@blamejs/pki 0.5.4 → 0.5.5

package/lib/guard-encoding.js

@@ -25,9 +25,33 @@
 // domain/reason; `label` the field phrase; `maxBytes` an optional decoded-size
 // cap (null/undefined = uncapped, for a PEM cert body already bounded upstream).
 
-var B64URL_ALPHABET = /^[A-Za-z0-9_-]*$/;
-var B64_ALPHABET = /^[A-Za-z0-9+/]*={0,2}$/;
-var HEX_ALPHABET = /^[0-9A-Fa-f]*$/;
+// The alphabets are TABLES, walked one character at a time, rather than regular
+// expressions. A guard runs on the most hostile input the toolkit sees, and a
+// pattern engine's cost on a non-matching string is a property of the pattern
+// rather than of the length -- the one thing a bound cannot be placed on from the
+// outside. A table lookup is one array index per character and its cost is the
+// length, which the caller already caps. It is also the more honest statement of
+// the rule: the set of permitted characters IS the rule, written out.
+function _alphabet(chars) {
+  var t = new Uint8Array(128);
+  for (var i = 0; i < chars.length; i++) t[chars.charCodeAt(i)] = 1;
+  return t;
+}
+var UPPER = "ABCDEFGHIJKLMNOPQRSTUVWXYZ", LOWER = "abcdefghijklmnopqrstuvwxyz", DIGITS = "0123456789";
+var B64URL_ALPHABET = _alphabet(UPPER + LOWER + DIGITS + "-_");
+var B64_ALPHABET = _alphabet(UPPER + LOWER + DIGITS + "+/");
+var HEX_ALPHABET = _alphabet(DIGITS + "abcdef" + "ABCDEF");
+
+// Every character of `text` is in `table`. A code point outside Latin-1's low half
+// (including every astral half) is outside all three alphabets, so the table bound
+// is the reject rather than an index that reads undefined.
+function _inAlphabet(text, table) {
+  for (var i = 0; i < text.length; i++) {
+    var c = text.charCodeAt(i);
+    if (c > 127 || table[c] !== 1) return false;
+  }
+  return true;
+}
 
 // Reject before Buffer.from allocates: a base64 text of N chars decodes to at
 // most floor(N*3/4) bytes, a hex text to N/2.
@@ -49,7 +73,7 @@ function _capBefore(nChars, perByteChars, maxBytes, E, code, label) {
 // @enforced-by base64-decode-not-via-guard
 function base64url(text, maxBytes, E, code, label) {
   if (typeof text !== "string") throw E(code, label + " must be a string");
-  if (!B64URL_ALPHABET.test(text)) throw E(code, label + " is not base64url (padding or a non-alphabet character)");
+  if (!_inAlphabet(text, B64URL_ALPHABET)) throw E(code, label + " is not base64url (padding or a non-alphabet character)");
   if (text.length % 4 === 1) throw E(code, label + " has an impossible base64url length");
   _capBefore(text.length * 3, 4, maxBytes, E, code, label);
   var buf = Buffer.from(text, "base64url");
@@ -62,7 +86,12 @@ function base64url(text, maxBytes, E, code, label) {
 // @enforced-by base64-decode-not-via-guard
 function base64(text, maxBytes, E, code, label) {
   if (typeof text !== "string") throw E(code, label + " must be a string");
-  if (!B64_ALPHABET.test(text)) throw E(code, label + " is not base64 (a non-alphabet character)");
+  // Padding is positional, not alphabetic: at most two "=" and only at the end, so
+  // the body is measured first and the alphabet applies to what remains. An "="
+  // anywhere else leaves a non-alphabet character in the body and rejects there.
+  var pad = 0;
+  while (pad < 2 && text.length > pad && text.charCodeAt(text.length - 1 - pad) === 0x3d) pad++;
+  if (!_inAlphabet(text.slice(0, text.length - pad), B64_ALPHABET)) throw E(code, label + " is not base64 (a non-alphabet character)");
   if (text.length % 4 !== 0) throw E(code, label + " must be whole 4-character base64 groups (RFC 4648 sec. 3.5)");
   _capBefore(text.length * 3, 4, maxBytes, E, code, label);
   var buf = Buffer.from(text, "base64");
@@ -79,7 +108,7 @@ function base64(text, maxBytes, E, code, label) {
 //   (a non-canonical / odd-length / non-hex #hex attribute value rejects) guard it.
 function hex(text, maxBytes, E, code, label) {
   if (typeof text !== "string") throw E(code, label + " must be a string");
-  if (!HEX_ALPHABET.test(text)) throw E(code, label + " is not hexadecimal");
+  if (!_inAlphabet(text, HEX_ALPHABET)) throw E(code, label + " is not hexadecimal");
   if (text.length % 2 !== 0) throw E(code, label + " must have an even number of hex digits");
   _capBefore(text.length, 2, maxBytes, E, code, label);
   var buf = Buffer.from(text, "hex");

package/lib/guard-identifier.js

@@ -21,6 +21,32 @@
 // silent false-reject). Every string-form identifier check routes through here so
 // the string and DER forms cannot diverge.
 
