@blamejs/pki 0.5.4 → 0.5.6

package/lib/cms-verify.js

@@ -538,7 +538,10 @@ function _surfaceUnsignedAttrs(si) {
 // Verify every countersignature attached to `si` (RFC 5652 sec. 11.4): each id-countersignature
 // value is a SignerInfo over `si`'s signature octets. Returns per-countersignature verdicts; a
 // countersignature's OWN countersignatures verify over ITS signature octets (recursive). A
-// present-but-invalid countersignature is surfaced ok:false -- never silently dropped. The recursion
+// countersignature that FAILS TO VERIFY is surfaced ok:false -- never silently dropped, and never
+// allowed to change the primary verdict. A countersignature value that is not a well-formed
+// SignerInfo does not reach here at all: the decoder validates every id-countersignature value by
+// content rather than on the attribute type, so such a message is refused whole. The recursion
 // terminates because it only walks the FINITE parsed structure: each nested countersignature value
 // is a sub-encoding of its parent, and the strict decoder already bounds total nesting by
 // C.LIMITS.DER_MAX_DEPTH at parse (CWE-834/770), so a hostile deep chain fails closed before verify.
@@ -650,7 +653,14 @@ function _snapshotIfBytes(input, label) {
 // capability cannot arrive with its option silently ignored at this boundary.
 var _VERIFY_OPTS = { certs: 1, content: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1 };
 
+// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async). The checks below stay
+// synchronous -- they read a caller's mutable options and bytes, and resolving those before any turn
+// passes is what stops a value being swapped between the check and the use.
 function verify(input, opts) {
+  return guard.async.deferred(function () { return _verify(input, opts); });
+}
+
+function _verify(input, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.verify options must be an object");
   // An unrecognized option is refused, not swallowed. This is what kept the missing trust seam
@@ -663,13 +673,17 @@ function verify(input, opts) {
   // the parse surfaced -- the signed content above all -- stays a view into the
   // caller's memory across that await, and a buffer rewritten in the gap would leave
   // the result describing one message while the signature was checked over another.
-  // Only a Buffer / Uint8Array can change underneath us: a PEM string is immutable
-  // and passes through untouched, and an already-parsed object is a lifetime the
-  // caller chose. Narrow rather than blanket, so neither input form is refused here
-  // that pki.cms.parse itself accepts.
-  var parsed = (input && typeof input === "object" && !Buffer.isBuffer(input) && Array.isArray(input.signerInfos))
-    ? input
-    : cms.parse(_snapshotIfBytes(input, "pki.cms.verify"));
+  // Re-derived from the bytes the parser read, never trusted as the object it arrives as. A
+  // SignedData's meaning is a signature over a byte range, but a parsed one presents that range
+  // (`signedAttrsBytes`, or the encapsulated `eContent` when there are no signed attributes), the
+  // signature, the algorithms and the certificates as SEPARATE properties. Keep a genuine signer's
+  // signature and signed attributes and put different content beside them and every part of this
+  // check passes for a message that signer never signed -- the forgery this verb's own block claims
+  // to defend (CWE-347). A duck-type test on `signerInfos` cannot see that, because every field is
+  // individually well-formed; only re-deriving them all from one byte string can.
+  var parsed = guard.parsed.acceptDerived(input, "cms", function (bytes) {
+    return cms.parse(_snapshotIfBytes(bytes, "pki.cms.verify"));
+  }, _err, "cms/bad-input", "the SignedData");
   if (!Array.isArray(parsed.signerInfos)) throw _err("cms/bad-input", "input is not a CMS SignedData");
   var content = parsed.encapContentInfo.eContent;
   if (content == null) {

package/lib/crl-sign.js

@@ -375,9 +375,10 @@ function _buildRevoked(entryList, isDelta) {
 // ---- the primitives --------------------------------------------------------
 
 function _parseIssuerCert(cert) {
-  var parsed = (Buffer.isBuffer(cert) || typeof cert === "string") ? x509Schema.parse(cert) : cert;
-  if (!parsed || !parsed.tbsBytes || !parsed.subjectPublicKeyInfo) throw _err("crl/bad-input", "issuer.cert must be a certificate DER/PEM or a parsed certificate");
-  return parsed;
+  // The issuer certificate decides who may have signed this CRL: its key verifies the signature and
+  // its keyUsage says whether it may sign CRLs at all. A caller-assembled one could carry a real
+  // CA's name and cRLSign bit beside a substituted key, so it is re-derived like every other.
+  return guard.parsed.acceptDerived(cert, "certificate", x509Schema.parse, _err, "crl/bad-input", "issuer.cert");
 }
 
