@blamejs/pki 0.5.15 → 0.5.17

package/lib/guard-intrinsic.js

@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is every guard that composes
+// this one, which is every guard that performs its work with a captured intrinsic: guard-bytes
+// (the byte-source door), guard-time (the evaluation instant), guard-name (distinguished-name
+// identity), guard-text (the byte-to-string decode), guard-secret (the wipe).
+//
+// guard-intrinsic -- invoke a captured method against a receiver without reading any property of
+// the captured function.
+//
+// Capturing a method at module load closes half of the hole. `var _fill =
+// Uint8Array.prototype.fill` freezes which function the guard will run, so a later
+// `Uint8Array.prototype.fill = noop` changes nothing. Then `_fill.call(view, 0)` reads `call` off
+// that function object, and the object is the one still sitting on the prototype where any caller
+// can reach it. Assigning `Uint8Array.prototype.fill.call = function () {}` installs an own
+// property that shadows `Function.prototype.call`, and the guard runs the caller's function with
+// the same result the un-captured code had. The wipe clears nothing. A distinguished name compares
+// equal to an unrelated one. A decode returns a string the caller chose. Every check around it
+// still runs and still passes.
+//
+// The uncurried form performs no property read at the call site. `_fill(view, 0)` invokes a
+// function object no caller holds a reference to, so nothing on it is left to poison. The binding
+// happens here, at load, while `Function.prototype.call` and `.bind` are still the language's own.
+//
+// The scope of the defense is replacement that happens after this module loads. Code running
+// before it is already inside the trust boundary and can reach further than any single method, so
+// there is no defense here to add for that case. What capture-then-uncurry buys is that a caller
+// who receives control later, through an option accessor or while a verb is suspended on an await,
+// cannot change what a guard does.
+
+var _utilTypes = require("util").types;
+
+var _call = Function.prototype.call;
+var _bind = Function.prototype.bind;
+// The invocation primitive `uncurry` itself is built out of. Binding as `_bind.call(_call, fn)`
+// would read `call` off the captured bind function, which is the very shape this module exists to
+// remove -- and `uncurry` is exported, so it can run long after load, while another guard
+// initializes. `Reflect.apply` is invoked directly, so no property of it is consulted either.
+var _reflectApply = Reflect.apply;
+
+// isArray -- the array test, snapshotted for the same reason as the predicates below. It decides
+// whether a value is walked as a list at all, so one answering `false` makes an index scan report
+// nothing and every rule keyed on what that scan found silently applies to nothing.
+var _isArray = Array.isArray;
+
+// The Buffer constructors, snapshotted for the same reason. `Buffer.from` is a writable property
+// of the `Buffer` global and it is how this toolkit turns a backing store into something it can
+// read or clear; one returning a buffer over DIFFERENT memory hands every later step a decoy, so a
+// wipe zeroes the decoy while the plaintext it was aimed at stays readable.
+var _bufferFrom = Buffer.from;
+var _bufferAlloc = Buffer.alloc;
+var _bufferConcat = Buffer.concat;
+var _bufferIsBuffer = Buffer.isBuffer;
+var _bufferByteLength = Buffer.byteLength;
+var _bufferCompare = Buffer.compare;
+
+// The rest of what a guard reads from the runtime while it is deciding something. These are
+// grouped here rather than captured file by file so the set is enumerable in one place and a guard
+// added later inherits it: a reader asking "what can a caller still reach" has one list to read.
+//
+// The reflective operations are the load-bearing ones. `getOwnPropertyDescriptor` is how the
+// identifier guard learns whether a field is an accessor, `getPrototypeOf` and `ownKeys` are how it
+// walks a chain honestly, and `isView` is how the byte guard recognizes the shape whose backing
+// store it must refuse when shared. A replacement for any of them answers the question the guard
+// asked on the caller's behalf.
+var _isView = ArrayBuffer.isView;
+var _isInteger = Number.isInteger;
+var _isSafeInteger = Number.isSafeInteger;
+var _fromCharCode = String.fromCharCode;
+var _objectCreate = Object.create;
+var _getPrototypeOf = Object.getPrototypeOf;
+var _setPrototypeOf = Object.setPrototypeOf;
+var _getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+var _getOwnPropertyNames = Object.getOwnPropertyNames;
+var _defineProperty = Object.defineProperty;
+var _objectKeys = Object.keys;
+var _objectAssign = Object.assign;
+var _objectFreeze = Object.freeze;
+var _isExtensible = Object.isExtensible;
+var _ownKeys = Reflect.ownKeys;
+var _jsonStringify = JSON.stringify;
+var _mathFloor = Math.floor;
+var _mathCeil = Math.ceil;
+var _mathMin = Math.min;
+var _promiseResolve = Promise.resolve;
+var _promiseReject = Promise.reject;
+
+// The array operations, uncurried at load. These run on arrays the TOOLKIT owns -- an `ownKeys`
+// result, a local accumulator -- so the receiver is never a caller's object; what is caller-
+// reachable is `Array.prototype` itself. A `forEach` replaced with a no-op makes a scan over
+// perfectly real keys report nothing, and a check keyed on what that scan found then passes
+// vacuously, which is the same fail-open shape as an index test that answers `false`.
