@blamejs/exceptd-skills 0.18.11 → 0.18.13

package/lib/ttp-mapper.js

@@ -5,7 +5,16 @@
  * and surfaces gaps where controls fail to cover attacker techniques.
  */
 
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
 function map(controlId, gapCatalog) {
+  // hasOwnProperty guard: a bare gapCatalog[controlId] dereferences inherited
+  // Object.prototype members, so controlId='__proto__' / 'toString' /
+  // 'constructor' returned found:true for a key that is not a real catalog
+  // entry. Only own enumerable keys are catalog controls.
+  if (!gapCatalog || !hasOwn(gapCatalog, controlId)) {
+    return { control_id: controlId, found: false, message: 'Control not in gap catalog' };
+  }
   const entry = gapCatalog[controlId];
   if (!entry) return { control_id: controlId, found: false, message: 'Control not in gap catalog' };
   return {
@@ -47,6 +56,12 @@ function coverage(frameworkId, ttpId, gapCatalog, atlasCatalog) {
     return { ttp_id: ttpId, found: false, error: 'frameworkId required', partially_covered_by: null, not_covered_by: null };
   }
 
+  // hasOwnProperty guard: ttpId='__proto__' / 'toString' / 'constructor'
+  // would otherwise resolve to an inherited Object.prototype member and be
+  // treated as a real ATLAS technique. Only own keys are catalog techniques.
+  if (!atlasCatalog || !hasOwn(atlasCatalog, ttpId)) {
+    return { ttp_id: ttpId, found: false };
+  }
   const ttp = atlasCatalog[ttpId];
   if (!ttp) return { ttp_id: ttpId, found: false };
 

package/lib/upstream-check.js

@@ -47,7 +47,15 @@ async function fetchLatestPublished({ timeoutMs = REQUEST_TIMEOUT_MS, pkgName =
       const fs = require("fs");
       const fixture = JSON.parse(fs.readFileSync(process.env.EXCEPTD_REGISTRY_FIXTURE, "utf8"));
       const version = fixture["dist-tags"]?.latest || fixture.version;
-      const published = fixture.time?.[version] || fixture.time?.modified;
+      // Same guard the network branch applies: a fixture with neither
+      // dist-tags.latest nor a top-level version yields no freshness signal.
+      // Returning ok:true with version:undefined would let an undefined
+      // version leak into buildFreshnessReport's semver compare and the
+      // operator-facing hint. Degrade to an explicit offline refusal.
+      if (!version) {
+        return { ok: false, error: "fixture missing dist-tags.latest / version", source: "offline" };
+      }
+      const published = fixture.time?.[version] || fixture.time?.modified || null;
       return { ok: true, version, published_at: published, source: "fixture" };
     } catch (e) {
       return { ok: false, error: `fixture: ${e.message}`, source: "offline" };
@@ -120,8 +128,14 @@ function buildFreshnessReport({ localVersion, registry, localManifest }) {
     };
   }
   const cmp = semverCmp(localVersion, registry.version);
-  const daysBehind = registry.published_at
-    ? Math.max(0, Math.floor((Date.now() - new Date(registry.published_at).getTime()) / (24 * 3600 * 1000)))
+  // Parse the publish timestamp once and validate it. A non-empty but
+  // unparseable date string (e.g. a malformed registry `time` value) makes
+  // `new Date(...).getTime()` return NaN, which would otherwise propagate
+  // NaN into days_since_latest_publish. Degrade an unparseable date to the
+  // explicit null (signal-absent) branch instead of emitting NaN.
+  const publishedTs = registry.published_at ? new Date(registry.published_at).getTime() : NaN;
+  const daysBehind = Number.isFinite(publishedTs)
+    ? Math.max(0, Math.floor((Date.now() - publishedTs) / (24 * 3600 * 1000)))
     : null;
   // Manifest's last_threat_review (per-skill) — surface the most stale.
   let oldestReview = null;

