@blamejs/pki 0.5.30 → 0.5.32

package/lib/mime.js

@@ -36,15 +36,38 @@ function _splitPoint(bytes) {
   return null;
 }
 
+// Line-ending + whitespace helpers, decided character by character (no regex): _toLf collapses any
+// CRLF / bare CR / bare LF to a single LF; _toCrlf then expands every LF to CRLF; _stripLeadingHtab
+// drops a leading run of SP/HTAB. They match the /\r\n/g, /\r/g, /\n/g and /^[ \t]+/ replacements.
+function _toLf(s) {
+  var out = "";
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charAt(i);
+    if (c === "\r") { if (s.charAt(i + 1) === "\n") continue; out += "\n"; }   // CRLF -> its LF next; bare CR -> LF
+    else out += c;
+  }
+  return out;
+}
+function _toCrlf(s) {
+  var lf = _toLf(s), out = "";
+  for (var i = 0; i < lf.length; i++) { var c = lf.charAt(i); out += (c === "\n") ? "\r\n" : c; }
+  return out;
+}
+function _stripLeadingHtab(s) {
+  var i = 0;
+  while (i < s.length && (s.charAt(i) === " " || s.charAt(i) === "\t")) i += 1;
+  return s.slice(i);
+}
+
 // Split a header block into unfolded logical lines (RFC 5322 folding: a continuation line begins with
 // SP/HTAB and joins the previous). Returns the raw header strings (each "Name: value").
 function _unfoldHeaders(headerText) {
-  var lines = headerText.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
+  var lines = _toLf(headerText).split("\n");
   var out = [];
   for (var i = 0; i < lines.length; i++) {
     var ln = lines[i];
     if (ln === "") continue;
-    if ((ln[0] === " " || ln[0] === "\t") && out.length) out[out.length - 1] += " " + ln.replace(/^[ \t]+/, "");
+    if ((ln[0] === " " || ln[0] === "\t") && out.length) out[out.length - 1] += " " + _stripLeadingHtab(ln);
     else out.push(ln);
   }
   return out;
@@ -130,7 +153,7 @@ function parse(input, E, code) {
     // with only the single conventional ": " delimiter space removed. Leading/trailing whitespace inside
     // the body is preserved, so a consumer that must reproduce the exact authenticated field body (S/MIME
     // header protection) is not handed a lossily-trimmed value.
-    headers.push({ name: nm, lname: nm.toLowerCase(), value: body.trim(), rawValue: body.replace(/^ /, "") });
+    headers.push({ name: nm, lname: nm.toLowerCase(), value: body.trim(), rawValue: body.charAt(0) === " " ? body.slice(1) : body });
   }
   function header(name) { var l = name.toLowerCase(); for (var j = 0; j < headers.length; j++) if (headers[j].lname === l) return headers[j].value; return null; }
   var ctv = header("content-type");
@@ -146,7 +169,7 @@ function parse(input, E, code) {
 // Normalize a text body's line endings to the RFC 8551 sec. 3.1.1 canonical CRLF pair (any bare CR or
 // LF becomes CRLF; an existing CRLF is preserved).
 function canonicalizeText(bodyBytes) {
-  var s = bodyBytes.toString("latin1").replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/\n/g, "\r\n");
+  var s = _toCrlf(bodyBytes.toString("latin1"));
   return Buffer.from(s, "latin1");
 }
 