 // RFC 5280 sec. 4.2.1.3 -- a certificate whose key signs CRLs asserts the cRLSign keyUsage bit. When the
@@ -508,10 +509,15 @@ function _sign(spec, issuer, opts) {
  */
 function sign(spec, issuer, opts) { return Promise.resolve().then(function () { return _sign(spec, issuer, opts); }); }
 
+// A CRL these verbs answer from is re-derived from the bytes its parser read. Completeness -- every
+// field present with the right type -- is not enough for a verdict: the signature covers a byte
+// range, while the revocation list and the scope extensions are separate properties of the parsed
+// object. Keep a correctly signed CRL's `tbsBytes` and signature and empty `revokedCertificates`,
+// and the signature still verifies while `isRevoked` answers from the edited list. An emptied
+// `crlExtensions` does the same to scope: a shard that may only speak for some reasons, or a delta
+// that may not answer alone, becomes one that answers for everything.
 function _coerceCrl(crl) {
-  if (Buffer.isBuffer(crl) || typeof crl === "string") return crlSchema.parse(crl);
-  if (crl && typeof crl === "object" && crl.tbsBytes && crl.signatureValue && crl.signatureAlgorithm) return crl;
-  throw _err("crl/bad-input", "crl must be a CRL DER Buffer, a PEM string, or a parsed CRL (from pki.schema.crl.parse)");
+  return guard.parsed.acceptDerived(crl, "crl", crlSchema.parse, _err, "crl/bad-input", "the CRL");
 }
 
 // The issuer's key AND, when the caller supplied a certificate rather than a bare key, the
@@ -523,7 +529,13 @@ function _resolveIssuer(issuer) {
   if (Buffer.isBuffer(issuer)) { _assertValidSpki(issuer, "issuer SPKI"); return { spki: issuer, cert: null }; }
   if (issuer.cert != null) { var ic = _parseIssuerCert(issuer.cert); return { spki: ic.subjectPublicKeyInfo.bytes, cert: ic }; }
   if (issuer.publicKey != null) { var spki = _reqDer(issuer.publicKey, "issuer.publicKey"); _assertValidSpki(spki, "issuer.publicKey"); return { spki: spki, cert: null }; }
-  if (issuer.subjectPublicKeyInfo && issuer.subjectPublicKeyInfo.bytes) return { spki: issuer.subjectPublicKeyInfo.bytes, cert: issuer };   // a parsed certificate
+  // A parsed certificate passed directly. It reaches the same identity and cRLSign checks the
+  // { cert } form does, so it goes through the same door: an object carrying an SPKI but missing
+  // the subject those checks compare would decide them on undefined.
+  if (issuer.subjectPublicKeyInfo && issuer.subjectPublicKeyInfo.bytes) {
+    var pc = _parseIssuerCert(issuer);
+    return { spki: pc.subjectPublicKeyInfo.bytes, cert: pc };
+  }
   throw _err("crl/bad-input", "issuer must be { cert }, { publicKey } (SPKI DER), or a raw SPKI Buffer");
 }
 

package/lib/est.js

@@ -86,6 +86,59 @@ var OID_TEMPLATE = oid.byName("certificationRequestInfoTemplate");
 
 var OPERATIONS = ["cacerts", "simpleenroll", "simplereenroll", "fullcmc", "serverkeygen", "csrattrs"];
 
