@blamejs/pki 0.5.9 → 0.5.11

package/lib/cms-sign.js

@@ -264,7 +264,7 @@ function _assertKeyMatchesSpki(keyOnly, soKey, soSpki, scheme, sig, signedBytes,
 // A signing-time Time value: UTCTime before 2050, GeneralizedTime from 2050 (RFC 5652 sec. 11.3 /
 // RFC 5280 sec. 4.1.2.5). A caller Date overrides; false omits the attribute (handled above).
 function _timeValue(when) {
-  var d = (when instanceof Date) ? when : new Date();
+  var d = guard.time.isDate(when) ? when : new Date();
   return d.getUTCFullYear() < 2050 ? b.utcTime(d) : b.generalizedTime(d);
 }
 
@@ -368,8 +368,7 @@ function sign(content, signers, opts) {
 }
 
 function _sign(content, signers, opts) {
-  opts = opts || {};
-  if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.sign options must be an object");
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.sign options");
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "cms/bad-input", "unknown opts field ");
   // The arguments were copied at entry (see `sign` above), which is what makes the refusal below
   // hold: flipping signedAttributes from true to false after the call returns would otherwise skip
@@ -590,8 +589,7 @@ function countersign(cmsInput, signers, opts) {
 }
 
 function _countersign(cmsInput, signers, opts) {
-  opts = opts || {};
-  if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.countersign options must be an object");
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.countersign options");
   guard.identifier.assertKnownKeys(opts, KNOWN_COUNTERSIGN_OPTS, _err, "cms/bad-input", "unknown opts field ");
   var list = Array.isArray(signers) ? signers : [signers];
   if (!list.length) throw _err("cms/bad-input", "pki.cms.countersign requires at least one countersigner");

package/lib/cms-verify.js

@@ -579,7 +579,7 @@ function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
   // Coverage residual, and deliberately kept. Every value reaching here was already walked by the
   // decoder, which validates an id-countersignature by content and not by the attribute type. A
   // malformed one therefore refused the whole message before verify was entered, so this catch
-  // cannot be reached through the public path. That is settled behaviour: a message the decoder
+  // cannot be reached through the public path. That is settled behavior: a message the decoder
   // has found to be malformed has no sound remainder to report a verdict over, so it is refused
   // whole instead of surfaced as one failed countersignature.
   // cms-verify.test.js pins that through the shipped verbs; this stays because the walk is also
@@ -693,8 +693,7 @@ function verify(input, opts) {
 }
 
 function _verify(input, opts) {
-  opts = opts || {};
-  if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.verify options must be an object");
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.verify options");
   // An unrecognized option is refused, not swallowed. This is what kept the missing trust seam
   // silent: a caller writing `trustAnchors` before it existed -- or `trustAnchor` now -- got a
   // verdict that looked anchored and was not. The guard rejects through a (code, message) FACTORY
@@ -744,7 +743,7 @@ function _verify(input, opts) {
   // read a promise turn later, and everything in it stays caller-owned across that gap: the array
   // can be re-pointed, an anchor's DER rewritten, the validation instant moved. Any of those would
   // have the chain judged against a configuration the caller never asked for while the verdict
-  // reports the one they did. The same defence the input and the certificates already have.
+  // reports the one they did. The same defense the input and the certificates already have.
   var trustCfg = _snapshotTrust(opts);
   return Promise.all(parsed.signerInfos.map(function (si) {
     // res.valid reflects only the PRIMARY signerInfos; a countersignature / unsigned attribute is
@@ -807,7 +806,11 @@ function _cloneAnchorValue(v, depth) {
   // field by field yields `{}` -- an anchor's `distrustAfter: { emailProtection: <Date> }` would
   // survive the snapshot as an empty object and be rejected as an invalid date, disabling the very
   // policy it encodes. Copied by value, like the validation instant.
-  if (v instanceof Date) return new Date(v.getTime());
+  // The instant comes through the guard's intrinsic read, so a caller's `getTime` override can
+  // neither throw out of the snapshot nor put a different instant in the copy than the original
+  // holds -- which would leave the anchor policy that was checked and the one that is applied two
+  // different values.
+  if (guard.time.isDate(v)) return new Date(guard.time.instantOf(v));
   // A structure too deep to copy is REFUSED, not shared. Returning it by reference at the cap
   // would leave part of the anchor caller-mutable across the chain walk while the rest was
   // snapshotted -- a guarantee that holds for the shallow fields and quietly lapses for the deep
@@ -835,7 +838,7 @@ function _snapshotTrust(opts) {
   }
   return {
     trustAnchors: anchors,
-    time: opts.time instanceof Date ? new Date(opts.time.getTime()) : opts.time,
+    time: guard.time.isDate(opts.time) ? new Date(guard.time.instantOf(opts.time)) : opts.time,
     requiredEku: Array.isArray(opts.requiredEku) ? opts.requiredEku.slice() : opts.requiredEku,
     checkPurpose: opts.checkPurpose,
   };

