@blamejs/pki 0.5.14 → 0.5.16

package/lib/guard-compress.js

@@ -36,6 +36,25 @@
 // code deliberately -- a per-errno surface is attack telemetry.
 
 var zlib = require("zlib");
+// Taken at load. The capability probe below decides which algorithms are safe to expose, and the
+// bounded decompress measures its cap with these, so a replacement chooses both. See
+// guard-intrinsic for the whole captured set.
+var _intrinsic = require("./guard-intrinsic");
+var _bufferFrom = _intrinsic.bufferFrom;
+var _isBuffer = _intrinsic.isBuffer;
+var _isInteger = _intrinsic.isInteger;
+var _objectKeys = _intrinsic.keys;
+var _stringify = _intrinsic.stringify;
+// This probe decides which algorithms qualify as truncation-reporting, so both the round-trip
+// comparison and the frame-size floor below settle whether a compressor is trusted. Reading either
+// off a prototype lets a replacement qualify one that silently accepts a cut frame.
+var _compare = _intrinsic.compare;
+var _sizeOf = _intrinsic.sizeOf;
+// The cut that makes the truncated frame. A replacement returning the whole frame means the
+// decompressor is handed something intact, so an algorithm that ignores truncation qualifies on a
+// test that never truncated anything.
+var _subarray = _intrinsic.uncurry(Uint8Array.prototype.subarray);
+var _hasOwn = _intrinsic.hasOwn;
 
 // The decompressor per algorithm: a registry, so a new algorithm is a row rather
 // than a branch and an unrecognized name fails closed.
@@ -77,28 +96,28 @@ function _reportsTruncation(name) {
   var compress = _PROBE_COMPRESS[name];
   var decompress = DECOMPRESS[name];
   if (typeof compress !== "function" || typeof decompress !== "function") return false;
-  var sample = Buffer.from("0123456789abcdefghijklmnopqrstuvwxyz0123456789");
+  var sample = _bufferFrom("0123456789abcdefghijklmnopqrstuvwxyz0123456789");
   var frame, whole;
   try { frame = compress(sample); }
   catch (_e) { /* allow:swallow-unverified a compressor that cannot compress 46 ASCII bytes is a broken runtime; the algorithm simply does not qualify, which is the fail-closed direction */ return false; }
   // A cut of 2 removes the frame's end marker; the sample is long enough that what remains is
   // still a plausible frame head and not nothing at all.
-  if (!Buffer.isBuffer(frame) || frame.length < 4) return false;
+  if (!_isBuffer(frame) || _sizeOf(frame) < 4) return false;
   try { whole = decompress(frame, { maxOutputLength: 4096 }); }
   catch (_e2) { /* allow:swallow-unverified a decompressor that rejects its own compressor's whole frame is a broken runtime; the algorithm does not qualify, again fail-closed */ return false; }
-  if (!Buffer.isBuffer(whole) || !whole.equals(sample)) return false;
+  if (!_isBuffer(whole) || _compare(whole, sample) !== 0) return false;
   // The cut frame must be refused. A returned value of any length, including the empty buffer
   // some bindings hand back, means a truncation would pass through unseen.
   var cutAccepted = false;
   try {
-    decompress(frame.subarray(0, frame.length - 2), { maxOutputLength: 4096 });
+    decompress(_subarray(frame, 0, _sizeOf(frame) - 2), { maxOutputLength: 4096 });
     cutAccepted = true;
   } catch (_e3) { /* refused, as a decompressor handed an unfinished frame must */ }
   return !cutAccepted;
 }
 
 var SAFE = {};
-Object.keys(DECOMPRESS).forEach(function (n) { if (_reportsTruncation(n)) SAFE[n] = true; });
+_intrinsic.forEach(_objectKeys(DECOMPRESS), function (n) { if (_reportsTruncation(n)) SAFE[n] = true; });
 