+// ---- the option surface each verb accepts -----------------------------------
+//
+// A misspelled option reads as an omission rather than as a value: nothing is out of range and
+// nothing fails to parse, so the caller who asked for something stricter gets the looser default
+// and is told nothing. That is worst here, where the options carry the security posture of a
+// network exchange -- a misspelled `tls` leaves the anchors unset (the no-anchors refusal names
+// the missing pin, so this one is caught), a misspelled `strict` accepts the extra certificates it
+// was set to reject, a misspelled `expectedRecipientKeyId` drops a recipient pin on a
+// server-generated private key, and a misspelled `oldCert` fails the re-enrollment outright.
+//
+// Every network verb shares the client surface, because every one of them goes through _client and
+// the redirect / authentication plumbing it drives. The per-verb tables extend it rather than
+// restating it, so a key added to the client reaches every verb at once and none of them drifts.
+var CLIENT_OPTS = {
+  transport: 1, tls: 1, label: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, now: 1,
+  auth: 1, username: 1, password: 1, allowCrossOriginRedirect: 1,
+};
+function _withClient(extra) {
+  var out = {};
+  Object.keys(CLIENT_OPTS).forEach(function (k) { out[k] = 1; });
+  Object.keys(extra || {}).forEach(function (k) { out[k] = 1; });
+  return out;
+}
+// `strict` is enroll-only: _certsResult reads it after the /cacerts branch has already returned, so
+// accepting it on cacerts would advertise a check that cannot run there.
+var CACERTS_OPTS = _withClient(null);
+var SIMPLEENROLL_OPTS = _withClient({ strict: 1 });
+var SIMPLEREENROLL_OPTS = _withClient({ strict: 1, oldCert: 1 });
+// expectedRecipientKind is NOT here: it is derived from the CSR's own advertised attribute, never
+// taken from the caller, so listing it would offer a pin that nothing reads.
+var SERVERKEYGEN_OPTS = _withClient({
+  requestedEncryption: 1, expectedRecipientKeyId: 1, expectedRecipientIssuerSerial: 1,
+});
+var CSRATTRS_OPTS = _withClient(null);
+var FULLCMC_OPTS = _withClient({
+  transactionId: 1, senderNonce: 1, dataReturn: 1,
+  responderCerts: 1, responseRecipient: 1, allowUnverifiedResponse: 1,
+});
+// The two verbs that take options without going near the network.
+var CLASSIFY_OPTS = { op: 1, now: 1 };
+var PATHS_OPTS = { label: 1 };
+var PARSE_SERVERKEYGEN_OPTS = {
+  requestedEncryption: 1, expectedRecipientKeyId: 1, expectedRecipientKind: 1,
+  expectedRecipientIssuerSerial: 1,
+};
+
+function _knownOpts(opts, known, verb) {
+  guard.identifier.assertKnownKeys(opts, known, E, "est/bad-input", function (k) {
+    return "unknown option " + JSON.stringify(k) + " for pki.est." + verb + " -- accepted: " +
+      Object.keys(known).sort().join(", ");
+  });
+}
+
 // ---- the RFC 8951 sec. 3/3.1 transfer codec (CTE-header-blind) -----------
 
 /**
@@ -397,6 +450,7 @@ function _partMediaType(contentType) {
 
 function parseServerKeygenResponse(body, contentType, opts) {
   opts = opts || {};
+  _knownOpts(opts, PARSE_SERVERKEYGEN_OPTS, "parseServerKeygenResponse");
   var parts = splitMultipartMixed(body, contentType);
   if (parts.length !== 2) throw E("est/bad-multipart", "a serverkeygen response must have exactly two parts (RFC 7030 sec. 4.4.2)");
   var keyPart = null, certPart = null, encrypted = false;
@@ -524,6 +578,7 @@ var NOT_IMPLEMENTED_OPS = { fullcmc: 1 };
  */
 function classifyResponse(status, headers, body, opts) {
   opts = opts || {};
+  _knownOpts(opts, CLASSIFY_OPTS, "classifyResponse");
   var op = opts.op;
   // Fail closed on an operation whose response this client cannot validate:
   // A named op this client cannot validate is a typo, not a pass. An
@@ -618,6 +673,7 @@ function classifyResponse(status, headers, body, opts) {
  */
 function paths(baseUrl, opts) {
   opts = opts || {};
+  _knownOpts(opts, PATHS_OPTS, "paths");
   var prefix = String(baseUrl).replace(/\/+$/, "") + "/.well-known/est";
   if (opts.label != null) {
     var label = String(opts.label);
@@ -1152,6 +1208,11 @@ function fullcmc(baseUrl, request, opts) {
   var der, wanted, sent;
   try {
     if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw E("est/bad-input", "pki.est.fullcmc options must be an object");
+    // Inside the try, so the refusal is a REJECTION like every other failure of this verb: it is
+    // documented as Promise-returning, and a synchronous throw escapes the `.catch(...)` a caller
+    // has already written. It stays in the synchronous capture rather than moving into a later turn,
+    // because that is what closes the race described above.
+    _knownOpts(opts, FULLCMC_OPTS, "fullcmc");
     der = _cmcRequestDer(request);
     // Confirm this IS a Full PKI Request before any of it goes over the wire. The
     // bytes are about to be labelled `smime-type=CMC-request`, so a PKIResponse or
@@ -1750,6 +1811,10 @@ function _enroll(op, baseUrl, csrInput, opts) {
  *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }.
  *   - `label` -- an OPTIONAL CA label path segment; `timeout` / `maxResponseBytes` / `maxRedirects` -- budgets.
  *   - `now` -- receipt time (epoch ms) to render a 202 Retry-After HTTP-date as seconds.
+ *   - `auth` -- HTTP authentication: `{ scheme: "basic" | "digest", username, password, allowMD5, allowLegacyQop, maxStaleRetries }`.
+ *     There is no `"auto"`: the scheme is chosen here, not by whatever a server offers. `username` / `password`
+ *     at the top level are the older form and mean Basic. Answered only after the transport authenticated the server.
+ *   - `allowCrossOriginRedirect` -- opt in to following a cross-origin redirect on an unsafe method.
  * @example
  *   // a live CA uses the default pki.transport.https; here an injected transport returns a canned bag
  *   var r = await pki.est.cacerts("https://ca.example",
@@ -1759,6 +1824,11 @@ function _enroll(op, baseUrl, csrInput, opts) {
 function cacerts(baseUrl, opts) {
   opts = opts || {};
   return Promise.resolve().then(function () {
+    // Inside the promise, like every other refusal these verbs make. They are documented as
+    // Promise-returning, so a caller writes `.catch(...)` -- and a check that throws synchronously
+    // escapes that catch entirely, turning a misspelled option into an uncaught exception rather
+    // than the rejection the caller is already handling.
+    _knownOpts(opts, CACERTS_OPTS, "cacerts");
     return _client("cacerts", "GET", baseUrl, null, { accept: "application/pkcs7-mime" }, opts);
   }).then(function (res) { return _certsResult("cacerts", res, opts, null); });
 }
@@ -1795,7 +1865,10 @@ function cacerts(baseUrl, opts) {
  */
 function simpleenroll(baseUrl, csrInput, opts) {
   opts = opts || {};
-  return Promise.resolve().then(function () { return _enroll("simpleenroll", baseUrl, csrInput, opts); });
+  return Promise.resolve().then(function () {
+    _knownOpts(opts, SIMPLEENROLL_OPTS, "simpleenroll");
+    return _enroll("simpleenroll", baseUrl, csrInput, opts);
+  });
 }
 