package/lib/constants.js

@@ -165,7 +165,7 @@ var LIMITS = {
   // is copied/tokenized so a hostile server cannot drive unbounded work parsing it
   // (CWE-770). 8 KiB clears any realistic multi-scheme Digest challenge.
   HTTP_AUTH_HEADER_MAX_BYTES: BYTES.kib(8),
-  // Deterministic-CBOR codec ceilings (RFC 8949), the DER neighbours' siblings:
+  // Deterministic-CBOR codec ceilings (RFC 8949), the DER neighbors' siblings:
   // a whole-document cap refused before the walk, a nesting cap, and a per-value
   // bignum ceiling the document cap can't provide. Unlike DER_MAX_INTEGER_BYTES,
   // the bignum cap carries NO +1 sign octet -- a CBOR tag-2/3 bignum body is pure

package/lib/crl-sign.js

@@ -426,7 +426,7 @@ function _sign(spec, issuer, opts) {
     nextU = _timeDer(spec.nextUpdate, "nextUpdate");
     // allow:nan-date-comparison-unguarded -- both operands are guard.time.assertValid'd via _timeDer on the
     // two lines above (thisUpdate + nextUpdate), so an Invalid Date throws before this comparison.
-    if (spec.nextUpdate.getTime() < spec.thisUpdate.getTime()) throw _err("crl/bad-input", "nextUpdate must not be before thisUpdate (RFC 5280 sec. 5.1.2.5)");
+    if (guard.time.instantOf(spec.nextUpdate) < guard.time.instantOf(spec.thisUpdate)) throw _err("crl/bad-input", "nextUpdate must not be before thisUpdate (RFC 5280 sec. 5.1.2.5)");
   }
 
   var extResult = _buildCrlExtensions(spec, { issuerCert: issuerCert, issuerSpki: issuerSpki });

package/lib/crmf-sign.js

@@ -74,7 +74,7 @@ function _encodeOptionalValidity(validity) {
   if (nb != null) parts.push(b.explicit(0, _b.timeDer(nb, "validity notBefore")));
   if (na != null) parts.push(b.explicit(1, _b.timeDer(na, "validity notAfter")));
   // allow:nan-date-comparison-unguarded -- both instants passed timeDer's guard.time.assertValid above.
-  if (nb != null && na != null && nb.getTime() > na.getTime()) throw _err("crmf/bad-validity", "notBefore must not be after notAfter");
+  if (nb != null && na != null && guard.time.instantOf(nb) > guard.time.instantOf(na)) throw _err("crmf/bad-validity", "notBefore must not be after notAfter");
   return b.implicit(4, b.sequence(parts));
 }
 // CertTemplate ::= SEQUENCE { [0..9] all IMPLICIT OPTIONAL }. A request omits serialNumber [1] / signingAlg

package/lib/ct.js

@@ -666,7 +666,7 @@ function _parseTemporalInterval(ti) {
   var start = rfc3339.parse(ti.start_inclusive, _ctErr, "ct/bad-date", "temporal_interval.start_inclusive");
   var end = rfc3339.parse(ti.end_exclusive, _ctErr, "ct/bad-date", "temporal_interval.end_exclusive");
   // allow:nan-date-comparison-unguarded -- start/end are rfc3339.parse results, guaranteed non-NaN (rfc3339.isValid rejects a NaN date).
-  if (start.getTime() >= end.getTime()) throw _ctErr("ct/bad-log-list", "a CT log temporal_interval start_inclusive must be strictly before end_exclusive");
+  if (guard.time.instantOf(start) >= guard.time.instantOf(end)) throw _ctErr("ct/bad-log-list", "a CT log temporal_interval start_inclusive must be strictly before end_exclusive");
   return { startInclusive: start, endExclusive: end };
 }
 
