@blamejs/pki 0.5.18 → 0.5.20

package/lib/path-validate.js

@@ -67,6 +67,20 @@ function pathCode(e, fallback) {
   return (e && typeof e.code === "string" && e.code.indexOf("path/") === 0) ? e.code : fallback;
 }
 
+// Membership decided by comparison rather than by a prototype method, through the shared guard.
+// Every use below is a RULE: whether a certificate's extended key usages cover the ones the caller
+// required, whether a policy is already expected at a node, whether anyPolicy is in the user's
+// initial set. See guard-list for what a replaced Array.prototype.indexOf did to this validator.
+var contains = guard.list.contains;
+var containsAll = guard.list.containsAll;
+// RFC 5280 6.1.4(a): a policyMappings extension MUST NOT map to or from anyPolicy. The scan for a
+// violating pair is the rule, so it routes through the guard for the same reason.
+function mapsAnyPolicy(mappings) {
+  return guard.list.anyMatches(mappings, function (m) {
+    return !!m && (m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy);
+  });
+}
+
 var NS = pkix.makeNS("path", PathError, oid);
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
@@ -828,7 +842,7 @@ function processPolicies(state, cert, i, checks) {
       if (p.policyIdentifier === OID.anyPolicy) { anyPolicyPresent = true; anyPolicyQualifiers = p.qualifiersBytes; return; }
       var matched = false;
       leavesAt(state.validPolicyTree, depth).forEach(function (node) {
-        if (node.expectedPolicySet.indexOf(p.policyIdentifier) !== -1) {
+        if (contains(node.expectedPolicySet, p.policyIdentifier)) {
           addChild(state, node, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], checks);
           matched = true;
         }
@@ -849,7 +863,7 @@ function processPolicies(state, cert, i, checks) {
       // certificate's own anyPolicy entry ("set the qualifier_set to AP-Q").
       leavesAt(state.validPolicyTree, depth).forEach(function (node) {
         node.expectedPolicySet.forEach(function (ep) {
-          var already = node.children.some(function (ch) { return ch.validPolicy === ep; });
+          var already = guard.list.anyMatches(node.children, function (ch) { return ch.validPolicy === ep; });
           if (!already) addChild(state, node, ep, anyPolicyQualifiers, [ep], checks);
         });
       });
@@ -929,8 +943,7 @@ function ekuPurposeFails(cert, requiredEku, checks) {
   catch (e) { checks.push({ name: "extendedKeyUsage", ok: false, code: pathCode(e, "path/bad-extension-value") }); return true; }
   if (!eku) return false;   // absent EKU: unrestricted (4.2.1.12 restricts only when present)
   var purposes = eku.value;
-  var ok = purposes.indexOf(OID.anyExtendedKeyUsage) !== -1 ||
-    requiredEku.every(function (p) { return purposes.indexOf(p) !== -1; });
+  var ok = contains(purposes, OID.anyExtendedKeyUsage) || containsAll(purposes, requiredEku);
   checks.push({ name: "extendedKeyUsage", ok: ok, code: ok ? undefined : "path/eku-not-permitted" });
   return !ok;
 }
@@ -950,7 +963,10 @@ function prepareNext(state, cert, i, checks) {
   try { pm = decodeExt(cert, OID.policyMappings); }
   catch (e) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
   if (pm) {
-    var badAny = pm.value.some(function (m) { return m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy; });
+    // The scan for a forbidden anyPolicy mapping is the rule itself (RFC 5280 6.1.4(a)), so it is a
+    // loop rather than a `some`: one answering false makes the forbidden mapping invisible and the
+    // certificate is accepted carrying it.
+    var badAny = mapsAnyPolicy(pm.value);
     if (badAny) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: E("path/bad-policy", "policyMappings must not map to or from anyPolicy (RFC 5280 6.1.4(a))") }; }
     if (state.validPolicyTree) applyPolicyMappings(state, pm.value, i);
   }
@@ -1084,12 +1100,16 @@ var TARGET_UNPROCESSED_IF_CRITICAL = {};
 TARGET_UNPROCESSED_IF_CRITICAL[OID.policyMappings] = true;
 Object.freeze(TARGET_UNPROCESSED_IF_CRITICAL);
 
