@blamejs/pki 0.7.6 → 0.7.8

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.8 — 2026-09-10
+
+A pre-encoded CRL extension whose value does not decode is refused instead of signed.
+
+### Fixed
+
+- A pre-encoded extension supplied to pki.crl.sign is put through the extension decoder registered for its identifier, and a value that does not decode is refused with the decoder's own typed code, the same one pki.x509.sign raises for the same bytes. An issuerAltName whose value is a NULL now raises crl/bad-extension-value and a keyUsage whose value is a NULL raises crl/bad-key-usage, where both were previously signed. Revoked-entry extensions take the same check.
+- The check runs after the per-extension profile rules this verb already applied, so a CRL whose only fault is one malformed extension keeps the code it has always raised: a pre-encoded cRLNumber that is not an INTEGER stays crl/bad-crl-number, and the criticality, delta-ordering and issuingDistributionPoint rules are unchanged. No CRL that was accepted before is refused for a different reason; the extensions newly refused are ones nothing was reading, and an extension with no registered decoder is unaffected.
+- Where a CRL carries more than one fault, the reported code can differ from earlier releases. The rules that compare extensions to each other, such as freshestCRL not appearing in a delta CRL and a delta's cRLNumber exceeding its baseCRLNumber, run once every extension has been read, so a malformed value found first is now reported first. Such a CRL was refused before and is refused now; only which of its faults is named has changed. A caller matching on a specific code for a CRL with several faults should re-check the code it expects.
+
+## v0.7.7 — 2026-09-10
+
+The two GeneralName arms that were taken on their tag alone are now read.
+
+### Changed
+
+- Every verb that walks a name is affected, since they share one reader: certification-path validation, certificate and attribute-certificate parsing, CRL and CMP name handling, certificate linting, and the name-carrying extension decoders. A certificate carrying one of these two arms malformed was accepted before and is refused now, with the typed code that verb already raises for a bad name. A conforming arm is unaffected, and no error code was added or changed.
+
+### Fixed
+
+- GeneralName ediPartyName [5] is read as the EDIPartyName it holds: an optional nameAssigner [0] before a required partyName [1], each wrapping a DirectoryString of at least one character, in that order and with nothing else alongside. It was previously accepted as any non-empty constructed value, so a [5] over a NULL, over an INTEGER, or carrying nameAssigner without partyName all decoded as names while encoding none. GeneralName is defined in the RFC 5280 Appendix A.2 implicitly tagged module, so the [5] tag replaces the EDIPartyName SEQUENCE tag and its children are the two arms directly.
+- GeneralName x400Address [3] must open with the BuiltInStandardAttributes SEQUENCE that begins an ORAddress, so an arm carrying that tag over some other value is refused. What the components hold is an X.400 structure this does not read, and every one of them is optional, so an address whose components are all empty is conforming and is not refused.
+
 ## v0.7.6 — 2026-09-10
 
 A Sigstore bundle is held to the shape its specification states, in signature count and in entry count.

package/lib/crl-sign.js

@@ -44,6 +44,9 @@ function _err(code, message, cause) { return new CrlError(code, message, cause);
 function _signE(kind, message, cause) { return new CrlError("crl/" + kind, message, cause); }
 function O(n) { return oid.byName(n); }
 
+/** @internal The builder is handed no decoder map: this module does not use the builder's
+ * extension-building path, it walks the pre-encoded array itself below and validates each value
+ * against this map there. */
 var _b = pkiBuild.makeBuilder({ ErrorClass: CrlError, prefix: "crl", O: O, NS: NS, NAME_SCHEMA: NAME_SCHEMA, SPKI_SCHEMA: SPKI_SCHEMA, EXT_DECODERS: {} });
 var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.reqDer,
   _assertValidSpki = _b.assertValidSpki, _assertValidExtension = _b.assertValidExtension,
@@ -52,6 +55,23 @@ var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.req
   _certLikeFromSpki = _b.certLikeFromSpki, _assertSignatureVerifies = _b.assertSignatureVerifies;
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
+/** @internal A pre-encoded extension is admitted on the shape of its Extension SEQUENCE, which says
+ * nothing about whether extnValue decodes as the structure its extnID names. Where a decoder is
+ * registered for that OID, the value is put through it, so a value that cannot be read is refused
+ * here rather than signed and left for a relying party to find. The decoder's own typed code is
+ * kept, since it names the field that failed. Called AFTER this module's own profile checks, so an
+ * extension it already answers for keeps the code it has always raised and this only reaches the
+ * ones nothing was checking. */
+function _assertExtensionValueDecodes(node, extnId, what) {
+  var dec = EXT_DECODERS[extnId];
+  if (!dec) return;
+  try { dec(asn1.read.octetString(node.children[node.children.length - 1])); }
+  catch (err) {
+    if (err instanceof CrlError) throw err;
+    throw _err("crl/bad-input", "pre-encoded " + what + " " + (oid.name(extnId) || extnId) + " value is malformed", err);
+  }
+}
+
 var OID_SKI = O("subjectKeyIdentifier");
 