@@ -700,10 +700,13 @@ function _sameTemporal(a, b) {
   // inputs; the remaining c8 sub-arm is a short-circuit path (when `a == null` is true, `b == null` is
   // never evaluated) with no additional reachable input.
   if (a == null || b == null) return false;
-  return a.startInclusive.getTime() === b.startInclusive.getTime() && a.endExclusive.getTime() === b.endExclusive.getTime();
+  return guard.time.instantOf(a.startInclusive) === guard.time.instantOf(b.startInclusive) &&
+    guard.time.instantOf(a.endExclusive) === guard.time.instantOf(b.endExclusive);
 }
 function _logsAgree(a, b) {
-  return a.state.name === b.state.name && a.state.since.getTime() === b.state.since.getTime() && _sameTemporal(a.temporalInterval, b.temporalInterval);
+  return a.state.name === b.state.name &&
+    guard.time.instantOf(a.state.since) === guard.time.instantOf(b.state.since) &&
+    _sameTemporal(a.temporalInterval, b.temporalInterval);
 }
 
 /**
@@ -783,7 +786,7 @@ function parseLogList(json, opts) {
 // The covered certificate's notAfter for the temporal gate: an explicit opts.certNotAfter, else derived
 // from a leafCert (entryType 0) via the shipped x509 parser, else null (a precert TBS can't be parsed).
 function _resolveNotAfter(entry, opts) {
-  if (opts.certNotAfter instanceof Date) return opts.certNotAfter;
+  if (guard.time.isDate(opts.certNotAfter)) return opts.certNotAfter;
   if (entry && entry.entryType === 0 && entry.leafCert != null) {
     // Inline require (circular-load): ct.js is loaded before schema-x509 finishes initializing in the
     // index chain (schema-x509 -> schema-pkix is mid-init when ct.js is first required), so a top-level
@@ -845,7 +848,7 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
   if (!log.state.trusted) {
     if (!log.state.conditional) throw _ctErr("ct/log-untrusted", "the CT log state '" + log.state.name + "' is not trusted");
     var ts = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp");
-    if (ts >= BigInt(log.state.since.getTime())) throw _ctErr("ct/log-untrusted", "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")");
+    if (ts >= BigInt(guard.time.instantOf(log.state.since))) throw _ctErr("ct/log-untrusted", "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")");
   }
   // Temporal gate (fail-closed): the covered cert's notAfter must be in [start_inclusive, end_exclusive).
   if (log.temporalInterval) {

