@blamejs/core 0.7.75 → 0.7.76

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.76** (2026-05-06) — CVE-class web hardening sweep — Trojan Source (CVE-2021-42574) log defense + drive-by-MIME attachment opt for `staticServe`. **Trojan Source defense** in `b.log` output: every log line now post-processes Unicode bidi / format-control characters (U+061C / U+200E-200F / U+202A-202E / U+2066-2069) into their `\uXXXX` literal escape on the wire so a hostile log message can't re-order the visible line in a TTY / syslog / file reader. JSON.stringify alone does NOT escape these codepoints, so a captured-error message containing `U+202E` (RIGHT-TO-LEFT OVERRIDE) survives into the log surface and silently flips visible field/key associations. The escape applies to the entire serialized JSON line including any extras / bound-context fields. **`staticServe.create({ safeAttachmentForRiskyMimes: true })`** — opt-in flag that adds `Content-Disposition: attachment` to responses whose Content-Type is in the risky-inline-MIME set (`text/html`, `text/xml`, `application/xml`, `application/xhtml+xml`, `image/svg+xml`, `application/javascript`, `text/javascript`, `application/x-javascript`). Defends against drive-by execution of user-uploaded HTML / JS / SVG (CVE-2017-15012 SVG XSS / CVE-2009-1312 HTML drive-by class). Default `false` — operators serving framework asset bundles continue to render inline; operators serving user-content directories opt in. Filename is RFC 5987-encoded (ASCII filename + `filename*=UTF-8''...`) so non-ASCII filenames survive without allowing CR/LF header injection.
+
 - **0.7.75** (2026-05-06) — Audit-emit redaction pipeline. `b.audit.safeEmit` now scrubs the `actor` / `reason` / `metadata` fields through `b.redact.redact()` before they hit the audit handler. Operators who pass `metadata: { reason: e.message }` from a caught error could land DB connection strings, bearer tokens, JWT compact-serialization fixtures, AWS access keys, PEM private keys, SSH keys, credit cards, and SSNs in audit rows; the redact pipeline catches the common shapes (sensitive field names + value-shape detectors) and replaces them with markers (`[REDACTED]`, `[REDACTED-CONN-STRING]`, `[REDACTED-JWT]`, `[REDACTED-PEM]`, `[REDACTED-AWS-KEY]`, `[REDACTED-CC]`, `[REDACTED-SSN]`, `[REDACTED-SEALED]`, `[REDACTED-SSH-KEY]`). The `b.redact` primitive existed in lib/ since v0.4.x but was dead code — `audit.safeEmit` previously passed metadata through unchanged. New connection-string detector matches `protocol://user:pass@host` shapes that surface in error messages from external-DB / SMTP / HTTP drivers (RFC 3986 generic syntax). Drop-silent on redact failure — the pipeline never breaks the caller's audit attempt.
 
 - **0.7.74** (2026-05-06) — Email receive-side parity: DMARC aggregate (RUA) report parser + ARC trust evaluation + Authentication-Results header builder + TLS-RPT receive-side report parser. Closes the "framework can send mail compliantly but can't receive compliantly" gap. **`b.mail.dmarc.parseAggregateReport(xmlBytes, { contentType? })`** parses RFC 7489 §7.2 aggregate XML reports through the framework's existing `lib/parsers/safe-xml.js` (the existing security-focused XML parser handles XXE / DOCTYPE / entity-expansion defenses by default). Auto-detects gzip via magic bytes (`0x1f 0x8b`) or `Content-Type: application/gzip`. Returns `{ reportMetadata, policyPublished, records, totals }` with per-record source-IP / count / policy-evaluated dispositions / identifiers / DKIM + SPF auth results, plus aggregated `messages` / `aligned` / `notAligned` totals operators want for dashboards. Caps report size at 8 MiB and records-per-report at 10 000. **`b.mail.arc.evaluate(rfc822, { trustedSealers })`** wraps the existing `arc.verify` cryptographic chain check with the operator-side trust decision: given a passing chain, did any hop in the chain belong to a sealer the operator trusts? Returns `{ chainStatus, trusted, trustedHop, trustedDomain }` walking hops most-recent-first so the deepest trusted sealer wins. **`b.mail.authResults.emit({ authservId, results, fold? })`** builds the RFC 8601 Authentication-Results header value — operators consume per-method results from `b.mail.spf.verify` / `b.mail.dmarc.evaluate` / `b.mail.arc.verify`, hand them to `.emit`, and the framework formats the conformant header string with method-specific properties (`smtp.mailfrom`, `header.d`, `header.from`, `policy.iprev`, `policy.ip`, `policy.tls`). Refuses unknown methods / results at config-mistake time. **`b.network.smtp.tlsRpt.parseReport(body, { contentType? })`** is the receive-side counterpart to `tlsRpt.recordShape` / `tlsRpt.submit` — accepts a Buffer or string, auto-detects gzip, parses JSON, validates the RFC 8460 §4.4 required-fields shape (`organization-name`, `date-range`, `report-id`, `policies`), aggregates `total-successful-session-count` / `total-failure-session-count` across policies. Caps report size at 8 MiB and policies-per-report at 1024.