+var _arrForEach = uncurry(Array.prototype.forEach);
+var _arrMap = uncurry(Array.prototype.map);
+var _arrFilter = uncurry(Array.prototype.filter);
+var _arrEvery = uncurry(Array.prototype.every);
+var _arrSome = uncurry(Array.prototype.some);
+var _arrIndexOf = uncurry(Array.prototype.indexOf);
+var _arrSort = uncurry(Array.prototype.sort);
+var _arrConcat = uncurry(Array.prototype.concat);
+var _arrSlice = uncurry(Array.prototype.slice);
+var _arrJoin = uncurry(Array.prototype.join);
+
+// The collection operations, uncurried. A guard's cycle-safe chain walk is a `Set` it owns, and
+// `has` is what stops it: one answering `true` ends the walk at the first prototype, so a scan that
+// should have found an accessor two levels up reports nothing and the rule keyed on it passes. The
+// registry lookups are the same shape from the other side -- a `get` that answers for a key never
+// stored hands a guard a member list for an object it has never seen.
+var _setAdd = uncurry(Set.prototype.add);
+var _setHas = uncurry(Set.prototype.has);
+var _mapGet = uncurry(Map.prototype.get);
+var _mapSet = uncurry(Map.prototype.set);
+var _mapHas = uncurry(Map.prototype.has);
+var _weakGet = uncurry(WeakMap.prototype.get);
+var _weakSet = uncurry(WeakMap.prototype.set);
+var _weakHas = uncurry(WeakMap.prototype.has);
+var _taSet = uncurry(Uint8Array.prototype.set);
+// Own-membership, which is how this toolkit asks whether a key is really in a table rather than
+// inherited from a prototype somebody extended. Spelled `Object.prototype.hasOwnProperty.call(t, k)`
+// it reads two replaceable properties to answer one question, and either of them answering yes puts
+// a name into an allowlist that never contained it.
+var _hasOwn = uncurry(Object.prototype.hasOwnProperty);
+// The conversions, which are globals and so ordinary writable properties of globalThis. They read
+// like language rather than like code, which is why they were the last of these to be noticed: an
+// index test is `String(Number(k)) === k`, a narrow is `Number(v)`, and a header value is
+// `String(value)` before it is scanned for injection. A replacement decides all three.
+var _String = String;
+var _Number = Number;
+var _Boolean = Boolean;
+var _BigInt = BigInt;
+var _Date = Date;
+var _isFinite = globalThis.isFinite;
+// The byte-view constructors, for the same reason: a private copy is only private if the store and
+// the view over it are the ones this code asked for. A replaced constructor hands back a view over
+// storage of its own choosing, while the cleanup still tracks the store that was allocated.
+var _ArrayBuffer = ArrayBuffer;
+var _Uint8Array = Uint8Array;
+var _DataView = DataView;
+// Boxing a primitive, which decides what a reflection scan then sees.
+var _ObjectFn = Object;
+// The prototype OBJECTS, used as identity sentinels: "is this a plain object", "is this a Buffer",
+// "has the chain walk reached the top". Each is reached as a property of a replaceable global, so
+// after a replacement the sentinel is a different object and every comparison against it is false.
+var _ObjectProto = Object.prototype;
+var _BufferProto = Buffer.prototype;
+var _ArrayProto = Array.prototype;
+var _Set = Set;
+var _Map = Map;
+var _WeakMap = WeakMap;
+
+// types -- the slot predicates, snapshotted at load.
+//
+// `util.types` is an ordinary object on an ordinary module export, so `util.types.isDate = () =>
+// true` reaches every guard that asks it at call time. These predicates are how this toolkit
+// answers "what IS this value", in preference to a prototype test a caller can satisfy, so a
+// caller who gets to answer them instead has replaced the one question a lookalike cannot lie
+// about. Every own function property is carried across rather than a written-out list, because a
+// list is a thing to get wrong and a predicate added by a later runtime would silently be missing
+// from it.
