@blamejs/core 0.7.4 → 0.7.19

package/lib/framework-error.js

@@ -183,6 +183,72 @@ var FileUploadError       = defineClass("FileUploadError",       { alwaysPermane
 // HTTP responses (403 permission_denied, 404 not_found, 412 precondition_failed,
 // 416 range_not_satisfiable, 429 quota_exceeded, 451 retention_blocked).
 var StaticServeError      = defineClass("StaticServeError",      { withStatusCode: true });
+// GateContractError covers gate-contract violations (operator-supplied
+// gate is malformed / hook threw / runtime exceeded). alwaysPermanent
+// because these are programming-bug-shaped, not transient.
+var GateContractError     = defineClass("GateContractError",     { alwaysPermanent: true });
+// GuardCsvError covers csv-shape violations on the serialize / sanitize /
+// validate paths. alwaysPermanent — chunk-shape errors / formula-injection
+// attempts / schema drift are all caller-shape errors.
+var GuardCsvError         = defineClass("GuardCsvError",         { alwaysPermanent: true });
+// GuardAllError covers parity-check failures, exceptFor opt validation, and
+// override opt validation in the b.guardAll registry. alwaysPermanent — every
+// case is a config-time programming bug, not a transient runtime condition.
+var GuardAllError         = defineClass("GuardAllError",         { alwaysPermanent: true });
+// GuardHtmlError covers html-shape violations on validate / sanitize / escape
+// paths. alwaysPermanent — XSS attempts / dangerous-tag detections / DOM
+// clobbering are all caller-shape errors.
+var GuardHtmlError        = defineClass("GuardHtmlError",        { alwaysPermanent: true });
+// GuardSvgError covers svg-shape violations: dangerous tags (script /
+// foreignObject / use cross-origin / handler), DOCTYPE entity expansion
+// (billion laughs / XXE), animation-element attributeName targeting href,
+// SVGZ compressed payloads, SSRF-shape href references. alwaysPermanent.
+var GuardSvgError         = defineClass("GuardSvgError",         { alwaysPermanent: true });
+// GuardFilenameError covers filename-shape violations: path traversal,
+// null-byte truncation, Windows reserved names (CON / PRN / AUX / ...),
+// NTFS alternate data streams, leading/trailing whitespace + trailing dots
+// (Windows strips them silently), unicode bidi/RTLO file-name spoofing,
+// overlong UTF-8 encoding, length caps. alwaysPermanent.
+var GuardFilenameError    = defineClass("GuardFilenameError",    { alwaysPermanent: true });
+// GuardArchiveError covers archive-shape violations: zip-slip path
+// traversal, symlink + hardlink escape, decompression-ratio bombs,
+// nested-archive depth, file-count + total-size + per-entry-size caps,
+// magic-byte / format-claim mismatch, duplicate entries, encryption-
+// claim mismatch. alwaysPermanent.
+var GuardArchiveError     = defineClass("GuardArchiveError",     { alwaysPermanent: true });
+// GuardJsonError covers json-shape violations: prototype pollution
+// (__proto__/constructor/prototype), depth + breadth + key-count bombs,
+// duplicate keys, NaN/Infinity/comments (JSON5 extensions), bidi/null
+// in string values, numeric precision loss, total-size cap.
+// alwaysPermanent.
+var GuardJsonError        = defineClass("GuardJsonError",        { alwaysPermanent: true });
+// GuardYamlError covers yaml-shape violations: deserialization-tag
+// injection (!!python/object / !!java.util.HashMap / custom !Class),
+// anchor recursion (billion laughs), Norway-problem implicit booleans,
+// leading-zero octals, duplicate keys, multi-document streams, depth +
+// node-count + size caps. alwaysPermanent.
+var GuardYamlError        = defineClass("GuardYamlError",        { alwaysPermanent: true });
+// GuardXmlError covers xml-shape violations: XXE, billion-laughs entity
+// expansion, parameter entities, external DTD subset, XInclude, schema-
+// fetch (xsi:schemaLocation), processing instructions, CDATA, depth +
+// element-count + attribute-count caps. alwaysPermanent.
+var GuardXmlError         = defineClass("GuardXmlError",         { alwaysPermanent: true });
+// GuardMarkdownError covers markdown-shape violations: raw-HTML smuggling
+// (including the CVE-2026-30838 whitespace-in-tag-name bypass), dangerous
+// link / image / autolink / reference-link URL schemes (javascript: / data:
+// text/html / vbscript: / file: / jar:), entity-encoded scheme bypass,
+// front-matter payloads, ReDoS-prone emphasis / nesting / autolink mass,
+// HTML-comment smuggling, code-fence language injection, depth + link
+// count + image count + line count + size caps. alwaysPermanent.
+var GuardMarkdownError    = defineClass("GuardMarkdownError",    { alwaysPermanent: true });
+// GuardEmailError covers email-shape violations: SMTP smuggling (bare
+// CR/LF in body, embedded SMTP verbs), CRLF header injection, RFC 5321
+// /5322 local-part / domain / total-length caps, multi-@ violations,
+// IDN homograph spoofing (mixed-script confusable codepoints), display-
+// name vs envelope mismatch, bare IP literal addresses, comment syntax
+// in addresses, bidi/null/control chars in headers + addresses, header-
+// folding smuggling, BOM injection. alwaysPermanent.
+var GuardEmailError       = defineClass("GuardEmailError",       { alwaysPermanent: true });
 
 module.exports = {
   FrameworkError:         FrameworkError,
@@ -212,4 +278,16 @@ module.exports = {
   LockoutError:           LockoutError,
   FileUploadError:        FileUploadError,
   StaticServeError:       StaticServeError,
+  GateContractError:      GateContractError,
+  GuardCsvError:          GuardCsvError,
+  GuardAllError:          GuardAllError,
+  GuardHtmlError:         GuardHtmlError,
+  GuardSvgError:          GuardSvgError,
+  GuardFilenameError:     GuardFilenameError,
+  GuardArchiveError:      GuardArchiveError,
+  GuardJsonError:         GuardJsonError,
+  GuardYamlError:         GuardYamlError,
+  GuardXmlError:          GuardXmlError,
+  GuardMarkdownError:     GuardMarkdownError,
+  GuardEmailError:        GuardEmailError,
 };