package/lib/validate-cve-catalog.js

@@ -384,8 +384,16 @@ function main() {
   const schema = readJson(SCHEMA_PATH);
   const catalog = readJson(CATALOG_PATH);
   const lessons = readJson(LESSONS_PATH);
-  const atlas = fs.existsSync(ATLAS_PATH) ? readJson(ATLAS_PATH) : {};
-  const cwe = fs.existsSync(CWE_PATH) ? readJson(CWE_PATH) : {};
+  // All five reference catalogs default to null when absent so the
+  // "cannot validate — catalog absent" branch in additionalChecks fires
+  // uniformly for every ref family. atlas/cwe previously defaulted to {},
+  // which built an EMPTY Set (never null) — so an absent atlas/cwe catalog
+  // silently FLAGGED every ref as unresolved (false positive) instead of
+  // surfacing the catalog-absent warning, the asymmetric opposite of how
+  // attack/d3fend/framework behaved. Uniform null makes the absence
+  // observable rather than misclassified.
+  const atlas = fs.existsSync(ATLAS_PATH) ? readJson(ATLAS_PATH) : null;
+  const cwe = fs.existsSync(CWE_PATH) ? readJson(CWE_PATH) : null;
   const attack = fs.existsSync(ATTACK_PATH) ? readJson(ATTACK_PATH) : null;
   const d3fend = fs.existsSync(D3FEND_PATH) ? readJson(D3FEND_PATH) : null;
   const frameworks = fs.existsSync(FRAMEWORK_GAPS_PATH)
@@ -393,8 +401,12 @@ function main() {
     : null;
 
   const ctx = {
-    atlasKeys: new Set(Object.keys(atlas).filter((k) => !k.startsWith('_'))),
-    cweKeys: new Set(Object.keys(cwe).filter((k) => !k.startsWith('_'))),
+    atlasKeys: atlas
+      ? new Set(Object.keys(atlas).filter((k) => !k.startsWith('_')))
+      : null,
+    cweKeys: cwe
+      ? new Set(Object.keys(cwe).filter((k) => !k.startsWith('_')))
+      : null,
     attackKeys: attack
       ? new Set(Object.keys(attack).filter((k) => !k.startsWith('_')))
       : null,

package/lib/validate-package.js

@@ -150,8 +150,15 @@ function main() {
     }
   }
 
-  // Size budget
-  if (typeof packInfo.size === "number" && packInfo.size > SIZE_BUDGET_BYTES) {
+  // Size budget. An absent/non-numeric `size` field is NOT a pass — it means
+  // the gate cannot evaluate the budget at all. Fail loudly instead of
+  // silently skipping (the absent-field-fails-open class, symmetric with the
+  // license_sha256 / vendored_sha256 guards in validate-vendor.js): a future
+  // npm-pack output shape change that drops or renames `size` must not turn the
+  // size budget into a no-op.
+  if (typeof packInfo.size !== "number") {
+    issues.push(`npm pack output missing numeric size — cannot enforce size budget`);
+  } else if (packInfo.size > SIZE_BUDGET_BYTES) {
     issues.push(`tarball size ${(packInfo.size / 1024 / 1024).toFixed(2)} MB exceeds budget ${(SIZE_BUDGET_BYTES / 1024 / 1024).toFixed(0)} MB`);
   }
 