package/lib/ocsp.js

@@ -84,7 +84,7 @@ function _responseFromBytes(response) {
 }
 
 function _toDer(input, what) {
-  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, OcspError, "ocsp/bad-input", what || "input");
+  if (guard.bytes.isByteSource(input)) return guard.bytes.snapshotSource(input, OcspError, "ocsp/bad-input", what || "input");
   if (typeof input === "string") { try { return ocspSchema.pemDecode(input); } catch (e) { throw _err("ocsp/bad-input", (what || "input") + " PEM could not be decoded", e); } }
   throw _err("ocsp/bad-input", (what || "input") + " must be a DER Buffer, Uint8Array, or PEM string");
 }
@@ -221,16 +221,16 @@ function _buildRequest(query, opts) {
 }
 function _emitReq(der, opts) { return opts.pem ? ocspSchema.pemEncode(der, "OCSP REQUEST") : der; }
 function _nameDer(name) {
-  if (Buffer.isBuffer(name)) return guard.bytes.snapshot(name, OcspError, "ocsp/bad-input", "requestorName");
+  if (guard.bytes.isByteSource(name)) return guard.bytes.snapshotSource(name, OcspError, "ocsp/bad-input", "requestorName");
   if (name && name.bytes) return name.bytes;   // a parsed Name
-  throw _err("ocsp/bad-input", "requestorName must be a DER Name Buffer or a parsed Name");
+  throw _err("ocsp/bad-input", "requestorName must be a DER Name BufferSource or a parsed Name");
 }
 // The RAW DER of a certificate that will be embedded verbatim (the responder cert in a
 // BasicOCSPResponse, the signer cert in a signed OCSPRequest). It must be supplied as bytes:
 // a parsed certificate does not retain its full DER encoding, and re-encoding it would risk
 // byte drift from the signed original, so a parsed cert is rejected rather than reconstructed.
 function _normCertDer(cert, what) {
-  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, OcspError, "ocsp/bad-input", what || "a certificate");
+  if (guard.bytes.isByteSource(cert)) return guard.bytes.snapshotSource(cert, OcspError, "ocsp/bad-input", what || "a certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("ocsp/bad-input", (what || "a certificate") + " PEM could not be decoded", e); } }
   if (cert && cert.tbsBytes && cert.subjectPublicKeyInfo) {
     throw _err("ocsp/bad-input", (what || "a certificate") + " to embed must be supplied as DER bytes or a PEM string, not a parsed certificate (the parser does not retain the full DER encoding needed to embed it verbatim)");
@@ -378,7 +378,7 @@ function _asDate(d) {
 // the aliasing window is wiped rather than left to the garbage collector. Only our own
 // allocations are listed: the caller's key is never written to.
 function _snapshotSignerKey(key, owned) {
-  if (Buffer.isBuffer(key) || key instanceof Uint8Array) {
+  if (Buffer.isBuffer(key) || key instanceof Uint8Array) {   // allow:byte-source-narrow -- responder private key on the key-ownership contract (Buffer / Uint8Array / PEM / CryptoKey); widening keys is a separate root decision
     var copy = guard.bytes.snapshot(key, OcspError, "ocsp/bad-input", "the responder key");
     owned.push(copy);
     return copy;
@@ -550,8 +550,8 @@ function verify(response, opts) {
     // A client that sent a nonce binds it (RFC 9654 / RFC 5019 sec. 4): a missing or mismatched
     // response nonce fails the verdict closed, even if the status/signature were otherwise good.
     var respNonce = _responseNonce(parsed);
-    var reqNonce = (Buffer.isBuffer(opts.requestNonce) || opts.requestNonce instanceof Uint8Array)
-      ? guard.bytes.snapshot(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
+    var reqNonce = guard.bytes.isByteSource(opts.requestNonce)
+      ? guard.bytes.snapshotSource(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
     var matched = respNonce != null && reqNonce != null && guard.crypto.constantTimeEqual(respNonce, reqNonce);
     var out = Object.assign({}, verdict, { nonceMatched: matched });
     // The downgrade applies to `good` ONLY. `unknown` is the closed direction for a

package/lib/oid.js

@@ -652,6 +652,21 @@ function byName(n) {
   return _byName.get(n);
 }
 
+// Does `s` look like a dotted-decimal OID -- one or more digit groups joined by single dots (at least two
+// groups, no leading/trailing/doubled dot)? Distinguishes a numeric OID from a symbolic name so a caller may
+// pass either. Decided by character scan (no regex); the arc-value bounds are the encoder's authority.
+function isDottedDecimal(s) {
+  if (typeof s !== "string" || s.length === 0) return false;
+  var i, c, sawDot = false, atomEmpty = true;
+  for (i = 0; i < s.length; i += 1) {
+    c = s.charCodeAt(i);
+    if (c === 46) { if (atomEmpty) return false; sawDot = true; atomEmpty = true; }   // "."
+    else if (c >= 48 && c <= 57) { atomEmpty = false; }                               // 0-9
+    else return false;
+  }
+  return sawDot && !atomEmpty;
+}
+
 function has(dotted) {
   _assertDotted(dotted, "has");
   return _byOid.has(dotted);
@@ -876,6 +891,7 @@ function kemParams(oidOrName) { return KEM_PARAMS[oidOrName]; }
 module.exports = {
   name:           name,
   byName:         byName,
+  isDottedDecimal: isDottedDecimal,
   has:            has,
   paramsMustBeAbsent: paramsMustBeAbsent,
   kemParams:      kemParams,