+// Membership is asked of the table's OWN properties. Freezing the table stops a write to it and
+// stops nothing about the prototype chain: a name planted on Object.prototype answers for every OID
+// the table does not carry, and read live this reported an unrecognized critical extension as
+// processed. On a CA certificate only the first table is consulted, so the chain was accepted.
 function unrecognizedCriticalExtension(cert, isTarget) {
   for (var i = 0; i < cert.extensions.length; i++) {
     var ext = cert.extensions[i];
     if (!ext.critical) continue;
-    if (!PROCESSED_EXTENSIONS[ext.oid]) return ext.oid;
-    if (isTarget && TARGET_UNPROCESSED_IF_CRITICAL[ext.oid]) return ext.oid;
+    if (!guard.intrinsic.hasOwn(PROCESSED_EXTENSIONS, ext.oid)) return ext.oid;
+    if (isTarget && guard.intrinsic.hasOwn(TARGET_UNPROCESSED_IF_CRITICAL, ext.oid)) return ext.oid;
   }
   return null;
 }
@@ -1222,7 +1242,7 @@ async function validate(path, opts) {
   // as a SUBSTRING match -- validated to an array of strings instead.
   if (opts.userInitialPolicySet !== undefined) {
     var uipsOk = Array.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
-      opts.userInitialPolicySet.every(function (p) { return typeof p === "string" && p.length > 0; });
+      guard.list.allMatch(opts.userInitialPolicySet, function (p) { return typeof p === "string" && p.length > 0; });
     if (!uipsOk) throw E("path/bad-input", "validate: opts.userInitialPolicySet must be a non-empty array of policy OID strings");
     // Each entry is compared (indexOf) against canonical decoder output, so a
     // non-canonical key would silently never match -- fail the typo closed here.
@@ -1427,7 +1447,7 @@ async function validate(path, opts) {
       var lpm;
       try { lpm = decodeExt(cert, OID.policyMappings); }
       catch (_e) { lpm = null; checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true; }
-      if (lpm && lpm.value.some(function (m) { return m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy; })) {
+      if (lpm && mapsAnyPolicy(lpm.value)) {
         checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true;
       }
       // 4.2.1.10 / 4.2.1.14: nameConstraints and inhibitAnyPolicy MUST be
@@ -1470,7 +1490,9 @@ async function validate(path, opts) {
       }
       if (checkPurpose && ta.purposes) {
         anchorPurposeApplied = true;
-        if (ta.purposes[checkPurpose] !== true) {
+        // The map is the operator's RESTRICTION, so it is asked for its own entry: an inherited
+        // `true` would grant the purpose on every anchor whose map does not name it.
+        if (!guard.intrinsic.hasOwn(ta.purposes, checkPurpose) || ta.purposes[checkPurpose] !== true) {
           checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
         }
       }
@@ -1502,7 +1524,7 @@ async function validate(path, opts) {
   var policyOk = state.explicitPolicy > 0 || ucps.length > 0;
   if (!policyOk) {
     var last = state.results[state.results.length - 1];
-    if (!last.checks.some(function (c) { return c.code === "path/policy-required"; })) {
+    if (!guard.list.anyMatches(last.checks, function (c) { return c.code === "path/policy-required"; })) {
       last.checks.push({ name: "policy", ok: false, code: "path/policy-required" });
     }
     failed = true;
@@ -1539,7 +1561,7 @@ async function validate(path, opts) {
 function userConstrainedPolicies(state, n) {
   if (!state.validPolicyTree) return [];
   var uips = state.userInitialPolicySet;
-  var anyUser = uips.indexOf(OID.anyPolicy) !== -1;
+  var anyUser = contains(uips, OID.anyPolicy);
   var leaves = leavesAt(state.validPolicyTree, n);
   var explicit = {}, hasAnyLeaf = false;
   leaves.forEach(function (node) {
@@ -1547,7 +1569,7 @@ function userConstrainedPolicies(state, n) {
     else explicit[node.validPolicy] = true;
   });
   var set = {};
-  Object.keys(explicit).forEach(function (p) { if (anyUser || uips.indexOf(p) !== -1) set[p] = true; });
+  Object.keys(explicit).forEach(function (p) { if (anyUser || contains(uips, p)) set[p] = true; });
   // 6.1.5(g) step 3: a depth-n anyPolicy node under a restrictive user set
   // expands to each user policy (the intersection of anyPolicy with the user
   // set is the user set itself).
@@ -2193,7 +2215,7 @@ function crlChecker(crls, opts) {
       // nothing can never erase a revocation the checker would otherwise report.
       for (var dj = 0; dj < classified.deltas.length; dj++) {
         var dRec = classified.deltas[dj];
-        if (consumedDeltas.indexOf(dRec) !== -1) continue;
+        if (contains(consumedDeltas, dRec)) continue;
         // A delta that was MERGEABLE with some complete CRL but lost the sec. 5.2.4 @3580 selection
         // does not speak for its scope at all -- the selected delta does, and it was evaluated
         // against the base. Letting a superseded delta contribute its revocation while ignoring its
@@ -2365,7 +2387,7 @@ function ocspChecker(responses) {
       // certificate's own subject encoding -- sec. 7.1-equal but not byte-identical).
       var issuerNameCandidates = [cert.issuer.bytes];
       function addNameCandidate(nm) {
-        if (nm && nm.bytes && !issuerNameCandidates.some(function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
+        if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
       }
       if (issuer.issuerCert) addNameCandidate(issuer.issuerCert.subject);
       addNameCandidate(issuer.workingIssuerName);
@@ -2525,7 +2547,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     if (!sig.ok) return unbound("the target certificate's signature does not verify under the supplied issuer certificate's key");
     var issuerCtx = { workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes, workingIssuerName: issuerCert.subject, issuerCert: issuerCert };
     var issuerNameCandidates = [cert.issuer.bytes];
-    function add(nm) { if (nm && nm.bytes && !issuerNameCandidates.some(function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes); }
+    function add(nm) { if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes); }
     add(issuerCert.subject);
     var issuerKeyBits;
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
@@ -2604,14 +2626,15 @@ function coerceCert(input, label) {
 // inert without one. An EMPTY map states no constraint and is not a reason to refuse.
 function _hasPurposeScopedMetadata(ta) {
   if (!ta || typeof ta !== "object") return false;
-  return ["distrustAfter", "purposes"].some(function (k) {
+  return guard.list.anyMatches(["distrustAfter", "purposes"], function (k) {
     var m = ta[k];
     return !!m && typeof m === "object" && Object.keys(m).length > 0;
   });
 }
 
