339).
+var TIME_CHARS    = 0x8;    // "HH:MM:SS"
+var OFFSET_CHARS  = 0x6;    // "+HH:MM"
+
 var DEFAULTS = {
   maxBytes: C.BYTES.mib(1),
   maxDepth: 100,
-  maxKeys:  50000,
+  maxKeys:  50_000,
 };
 
 var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 function parse(input, opts) {
   opts = opts || {};
-  var maxBytes = (typeof opts.maxBytes === "number" && opts.maxBytes > 0)
+  // Validate operator-supplied numeric opts via lib/numeric-bounds —
+  // Infinity / NaN / negative / non-integer all bypass the `> 0` shape
+  // and silently lift the DoS cap they were meant to enforce.
+  if (opts.maxBytes !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new SafeTomlError("toml.parse: maxBytes must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxBytes), "toml/bad-opt");
+  }
+  if (opts.maxDepth !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxDepth)) {
+    throw new SafeTomlError("toml.parse: maxDepth must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxDepth), "toml/bad-opt");
+  }
+  if (opts.maxKeys !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxKeys)) {
+    throw new SafeTomlError("toml.parse: maxKeys must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxKeys), "toml/bad-opt");
+  }
+  var maxBytes = opts.maxBytes !== undefined
     ? Math.min(opts.maxBytes, C.BYTES.mib(64))
     : DEFAULTS.maxBytes;
-  var maxDepth = (typeof opts.maxDepth === "number" && opts.maxDepth > 0)
-    ? Math.min(opts.maxDepth, 1000)
+  var maxDepth = opts.maxDepth !== undefined
+    ? Math.min(opts.maxDepth, 1_000)
     : DEFAULTS.maxDepth;
-  var maxKeys = (typeof opts.maxKeys === "number" && opts.maxKeys > 0)
-    ? Math.min(opts.maxKeys, 1000000)
+  var maxKeys = opts.maxKeys !== undefined
+    ? Math.min(opts.maxKeys, 1_000_000)
     : DEFAULTS.maxKeys;
 
