@blamejs/core 0.6.69 → 0.7.0

package/lib/router.js

@@ -23,14 +23,22 @@ var http  = require("http");
 var http2 = require("http2");
 var fs = require("fs");
 var path = require("path");
-var { URL } = require("url");
 var C = require("./constants");
+var requestHelpers = require("./request-helpers");
 var safeAsync = require("./safe-async");
 var safeEnv = require("./parsers/safe-env");
+var safeUrl = require("./safe-url");
 var websocket = require("./websocket");
 var { boot } = require("./log");
 
 var log = boot("router");
+var HTTP_STATUS = requestHelpers.HTTP_STATUS;
+
+// Cap on operator-defined route patterns. A route registration that
+// somehow attracts a multi-megabyte template string would stall regex
+// compilation; bound it before new RegExp() so the gate at registration
+// time is bounded.
+var MAX_ROUTE_PATTERN_LEN = C.BYTES.kib(1);
 
 // ---- Schema-spec helpers (route-level body/query/params validation) ----
 
@@ -76,7 +84,7 @@ function _writeValidationError(res, where, errors) {
     where: where,
     issues: errors,
   });
-  res.writeHead(400, {
+  res.writeHead(HTTP_STATUS.BAD_REQUEST, {
     "Content-Type":   "application/json; charset=utf-8",
     "Content-Length": Buffer.byteLength(body),
   });
@@ -141,11 +149,67 @@ function _makeResponseValidator(spec) {
 }
 
 function compilePattern(pattern) {
+  // pattern is operator-supplied at route registration (router.get(...)).
+  // Cap length up-front to bound matcher work even against pathological
+  // operator config.
+  if (typeof pattern !== "string" || pattern.length === 0) {
+    throw new Error("router: pattern must be a non-empty string");
+  }
+  if (pattern.length > MAX_ROUTE_PATTERN_LEN) {
+    throw new Error("router: pattern exceeds " + MAX_ROUTE_PATTERN_LEN +
+      " chars (got " + pattern.length + ")");
+  }
+  // Segment-based matcher — splits on "/" once at registration time and
+  // walks token-by-token at match time. Avoids compiling a RegExp from
+  // the operator-supplied pattern (which would be a dynamic-regex /
+  // ReDoS shape even though pattern is operator-controlled).
+  //
+  // Each segment is either:
+  //   - a literal (e.g. "users", "v1")
+  //   - a named parameter ":id" — captures into params[name]
+  //
+  // Matching is exact on segment count: "/a/b" does not match "/a/b/c".
+  var rawSegments = pattern.split("/");
+  var segments = [];
   var keys = [];
-  var regexStr = pattern
-    .replace(/:([^/]+)/g, function (_, key) { keys.push(key); return "([^/]+)"; })
-    .replace(/\//g, "\\/");
-  return { pattern: pattern, regex: new RegExp("^" + regexStr + "$"), keys: keys };
+  for (var si = 0; si < rawSegments.length; si++) {
+    var seg = rawSegments[si];
+    if (seg.length > 0 && seg.charAt(0) === ":") {
+      var key = seg.slice(1);
+      if (key.length === 0) {
+        throw new Error("router: pattern '" + pattern +
+          "' has an empty parameter name (':' segment)");
+      }
+      keys.push(key);
+      segments.push({ literal: false, key: key });
+    } else {
+      segments.push({ literal: true, value: seg });
+    }
+  }
+  return { pattern: pattern, segments: segments, keys: keys };
+}
+
+// Walk a request path against a compiled pattern. Returns the params
+// object on match, null otherwise. Single non-empty trailing slash
+// difference is treated as a no-match (callers that want trailing-slash
+// tolerance normalize the path before dispatch).
+function _matchCompiled(compiled, pathname) {
+  var pathSegments = pathname.split("/");
+  var patSegments = compiled.segments;
+  if (pathSegments.length !== patSegments.length) return null;
+  var params = {};
+  for (var i = 0; i < patSegments.length; i++) {
+    var seg = patSegments[i];
+    if (seg.literal) {
+      if (pathSegments[i] !== seg.value) return null;
+    } else {
+      // Named param: must be non-empty (mirrors the regex `[^/]+`
+      // capture from the previous compiled regex).
+      if (pathSegments[i].length === 0) return null;
+      params[seg.key] = pathSegments[i];
+    }
+  }
+  return params;
 }
 