 function assertAnchorConstraints(ta, checkPurpose) {
-  var d = (checkPurpose && ta && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
+  var d = (checkPurpose && ta && ta.distrustAfter && guard.intrinsic.hasOwn(ta.distrustAfter, checkPurpose))
+    ? ta.distrustAfter[checkPurpose] : null;
   if (d == null) return null;
   return guard.time.assertValid(d, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
 }
@@ -2728,9 +2751,12 @@ function _pushCandidates(frame, scored, stack, counter) {
     counter.tick();          // breadth / total-work cap -> throws path/build-limit
     n += 1;
     var cand = scored[ci].cand, candKey = identityKey(cand);
-    if (frame.keys.has(candKey)) continue;   // the (subject, SAN, key) tuple is already on this branch -> a loop, prune
+    // Loop detection and the dedupe sets below are resource bounds, so they are asked through the
+    // captured methods: a replaced `Set.prototype.has` answering false never prunes and the build
+    // walks a cycle until a cap stops it.
+    if (guard.intrinsic.setHas(frame.keys, candKey)) continue;
     var childKeys = new Set(frame.keys);
-    childKeys.add(candKey);
+    guard.intrinsic.setAdd(childKeys, candKey);
     stack.push({ chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
   return n;
@@ -2821,16 +2847,16 @@ async function _fetchAiaIssuers(current, aia) {
     // IP literals only (already validated above), never a hostname whose resolved address we cannot verify.
     if (net.isIP(u.hostname.replace(/^\[(.*)\]$/, "$1")) === 0 && !aia.transportGuardsAddresses) continue;
     u.hash = "";                                          // the fragment is never sent on the wire -> not part of the request/dedupe identity
-    if (aia.fetchedUrls.has(u.href) || seenThisCert.has(u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
+    if (guard.intrinsic.setHas(aia.fetchedUrls, u.href) || guard.intrinsic.setHas(seenThisCert, u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
     if (seenThisCert.size >= aia.maxPerCert) break;       // per-cert DISTINCT-url cap, checked BEFORE appending so maxAiaPerCert:0 collects nothing (no fetch at all)
-    seenThisCert.add(u.href);
+    guard.intrinsic.setAdd(seenThisCert, u.href);
     uris.push(u.href);
   }
   var out = [];
   for (var k = 0; k < uris.length; k++) {
-    if (aia.fetchedUrls.has(uris[k])) continue;   // a same-cert normalization-equal duplicate
+    if (guard.intrinsic.setHas(aia.fetchedUrls, uris[k])) continue;   // a same-cert normalization-equal duplicate
     if (aia.fetches >= aia.maxFetches) break;     // total budget reached -> STOP fetching (a SILENT cap, never a throw that denies a buildable path)
-    aia.fetchedUrls.add(uris[k]);                 // mark BEFORE the fetch -> fetched at most once, even on failure
+    guard.intrinsic.setAdd(aia.fetchedUrls, uris[k]);   // mark BEFORE the fetch -> fetched at most once, even on failure
     aia.fetches += 1;
     var certs;
     try { certs = await _aiaFetchOne(uris[k], aia); }
@@ -2958,7 +2984,7 @@ async function build(leaf, opts) {
   // repeating CMS returning the same issuer) is appended AT MOST ONCE -- it otherwise inflates the pool, charging
   // the candidate budget and the ceiling for each copy before the issuer is ever evaluated.
   var poolDerKeys = new Set();
-  for (var pdk = 0; pdk < pool.length; pdk++) poolDerKeys.add(certDerKey(pool[pdk]));
+  for (var pdk = 0; pdk < pool.length; pdk++) guard.intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
 