 // bounded(algorithm, stream, cap, E, codes, label) -> Buffer. Decompress `stream`
 // under `algorithm`, refusing any output that would exceed `cap` bytes and any
@@ -116,19 +135,19 @@ function bounded(algorithm, stream, cap, E, codes, label) {
   // fault, not untrusted input: a caller resolves a wire value to a name against algorithms()
   // and rejects one it does not find, before reaching here. Arriving with a name outside that
   // set means the consumer skipped the step, so it faults loudly and never silently.
-  if (!Object.prototype.hasOwnProperty.call(SAFE, algorithm) || !decompress) {
-    throw new TypeError("guard.compress.bounded: unknown or unsafe algorithm " + JSON.stringify(algorithm));
+  if (!_hasOwn(SAFE, algorithm) || !decompress) {
+    throw new TypeError("guard.compress.bounded: unknown or unsafe algorithm " + _stringify(algorithm));
   }
   // The byte-source normalization is guard.bytes.view's job and belongs at the
   // consumer's boundary; reaching here with anything else means it was skipped.
-  if (!Buffer.isBuffer(stream)) {
+  if (!_isBuffer(stream)) {
     throw new TypeError("guard.compress.bounded: stream must be a Buffer (route the input through guard.bytes.view first)");
   }
   // The ceiling is an authoring input: an undefined / NaN / fractional / negative
   // cap would silently disable the bomb defense. It must also be at least 1 --
   // node rejects maxOutputLength 0 with a different fault than a cap breach, so a
   // zero cap would surface as a malformed-stream verdict instead of a config error.
-  if (!Number.isInteger(cap) || cap < 1) {
+  if (!_isInteger(cap) || cap < 1) {
     throw new TypeError("guard.compress.bounded: cap must be a positive integer");
   }
   var what = label || "the compressed input";
@@ -145,8 +164,9 @@ function bounded(algorithm, stream, cap, E, codes, label) {
   // ends before the input does means the remainder was ignored, which is the
   // malleability above, so the whole input must be exactly one frame.
   var consumed = res.engine.bytesWritten;
-  if (consumed !== stream.length) {
-    throw E(codes.failed, what + " carries " + (stream.length - consumed) +
+  var streamLen = _sizeOf(stream);
+  if (consumed !== streamLen) {
+    throw E(codes.failed, what + " carries " + (streamLen - consumed) +
       " trailing byte(s) after the end of the compressed stream");
   }
   return res.buffer;
@@ -159,6 +179,6 @@ function bounded(algorithm, stream, cap, E, codes, label) {
 // @enforced-by behavioral -- a read-only list of the safe registry's keys has no
 // rename-proof code shape to re-inline; the guard's reject path is the contract,
 // and a consumer offering an algorithm this list omits fails closed at `bounded`.
-function algorithms() { return Object.keys(SAFE); }
+function algorithms() { return _objectKeys(SAFE); }
 
 module.exports = { bounded: bounded, algorithms: algorithms };

package/lib/guard-der.js

@@ -30,6 +30,16 @@
 // therefore both deferred to first use -- the documented circular-load exception to top-of-file
 // requires. Guards sit BELOW the codec in the dependency order; this is the one place that
 // order is inverted, and it is inverted lazily.
+// The byte comparison SET-OF ordering is decided by, taken at load. A replacement chooses which
+// encodings this guard calls correctly ordered. See guard-intrinsic for the whole captured set.
+var _compare = require("./guard-intrinsic").compare;
+var _forEach = require("./guard-intrinsic").forEach;
+// The emptiness gate below decides whether bytes reach the decoder at all, and on a byte view
+// `length` is a replaceable accessor: one answering non-zero for an empty buffer sends nothing to
+// asn1.decode as though it were an element.
+var _sizeOf = require("./guard-intrinsic").sizeOf;
+var _create = require("./guard-intrinsic").create;
+
 var asn1 = null;
 function _asn1() { if (asn1 === null) asn1 = require("./asn1-der"); return asn1; }
 
