@blamejs/pki 0.8.2 → 0.8.4

package/lib/schema-cmp.js

@@ -283,7 +283,7 @@ var GEN_MSG_CONTENT = schema.seqOf(INFO_TYPE_AND_VALUE, {
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
 
-var CERT_TEMPLATE_LEAF = schema.decode(function (n) { return crmf.walkCertTemplate(n); });
+var CERT_TEMPLATE_LEAF = schema.decode(function (n, ctx) { return crmf.walkCertTemplate(n, ctx); });
 var REV_DETAILS = schema.seq([
   schema.field("certDetails", CERT_TEMPLATE_LEAF),
   schema.optional("crlEntryDetails", EXTENSIONS, { whenUniversal: [TAGS.SEQUENCE] }),
@@ -348,7 +348,7 @@ var ENCRYPTED_KEY = schema.choice([
   { when: { tagClass: "context", tagNumber: 0 },
     schema: schema.decode(function (n, ctx) {
       var env;
-      try { env = cms.walkEnvelopedData(asn1.decode(asn1.sequenceTlv(n))); }
+      try { env = cms.walkEnvelopedData(pkix.decodeNested(asn1.sequenceTlv(n), ctx, "an EncryptedKey envelopedData"), ctx); }
       catch (e) {
         throw ctx.E("cmp/bad-cert-response", "envelopedData [0] must be a well-formed IMPLICIT EnvelopedData (RFC 9810 sec. 5.2.2)", e);
       }
@@ -521,7 +521,7 @@ var BODY = schema.decode(function (n, ctx) {
   var out = { arm: BODY_ARMS[n.tagNumber], tag: n.tagNumber, bytes: inner.bytes };
   if (CRMF_ARMS[n.tagNumber]) {
     var isCcr = n.tagNumber === 13;
-    out.decoded = crmf.walkCertReqMessages(inner, { allowSigningAlg: isCcr, allowV1Version: isCcr });
+    out.decoded = crmf.walkCertReqMessages(inner, { allowSigningAlg: isCcr, allowV1Version: isCcr }, ctx);
   } else if (DECODED_ARMS[n.tagNumber]) {
     var match = schema.walk(DECODED_ARMS[n.tagNumber], inner, ctx);
     out.decoded = match.result;
@@ -612,7 +612,7 @@ var PKI_MESSAGE = schema.seq([
           for (var cn = 0; cn < controls.length; cn++) {
             if (controls[cn].type !== OID_PKI_ARCHIVE_OPTIONS) continue;
             var arch;
-            try { arch = asn1.decode(controls[cn].value); }
+            try { arch = pkix.decodeNested(controls[cn].value, ctx, "a pkiArchiveOptions control value"); }
             catch (e) { throw ctx.E("cmp/bad-body", "a ccr pkiArchiveOptions control did not decode (RFC 9810 sec. 5.3.11)", e); }
             if (arch.tagClass === "context" && arch.tagNumber === 0) {
               throw ctx.E("cmp/bad-body", "a cross-certification request (ccr) must not send the private key -- a pkiArchiveOptions encryptedPrivKey control is forbidden (RFC 9810 sec. 5.3.11, sec. 5.2.8.3.1)");
@@ -631,7 +631,7 @@ var PKI_MESSAGE = schema.seq([
         if (archCtrls && header.pvno !== 3) {
           for (var ac = 0; ac < archCtrls.length; ac++) {
             if (archCtrls[ac].type !== OID_PKI_ARCHIVE_OPTIONS) continue;
-            var opt = asn1.decode(archCtrls[ac].value);
+            var opt = pkix.decodeNested(archCtrls[ac].value, ctx, "a pkiArchiveOptions control value");
             if (opt.tagClass === "context" && opt.tagNumber === 0 && opt.children && opt.children.length >= 1 &&
                 opt.children[0].tagClass === "context" && opt.children[0].tagNumber === 0) {
               throw ctx.E("cmp/bad-version", "a pkiArchiveOptions encryptedPrivKey using the EnvelopedData form requires CMP version cmp2021(3) (RFC 9810 sec. 5.2.8.3.1, sec. 7)");
@@ -643,7 +643,7 @@ var PKI_MESSAGE = schema.seq([
     if (header.generalInfo) {
       for (var gi = 0; gi < header.generalInfo.length; gi++) {
         if (header.generalInfo[gi].type !== OID_CERT_PROFILE) continue;
-        var profileCount = asn1.decode(header.generalInfo[gi].value).children.length;
+        var profileCount = pkix.decodeNested(header.generalInfo[gi].value, ctx, "a certProfile infoValue").children.length;
         var bodyCount = null;
         if (body.arm === "p10cr") bodyCount = 1;
         else if (body.decoded && body.decoded.messages) bodyCount = body.decoded.messages.length;
@@ -654,13 +654,13 @@ var PKI_MESSAGE = schema.seq([
       }
     }
     if (body.arm === "ckuann" && header.pvno !== 3) {
-      var caKeyUpd = asn1.decode(body.bytes);
+      var caKeyUpd = pkix.decodeNested(body.bytes, ctx, "a ckuann body");
       if (caKeyUpd.tagClass === "context" && caKeyUpd.tagNumber === 0) {
         throw ctx.E("cmp/bad-version", "a ckuann using the cAKeyUpdAnnV3 [0] RootCaKeyUpdateContent form requires CMP version cmp2021(3) (RFC 9810 sec. 5.3.13, sec. 7)");
       }
     }
     if (body.arm === "popdecc" && header.pvno !== 3) {
-      var challenges = asn1.decode(body.bytes);
+      var challenges = pkix.decodeNested(body.bytes, ctx, "a popdecc body");
       if (challenges.tagClass === "universal" && challenges.tagNumber === TAGS.SEQUENCE && challenges.children) {
         for (var chi = 0; chi < challenges.children.length; chi++) {
           var chKids = challenges.children[chi].children;
@@ -751,7 +751,7 @@ var readName = _valueParser("Name", pkix.name(NS));
 
