@blamejs/pki 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.2 — 2026-09-10
+
+A PKCS#12 iteration cap is read once, so it cannot be answered with a value that is not a number.
+
+### Security
+
+- pki.pkcs12.open and pki.pkcs12.verifyMac hold a store to opts.maxIterations however that option is supplied. The option is the caller's own bound on key-derivation work, and it was read once for each part of its shape check and again by every later pass that applies it: the message authentication code, and then each bag the store carries. An option reached through an accessor answers each read separately, so one that returned a valid integer to the shape check and a non-numeric value to a later comparison left the cap as NaN. No count is above NaN, so the comparison stopped refusing anything and a store demanding far more work than the caller allowed was accepted and its keys derived. A store carrying no message authentication code reaches this through its bags alone, so opening one with opts.allowUnauthenticated was affected even though the authenticated path was not consulted. Both verbs now take the whole options object once, at entry, and every pass reads that one copy, which closes the same door for every option either verb accepts rather than for this one alone. A caller passing options as plain values was never affected. The same read-once shape is applied to the PBES2 and CMP iteration caps, where no route was found that reaches them this way.
+
+## v0.7.1 — 2026-09-10
+
+A wildcard name in a certificate is held to an excluded name constraint it can reach.
+
+### Security
+
+- pki.path.validate refuses a certificate whose wildcard dNSName reaches a name an excluded subtree forbids. An excluded subtree states the names a certificate must not present, and a wildcard subject alternative name stands for every name one label below its parent rather than for the literal text. Comparing the text alone let a leaf carrying only *.example.com pass an exclusion of bar.example.com, which is a name that leaf presents. Any chain whose certificate authority relies on an excluded dNSName subtree to keep a subordinate away from a name was affected, in every version that shipped name-constraint validation. The permitted direction is unchanged and is not widened by this: a permitted subtree still has to cover the whole of a wildcard, so a base of foo.com admits *.foo.com while a base of bar.example.com does not admit *.example.com. A wildcard reaches exactly one label, so an excluded name deeper than that is out of its reach and is not refused: *.example.com is still admitted against an exclusion of deep.bar.example.com.
+
 ## v0.7.0 — 2026-09-09
 
 A Sigstore bundle signed over an artifact's own bytes is verified, not just one wrapping an attestation.

package/lib/cmp-verify.js

@@ -535,11 +535,15 @@ async function _verifyMac(m, protectedPart, protectionAlg, protection, opts) {
 
 function _capWork(iterationCount, salt, keyLength, prfHash, opts) {
   var cap = PBMAC1_MAX_ITER;
-  if (opts.maxIterations != null) {
-    if (typeof opts.maxIterations !== "number" || !_isFinite(opts.maxIterations) || opts.maxIterations < 1 || _floor(opts.maxIterations) !== opts.maxIterations) {
+  /** @internal Read once: the shape check and the comparison must read the same answer, or an
+   * option reached through an accessor passes as a number and then answers the comparison with
+   * something that is not one, leaving the cap NaN and bounding nothing. */
+  var wantedIter = opts.maxIterations;
+  if (wantedIter != null) {
+    if (typeof wantedIter !== "number" || !_isFinite(wantedIter) || wantedIter < 1 || _floor(wantedIter) !== wantedIter) {
       throw _err("cmp/bad-input", "opts.maxIterations must be a positive integer");
     }
-    cap = _min(opts.maxIterations, cap);
+    cap = _min(wantedIter, cap);
   }
   if (iterationCount < PBMAC1_MIN_ITER) throw _err("cmp/bad-input", "the PBMAC1 iterationCount " + iterationCount + " is below the floor " + PBMAC1_MIN_ITER + " (RFC 8018 sec. 4.2)");
   if (iterationCount > cap) throw _err("cmp/bad-input", "the PBMAC1 iterationCount " + iterationCount + " exceeds the cap " + cap);

package/lib/path-validate.js

@@ -52,6 +52,8 @@ var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _strIndexOf = intrinsic.uncurry(String.prototype.indexOf);
 var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var constants = require("./constants");
 var validator = require("./validator-all");
@@ -420,11 +422,28 @@ function emailMatch(constraint, mailbox) {
 
 var stripTrailingDot = guard.name.stripTrailingDot;
 