+var _types = Object.create(null);
+var _typeNames = Object.getOwnPropertyNames(_utilTypes);
+for (var _i = 0; _i < _typeNames.length; _i++) {
+  if (typeof _utilTypes[_typeNames[_i]] === "function") {
+    _types[_typeNames[_i]] = _utilTypes[_typeNames[_i]];
+  }
+}
+Object.freeze(_types);
+
+// uncurry(fn) -> function (receiver, ...args) { return fn.call(receiver, ...args); }
+//   fn : the intrinsic captured from a prototype, or an intrinsic getter function.
+//
+// The returned function is private to whichever module called `uncurry`, so no property of it is
+// reachable from outside.
+//
+// A `.call` on a captured intrinsic is the shape this replaces. It reads as safe while being as
+// reachable as the un-captured method was, so it is flagged anywhere in lib/, including a guard
+// not yet written. The safe spelling is also the tripwire for the next one.
+// @enforced-by guard-shape-reinlined
+// @guard-shape \b_[A-Za-z][A-Za-z0-9_$]*\.(?:call|apply)\s*\(
+function uncurry(fn) {
+  if (typeof fn !== "function") {
+    throw new TypeError("guard.intrinsic.uncurry: expects the captured function, got " + typeof fn);
+  }
+  return _reflectApply(_bind, _call, [fn]);
+}
+
+// getter(proto, name, who) -> the prototype's own accessor, uncurried.
+//   proto : the intrinsic prototype the accessor lives on.
+//   name  : the accessor's property name.
+//   who   : how the prototype is named in the refusal, for a runtime that has no such accessor.
+//
+// A view's size, offset and backing store are accessors on a prototype, which means they are
+// replaceable, which means every rule keyed on one is answerable by whoever replaced it. Taking the
+// descriptor's `get` at load and uncurrying it reads the value's own slot and consults nothing.
+// A runtime without the accessor is refused rather than fallen back from: a fallback here would be
+// the value's own `length`, which is the property this exists to stop reading.
+// @enforced-by behavioral -- reading a descriptor's `get` is not distinguishable from testing one
+//   for presence (`!!d.get`, which four guards do legitimately), so a lexical detector would
+//   false-fire on every accessor-shape check in the tree; the vectors that replace an accessor and
+//   drive the composing guard are the guard. The `.call` half of the shape is covered by uncurry's
+//   guard-shape-reinlined detector.
+function getter(proto, name, who) {
+  var d = _getOwnPropertyDescriptor(proto, name);
+  if (!d || typeof d.get !== "function") {
+    throw new TypeError("guard.intrinsic.getter: this runtime has no intrinsic " + who + "." +
+      name + " accessor, so the value's own would have to be invoked instead");
+  }
+  return uncurry(d.get);
+}
+
+var _taByteLength = getter(_getPrototypeOf(Uint8Array.prototype), "byteLength", "%TypedArray%.prototype");
+var _dvByteLength = getter(DataView.prototype, "byteLength", "DataView.prototype");
+
+// sizeOf(value) -> how large the value is: a string's character count, a view's byte count.
+//
+// The size of an input decides a cap, a bound, an emptiness gate and a loop end all over this
+// toolkit, and `value.length` asks the prototype for it. On a view that property is a replaceable
+// accessor: one reporting a small number for a large buffer disables every size cap at once, and
+// one reporting a positive number for an empty buffer passes an empty secret, an empty DER element
+// and an empty name through the gates that exist to refuse them. So a view is measured from its
+// slot, and a DataView carries its own accessor rather than the typed-array one.
+//
+// A primitive string's `length` is a data property the language maintains and no code can redefine,
+// so the string arm reads it directly. The two arms are one function because a size comparison
+// should have one spelling: a second way to measure is a second thing to get wrong, and the arm
+// that gets skipped is the one that was replaceable. Anything that is neither is refused rather
+// than measured, since its `length` would be whatever its author wrote.
+// @enforced-by behavioral -- `x.length` on a byte view is the same three tokens as on a string or
+//   an array, where the read is safe and ubiquitous, and the receiver's kind is not knowable
+//   statically in this codebase's style; a detector would flag every array bound in the tree. The
+//   over-cap and control-byte vectors under a replaced accessor are the guard.