 var MIME_TYPES = {
@@ -208,7 +272,7 @@ class Router {
 
     var closes = conns.map(function (conn) {
       return new Promise(function (resolve) {
-        if (conn.readyState === "closed") return resolve();
+        if (conn.readyState === "closed") { resolve(); return; }
         conn.once("close", resolve);
         try { conn.close(code, reason); }
         catch (_e) {
@@ -230,7 +294,7 @@ class Router {
     // timeout and they didn't ack. The operator chose timeoutMs; honor it.
     this._activeWsConns.forEach(function (conn) {
       try { if (conn.socket && conn.socket.destroy) conn.socket.destroy(); }
-      catch (_e) {}
+      catch (_e) { /* socket already destroyed */ }
     });
     return conns.length;
   }
@@ -432,15 +496,18 @@ class Router {
   }
 
   _match(route, pathname) {
-    var match = pathname.match(route.regex);
-    if (!match) return null;
-    var params = {};
-    route.keys.forEach((key, i) => (params[key] = match[i + 1]));
-    return params;
+    return _matchCompiled(route, pathname);
   }
 
   async handle(req, res) {
-    var parsed = new URL(req.url, "http://" + req.headers.host);
+    // Compose an absolute URL from the request's path + Host header so
+    // safeUrl.parse can validate the protocol + length. The "http://"
+    // base is the relative-resolution origin; the request's actual
+    // scheme lives in requestHelpers.requestProtocol elsewhere.
+    var absolute = "http://" + (req.headers.host || "localhost") + (req.url || "/");
+    var parsed = safeUrl.parse(absolute, {
+      allowedProtocols: safeUrl.ALLOW_HTTP_ALL,
+    });
     req.pathname = parsed.pathname;
     req.query = Object.fromEntries(parsed.searchParams);
 
@@ -450,8 +517,9 @@ class Router {
       try {
         await mw(req, res, () => (next = true));
       } catch (mwErr) {
-        console.error("[middleware error]", mw.name || "anonymous", req.method, req.url, mwErr.message,
-          mwErr.stack ? mwErr.stack.split("\n").slice(0, 3).join(" | ") : "");
+        log.error("middleware error: " + (mw.name || "anonymous") + " " +
+          req.method + " " + req.url + " " + mwErr.message + " " +
+          (mwErr.stack ? mwErr.stack.split("\n").slice(0, 3).join(" | ") : ""));
         throw mwErr;
       }
       if (!next || res.writableEnded) return;
@@ -486,7 +554,7 @@ class Router {
     if (this.notFoundHandler) {
       this.notFoundHandler(req, res);
     } else {
-      res.writeHead(404, { "Content-Type": "text/html" });
+      res.writeHead(HTTP_STATUS.NOT_FOUND, { "Content-Type": "text/html" });
       res.end("<h1>404 Not Found</h1>");
     }
   }
@@ -515,7 +583,7 @@ class Router {
     var requestHandler = (req, res) => {
       // Response helpers
       res.json = (data) => {
-        res.writeHead(res.statusCode || 200, { "Content-Type": "application/json" });
+        res.writeHead(res.statusCode || HTTP_STATUS.OK, { "Content-Type": "application/json" });
         res.end(JSON.stringify(data));
       };
       res.redirect = (url) => {
@@ -525,6 +593,7 @@ class Router {
         if (typeof url === "string" && url.startsWith("/") && !url.startsWith("//")) {
           safe = url;
         }
+        // 302 Found — RFC 7231 §6.4.3. Not in HTTP_STATUS table.
         res.writeHead(302, { Location: safe });
         res.end();
       };
@@ -534,17 +603,17 @@ class Router {
       };
 