-function hostConstraintMatch(constraint, host) {
+/** @internal `reachIntoBase` asks the excluded question rather than the permitted one. A wildcard
+ * dNSName stands for every name one label below its parent, so it is a set rather than a name. A
+ * permitted subtree asks whether that whole set stays inside the base, which the literal comparison
+ * already answers: `*.foo.com` ends with `.foo.com`, so a base of `foo.com` covers all of it. An
+ * excluded subtree asks the other question, whether any member of the set falls inside the base, and
+ * the literal comparison answers it in the fail-open direction: `*.example.com` is not the string
+ * `bar.example.com`, so an exclusion of `bar.example.com` admitted a certificate that presents
+ * exactly the name the exclusion forbids. Widening this for the permitted direction would be the
+ * fail-open mirror, so it is asked for only where the caller wants reach. A wildcard reaches exactly
+ * one label, so a base below the wildcard's parent is reached only when it is one label below it. */
+function hostConstraintMatch(constraint, host, reachIntoBase) {
   var c = stripTrailingDot(constraint.toLowerCase()), h = stripTrailingDot(host.toLowerCase());
   if (c === "") return true;
   if (c.charAt(0) === ".") return h.length > c.length && h.slice(-c.length) === c;
-  return h === c || (h.length > c.length && h.slice(-(c.length + 1)) === "." + c);
+  if (h === c || (h.length > c.length && h.slice(-(c.length + 1)) === "." + c)) return true;
+  if (reachIntoBase === true && h.length > 2 && _charCodeAt(h, 0) === 42 && _charCodeAt(h, 1) === 46) {
+    var parent = _strSlice(h, 2);
+    if (parent.length > 0 && c.length > parent.length && _strSlice(c, -(parent.length + 1)) === "." + parent) {
+      return _strIndexOf(_strSlice(c, 0, c.length - parent.length - 1), ".") === -1;
+    }
+  }
+  return false;
 }
 
 function _charTable(chars) { var t = []; for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true; return t; }
@@ -491,14 +510,14 @@ function ipMatch(constraint, addr) {
  * certificate carries in its own nameConstraints extension met no door, and the same rule decides it
  * here. Answering a base outside its tag's form with no match rather than no verdict would make an
  * excluded subtree that covers nothing exclude nothing. */
-function nameMatchesConstraint(gnTag, gnValue, base) {
+function nameMatchesConstraint(gnTag, gnValue, base, reachIntoBase) {
   if (base.tagNumber !== gnTag) return null;
   if (gnTag === 1 || gnTag === 2 || gnTag === 6) {
     if (guard.name.constraintBaseUnreadable(gnTag, base.value)) return "unsupported";
   }
   switch (gnTag) {
     case 1: return emailMatch(base.value, gnValue);
-    case 2: return hostConstraintMatch(base.value, gnValue);
+    case 2: return hostConstraintMatch(base.value, gnValue, reachIntoBase);
     case 6: return uriMatch(base.value, gnValue);
     case 7: return ipMatch(base.value, gnValue);
     case 4: return dnStartsWith(gnValue, base.value);
@@ -540,7 +559,7 @@ function checkNameConstraints(state, cert) {
   for (var e = 0; e < state.excludedSubtrees.length; e++) {
     var ex = state.excludedSubtrees[e];
     for (var i = 0; i < forms.length; i++) {
-      var m = nameMatchesConstraint(forms[i].tag, forms[i].value, { tagNumber: ex.tag, value: ex.base });
+      var m = nameMatchesConstraint(forms[i].tag, forms[i].value, { tagNumber: ex.tag, value: ex.base }, true);
       if (m === true) return { ok: false, code: "path/name-constraint-excluded" };
       if (m === "unsupported") return { ok: false, code: "path/name-constraint-unsupported" };
     }

package/lib/pbes2.js

@@ -74,9 +74,13 @@ function parsePbkdf2Params(paramsDer, opts, E, prefix, strictPrf) {
   if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw E(prefix + "/bad-input", "PBKDF2 salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
   var iterations = guard.range.positiveInt31(asn1.read.integer(kids[1]), E, prefix + "/bad-input", "PBKDF2 iterationCount");
   var cap = C.LIMITS.PBKDF2_MAX_ITERATIONS;
-  if (opts && opts.maxIterations != null) {
-    if (typeof opts.maxIterations !== "number" || !isFinite(opts.maxIterations) || opts.maxIterations < 1 || Math.floor(opts.maxIterations) !== opts.maxIterations) throw E(prefix + "/bad-input", "maxIterations must be a positive integer");
-    cap = Math.min(opts.maxIterations, cap);
+  /** @internal Read once: the shape check and the comparison must read the same answer, or an
+   * option reached through an accessor passes as a number and then answers the comparison with
+   * something that is not one, leaving the cap NaN and bounding nothing. */
+  var wantedIter = opts ? opts.maxIterations : null;
+  if (wantedIter != null) {
+    if (typeof wantedIter !== "number" || !isFinite(wantedIter) || wantedIter < 1 || Math.floor(wantedIter) !== wantedIter) throw E(prefix + "/bad-input", "maxIterations must be a positive integer");
+    cap = Math.min(wantedIter, cap);
   }
   if (iterations > cap) throw E(prefix + "/iteration-limit", "PBKDF2 iterationCount " + iterations + " exceeds the cap " + cap);
   var prfNode = "sha1";