package/lib/path-validate.js

@@ -49,6 +49,7 @@ var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -568,11 +569,54 @@ function hostConstraintMatch(constraint, host) {
 // or a value carrying non-hostname characters (a scheme "://", a path "/", a
 // port ":") is not a FQDN and cannot be matched against a domain-suffix
 // constraint. Only [A-Za-z0-9.-] with at least one dot qualifies.
+// A code-point membership table built from a string of the allowed characters, and the shared scan that
+// checks every character of a non-empty string against one -- replacing the hostname-charset regexes
+// through one loop (no per-predicate character-class chain).
+function _charTable(chars) { var t = []; for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true; return t; }
+var _FQDN_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-");   // /^[a-z0-9.-]+$/i
+var _DIGDOT_TABLE = _charTable("0123456789.");                                                     // /^[0-9.]+$/
+function _allCharsIn(s, table) {
+  if (s.length === 0) return false;
+  for (var i = 0; i < s.length; i++) if (!table[_charCodeAt(s, i)]) return false;
+  return true;
+}
+// /^[0-9]/ : begins with an ASCII digit (a dotted-OID attempt, vs an EKU / purpose name).
+function _startsWithDigit(s) { if (s.length === 0) return false; var c = _charCodeAt(s, 0); return c >= 48 && c <= 57; }
+
+var _SCHEME_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+.-");   // [a-z0-9+.-]
+// /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i : the [start, end) range of the authority (up to the first / ? #
+// or end), or null when the input is not a scheme "//" URI. Returns a range so the caller slices once
+// (the slice that replaces the removed .exec), not a fresh substring here.
+function _uriAuthorityRange(uri) {
+  var n = uri.length;
+  if (n === 0) return null;
+  var c0 = _charCodeAt(uri, 0);
+  if (!((c0 >= 65 && c0 <= 90) || (c0 >= 97 && c0 <= 122))) return null;                 // scheme starts with a letter
+  var p = 1;
+  while (p < n && _SCHEME_TABLE[_charCodeAt(uri, p)]) p += 1;
+  if (_charCodeAt(uri, p) !== 58 || _charCodeAt(uri, p + 1) !== 47 || _charCodeAt(uri, p + 2) !== 47) return null;   // "://"
+  p += 3;
+  var authStart = p;
+  while (p < n) { var d = _charCodeAt(uri, p); if (d === 47 || d === 63 || d === 35) break; p += 1; }   // [^/?#]*
+  return [authStart, p];
+}
+// /:\d+$/ : the index at which a trailing ":" + digits port starts (to slice off), or s.length when absent.
+function _portStripIndex(s) {
+  var i = s.length;
+  while (i > 0) { var c = _charCodeAt(s, i - 1); if (c >= 48 && c <= 57) i -= 1; else break; }
+  return (i < s.length && i > 0 && _charCodeAt(s, i - 1) === 58) ? i - 1 : s.length;
+}
+// /^\[(.*)\]$/ -> "$1" : an IPv6 literal's surrounding "[" "]" removed, else the string unchanged.
+function _stripBrackets(s) {
+  var n = s.length;
+  return (n >= 2 && _charCodeAt(s, 0) === 91 && _charCodeAt(s, n - 1) === 93) ? s.slice(1, n - 1) : s;
+}
+
 function isFqdnHost(host) {
   var h = stripTrailingDot(host);
   if (h === "" || h.indexOf(".") === -1) return false;       // empty or single-label (localhost)
-  if (!/^[a-z0-9.-]+$/i.test(h)) return false;               // scheme/path/port/IPv6 chars, "@", etc.
-  if (/^[0-9.]+$/.test(h)) return false;                     // IPv4 dotted-quad literal
+  if (!_allCharsIn(h, _FQDN_TABLE)) return false;            // scheme/path/port/IPv6 chars, "@", etc.
+  if (_allCharsIn(h, _DIGDOT_TABLE)) return false;           // IPv4 dotted-quad literal
   return true;
 }
 