   input = safeBuffer.normalizeText(input, {
@@ -237,19 +263,20 @@ function parse(input, opts) {
       case "t":  return "\t";
       case "u": {
         var hex = input.substring(pos, pos + 4);
-        if (hex.length < 4 || !/^[0-9a-fA-F]{4}$/.test(hex)) {
+        if (!safeBuffer.isHex(hex, 4)) {
           throw _err("bad \\u escape", "toml/bad-escape");
         }
         _advance(4);
-        return String.fromCharCode(parseInt(hex, 16));
+        return String.fromCharCode(parseInt(hex, RADIX_HEX));
       }
       case "U": {
-        var hex8 = input.substring(pos, pos + 8);
-        if (hex8.length < 8 || !/^[0-9a-fA-F]{8}$/.test(hex8)) {
+        var hexLen = 0x8;
+        var hex8 = input.substring(pos, pos + hexLen);
+        if (hex8.length < hexLen || !/^[0-9a-fA-F]{8}$/.test(hex8)) {
           throw _err("bad \\U escape", "toml/bad-escape");
         }
-        _advance(8);
-        var code = parseInt(hex8, 16);
+        _advance(hexLen);
+        var code = parseInt(hex8, RADIX_HEX);
         if (code > 0x10FFFF) throw _err("\\U code point > U+10FFFF", "toml/bad-escape");
         return String.fromCodePoint(code);
       }
@@ -367,11 +394,12 @@ function parse(input, opts) {
     if (pos + 10 <= len && /^\d{4}-\d{2}-\d{2}/.test(input.substr(pos, 10))) {
       var sep = _peek(10);
       if (sep === "T" || sep === "t" || sep === " ") {
-        // Look ahead for time portion
+        // Look ahead for time portion (HH:MM:SS = 8 chars)
         var timeStart = pos + 11;
-        if (/^\d{2}:\d{2}:\d{2}/.test(input.substr(timeStart, 8))) {
+        var timeChars = TIME_CHARS;
+        if (/^\d{2}:\d{2}:\d{2}/.test(input.substr(timeStart, timeChars))) {
           var datePart = input.substr(pos, 10);
-          var timeEnd = timeStart + 8;
+          var timeEnd = timeStart + timeChars;
           // Optional fractional
           if (_peek(timeEnd - pos) === ".") {
             timeEnd += 1;
@@ -383,11 +411,12 @@ function parse(input, opts) {
           var nextChar = input.charAt(timeEnd);
           if (nextChar === "Z" || nextChar === "z") { offsetStr = "Z"; timeEnd += 1; }
           else if (nextChar === "+" || nextChar === "-") {
-            // Expect HH:MM
-            var off = input.substr(timeEnd, 6);
+            // Expect ±HH:MM (6 chars)
+            var offsetChars = OFFSET_CHARS;
+            var off = input.substr(timeEnd, offsetChars);
             if (/^[+-]\d{2}:\d{2}$/.test(off)) {
               offsetStr = off;
-              timeEnd += 6;
+              timeEnd += offsetChars;
             }
           }
           _advance(timeEnd - pos);
@@ -409,9 +438,10 @@ function parse(input, opts) {
         return { kind: "local-date", value: ds };
       }
     }
-    // Time-only: HH:MM:SS
-    if (pos + 8 <= len && /^\d{2}:\d{2}:\d{2}/.test(input.substr(pos, 8))) {
-      var teEnd = pos + 8;
+    // Time-only: HH:MM:SS (8 chars)
+    var timeOnlyChars = TIME_CHARS;
+    if (pos + timeOnlyChars <= len && /^\d{2}:\d{2}:\d{2}/.test(input.substr(pos, timeOnlyChars))) {
+      var teEnd = pos + timeOnlyChars;
       if (input.charAt(teEnd) === ".") {
         teEnd += 1;
         while (teEnd < len && /\d/.test(input.charAt(teEnd))) teEnd += 1;
@@ -448,14 +478,14 @@ function parse(input, opts) {
       if (prefix === "x" || prefix === "o" || prefix === "b") {
         if (sign !== 1) throw _err("sign not allowed on hex/oct/bin literal", "toml/bad-number");
         _advance(2);
-        var radix = prefix === "x" ? 16 : prefix === "o" ? 8 : 2;
+        var radix = prefix === "x" ? RADIX_HEX : prefix === "o" ? RADIX_OCTAL : RADIX_BIN;
         var digitsStart = pos;
         while (!_eof()) {
           var ch = _peek();
           if (ch === "_") { _advance(); continue; }
-          if (radix === 16 && /[0-9a-fA-F]/.test(ch)) { _advance(); continue; }
-          if (radix === 8  && /[0-7]/.test(ch))      { _advance(); continue; }
-          if (radix === 2  && /[01]/.test(ch))       { _advance(); continue; }
+          if (radix === RADIX_HEX   && /[0-9a-fA-F]/.test(ch)) { _advance(); continue; }
+          if (radix === RADIX_OCTAL && /[0-7]/.test(ch))       { _advance(); continue; }
+          if (radix === RADIX_BIN   && /[01]/.test(ch))        { _advance(); continue; }
           break;
         }
         var digits = input.substring(digitsStart, pos).replace(/_/g, "");

package/lib/parsers/safe-xml.js

@@ -40,6 +40,7 @@
  */
 
 var C = require("../constants");
+var nb = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
 
