@blamejs/pki 0.6.39 → 0.6.41

package/lib/http-transport.js

@@ -440,7 +440,7 @@ function httpsTransport(defaults) {
     var bodyIsFn = typeof body === "function";
     if (!bodyIsFn && guard.bytes.isByteSource(body)) body = guard.bytes.source(body, E, C("bad-input"), "the request body");
 
-    var reqHeaders = Object.assign({}, request.headers || {});
+    var reqHeaders = Object.assign(Object.create(null), request.headers || {});
     Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "proxy-authorization" || lk === "proxy-connection") delete reqHeaders[k]; });
     if (bodyIsFn) {
       Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "content-length" || lk === "transfer-encoding" || lk === "expect") delete reqHeaders[k]; });
@@ -553,7 +553,7 @@ function httpsTransport(defaults) {
               if (settled) return;
               settled = true;
               clearTimer();
-              var lower = {};
+              var lower = Object.create(null);
               Object.keys(res.headers || {}).forEach(function (k) { lower[k.toLowerCase()] = res.headers[k]; });
               resolve({
                 status: res.statusCode,
@@ -595,7 +595,7 @@ function httpsTransport(defaults) {
       if (!prep.proxy) { issue(prep.options); return; }
 
       var pinfo = prep.proxy;
-      var pheaders = { Host: pinfo.originAuthority, Connection: "keep-alive" };
+      var pheaders = Object.assign(Object.create(null), { Host: pinfo.originAuthority, Connection: "keep-alive" });
       if (pinfo.auth) pheaders["Proxy-Authorization"] = _basicProxyHeader(pinfo.auth);
       var connectOpts = { host: pinfo.host, port: pinfo.port, method: "CONNECT", path: pinfo.originAuthority, headers: pheaders, agent: false };
       var cr;

package/lib/inspect.js

@@ -95,9 +95,9 @@ function _serial(cert, indent) {
   return "Serial Number:\n" + " ".repeat(indent) + _hexColon(buf, {});
 }
 
-var CURVE_BITS = { "P-256": 256, "P-384": 384, "P-521": 521, "prime256v1": 256, "secp384r1": 384, "secp521r1": 521 };
+var CURVE_BITS = Object.assign(Object.create(null), { "P-256": 256, "P-384": 384, "P-521": 521, "prime256v1": 256, "secp384r1": 384, "secp521r1": 521 });
 var NIST_NAME = NAMES.NIST_CURVE;
-var RSA_KEY_ALGS = { rsaEncryption: 1, rsassaPss: 1, rsaesOaep: 1 };
+var RSA_KEY_ALGS = Object.assign(Object.create(null), { rsaEncryption: 1, rsassaPss: 1, rsaesOaep: 1 });
 function _keyBlock(spki, pad) {
   var algName = _algName(spki.algorithm);
   var out = [pad + "Public Key Algorithm: " + algName];
@@ -214,7 +214,7 @@ function _renderCrlDp(decoded, inner) {
 }
 
 
-var EXT_RENDERERS = {
+var EXT_RENDERERS = Object.assign(Object.create(null), {
   keyUsage: function (decoded, inner) {
     return inner + Object.keys(KU_LABEL).filter(function (k) { return decoded[k]; }).map(function (k) { return KU_LABEL[k]; }).join(", ");
   },
@@ -301,7 +301,7 @@ var EXT_RENDERERS = {
   cRLDistributionPoints: _renderCrlDp,
   freshestCRL: _renderCrlDp,
   authorityInfoAccess: function (decoded, inner) {
-    var LABEL = { caIssuers: "CA Issuers", ocsp: "OCSP" };
+    var LABEL = Object.assign(Object.create(null), { caIssuers: "CA Issuers", ocsp: "OCSP" });
     return (decoded || []).map(function (ad) {
       var m = null;
       try { m = oid.name(ad.accessMethod); } catch (_e) { /* allow:swallow-unverified display best-effort: an unregistered accessMethod OID falls back to the raw dotted OID below (inspection is best-effort, never a verdict) */ }
@@ -369,7 +369,7 @@ var EXT_RENDERERS = {
     }
     return akiLines.length ? akiLines.join("\n") : inner + "keyid:(none)";
   },
-};
+});
 EXT_RENDERERS.msApplicationPolicies = EXT_RENDERERS.certificatePolicies;
 
