@blamejs/pki 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.1 — 2026-09-10
+
+A wildcard name in a certificate is held to an excluded name constraint it can reach.
+
+### Security
+
+- pki.path.validate refuses a certificate whose wildcard dNSName reaches a name an excluded subtree forbids. An excluded subtree states the names a certificate must not present, and a wildcard subject alternative name stands for every name one label below its parent rather than for the literal text. Comparing the text alone let a leaf carrying only *.example.com pass an exclusion of bar.example.com, which is a name that leaf presents. Any chain whose certificate authority relies on an excluded dNSName subtree to keep a subordinate away from a name was affected, in every version that shipped name-constraint validation. The permitted direction is unchanged and is not widened by this: a permitted subtree still has to cover the whole of a wildcard, so a base of foo.com admits *.foo.com while a base of bar.example.com does not admit *.example.com. A wildcard reaches exactly one label, so an excluded name deeper than that is out of its reach and is not refused: *.example.com is still admitted against an exclusion of deep.bar.example.com.
+
 ## v0.7.0 — 2026-09-09
 
 A Sigstore bundle signed over an artifact's own bytes is verified, not just one wrapping an attestation.

package/lib/path-validate.js

@@ -52,6 +52,8 @@ var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _strIndexOf = intrinsic.uncurry(String.prototype.indexOf);
 var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var constants = require("./constants");
 var validator = require("./validator-all");
@@ -420,11 +422,28 @@ function emailMatch(constraint, mailbox) {
 
 var stripTrailingDot = guard.name.stripTrailingDot;
 
-function hostConstraintMatch(constraint, host) {
+/** @internal `reachIntoBase` asks the excluded question rather than the permitted one. A wildcard
+ * dNSName stands for every name one label below its parent, so it is a set rather than a name. A
+ * permitted subtree asks whether that whole set stays inside the base, which the literal comparison
+ * already answers: `*.foo.com` ends with `.foo.com`, so a base of `foo.com` covers all of it. An
+ * excluded subtree asks the other question, whether any member of the set falls inside the base, and
+ * the literal comparison answers it in the fail-open direction: `*.example.com` is not the string
+ * `bar.example.com`, so an exclusion of `bar.example.com` admitted a certificate that presents
+ * exactly the name the exclusion forbids. Widening this for the permitted direction would be the
+ * fail-open mirror, so it is asked for only where the caller wants reach. A wildcard reaches exactly
+ * one label, so a base below the wildcard's parent is reached only when it is one label below it. */
+function hostConstraintMatch(constraint, host, reachIntoBase) {
   var c = stripTrailingDot(constraint.toLowerCase()), h = stripTrailingDot(host.toLowerCase());
   if (c === "") return true;
   if (c.charAt(0) === ".") return h.length > c.length && h.slice(-c.length) === c;
-  return h === c || (h.length > c.length && h.slice(-(c.length + 1)) === "." + c);
+  if (h === c || (h.length > c.length && h.slice(-(c.length + 1)) === "." + c)) return true;
+  if (reachIntoBase === true && h.length > 2 && _charCodeAt(h, 0) === 42 && _charCodeAt(h, 1) === 46) {
+    var parent = _strSlice(h, 2);
+    if (parent.length > 0 && c.length > parent.length && _strSlice(c, -(parent.length + 1)) === "." + parent) {
+      return _strIndexOf(_strSlice(c, 0, c.length - parent.length - 1), ".") === -1;
+    }
+  }
+  return false;
 }
 
 function _charTable(chars) { var t = []; for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true; return t; }
@@ -491,14 +510,14 @@ function ipMatch(constraint, addr) {
  * certificate carries in its own nameConstraints extension met no door, and the same rule decides it
  * here. Answering a base outside its tag's form with no match rather than no verdict would make an
  * excluded subtree that covers nothing exclude nothing. */
-function nameMatchesConstraint(gnTag, gnValue, base) {
+function nameMatchesConstraint(gnTag, gnValue, base, reachIntoBase) {
   if (base.tagNumber !== gnTag) return null;
   if (gnTag === 1 || gnTag === 2 || gnTag === 6) {
     if (guard.name.constraintBaseUnreadable(gnTag, base.value)) return "unsupported";
   }
   switch (gnTag) {
     case 1: return emailMatch(base.value, gnValue);
-    case 2: return hostConstraintMatch(base.value, gnValue);
+    case 2: return hostConstraintMatch(base.value, gnValue, reachIntoBase);
     case 6: return uriMatch(base.value, gnValue);
     case 7: return ipMatch(base.value, gnValue);
     case 4: return dnStartsWith(gnValue, base.value);
@@ -540,7 +559,7 @@ function checkNameConstraints(state, cert) {
   for (var e = 0; e < state.excludedSubtrees.length; e++) {
     var ex = state.excludedSubtrees[e];
     for (var i = 0; i < forms.length; i++) {
-      var m = nameMatchesConstraint(forms[i].tag, forms[i].value, { tagNumber: ex.tag, value: ex.base });
+      var m = nameMatchesConstraint(forms[i].tag, forms[i].value, { tagNumber: ex.tag, value: ex.base }, true);
       if (m === true) return { ok: false, code: "path/name-constraint-excluded" };
       if (m === "unsupported") return { ok: false, code: "path/name-constraint-unsupported" };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:fb4bc11f-cd39-480a-b276-ec20713541e7",
+  "serialNumber": "urn:uuid:f4cef9a3-338a-48f8-81a2-c156e38dfb4b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T03:36:52.727Z",
+    "timestamp": "2026-09-10T05:54:34.594Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.0",
+      "bom-ref": "@blamejs/pki@0.7.1",
       "type": "application",
       "name": "pki",
-      "version": "0.7.0",
+      "version": "0.7.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.0",
+      "ref": "@blamejs/pki@0.7.1",
       "dependsOn": []
     }
   ]