package/lib/validate-playbooks.js

@@ -129,6 +129,25 @@ function typeOf(value) {
   return typeof value;
 }
 
+// Strict ISO calendar-date check for format:date fields. The shape regex alone
+// accepts impossible dates — `new Date('2026-02-30T00:00:00Z')` does NOT throw,
+// it silently rolls over to March 2 and reports a valid getTime() — so a
+// malformed _meta.last_threat_review or changelog `date` (2026-02-30,
+// 2026-13-40) would pass with only the YYYY-MM-DD shape test. Require the
+// parsed Y-M-D to round-trip back to the input components, mirroring
+// parseIsoDateStrict in lib/validate-catalog-meta.js.
+function isStrictIsoDate(value) {
+  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+  const d = new Date(value + 'T00:00:00Z');
+  if (Number.isNaN(d.getTime())) return false;
+  const [y, m, day] = value.split('-').map(Number);
+  return (
+    d.getUTCFullYear() === y &&
+    d.getUTCMonth() + 1 === m &&
+    d.getUTCDate() === day
+  );
+}
+
 function typeMatches(value, expected) {
   if (Array.isArray(expected)) return expected.some((t) => typeMatches(value, t));
   const actual = typeOf(value);
@@ -185,7 +204,7 @@ function validate(value, schema, schemaName, pathStr) {
       }
     }
     if (schema.format === 'date') {
-      if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+      if (!isStrictIsoDate(value)) {
         err(`${here}: value ${JSON.stringify(value)} is not an ISO date (YYYY-MM-DD)`);
       }
     }
@@ -669,6 +688,21 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
   // the source is the base phase or a directive override.
   function checkRwepThreshold(rwepObj, pathPrefix) {
     const rwep = rwepObj || {};
+    // Range check is PER-KEY and independent of the others. A directive's
+    // phase_overrides.direct.rwep_threshold is a partial fragment the runner
+    // deep-merges, so it may carry only one of the three keys — gating the
+    // whole check on all-three-present let an out-of-range single-key override
+    // (e.g. {escalate: 150} or {close: -5}) ship unchecked and reach the
+    // runner. Validate each present numeric key on its own.
+    for (const k of ['close', 'monitor', 'escalate']) {
+      const v = rwep[k];
+      if (typeof v === 'number' && (v < 0 || v > 100)) {
+        err(`${pathPrefix}.${k}: ${v} outside 0..100`);
+      }
+    }
+    // Ordering is only meaningful when the full triple is present (a partial
+    // override inherits the missing edges from the base phase, so close <=
+    // monitor <= escalate can't be evaluated on the fragment alone).
     if (
       typeof rwep.close === 'number' &&
       typeof rwep.monitor === 'number' &&
@@ -679,15 +713,6 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
           `${pathPrefix}: ordering violation — expected close <= monitor <= escalate, got close=${rwep.close} monitor=${rwep.monitor} escalate=${rwep.escalate}`,
         );
       }
-      for (const [k, v] of [
-        ['close', rwep.close],
-        ['monitor', rwep.monitor],
-        ['escalate', rwep.escalate],
-      ]) {
-        if (v < 0 || v > 100) {
-          err(`${pathPrefix}.${k}: ${v} outside 0..100`);
-        }
-      }
     }
   }
 

package/lib/validate-vendor.js

@@ -111,17 +111,23 @@ function main() {
   }
 
   // On-disk inventory cross-check (BJS-04): the loop above is one-directional
-  // (manifest → disk). A .js file PRESENT in vendor/blamejs/ but ABSENT from
-  // _PROVENANCE.json would ship in the tarball and be require()'d by lib code
-  // while NOTHING verifies its integrity — an unregistered or smuggled-in
-  // vendored module. Flag every on-disk .js that the manifest does not record.
+  // (manifest → disk). A loadable JS module PRESENT in vendor/blamejs/ but
+  // ABSENT from _PROVENANCE.json would ship in the tarball and be require()'d
+  // by lib code while NOTHING verifies its integrity — an unregistered or
+  // smuggled-in vendored module. Node executes `.js`, `.cjs`, and `.mjs` as
+  // code, so a `.cjs`/`.mjs` smuggled module carries the same arbitrary-code
+  // risk as a `.js` one — checking only `.js` let a renamed extension slip the
+  // gate. `.json`/`.node` are deliberately NOT swept here: `_PROVENANCE.json`
+  // itself lives in this directory and is the manifest, not a registered
+  // vendored module, so sweeping `.json` would false-positive on the manifest.
+  const LOADABLE_MODULE = /\.(c|m)?js$/;
   const registered = new Set(
     Object.values(prov.files || {}).map((info) => path.basename(info.vendored_path))
   );
   const vendorDir = path.join(ROOT, "vendor", "blamejs");
   try {
     for (const f of fs.readdirSync(vendorDir)) {
-      if (!f.endsWith(".js")) continue;
+      if (!LOADABLE_MODULE.test(f)) continue;
       if (!registered.has(f)) {
         issues.push(`unregistered vendored file: vendor/blamejs/${f} is on disk but absent from _PROVENANCE.json — its integrity is not verified`);
       }