@@ -39,7 +49,10 @@ var VALUE_READERS = null;
 function _readers() {
   if (VALUE_READERS !== null) return VALUE_READERS;
   var asn1 = _asn1();
-  var m = {}, R = asn1.read, T = asn1.TAGS;
+  // Null-prototype: this table IS the allowlist of universal tags with a strict content reader, and
+  // a tag it does not carry is refused. Built on a `{}`, an inherited numeric property supplies a
+  // reader for a tag that was deliberately left out, and the refusal that is the point stops.
+  var m = _create(null), R = asn1.read, T = asn1.TAGS;
   // ENUMERATED shares INTEGER's content rules and is NOT constrained to non-negative
   // values. X.680 (02/2021) sec. 20.2 requires each NamedNumber's SignedNumber to be
   // distinct, and sec. 19 defines SignedNumber ::= number | "-" number; the non-negativity
@@ -55,8 +68,8 @@ function _readers() {
   // it through read.string would fold it into the RFC 5280 sec. 7.1 name-comparison identity
   // class (see asn1-der.js).
   m[T.NUMERIC_STRING] = R.numericString;
-  [T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING,
-    T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
+  _forEach([T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING,
+    T.BMP_STRING, T.UNIVERSAL_STRING], function (t) { m[t] = R.string; });
   VALUE_READERS = m;
   return VALUE_READERS;
 }
@@ -79,9 +92,19 @@ function _readers() {
 // security posture, which this family avoids, and tightening it for both would reject valid
 // structured SETs that c509 round-trips today. The rule is therefore unchanged and the cost is
 // written down rather than discovered later.
-var TAG_CLASS_RANK = { universal: 0, application: 1, context: 2, private: 3 };
+// Null-prototype: the rank decides canonical SET order, so an inherited property answering for an
+// unrecognized tag class would rank it rather than leave it unranked, and a SET in no canonical
+// order would compare as ordered.
+var TAG_CLASS_RANK = _create(null);
+TAG_CLASS_RANK.universal = 0;
+TAG_CLASS_RANK.application = 1;
+TAG_CLASS_RANK.context = 2;
+TAG_CLASS_RANK["private"] = 3;
 function setOrderOk(kids) {
-  var i, dup = false, seen = {};
+  // A null-prototype accumulator: on a `{}` a planted `Object.prototype["universal:16"]` answers
+  // this membership test for a tag the SET never carried, which reports a duplicate that is not
+  // there and selects the wrong canonical-order rule for the whole SET.
+  var i, dup = false, seen = _create(null);
   for (i = 0; i < kids.length; i++) {
     var key = kids[i].tagClass + ":" + kids[i].tagNumber;
     if (seen[key]) { dup = true; break; }
@@ -89,7 +112,7 @@ function setOrderOk(kids) {
   }
   var octetAsc = true, tagAsc = true;
   for (i = 1; i < kids.length; i++) {
-    if (Buffer.compare(kids[i - 1].bytes, kids[i].bytes) > 0) octetAsc = false;
+    if (_compare(kids[i - 1].bytes, kids[i].bytes) > 0) octetAsc = false;
     // Tag order ranks by CLASS first (universal < application < context < private, X.680
     // sec. 8.6), then by tag number. Compare the class's NUMBER: the names do not sort in
     // class order.
@@ -141,7 +164,7 @@ function element(node, E, code, label) {
 // @enforced-by guard-shape-reinlined
 // @guard-shape must be exactly one well-formed DER element
 function tlv(content, E, code, label) {
-  if (!content || content.length === 0) throw E(code, label + " must be a non-empty DER element");
+  if (!content || _sizeOf(content) === 0) throw E(code, label + " must be a non-empty DER element");
   var node;
   try { node = _asn1().decode(content); }
   catch (e) { throw E(code, label + " must be exactly one well-formed DER element (no trailing data)", e); }