package/lib/est.js

@@ -699,8 +699,11 @@ function _attr(typeOid, valueNodes) { return asn1.build.sequence([asn1.build.oid
 // attribute whose value is their RFC 4648 base64 (SIZE 1..255). The builder
 // takes caller-supplied binding bytes and never fakes one.
 function challengePasswordFromTlsUnique(channelBinding) {
-  if (!Buffer.isBuffer(channelBinding) || channelBinding.length === 0) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
-  var b64 = channelBinding.toString("base64");
+  // The count comes from the guard, so an own `length` on the caller's Buffer cannot report a
+  // full one as empty. `length` is shadowable on any instance, and `Object.defineProperty(buf,
+  // "length", { get: function () { return 0; } })` had this refuse bytes that were there.
+  if (!Buffer.isBuffer(channelBinding) || guard.bytes.lengthOf(channelBinding) === 0) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
+  var b64 = guard.bytes.view(channelBinding, EstError, "est/bad-input", "the channel-binding bytes").toString("base64");
   if (b64.length > 255) throw E("est/tls-unique-too-long", "the base64 tls-unique value exceeds 255 octets (RFC 7030 sec. 3.5)");
   return _attr(OID_CHALLENGE_PASSWORD, [asn1.build.printable(b64)]);
 }
@@ -954,7 +957,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
       // Measure an injected string body as UTF-8 -- the byte width the body is decoded/transfer-decoded at,
       // and what the real socket transport counts -- so a non-ASCII body (multi-byte chars are ~half the
       // count under latin1) cannot undercount past the DoS cap and reach body handling.
-      var blen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+      var blen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
       // The transport contract returns lowercased headers, but the injectable seam only promises
       // { status, headers, body }; normalize here so a redirect Location / WWW-Authenticate from an
@@ -1104,7 +1107,7 @@ function _certsResult(op, res, opts, csrSpki) {
   if (verdict.status !== "ok") throw E("est/http-error", "an EST " + op + " response must be HTTP 200 or 202 (RFC 7030 sec. 4.1.3 / 4.2.3), got " + res.status);
   // Measure the body as UTF-8 for parity with the transport cap above (this check only distinguishes empty
   // from non-empty, where the encoding is immaterial, but the shape is kept uniform so no site undercounts).
-  var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+  var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
   if (bodyLen === 0) throw E("est/empty-body", "a 200 " + op + " response carried an empty body (RFC 7030 sec. 4.1.3 / 4.2.3)");
   var parsed = parseCertsOnly(transferDecode(res.body));
   if (op === "cacerts") return { certificates: parsed.certificates, crls: parsed.crls };
@@ -1231,7 +1234,7 @@ function fullcmc(baseUrl, request, opts) {
     _knownOpts(opts, FULLCMC_OPTS, "fullcmc");
     der = _cmcRequestDer(request);
     // Confirm this IS a Full PKI Request before any of it goes over the wire. The
-    // bytes are about to be labelled `smime-type=CMC-request`, so a PKIResponse or
+    // bytes are about to be labeled `smime-type=CMC-request`, so a PKIResponse or
     // an unparseable blob handed in by mistake would be POSTed to a CA under a
     // label that does not describe it -- and, since only an `issued` outcome is
     // correlated, could still come back as a pending or rejected verdict, making
@@ -1449,11 +1452,14 @@ function _cmcSent(opts, der) {
 // Uint8Array would leave those forms aliased across the request's whole flight, which is the same
 // window this exists to close, open for exactly the inputs that came in by the wider door.
 // A DataView is copied over its OWN window, not the whole backing buffer it happens to sit in.
+// One call, because guard.bytes decides what a byte form is and where its bytes are. The three
+// hand-rolled branches this replaces read `v.buffer`, `v.byteOffset` and `v.byteLength` off the
+// value, and all three are accessors a caller's subclass can answer: one that lied copied a
+// different store than the array held, so the bytes checked here and the bytes sent later were
+// two different reads.
 function _copyBytes(v) {
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, EstError, "est/bad-input", "a byte field of the request");
-  if (ArrayBuffer.isView(v)) return Buffer.from(new Uint8Array(v.buffer, v.byteOffset, v.byteLength));
-  if (v instanceof ArrayBuffer) return Buffer.from(new Uint8Array(v));
-  return v;
+  if (!guard.bytes.isByteSource(v)) return v;
+  return guard.bytes.snapshotSource(v, EstError, "est/bad-input", "a byte field of the request");
 }
 
 // The exchange-binding controls the request ACTUALLY carries (RFC 5272 sec. 6.6
@@ -1567,7 +1573,7 @@ function _assertAgrees(name, supplied, carried) {
   } else {
     // Through the shared authoring guard, not a bare BigInt(): a `number` above
     // Number.MAX_SAFE_INTEGER has already lost the digits that distinguish it from
-    // its neighbour, so converting it here would compare a value the caller never
+    // its neighbor, so converting it here would compare a value the caller never
     // wrote. A transaction identifier is an unbounded INTEGER on the wire; large
     // ones are passed as a bigint, and this says so rather than rounding.
     same = carried != null &&
@@ -1665,13 +1671,13 @@ function _fullcmcResult(res, opts, wanted, sent) {
       "an EST /fullcmc response must be HTTP 200 or 202 (RFC 7030 sec. 4.3.2), got " + res.status);
   }
 
-  var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+  var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
   if (bodyLen === 0) throw E("est/empty-body", "a 200 /fullcmc response carried an empty body (RFC 7030 sec. 4.3.2)");
   var der = transferDecode(res.body);
 