 /**
@@ -1826,6 +1899,7 @@ function simpleenroll(baseUrl, csrInput, opts) {
 function simplereenroll(baseUrl, csrInput, opts) {
   opts = opts || {};
   return Promise.resolve().then(function () {
+    _knownOpts(opts, SIMPLEREENROLL_OPTS, "simplereenroll");
     if (!opts.oldCert) throw E("est/bad-input", "simplereenroll requires opts.oldCert (the certificate being renewed, RFC 7030 sec. 4.2.2)");
     reenrollGuard(opts.oldCert, _csrDer(csrInput));   // est/reenroll-* on mismatch, BEFORE the POST
     return _enroll("simplereenroll", baseUrl, csrInput, opts);
@@ -1989,6 +2063,7 @@ async function _serverkeygenResult(res, opts, derived) {
 function serverkeygen(baseUrl, csrInput, opts) {
   opts = opts || {};
   return Promise.resolve().then(function () {
+    _knownOpts(opts, SERVERKEYGEN_OPTS, "serverkeygen");
     var csrDer = _csrDer(csrInput);
     var derived = _serverkeygenEncryptionFromCsr(csrDer);
     if (opts.requestedEncryption !== undefined && !!opts.requestedEncryption !== derived.requestedEncryption) throw E("est/bad-input", "opts.requestedEncryption (" + !!opts.requestedEncryption + ") contradicts the CSR's advertised key-encryption attribute (" + derived.requestedEncryption + ") (RFC 7030 sec. 4.4.1)");
@@ -2056,6 +2131,7 @@ function _csrattrsResult(res, opts) {
 function csrattrs(baseUrl, opts) {
   opts = opts || {};
   return Promise.resolve().then(function () {
+    _knownOpts(opts, CSRATTRS_OPTS, "csrattrs");
     return _client("csrattrs", "GET", baseUrl, null, { accept: "application/csrattrs" }, opts);
   }).then(function (res) { return _csrattrsResult(res, opts); });
 }