package/lib/guard-encoding.js

@@ -33,10 +33,26 @@
 // follows the length, which the caller already caps. It is also the more honest
 // statement of the rule: the set of permitted characters is the rule, written out.
 function _alphabet(chars) {
+  // allow:guard-reads-runtime-live -- the three tables below are the only callers and they are
+  // built at module load, before any caller code has run. There is no live read to remove.
   var t = new Uint8Array(128);
-  for (var i = 0; i < chars.length; i++) t[chars.charCodeAt(i)] = 1;
+  for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = 1;
   return t;
 }
+// Both halves of the round trip, taken at load, along with the string reads the alphabet checks
+// are built on. Canonicality here is decided by decoding the text and re-encoding the result, so
+// either half is enough to decide the answer: a `toString` returning the input makes every
+// non-canonical encoding canonical, and a `charCodeAt` deciding what is in the alphabet chooses
+// which characters are there to be judged.
+var _intrinsic = require("./guard-intrinsic");
+var _bufferFrom = _intrinsic.bufferFrom;
+var _toString = _intrinsic.uncurry(Buffer.prototype.toString);
+var _charCodeAt = _intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = _intrinsic.uncurry(String.prototype.slice);
+var _toLowerCase = _intrinsic.uncurry(String.prototype.toLowerCase);
+var _isInteger = _intrinsic.isInteger;
+var _floor = _intrinsic.floor;
+
 var UPPER = "ABCDEFGHIJKLMNOPQRSTUVWXYZ", LOWER = "abcdefghijklmnopqrstuvwxyz", DIGITS = "0123456789";
 var B64URL_ALPHABET = _alphabet(UPPER + LOWER + DIGITS + "-_");
 var B64_ALPHABET = _alphabet(UPPER + LOWER + DIGITS + "+/");
@@ -47,7 +63,7 @@ var HEX_ALPHABET = _alphabet(DIGITS + "abcdef" + "ABCDEF");
 // bound rejects it, so no lookup can read undefined off the end of the table.
 function _inAlphabet(text, table) {
   for (var i = 0; i < text.length; i++) {
-    var c = text.charCodeAt(i);
+    var c = _charCodeAt(text, i);
     if (c > 127 || table[c] !== 1) return false;
   }
   return true;
@@ -60,10 +76,10 @@ function _capBefore(nChars, perByteChars, maxBytes, E, code, label) {
   // The cap is an authoring input: a NaN / fractional / negative maxBytes makes
   // the comparison below always false -- the cap silently disabled. Config-time
   // TypeError instead (null/undefined stays the documented uncapped mode).
-  if (!Number.isInteger(maxBytes) || maxBytes < 0) {
+  if (!_isInteger(maxBytes) || maxBytes < 0) {
     throw new TypeError("guard.encoding: maxBytes must be a non-negative integer or null");
   }
-  if (Math.floor(nChars / perByteChars) > maxBytes) {
+  if (_floor(nChars / perByteChars) > maxBytes) {
     throw E(code, label + " exceeds the maximum decoded size of " + maxBytes + " bytes");
   }
 }
@@ -76,8 +92,8 @@ function base64url(text, maxBytes, E, code, label) {
   if (!_inAlphabet(text, B64URL_ALPHABET)) throw E(code, label + " is not base64url (padding or a non-alphabet character)");
   if (text.length % 4 === 1) throw E(code, label + " has an impossible base64url length");
   _capBefore(text.length * 3, 4, maxBytes, E, code, label);
-  var buf = Buffer.from(text, "base64url");
-  if (buf.toString("base64url") !== text) throw E(code, label + " is not canonical base64url");
+  var buf = _bufferFrom(text,"base64url");
+  if (_toString(buf, "base64url") !== text) throw E(code, label + " is not canonical base64url");
   return buf;
 }
 
@@ -90,12 +106,12 @@ function base64(text, maxBytes, E, code, label) {
   // the body is measured first and the alphabet applies to what remains. An "="
   // anywhere else leaves a non-alphabet character in the body and rejects there.
   var pad = 0;
-  while (pad < 2 && text.length > pad && text.charCodeAt(text.length - 1 - pad) === 0x3d) pad++;
-  if (!_inAlphabet(text.slice(0, text.length - pad), B64_ALPHABET)) throw E(code, label + " is not base64 (a non-alphabet character)");
+  while (pad < 2 && text.length > pad && _charCodeAt(text, text.length - 1 - pad) === 0x3d) pad++;
+  if (!_inAlphabet(_strSlice(text, 0, text.length - pad), B64_ALPHABET)) throw E(code, label + " is not base64 (a non-alphabet character)");
   if (text.length % 4 !== 0) throw E(code, label + " must be whole 4-character base64 groups (RFC 4648 sec. 3.5)");
   _capBefore(text.length * 3, 4, maxBytes, E, code, label);
-  var buf = Buffer.from(text, "base64");
-  if (buf.toString("base64") !== text) throw E(code, label + " is not canonical base64 (RFC 4648 sec. 3.5)");
+  var buf = _bufferFrom(text,"base64");
+  if (_toString(buf, "base64") !== text) throw E(code, label + " is not canonical base64 (RFC 4648 sec. 3.5)");
   return buf;
 }
 
