@blamejs/pki 0.5.30 → 0.5.32

package/lib/cms-compress.js

@@ -37,7 +37,7 @@ var NULL_PARAMS_DER = Buffer.from([0x05, 0x00]);
 // (default id-data), eContent = the RFC 1950 ZLIB stream }.
 async function compress(content, opts) {
   opts = opts || {};
-  var raw = guard.bytes.view(content, CmsError, "cms/bad-input", "content");
+  var raw = guard.bytes.source(content, CmsError, "cms/bad-input", "content");
   var level = opts.level;
   if (level !== undefined && (typeof level !== "number" || !isFinite(level) || Math.floor(level) !== level)) throw _err("cms/bad-input", "opts.level must be an integer");
   var ctName = opts.contentType || "data";
@@ -86,7 +86,7 @@ async function decompress(input, opts) {
 }
 
 function _toDer(input) {
-  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, CmsError, "cms/bad-input", "input");
+  if (guard.bytes.isByteSource(input)) return guard.bytes.snapshotSource(input, CmsError, "cms/bad-input", "input");
   if (typeof input === "string") { try { return schemaCms.pemDecode(input); } catch (e) { throw _err("cms/bad-input", "the CMS PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }

package/lib/cms-decrypt.js

@@ -129,7 +129,7 @@ function _parse(input) {
   return schemaCms.parse(_toDer(input));
 }
 function _toDer(input) {
-  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, CmsError, "cms/bad-input", "input");
+  if (guard.bytes.isByteSource(input)) return guard.bytes.snapshotSource(input, CmsError, "cms/bad-input", "input");
   if (typeof input === "string") { try { return schemaCms.pemDecode(input); } catch (e) { throw _err("cms/bad-input", "the CMS PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }
@@ -166,7 +166,7 @@ function _riKindForKey(km) {
   throw _err("cms/bad-input", "key material needs { key, cert }, { password }, { kek }, or { cek }");
 }
 function _assertSupported(ri, km) {
-  if (ri.type === "kari" && ri.keyEncryptionAlgorithm && /mqv/i.test(ri.keyEncryptionAlgorithm.name || "")) throw _err("cms/unsupported-algorithm", "ECMQV kari is not supported");
+  if (ri.type === "kari" && ri.keyEncryptionAlgorithm && intrinsic.stringIndexOf(intrinsic.toLowerCase(ri.keyEncryptionAlgorithm.name || ""), "mqv") !== -1) throw _err("cms/unsupported-algorithm", "ECMQV kari is not supported");   // /mqv/i (ASCII name)
   if (ri.type === "ori") {
     if (ri.oriType !== O("kem")) throw _err("cms/unsupported-recipient-type", "unsupported OtherRecipientInfo type " + ri.oriType);
     if (ri.kemri && ri.kemri.kem && ri.kemri.kem.oid === O("id-kem-rsa")) throw _err("cms/unsupported-algorithm", "RSA-KEM is not supported");
@@ -801,7 +801,7 @@ function _releaseKeyDer(k) {
   if (k && k.owned) guard.secret.zeroize(k.der, CmsError, "cms/bad-input", "the recipient private-key copy");
 }
 function _normCertDer(cert) {
-  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, CmsError, "cms/bad-input", "the recipient certificate");
+  if (guard.bytes.isByteSource(cert)) return guard.bytes.snapshotSource(cert, CmsError, "cms/bad-input", "the recipient certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("cms/bad-input", "the recipient certificate PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "the recipient certificate must be a DER Buffer or PEM string");
 }

package/lib/cms-encrypt.js

@@ -41,7 +41,7 @@ function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(nam
 // A certificate descriptor -> raw DER (the recipient cert is parsed for dispatch + rid; the caller
 // supplies bytes, not a re-encoded parse).
 function _normCertDer(cert, what) {
-  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, CmsError, "cms/bad-input", what || "a certificate");
+  if (guard.bytes.isByteSource(cert)) return guard.bytes.snapshotSource(cert, CmsError, "cms/bad-input", what || "a certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("cms/bad-input", (what || "a certificate") + " PEM could not be decoded", e); } }
   throw _err("cms/bad-input", (what || "a certificate") + " must be a DER Buffer, Uint8Array, or PEM string");
 }

package/lib/cms-sign.js

@@ -134,7 +134,7 @@ function _resolveAttrPairs(list, what) {
   return (list || []).map(function (a) {
     var vals = (a.values || []).map(function (v) { return _toBuf(v, what); });
     if (!vals.length) throw _err("cms/bad-input", "a signed attribute must carry at least one value (RFC 5652 -- Attribute values is SET SIZE (1..MAX))");
-    return { type: /^\d+(\.\d+)+$/.test(a.type) ? a.type : O(a.type), values: vals };
+    return { type: oid.isDottedDecimal(a.type) ? a.type : O(a.type), values: vals };
   });
 }
 