+function sizeOf(value) {
+  if (typeof value === "string") return value.length;
+  if (_types.isDataView(value)) return _dvByteLength(value);
+  if (_types.isTypedArray(value)) return _taByteLength(value);
+  throw new TypeError("guard.intrinsic.sizeOf: expects a string or a byte view, got " +
+    (value === null ? "null" : typeof value));
+}
+
+module.exports = {
+  uncurry: uncurry,
+  getter: getter,
+  sizeOf: sizeOf,
+  types: _types,
+  isArray: _isArray,
+  bufferFrom: _bufferFrom,
+  bufferAlloc: _bufferAlloc,
+  bufferConcat: _bufferConcat,
+  isBuffer: _bufferIsBuffer,
+  byteLength: _bufferByteLength,
+  compare: _bufferCompare,
+  isView: _isView,
+  isInteger: _isInteger,
+  isSafeInteger: _isSafeInteger,
+  fromCharCode: _fromCharCode,
+  create: _objectCreate,
+  getPrototypeOf: _getPrototypeOf,
+  setPrototypeOf: _setPrototypeOf,
+  getOwnPropertyDescriptor: _getOwnPropertyDescriptor,
+  getOwnPropertyNames: _getOwnPropertyNames,
+  defineProperty: _defineProperty,
+  keys: _objectKeys,
+  assign: _objectAssign,
+  freeze: _objectFreeze,
+  isExtensible: _isExtensible,
+  ownKeys: _ownKeys,
+  stringify: _jsonStringify,
+  floor: _mathFloor,
+  ceil: _mathCeil,
+  min: _mathMin,
+  promiseResolve: _promiseResolve,
+  promiseReject: _promiseReject,
+  forEach: _arrForEach,
+  map: _arrMap,
+  filter: _arrFilter,
+  every: _arrEvery,
+  some: _arrSome,
+  indexOf: _arrIndexOf,
+  sort: _arrSort,
+  concat: _arrConcat,
+  arraySlice: _arrSlice,
+  join: _arrJoin,
+  hasOwn: _hasOwn,
+  // Invocation itself. `fn.apply(...)` reads `apply` off Function.prototype, so a replacement
+  // decides whether a verb's body runs at all and what it appears to return; `Reflect.apply` is
+  // invoked directly and consults no property of the function.
+  apply: _reflectApply,
+  // And the cleanup half of a promise chain: `.finally` is where a copied secret is released, so a
+  // replacement that drops its callback leaves the plaintext copy alive for the process's lifetime.
+  promiseFinally: uncurry(Promise.prototype["finally"]),
+  String: _String,
+  Number: _Number,
+  Boolean: _Boolean,
+  BigInt: _BigInt,
+  Date: _Date,
+  isFinite: _isFinite,
+  ArrayBuffer: _ArrayBuffer,
+  Uint8Array: _Uint8Array,
+  DataView: _DataView,
+  Object: _ObjectFn,
+  ObjectProto: _ObjectProto,
+  BufferProto: _BufferProto,
+  ArrayProto: _ArrayProto,
+  setAdd: _setAdd,
+  setHas: _setHas,
+  mapGet: _mapGet,
+  mapSet: _mapSet,
+  mapHas: _mapHas,
+  weakGet: _weakGet,
+  weakSet: _weakSet,
+  weakHas: _weakHas,
+  typedArraySet: _taSet,
+  Set: _Set,
+  Map: _Map,
+  WeakMap: _WeakMap,
+};

package/lib/guard-json.js

@@ -23,6 +23,31 @@
 // grammar (no leading zero, a fraction/exponent needs a digit, no bare "-").
 //
 var text = require("./guard-text");
+// Taken at load. `defineProperty` is how a decoded member lands on the result without consulting a
+// setter, and `fromCharCode` is how an escape becomes the character it names; a replacement for
+// either decides what this parser produces. See guard-intrinsic for the whole captured set.
+var _defineProperty = require("./guard-intrinsic").defineProperty;
+var _fromCharCode = require("./guard-intrinsic").fromCharCode;
+// The character-code read the whole scanner is built on: whitespace, escapes and the control-byte
+// reject all consult it, so one that lies decides what this parser sees in the input.
+var _charCodeAt = require("./guard-intrinsic").uncurry(String.prototype.charCodeAt);
+// The scanner has already found where a number literal starts and ends; this is the step that cuts
+// it out. A replacement hands `Number` a different span than the one the parser validated, so the
+// value the document is understood to carry is not the value its bytes spell.
+var _strSlice = require("./guard-intrinsic").uncurry(String.prototype.slice);
+// The duplicate-member gate below asks whether a key is already present. Spelled
+// `Object.prototype.hasOwnProperty.call(...)` it reads two replaceable properties to answer that,
+// and either of them answering wrongly lets a document carry the same member twice.
+var _hasOwn = require("./guard-intrinsic").hasOwn;
+// The conversion that turns a validated number literal into the value the document is understood to
+// carry. A replacement returns something else for text this parser has already checked.
+var _Number = require("./guard-intrinsic").Number;
+// The gate that refuses a numeric token that overflowed to Infinity. A replacement answering true
+// admits it, and the document is understood to carry a value its bytes cannot spell.