@@ -111,8 +127,8 @@ function hex(text, maxBytes, E, code, label) {
   if (!_inAlphabet(text, HEX_ALPHABET)) throw E(code, label + " is not hexadecimal");
   if (text.length % 2 !== 0) throw E(code, label + " must have an even number of hex digits");
   _capBefore(text.length, 2, maxBytes, E, code, label);
-  var buf = Buffer.from(text, "hex");
-  if (buf.toString("hex") !== text.toLowerCase()) throw E(code, label + " is not canonical hexadecimal");
+  var buf = _bufferFrom(text,"hex");
+  if (_toString(buf, "hex") !== _toLowerCase(text)) throw E(code, label + " is not canonical hexadecimal");
   return buf;
 }
 

package/lib/guard-header.js

@@ -18,6 +18,17 @@
 // reintroduce the injection.
 
 var C = require("./constants");
+// Taken at load. `byteLength` is what the RFC 5322 line limit is measured with, so a replacement
+// decides whether an over-long header line is refused. See guard-intrinsic for the whole set.
+var _byteLength = require("./guard-intrinsic").byteLength;
+// The character-code read the RFC 5322 ftext and CR/LF/NUL checks are built on. One that never
+// reports a control byte is a header-injection defense that inspects nothing.
+var _charCodeAt = require("./guard-intrinsic").uncurry(String.prototype.charCodeAt);
+var _stringify = require("./guard-intrinsic").stringify;
+// The conversion that produces the text this guard then scans for CR and LF. A replacement returns
+// a clean string for a value carrying a line break, so the injection scan runs on text that is not
+// what gets emitted.
+var _String = require("./guard-intrinsic").String;
 
 // assertField(name, value, E, code) -> value | throws new E(code, ...)
 // name: RFC 5322 ftext, printable ASCII [0x21, 0x7e] except ':' (0x3a), non-empty
@@ -33,18 +44,18 @@ var C = require("./constants");
 function assertField(name, value, E, code) {
   if (typeof name !== "string" || name.length === 0) throw new E(code, "a header field name must be a non-empty string");
   for (var i = 0; i < name.length; i++) {
-    var nc = name.charCodeAt(i);
-    if (nc < 0x21 || nc > 0x7e || nc === 0x3a) throw new E(code, "a header field name must be RFC 5322 ftext (printable ASCII, no space / ':' / control): " + JSON.stringify(name));
+    var nc = _charCodeAt(name, i);
+    if (nc < 0x21 || nc > 0x7e || nc === 0x3a) throw new E(code, "a header field name must be RFC 5322 ftext (printable ASCII, no space / ':' / control): " + _stringify(name));
   }
-  var v = typeof value === "string" ? value : String(value);
+  var v = typeof value === "string" ? value : _String(value);
   for (var j = 0; j < v.length; j++) {
-    var vc = v.charCodeAt(j);
-    if (vc === 0x00 || vc === 0x0d || vc === 0x0a) throw new E(code, "a header field value must not contain CR / LF / NUL (header injection) in " + JSON.stringify(name));
+    var vc = _charCodeAt(v, j);
+    if (vc === 0x00 || vc === 0x0d || vc === 0x0a) throw new E(code, "a header field value must not contain CR / LF / NUL (header injection) in " + _stringify(name));
   }
   // RFC 5322 sec. 2.1.1: the serialized "Name: value" line (UTF-8 octets, excluding CRLF) must not exceed
   // the line limit, or a relay may re-fold it and silently change the signed bytes of a protected header.
-  if (Buffer.byteLength(name, "utf8") + 2 + Buffer.byteLength(v, "utf8") > C.LIMITS.HEADER_LINE_MAX_OCTETS) {
-    throw new E(code, "a header field line exceeds RFC 5322's " + C.LIMITS.HEADER_LINE_MAX_OCTETS + "-octet limit: " + JSON.stringify(name));
+  if (_byteLength(name, "utf8") + 2 + _byteLength(v, "utf8") > C.LIMITS.HEADER_LINE_MAX_OCTETS) {
+    throw new E(code, "a header field line exceeds RFC 5322's " + C.LIMITS.HEADER_LINE_MAX_OCTETS + "-octet limit: " + _stringify(name));
   }
   return v;
 }