 var CRL_REASON = constants.NAMES.CRL_REASON;
@@ -221,6 +241,7 @@ function _buildCrlExtensions(spec, ctx) {
           if (extnId === O("issuingDistributionPoint")) _validatePreEncodedIdp(inner);
         }
       }
+      _assertExtensionValueDecodes(node, extnId, "extension");
       if (extnId === O("deltaCRLIndicator")) isDelta = true;
       out.push(b.raw(der));
     });
@@ -307,6 +328,7 @@ function _buildRevoked(entryList, isDelta) {
             try { asn1.read.time(einner); } catch (e) { throw _err("crl/bad-input", "pre-encoded invalidityDate is not a well-formed GeneralizedTime (RFC 5280 sec. 5.3.2)", e); }
           }
         }
+        _assertExtensionValueDecodes(xnode, extnId, "entry extension");
         entryExts.push(b.raw(der));
       });
     }

package/lib/crmf-sign.js

@@ -825,24 +825,16 @@ function _namesSomebody(node) {
   if (!_isUniversal(node, 16) || !node.children || node.children.length === 0) return false;
   try { schema.walk(pkix.generalNames(NS, { code: "crmf/bad-popo" }), node, NS); }
   catch (_e) { return false; } // allow:swallow-unverified a list the shared reader refuses names nobody, which the caller's refusal states
-  /** @internal The shared reader takes ediPartyName [5] as any non-empty constructed value, so a [5]
-   * holding a NULL passes it while encoding no name at all. EDIPartyName is SEQUENCE { nameAssigner
-   * [0] DirectoryString OPTIONAL, partyName [1] DirectoryString } (RFC 5280 sec. 4.2.1.6), so the
-   * arms it holds are context-tagged and a universal value is not one of them. x400Address [3] is an
-   * ORAddress, which this does not read, and is left to the shared reader: the derivation hashes
-   * these bytes rather than interpreting them, so an arm it cannot check is still an arm both sides
-   * hash alike. */
-  /** @internal Walked arm by arm, because the reader answers for most of them and not for all. It
-   * requires the IA5 arms [1] [2] [6] to carry characters, [7] to be an address of a real width and
-   * [8] to be an OBJECT IDENTIFIER, and it walks [0] and [4] into their own shapes. What it does not
-   * do is refuse the two empty forms below, and x400Address [3] it takes on its tag alone, which is
-   * left as it is: the derivation hashes these bytes rather than reading them, so an arm neither
-   * side reads is still an arm both sides hash alike. */
+  /** @internal The shared reader answers for the SHAPE of every arm, including ediPartyName [5] and
+   * the ORAddress opening of x400Address [3]. What remains here is the separate question this
+   * derivation asks, which is whether the arm names SOMEBODY rather than whether it is well formed:
+   * a Name with no RDNs and an ORAddress whose components are all empty are both conforming and
+   * neither identifies a subject. Splitting it this way keeps a naming-strength rule out of a
+   * structural reader every other consumer shares. */
   for (var i = 0; i < node.children.length; i++) {
     var arm = node.children[i];
     if (arm.tagNumber === 3 && !_isOrAddress(arm)) return false;
     if (arm.tagNumber === 4 && !_isNonEmptyName(arm)) return false;
-    if (arm.tagNumber === 5 && !_isEdiPartyName(arm)) return false;
   }
   return true;
 }
@@ -874,32 +866,6 @@ function _isNonEmptyName(node) {
   return schema.isUniversal(dn, 16) && !!dn.children && dn.children.length > 0;
 }
 
-/** @internal The universal tags a DirectoryString is written under (RFC 5280 sec. 4.1.2.4):
- * UTF8String, PrintableString, TeletexString, UniversalString and BMPString. */
-var DIRECTORY_STRING_TAGS = [12, 19, 20, 28, 30];
-
-/** @internal Whether a [5] arm holds an EDIPartyName: the optional nameAssigner [0] before the
- * required partyName [1], each carrying a DirectoryString. DirectoryString is a CHOICE, so its tag
- * is EXPLICIT however the module tags: the arm is constructed and wraps the string itself, and the
- * string has to be one, since a [1] wrapping a NULL is tagged like a name and holds none. */
-function _isEdiPartyName(node) {
-  var kids = node.children;
-  if (!kids || kids.length < 1 || kids.length > 2) return false;
-  for (var i = 0; i < kids.length; i++) {
-    var arm = kids[i];
-    if (!schema.isContextInRange(arm, 0, 1) || !arm.children || arm.children.length !== 1) return false;
-    if (!schema.isUniversalOneOf(arm.children[0], DIRECTORY_STRING_TAGS)) return false;
-    /** @internal Read as the string it is tagged as, not counted as one. DirectoryString is
-     * SIZE (1..MAX), so an empty one names nobody, and a string whose bytes are not the encoding its
-     * tag claims is not a name either. The codec's own reader answers both. */
-    var text;
-    try { text = asn1.read.string(arm.children[0]); }
-    catch (_e) { return false; } // allow:swallow-unverified a string the codec cannot read names nobody, which the caller's refusal states
-    if (text.length === 0) return false;
-  }
-  if (kids.length === 2) return kids[0].tagNumber === 0 && kids[1].tagNumber === 1;
-  return kids[0].tagNumber === 1;
-}
 