 
@@ -378,7 +378,7 @@ function _renderExtValue(ext, decoded, inner) {
   return fn ? fn(decoded, inner) : null;
 }
 
-var _STRING_TAGS = { 12: 1, 19: 1, 22: 1, 20: 1, 26: 1, 27: 1, 30: 1 };
+var _STRING_TAGS = Object.assign(Object.create(null), { 12: 1, 19: 1, 22: 1, 20: 1, 26: 1, 27: 1, 30: 1 });
 function _printable(buf) {
   return buf.length > 0 && buf.every(function (b) { return b >= 0x20 && b < 0x7f; });
 }
@@ -499,7 +499,7 @@ function _looksParsedCms(o) {
   var shape = _CMS_SHAPE[o.contentType];
   return shape ? shape(o) : false;
 }
-var _INSPECT_ENTRY = { pemLabel: null, PemError: InspectError, ErrorClass: InspectError, prefix: "inspect" };
+var _INSPECT_ENTRY = Object.assign(Object.create(null), { pemLabel: null, PemError: InspectError, ErrorClass: InspectError, prefix: "inspect" });
 function _coerce(input, spec) {
   if (input && typeof input === "object" && !Buffer.isBuffer(input) && !(input instanceof Uint8Array) && input[spec.marker] !== undefined) {
     if (!spec.looksParsed(input)) throw _err("inspect/bad-input", "input has a " + spec.marker + " property but is not a complete " + spec.parsedName + " result");
@@ -657,7 +657,7 @@ function csrReport(input) {
 
 var OID_SIGNED_DATA = oid.byName("signedData");
 function _isObj(x) { return !!x && typeof x === "object"; }
-var _CMS_SHAPE = {};
+var _CMS_SHAPE = Object.create(null);
 _CMS_SHAPE[OID_SIGNED_DATA] = function (o) { return Array.isArray(o.digestAlgorithms) && _isObj(o.encapContentInfo) && Array.isArray(o.signerInfos); };
 _CMS_SHAPE[oid.byName("envelopedData")] = function (o) { return Array.isArray(o.recipientInfos) && _isObj(o.encryptedContentInfo); };
 _CMS_SHAPE[oid.byName("encryptedData")] = function (o) { return _isObj(o.encryptedContentInfo); };
@@ -784,7 +784,7 @@ function cmsReport(input) {
 }
 
 
-var _INSPECT_BY_FORMAT = { x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport };
+var _INSPECT_BY_FORMAT = Object.assign(Object.create(null), { x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport });
 
 /**
  * @primitive pki.inspect.any

package/lib/ip-utils.js

@@ -15,7 +15,7 @@ var _bufferFrom = intrinsic.bufferFrom;
 var _bufferAlloc = intrinsic.bufferAlloc;
 var _defineProperty = intrinsic.defineProperty;
 var _Number = intrinsic.Number;
-function _push(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
+var _push = require("./guard-list").append;
 function _splitOn(str, sep) {
   var out = [], from = 0, at;
   while ((at = _indexOf(str, sep, from)) !== -1) { _push(out, _slice(str, from, at)); from = at + sep.length; }