package/lib/log.js

@@ -279,6 +279,14 @@ function create(opts) {
         _logError: "extras not serializable",
       }) + "\n";
     }
+    // Trojan-Source defense (CVE-2021-42574). JSON.stringify does NOT
+    // escape Unicode bidi / format controls, so a hostile log message
+    // containing U+202E (RIGHT-TO-LEFT OVERRIDE) survives into TTY /
+    // syslog / file sinks where it can re-order the visible line —
+    // forging which fields appear under which keys when the operator
+    // reads the log. Escape the entire bidi/format-control set to
+    // `\uXXXX` literals on the wire.
+    line = _escapeBidiControls(line);
 
     var lvlNum = LEVELS[levelName];
     for (var s = 0; s < sinks.length; s++) {
@@ -479,6 +487,25 @@ function makeViaOrFallback(operatorLog, fallbackLog) {
 
 // Boot-time minimum level (debug suppressed unless explicitly enabled).
 // Uses raw process.env per the documented load-cycle exception: log.js
+// Trojan-Source defense (CVE-2021-42574). Replace Unicode bidi /
+// format-control characters with their `\uXXXX` literal escape so a
+// hostile log message can't re-order the visible line in a TTY /
+// syslog reader. Set covers:
+//   U+061C — Arabic Letter Mark
+//   U+200E/U+200F — LRM/RLM
+//   U+202A-U+202E — LRE/RLE/PDF/LRO/RLO
+//   U+2066-U+2069 — LRI/RLI/FSI/PDI
+var _BIDI_CONTROL_RE = /[؜‎‏‪‫‬‭‮⁦⁧⁨⁩]/g;
+
+function _escapeBidiControls(s) {
+  if (typeof s !== "string" || s.length === 0) return s;
+  return s.replace(_BIDI_CONTROL_RE, function (ch) {
+    var code = ch.charCodeAt(0).toString(16);                                      // allow:raw-byte-literal — Unicode hex radix
+    while (code.length < 4) code = "0" + code;
+    return "\\u" + code;
+  });
+}
+
 // runs before safeEnv on the boot path; safeEnv requires log, so log
 // can't go through safeEnv to read its own level.
 function _bootMinLevel() {

package/lib/static.js

@@ -208,6 +208,46 @@ function _contentTypeFor(filePath, table) {
   return (table && table[ext]) || DEFAULT_CONTENT_TYPES[ext] || "application/octet-stream";
 }
 