 function _nameOrAlternative(parsed, nameField, altExtension) {
   var name = parsed[nameField];

package/lib/schema-pkix.js

@@ -460,6 +460,10 @@ var CRL_REASON_NAMES = constants.NAMES.CRL_REASON;
 
 var GN_CONSTRUCTED = _assign(_create(null), { 0: 1, 3: 1, 4: 1, 5: 1 });
 var GN_IA5 = _assign(_create(null), { 1: 1, 2: 1, 6: 1 });
+/** @internal DirectoryString ::= CHOICE { teletexString, printableString, universalString,
+ * utf8String, bmpString } (RFC 5280 sec. 4.1.2.4). */
+var DIRECTORY_STRING_TAGS = [asn1.TAGS.UTF8_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.TELETEX_STRING,
+  asn1.TAGS.UNIVERSAL_STRING, asn1.TAGS.BMP_STRING];
 function generalName(ns, opts) {
   opts = opts || {};
   var code = opts.code || (ns.prefix + "/bad-general-name");
@@ -489,6 +493,40 @@ function generalName(ns, opts) {
         if (n.children.length !== 1) throw ctx.E(code, "GeneralName directoryName [4] must wrap exactly one Name");
         var dnMatch = schema.walk(NAME, n.children[0], ctx);
         if (decodeValue) value = dnMatch.result;
+      } else if (t === 3) {
+        /** @internal ORAddress opens with the BuiltInStandardAttributes SEQUENCE (X.411), so an arm
+         * carrying its tag over some other value is not an address. What the components hold is an
+         * X.400 structure this does not read, and every one of them is optional, so an address whose
+         * components are all empty is still a conforming address and is not refused here. */
+        if (!schema.isUniversal(n.children[0], asn1.TAGS.SEQUENCE)) {
+          throw ctx.E(code, "GeneralName x400Address [3] must be an ORAddress opening with the BuiltInStandardAttributes SEQUENCE (X.411)");
+        }
+      } else if (t === 5) {
+        /** @internal EDIPartyName ::= SEQUENCE { nameAssigner [0] DirectoryString OPTIONAL,
+         * partyName [1] DirectoryString } (RFC 5280 sec. 4.2.1.6). partyName is not optional, the
+         * two arms are ordered, and a DirectoryString is SIZE (1..MAX), so an empty one is not one. */
+        var ediKids = n.children;
+        if (ediKids.length > 2) throw ctx.E(code, "GeneralName ediPartyName [5] holds at most nameAssigner [0] and partyName [1] (RFC 5280 sec. 4.2.1.6)");
+        for (var ei = 0; ei < ediKids.length; ei++) {
+          var ediArm = ediKids[ei];
+          if (!schema.isContextInRange(ediArm, 0, 1) || !ediArm.children || ediArm.children.length !== 1) {
+            throw ctx.E(code, "GeneralName ediPartyName [5] arms must be [0] or [1] wrapping exactly one DirectoryString");
+          }
+          if (!schema.isUniversalOneOf(ediArm.children[0], DIRECTORY_STRING_TAGS)) {
+            throw ctx.E(code, "GeneralName ediPartyName [5] arm must hold a DirectoryString");
+          }
+          var ediText;
+          try { ediText = asn1.read.string(ediArm.children[0]); }
+          catch (e) { throw ctx.E(code, "GeneralName ediPartyName [5] arm is not the string its tag claims", e); }
+          if (ediText.length === 0) throw ctx.E(code, "GeneralName ediPartyName [5] DirectoryString must be SIZE (1..MAX)");
+        }
+        if (ediKids.length === 2) {
+          if (ediKids[0].tagNumber !== 0 || ediKids[1].tagNumber !== 1) {
+            throw ctx.E(code, "GeneralName ediPartyName [5] must order nameAssigner [0] before partyName [1]");
+          }
+        } else if (ediKids[0].tagNumber !== 1) {
+          throw ctx.E(code, "GeneralName ediPartyName [5] requires partyName [1]; nameAssigner [0] alone is not a name");
+        }
       }
     } else {
       if (constructed) throw ctx.E(code, "GeneralName [" + t + "] must be primitive (X.690 sec. 10.2)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:8551b89b-6716-4eab-914a-0a3d1aafe57d",
+  "serialNumber": "urn:uuid:eb6258f5-7cf4-4371-80b7-ed98047003ac",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T12:38:33.413Z",
+    "timestamp": "2026-09-10T13:51:21.922Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.6",
+      "bom-ref": "@blamejs/pki@0.7.8",
       "type": "application",
       "name": "pki",
-      "version": "0.7.6",
+      "version": "0.7.8",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.6",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.8",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.6",
+      "ref": "@blamejs/pki@0.7.8",
       "dependsOn": []
     }
   ]