   if (!Array.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
   var anchors = opts.trustAnchors.map(toAnchor);
@@ -3120,8 +3146,8 @@ async function build(leaf, opts) {
         var fetched = await _fetchAiaIssuers(fbCur, aiaCtx);   // append newly-fetched issuer(s) to the SHARED pool
         for (var fj = 0; fj < fetched.length; fj++) {
           var fdk = certDerKey(fetched[fj]);
-          if (poolDerKeys.has(fdk)) continue;                  // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
-          poolDerKeys.add(fdk);
+          if (guard.intrinsic.setHas(poolDerKeys, fdk)) continue;   // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
+          guard.intrinsic.setAdd(poolDerKeys, fdk);
           if (pool.length < poolCeiling) pool.push(fetched[fj]);
         }
       }

package/lib/sign-scheme.js

@@ -52,6 +52,20 @@ var MLDSA_SUITABLE_DIGEST = {
   "ML-DSA-65": { sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-87": { sha512: 1, shake256: 1 },
 };
+// mldsaDigestSuitable(mlName, md) -- is `md` listed as meeting `mlName`'s security strength?
+// Both levels are asked for their OWN entries. The gate rejects on a falsy lookup, so a digest name
+// planted on Object.prototype answers for every name the row omits and a below-strength digest
+// passes the RFC 9882 sec. 3.3 check. This is the single home for that question: the signer and the
+// verifier both ask it, and a copy at either would let the two drift.
+// @enforced-by behavioral -- an own-property table read has no rename-proof shape distinct from a
+//   legitimate one; the RED vectors (a below-strength digest still refused with its name planted on
+//   Object.prototype, on both the sign and verify paths) are the guard.
+function mldsaDigestSuitable(mlName, md) {
+  if (!guard.intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
+  var row = MLDSA_SUITABLE_DIGEST[mlName];
+  return !!row && guard.intrinsic.hasOwn(row, md) && !!row[md];
+}
+
 var SLHDSA_BY_OID = {};
 [["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
  ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
@@ -173,7 +187,7 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
     } else {
       md = so.digestAlgorithm || "sha512";
       if (!NODE_DIGEST[md]) throw E("unsupported-algorithm", "unsupported ML-DSA message digest " + JSON.stringify(md));
-      if (!MLDSA_SUITABLE_DIGEST[mlName][md]) throw E("unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
+      if (!mldsaDigestSuitable(mlName, md)) throw E("unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
     }
     return { digest: md, digestAlgId: _algId(md, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: mlName }, sign: { name: mlName }, ecdsaDer: false };
   }
@@ -266,5 +280,6 @@ module.exports = {
   pssSpkiPinnedHash: pssSpkiPinnedHash,
   signOverTbs: signOverTbs,
   MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST,
+  mldsaDigestSuitable: mldsaDigestSuitable,
   SLHDSA_BY_OID: SLHDSA_BY_OID,
 };