+// Risky MIMEs that the browser executes inline. When safeAttachment is
+// on, the framework forces Content-Disposition: attachment so
+// drive-by uploads can't be executed in the user's browser. Operators
+// serving trusted assets (CSS / JS bundle / SVG icon) opt out by NOT
+// setting safeAttachmentForRiskyMimes — leaving the existing inline
+// default. The defense is per-CVE-2017-15012 (SVG XSS) /
+// CVE-2009-1312 (HTML drive-by) class.
+var RISKY_INLINE_MIMES = {
+  "text/html":              true,
+  "text/xml":               true,
+  "application/xml":        true,
+  "application/xhtml+xml":  true,
+  "image/svg+xml":          true,
+  "application/javascript": true,
+  "text/javascript":        true,
+  "application/x-javascript": true,
+};
+
+function _isRiskyInlineMime(contentType) {
+  if (typeof contentType !== "string" || contentType.length === 0) return false;
+  // Strip parameters like "; charset=utf-8".
+  var semi = contentType.indexOf(";");
+  var bare = (semi === -1 ? contentType : contentType.slice(0, semi)).trim().toLowerCase();
+  return RISKY_INLINE_MIMES[bare] === true;
+}
+
+// Build a safe Content-Disposition value for an attachment. The
+// filename is RFC 5987-encoded so non-ASCII characters survive without
+// allowing CR/LF header injection.
+function _attachmentDisposition(filePath) {
+  var name = path.basename(filePath);
+  // Refuse CR/LF/NUL outright — they're already filtered upstream by
+  // the path-traversal guard, but defense-in-depth here.
+  if (/[\r\n\0]/.test(name)) name = "download";
+  // ASCII-safe filename (replace non-ASCII with _) plus filename* = UTF-8 form.
+  var asciiName = name.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_");
+  var encName = encodeURIComponent(name);
+  return 'attachment; filename="' + asciiName + '"; filename*=UTF-8\'\'' + encName;
+}
+
 // _parseRangeHeader — RFC 7233 single-range parser. Returns null when:
 //   - header absent
 //   - syntactically malformed (not `bytes=`, multi-range, suffix syntax
@@ -331,6 +371,8 @@ function _validateCreateOpts(opts) {
   validateOpts.optionalBoolean(opts.acceptRanges, "staticServe.create: acceptRanges", StaticServeError);
   validateOpts.optionalBoolean(opts.auditSuccess, "staticServe.create: auditSuccess", StaticServeError);
   validateOpts.optionalBoolean(opts.auditFailures, "staticServe.create: auditFailures", StaticServeError);
+  validateOpts.optionalBoolean(opts.safeAttachmentForRiskyMimes,
+    "staticServe.create: safeAttachmentForRiskyMimes", StaticServeError);
   numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxBytesPerActorPerWindowMs,
     "staticServe.create: maxBytesPerActorPerWindowMs", StaticServeError, "BAD_OPT");
   numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxBytesAllActorsPerWindowMs,
@@ -507,6 +549,7 @@ function create(opts) {
   var auditSuccess    = cfg.auditSuccess;
   var auditFailures   = cfg.auditFailures;
   var acceptRanges    = cfg.acceptRanges;
+  var safeAttachment  = !!cfg.safeAttachmentForRiskyMimes;
   var perActorCap     = cfg.maxBytesPerActorPerWindowMs;
   var globalCap       = cfg.maxBytesAllActorsPerWindowMs;
   var bandwidthWindowMs = cfg.bandwidthWindowMs;
@@ -851,6 +894,13 @@ function create(opts) {
       "Last-Modified":  meta.lastModified,
       "X-Integrity":    meta.integrity,
     };
+    // Drive-by-execution defense — when safeAttachmentForRiskyMimes is
+    // on, force Content-Disposition: attachment for HTML / JS / SVG /
+    // XML so the browser downloads instead of rendering. Operator's
+    // onServe hook can override.
+    if (safeAttachment && _isRiskyInlineMime(headers["Content-Type"])) {
+      headers["Content-Disposition"] = _attachmentDisposition(absPath);
+    }
     if (acceptRanges) headers["Accept-Ranges"] = "bytes";
     if (range) headers["Content-Range"] = "bytes " + range.start + "-" + range.end + "/" + meta.size;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.75",
+  "version": "0.7.76",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:029bc278-cc4e-40cb-9b56-3102289527e4",
+  "serialNumber": "urn:uuid:16490b30-e9d2-4135-a820-485954fc745f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-06T04:13:02.729Z",
+    "timestamp": "2026-05-06T04:28:11.034Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.75",
+      "bom-ref": "@blamejs/core@0.7.76",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.75",
+      "version": "0.7.76",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.75",
+      "purl": "pkg:npm/%40blamejs/core@0.7.76",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.75",
+      "ref": "@blamejs/core@0.7.76",
       "dependsOn": []
     }
   ]