 /**
  * @primitive  pki.schema.cmp.parse
- * @signature  pki.schema.cmp.parse(input) -> pkiMessage
+ * @signature  pki.schema.cmp.parse(input, caps?) -> pkiMessage
  * @since      0.1.19
  * @status     stable
  * @spec       RFC 9810, RFC 9483, RFC 9481
@@ -805,6 +805,11 @@ var readName = _valueParser("Name", pkix.name(NS));
  *   var m = pki.schema.cmp.parse(der);
  *   m.body.arm;             // "ir", "ip", "error", ...
  *   m.header.transactionID; // raw Buffer or null
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeParser({
   pemLabel: "CMP", PemError: PemError, ErrorClass: CmpError,

package/lib/schema-cms.js

@@ -127,7 +127,7 @@ function _checkAttrPlacement(attrs, place) {
   }
 }
 
-function _checkContentBindingAttrs(attrs, mode) {
+function _checkContentBindingAttrs(attrs, mode, ctx) {
   var ct = 0, md = 0, seen = Object.create(null);
   for (var i = 0; i < attrs.length; i++) {
     var a = attrs[i];
@@ -141,16 +141,16 @@ function _checkContentBindingAttrs(attrs, mode) {
       ct += 1;
       if (mode === "countersig") throw NS.E("cms/misplaced-attr", "a countersignature's signedAttrs must not carry a content-type attribute (RFC 5652 sec. 11.4)");
       if (a.values.length !== 1) throw NS.E("cms/bad-content-type-attr", "the content-type attribute must be single-valued");
-      try { asn1.read.oid(asn1.decode(a.values[0])); }
+      try { asn1.read.oid(pkix.decodeNested(a.values[0], ctx, "a content-type attribute value")); }
       catch (e) { throw NS.E("cms/bad-content-type-attr", "the content-type attribute value must be a valid OBJECT IDENTIFIER", e); }
     } else if (a.type === OID_MESSAGE_DIGEST) {
       md += 1;
       if (a.values.length !== 1) throw NS.E("cms/bad-message-digest-attr", "the message-digest attribute must be single-valued");
-      try { asn1.read.octetString(asn1.decode(a.values[0])); }
+      try { asn1.read.octetString(pkix.decodeNested(a.values[0], ctx, "a message-digest attribute value")); }
       catch (e) { throw NS.E("cms/bad-message-digest-attr", "the message-digest attribute value must be an OCTET STRING", e); }
     } else if (a.type === OID_SIGNING_TIME) {
       if (a.values.length !== 1) throw NS.E("cms/bad-signing-time-attr", "the signing-time attribute must be single-valued (RFC 5652 sec. 11.3)");
-      try { asn1.read.time(asn1.decode(a.values[0])); }
+      try { asn1.read.time(pkix.decodeNested(a.values[0], ctx, "a signing-time attribute value")); }
       catch (e) { throw NS.E("cms/bad-signing-time-attr", "the signing-time attribute value must be a Time (RFC 5652 sec. 11.3)", e); }
     }
   }
@@ -187,6 +187,7 @@ function _ascendingDer(nodes) {
 function looksLikeSignedAttributes(bytes) {
   if (!bytes || !bytes.length) return false;
   var node;
+  // allow:bare-decode a shape probe on bytes a caller hands the signer or verifier, outside any parse.
   try { node = asn1.decode(bytes); }
   catch (_e) { return false; }
   if (!schema.isUniversal(node, asn1.TAGS.SET) || !node.constructed) return false;
@@ -225,12 +226,12 @@ function looksLikeSignedAttributes(bytes) {
   return sawContentType && sawMessageDigest;
 }
 