package/lib/verify.js

@@ -342,6 +342,39 @@ function canonicalManifestBytes(manifest) {
  * @param {object} manifest
  */
 function verifyManifestSignature(manifest) {
+  // The key-pin fingerprint check runs FIRST — independent of whether a
+  // manifest_signature is present — so library callers (refresh-network gate,
+  // verify-shipped-tarball gate, tests, downstream `require("lib/verify")`
+  // consumers) cannot bypass the pin. Previously the pin only fired AFTER the
+  // signature-present check, so a key-substitution attacker who swapped
+  // keys/public.pem AND stripped manifest_signature got the early `missing`
+  // return and never tripped the pin — authenticating against the attacker key
+  // through the library API. Consulting the pin up front closes that on the
+  // legacy/missing path too. Honors KEYS_ROTATED=1 for legitimate rotations; a
+  // MISSING pin file fails closed (keys/EXPECTED_FINGERPRINT ships in the
+  // tarball and is committed, so its absence is the signature of a tamper that
+  // stripped the pin to hide a swapped key).
+  const publicKey = loadPublicKey();
+  if (publicKey) {
+    const liveFp = publicKeyFingerprint(publicKey);
+    const pinResult = checkExpectedFingerprint(liveFp);
+    if (pinResult.status === 'mismatch' && !pinResult.rotationOverride) {
+      return {
+        status: 'invalid',
+        reason: `fingerprint-mismatch: live=${pinResult.actual} pin=${pinResult.expected} — keys/public.pem does not match keys/EXPECTED_FINGERPRINT. If this is an intentional rotation, set KEYS_ROTATED=1 and update the pin.`,
+        fingerprint_mismatch: true,
+        expected: pinResult.expected,
+        actual: pinResult.actual,
+      };
+    }
+    if (pinResult.status === 'no-pin') {
+      return {
+        status: 'invalid',
+        reason: `key-pin absent: keys/EXPECTED_FINGERPRINT is missing, so a swapped keys/public.pem cannot be detected. The pin ships in the tarball and is committed — restore it from the package or version control.`,
+        pin_absent: true,
+      };
+    }
+  }
   const sig = manifest && manifest.manifest_signature;
   if (!sig || typeof sig !== 'object') return { status: 'missing' };
   if (typeof sig.signature_base64 !== 'string') {
@@ -359,43 +392,11 @@ function verifyManifestSignature(manifest) {
       reason: `manifest_signature.algorithm must be exactly 'Ed25519' (got ${JSON.stringify(sig.algorithm)})`,
     };
   }
-  const publicKey = loadPublicKey();
   if (!publicKey) {
     return { status: 'no-key', reason: 'public key missing at keys/public.pem' };
   }
-  // consult keys/EXPECTED_FINGERPRINT BEFORE crypto.verify so
-  // library callers (refresh-network gate, verify-shipped-tarball gate, tests,
-  // downstream consumers via `require("lib/verify")`) cannot bypass the pin.
-  // Previously the pin only fired at the CLI tail of `node lib/verify.js`,
-  // letting a coordinated attacker who swapped keys/public.pem authenticate
-  // against the attacker key without any divergence surfaced through the
-  // library API. Honors KEYS_ROTATED=1 for legitimate rotations. A MISSING pin
-  // file is now rejected too: keys/EXPECTED_FINGERPRINT ships in the tarball and
-  // is committed to the repo, so its absence is not a legacy state — it is the
-  // signature a key-substitution attack leaves when it strips the pin to hide a
-  // swapped keys/public.pem.
-  const liveFp = publicKeyFingerprint(publicKey);
-  const pinResult = checkExpectedFingerprint(liveFp);
-  if (pinResult.status === 'mismatch' && !pinResult.rotationOverride) {
-    return {
-      status: 'invalid',
-      reason: `fingerprint-mismatch: live=${pinResult.actual} pin=${pinResult.expected} — keys/public.pem does not match keys/EXPECTED_FINGERPRINT. If this is an intentional rotation, set KEYS_ROTATED=1 and update the pin.`,
-      fingerprint_mismatch: true,
-      expected: pinResult.expected,
-      actual: pinResult.actual,
-    };
-  }
-  if (pinResult.status === 'no-pin') {
-    // A missing pin fails closed unconditionally — there is nothing to override.
-    // KEYS_ROTATED only applies to a fingerprint MISMATCH (a new key + a new
-    // pin); a legitimate rotation updates the pin in place, it never removes it,
-    // so an absent pin is treated as tampering and restoring it is the only fix.
-    return {
-      status: 'invalid',
-      reason: `key-pin absent: keys/EXPECTED_FINGERPRINT is missing, so a swapped keys/public.pem cannot be detected. The pin ships in the tarball and is committed — restore it from the package or version control.`,
-      pin_absent: true,
-    };
-  }
+  // The key-pin (mismatch / no-pin) was already verified up front, before any
+  // signature branching — so reaching here means the live key matches the pin.
   let signatureBytes;
   try {
     signatureBytes = Buffer.from(sig.signature_base64, 'base64');