@@ -595,9 +639,9 @@ function uriMatch(constraint, uri) {
 }
 
 function uriHost(uri) {
-  var m = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(uri);
-  if (!m) return null;
-  var authority = m[1];
+  var r = _uriAuthorityRange(uri);
+  if (r === null) return null;
+  var authority = uri.slice(r[0], r[1]);
   // authority = [ userinfo "@" ] host [ ":" port ]. RFC 3986 userinfo does not
   // contain a raw "@", so a conformant authority has at most one "@". With more
   // than one the host cannot be determined reliably, so this fails closed
@@ -606,7 +650,7 @@ function uriHost(uri) {
   var firstAt = authority.indexOf("@");
   if (firstAt !== authority.lastIndexOf("@")) return null;
   if (firstAt !== -1) authority = authority.slice(firstAt + 1);
-  var host = authority.replace(/:\d+$/, "");
+  var host = authority.slice(0, _portStripIndex(authority));
   return host === "" ? null : host;   // an empty authority cannot be evaluated -> unsupported
 }
 
@@ -788,8 +832,7 @@ function treeIsEmpty(tree) { return tree.children.length === 0; }
 function isSubtreeBaseValid(tag, base) {
   switch (tag) {
     case 1: case 2: case 6: return typeof base === "string";                       // rfc822Name / dNSName / URI
-    case 7: return (Buffer.isBuffer(base) || base instanceof Uint8Array) &&
-                   (base.length === 8 || base.length === 32);                      // iPAddress: address + mask
+    case 7: return Buffer.isBuffer(base) && (base.length === 8 || base.length === 32);   // iPAddress: address + mask (any BufferSource is normalized to a Buffer in checkedSubtreeSeeds)
     case 4: return base !== null && typeof base === "object" && !!base.rdns && intrinsic.isArray(base.rdns);   // directoryName
     default: return base !== undefined;
   }
@@ -803,10 +846,19 @@ function checkedSubtreeSeeds(list, optName) {
   if (list === undefined || list === null) return [];
   if (!intrinsic.isArray(list)) throw E("path/bad-input", "validate: opts." + optName + " must be an array of { tag, base } subtree entries");
   return list.map(function (st) {
-    if (!st || typeof st !== "object" || !Number.isInteger(st.tag) || st.tag < 0 || st.tag > 8 || !isSubtreeBaseValid(st.tag, st.base)) {
+    if (!st || typeof st !== "object" || !Number.isInteger(st.tag) || st.tag < 0 || st.tag > 8) {
+      throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
+    }
+    // An iPAddress base (address+mask) may arrive as any BufferSource; normalize it to a
+    // private Buffer so the matcher can index it by byte and a caller cannot mutate it once a
+    // microtask has passed. The name forms (string / directoryName) are validated as they stand.
+    var base = (st.tag === 7 && guard.bytes.isByteSource(st.base))
+      ? guard.bytes.snapshotSource(st.base, PathError, "path/bad-input", "an iPAddress subtree base")
+      : st.base;
+    if (!isSubtreeBaseValid(st.tag, base)) {
       throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
     }
-    return { tag: st.tag, base: st.base };
+    return { tag: st.tag, base: base };
   });
 }
 