+var _isFinite = require("./guard-intrinsic").isFinite;
+var _stringify = require("./guard-intrinsic").stringify;
+// Appended by index rather than through `push`, so the growth reads no prototype method at all.
+function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
 var limits = require("./guard-limits");
 
 // One hex digit's value, or -1. Written out because the three ranges ARE the rule.
@@ -55,7 +80,7 @@ function parse(input, ErrorClass, spec) {
     charset: "utf-8", fatal: true, tooLarge: spec.tooLarge, badDecode: spec.badJson, badInput: spec.badInput, label: spec.label,
   });
   var i = 0, n = str.length;
-  function ws() { while (i < n) { var c = str.charCodeAt(i); if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) i++; else break; } }
+  function ws() { while (i < n) { var c = _charCodeAt(str, i); if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) i++; else break; } }
   function fail(msg) { throw E(spec.badJson, "invalid JSON at offset " + i + ": " + msg); }
   function value(depth) {
     if (depth > maxDepth) throw E(spec.tooDeep, "JSON nesting exceeds the depth cap");
@@ -66,9 +91,11 @@ function parse(input, ErrorClass, spec) {
     if (c === "[") return array(depth);
     if (c === "\"") return string();
     if (c === "-" || (c >= "0" && c <= "9")) return number();
-    if (str.substr(i, 4) === "true") { i += 4; return true; }
-    if (str.substr(i, 5) === "false") { i += 5; return false; }
-    if (str.substr(i, 4) === "null") { i += 4; return null; }
+    // Through the captured slice, not `substr`: these three comparisons ARE the literal grammar, so
+    // one returning something else accepts a token the document does not spell.
+    if (_strSlice(str, i, i + 4) === "true") { i += 4; return true; }
+    if (_strSlice(str, i, i + 5) === "false") { i += 5; return false; }
+    if (_strSlice(str, i, i + 4) === "null") { i += 4; return null; }
     fail("unexpected token");
     return undefined;
   }
@@ -81,13 +108,13 @@ function parse(input, ErrorClass, spec) {
       ws();
       if (str[i] !== "\"") fail("expected a string key");
       var key = string();
-      if (Object.prototype.hasOwnProperty.call(out, key)) throw E(spec.duplicateMember, "duplicate JSON member " + JSON.stringify(key));
+      if (_hasOwn(out, key)) throw E(spec.duplicateMember, "duplicate JSON member " + _stringify(key));
       ws();
       if (str[i] !== ":") fail("expected ':'");
       i++;
       // Own data property (not out[key]=...): a "__proto__" key becomes a normal
       // member, never a prototype mutation nor a silent duplicate-gate bypass.
-      Object.defineProperty(out, key, { value: value(depth + 1), writable: true, enumerable: true, configurable: true });
+      _defineProperty(out, key, { value: value(depth + 1), writable: true, enumerable: true, configurable: true });
       ws();
       if (str[i] === ",") { i++; continue; }
       if (str[i] === "}") { i++; return out; }
@@ -100,7 +127,7 @@ function parse(input, ErrorClass, spec) {
     ws();
     if (str[i] === "]") { i++; return out; }
     for (;;) {
-      out.push(value(depth + 1));
+      _append(out, value(depth + 1));
       ws();
       if (str[i] === ",") { i++; continue; }
       if (str[i] === "]") { i++; return out; }
@@ -132,14 +159,14 @@ function parse(input, ErrorClass, spec) {
           var cp = 0;
           if (i + 4 > n) fail("bad \\u escape");
           for (var h = 0; h < 4; h++) {
-            var d = _hexVal(str.charCodeAt(i + h));
+            var d = _hexVal(_charCodeAt(str, i + h));
             if (d < 0) fail("bad \\u escape");
             cp = (cp << 4) | d;
           }
-          s += String.fromCharCode(cp);
+          s += _fromCharCode(cp);
           i += 4;
         } else fail("bad escape");
-      } else if (c.charCodeAt(0) < 0x20) {
+      } else if (_charCodeAt(c, 0) < 0x20) {
         fail("control character in string");
       } else s += c;
     }
@@ -172,8 +199,8 @@ function parse(input, ErrorClass, spec) {
       while (i < n && str[i] >= "0" && str[i] <= "9") i++;
       if (i === expStart) fail("malformed number");                      // "1e" has no exponent
     }
-    var v = Number(str.slice(start, i));
-    if (!isFinite(v)) fail("bad number");
+    var v = _Number(_strSlice(str, start, i));
+    if (!_isFinite(v)) fail("bad number");
     return v;
   }
   var result = value(0);

package/lib/guard-limits.js

@@ -23,6 +23,14 @@
 // that actually holds is the bound at the parser.