@@ -351,17 +351,17 @@ function _keyOnlyKeyId(so) {
 
 function _normCertDer(c) {
   if (c == null) throw _err("cms/bad-input", "each signer requires a certificate (cert)");
-  if (c instanceof Uint8Array || Buffer.isBuffer(c)) {
-    c = guard.bytes.snapshot(c, CmsError, "cms/bad-input", "a signer certificate");
+  if (guard.bytes.isByteSource(c)) {
+    c = guard.bytes.snapshotSource(c, CmsError, "cms/bad-input", "a signer certificate");
     return c[0] === 0x30 ? c : _pemToDer(c.toString("latin1"));   // DER as-is, else PEM
   }
   if (typeof c === "string") return _pemToDer(c);
   throw _err("cms/bad-input", "a signer certificate must be a DER Buffer or a PEM string");
 }
 function _pemToDer(text) {
-  var m = text.match(/-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/);
-  if (!m) throw _err("cms/bad-input", "a signer certificate PEM is not a CERTIFICATE block");
-  return Buffer.from(m[1].replace(/[^A-Za-z0-9+/=]/g, ""), "base64");
+  var der = pkix.pemDecodeLenient(text, "CERTIFICATE");
+  if (der === null) throw _err("cms/bad-input", "a signer certificate PEM is not a CERTIFICATE block");
+  return der;
 }
 
 // pki.cms.sign -- documented by the @primitive block in cms-verify.js (the @module pki.cms home).
@@ -460,7 +460,7 @@ function _dedupe(ders) {
 }
 
 function _toBuf(v, what) {
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmsError, "cms/bad-input", what);
+  if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, CmsError, "cms/bad-input", what);
   throw _err("cms/bad-input", what + " must be a Buffer");
 }
 

package/lib/cms-verify.js

@@ -123,7 +123,7 @@ EC_CURVE[oid.byName("secp384r1")] = { curve: "P-384", coordLen: 48 };
 EC_CURVE[oid.byName("secp521r1")] = { curve: "P-521", coordLen: 66 };
 
 function _toBuf(v, what) {
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmsError, "cms/bad-input", what);
+  if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, CmsError, "cms/bad-input", what);
   throw _err("cms/bad-input", what + " must be a Buffer");
 }
 
@@ -679,7 +679,7 @@ function _snapshotIfBytes(input, label) {
   // Every byte form the parser accepts -- an ArrayBuffer or a DataView reaches the
   // decoder as readily as a Buffer, and leaving those aliased would reopen the
   // window for exactly the inputs that came in by the wider door.
-  if (ArrayBuffer.isView(input) || input instanceof ArrayBuffer) {
+  if (guard.bytes.isByteSource(input)) {
     return guard.bytes.snapshotSource(input, CmsError, "cms/bad-input", label);
   }
   return input;
@@ -804,7 +804,7 @@ function setEngine(engine) { _engine = engine; }
 // rewritten. `requiredEku` is copied for the same reason as the array.
 var _ANCHOR_CLONE_DEPTH = 8;
 function _cloneAnchorValue(v, depth) {
-  if (Buffer.isBuffer(v) || ArrayBuffer.isView(v) || v instanceof ArrayBuffer) {
+  if (guard.bytes.isByteSource(v)) {
     return _snapshotIfBytes(v, "opts.trustAnchors[]");
   }
   if (v === null || typeof v !== "object") return v;
@@ -969,7 +969,12 @@ function _applyTrust(res, parsedCerts, cfg) {
           // A CONFIG fault -- unusable anchors, an invalid time -- is the caller's mistake and must
           // not be absorbed into "untrusted", which would read as a verdict about the message. A
           // chain that simply does not reach an anchor is not that: it is the answer.
-          if (e && e.code && /bad-input|bad-anchor|bad-time/.test(String(e.code))) throw e;
+          if (e && e.code) {
+            var code = String(e.code);
+            if (intrinsic.stringIndexOf(code, "bad-input") !== -1 ||
+                intrinsic.stringIndexOf(code, "bad-anchor") !== -1 ||
+                intrinsic.stringIndexOf(code, "bad-time") !== -1) throw e;
+          }
           s.trusted = false;
         });
     });