package/lib/tsp-sign.js

@@ -336,7 +336,7 @@ function request(messageImprint, opts) {
   if (opts.certReq != null && typeof opts.certReq !== "boolean") throw _err("tsp/bad-input", "certReq must be a boolean");
   if (opts.certReq === true) fields.push(b.boolean(true));
   if (opts.extensions != null) {
-    if (!Array.isArray(opts.extensions) || !opts.extensions.every(function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
+    if (!Array.isArray(opts.extensions) || !guard.list.allMatch(opts.extensions, function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
     // Each pre-encoded Extension is validated as one, and its extnID must not repeat -- the same
     // gate every other request builder applies. Spliced in unchecked, a caller relaying a blob it
     // did not author put fully chosen bytes inside [0] and this encoder emitted DER its own
@@ -507,7 +507,7 @@ var _BIND_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
 // tsp/* verdict code; a config-shape error throws (the caller's contract).
 function _imprintMatches(mi, data) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;
-  var nodeAlg = name && _VERIFY_DIGEST[name];
+  var nodeAlg = (name && guard.intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
   if (!nodeAlg) return "tsp/unsupported-algorithm";   // cannot recompute -> never assume a match
   var wantLen = _VERIFY_DIGEST_LEN[name];
   // The token's messageImprint MUST be a full-length digest for its algorithm. A short/empty
@@ -732,6 +732,12 @@ function _buildTsaChains(leaf, pool) {
 // Every option pki.tsp.verify reads. Adding one here is the only way to make it accepted.
 var _VERIFY_OPTS = { certs: 1, trustAnchor: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 };
 
+// Does any extension carry the critical flag? The answer IS the unknown-critical-extension gate, so
+// it is decided by comparison instead of by a `some`. See guard-list.
+function _anyCritical(extensions) {
+  return guard.list.anyMatches(extensions, function (e) { return !!e && !!e.critical; });
+}
+
 async function verify(token, data, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
@@ -742,7 +748,7 @@ async function verify(token, data, opts) {
   // nothing to notice it by. Naming the difference at the boundary is the only place it is cheap.
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
     "pki.tsp.verify has an unknown option (note the anchor option here is `trustAnchor`, singular, an anchor tuple -- not the `trustAnchors` certificate list pki.cms.verify takes) ");
-  if (opts.certs != null && (!Array.isArray(opts.certs) || !opts.certs.every(function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
+  if (opts.certs != null && (!Array.isArray(opts.certs) || !guard.list.allMatch(opts.certs, function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
     throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");   // a bad element is a caller error, never silently dropped
   }
   var tokenDer = _tokenDer(token);   // DER Buffer / PEM -> DER; a non-token input throws tsp/bad-input
@@ -789,7 +795,9 @@ async function verify(token, data, opts) {
   // A TSTInfo carrying a CRITICAL extension the verifier cannot process is unusable: RFC 3161 sec.
   // 2.4.2 defers extension handling to RFC 5280 sec. 4.2, and defines no TSTInfo extension, so any
   // critical one is unrecognized (the unknown-critical-extension gate the cert path also applies).
-  if (tst.extensions && tst.extensions.some(function (e) { return e.critical; })) {
+  // The scan for a critical extension IS the gate, so it is a loop rather than a `some`: one
+  // answering false makes the unrecognized critical extension invisible and the token is accepted.
+  if (tst.extensions && _anyCritical(tst.extensions)) {
     return fail("tsp/unknown-critical-extension");
   }
   // M13 -- the ESSCertID(V2) binding: the verifying cert MUST be the one the signer identified.

package/lib/validator-attcert.js

@@ -29,6 +29,12 @@
 
 var oid = require("./oid");
 var asn1 = require("./asn1-der");
+var guard = require("./guard-all");
+
+// Does this extended-key-usage list assert the given purpose? The answer decides whether a
+// certificate qualifies as the kind the rule names, so it goes through the membership guard
+// instead of a prototype method. See guard-list.
+var _asserts = guard.list.contains;
 
 // requireV3(cert, E, code) -- the leaf attestation certificate MUST be X.509 v3.
 // @enforced-by behavioral -- a version-field check has no rename-proof code shape; the RED
@@ -73,7 +79,10 @@ function aikCert(cert, exts, E, code) {
   assertNotCa(cert, exts, E, code);
   if ((cert.subject.rdns || []).length !== 0) throw new E(code, "the tpm AIK certificate subject MUST be empty (WebAuthn 8.3.1)");
   var eku = exts.decode(cert, "extKeyUsage");
-  if (!eku || !Array.isArray(eku.value) || eku.value.indexOf(oid.byName("tcgKpAikCertificate")) === -1) {
+  // The purpose test IS the rule that makes this an AIK certificate, so it is decided by comparison
+  // rather than by a prototype method: a replaced `indexOf` reports the purpose present on any
+  // certificate and an ordinary leaf is accepted as a TPM attestation key.
+  if (!eku || !Array.isArray(eku.value) || !_asserts(eku.value, oid.byName("tcgKpAikCertificate"))) {
     throw new E(code, "the tpm AIK certificate lacks the tcg-kp-AIKCertificate extended key purpose (WebAuthn 8.3.1)");
   }
   var san = exts.decode(cert, "subjectAltName");