 
 var constants = require("./constants");
+// The integer test, taken at load. Every bound below is only a bound while this answers honestly:
+// one returning true admits a NaN or fractional cap, which makes the comparison it guards always
+// false. See guard-intrinsic for the whole captured set.
+var _isInteger = require("./guard-intrinsic").isInteger;
+// And the size measurement, for the same reason one step further in: a cap compares against a
+// length, and on a byte view `length` is a replaceable accessor. One reporting a small number for a
+// large buffer leaves every byteCap below always-false, which is the size defense silently dead.
+var _sizeOf = require("./guard-intrinsic").sizeOf;
 
 // cap(value, key, dflt, opts) -> a validated bounded integer, or dflt when value
 // is undefined. A non-integer / non-finite / negative value fails closed
@@ -49,10 +57,10 @@ function cap(value, key, dflt, opts) {
   // compares false against every value, silently disabling the check (a NaN min
   // even REPLACES the default >= 0 floor). Always a config-time TypeError --
   // the bound wiring is broken regardless of the value currency opts.E selects.
-  if (!Number.isInteger(min) || (opts.max !== undefined && !Number.isInteger(opts.max))) {
+  if (!_isInteger(min) || (opts.max !== undefined && !_isInteger(opts.max))) {
     throw new TypeError("guard.limits.cap: the min/max bounds for " + key + " must be integers");
   }
-  if (!Number.isInteger(value) || value < min || (opts.max !== undefined && value > opts.max)) {
+  if (!_isInteger(value) || value < min || (opts.max !== undefined && value > opts.max)) {
     var want = "an integer >= " + min + (opts.max !== undefined ? " and <= " + opts.max : "");
     if (min === 0 && opts.max === undefined) want = "a non-negative integer";
     if (opts.E) throw opts.E(opts.code, (opts.label || key) + " must be " + want);
@@ -91,7 +99,7 @@ function counter(max, E, code, label) {
   // The ceiling is an authoring input: an undefined / NaN / fractional max
   // builds a counter whose `n > max` never fires, leaving a silently dead fanout
   // defense. Reject at construction (config-time TypeError).
-  if (!Number.isInteger(max) || max < 0) {
+  if (!_isInteger(max) || max < 0) {
     throw new TypeError("guard.limits.counter: max must be a non-negative integer");
   }
   var n = 0;
@@ -119,11 +127,12 @@ function byteCap(buf, max, E, code, label) {
   // The ceiling is an authoring input: an undefined / NaN / fractional / negative
   // max makes `length > max` never fire, and the size defense is then silently
   // dead. Reject at config time (TypeError), regardless of the value currency E selects.
-  if (!Number.isInteger(max) || max < 0) {
+  if (!_isInteger(max) || max < 0) {
     throw new TypeError("guard.limits.byteCap: max must be a non-negative integer");
   }
-  if (buf.length > max) {
-    throw E(code, (label || "input") + " is " + buf.length + " bytes, over the " + max + "-byte cap");
+  var size = _sizeOf(buf);
+  if (size > max) {
+    throw E(code, (label || "input") + " is " + size + " bytes, over the " + max + "-byte cap");
   }
   return buf;
 }

package/lib/guard-name.js

@@ -25,6 +25,35 @@
 // match, or (the mirror risk) a name constraint is escaped. Every DN identity
 // decision routes through the one canonical comparison here.
 
+var intrinsic = require("./guard-intrinsic");
+
+// The string operations this module is built out of, taken from the prototypes at module load and
+// uncurried so no call site reads a property of them. Every value compared here is a primitive
+// string, so each call below would otherwise dispatch to whatever `String.prototype` holds at the
+// moment it runs, and those are ordinary writable properties. A `toLowerCase` that returns a
+// constant makes every DN compare equal to every other, which is the whole of this guard's job
+// answered by the caller: chaining accepts an unrelated issuer, a revocation entry matches a
+// certificate it was never written for, and a name constraint stops excluding anything. The same
+// reasoning covers the escaping helpers, where a replaced `charAt` decides what a report line says
+// a subject was. See guard-intrinsic for why the capture alone is not enough.
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _charAt = intrinsic.uncurry(String.prototype.charAt);
+var _toLowerCase = intrinsic.uncurry(String.prototype.toLowerCase);
+var _toUpperCase = intrinsic.uncurry(String.prototype.toUpperCase);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _lastIndexOf = intrinsic.uncurry(String.prototype.lastIndexOf);
+var _numToString = intrinsic.uncurry(Number.prototype.toString);
+var _create = intrinsic.create;
+var _hasOwn = intrinsic.hasOwn;
+// Already a plain function rather than a method, so it is invoked directly and has no receiver.