package/lib/guard-all.js

@@ -40,6 +40,10 @@
 //   guard.header.assertField          -- emitted MIME/RFC 5322 header field name +
 //                                        value integrity (CR/LF/NUL header-injection
 //                                        defence, CWE-93)
+//   guard.parsed.accept               -- a CLAIMED-parsed structure carries every
+//                                        field the consuming code dereferences
+//                                        (type confusion / unverified provenance,
+//                                        CWE-843 / CWE-345)
 //
 // Each shape is enforced by a codebase-patterns detector: the characteristic
 // token of a guard (the Buffer.from(x.buffer, byteOffset) re-view, the
@@ -60,6 +64,8 @@ var identifier = require("./guard-identifier");
 var header = require("./guard-header");
 var compress = require("./guard-compress");
 var secret = require("./guard-secret");
+var parsed = require("./guard-parsed");
+var async_ = require("./guard-async");
 
 module.exports = {
   bytes:  bytes,
@@ -75,4 +81,6 @@ module.exports = {
   header: header,
   compress: compress,
   secret: secret,
+  parsed: parsed,
+  async:  async_,
 };

package/lib/guard-async.js

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is every verb whose
+// @signature says `-> Promise<...>`; this is how each of them refuses.
+//
+// guard-async -- a verb documented as Promise-returning refuses by REJECTING, never by throwing.
+//
+// The failure is invisible at the call site, which is what makes it worth a choke point. An operator
+// reads `-> Promise<...>` in the reference and writes the documented shape:
+//
+//     pki.acme.newOrder(opts).catch(handleIt);
+//
+// A validation that runs BEFORE the promise is created throws straight past that `.catch`, so a
+// misspelled option or a malformed input becomes an uncaught exception in code that already handles
+// errors -- and nothing in the shape of the call tells the caller which verbs do that. Eleven verbs
+// across five modules had it (pki.cms.verify / sign / countersign, pki.ocsp.sign, pki.tsp.sign and
+// six pki.acme verbs), each having grown the same way: a cheap synchronous check added at the top of
+// a function that returns a promise further down.
+//
+// What this does NOT change is WHEN the work happens. The body still runs synchronously, because
+// several of these verbs must resolve a caller's mutable options object before any turn passes --
+// reading a key, a nonce, or a request's bytes a turn later is a different value than the one that
+// was checked. Only the exit changes: a fault leaves as a rejection instead of a throw.
+//
+// @enforced-by behavioral -- the rule has no rename-proof code shape (it is the ABSENCE of a wrapper
+//   around a synchronous prefix, which no lexical pattern can see). The guard is the derived test
+//   test/layer-0-primitives/promise-contract.test.js, which reads every `-> Promise<` @signature out
+//   of lib/ and calls each verb to prove the refusal arrives as a rejection -- so a new verb is in
+//   scope the day it is documented, and no list here can go stale.
+function deferred(body) {
+  try { return Promise.resolve(body()); }
+  catch (e) { return Promise.reject(e); }
+}
+
+module.exports = { deferred: deferred };

package/lib/guard-encoding.js

@@ -25,9 +25,33 @@
 // domain/reason; `label` the field phrase; `maxBytes` an optional decoded-size
 // cap (null/undefined = uncapped, for a PEM cert body already bounded upstream).
 
-var B64URL_ALPHABET = /^[A-Za-z0-9_-]*$/;
-var B64_ALPHABET = /^[A-Za-z0-9+/]*={0,2}$/;
-var HEX_ALPHABET = /^[0-9A-Fa-f]*$/;
+// The alphabets are TABLES, walked one character at a time, rather than regular
+// expressions. A guard runs on the most hostile input the toolkit sees, and a
+// pattern engine's cost on a non-matching string is a property of the pattern
+// rather than of the length -- the one thing a bound cannot be placed on from the
+// outside. A table lookup is one array index per character and its cost is the
+// length, which the caller already caps. It is also the more honest statement of
+// the rule: the set of permitted characters IS the rule, written out.
+function _alphabet(chars) {
+  var t = new Uint8Array(128);
+  for (var i = 0; i < chars.length; i++) t[chars.charCodeAt(i)] = 1;
+  return t;
+}
+var UPPER = "ABCDEFGHIJKLMNOPQRSTUVWXYZ", LOWER = "abcdefghijklmnopqrstuvwxyz", DIGITS = "0123456789";
+var B64URL_ALPHABET = _alphabet(UPPER + LOWER + DIGITS + "-_");
+var B64_ALPHABET = _alphabet(UPPER + LOWER + DIGITS + "+/");
+var HEX_ALPHABET = _alphabet(DIGITS + "abcdef" + "ABCDEF");
+
+// Every character of `text` is in `table`. A code point outside Latin-1's low half
+// (including every astral half) is outside all three alphabets, so the table bound
+// is the reject rather than an index that reads undefined.
+function _inAlphabet(text, table) {
+  for (var i = 0; i < text.length; i++) {
+    var c = text.charCodeAt(i);
+    if (c > 127 || table[c] !== 1) return false;
+  }
+  return true;
+}
 