package/lib/jose.js

@@ -129,7 +129,7 @@ function parseJson(input) {
 }
 
 
-var SIG_ALGS = {
+var SIG_ALGS = intrinsic.assign(intrinsic.create(null), {
   ES256: { kty: "EC", crv: "P-256", hash: "SHA-256", subtle: "ECDSA", sigBytes: 64 },
   ES384: { kty: "EC", crv: "P-384", hash: "SHA-384", subtle: "ECDSA", sigBytes: 96 },
   ES512: { kty: "EC", crv: "P-521", hash: "SHA-512", subtle: "ECDSA", sigBytes: 132 },
@@ -139,26 +139,26 @@ var SIG_ALGS = {
   PS256: { kty: "RSA", hash: "SHA-256", subtle: "RSA-PSS", saltLength: 32 },
   PS384: { kty: "RSA", hash: "SHA-384", subtle: "RSA-PSS", saltLength: 48 },
   PS512: { kty: "RSA", hash: "SHA-512", subtle: "RSA-PSS", saltLength: 64 },
-  EdDSA: { kty: "OKP", subtle: "EdDSA", sigBytesByCrv: { Ed25519: 64, Ed448: 114 } },
+  EdDSA: { kty: "OKP", subtle: "EdDSA", sigBytesByCrv: intrinsic.assign(intrinsic.create(null), { Ed25519: 64, Ed448: 114 }) },
   "ML-DSA-44": { kty: "AKP", subtle: "ML-DSA-44", sigBytes: 2420 },
   "ML-DSA-65": { kty: "AKP", subtle: "ML-DSA-65", sigBytes: 3309 },
   "ML-DSA-87": { kty: "AKP", subtle: "ML-DSA-87", sigBytes: 4627 },
-};
+});
 
-var MAC_ALGS = {
+var MAC_ALGS = intrinsic.assign(intrinsic.create(null), {
   HS256: { kty: "oct", hash: "SHA-256", sigBytes: 32 },
   HS384: { kty: "oct", hash: "SHA-384", sigBytes: 48 },
   HS512: { kty: "oct", hash: "SHA-512", sigBytes: 64 },
-};
+});
 
-var UNDERSTOOD_HEADER = { alg: 1, nonce: 1, url: 1, jwk: 1, kid: 1, crit: 1 };
+var UNDERSTOOD_HEADER = intrinsic.assign(intrinsic.create(null), { alg: 1, nonce: 1, url: 1, jwk: 1, kid: 1, crit: 1 });
 
 
-var PROFILES = {
+var PROFILES = intrinsic.assign(intrinsic.create(null), {
   "acme-outer":     { algs: SIG_ALGS, nonce: "required",  keyId: "one-of", requireUrl: true },
   "eab-inner":      { algs: MAC_ALGS, nonce: "forbidden", keyId: "kid",    requireUrl: true },
   "keychange-inner": { algs: SIG_ALGS, nonce: "forbidden", keyId: "jwk",    requireUrl: true },
-};
+});
 
 function _checkHeader(header, profileName) {
   var profile = PROFILES[profileName];
@@ -192,7 +192,7 @@ function _checkHeader(header, profileName) {
   if (_hasOwn(header, "crit")) {
     var crit = header.crit;
     if (!_isArray(crit) || crit.length === 0) throw E("jose/bad-crit", "crit must be a non-empty array");
-    var seen = {};
+    var seen = intrinsic.create(null);
     for (var c = 0; c < crit.length; c++) {
       var name = crit[c];
       if (typeof name !== "string") throw E("jose/bad-crit", "crit entries must be strings");
@@ -315,7 +315,7 @@ function assertPublicJwk(jwk) {
  *   var v = await pki.jose.verify(jws, { profile: "acme-outer", key: accountJwk });
  *   v.header.alg;   // -> "ES256"
  */
-var _VERIFY_KEYS = { key: 1, profile: 1 };
+var _VERIFY_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, profile: 1 });
 async function verify(jws, opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, E, "jose/bad-input", "unknown pki.jose.verify option ");
@@ -395,8 +395,8 @@ async function verify(jws, opts) {
  *     nonce: "oFvnlFP1wIhRlYS2jTaXbA", url: "https://ca.example/acme/new-acct" };
  *   var jws = await pki.jose.sign({ protected: hdr, payload: Buffer.from("{}"), key: priv });
  */
-var _SIGN_KEYS = { protected: 1, payload: 1, key: 1, jwk: 1, profile: 1 };
-var _SIGN_KEYS_EMBEDDED_JWK = { protected: 1, payload: 1, key: 1, profile: 1 };
+var _SIGN_KEYS = intrinsic.assign(intrinsic.create(null), { protected: 1, payload: 1, key: 1, jwk: 1, profile: 1 });
+var _SIGN_KEYS_EMBEDDED_JWK = intrinsic.assign(intrinsic.create(null), { protected: 1, payload: 1, key: 1, profile: 1 });
 async function sign(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _SIGN_KEYS, E, "jose/bad-input", "unknown pki.jose.sign option ");
@@ -442,13 +442,13 @@ async function sign(opts) {
 }
 