@@ -2522,8 +2574,8 @@ function verifyOcspResponse(response, cert, issuerCert, time, opts) {
 var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
 function _ocspFromBytes(response) {
   return guard.parsed.fromTrustedSource(response, "ocspResponse", _OCSP_CLAIM, function (bytes) {
-    if (!Buffer.isBuffer(bytes) && !(bytes instanceof Uint8Array) && typeof bytes !== "string") {
-      throw E("path/bad-input", "verifyOcspResponse: the response must be an OCSP response DER Buffer, a PEM string, or a pki.schema.ocsp.parseResponse result");
+    if (!guard.bytes.isByteSource(bytes) && typeof bytes !== "string") {
+      throw E("path/bad-input", "verifyOcspResponse: the response must be an OCSP response DER BufferSource, a PEM string, or a pki.schema.ocsp.parseResponse result");
     }
     return ocsp.parseResponse(bytes);
   }, E, "path/bad-input",
@@ -2674,7 +2726,7 @@ function resolvePurposeOpts(opts) {
       // A dotted-form attempt (leads with a digit) must be a canonical OID -- a
       // loose regex accepted a leading-zero / out-of-bounds key that would never
       // match the canonical EKU the target advertises; anything else is a name.
-      if (/^[0-9]/.test(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
+      if (_startsWithDigit(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
       var dotted = oid.byName(p);
       if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
       return dotted;
@@ -2685,7 +2737,7 @@ function resolvePurposeOpts(opts) {
     if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
       throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
     }
-    if (/^[0-9]/.test(opts.checkPurpose)) {
+    if (_startsWithDigit(opts.checkPurpose)) {
       var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
       checkPurpose = oid.name(cpDotted) || cpDotted;   // normalize a dotted purpose OID to its name for the anchor map
     } else {
@@ -2840,7 +2892,7 @@ function toAnchor(entry, verb) {
   // entry refusal, not a raw exception leaked past the typed guards. `alg` and the raw publicKey are PINNED
   // to ONE read here and used throughout, so a stateful accessor that returns a value now and throws (or
   // returns a different value) on a later read cannot slip past this guard at the shape check or the snapshot.
-  var isTuple = false, alg = null, pubRaw = null, nameRaw = null, pk = null, purposesSnap, distrustSnap;
+  var isTuple = false, alg = null, pubRaw, nameRaw = null, pk = null, purposesSnap, distrustSnap;
   var subjectDerRaw, labelRaw, mozRaw;
   // A Proxy anchor is refused outright. Every field read below -- whether by property access or from an own
   // data descriptor -- is answered by the anchor's own reflection, and a Proxy's traps let the same read
@@ -2915,7 +2967,10 @@ function toAnchor(entry, verb) {
       // it is captured. A non-tuple leaves pk null / isTuple false and falls through to coerceCert below.
       pubRaw = entry.publicKey;
       if (guard.bytes.isByteSource(pubRaw)) {
-        pk = guard.bytes.snapshot(pubRaw, PathError, "path/bad-input", who + ": trustAnchor publicKey");
+        // snapshotSource, not snapshot: isByteSource accepts all four BufferSource forms (Buffer, any view,
+        // DataView, ArrayBuffer), so the normalizer must too -- snapshot accepts only Buffer/Uint8Array and
+        // would accept-then-throw on an ArrayBuffer / DataView anchor publicKey.
+        pk = guard.bytes.snapshotSource(pubRaw, PathError, "path/bad-input", who + ": trustAnchor publicKey");
       }
       nameRaw = entry.name;
       alg = entry.algorithm;
@@ -3005,7 +3060,10 @@ function toAnchor(entry, verb) {
     // resolve a polluted Object.prototype.rdns on a name that supplied none (and could invoke an inherited
     // throwing getter) -- means a name with no own rdns is refused, never accepted on an inherited array.
     var nameHasRdns = intrinsic.hasOwn(nameOut, "rdns") && intrinsic.isArray(nameOut.rdns);
-    if (!nameHasRdns || !Buffer.isBuffer(pubRaw) || algStr === null) {
+    // Gate on the NORMALIZED key `pk` (a private Buffer from snapshotSource iff publicKey was any of the four
+    // BufferSource forms), not the raw `pubRaw` -- Buffer.isBuffer(pubRaw) would reject a Uint8Array / view /
+    // ArrayBuffer publicKey that isByteSource + snapshotSource just accepted.
+    if (!nameHasRdns || !Buffer.isBuffer(pk) || algStr === null) {
       throw E("path/bad-input", who + ": a trustAnchor tuple must be { name: { rdns: [...] }, publicKey: Buffer, algorithm: an OID string or a SubjectPublicKeyInfo algorithm carrying an oid }");
     }
     // Hold the stated algorithm to a canonical dotted-decimal OID: a shape-valid but non-canonical value
@@ -3256,7 +3314,7 @@ async function _fetchAiaIssuers(current, aia) {
     // A DNS-NAME host's private RESOLUTION can only be blocked by a transport that filters the resolved address;
     // with an UNGUARDED transport (an injected fn that does not vouch blocksPrivateAddresses) fail closed -- fetch
     // IP literals only (already validated above), never a hostname whose resolved address we cannot verify.
-    if (net.isIP(u.hostname.replace(/^\[(.*)\]$/, "$1")) === 0 && !aia.transportGuardsAddresses) continue;
+    if (net.isIP(_stripBrackets(u.hostname)) === 0 && !aia.transportGuardsAddresses) continue;
     u.hash = "";                                          // the fragment is never sent on the wire -> not part of the request/dedupe identity
     if (intrinsic.setHas(aia.fetchedUrls, u.href) || intrinsic.setHas(seenThisCert, u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
     if (seenThisCert.size >= aia.maxPerCert) break;       // per-cert DISTINCT-url cap, checked BEFORE appending so maxAiaPerCert:0 collects nothing (no fetch at all)