 // Reject before Buffer.from allocates: a base64 text of N chars decodes to at
 // most floor(N*3/4) bytes, a hex text to N/2.
@@ -49,7 +73,7 @@ function _capBefore(nChars, perByteChars, maxBytes, E, code, label) {
 // @enforced-by base64-decode-not-via-guard
 function base64url(text, maxBytes, E, code, label) {
   if (typeof text !== "string") throw E(code, label + " must be a string");
-  if (!B64URL_ALPHABET.test(text)) throw E(code, label + " is not base64url (padding or a non-alphabet character)");
+  if (!_inAlphabet(text, B64URL_ALPHABET)) throw E(code, label + " is not base64url (padding or a non-alphabet character)");
   if (text.length % 4 === 1) throw E(code, label + " has an impossible base64url length");
   _capBefore(text.length * 3, 4, maxBytes, E, code, label);
   var buf = Buffer.from(text, "base64url");
@@ -62,7 +86,12 @@ function base64url(text, maxBytes, E, code, label) {
 // @enforced-by base64-decode-not-via-guard
 function base64(text, maxBytes, E, code, label) {
   if (typeof text !== "string") throw E(code, label + " must be a string");
-  if (!B64_ALPHABET.test(text)) throw E(code, label + " is not base64 (a non-alphabet character)");
+  // Padding is positional, not alphabetic: at most two "=" and only at the end, so
+  // the body is measured first and the alphabet applies to what remains. An "="
+  // anywhere else leaves a non-alphabet character in the body and rejects there.
+  var pad = 0;
+  while (pad < 2 && text.length > pad && text.charCodeAt(text.length - 1 - pad) === 0x3d) pad++;
+  if (!_inAlphabet(text.slice(0, text.length - pad), B64_ALPHABET)) throw E(code, label + " is not base64 (a non-alphabet character)");
   if (text.length % 4 !== 0) throw E(code, label + " must be whole 4-character base64 groups (RFC 4648 sec. 3.5)");
   _capBefore(text.length * 3, 4, maxBytes, E, code, label);
   var buf = Buffer.from(text, "base64");
@@ -79,7 +108,7 @@ function base64(text, maxBytes, E, code, label) {
 //   (a non-canonical / odd-length / non-hex #hex attribute value rejects) guard it.
 function hex(text, maxBytes, E, code, label) {
   if (typeof text !== "string") throw E(code, label + " must be a string");
-  if (!HEX_ALPHABET.test(text)) throw E(code, label + " is not hexadecimal");
+  if (!_inAlphabet(text, HEX_ALPHABET)) throw E(code, label + " is not hexadecimal");
   if (text.length % 2 !== 0) throw E(code, label + " must have an even number of hex digits");
   _capBefore(text.length, 2, maxBytes, E, code, label);
   var buf = Buffer.from(text, "hex");

package/lib/guard-identifier.js

@@ -21,6 +21,32 @@
 // silent false-reject). Every string-form identifier check routes through here so
 // the string and DER forms cannot diverge.
 
+// The dotted-decimal grammar, walked rather than matched. `(0|[1-9]\d*)(\.(0|[1-9]\d*))+`
+// nests a quantified group inside a quantified group with an alternation in each,
+// which is the shape whose cost on a REJECTING string is a property of the pattern
+// rather than of the length -- and this guard's whole job is to be handed strings
+// that reject. Walking the string is one pass, one comparison per character, and it
+// states the two rules plainly: an arc is one or more digits, and an arc longer than
+// one digit does not start with zero (the leading-zero form round-trips to a
+// DIFFERENT OID, which is the divergence this guard exists to stop).
+function _isDottedDecimal(str) {
+  if (str.length === 0) return false;
+  var arcs = 0, digits = 0, leadingZero = false;
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c === 0x2e) {                                   // "."
+      if (digits === 0 || leadingZero) return false;    // empty arc, or "01"
+      arcs++; digits = 0; leadingZero = false;
+      continue;
+    }
+    if (c < 0x30 || c > 0x39) return false;             // not a digit
+    if (digits === 1 && str.charCodeAt(i - 1) === 0x30) leadingZero = true;
+    digits++;
+  }
+  if (digits === 0 || leadingZero) return false;        // trailing "." or a final "01"
+  return arcs >= 1;                                     // two or more arcs
+}
+
 // assertCanonicalOid(str, E, code, label, boundsCode) -> str | throws
 // A canonical dotted-decimal object identifier string: two or more arcs, each a
 // non-negative decimal integer with no leading zero (the SYNTAX), and -- unless
@@ -40,7 +66,7 @@
 //   reject a non-canonical OID) driving the composing consumers are the guard.
 function assertCanonicalOid(str, E, code, label, boundsCode) {
   var who = label || "OID";
-  if (typeof str !== "string" || !/^(0|[1-9]\d*)(\.(0|[1-9]\d*))+$/.test(str)) {
+  if (typeof str !== "string" || !_isDottedDecimal(str)) {
     throw E(code, who + " must be a canonical dotted-decimal OID string of two or more arcs with no leading-zero component");
   }
   if (boundsCode === null) return str;