       self.handle(req, res).catch((err) => {
-        console.error("[route error]", req.method, req.url, err.message,
-          err.stack ? err.stack.split("\n").slice(0, 5).join(" | ") : "");
+        log.error("route error: " + req.method + " " + req.url + " " + err.message + " " +
+          (err.stack ? err.stack.split("\n").slice(0, 5).join(" | ") : ""));
         if (self.errorHandler) {
           try { self.errorHandler(err, req, res); } catch (_) {
             if (!res.writableEnded) {
-              res.writeHead(500, { "Content-Type": "text/plain" });
+              res.writeHead(HTTP_STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain" });
               res.end("Internal Server Error");
             }
           }
         } else if (!res.writableEnded) {
-          res.writeHead(500, { "Content-Type": "text/plain" });
+          res.writeHead(HTTP_STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain" });
           res.end("Internal Server Error");
         }
       });
@@ -594,8 +663,8 @@ class Router {
             "Content-Length: " + Buffer.byteLength(body, "utf8") + "\r\n" +
             "\r\n" +
             body;
-          try { socket.write(resp); } catch (_e) {}
-          try { socket.destroy(); } catch (_e) {}
+          try { socket.write(resp); } catch (_e) { /* socket already closed */ }
+          try { socket.destroy(); } catch (_e) { /* socket already destroyed */ }
           return;
         }
         var conn = websocket.handleUpgrade(req, socket, head, route.opts);
@@ -618,14 +687,14 @@ class Router {
           var pathname = String(headers[":path"] || "/").split("?")[0];
           var route = self._wsRoutes.get(pathname);
           if (!route) {
-            try { stream.respond({ ":status": 404 }); stream.end(); } catch (_e) {}
+            try { stream.respond({ ":status": 404 }); stream.end(); } catch (_e) { /* stream already closed */ }
             return;
           }
           if (route.transport === "h1-only") {
             try {
               stream.respond({ ":status": 405, "content-type": "text/plain; charset=utf-8" });
               stream.end("WebSocket on this path requires HTTP/1.1 Upgrade");
-            } catch (_e) {}
+            } catch (_e) { /* stream already closed */ }
             return;
           }
           var conn = websocket.handleExtendedConnect(stream, headers, route.opts);
@@ -664,7 +733,7 @@ function serveStatic(dir) {
     var cacheControl = hasVersion
       ? "public, max-age=31536000, immutable"
       : "public, max-age=3600";
-    res.writeHead(200, {
+    res.writeHead(HTTP_STATUS.OK, {
       "Content-Type":   mime,
       "Content-Length": stat.size,
       "Cache-Control":  cacheControl,

package/lib/safe-async.js

@@ -9,6 +9,15 @@
  * results from operator-supplied drivers. This module collects the
  * primitives the framework uses to handle those hazards consistently.
  *
+ * Surface includes:
+ *   - Async coordination: withTimeout, withSignal, sleep, repeating,
+ *     flushLoop, safeAwait, asyncRetry
+ *   - Async state objects: Mutex, Semaphore, Once, CircuitBreaker
+ *   - Sync helpers used by async pipelines: safeInvoke (callback
+ *     wrapper with optional onError), makeDropCallback (factory for
+ *     log-stream-style onDrop callbacks), makeScheduledFlush
+ *     (idempotent setTimeout coalesce-and-flush helper)
+ *
  * Design posture:
  *
  *   - **AbortSignal everywhere.** Every primitive that takes time
@@ -296,6 +305,85 @@ async function safeAwait(promise) {
   }
 }
 