+var _fromCharCode = String.fromCharCode;
+var _String = String;
+// The shape test that decides whether a comparison can be performed at all. Refusing is the
+// fail-closed direction, so replacing this turns comparisons into refusals rather than into false
+// matches, and it is captured for the same reason as the rest: what a guard does is settled before
+// a caller runs, or it is settled by the caller.
+var _isArray = Array.isArray;
+
 // assertNoControlBytes(str, E, code, label) -> str | throws E(code, ...)
 // DirectoryString policy (a DN attribute value): reject NUL and C0 control bytes
 // in a DECODED name string. TAB (0x09) is exempt; printable non-ASCII (a
@@ -35,7 +64,7 @@
 //   (a DN string with an embedded NUL / control byte rejects) are the guard.
 function assertNoControlBytes(str, E, code, label) {
   for (var i = 0; i < str.length; i++) {
-    var c = str.charCodeAt(i);
+    var c = _charCodeAt(str, i);
     if (c === 0 || (c < 0x20 && c !== 0x09)) {
       throw E(code, label + " contains an embedded control byte (CVE-2009-2408)");
     }
@@ -51,7 +80,10 @@ function assertNoControlBytes(str, E, code, label) {
 //   code shape distinct from the ASN.1 IA5 reader; the CVE-2009-2408 RED vectors
 //   (a SAN with a control byte rejects) are the guard.
 function assertPrintableIa5(buf, E, code, label) {
-  for (var i = 0; i < buf.length; i++) {
+  // The scan end comes from the slot, not from `buf.length`. A shorter answer stops the walk before
+  // the control byte, which is the whole defense skipped on a name that still carries it.
+  var n = intrinsic.sizeOf(buf);
+  for (var i = 0; i < n; i++) {
     if (buf[i] < 0x20 || buf[i] > 0x7e) {
       throw E(code, label + " must be a printable IA5String (no control bytes)");
     }
@@ -78,12 +110,12 @@ function _canonAttrValue(v, E, code, label) {
   assertNoControlBytes(v, E, code, label);
   var out = "", lastWasSpace = true;   // true so leading whitespace is dropped
   for (var i = 0; i < v.length; i++) {
-    if (_isSpace(v.charCodeAt(i))) { lastWasSpace = true; continue; }
+    if (_isSpace(_charCodeAt(v, i))) { lastWasSpace = true; continue; }
     if (lastWasSpace && out.length) out += " ";
     lastWasSpace = false;
-    out += v.charAt(i);
+    out += _charAt(v, i);
   }
-  return out.toLowerCase();
+  return _toLowerCase(out);
 }
 // rdnEqual(a, b, E, code, label) -> boolean. Canonical comparison of a single
 // RelativeDistinguishedName (an unordered SET of type/value pairs, compared as a
@@ -100,15 +132,30 @@ function _canonAttrValue(v, E, code, label) {
 // performed refuses, and the caller learns at the call site instead of trusting a fabricated
 // match. (A caller holding a parsed Name passes its `.rdns`.)
 function _assertSequence(a, b, E, code, label, what) {
-  if (!Array.isArray(a) || !Array.isArray(b)) {
+  if (!_isArray(a) || !_isArray(b)) {
     throw E(code, "cannot compare " + label + ": " + what + " comparison requires the RDN sequence on both sides (pass name.rdns, not the parsed Name)");
   }
+  // A hole is refused here rather than read below. Indexing a sparse array walks to
+  // `Array.prototype`, so a numeric property planted there supplies an attribute at the missing
+  // index and the comparison decides identity on a value the name does not carry. A real RDN
+  // sequence has no holes, so refusing costs nothing and there is no value to guess at.
+  if (_hasHole(a) || _hasHole(b)) {
+    throw E(code, "cannot compare " + label + ": " + what + " comparison requires a dense sequence on both sides");
+  }
+}
+
+function _hasHole(arr) {
+  for (var i = 0; i < arr.length; i++) { if (!_hasOwn(arr, i)) return true; }
+  return false;
 }
 // @enforced-by guard-shape-reinlined  (shares the canonicalization shape declared on dnEqual)
 function rdnEqual(a, b, E, code, label) {
   _assertSequence(a, b, E, code, label, "an RDN");
   if (a.length !== b.length) return false;
-  var used = [];
+  // A null-prototype accumulator rather than an array: a numeric property planted on
+  // `Array.prototype` reads back as "already matched" for an index nothing has matched, which skips
+  // a candidate attribute and reports two equal RDNs as different.