 
-var THUMBPRINT_MEMBERS = {
+var THUMBPRINT_MEMBERS = intrinsic.assign(intrinsic.create(null), {
   EC: ["crv", "kty", "x", "y"],
   RSA: ["e", "kty", "n"],
   oct: ["k", "kty"],
   OKP: ["crv", "kty", "x"],
   AKP: ["alg", "kty", "pub"],
-};
+});
 
 /**
  * @primitive  pki.jose.thumbprint

package/lib/key.js

@@ -38,7 +38,7 @@ function _err(code, msg, cause) { return new KeyError(code, msg, cause); }
 
 var CIPHER_NAME = Object.assign(Object.create(null), { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" });
 
-var INFER_ALG = {};
+var INFER_ALG = Object.create(null);
 ["Ed25519", "Ed448", "X25519", "X448"].forEach(function (n) { INFER_ALG[O(n)] = { name: n }; });
 [["id-ml-dsa-44", "ML-DSA-44"], ["id-ml-dsa-65", "ML-DSA-65"], ["id-ml-dsa-87", "ML-DSA-87"],
  ["id-ml-kem-512", "ML-KEM-512"], ["id-ml-kem-768", "ML-KEM-768"], ["id-ml-kem-1024", "ML-KEM-1024"]
@@ -88,7 +88,7 @@ async function _toPrivateKeyDer(input) {
  *   var enc = await pki.key.encrypt(der, "s3cr3t", { pem: true });
  *   var back = await pki.key.decrypt(enc, "s3cr3t");
  */
-var _ENCRYPT_OPTS = { cipher: 1, iterations: 1, pem: 1, prf: 1, salt: 1 };
+var _ENCRYPT_OPTS = Object.assign(Object.create(null), { cipher: 1, iterations: 1, pem: 1, prf: 1, salt: 1 });
 
 async function encrypt(privateKey, password, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.encrypt options");
@@ -147,7 +147,7 @@ async function encrypt(privateKey, password, opts) {
  *   var enc = await pki.key.encrypt(await pki.key.export(pair.privateKey), "s3cr3t", { pem: true });
  *   var der = await pki.key.decrypt(enc, "s3cr3t");
  */
-var _DECRYPT_OPTS = { maxIterations: 1, pem: 1 };
+var _DECRYPT_OPTS = Object.assign(Object.create(null), { maxIterations: 1, pem: 1 });
 
 async function decrypt(encrypted, password, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.decrypt options");
@@ -203,7 +203,7 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
  *   var pair = await pki.key.generate("Ed25519");
  *   var spkiPem = await pki.key.export(pair.publicKey, { format: "pem" });
  */
-var _EXPORT_OPTS = { format: 1, label: 1 };
+var _EXPORT_OPTS = Object.assign(Object.create(null), { format: 1, label: 1 });
 
 async function export_(key, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.export options");
@@ -246,7 +246,7 @@ async function export_(key, opts) {
  *   var spki = await pki.key.export(pair.publicKey);
  *   var pub = await pki.key.import(spki);                       // Ed25519 -- algorithm inferred
  */
-var _IMPORT_OPTS = { algorithm: 1, extractable: 1, password: 1, usages: 1 };
+var _IMPORT_OPTS = Object.assign(Object.create(null), { algorithm: 1, extractable: 1, password: 1, usages: 1 });
 
 async function import_(input, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.import options");
@@ -290,7 +290,7 @@ async function import_(input, opts) {
  *   var pair = await pki.key.generate("Ed25519");
  *   var pkcs8 = await pki.key.export(pair.privateKey);
  */
-var _GENERATE_OPTS = { extractable: 1, usages: 1 };
+var _GENERATE_OPTS = Object.assign(Object.create(null), { extractable: 1, usages: 1 });
 