package/lib/crl-sign.js

@@ -180,7 +180,7 @@ function _resolveReason(reason, isDelta) {
 // The AKI keyIdentifier from the issuer: an explicit Buffer, or true -> the issuer cert's subjectKeyIdentifier,
 // else the SHA-1 of the issuer SPKI (RFC 5280 sec. 5.2.1 key-identifier method).
 function _akiKeyId(val, ctx) {
-  if (Buffer.isBuffer(val)) return guard.bytes.snapshot(val, CrlError, "crl/bad-input", "the authorityKeyIdentifier keyIdentifier");
+  if (guard.bytes.isByteSource(val)) return guard.bytes.snapshotSource(val, CrlError, "crl/bad-input", "the authorityKeyIdentifier keyIdentifier");
   if (val === true) {
     if (ctx.issuerCert) {
       var ski = (ctx.issuerCert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
@@ -463,7 +463,7 @@ function _sign(spec, issuer, opts) {
         : "explicit form; the issuer takes { key, name, publicKey }, or { key, cert } to take both from a certificate");
     });
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "crl/bad-input", "pki.crl.sign has an unknown option ");
-  if (issuer.key == null) throw _err("crl/bad-input", "a signing key (issuer.key, a PKCS#8 private key) is required");
+  if (issuer.key == null) throw _err("crl/bad-input", "a signing key (issuer.key, a WebCrypto CryptoKey or a PKCS#8 private key DER/PEM) is required");
 
   // Resolve the issuer name + signing-key SPKI. `{ cert }` supplies both; else `{ name|spec.issuer, publicKey }`.
   var issuerDer, issuerSpki, issuerCert = null;
@@ -597,7 +597,7 @@ function _coerceCrl(crl) {
 // names, are separate questions that only a certificate can answer.
 function _resolveIssuer(issuer) {
   if (issuer == null) throw _err("crl/bad-input", "an issuer is required to verify a CRL");
-  if (Buffer.isBuffer(issuer)) { _assertValidSpki(issuer, "issuer SPKI"); return { spki: issuer, cert: null }; }
+  if (guard.bytes.isByteSource(issuer)) { var _isp = guard.bytes.source(issuer, CrlError, "crl/bad-input", "issuer SPKI"); _assertValidSpki(_isp, "issuer SPKI"); return { spki: _isp, cert: null }; }
   if (issuer.cert != null) { var ic = _parseIssuerCert(issuer.cert); return { spki: ic.subjectPublicKeyInfo.bytes, cert: ic }; }
   if (issuer.publicKey != null) { var spki = _reqDer(issuer.publicKey, "issuer.publicKey"); _assertValidSpki(spki, "issuer.publicKey"); return { spki: spki, cert: null }; }
   // A parsed certificate passed directly. It reaches the same identity and cRLSign checks the
@@ -685,8 +685,8 @@ function _serialHexOf(serial) {
   if (typeof serial === "bigint") v = serial;
   else if (typeof serial === "number") { if (!Number.isSafeInteger(serial)) throw _err("crl/bad-input", "serialNumber number must be a safe integer (pass a BigInt, hex string, or Buffer)"); v = BigInt(serial); }
   else if (typeof serial === "string") { try { v = BigInt(serial); } catch (e) { throw _err("crl/bad-input", "serialNumber string must be a decimal or 0x-hex integer", e); } }
-  else if (Buffer.isBuffer(serial)) { v = serial.length ? BigInt("0x" + serial.toString("hex")) : 0n; }
-  else throw _err("crl/bad-input", "serialNumber must be a BigInt, integer, hex string, or Buffer");
+  else if (guard.bytes.isByteSource(serial)) { var _sb = guard.bytes.source(serial, CrlError, "crl/bad-input", "serialNumber"); v = _sb.length ? BigInt("0x" + _sb.toString("hex")) : 0n; }
+  else throw _err("crl/bad-input", "serialNumber must be a BigInt, integer, hex string, or BufferSource");
   if (v <= 0n) throw _err("crl/bad-input", "serialNumber must be a positive integer");
   // Match schema-crl's serialNumberHex: the DER INTEGER content octets (preserving sign padding).
   return asn1.decode(b.integer(v)).content.toString("hex");

