@blamejs/pki 0.1.23 → 0.1.25
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +28 -1
- package/README.md +5 -1
- package/index.js +18 -0
- package/lib/acme.js +1159 -0
- package/lib/constants.js +10 -0
- package/lib/est.js +717 -0
- package/lib/framework-error.js +35 -0
- package/lib/jose.js +616 -0
- package/lib/oid.js +8 -2
- package/lib/schema-all.js +16 -0
- package/lib/schema-csr.js +17 -3
- package/lib/schema-csrattrs.js +371 -0
- package/lib/schema-pkix.js +45 -5
- package/lib/webcrypto.js +5 -4
- package/package.json +1 -1
- package/sbom.cdx.json +6 -6
package/lib/constants.js
CHANGED
|
@@ -173,6 +173,16 @@ var LIMITS = {
|
|
|
173
173
|
// A single attribute's value SET -- no deployed attribute carries more than
|
|
174
174
|
// a handful of values; a list at this scale is amplification.
|
|
175
175
|
ATTRIBUTE_MAX_VALUES: 256,
|
|
176
|
+
// JSON message bounds for the JOSE / ACME layer (RFC 8555). Directories and
|
|
177
|
+
// resource objects are small (certificates travel as PEM, not JSON); 1 MiB is
|
|
178
|
+
// generous headroom. Depth 32 clears the deepest real nesting (a problem
|
|
179
|
+
// document's subproblems nest one level) with margin below any stack risk;
|
|
180
|
+
// enforced BEFORE parsing so a hostile document is refused up front.
|
|
181
|
+
JSON_MAX_BYTES: BYTES.mib(1),
|
|
182
|
+
JSON_MAX_DEPTH: 32,
|
|
183
|
+
// ACME challenge token entropy floor (RFC 8555 sec. 8, errata 6950): >= 128
|
|
184
|
+
// bits of base64url is >= 22 characters. A shorter token is refused before use.
|
|
185
|
+
ACME_TOKEN_MIN_CHARS: 22,
|
|
176
186
|
};
|
|
177
187
|
|
|
178
188
|
// Single-sourced from the package manifest so the reported version can
|