-function _assertContentTypeMatchesAttrs(attrs, eContentType) {
+function _assertContentTypeMatchesAttrs(attrs, eContentType, ctx) {
   for (var i = 0; i < attrs.length; i++) {
     if (attrs[i].type !== OID_CONTENT_TYPE) continue;
     if (attrs[i].values.length !== 1) throw NS.E("cms/bad-content-type-attr", "the content-type attribute must be single-valued (RFC 5652 sec. 11.1)");
     var ctv;
-    try { ctv = asn1.read.oid(asn1.decode(attrs[i].values[0])); }
+    try { ctv = asn1.read.oid(pkix.decodeNested(attrs[i].values[0], ctx, "a content-type attribute value")); }
     catch (e) { throw NS.E("cms/bad-content-type-attr", "the content-type attribute value must be a valid OBJECT IDENTIFIER", e); }
     if (ctv !== eContentType) throw NS.E("cms/content-type-mismatch", "the content-type attribute (" + ctv + ") must equal the eContentType (" + eContentType + ") (RFC 5652 sec. 5.3)");
   }
@@ -244,13 +245,13 @@ function _checkNoDuplicateAttrs(attrs) {
   }
 }
 
-function _validateAeadParams(alg, macLen) {
+function _validateAeadParams(alg, macLen, ctx) {
   var kind = AEAD_ALGS[alg.oid];
   if (!kind) return null;
   var K = kind.toUpperCase();
   if (alg.parameters === null) throw NS.E("cms/bad-aead-params", "an AES-" + K + " content-encryption algorithm MUST carry its parameters (RFC 5084 sec. 3." + (kind === "gcm" ? "2" : "1") + ")");
   var node;
-  try { node = asn1.decode(alg.parameters); }
+  try { node = pkix.decodeNested(alg.parameters, ctx, "AES-" + K + " content-encryption parameters"); }
   catch (e) { throw NS.E("cms/bad-aead-params", "malformed AES-" + K + " parameters", e); }
   if (node.tagClass !== "universal" || node.tagNumber !== T.SEQUENCE || !node.children || node.children.length < 1 || node.children.length > 2) {
     throw NS.E("cms/bad-aead-params", "AES-" + K + " parameters must be a SEQUENCE { aes-nonce, aes-ICVlen DEFAULT 12 } (RFC 5084)");
@@ -275,8 +276,8 @@ function _validateAeadParams(alg, macLen) {
   return { kind: kind, nonce: nonce, icvLen: icvLen };
 }
 
-function _assertDerEncodedAttrs(node, code) {
-  try { asn1.decode(node.bytes); }
+function _assertDerEncodedAttrs(node, code, ctx) {
+  try { pkix.decodeNested(node.bytes, ctx, "an attribute set"); }
   catch (e) { throw NS.E(code, "the attribute set must be DER encoded even inside a BER envelope (RFC 5652 sec. 5.3)", e); }
 }
 