package/lib/pbes2.js

@@ -157,7 +157,7 @@ function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
   opts = opts || {};
   var cipherName = opts.cipher || "aes256-CBC";
   var keyBits = CONTENT_KEYBITS[O(cipherName)];
-  if (!keyBits || !/CBC/.test(cipherName)) throw E(prefix + "/bad-input", "unsupported PBES2 cipher " + cipherName + " (AES-CBC only)");
+  if (!keyBits || cipherName.indexOf("CBC") === -1) throw E(prefix + "/bad-input", "unsupported PBES2 cipher " + cipherName + " (AES-CBC only)");
   var prf = opts.prf || "hmacWithSHA256";
   var prfNode = prfNodeByName(prf, E, prefix);
   var iterations = assertIterations(opts.iterations == null ? 2048 : opts.iterations, E, prefix);
@@ -200,7 +200,7 @@ function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix, budget) {
     pb = parsePbkdf2Params(kdf[1].bytes, opts, E, prefix, true);   // strictPrf: reject a non-canonical explicit default prf
     var encOid = asn1.read.oid(encScheme[0]);
     keyBits = CONTENT_KEYBITS[encOid];
-    if (!keyBits || !/CBC/.test(oid.name(encOid) || "")) throw E(prefix + "/unsupported-algorithm", "unsupported PBES2 encryptionScheme " + (oid.name(encOid) || encOid) + " (AES-CBC only)");
+    if (!keyBits || (oid.name(encOid) || "").indexOf("CBC") === -1) throw E(prefix + "/unsupported-algorithm", "unsupported PBES2 encryptionScheme " + (oid.name(encOid) || encOid) + " (AES-CBC only)");
     iv = asn1.read.octetString(encScheme[1]);
     if (iv.length !== 16) throw E(prefix + "/bad-algorithm-parameters", "the AES-CBC IV must be 16 octets");
   } catch (e) {

package/lib/pkcs12-build.js

@@ -216,7 +216,7 @@ function _p12Encode(pw) {
   // A view first, so a detached backing store is a reject and never an empty password; then a copy,
   // because everything this function returns is reported owned and gets zeroized after derivation,
   // and handing back a view of a caller's Uint8Array would wipe the caller's own credential.
-  if (Buffer.isBuffer(pw) || pw instanceof Uint8Array) return guard.bytes.snapshot(pw, Pkcs12Error, "pkcs12/bad-input", "the password");
+  if (Buffer.isBuffer(pw) || pw instanceof Uint8Array) return guard.bytes.snapshot(pw, Pkcs12Error, "pkcs12/bad-input", "the password");   // allow:byte-source-narrow -- password on the ownership contract (string / Buffer / Uint8Array); widening passwords is a separate root decision
   if (typeof pw !== "string") throw _err("pkcs12/bad-input", _MISSING_PASSWORD);
   var out = Buffer.alloc(pw.length * 2 + 2);   // + the 2-byte NULL terminator
   for (var i = 0; i < pw.length; i++) {
@@ -507,7 +507,7 @@ async function _buildAuthSafeElement(sc, opts) {
     var alg = sc.contentEncryptionAlgorithm || "aes-256-cbc";
     // RFC 7292 sec. 4.1 lists only id-envelopedData for a public-key privacy safe (never id-ct-authEnvelopedData);
     // cms.encrypt DEFAULTS to aes-256-gcm (AEAD -> AuthEnvelopedData), so force a CBC content cipher and reject GCM.
-    if (!/^aes-(128|192|256)-cbc$/.test(alg)) throw _err("pkcs12/bad-input", "a public-key privacy safe requires an AES-CBC content cipher (aes-128|192|256-cbc), not " + JSON.stringify(alg) + " -- RFC 7292 sec. 4.1 admits only id-envelopedData, not GCM/AuthEnvelopedData");
+    if (alg !== "aes-128-cbc" && alg !== "aes-192-cbc" && alg !== "aes-256-cbc") throw _err("pkcs12/bad-input", "a public-key privacy safe requires an AES-CBC content cipher (aes-128|192|256-cbc), not " + JSON.stringify(alg) + " -- RFC 7292 sec. 4.1 admits only id-envelopedData, not GCM/AuthEnvelopedData");
     var envCi = await cms.encrypt(safeContentsDer, sc.recipients, { contentEncryptionAlgorithm: alg, contentType: "data" });
     return b.raw(envCi);   // cms.encrypt returns the whole id-envelopedData ContentInfo DER -- splice it verbatim
   }