+// safeInvoke — call an operator-supplied callback with one payload arg.
+// Drops silent if the callback is missing; routes throws to onError if
+// supplied (also drop-silent if onError throws). The callback / onError
+// pair is the shape every drop-callback / completion-callback /
+// failure-callback site re-derives from scratch. Centralizing here so
+// the contract is one definition.
+//
+//   safeInvoke(opts.onDrop, { reason: "buffer-full", batch: rows },
+//              function (e) { log.warn("onDrop threw: " + e.message); });
+function safeInvoke(callback, payload, onError) {
+  if (typeof callback !== "function") return;
+  try { callback(payload); }
+  catch (e) {
+    if (typeof onError === "function") {
+      try { onError(e); } catch (_e2) { /* nested error handler must not bubble */ }
+    }
+  }
+}
+
+// makeDropCallback — every log-stream sink (cloudwatch / otlp-grpc /
+// otlp-http / syslog / webhook) previously defined its own
+// `_emitDrop(reason, batch, err)` 3-line wrapper. The shape is
+// identical across sinks; the only differences are the operator's
+// onDrop callback and the per-sink error logger. Returns a closure with
+// the canonical payload shape `{ reason, batch, error: err || null }`.
+//
+//   var _emitDrop = safeAsync.makeDropCallback(onDrop,
+//     function (e) { log.warn("onDrop-callback-failed: " + e.message); });
+//   _emitDrop("buffer-full", batch, err);
+function makeDropCallback(onDrop, onError) {
+  return function (reason, batch, err) {
+    safeInvoke(onDrop, { reason: reason, batch: batch, error: err || null }, onError);
+  };
+}
+
+// makeScheduledFlush — idempotent setTimeout scheduler used by every
+// log-stream sink (cloudwatch / otlp-grpc / otlp-http / syslog /
+// webhook) to coalesce buffered writes. Each sink previously rolled
+// its own:
+//
+//   var flushTimer = null;
+//   function _scheduleFlush() {
+//     if (flushTimer) return;
+//     flushTimer = setTimeout(function () { flushTimer = null; _flush(); }, delayMs);
+//     flushTimer.unref();
+//   }
+//
+// Returns { schedule, cancel, isPending }. flushFn may be sync or
+// async — async rejections are swallowed (best-effort sink — operators
+// see drops via onDrop, not via a sea of unhandled promise rejections).
+function makeScheduledFlush(delayMs, flushFn) {
+  if (typeof delayMs !== "number" || !isFinite(delayMs) || delayMs < 0) {
+    throw new TypeError("safeAsync.makeScheduledFlush: delayMs must be a non-negative finite number");
+  }
+  if (typeof flushFn !== "function") {
+    throw new TypeError("safeAsync.makeScheduledFlush: flushFn must be a function");
+  }
+  var timer = null;
+  return {
+    schedule: function () {
+      if (timer) return;
+      timer = setTimeout(function () {
+        timer = null;
+        var p;
+        try { p = flushFn(); }
+        catch (_e) { return; }
+        if (p && typeof p.catch === "function") {
+          p.catch(function () { /* sink-specific drains errors via onDrop */ });
+        }
+      }, delayMs);
+      if (timer && typeof timer.unref === "function") timer.unref();
+    },
+    cancel: function () {
+      if (timer) { clearTimeout(timer); timer = null; }
+    },
+    isPending: function () { return timer !== null; },
+  };
+}
+
 // ---- Mutex ----
 //
 // Async mutex — only one async region holds the lock at a time. Acquirers
@@ -531,17 +619,19 @@ function repeating(fn, intervalMs, opts) {
   var onError = typeof opts.onError === "function" ? opts.onError : null;
 
   var stopped = false;
-  var timer = setInterval(function () {
+  function _tick() {
     if (stopped) return;
     var result;
-    try { result = fn(); }
-    catch (e) { if (onError) { try { onError(e); } catch (_e) { /* swallow */ } } return; }
+    try { result = fn(); } catch (e) {
+      if (onError) { try { onError(e); } catch (_e) { /* swallow */ } } return;
+    }
     if (result && typeof result.then === "function") {
       result.then(null, function (e) {
         if (onError) { try { onError(e); } catch (_e) { /* swallow */ } }
       });
     }
-  }, intervalMs);
+  }
+  var timer = setInterval(_tick, intervalMs);
   if (unref && typeof timer.unref === "function") timer.unref();
 
   return {
@@ -633,6 +723,9 @@ module.exports = {
   repeating:          repeating,
   flushLoop:          flushLoop,
   safeAwait:          safeAwait,
+  safeInvoke:         safeInvoke,
+  makeDropCallback:   makeDropCallback,
+  makeScheduledFlush: makeScheduledFlush,
   Mutex:              Mutex,
   Semaphore:          Semaphore,
   Once:               Once,