   // FC5 admits two smime-types, and the LABEL must agree with the BYTES: a
   // certs-only label over a Full PKI Response (or the reverse) is a server
-  // mislabelling its own body, and accepting either shape under either label
+  // mislabeling its own body, and accepting either shape under either label
   // would make the content-type check decorative.
   // Through the shared case-insensitive accessor: HTTP header names are
   // case-insensitive (RFC 9110 sec. 5.1), the classifier already reads them that
@@ -2040,7 +2046,7 @@ async function _serverkeygenResult(res, opts, derived) {
   // A 202 is an enrollment posture (RFC 7030 sec. 4.4 treats /serverkeygen as an enroll): surfaced, never slept.
   if (verdict.status === "retry") return { retry: true, retryAfterSeconds: verdict.retryAfterSeconds, retryAfterDate: verdict.retryAfterDate };
   if (verdict.status !== "ok") throw E("est/http-error", "an EST serverkeygen response must be HTTP 200 or 202 (RFC 7030 sec. 4.4.2), got " + res.status);
-  var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+  var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
   if (bodyLen === 0) throw E("est/empty-body", "a 200 serverkeygen response carried an empty body (RFC 7030 sec. 4.4.2)");
   _assertConfidentialCipher(res);
   // parseServerKeygenResponse does the per-part transfer-decode; the recipient coherence is bound to the CSR.
@@ -2142,7 +2148,7 @@ function _csrattrsResult(res, opts) {
   // A 202 is nonconforming for a policy GET (sec. 4.5.2 lists only 200 / 204 / 404).
   if (verdict.status === "retry") throw E("est/http-error", "a /csrattrs response must be HTTP 200, 204, or 404, not 202 (RFC 7030 sec. 4.5.2)");
   if (verdict.status !== "ok") throw E("est/http-error", "an EST csrattrs response must be HTTP 200 / 204 / 404 (RFC 7030 sec. 4.5.2), got " + res.status);
-  var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+  var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
   // An empty HTTP body is distinct from a valid EMPTY CsrAttrs (`30 00` / base64 `MAA=`), which parses as {items:[]}.
   if (bodyLen === 0) throw E("est/empty-body", "a 200 csrattrs response carried an empty body (RFC 7030 sec. 4.5.2)");
   var attrs = csrattrsFmt.parse(transferDecode(res.body));

package/lib/guard-all.js

@@ -11,35 +11,35 @@
 // itself, with no guard re-implemented inline:
 //
 //   guard.bytes.view / .source        -- untrusted byte-source -> Buffer re-view
-//                                         (detached-buffer fail-open defence)
+//                                         (detached-buffer fail-open defense)
 //   guard.text.decode                 -- byte-source -> string, cap before copy
-//                                         (parser-DoS string-allocation defence)
+//                                         (parser-DoS string-allocation defense)
 //   guard.limits.cap / .depthCap      -- config-time resource-cap validation
-//                                         (recursion / allocation DoS defence)
+//                                         (recursion / allocation DoS defense)
 //   guard.crypto.constantTimeEqual    -- length-checked constant-time compare
-//                                         (timing side-channel defence)
+//                                         (timing side-channel defense)
 //   guard.range.int / .uint31 / .positiveInt31
 //                                     -- bound a decoded integer before narrowing
-//                                        to Number (silent-narrowing defence)
+//                                        to Number (silent-narrowing defense)
 //   guard.time.assertValid / .within  -- validate a Date-instant before a temporal
-//                                        comparison (NaN-Date fail-open defence)
+//                                        comparison (NaN-Date fail-open defense)
 //   guard.name.dnEqual / .rdnEqual / .assertNoControlBytes / .assertPrintableIa5
 //                                     -- canonical DN identity + name-string integrity
 //   guard.name.escapeControlBytes / .escapeDnValue
 //                                     -- render-side name safety: control-byte + RFC 4514 escaping
-//                                        (CVE-2009-2408 truncation / identity defence)
+//                                        (CVE-2009-2408 truncation / identity defense)
 //   guard.encoding.base64url / .base64 / .hex
 //                                     -- strict textual-encoding decode, canonical
-//                                        + capped (encoding-malleability defence)
+//                                        + capped (encoding-malleability defense)
 //   guard.identifier.assertCanonicalOid
 //                                     -- canonical dotted-decimal OID string form
-//                                        (canonicalization-divergence defence)
+//                                        (canonicalization-divergence defense)
 //   guard.compress.bounded            -- decompress an untrusted stream under a hard
 //                                        output cap, whole-input (decompression-bomb +
-//                                        trailing-frame malleability defence)
+//                                        trailing-frame malleability defense)
 //   guard.header.assertField          -- emitted MIME/RFC 5322 header field name +
 //                                        value integrity (CR/LF/NUL header-injection
-//                                        defence, CWE-93)
+//                                        defense, CWE-93)
 //   guard.parsed.accept               -- a CLAIMED-parsed structure carries every
 //                                        field the consuming code dereferences
 //                                        (type confusion / unverified provenance,
@@ -49,7 +49,7 @@
 // token of a guard (the Buffer.from(x.buffer, byteOffset) re-view, the
 // timingSafeEqual call, the MAX_DECODE_DEPTH_CEILING check) must appear only in
 // its guard module, so a new boundary cannot re-inline the shape and forget the
-// defence.
+// defense.
 
 var bytes  = require("./guard-bytes");
 var text   = require("./guard-text");