 async function generate(algorithm, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.generate options");
@@ -325,7 +325,7 @@ async function generate(algorithm, opts) {
  *   var pair = await pki.key.generate("Ed25519");
  *   var spki = await pki.key.publicFromPrivate(await pki.key.export(pair.privateKey));
  */
-var _PUBLIC_FROM_PRIVATE_OPTS = { pem: 1 };
+var _PUBLIC_FROM_PRIVATE_OPTS = Object.assign(Object.create(null), { pem: 1 });
 
 async function publicFromPrivate(privateKey, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.publicFromPrivate options");

package/lib/lint.js

@@ -129,7 +129,8 @@ function _effective(rule, cert) {
 }
 
 function _runLints(rules, cert, ctx) {
-  var findings = [], counts = { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }, ran = [];
+  var findings = [], ran = [];
+  var counts = Object.assign(Object.create(null), { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 });
   rules.forEach(function (rule) {
     if (rule.appliesTo && !rule.appliesTo(cert, ctx)) { counts.na++; return; }
     if (!_effective(rule, cert)) { counts.ne++; return; }
@@ -172,7 +173,7 @@ function _subjectCNs(cert) {
   return out;
 }
 
-var _CRITICAL_LEGIT = {};
+var _CRITICAL_LEGIT = Object.create(null);
 _CRITICAL_LEGIT[oid.byName("precertificatePoison")] = true;
 function _isUnknownExtension(extOid) {
   if (path.PROCESSED_EXTENSIONS[extOid] !== true) return _CRITICAL_LEGIT[extOid] !== true;
@@ -560,7 +561,7 @@ function _applyThreshold(report, severity) {
  *   report.worst;                              // "notice" | "error" | ...
  *   report.findings.map(function (f) { return f.id; });
  */
-var _CERTIFICATE_OPTS = { profile: 1, severity: 1 };
+var _CERTIFICATE_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
 
 function certificate(input, opts) {
   opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
@@ -573,7 +574,8 @@ function certificate(input, opts) {
   var ingested = _ingest(input);
   var report;
   if (ingested.fatal) {
-    report = { findings: [ingested.fatal], counts: { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }, ran: [] };
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
   } else {
     var ctx = _makeCtx(ingested.cert, opts.profile);
     report = _runLints(rules, ingested.cert, ctx);

package/lib/merkle.js

@@ -180,7 +180,7 @@ function emptyRootHash() {
  *   var lh = pki.merkle.leafHash(Buffer.from([0]));
  *   pki.merkle.verifyInclusion({ leafIndex: 0, treeSize: 1, leafHash: lh, proof: [], rootHash: lh }); // -> true
  */
-var _INCLUSION_KEYS = { leafIndex: 1, treeSize: 1, leafHash: 1, rootHash: 1, proof: 1 };
+var _INCLUSION_KEYS = Object.assign(Object.create(null), { leafIndex: 1, treeSize: 1, leafHash: 1, rootHash: 1, proof: 1 });
 function verifyInclusion(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _INCLUSION_KEYS, function (c, m) { return new MerkleError(c, m); },
@@ -252,7 +252,7 @@ function verifyInclusion(opts) {
  *   var r = pki.merkle.leafHash(Buffer.from([0]));
  *   pki.merkle.verifyConsistency({ oldSize: 1, newSize: 1, oldRoot: r, newRoot: r, proof: [] }); // -> true
  */
-var _CONSISTENCY_KEYS = { oldSize: 1, newSize: 1, oldRoot: 1, newRoot: 1, proof: 1 };
+var _CONSISTENCY_KEYS = Object.assign(Object.create(null), { oldSize: 1, newSize: 1, oldRoot: 1, newRoot: 1, proof: 1 });
 function verifyConsistency(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _CONSISTENCY_KEYS, function (c, m) { return new MerkleError(c, m); },