package/lib/guard-json.js

@@ -25,6 +25,14 @@
 var text = require("./guard-text");
 var limits = require("./guard-limits");
 
+// One hex digit's value, or -1. Written out because the three ranges ARE the rule.
+function _hexVal(c) {
+  if (c >= 0x30 && c <= 0x39) return c - 0x30;          // 0-9
+  if (c >= 0x61 && c <= 0x66) return c - 0x61 + 10;     // a-f
+  if (c >= 0x41 && c <= 0x46) return c - 0x41 + 10;     // A-F
+  return -1;
+}
+
 // parse(input, ErrorClass, spec) -> value. `input` is a Buffer or a string.
 // spec = { maxBytes, maxDepth, badJson, tooDeep, duplicateMember, tooLarge,
 //   badInput, label } -- the caller's caps + frozen domain/reason codes.
@@ -118,9 +126,17 @@ function parse(input, ErrorClass, spec) {
         else if (e === "r") s += "\r";
         else if (e === "t") s += "\t";
         else if (e === "u") {
-          var hex = str.substr(i, 4);
-          if (!/^[0-9a-fA-F]{4}$/.test(hex)) fail("bad \\u escape");
-          s += String.fromCharCode(parseInt(hex, 16));
+          // Four hex digits, read as digits rather than matched as a pattern: the
+          // scanner is already walking this string one character at a time, and a
+          // parser handed hostile input should not hand any of it to a second engine.
+          var cp = 0;
+          if (i + 4 > n) fail("bad \\u escape");
+          for (var h = 0; h < 4; h++) {
+            var d = _hexVal(str.charCodeAt(i + h));
+            if (d < 0) fail("bad \\u escape");
+            cp = (cp << 4) | d;
+          }
+          s += String.fromCharCode(cp);
           i += 4;
         } else fail("bad escape");
       } else if (c.charCodeAt(0) < 0x20) {
@@ -128,15 +144,35 @@ function parse(input, ErrorClass, spec) {
       } else s += c;
     }
   }
+  // RFC 8259 sec. 6, enforced BY the walk rather than by re-matching the token
+  // afterwards. The scan already knows where each part starts and ends, so the
+  // grammar's three rules -- an integer part that is "0" or has no leading zero, a
+  // fraction with at least one digit, an exponent with at least one digit -- are
+  // checked as it goes. Re-matching what the scanner just read meant maintaining
+  // the same grammar twice, in two notations, and the pattern was the copy whose
+  // cost on a rejecting token could not be bounded from outside.
   function number() {
     var start = i;
     if (str[i] === "-") i++;
+    var intStart = i;
     while (i < n && str[i] >= "0" && str[i] <= "9") i++;
-    if (str[i] === ".") { i++; while (i < n && str[i] >= "0" && str[i] <= "9") i++; }
-    if (str[i] === "e" || str[i] === "E") { i++; if (str[i] === "+" || str[i] === "-") i++; while (i < n && str[i] >= "0" && str[i] <= "9") i++; }
-    var tok = str.slice(start, i);
-    if (!/^-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?$/.test(tok)) fail("malformed number");
-    var v = Number(tok);
+    var intLen = i - intStart;
+    if (intLen === 0) fail("malformed number");
+    if (intLen > 1 && str[intStart] === "0") fail("malformed number");   // no leading zero
+    if (str[i] === ".") {
+      i++;
+      var fracStart = i;
+      while (i < n && str[i] >= "0" && str[i] <= "9") i++;
+      if (i === fracStart) fail("malformed number");                     // "1." has no fraction
+    }
+    if (str[i] === "e" || str[i] === "E") {
+      i++;
+      if (str[i] === "+" || str[i] === "-") i++;
+      var expStart = i;
+      while (i < n && str[i] >= "0" && str[i] <= "9") i++;
+      if (i === expStart) fail("malformed number");                      // "1e" has no exponent
+    }
+    var v = Number(str.slice(start, i));
     if (!isFinite(v)) fail("bad number");
     return v;
   }