+  var used = _create(null);
   for (var i = 0; i < a.length; i++) {
     var found = false;
     for (var j = 0; j < b.length; j++) {
@@ -150,10 +197,12 @@ function dnEqual(rdnsA, rdnsB, E, code, label) {
 // @enforced-by guard-shape-reinlined
 // @guard-shape < 0x20 \|\| \w+ === 0x7f
 function escapeControlBytes(str) {
-  var s = String(str), out = "";
+  var s = _String(str), out = "";
   for (var i = 0; i < s.length; i++) {
-    var c = s.charCodeAt(i);
-    out += (c < 0x20 || c === 0x7f) ? "\\x" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase() : s.charAt(i);
+    var c = _charCodeAt(s, i);
+    out += (c < 0x20 || c === 0x7f)
+      ? "\\x" + (c < 16 ? "0" : "") + _toUpperCase(_numToString(c, 16))
+      : _charAt(s, i);
   }
   return out;
 }
@@ -177,17 +226,17 @@ var DN_SPECIAL = { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1
 //   from ordinary string building; the guard-name RED vectors + the schema-pkix DN
 //   round-trip vectors (a comma / plus / leading '#' renders backslash-escaped) are the guard.
 function escapeDnValue(v) {
-  var s = String(v), out = "";
+  var s = _String(v), out = "";
   // A NUL / control octet becomes '\' + two hex digits, so an embedded CR / LF / NUL
   // in a decoded DN value can never forge a report line when displayed.
   for (var i = 0; i < s.length; i++) {
-    var c = s.charCodeAt(i);
-    if (c < 0x20 || c === 0x7f) out += "\\" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase();
-    else if (DN_SPECIAL[c] === 1) out += "\\" + s.charAt(i);
-    else out += s.charAt(i);
+    var c = _charCodeAt(s, i);
+    if (c < 0x20 || c === 0x7f) out += "\\" + (c < 16 ? "0" : "") + _toUpperCase(_numToString(c, 16));
+    else if (DN_SPECIAL[c] === 1) out += "\\" + _charAt(s, i);
+    else out += _charAt(s, i);
   }
-  if (out.length && out.charAt(out.length - 1) === " ") out = out.slice(0, -1) + "\\ ";
-  if (out.charAt(0) === "#" || out.charAt(0) === " ") out = "\\" + out;
+  if (out.length && _charAt(out, out.length - 1) === " ") out = _strSlice(out, 0, -1) + "\\ ";
+  if (_charAt(out, 0) === "#" || _charAt(out, 0) === " ") out = "\\" + out;
   return out;
 }
 
@@ -218,10 +267,10 @@ function emailEqual(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return "not-comparable";
   // Split on the LAST "@": a quoted local-part may legally contain one, and taking the
   // first would move part of the mailbox into the domain and compare the wrong halves.
-  var ai = a.lastIndexOf("@"), bi = b.lastIndexOf("@");
+  var ai = _lastIndexOf(a, "@"), bi = _lastIndexOf(b, "@");
   if (ai <= 0 || bi <= 0 || ai === a.length - 1 || bi === b.length - 1) return "not-comparable";
-  var aLocal = a.slice(0, ai), bLocal = b.slice(0, bi);
-  var aHost = a.slice(ai + 1), bHost = b.slice(bi + 1);
+  var aLocal = _strSlice(a, 0, ai), bLocal = _strSlice(b, 0, bi);
+  var aHost = _strSlice(a, ai + 1), bHost = _strSlice(b, bi + 1);
   if (!_asciiHost(aHost) || !_asciiHost(bHost)) return "not-comparable";
   if (aLocal !== bLocal) return "no-match";
   return _lowerAscii(aHost) === _lowerAscii(bHost) ? "match" : "no-match";
@@ -239,7 +288,7 @@ function _asciiHost(h) {
   // an internationalized domain, including one whose address matches exactly. The case an
   // IDNA transform WOULD be needed for is an A-label against a U-label, and the U-label
   // side is non-ASCII, so it is refused here anyway.
-  for (var i = 0; i < h.length; i++) if (h.charCodeAt(i) > 0x7f) return false;
+  for (var i = 0; i < h.length; i++) if (_charCodeAt(h, i) > 0x7f) return false;
   return true;
 }
 
@@ -250,8 +299,8 @@ function _asciiHost(h) {
 function _lowerAscii(s) {
   var out = "";
   for (var i = 0; i < s.length; i++) {
-    var c = s.charCodeAt(i);
-    out += (c >= 0x41 && c <= 0x5a) ? String.fromCharCode(c + 32) : s.charAt(i);
+    var c = _charCodeAt(s, i);
+    out += (c >= 0x41 && c <= 0x5a) ? _fromCharCode(c + 32) : _charAt(s, i);
   }
   return out;
 }