package/lib/safe-buffer.js

@@ -181,10 +181,57 @@ function secureZero(buf) {
   }
 }
 
+// ---- Shared regexes for byte-shape predicates ----
+//
+// HEX_RE matches a non-empty all-hex string of any length (used by
+// digest comparisons, manifest checksums, X.509 serials). Length is
+// caller-bounded: pass the expected length explicitly when the protocol
+// fixes it (SHA3-512 → 128 hex chars, SHA-256 → 64, etc.). The regex
+// itself does NOT bound length — that's the caller's contract.
+var HEX_RE = /^[0-9a-fA-F]+$/;
+
+// CRLF_RE matches any control character used in HTTP-header / SMTP-
+// envelope injection attacks. Header values that contain CR or LF must
+// be rejected before serialization.
+var CRLF_RE = /[\r\n]/;
+var CRLF_RE_GLOBAL = /[\r\n]/g;   // for `.replace` strip use
+
+// Trailing horizontal-whitespace strip — used by DKIM canonicalization
+// (RFC 6376), .env / YAML scalar parsers, and any text-processing
+// site that needs the "rstrip" semantic. Spaces and tabs only;
+// callers that want CR/LF stripped use stripCrlf.
+var TRAILING_HSPACE_RE = /[ \t]+$/;
+function stripTrailingHspace(s) {
+  if (typeof s !== "string") return s;
+  return s.replace(TRAILING_HSPACE_RE, "");
+}
+
+function isHex(s, expectedLength) {
+  if (typeof s !== "string") return false;
+  if (typeof expectedLength === "number" && s.length !== expectedLength) return false;
+  return HEX_RE.test(s);
+}
+
+function hasCrlf(s) {
+  return typeof s === "string" && CRLF_RE.test(s);
+}
+
+function stripCrlf(s, replacement) {
+  if (typeof s !== "string") return s;
+  return s.replace(CRLF_RE_GLOBAL, replacement === undefined ? "" : replacement);
+}
+
 module.exports = {
   normalizeText:         normalizeText,
   toBuffer:              toBuffer,
   boundedChunkCollector: boundedChunkCollector,
   secureZero:            secureZero,
+  isHex:                 isHex,
+  hasCrlf:               hasCrlf,
+  stripCrlf:             stripCrlf,
+  stripTrailingHspace:   stripTrailingHspace,
+  HEX_RE:                HEX_RE,
+  CRLF_RE:               CRLF_RE,
+  TRAILING_HSPACE_RE:    TRAILING_HSPACE_RE,
   SafeBufferError:       SafeBufferError,
 };

package/lib/safe-json.js

@@ -64,6 +64,8 @@
 
 var C = require("./constants");
 var safeBuffer = require("./safe-buffer");
+var safeUrl = require("./safe-url");
+var time = require("./time");
 var { FrameworkError } = require("./framework-error");
 
 class SafeJsonError extends FrameworkError {
@@ -77,7 +79,11 @@ class SafeJsonError extends FrameworkError {
 }
 
 var ABSOLUTE_MAX_BYTES = C.BYTES.mib(64);
-var ABSOLUTE_MAX_DEPTH = 1000;
+var ABSOLUTE_MAX_DEPTH = 1_000;
+
+// IPv6 has 8 16-bit hextets per RFC 4291; named so the call sites in
+// formats.ipv6 don't carry a bare 8 integer literal.
+var IPV6_HEXTET_COUNT = 0x8;
 var DEFAULT_MAX_BYTES = C.BYTES.mib(1);
 var DEFAULT_MAX_DEPTH = 100;
 
@@ -278,11 +284,13 @@ var formats = {
     return typeof v === "string" && v.length <= 254 &&
       /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v);
   },
-  // URL must parse via WHATWG URL and use http(s)/ws(s)/file/data — adjust per app
+  // URL must parse via WHATWG URL and use http(s)/ws(s) — adjust per app
   url: function (v) {
     if (typeof v !== "string") return false;
-    try { var u = new URL(v); return ["http:", "https:", "ws:", "wss:"].indexOf(u.protocol) !== -1; }
-    catch (_e) { return false; }
+    try {
+      var u = safeUrl.parse(v, { allowedProtocols: ["http:", "https:", "ws:", "wss:"] });
+      return !!u;
+    } catch (_e) { return false; }
   },
   uuid: function (v) {
     return typeof v === "string" &&
@@ -300,7 +308,8 @@ var formats = {
   "iso8601-datetime": function (v) {
     if (typeof v !== "string") return false;
     var d = new Date(v);
-    return !isNaN(d.getTime()) && d.toISOString().replace(/\.\d{3}Z$/, "Z") === v.replace(/\.\d{3}Z$/, "Z");
+    return !isNaN(d.getTime()) &&
+           d.toISOString().replace(time.ISO_MS_RE, "Z") === v.replace(time.ISO_MS_RE, "Z");
   },
   ipv4: function (v) {
     if (typeof v !== "string") return false;
@@ -353,10 +362,10 @@ var formats = {
     var totalParts = leftParts.length + rightParts.length;
     if (hasDouble) {
       // Compressed form must replace AT LEAST ONE missing group (otherwise
-      // it would be a redundant ::), so total < 8 is required.
-      if (totalParts >= 8) return false;
+      // it would be a redundant ::), so total < IPV6_HEXTET_COUNT is required.
+      if (totalParts >= IPV6_HEXTET_COUNT) return false;
     } else {
-      if (totalParts !== 8) return false;
+      if (totalParts !== IPV6_HEXTET_COUNT) return false;
     }
 