package/lib/xml-tokenizer.js

@@ -400,6 +400,7 @@ function parseFeedDetailed(xml) {
   let activeField = null;   // active field local-name
   let buffer = "";          // accumulator for current field text
   let linkRank = 0;         // rel-rank of the best <link> captured so far
+  let linkRel = null;       // rel of the link element currently open (for its element-text close)
 
   tokenize(xml, {
     rawTextElements: LEAF_FIELDS,
@@ -413,6 +414,10 @@ function parseFeedDetailed(xml) {
       if (FIELD_MAP[name]) {
         activeField = FIELD_MAP[name];
         buffer = "";
+        // Remember this link element's rel so its element-text close (below) is
+        // ranked the same way the attribute path is — a non-alternate link with
+        // text must not clobber a captured rel=alternate.
+        if (name === "link") linkRel = attrs ? attrs.rel : null;
         // Atom <link href="..."/> — rel-aware selection. Only let an
         // alternate / rel-absent link upgrade the captured value, and never
         // let a non-alternate rel (self/replies/edit) clobber an alternate
@@ -442,14 +447,19 @@ function parseFeedDetailed(xml) {
       if (!current) return;
       if (FIELD_MAP[name] && activeField === FIELD_MAP[name]) {
         const value = buffer.trim();
-        // RSS <link>...</link> — element text is authoritative (rank 2),
-        // unconditional. An empty element-text link falls back to whatever
-        // attribute capture onTagOpen already recorded.
+        // <link>...</link> element text — ranked by the link's rel, the SAME
+        // gate the attribute path uses, so a non-alternate (self/replies/edit)
+        // link with text cannot clobber a captured rel=alternate. RSS links
+        // carry no rel, and relRank(undefined) === 2, so RSS element-text links
+        // keep their previous authoritative rank. An empty element-text link
+        // falls back to whatever attribute capture onTagOpen already recorded.
         if (name === "link") {
-          if (value) {
+          const r = relRank(linkRel);
+          if (value && r > linkRank) {
             current.link = value;
-            linkRank = 2;
+            linkRank = r;
           }
+          linkRel = null;
         } else if (activeField === "body" || activeField === "title") {
           // Strip HTML tags from title + description / content / summary.
           // Many feeds embed inline HTML (<b>, <em>, <a>) in titles for
@@ -498,9 +508,27 @@ function parseFeed(xml, errors = null) {
 
 function stripHtml(s) {
   if (typeof s !== "string") return "";
-  // First strip tags, then collapse runs of whitespace including
-  // newlines. Entity decoding has already happened by this point.
-  return s.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+  // Single-pass tag strip. A backtracking /<[^>]+>/g is O(n^2) on
+  // attacker-controlled feed text with many '<' and no '>' (a ~150 KB
+  // <title>/<description> of bare '<' froze the refresh worker for seconds —
+  // a ReDoS-class DoS, since parseFeed() runs on network-fetched RSS/Atom
+  // bodies). Walk '<'..'>' instead, preserving the prior contract exactly: a
+  // real `<...>` becomes a space; a stray '<' with no closing '>' and an empty
+  // '<>' survive as literal text (the `[^>]+` quantifier required >=1 char, so
+  // neither matched). Then collapse whitespace as before.
+  let out = "";
+  let i = 0;
+  while (i < s.length) {
+    const lt = s.indexOf("<", i);
+    if (lt === -1) { out += s.slice(i); break; }
+    out += s.slice(i, lt);
+    const gt = s.indexOf(">", lt + 1);
+    if (gt === -1) { out += s.slice(lt); break; }       // stray '<' -> literal
+    if (gt === lt + 1) { out += "<>"; i = gt + 1; continue; } // empty '<>' is not a tag
+    out += " ";                                          // a real tag -> space
+    i = gt + 1;
+  }
+  return out.replace(/\s+/g, " ").trim();
 }
 
 module.exports = { tokenize, parseFeed, parseFeedDetailed, decodeEntities, localName, parseAttrs, stripHtml };