+// The dotted-decimal grammar, walked rather than matched. `(0|[1-9]\d*)(\.(0|[1-9]\d*))+`
+// nests a quantified group inside a quantified group with an alternation in each,
+// which is the shape whose cost on a REJECTING string is a property of the pattern
+// rather than of the length -- and this guard's whole job is to be handed strings
+// that reject. Walking the string is one pass, one comparison per character, and it
+// states the two rules plainly: an arc is one or more digits, and an arc longer than
+// one digit does not start with zero (the leading-zero form round-trips to a
+// DIFFERENT OID, which is the divergence this guard exists to stop).
+function _isDottedDecimal(str) {
+  if (str.length === 0) return false;
+  var arcs = 0, digits = 0, leadingZero = false;
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c === 0x2e) {                                   // "."
+      if (digits === 0 || leadingZero) return false;    // empty arc, or "01"
+      arcs++; digits = 0; leadingZero = false;
+      continue;
+    }
+    if (c < 0x30 || c > 0x39) return false;             // not a digit
+    if (digits === 1 && str.charCodeAt(i - 1) === 0x30) leadingZero = true;
+    digits++;
+  }
+  if (digits === 0 || leadingZero) return false;        // trailing "." or a final "01"
+  return arcs >= 1;                                     // two or more arcs
+}
+
 // assertCanonicalOid(str, E, code, label, boundsCode) -> str | throws
 // A canonical dotted-decimal object identifier string: two or more arcs, each a
 // non-negative decimal integer with no leading zero (the SYNTAX), and -- unless
@@ -40,7 +66,7 @@
 //   reject a non-canonical OID) driving the composing consumers are the guard.
 function assertCanonicalOid(str, E, code, label, boundsCode) {
   var who = label || "OID";
-  if (typeof str !== "string" || !/^(0|[1-9]\d*)(\.(0|[1-9]\d*))+$/.test(str)) {
+  if (typeof str !== "string" || !_isDottedDecimal(str)) {
     throw E(code, who + " must be a canonical dotted-decimal OID string of two or more arcs with no leading-zero component");
   }
   if (boundsCode === null) return str;

package/lib/guard-json.js

@@ -25,6 +25,14 @@
 var text = require("./guard-text");
 var limits = require("./guard-limits");
 
+// One hex digit's value, or -1. Written out because the three ranges ARE the rule.
+function _hexVal(c) {
+  if (c >= 0x30 && c <= 0x39) return c - 0x30;          // 0-9
+  if (c >= 0x61 && c <= 0x66) return c - 0x61 + 10;     // a-f
+  if (c >= 0x41 && c <= 0x46) return c - 0x41 + 10;     // A-F
+  return -1;
+}
+
 // parse(input, ErrorClass, spec) -> value. `input` is a Buffer or a string.
 // spec = { maxBytes, maxDepth, badJson, tooDeep, duplicateMember, tooLarge,
 //   badInput, label } -- the caller's caps + frozen domain/reason codes.
@@ -118,9 +126,17 @@ function parse(input, ErrorClass, spec) {
         else if (e === "r") s += "\r";
         else if (e === "t") s += "\t";
         else if (e === "u") {
-          var hex = str.substr(i, 4);
-          if (!/^[0-9a-fA-F]{4}$/.test(hex)) fail("bad \\u escape");
-          s += String.fromCharCode(parseInt(hex, 16));
+          // Four hex digits, read as digits rather than matched as a pattern: the
+          // scanner is already walking this string one character at a time, and a
+          // parser handed hostile input should not hand any of it to a second engine.
+          var cp = 0;
+          if (i + 4 > n) fail("bad \\u escape");
+          for (var h = 0; h < 4; h++) {
+            var d = _hexVal(str.charCodeAt(i + h));
+            if (d < 0) fail("bad \\u escape");
+            cp = (cp << 4) | d;
+          }
+          s += String.fromCharCode(cp);
           i += 4;
         } else fail("bad escape");
       } else if (c.charCodeAt(0) < 0x20) {
@@ -128,15 +144,35 @@ function parse(input, ErrorClass, spec) {
       } else s += c;
     }
   }
+  // RFC 8259 sec. 6, enforced BY the walk rather than by re-matching the token
+  // afterwards. The scan already knows where each part starts and ends, so the
+  // grammar's three rules -- an integer part that is "0" or has no leading zero, a
+  // fraction with at least one digit, an exponent with at least one digit -- are
+  // checked as it goes. Re-matching what the scanner just read meant maintaining
+  // the same grammar twice, in two notations, and the pattern was the copy whose
+  // cost on a rejecting token could not be bounded from outside.
   function number() {
     var start = i;
     if (str[i] === "-") i++;
+    var intStart = i;
     while (i < n && str[i] >= "0" && str[i] <= "9") i++;
-    if (str[i] === ".") { i++; while (i < n && str[i] >= "0" && str[i] <= "9") i++; }
-    if (str[i] === "e" || str[i] === "E") { i++; if (str[i] === "+" || str[i] === "-") i++; while (i < n && str[i] >= "0" && str[i] <= "9") i++; }
-    var tok = str.slice(start, i);
-    if (!/^-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?$/.test(tok)) fail("malformed number");
-    var v = Number(tok);
+    var intLen = i - intStart;
+    if (intLen === 0) fail("malformed number");
+    if (intLen > 1 && str[intStart] === "0") fail("malformed number");   // no leading zero
+    if (str[i] === ".") {
+      i++;
+      var fracStart = i;
+      while (i < n && str[i] >= "0" && str[i] <= "9") i++;
+      if (i === fracStart) fail("malformed number");                     // "1." has no fraction
+    }
+    if (str[i] === "e" || str[i] === "E") {
+      i++;
+      if (str[i] === "+" || str[i] === "-") i++;
+      var expStart = i;
+      while (i < n && str[i] >= "0" && str[i] <= "9") i++;
+      if (i === expStart) fail("malformed number");                      // "1e" has no exponent
+    }
+    var v = Number(str.slice(start, i));
     if (!isFinite(v)) fail("bad number");
     return v;
   }