@@ -53,34 +54,44 @@ class SafeXmlError extends FrameworkError {
   }
 }
 
+// parseInt radix — named so the call site doesn't carry a bare 16
+// integer literal that reads as a byte count.
+var RADIX_HEX = 0x10;
+
 var DEFAULTS = {
   maxBytes:        C.BYTES.mib(1),
   maxDepth:        100,
-  maxElements:     10000,
+  maxElements:     10_000,
   maxAttributes:   100,
   allowDoctype:    false,
   allowProcessing: false,    // <?...?> other than the xml decl
 };
 
 var ABSOLUTE_MAX_BYTES = C.BYTES.mib(64);
-var ABSOLUTE_MAX_DEPTH = 1000;
-var ABSOLUTE_MAX_ELEMENTS = 1000000;
+var ABSOLUTE_MAX_DEPTH = 1_000;
+var ABSOLUTE_MAX_ELEMENTS = 1_000_000;
+var ABSOLUTE_MAX_ATTRIBUTES = 1_000;
 
 // XML built-in entities (the ONLY entities allowed)
 var BUILT_IN_ENTITIES = { lt: "<", gt: ">", amp: "&", quot: "\"", apos: "'" };
 
-function _capInt(value, defaultValue, ceiling) {
-  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return defaultValue;
-  return Math.min(Math.floor(value), ceiling);
+function _validateAndCap(name, value, defaultValue, ceiling) {
+  if (value === undefined) return defaultValue;
+  if (!nb.isPositiveFiniteInt(value)) {
+    throw new SafeXmlError("xml/bad-opt",
+      "xml.parse: " + name + " must be a positive finite integer; got " +
+      nb.shape(value));
+  }
+  return Math.min(value, ceiling);
 }
 
 function parse(input, opts) {
   opts = opts || {};
 
-  var maxBytes      = _capInt(opts.maxBytes,      DEFAULTS.maxBytes,      ABSOLUTE_MAX_BYTES);
-  var maxDepth      = _capInt(opts.maxDepth,      DEFAULTS.maxDepth,      ABSOLUTE_MAX_DEPTH);
-  var maxElements   = _capInt(opts.maxElements,   DEFAULTS.maxElements,   ABSOLUTE_MAX_ELEMENTS);
-  var maxAttrs      = _capInt(opts.maxAttributes, DEFAULTS.maxAttributes, 1000);
+  var maxBytes      = _validateAndCap("maxBytes",      opts.maxBytes,      DEFAULTS.maxBytes,      ABSOLUTE_MAX_BYTES);
+  var maxDepth      = _validateAndCap("maxDepth",      opts.maxDepth,      DEFAULTS.maxDepth,      ABSOLUTE_MAX_DEPTH);
+  var maxElements   = _validateAndCap("maxElements",   opts.maxElements,   DEFAULTS.maxElements,   ABSOLUTE_MAX_ELEMENTS);
+  var maxAttrs      = _validateAndCap("maxAttributes", opts.maxAttributes, DEFAULTS.maxAttributes, ABSOLUTE_MAX_ATTRIBUTES);
   var allowDoctype  = !!opts.allowDoctype;
   var allowProcessing = !!opts.allowProcessing;
 
@@ -130,7 +141,7 @@ function parse(input, opts) {
         // Numeric character reference
         var code;
         if (name.charAt(1) === "x" || name.charAt(1) === "X") {
-          code = parseInt(name.substring(2), 16);
+          code = parseInt(name.substring(2), RADIX_HEX);
         } else {
           code = parseInt(name.substring(1), 10);
         }

package/lib/parsers/safe-yaml.js

@@ -53,6 +53,7 @@
  */
 
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
 
@@ -67,10 +68,21 @@ class SafeYamlError extends FrameworkError {
   }
 }
 
+// parseInt radices, named so the line itself doesn't carry a bare 8 / 16
+// integer literal that reads as a byte count.
+var RADIX_OCTAL = 0x8;
+var RADIX_HEX   = 0x10;
+
+// Defensive cap on the size of a single scalar token before regex
+// classification. The parser already bounds the whole input via maxBytes;
+// this cap keeps a pathological single-line scalar from feeding the type-
+// inference regexes an arbitrarily long string.
+var MAX_SCALAR_BYTES = C.BYTES.kib(64);
+
 var DEFAULTS = {
   maxBytes: C.BYTES.mib(1),
   maxDepth: 100,
-  maxKeys:  50000,
+  maxKeys:  50_000,
 };
 