package/lib/guard-name.js

@@ -65,10 +65,25 @@ function assertPrintableIa5(buf, E, code, label) {
 // matches OpenSSL's X509_NAME_cmp, so a chain OpenSSL accepts is not rejected. This
 // canonicalization is the shape the guard-shape-reinlined detector keys on
 // (declared on dnEqual): a boundary hand-rolling it is re-implementing DN identity.
+// The collapse is a single walk rather than a pattern replace. This runs on every
+// attribute value of every name the toolkit compares -- a certificate an attacker
+// supplies included -- and one pass with a running "was the last character a space"
+// flag costs exactly the length. It also spells out which characters count as
+// whitespace: RFC 5280 sec. 7.1 defers to X.520's caseIgnoreMatch, whose SPACE is
+// the ASCII space, and a pattern's \s silently also folds VT, FF, NBSP and every
+// Unicode space separator, which would equate two names X.520 keeps distinct.
+function _isSpace(c) { return c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d; }
 function _canonAttrValue(v, E, code, label) {
   if (typeof v !== "string") return v;
   assertNoControlBytes(v, E, code, label);
-  return v.trim().replace(/\s+/g, " ").toLowerCase();
+  var out = "", lastWasSpace = true;   // true so leading whitespace is dropped
+  for (var i = 0; i < v.length; i++) {
+    if (_isSpace(v.charCodeAt(i))) { lastWasSpace = true; continue; }
+    if (lastWasSpace && out.length) out += " ";
+    lastWasSpace = false;
+    out += v.charAt(i);
+  }
+  return out.toLowerCase();
 }
 // rdnEqual(a, b, E, code, label) -> boolean. Canonical comparison of a single
 // RelativeDistinguishedName (an unordered SET of type/value pairs, compared as a
@@ -151,17 +166,25 @@ function escapeControlBytes(str) {
 // with the hexstring form, so the report misstates a subject/issuer name (CWE-116).
 // The one place a DN attribute value is made display-safe; pki.schema.pkix's DN
 // rendering composes it, and pki.inspect reuses that parser output (name.dn).
-// @enforced-by behavioral -- the RFC 4514 separator class carries a quote inside a
-//   regex literal, which the codebase-patterns literal-stripper mis-tokenizes, so no
-//   rename-proof shape is detectable; the guard-name RED vectors + the schema-pkix DN
+var DN_SPECIAL = { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1 };   // , + " \ < > ;
+// RFC 4514 sec. 2.4's special set is the TABLE above and the walk is a single pass.
+// The separator escape used to be a pattern replace feeding a second loop, which
+// meant two passes over an attacker-supplied value and a character class holding a
+// quote and a backslash inside a regex literal -- the form most easily misread by a
+// human and, as it happened, by the codebase-patterns literal-stripper.
+//
+// @enforced-by behavioral -- the escaping has no rename-proof code shape distinct
+//   from ordinary string building; the guard-name RED vectors + the schema-pkix DN
 //   round-trip vectors (a comma / plus / leading '#' renders backslash-escaped) are the guard.
 function escapeDnValue(v) {
-  var s = String(v).replace(/([,+"\\<>;])/g, "\\$1"), out = "";
-  // RFC 4514 sec. 2.4: a NUL / control octet -> '\' + two hex digits, so an embedded
-  // CR / LF / NUL in a decoded DN value can never forge a report line when displayed.
+  var s = String(v), out = "";
+  // A NUL / control octet becomes '\' + two hex digits, so an embedded CR / LF / NUL
+  // in a decoded DN value can never forge a report line when displayed.
   for (var i = 0; i < s.length; i++) {
     var c = s.charCodeAt(i);
-    out += (c < 0x20 || c === 0x7f) ? "\\" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase() : s.charAt(i);
+    if (c < 0x20 || c === 0x7f) out += "\\" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase();
+    else if (DN_SPECIAL[c] === 1) out += "\\" + s.charAt(i);
+    else out += s.charAt(i);
   }
   if (out.length && out.charAt(out.length - 1) === " ") out = out.slice(0, -1) + "\\ ";
   if (out.charAt(0) === "#" || out.charAt(0) === " ") out = "\\" + out;