@@ -373,10 +374,10 @@ function makeSignerInfo(mode) {
       }
       var signedAttrs = null, signedAttrsBytes = null;
       if (m.fields.signedAttrs.present) {
-        _assertDerEncodedAttrs(m.fields.signedAttrs.node, "cms/bad-signed-attrs");
+        _assertDerEncodedAttrs(m.fields.signedAttrs.node, "cms/bad-signed-attrs", ctx);
         signedAttrs = m.fields.signedAttrs.value.items.map(function (it) { return it.value.result; });
         _checkAttrPlacement(signedAttrs, "signed");
-        _checkContentBindingAttrs(signedAttrs, mode);
+        _checkContentBindingAttrs(signedAttrs, mode, ctx);
         signedAttrsBytes = m.fields.signedAttrs.node.bytes;
       }
       var unsignedAttrs = null;
@@ -387,7 +388,7 @@ function makeSignerInfo(mode) {
           if (unsignedAttrs[u].type !== OID_COUNTERSIGNATURE) continue;
           for (var v = 0; v < unsignedAttrs[u].values.length; v++) {
             var csNode;
-            try { csNode = asn1.decode(unsignedAttrs[u].values[v]); }
+            try { csNode = pkix.decodeNested(unsignedAttrs[u].values[v], ctx, "a countersignature attribute value"); }
             catch (e) { throw NS.E("cms/bad-countersignature", "a countersignature attribute value must be DER (RFC 5652 sec. 11.4)", e); }
             schema.walk(COUNTERSIGNATURE_SIGNER_INFO, csNode, ctx);
           }
@@ -418,7 +419,7 @@ var SIGNED_DATA = schema.seq([
   schema.field("signerInfos", schema.setOf(SIGNER_INFO, { min: 0, code: "cms/bad-signer-infos", what: "signerInfos" })),
 ], {
   assert: "sequence", code: "cms/bad-signed-data", what: "SignedData",
-  build: function (m) {
+  build: function (m, ctx) {
     var version = m.fields.version.value;
     var encapContentInfo = m.fields.encapContentInfo.value.result;
     var certificates = m.fields.certificates.present ? m.fields.certificates.value.items.map(rawChoiceElement(CERT_CHOICE_TAGS, "cms/bad-certificates", "certificates")) : [];
@@ -432,7 +433,7 @@ var SIGNED_DATA = schema.seq([
     }
 
     for (var si = 0; si < signerInfos.length; si++) {
-      if (signerInfos[si].signedAttrs) _assertContentTypeMatchesAttrs(signerInfos[si].signedAttrs, encapContentInfo.eContentType);
+      if (signerInfos[si].signedAttrs) _assertContentTypeMatchesAttrs(signerInfos[si].signedAttrs, encapContentInfo.eContentType, ctx);
     }
 
     var expected = _expectedSignedDataVersion(certificates, crls, signerInfos, encapContentInfo.eContentType);
@@ -771,7 +772,7 @@ var AUTHENTICATED_DATA = schema.seq([
   schema.optional("unauthAttrs", schema.implicitSetOf(3, ATTRIBUTE, { min: 1, code: "cms/bad-unauth-attrs", what: "unauthAttrs" }), { tag: 3 }),
 ], {
   assert: "sequence", code: "cms/bad-auth-data", what: "AuthenticatedData",
-  build: function (m) {
+  build: function (m, ctx) {
     var version = m.fields.version.value;
     var originatorInfo = m.fields.originatorInfo.present ? m.fields.originatorInfo.value.result : null;
     var encapContentInfo = m.fields.encapContentInfo.value.result;
@@ -789,11 +790,11 @@ var AUTHENTICATED_DATA = schema.seq([
 
     var authAttrs = null, authAttrsBytes = null;
     if (hasAuthAttrs) {
-      _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs");
+      _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs", ctx);
       authAttrs = m.fields.authAttrs.value.items.map(function (it) { return it.value.result; });
       _checkAttrPlacement(authAttrs, "auth");
-      _checkContentBindingAttrs(authAttrs, "content");
-      _assertContentTypeMatchesAttrs(authAttrs, encapContentInfo.eContentType);
+      _checkContentBindingAttrs(authAttrs, "content", ctx);
+      _assertContentTypeMatchesAttrs(authAttrs, encapContentInfo.eContentType, ctx);
       authAttrsBytes = m.fields.authAttrs.node.bytes;
     }
     var unauthAttrs = null;
@@ -826,10 +827,10 @@ var AUTH_ENVELOPED_DATA = schema.seq([
   schema.optional("unauthAttrs", schema.implicitSetOf(2, ATTRIBUTE, { min: 1, code: "cms/bad-unauth-attrs", what: "unauthAttrs" }), { tag: 2 }),
 ], {
   assert: "sequence", code: "cms/bad-auth-enveloped-data", what: "AuthEnvelopedData",
-  build: function (m) {
+  build: function (m, ctx) {
     var encryptedContentInfo = m.fields.authEncryptedContentInfo.value.result;
     var mac = m.fields.mac.value;
-    var aead = _validateAeadParams(encryptedContentInfo.contentEncryptionAlgorithm, mac.length);
+    var aead = _validateAeadParams(encryptedContentInfo.contentEncryptionAlgorithm, mac.length, ctx);
 
