@blamejs/pki 0.1.32 → 0.2.1

package/lib/webcrypto.js

@@ -36,6 +36,7 @@
 var nodeCrypto = require("node:crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var constants = require("./constants");
 
 // Single-owner error class -- co-located with its module (framework-error
 // stays the cross-module home; this is webcrypto-private). withCause: a
@@ -55,7 +56,13 @@ function _toArrayBuffer(buf) {
   return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
 }
 
-function _b64urlToBuf(s) { return Buffer.from(String(s), "base64url"); }
+function _wcErr(code, msg) { return new WebCryptoError(code, msg); }
+// STRICT base64url decode via the shared encoding guard: a missing / non-canonical
+// / non-alphabet value throws webcrypto/data rather than silently importing WRONG
+// key material (the lenient Buffer.from(String(undefined),"base64url") returned a
+// bogus 6-byte key). Node's own canonical JWK export (_rawPublic) round-trips
+// cleanly, so the strictness is benign there and fail-closed on untrusted import.
+function _b64urlToBuf(s, who) { return guard.encoding.base64url(s, null, _wcErr, "webcrypto/data", who || "base64url value"); }
 function _bufToB64url(buf) { return Buffer.from(buf).toString("base64url"); }
 
 function _normalizeAlg(algorithm, who) {
@@ -548,11 +555,15 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
   var keyData;
   if (format === "jwk") {
     // A NON-authenticating unwrap algorithm (AES-CBC / AES-CTR) decrypts
-    // tampered bytes "successfully", so this JSON.parse is the first point
-    // that can notice -- its failure must surface as the module's typed
-    // error (W3C: DataError), never a raw SyntaxError from the public API.
-    try { keyData = JSON.parse(bytes.toString()); }
-    catch (e) { throw new WebCryptoError("webcrypto/data", "unwrapKey: unwrapped bytes are not a valid JWK", e); }
+    // tampered bytes "successfully", so this parse is the first point that can
+    // notice. The shared JSON guard parses strictly (bounded, fatal UTF-8, and a
+    // smuggled duplicate member rejected rather than resolved last-wins), and its
+    // failure surfaces as the module's typed webcrypto/data (W3C: DataError).
+    keyData = guard.json.parse(bytes, WebCryptoError, {
+      maxBytes: constants.LIMITS.JSON_MAX_BYTES, maxDepth: constants.LIMITS.JSON_MAX_DEPTH,
+      badJson: "webcrypto/data", tooDeep: "webcrypto/data", duplicateMember: "webcrypto/data",
+      tooLarge: "webcrypto/data", badInput: "webcrypto/data", label: "the unwrapped JWK",
+    });
   } else {
     keyData = bytes;
   }
@@ -592,7 +603,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
   if (format === "jwk") {
     var jwk = keyData;
     if (jwk.kty === "oct") {
-      var kbuf = _b64urlToBuf(jwk.k);
+      var kbuf = _b64urlToBuf(jwk.k, "JWK oct key material");
       var s2 = nodeCrypto.createSecretKey(kbuf);
       var a2 = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash), length: kbuf.length * 8 } : { name: name, length: kbuf.length * 8 };
       return new CryptoKey("secret", extractable, a2, usages, s2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.32",
+  "version": "0.2.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:87ae1f84-9b42-4b45-820b-1323915f3fbe",
+  "serialNumber": "urn:uuid:1e68f63c-e550-4432-9b59-4cca3a0ddc64",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-11T18:49:24.325Z",
+    "timestamp": "2026-07-12T01:48:49.026Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.32",
+      "bom-ref": "@blamejs/pki@0.2.1",
       "type": "application",
       "name": "pki",
-      "version": "0.1.32",
+      "version": "0.2.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.32",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.32",
+      "ref": "@blamejs/pki@0.2.1",
       "dependsOn": []
     }
   ]