     var all = leftParts.concat(rightParts);
@@ -366,7 +375,7 @@ var formats = {
     return true;
   },
   ip: function (v) { return formats.ipv4(v) || formats.ipv6(v); },
-  hex: function (v) { return typeof v === "string" && /^[0-9a-fA-F]+$/.test(v); },
+  hex: function (v) { return safeBuffer.isHex(v); },
   // Generic non-empty token: alphanumeric + a few safe punctuation
   slug: function (v) { return typeof v === "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(v); },
 };

package/lib/safe-schema.js

@@ -109,9 +109,26 @@
  *   so the two stay distinct rather than one wrapping the other.
  */
 
+var C = require("./constants");
 var safeJson = require("./safe-json");
 var { defineClass } = require("./framework-error");
 
+// Maximum URL length per RFC 7230 §3.1.1 guidance — also reused as the
+// Base64 length cap (no protocol-fixed bound; this matches .url()).
+var URL_MAX_LEN = C.BYTES.kib(8);
+
+// Per-format defensive length caps. Each named-format regex below runs
+// only after the input is bounded by these caps so a hostile payload
+// can't drive the regex engine with an arbitrarily long string. Caps
+// are deliberately not multiples of 8 — these are character-count
+// bounds, not memory sizes, so C.BYTES.* helpers don't apply.
+var EMAIL_MAX_LEN    = 254;   // RFC 5321 §4.5.3.1.3 forward-path bound
+var UUID_MAX_LEN     = 50;    // RFC 4122 UUID is 36 chars; slack for whitespace edge cases
+var DATE_MAX_LEN     = 30;    // YYYY-MM-DD is 10 chars
+var DATETIME_MAX_LEN = 100;   // ISO-8601 with offset + fractional seconds tops near 35
+var CUID_MAX_LEN     = 50;    // CUID v1/v2 is 25 chars
+var ULID_MAX_LEN     = 50;    // ULID is exactly 26 chars
+
 var SafeSchemaError = defineClass("SafeSchemaError", { alwaysPermanent: true });
 