     var hasAuthAttrs = m.fields.authAttrs.present;
     if (!hasAuthAttrs && encryptedContentInfo.contentType !== OID_DATA) {
@@ -837,11 +838,11 @@ var AUTH_ENVELOPED_DATA = schema.seq([
     }
     var authAttrs = null, authAttrsBytes = null;
     if (hasAuthAttrs) {
-      _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs");
+      _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs", ctx);
       authAttrs = m.fields.authAttrs.value.items.map(function (it) { return it.value.result; });
       _checkAttrPlacement(authAttrs, "auth");
       _checkNoDuplicateAttrs(authAttrs);
-      _assertContentTypeMatchesAttrs(authAttrs, encryptedContentInfo.contentType);
+      _assertContentTypeMatchesAttrs(authAttrs, encryptedContentInfo.contentType, ctx);
       authAttrsBytes = m.fields.authAttrs.node.bytes;
     }
     var unauthAttrs = null;
@@ -934,7 +935,7 @@ var CONTENT_INFO = schema.seq([
 
 /**
  * @primitive  pki.schema.cms.parse
- * @signature  pki.schema.cms.parse(input) -> content
+ * @signature  pki.schema.cms.parse(input, caps?) -> content
  * @since      0.1.10
  * @status     stable
  * @spec       RFC 5652, RFC 5083, RFC 9629
@@ -972,6 +973,11 @@ var CONTENT_INFO = schema.seq([
  *   var cms = pki.schema.cms.parse(der);
  *   cms.signerInfos[0].sid.serialNumberHex;   // -> "0a1b"
  *   cms.encapContentInfo.eContent;            // -> Buffer | null (detached)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({ pemLabel: "CMS", PemError: PemError, ErrorClass: CmsError, prefix: "cms", what: "CMS ContentInfo", topSchema: CONTENT_INFO, ns: NS }, "cms");
 
@@ -1025,13 +1031,23 @@ function matches(root) {
   return true;
 }
 
-function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).result; }
+/** @internal `ctx` is the walk context of the parse that reached this structure, when another
+ *  format carries it. Only its caps and budget cross over: a cap the caller named at that
+ *  format's door has to reach this walk, and a fault in this structure is still CMS's to report. */
+function walkEnvelopedData(node, ctx) {
+  return schema.walk(ENVELOPED_DATA, node, schema.withResources(NS, ctx)).result;
+}
 
-var walkSignedData = guard.parsed.recordingWalker("cms", function (node) {
-  return schema.walk(SIGNED_DATA, node, NS).result;
+var walkSignedData = guard.parsed.recordingWalker("cms", function (node, ctx) {
+  return schema.walk(SIGNED_DATA, node, schema.withResources(NS, ctx)).result;
+  // allow:bare-decode the re-decode a recording walker performs on raw DER a caller hands it, outside any parse.
 }, function (der) { return asn1.decode(der, { ber: true }); });
-function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
-function walkCountersignature(node) { return schema.walk(COUNTERSIGNATURE_SIGNER_INFO, node, NS).result; }
+function walkEncryptedData(node, ctx) {
+  return schema.walk(ENCRYPTED_DATA, node, schema.withResources(NS, ctx)).result;
+}
+function walkCountersignature(node, ctx) {
+  return schema.walk(COUNTERSIGNATURE_SIGNER_INFO, node, schema.withResources(NS, ctx)).result;
+}
 
 function assertAttachedCiphertext(eci, E, code, label) {
   if (!eci || eci.encryptedContent === null || eci.encryptedContent.length === 0) {

package/lib/schema-crl.js

@@ -51,20 +51,20 @@ var TIME = pkix.time(NS);
 
 var CRL_VERSION = pkix.versionReader(NS, { "1": 2 });
 