package/lib/mime.js

@@ -68,7 +68,7 @@ function _unfoldHeaders(headerText) {
 function _parseStructured(headerValue) {
   var parts = _splitSemicolons(headerValue);
   var type = _stripComments(parts[0]).trim().toLowerCase();
-  var params = {};
+  var params = Object.create(null);
   for (var i = 1; i < parts.length; i++) {
     var p = _stripComments(parts[i]);
     var eq = p.indexOf("=");
@@ -131,7 +131,7 @@ function parse(input, E, code) {
   var cte = (header("content-transfer-encoding") || "").trim().toLowerCase() || "7bit";
   return {
     headers: headers, header: header,
-    contentType: ctv != null ? _parseStructured(ctv) : { value: "text/plain", type: "text/plain", params: {} },
+    contentType: ctv != null ? _parseStructured(ctv) : { value: "text/plain", type: "text/plain", params: Object.create(null) },
     cte: cte,
     headerBytes: headerBytes, bodyBytes: bodyBytes, body: bodyBytes, bytes: bytes,
   };

package/lib/ocsp-verify.js

@@ -12,7 +12,7 @@ var compositeSig = require("./composite-sig");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 
-var OCSP_CERTID_HASHES = {};
+var OCSP_CERTID_HASHES = intrinsic.create(null);
 OCSP_CERTID_HASHES[oid.byName("sha1")] = "SHA-1";
 OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
 OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";

package/lib/ocsp.js

@@ -139,9 +139,9 @@ function buildRequest(query, opts) {
   ], _buildRequest);
 }
 
-var _BUILD_REQUEST_OPTS = {
+var _BUILD_REQUEST_OPTS = Object.assign(Object.create(null), {
   hashAlgorithm: 1, nonce: 1, pem: 1, profile: 1, requestorName: 1, signer: 1
-};
+});
 
 function _buildRequest(query, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.buildRequest options");
@@ -250,7 +250,7 @@ function sign(responseData, responder, opts) {
   ], _sign);
 }
 
-var _SIGN_OPTS = { embedCert: 1, extendedRevoke: 1, nonce: 1, pem: 1 };
+var _SIGN_OPTS = Object.assign(Object.create(null), { embedCert: 1, extendedRevoke: 1, nonce: 1, pem: 1 });
 
 function _sign(responseData, responder, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.sign options");
@@ -425,7 +425,7 @@ function buildErrorResponse(status) {
  *   var res = await pki.ocsp.verify(responseDer, { cert: leafDer, issuer: caDer });
  *   res.status;   // "good" | "revoked" | "unknown"
  */
-var _VERIFY_OPTS = { cert: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 };
+var _VERIFY_OPTS = Object.assign(Object.create(null), { cert: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 });
 
 function verify(response, opts) {
   try {
@@ -465,7 +465,7 @@ function _responseNonce(parsed) {
   return null;
 }
 
-var _VERIFY_REQUEST_OPTS = { certs: 1 };
+var _VERIFY_REQUEST_OPTS = Object.assign(Object.create(null), { certs: 1 });
 function _requestFromBytes(request) {
   if (guard.bytes.isByteSource(request)) request = guard.bytes.snapshotSource(request, OcspError, "ocsp/bad-input", "the OCSP request");
   return ocspSchema.parseRequest(request);

package/lib/oid.js

@@ -42,7 +42,7 @@ var OidError = frameworkError.OidError;
 
 function _oidError(c, m) { return new OidError(c, m); }
 
-var FAMILIES = {
+var FAMILIES = Object.assign(Object.create(null), {
   attributeType: { base: [2, 5, 4], of: {
     commonName: 3, surname: 4, serialNumber: 5, countryName: 6,
     localityName: 7, stateOrProvinceName: 8, streetAddress: 9,
@@ -335,7 +335,7 @@ var FAMILIES = {
     scepMessageType: 2, scepPkiStatus: 3, scepFailInfo: 4,
     scepSenderNonce: 5, scepRecipientNonce: 6, scepTransactionId: 7 } },
   scep: { base: [1, 3, 6, 1, 5, 5, 7, 24], of: { scepFailInfoText: 1 } },
-};
+});
 
 var _byOid = new Map();
 var _byName = new Map();
@@ -483,7 +483,7 @@ function registerFamily(base, members) {
 }
 
 function all() {
-  var out = {};
+  var out = Object.create(null);
   _byOid.forEach(function (v, k) { out[k] = v; });
   return out;
 }