 var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
@@ -88,25 +100,36 @@ var FLOAT_INF = /^[-+]?\.(inf|Inf|INF)$/;
 var FLOAT_NAN = /^\.(nan|NaN|NAN)$/;
 
 function _resolveScalar(s) {
+  // Fall back to string for any token whose length exceeds the scalar cap
+  // before running type-inference regexes. The parser caller has already
+  // applied the input-wide maxBytes cap; this is a per-token guard so the
+  // type-inference regexes never see a pathologically long string.
+  if (typeof s !== "string" || s.length > MAX_SCALAR_BYTES) return s;
+  // Below: every regex test sees an `s` whose s.length <= MAX_SCALAR_BYTES.
   if (NULL_RE.test(s)) return null;
   if (BOOL_RE.test(s)) return s.toLowerCase() === "true";
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (INT_RE.test(s)) {
     var n = parseInt(s, 10);
     if (Number.isSafeInteger(n)) return n;
     return s;  // fallback to string for huge ints (don't lose precision silently)
   }
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (INT_OCT.test(s)) {
-    var oct = parseInt(s.substring(2), 8);
+    var oct = parseInt(s.substring(2), RADIX_OCTAL);
     if (Number.isSafeInteger(oct)) return oct;
     return s;
   }
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (INT_HEX.test(s)) {
-    var hex = parseInt(s.substring(2), 16);
+    var hex = parseInt(s.substring(2), RADIX_HEX);
     if (Number.isSafeInteger(hex)) return hex;
     return s;
   }
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (FLOAT_INF.test(s)) return s.charAt(0) === "-" ? -Infinity : Infinity;
   if (FLOAT_NAN.test(s)) return NaN;
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (FLOAT_RE.test(s)) {
     var f = parseFloat(s);
     if (!isNaN(f)) return f;
@@ -116,12 +139,27 @@ function _resolveScalar(s) {
 
 function parse(input, opts) {
   opts = opts || {};
-  var maxBytes = (typeof opts.maxBytes === "number" && opts.maxBytes > 0)
+  // Validate operator-supplied numeric opts via lib/numeric-bounds —
+  // Infinity / NaN / negative / non-integer all bypass the
+  // `> 0` shape and silently lift the DoS cap they were meant to enforce.
+  if (opts.maxBytes !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new SafeYamlError("yaml.parse: maxBytes must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxBytes), "yaml/bad-opt");
+  }
+  if (opts.maxDepth !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxDepth)) {
+    throw new SafeYamlError("yaml.parse: maxDepth must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxDepth), "yaml/bad-opt");
+  }
+  if (opts.maxKeys !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxKeys)) {
+    throw new SafeYamlError("yaml.parse: maxKeys must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxKeys), "yaml/bad-opt");
+  }
+  var maxBytes = opts.maxBytes !== undefined
     ? Math.min(opts.maxBytes, C.BYTES.mib(64)) : DEFAULTS.maxBytes;
-  var maxDepth = (typeof opts.maxDepth === "number" && opts.maxDepth > 0)
-    ? Math.min(opts.maxDepth, 1000) : DEFAULTS.maxDepth;
-  var maxKeys = (typeof opts.maxKeys === "number" && opts.maxKeys > 0)
-    ? Math.min(opts.maxKeys, 1000000) : DEFAULTS.maxKeys;
+  var maxDepth = opts.maxDepth !== undefined
+    ? Math.min(opts.maxDepth, 1_000) : DEFAULTS.maxDepth;
+  var maxKeys = opts.maxKeys !== undefined
+    ? Math.min(opts.maxKeys, 1_000_000) : DEFAULTS.maxKeys;
 