package/lib/pkcs12-build.js

@@ -552,6 +552,8 @@ async function _build(spec, opts) {
 async function verifyMac(pfx, password, opts) {
   if (opts != null && typeof opts === "object" && !Buffer.isBuffer(opts)) {
     guard.identifier.assertKnownKeys(opts, _VERIFY_MAC_OPTS, _err, "pkcs12/bad-input", "pki.pkcs12.verifyMac has an unknown option ");
+    /** @internal Taken once here, for the reason the same call in `open` states. */
+    opts = guard.identifier.snapshotOptions(opts, _VERIFY_MAC_OPTS);
   }
   var m = _storeFromBytes(pfx);
   var valid = await _verifyMacOfStore(m, password, opts);
@@ -593,11 +595,16 @@ async function _verifyMacOfStore(m, password, opts) {
   return computed.length === expected.length && guard.crypto.constantTimeEqual(computed, expected);
 }
 
+/** @internal The caller's bound is read once and the shape check and the comparison both read that
+ * one answer. Read separately, an option reached through an accessor satisfies every check as a
+ * number and then answers the comparison with something that is not one, so `Math.min` yields NaN.
+ * Nothing compares above NaN, so the cap stopped bounding the work it exists to bound. */
 function _capWork(iterations, salt, opts, keyLength, hardCap) {
   var cap = hardCap;
-  if (opts.maxIterations != null) {
-    if (typeof opts.maxIterations !== "number" || !isFinite(opts.maxIterations) || opts.maxIterations < 1 || Math.floor(opts.maxIterations) !== opts.maxIterations) throw _err("pkcs12/bad-input", "maxIterations must be a positive integer");
-    cap = Math.min(opts.maxIterations, cap);
+  var wanted = opts.maxIterations;
+  if (wanted != null) {
+    if (typeof wanted !== "number" || !isFinite(wanted) || wanted < 1 || Math.floor(wanted) !== wanted) throw _err("pkcs12/bad-input", "maxIterations must be a positive integer");
+    cap = Math.min(wanted, cap);
   }
   if (iterations > cap) throw _err("pkcs12/iteration-limit", "the MAC iteration count " + iterations + " exceeds the cap " + cap);
   if (salt && salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("pkcs12/bad-input", "the MAC salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
@@ -653,6 +660,12 @@ function _capWork(iterations, salt, opts, keyLength, hardCap) {
 async function open(pfx, password, opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _OPEN_OPTS, _err, "pkcs12/bad-input", "pki.pkcs12.open has an unknown option ");
+  /** @internal Every option is taken once, here, and everything below reads the snapshot. A store
+   * is opened in many passes, the MAC and then each bag, so an option left on the caller's object is
+   * read again by every one of them. An option reached through an accessor answers each read
+   * separately: one that returned a valid integer to this check and something that is not a number
+   * to a later bag left the work cap as NaN, and no count is above NaN. */
+  opts = guard.identifier.snapshotOptions(opts, _OPEN_OPTS);
   if (opts.maxIterations != null &&(typeof opts.maxIterations !== "number" || !isFinite(opts.maxIterations) || opts.maxIterations < 1 || Math.floor(opts.maxIterations) !== opts.maxIterations)) {
     throw _err("pkcs12/bad-input", "maxIterations must be a positive integer");
   }
@@ -732,7 +745,8 @@ function _decryptLegacyPbe(ea, ct, password, opts, budget) {
     if (e && e.isPkcs12Error) throw e;
     throw _err("pkcs12/bad-algorithm-parameters", "malformed pkcs-12PbeParams (RFC 7292 App. C)", e);
   }
-  var cap = opts.maxIterations != null ? Math.min(opts.maxIterations, CLASSIC_MAC_MAX_ITERATIONS) : CLASSIC_MAC_MAX_ITERATIONS;
+  var wantedLegacy = opts.maxIterations;
+  var cap = wantedLegacy != null ? Math.min(wantedLegacy, CLASSIC_MAC_MAX_ITERATIONS) : CLASSIC_MAC_MAX_ITERATIONS;
   if (iterations > cap) throw _err("pkcs12/iteration-limit", "the legacy PBE iteration count " + iterations + " exceeds the cap " + cap);
   if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("pkcs12/bad-input", "the legacy PBE salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
   var u = P12_KDF_UV[scheme.hash].u;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:fb4bc11f-cd39-480a-b276-ec20713541e7",
+  "serialNumber": "urn:uuid:3b58cd3c-2ea1-4d00-9d93-8181e4a421b2",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T03:36:52.727Z",
+    "timestamp": "2026-09-10T07:33:50.131Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.0",
+      "bom-ref": "@blamejs/pki@0.7.2",
       "type": "application",
       "name": "pki",
-      "version": "0.7.0",
+      "version": "0.7.2",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.2",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.0",
+      "ref": "@blamejs/pki@0.7.2",
       "dependsOn": []
     }
   ]