@blamejs/pki 0.6.9 → 0.6.10

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.10 — 2026-08-31
+
+pki.est computes a response body's length from a single read of res.body, shared by one helper across every verb, so a caller-supplied transport whose res.body getter changes between reads cannot desync the type check from the measured length.
+
+### Fixed
+
+- pki.est reads a response body's length from a single access of res.body rather than re-reading it across the null / string / BufferSource type-check arms. A caller-supplied transport whose res.body getter returns different values across reads could otherwise size the body from a different value than the one the type check classified. The five identical per-verb length computations are consolidated into one shared helper that reads res.body once.
+
 ## v0.6.9 — 2026-08-31
 
 pki.cmp.verify holds a received PKIMessage to the RFC 9483 sec. 3.5 header rules, and pki.path.build and pki.est read a response body an injected transport returns as any BufferSource, not only a Node Buffer.

package/lib/est.js

@@ -196,6 +196,16 @@ function transferDecode(body) {
   return der;
 }
 
+// The byte length of a transport response body for the size-cap and empty-body checks: a null / absent body
+// is 0, a string its UTF-8 byte length, and any BufferSource (a Buffer / Uint8Array / ArrayBuffer / DataView
+// from an injected transport) its byte count through the byte guard -- never a String()-coerced comma list.
+// res.body is read ONCE so a lying getter on an injected response cannot change it between the arms.
+function _bodyLen(res) {
+  var body = res.body;
+  return body == null ? 0 : (typeof body === "string" ? Buffer.byteLength(body, "utf8")
+    : (Buffer.isBuffer(body) ? guard.bytes.lengthOf(body) : guard.bytes.lengthOf(guard.bytes.source(body, EstError, "est/bad-input", "the response body"))));
+}
+
 /**
  * @primitive  pki.est.transferEncode
  * @signature  pki.est.transferEncode(der) -> string
@@ -1152,7 +1162,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
       // Measure an injected string body as UTF-8 -- the byte width the body is decoded/transfer-decoded at,
       // and what the real socket transport counts -- so a non-ASCII body (multi-byte chars are ~half the
       // count under latin1) cannot undercount past the DoS cap and reach body handling.
-      var blen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
+      var blen = _bodyLen(res);
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
       // The transport contract returns lowercased headers, but the injectable seam only promises
       // { status, headers, body }; normalize here so a redirect Location / WWW-Authenticate from an
@@ -1302,7 +1312,7 @@ function _certsResult(op, res, opts, csrSpki) {
   if (verdict.status !== "ok") throw E("est/http-error", "an EST " + op + " response must be HTTP 200 or 202 (RFC 7030 sec. 4.1.3 / 4.2.3), got " + res.status);
   // Measure the body as UTF-8 for parity with the transport cap above (this check only distinguishes empty
   // from non-empty, where the encoding is immaterial, but the shape is kept uniform so no site undercounts).
-  var bodyLen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
+  var bodyLen = _bodyLen(res);
   if (bodyLen === 0) throw E("est/empty-body", "a 200 " + op + " response carried an empty body (RFC 7030 sec. 4.1.3 / 4.2.3)");
   var parsed = parseCertsOnly(transferDecode(res.body));
   if (op === "cacerts") return { certificates: parsed.certificates, crls: parsed.crls };
@@ -1866,7 +1876,7 @@ function _fullcmcResult(res, opts, wanted, sent) {
       "an EST /fullcmc response must be HTTP 200 or 202 (RFC 7030 sec. 4.3.2), got " + res.status);
   }
 
-  var bodyLen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
+  var bodyLen = _bodyLen(res);
   if (bodyLen === 0) throw E("est/empty-body", "a 200 /fullcmc response carried an empty body (RFC 7030 sec. 4.3.2)");
   var der = transferDecode(res.body);
 
@@ -2265,7 +2275,7 @@ async function _serverkeygenResult(res, opts, derived) {
   // A 202 is an enrollment posture (RFC 7030 sec. 4.4 treats /serverkeygen as an enroll): surfaced, never slept.
   if (verdict.status === "retry") return { retry: true, retryAfterSeconds: verdict.retryAfterSeconds, retryAfterDate: verdict.retryAfterDate };
   if (verdict.status !== "ok") throw E("est/http-error", "an EST serverkeygen response must be HTTP 200 or 202 (RFC 7030 sec. 4.4.2), got " + res.status);
-  var bodyLen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
+  var bodyLen = _bodyLen(res);
   if (bodyLen === 0) throw E("est/empty-body", "a 200 serverkeygen response carried an empty body (RFC 7030 sec. 4.4.2)");
   _assertConfidentialCipher(res);
   // parseServerKeygenResponse does the per-part transfer-decode; the recipient coherence is bound to the CSR.
@@ -2367,7 +2377,7 @@ function _csrattrsResult(res, opts) {
   // A 202 is nonconforming for a policy GET (sec. 4.5.2 lists only 200 / 204 / 404).
   if (verdict.status === "retry") throw E("est/http-error", "a /csrattrs response must be HTTP 200, 204, or 404, not 202 (RFC 7030 sec. 4.5.2)");
   if (verdict.status !== "ok") throw E("est/http-error", "an EST csrattrs response must be HTTP 200 / 204 / 404 (RFC 7030 sec. 4.5.2), got " + res.status);
-  var bodyLen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
+  var bodyLen = _bodyLen(res);
   // An empty HTTP body is distinct from a valid EMPTY CsrAttrs (`30 00` / base64 `MAA=`), which parses as {items:[]}.
   if (bodyLen === 0) throw E("est/empty-body", "a 200 csrattrs response carried an empty body (RFC 7030 sec. 4.5.2)");
   var attrs = csrattrsFmt.parse(transferDecode(res.body));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.9",
+  "version": "0.6.10",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2f668b08-8394-4a54-b202-eac9892a6e2f",
+  "serialNumber": "urn:uuid:bf09eeaa-91f9-4b51-807c-b6184d2dfdce",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-31T15:15:24.682Z",
+    "timestamp": "2026-08-31T16:54:53.965Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.9",
+      "bom-ref": "@blamejs/pki@0.6.10",
       "type": "application",
       "name": "pki",
-      "version": "0.6.9",
+      "version": "0.6.10",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.9",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.10",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.9",
+      "ref": "@blamejs/pki@0.6.10",
       "dependsOn": []
     }
   ]