@blamejs/pki 0.5.22 → 0.5.24

package/lib/http-digest.js

@@ -14,14 +14,24 @@
 
 var crypto = require("crypto");
 var constants = require("./constants");
+var intrinsic = require("./guard-intrinsic");
+// Own-key membership through an operation taken at load. Written out, the question reads two
+// replaceable properties to answer one thing, and here it decides whether an auth-param repeats --
+// answering false lets the second copy of a nonce overwrite the first.
+var _hasOwn = intrinsic.hasOwn;
 
 // Algorithm registry, a data row and not a switch: rank orders the RFC 7616 sec. 3.7
 // "most secure the client can use" selection (SHA-512-256 > SHA-256 > MD5); an unknown algorithm ranks 0.
-var ALGS = {
+//
+// Null prototype, because the gate on an unknown algorithm is `if (!ALGS[name])`. With an ordinary
+// object literal that question is asked of the prototype chain too, so an algorithm named for any
+// member of Object.prototype answers with a truthy value the table never carried: the
+// unsupported-algorithm refusal is skipped and the descriptor's own fields read as undefined.
+var ALGS = intrinsic.assign(intrinsic.create(null), {
   "SHA-512-256": { hash: "sha512-256", rank: 3, sess: false }, "SHA-512-256-SESS": { hash: "sha512-256", rank: 3, sess: true },
   "SHA-256": { hash: "sha256", rank: 2, sess: false }, "SHA-256-SESS": { hash: "sha256", rank: 2, sess: true },
   "MD5": { hash: "md5", rank: 1, sess: false }, "MD5-SESS": { hash: "md5", rank: 1, sess: true },
-};
+});
 var DEFAULT_CODES = {
   unsupportedAlgorithm: "digest/unsupported-algorithm", weakAlgorithm: "digest/weak-algorithm",
   noQop: "digest/no-qop", badChallenge: "digest/bad-challenge",
@@ -110,7 +120,7 @@ function _parseParams(paramText, E, code) {
     var rawVal = seg.slice(eq + 1).replace(/^\s+|\s+$/g, "");
     var quoted = rawVal.charAt(0) === "\"";
     if (quoted && !_closedQuote(rawVal)) throw E(code, "an unterminated or trailing-garbage Digest quoted-string (RFC 7230 sec. 3.2.6)");
-    if (Object.prototype.hasOwnProperty.call(map, key)) throw E(code, "repeated Digest auth-param " + JSON.stringify(key));
+    if (_hasOwn(map, key)) throw E(code, "repeated Digest auth-param " + JSON.stringify(key));
     var value = quoted ? _unq(rawVal) : rawVal;
     // Reject a control octet in any value (CR / LF / NUL / ...): it is a MUST-reject per RFC 7230 qdtext AND a
     // header-injection sink -- an unescaped CR/LF reflected into the outgoing Authorization would split the header.

package/lib/path-validate.js

@@ -3081,7 +3081,7 @@ async function build(leaf, opts) {
   // supplied and `opts.softFail` answers for it. Own membership decides only whether a name is
   // build-only, which is a question about this module's own table and never about the caller.
   Object.keys(_VALIDATE_OPTS).forEach(function (k) {
-    if (Object.prototype.hasOwnProperty.call(BUILD_ONLY_OPT, k)) return;
+    if (intrinsic.hasOwn(BUILD_ONLY_OPT, k)) return;
     if (k in opts) forwarded[k] = opts[k];
   });
   function validateOpts(anchor) {

package/lib/schema-attrcert.js

@@ -39,6 +39,10 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// Own-key membership through an operation taken at load. Written out, the question reads two
+// replaceable properties to answer one thing, and here it decides which object-digest types resolve.
+var _hasOwn = intrinsic.hasOwn;
 var frameworkError = require("./framework-error");
 