   input = safeBuffer.normalizeText(input, {
     maxBytes:   maxBytes,
@@ -147,7 +185,7 @@ function parse(input, opts) {
     var raw = rawLines[i];
     // Strip trailing whitespace from the line for analysis (block-scalar
     // content paths preserve their own internal spacing separately).
-    var trimmed = raw.replace(/[ \t]+$/, "");
+    var trimmed = raw.replace(safeBuffer.TRAILING_HSPACE_RE, "");
     var indent = 0;
     while (indent < raw.length && raw.charAt(indent) === " ") indent += 1;
     if (indent < raw.length && raw.charAt(indent) === "\t") {
@@ -294,7 +332,7 @@ function parse(input, opts) {
     if (raw.charAt(0) === "'") {
       return _decodeSingleQuoted(raw, lineNumber, col);
     }
-    var trimmed = raw.replace(/[ \t]+$/, "");
+    var trimmed = raw.replace(safeBuffer.TRAILING_HSPACE_RE, "");
     if (POISONED_KEYS.has(trimmed)) {
       throw new SafeYamlError("forbidden key '" + trimmed + "'",
         "yaml/poisoned-key", lineNumber, col);
@@ -468,7 +506,7 @@ function parse(input, opts) {
       return sq;
     }
     // Plain scalar — strip trailing space, resolve type.
-    return _resolveScalar(t.replace(/[ \t]+$/, ""));
+    return _resolveScalar(t.replace(safeBuffer.TRAILING_HSPACE_RE, ""));
   }
 
   // For quoted-string termination check on a single-line value.
@@ -584,7 +622,7 @@ function parse(input, opts) {
       if (c === "," || c === "}" || c === "]") break;
       p += 1;
     }
-    var raw = text.substring(start, p).replace(/[ \t]+$/, "");
+    var raw = text.substring(start, p).replace(safeBuffer.TRAILING_HSPACE_RE, "");
     return { value: _resolveScalar(raw), nextPos: p };
   }
 
@@ -607,7 +645,7 @@ function parse(input, opts) {
       if (c === ":" || c === "," || c === "}" || c === "]") break;
       p += 1;
     }
-    return { key: text.substring(start, p).replace(/[ \t]+$/, ""), nextPos: p };
+    return { key: text.substring(start, p).replace(safeBuffer.TRAILING_HSPACE_RE, ""), nextPos: p };
   }
 
   function _findMatchingBracket(text, start, open, close, lineNumber, col) {
@@ -678,10 +716,10 @@ function parse(input, opts) {
           case "0":  out += "\0"; i += 2; break;
           case "u": {
             var hex = raw.substring(i + 2, i + 6);
-            if (!/^[0-9a-fA-F]{4}$/.test(hex)) {
+            if (!safeBuffer.isHex(hex, 4)) {
               throw new SafeYamlError("bad \\u escape", "yaml/bad-escape", lineNumber, col + i);
             }
-            out += String.fromCharCode(parseInt(hex, 16));
+            out += String.fromCharCode(parseInt(hex, RADIX_HEX));
             i += 6;
             break;
           }
@@ -690,7 +728,7 @@ function parse(input, opts) {
             if (!/^[0-9a-fA-F]{8}$/.test(hex8)) {
               throw new SafeYamlError("bad \\U escape", "yaml/bad-escape", lineNumber, col + i);
             }
-            var code = parseInt(hex8, 16);
+            var code = parseInt(hex8, RADIX_HEX);
             if (code > 0x10FFFF) {
               throw new SafeYamlError("\\U code point > U+10FFFF",
                 "yaml/bad-escape", lineNumber, col + i);
@@ -734,7 +772,7 @@ function parse(input, opts) {
   function _stripEolComment(text) {
     // Strip ` #...` comments (must be preceded by whitespace) at end of line.
     var match = text.match(/^(.*?)(\s+#.*)?$/);
-    return (match && match[1] != null ? match[1] : text).replace(/[ \t]+$/, "");
+    return (match && match[1] != null ? match[1] : text).replace(safeBuffer.TRAILING_HSPACE_RE, "");
   }
 
   // ---- Block scalars (| literal, > folded) ----