package/lib/crmf-sign.js

@@ -328,7 +328,8 @@ function _buildEncryptedKeyPop(pop, outerTag, template) {
   // reject. CBC is the default here for that reason, not as a preference between the two.
   var cea = pop.contentEncryptionAlgorithm || "aes-256-cbc";
   if (typeof cea !== "string") throw _err("crmf/bad-input", "pop.contentEncryptionAlgorithm must be an algorithm name");
-  if (/gcm|ccm|chacha/i.test(cea)) {
+  var _ceaLc = intrinsic.toLowerCase(cea);   // /gcm|ccm|chacha/i (ASCII algorithm name)
+  if (intrinsic.stringIndexOf(_ceaLc, "gcm") !== -1 || intrinsic.stringIndexOf(_ceaLc, "ccm") !== -1 || intrinsic.stringIndexOf(_ceaLc, "chacha") !== -1) {
     throw _err("crmf/bad-popo", "encryptedKey is typed EnvelopedData, and the AEAD algorithm " + cea +
       " produces an AuthEnvelopedData instead (RFC 5083) -- choose a CBC content-encryption algorithm");
   }

package/lib/csr-sign.js

@@ -47,9 +47,6 @@ var _b = pkiBuild.makeBuilder({
   NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
 });
 
-// challengePassword DirectoryString charset (PrintableString set); anything else uses UTF8String.
-var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
-
 // attributes ::= [0] IMPLICIT SET OF Attribute (RFC 2986). The IMPLICIT tag replaces the universal SET,
 // so it is a context-constructed [0] whose DER-sorted members ARE the SET-OF; empty -> A0 00.
 function _implicitSetOf0(members) {
@@ -64,7 +61,7 @@ function _buildRequestedExtensions(extSpec, subjectSpki) { return _b.requestedEx
 // value is in that charset, else UTF8String; never a Teletex/BMP/Universal string for a new value.
 function _challengePassword(pw) {
   if (typeof pw !== "string" || pw.length < 1 || pw.length > 255) throw _err("csr/bad-input", "challengePassword must be a 1..255 character string (RFC 2985 sec. 5.4.1)");
-  return PRINTABLE_RE.test(pw) ? b.printable(pw) : b.utf8(pw);
+  return asn1.isPrintableString(pw) ? b.printable(pw) : b.utf8(pw);
 }
 
 /**

package/lib/ct.js

@@ -49,6 +49,10 @@ var intrinsic = require("./guard-intrinsic.js");
 // replaceable properties to answer one thing, and here it decides whether a log state is one this
 // toolkit trusts -- answering true for a name the table never carried trusts an untrusted log.
 var _hasOwn = intrinsic.hasOwn;
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _JSON_SUFFIX = ".json";
+// A pathname ending with the literal ".json" suffix (matching /\.json$/), by suffix compare (no regex).
+function _endsWithJson(s) { return s.length >= _JSON_SUFFIX.length && _strSlice(s, s.length - _JSON_SUFFIX.length) === _JSON_SUFFIX; }
 var ByteReader = require("./byte-reader.js");
 var ByteWriter = require("./byte-writer.js");
 var oid = require("./oid.js");
@@ -973,9 +977,9 @@ function _parseHttpsUrl(u, label) {
 // yield an unambiguous sig URL, so the caller must pass opts.sigUrl explicitly (guards never guess a value).
 // The derived URL inherits the json URL's https origin.
 function _sigUrlFor(parsed) {
-  if (!/\.json$/.test(parsed.pathname)) throw _ctErr("ct/bad-input", "cannot derive the detached-signature URL from a non-.json path (" + JSON.stringify(parsed.pathname) + "); pass opts.sigUrl explicitly");
+  if (!_endsWithJson(parsed.pathname)) throw _ctErr("ct/bad-input", "cannot derive the detached-signature URL from a non-.json path (" + JSON.stringify(parsed.pathname) + "); pass opts.sigUrl explicitly");
   var sig = new URL(parsed.href);
-  sig.pathname = parsed.pathname.replace(/\.json$/, ".sig");
+  sig.pathname = _strSlice(parsed.pathname, 0, parsed.pathname.length - _JSON_SUFFIX.length) + ".sig";
   return sig.href;
 }
 
@@ -994,8 +998,8 @@ function _fetchBody(transport, url, req, label) {
     res = res || {};
     var h = {};
     Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
-    var body = (Buffer.isBuffer(res.body) || res.body instanceof Uint8Array)
-      ? guard.bytes.view(res.body, CtError, "ct/bad-input", label)
+    var body = guard.bytes.isByteSource(res.body)
+      ? guard.bytes.source(res.body, CtError, "ct/bad-input", label)
       : Buffer.from(String(res.body == null ? "" : res.body), "utf8");
     if (body.length > req.maxResponseBytes) throw _ctErr("ct/response-too-large", "the " + label + " (" + body.length + " bytes) exceeds the " + req.maxResponseBytes + "-byte cap");
     if (res.status !== 200) throw _ctErr("ct/http-error", "the CT server returned HTTP " + JSON.stringify(res.status) + " for the " + label);