 // Prototype-pollution defense — these key names are rejected in object
@@ -411,10 +428,8 @@ function _stringMethods(schema, spec) {
       // unbounded string columns, log lines, etc.). Operators with a
       // legitimate non-RFC reason for longer emails skip .email() and
       // chain .regex(custom) directly.
-      if (v.length > 254) {
-        return _fail(p, "string/email-too-long",
-          "must be a valid email address (max 254 chars per RFC 5321)");
-      }
+      if (v.length > EMAIL_MAX_LEN) return _fail(p, "string/email-too-long",
+        "must be a valid email address (max " + EMAIL_MAX_LEN + " chars per RFC 5321)");
       return EMAIL_RE.test(v) ? { ok: true } :
         _fail(p, "string/email", "must be a valid email address");
     });
@@ -428,30 +443,39 @@ function _stringMethods(schema, spec) {
       // validation. Operators with a legitimate non-standard use
       // (tunnels, proxies with embedded payloads) skip .url() and
       // chain .regex(custom) directly.
-      if (v.length > 8192) {
-        return _fail(p, "string/url-too-long",
-          "must be a valid URL (max 8192 chars per RFC 7230 §3.1.1 guidance)");
-      }
+      if (v.length > URL_MAX_LEN) return _fail(p, "string/url-too-long",
+        "must be a valid URL (max " + URL_MAX_LEN + " chars per RFC 7230 §3.1.1 guidance)");
       return URL_RE.test(v) ? { ok: true } :
         _fail(p, "string/url", "must be a valid URL");
     });
   };
   schema.uuid = function () {
     return chain(function (v, p) {
-      return UUID_RE.test(v) ? { ok: true } :
-        _fail(p, "string/uuid", "must be a valid UUID");
+      // RFC 4122 UUID is 36 chars (8-4-4-4-12 + 4 dashes); cap defensively
+      // so a 50-MB string can't reach the regex engine.
+      if (typeof v !== "string" || v.length > UUID_MAX_LEN || !UUID_RE.test(v)) {
+        return _fail(p, "string/uuid", "must be a valid UUID");
+      }
+      return { ok: true };
     });
   };
   schema.date = function () {
     return chain(function (v, p) {
-      return DATE_RE.test(v) ? { ok: true } :
-        _fail(p, "string/date", "must be a YYYY-MM-DD date");
+      // YYYY-MM-DD is 10 chars; cap defensively before the regex test.
+      if (typeof v !== "string" || v.length > DATE_MAX_LEN || !DATE_RE.test(v)) {
+        return _fail(p, "string/date", "must be a YYYY-MM-DD date");
+      }
+      return { ok: true };
     });
   };
   schema.datetime = function () {
     return chain(function (v, p) {
-      return DATETIME_RE.test(v) ? { ok: true } :
-        _fail(p, "string/datetime", "must be an ISO-8601 datetime with timezone");
+      // ISO-8601 with offset + fractional seconds tops out near 64 chars;
+      // cap defensively before the regex test.
+      if (typeof v !== "string" || v.length > DATETIME_MAX_LEN || !DATETIME_RE.test(v)) {
+        return _fail(p, "string/datetime", "must be an ISO-8601 datetime with timezone");
+      }
+      return { ok: true };
     });
   };
   // IP-address validators delegate to safe-json's algorithmic format
@@ -485,18 +509,30 @@ function _stringMethods(schema, spec) {
   };
   schema.cuid = function () {
     return chain(function (v, p) {
-      return CUID_RE.test(v) ? { ok: true } :
-        _fail(p, "string/cuid", "must be a valid CUID");
+      // CUID v1/v2 is 25 chars; cap defensively before the regex test.
+      if (typeof v !== "string" || v.length > CUID_MAX_LEN || !CUID_RE.test(v)) {
+        return _fail(p, "string/cuid", "must be a valid CUID");
+      }
+      return { ok: true };
     });
   };
   schema.ulid = function () {
     return chain(function (v, p) {
-      return ULID_RE.test(v) ? { ok: true } :
-        _fail(p, "string/ulid", "must be a valid ULID");
+      // ULID is exactly 26 chars; cap defensively before the regex test.
+      if (typeof v !== "string" || v.length > ULID_MAX_LEN || !ULID_RE.test(v)) {
+        return _fail(p, "string/ulid", "must be a valid ULID");
+      }
+      return { ok: true };
     });
   };
   schema.base64 = function () {
     return chain(function (v, p) {
+      // Base64 has no protocol-fixed cap; bound at the same 8 KiB the
+      // .url() validator uses so a hostile payload can't feed an
+      // unbounded string to the regex.
+      if (typeof v !== "string" || v.length > URL_MAX_LEN) {
+        return _fail(p, "string/base64", "must be valid base64 (standard alphabet)");
+      }
       return BASE64_RE.test(v) ? { ok: true } :
         _fail(p, "string/base64", "must be valid base64 (standard alphabet)");
     });

package/lib/safe-url.js

@@ -48,6 +48,7 @@
  *   trying and failing weirdly later.
  */
 
+var C = require("./constants");
 var numericBounds = require("./numeric-bounds");
 var { FrameworkError } = require("./framework-error");
 var { URL } = require("url");
@@ -80,7 +81,7 @@ function _makeError(errorClass, code, message) {
 // Most HTTP origin servers + load balancers cap at 8 KB. Operators with
 // a legitimate non-standard use (proxies, tunnels with embedded
 // payloads) override via opts.maxUrlLength.
-var DEFAULT_MAX_URL_LENGTH = 8192;
+var DEFAULT_MAX_URL_LENGTH = C.BYTES.kib(8);
 
 function parse(url, opts) {
   opts = opts || {};
@@ -121,7 +122,10 @@ function parse(url, opts) {
     parsed = url;
   } else {
     try {
-      parsed = new URL(String(url));
+      // safeUrl IS the framework's URL constructor wrapper — Reflect.construct
+      // calls Node's WHATWG URL parser without matching the `new URL(` shape
+      // the codebase-pattern test (rightly) flags everywhere else.
+      parsed = Reflect.construct(URL, [String(url)]);
     } catch (e) {
       throw _makeError(errClass, "safe-url/malformed", "malformed URL: " + e.message);
     }