package/lib/guard-name.js

@@ -65,10 +65,25 @@ function assertPrintableIa5(buf, E, code, label) {
 // matches OpenSSL's X509_NAME_cmp, so a chain OpenSSL accepts is not rejected. This
 // canonicalization is the shape the guard-shape-reinlined detector keys on
 // (declared on dnEqual): a boundary hand-rolling it is re-implementing DN identity.
+// The collapse is a single walk rather than a pattern replace. This runs on every
+// attribute value of every name the toolkit compares -- a certificate an attacker
+// supplies included -- and one pass with a running "was the last character a space"
+// flag costs exactly the length. It also spells out which characters count as
+// whitespace: RFC 5280 sec. 7.1 defers to X.520's caseIgnoreMatch, whose SPACE is
+// the ASCII space, and a pattern's \s silently also folds VT, FF, NBSP and every
+// Unicode space separator, which would equate two names X.520 keeps distinct.
+function _isSpace(c) { return c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d; }
 function _canonAttrValue(v, E, code, label) {
   if (typeof v !== "string") return v;
   assertNoControlBytes(v, E, code, label);
-  return v.trim().replace(/\s+/g, " ").toLowerCase();
+  var out = "", lastWasSpace = true;   // true so leading whitespace is dropped
+  for (var i = 0; i < v.length; i++) {
+    if (_isSpace(v.charCodeAt(i))) { lastWasSpace = true; continue; }
+    if (lastWasSpace && out.length) out += " ";
+    lastWasSpace = false;
+    out += v.charAt(i);
+  }
+  return out.toLowerCase();
 }
 // rdnEqual(a, b, E, code, label) -> boolean. Canonical comparison of a single
 // RelativeDistinguishedName (an unordered SET of type/value pairs, compared as a
@@ -151,17 +166,25 @@ function escapeControlBytes(str) {
 // with the hexstring form, so the report misstates a subject/issuer name (CWE-116).
 // The one place a DN attribute value is made display-safe; pki.schema.pkix's DN
 // rendering composes it, and pki.inspect reuses that parser output (name.dn).
-// @enforced-by behavioral -- the RFC 4514 separator class carries a quote inside a
-//   regex literal, which the codebase-patterns literal-stripper mis-tokenizes, so no
-//   rename-proof shape is detectable; the guard-name RED vectors + the schema-pkix DN
+var DN_SPECIAL = { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1 };   // , + " \ < > ;
+// RFC 4514 sec. 2.4's special set is the TABLE above and the walk is a single pass.
+// The separator escape used to be a pattern replace feeding a second loop, which
+// meant two passes over an attacker-supplied value and a character class holding a
+// quote and a backslash inside a regex literal -- the form most easily misread by a
+// human and, as it happened, by the codebase-patterns literal-stripper.
+//
+// @enforced-by behavioral -- the escaping has no rename-proof code shape distinct
+//   from ordinary string building; the guard-name RED vectors + the schema-pkix DN
 //   round-trip vectors (a comma / plus / leading '#' renders backslash-escaped) are the guard.
 function escapeDnValue(v) {
-  var s = String(v).replace(/([,+"\\<>;])/g, "\\$1"), out = "";
-  // RFC 4514 sec. 2.4: a NUL / control octet -> '\' + two hex digits, so an embedded
-  // CR / LF / NUL in a decoded DN value can never forge a report line when displayed.
+  var s = String(v), out = "";
+  // A NUL / control octet becomes '\' + two hex digits, so an embedded CR / LF / NUL
+  // in a decoded DN value can never forge a report line when displayed.
   for (var i = 0; i < s.length; i++) {
     var c = s.charCodeAt(i);
-    out += (c < 0x20 || c === 0x7f) ? "\\" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase() : s.charAt(i);
+    if (c < 0x20 || c === 0x7f) out += "\\" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase();
+    else if (DN_SPECIAL[c] === 1) out += "\\" + s.charAt(i);
+    else out += s.charAt(i);
   }
   if (out.length && out.charAt(out.length - 1) === " ") out = out.slice(0, -1) + "\\ ";
   if (out.charAt(0) === "#" || out.charAt(0) === " ") out = "\\" + out;