 var AttrCertError = frameworkError.AttrCertError;
@@ -69,7 +73,7 @@ var ODT_NAMES = constants.NAMES.OBJECT_DIGEST_TYPE;
 var DIGESTED_OBJECT_TYPE = schema.decode(function (n, ctx) {
   var v = asn1.read.enumerated(n);
   var k = v.toString();
-  if (!Object.prototype.hasOwnProperty.call(ODT_NAMES, k)) {
+  if (!_hasOwn(ODT_NAMES, k)) {
     throw ctx.E("attrcert/bad-digested-object-type", "digestedObjectType " + k + " is not a defined value (RFC 5755 sec. 4.1)");
   }
   // RFC 5755 sec. 7.3 -- a conformant AC MUST NOT use otherObjectTypes(2); the digested

package/lib/schema-crl.js

@@ -28,6 +28,10 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
+var intrinsic = require("./guard-intrinsic");
+// Own-key membership through an operation taken at load. Written out, the question reads two
+// replaceable properties to answer one thing, and here it decides which CRLReason values are defined.
+var _hasOwn = intrinsic.hasOwn;
 
 var CrlError = frameworkError.CrlError;
 var PemError = frameworkError.PemError;
@@ -77,7 +81,7 @@ function decodeExt(ext) {
       // read.enumerated asserts the ENUMERATED tag (a bare INTEGER is rejected) --
       // the codec owns the tag check, so this reader need not repeat it.
       var reason = asn1.read.enumerated(asn1.decode(ext.value));
-      if (!Object.prototype.hasOwnProperty.call(CRL_REASONS, reason.toString())) throw new Error("undefined CRLReason " + reason.toString());
+      if (!_hasOwn(CRL_REASONS, reason.toString())) throw new Error("undefined CRLReason " + reason.toString());
       value = Number(reason);
     } else if (ext.oid === OID_INVALIDITY_DATE) { // invalidityDate ::= GeneralizedTime
       var n = asn1.decode(ext.value);

package/lib/schema-ocsp.js

@@ -39,6 +39,11 @@ var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
+var intrinsic = require("./guard-intrinsic");
+// Own-key membership through an operation taken at load. Written out, the question reads two
+// replaceable properties to answer one thing, and here it decides which response statuses and
+// revocation reasons are defined -- an admitted name names a status RFC 6960 never assigned.
+var _hasOwn = intrinsic.hasOwn;
 
 var OcspError = frameworkError.OcspError;
 var PemError = frameworkError.PemError;
@@ -85,7 +90,7 @@ var GENERALIZED_TIME = pkix.generalizedTime(NS, { code: "ocsp/bad-time", message
 var OCSP_RESPONSE_STATUS = schema.decode(function (n, ctx) {
   var v = asn1.read.enumerated(n);
   var key = v.toString();
-  if (!Object.prototype.hasOwnProperty.call(STATUS_NAMES, key)) throw ctx.E("ocsp/bad-response-status", "undefined OCSPResponseStatus " + key + " (RFC 6960 sec. 4.2.1)");
+  if (!_hasOwn(STATUS_NAMES, key)) throw ctx.E("ocsp/bad-response-status", "undefined OCSPResponseStatus " + key + " (RFC 6960 sec. 4.2.1)");
   return { code: Number(v), name: STATUS_NAMES[key] };
 });
 
@@ -93,7 +98,7 @@ var OCSP_RESPONSE_STATUS = schema.decode(function (n, ctx) {
 var CRL_REASON = schema.decode(function (n, ctx) {
   var v = asn1.read.enumerated(n);
   var key = v.toString();
-  if (!Object.prototype.hasOwnProperty.call(CRL_REASONS, key)) throw ctx.E("ocsp/bad-revocation-reason", "undefined CRLReason " + key + " (RFC 5280 sec. 5.3.1)");
+  if (!_hasOwn(CRL_REASONS, key)) throw ctx.E("ocsp/bad-revocation-reason", "undefined CRLReason " + key + " (RFC 5280 sec. 5.3.1)");
   return CRL_REASONS[key];
 });