-function decodeExt(ext, scope) {
+function decodeExt(ext, scope, ctx) {
   var value = ext.value;
   var atCrl = scope !== "entry";
   var atEntry = scope !== "crl";
   try {
     if (ext.oid === OID_CRL_NUMBER && atCrl) {
-      value = asn1.read.integer(asn1.decode(ext.value));
+      value = asn1.read.integer(pkix.decodeNested(ext.value, ctx, "a cRLNumber extension value"));
       if (value < 0n) throw new Error("cRLNumber must be non-negative (INTEGER 0..MAX)");
     } else if (ext.oid === OID_REASON_CODE && atEntry) {
-      var reason = asn1.read.enumerated(asn1.decode(ext.value));
+      var reason = asn1.read.enumerated(pkix.decodeNested(ext.value, ctx, "a reasonCode extension value"));
       if (!_hasOwn(CRL_REASONS, reason.toString())) throw new Error("undefined CRLReason " + reason.toString());
       value = Number(reason);
     } else if (ext.oid === OID_INVALIDITY_DATE && atEntry) {
-      var n = asn1.decode(ext.value);
+      var n = pkix.decodeNested(ext.value, ctx, "an invalidityDate extension value");
       if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
         throw new Error("invalidityDate must be a GeneralizedTime");
       }
@@ -82,13 +82,13 @@ var REVOKED_ENTRY = schema.seq([
   schema.optional("crlEntryExtensions", EXTENSIONS, { whenUniversal: [TAGS.SEQUENCE] }),
 ], {
   assert: "sequence", arity: { min: 2 }, code: "crl/bad-revoked-entry", what: "RevokedCertificate",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       serialNumber: m.fields.userCertificate.value,
       serialNumberHex: m.fields.userCertificate.node.content.toString("hex"),
       revocationDate: m.fields.revocationDate.value,
       crlEntryExtensions: m.fields.crlEntryExtensions.present
-        ? m.fields.crlEntryExtensions.value.result.map(function (e) { return decodeExt(e, "entry"); })
+        ? m.fields.crlEntryExtensions.value.result.map(function (e) { return decodeExt(e, "entry", ctx); })
         : [],
     };
   },
@@ -111,7 +111,7 @@ var TBS_CERTLIST = schema.seq([
     { minTag: 0, maxTag: 0, unexpectedCode: "crl/bad-tbs", orderCode: "crl/bad-tbs" }),
 ], {
   assert: "sequence", code: "crl/bad-tbs", what: "tbsCertList",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       version: m.fields.version.present ? m.fields.version.value : 1,
       issuer: m.fields.issuer.value.result,
@@ -119,7 +119,7 @@ var TBS_CERTLIST = schema.seq([
       nextUpdate: m.fields.nextUpdate.present ? m.fields.nextUpdate.value : null,
       revokedCertificates: m.fields.revokedCertificates.present ? m.fields.revokedCertificates.value.result : [],
       crlExtensions: m.fields.crlExtensions.present
-        ? m.fields.crlExtensions.value.result.map(function (e) { return decodeExt(e, "crl"); })
+        ? m.fields.crlExtensions.value.result.map(function (e) { return decodeExt(e, "crl", ctx); })
         : [],
       crlExtensionsPresent: m.fields.crlExtensions.present,
     };
@@ -157,7 +157,7 @@ var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
 
 /**
  * @primitive  pki.schema.crl.parse
- * @signature  pki.schema.crl.parse(input) -> crl
+ * @signature  pki.schema.crl.parse(input, caps?) -> crl
  * @since      0.1.7
  * @status     stable
  * @spec       RFC 5280
@@ -180,6 +180,11 @@ var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
  *     { cert: caCert, key: key });
  *   var crl = pki.schema.crl.parse(der);
  *   crl.revokedCertificates[0].serialNumberHex;  // -> "0a3f"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({ pemLabel: "X509 CRL", PemError: PemError, ErrorClass: CrlError, prefix: "crl", what: "CRL", topSchema: CERTIFICATE_LIST, ns: NS }, "crl");
 
@@ -260,10 +265,10 @@ function entryExtensionCriticality(oidRegistry) {
  *  raw. Returns the record with its decoded `value`; throws `crl/bad-extension-value`. */
 var OID_CERTIFICATE_ISSUER = oid.byName("certificateIssuer");
 var CERTIFICATE_ISSUER_NAMES = pkix.generalNames(NS, { code: "crl/bad-extension-value" });
-function readEntryExtension(ext) {
-  if (ext.oid !== OID_CERTIFICATE_ISSUER) return decodeExt(ext);
+function readEntryExtension(ext, ctx) {
+  if (ext.oid !== OID_CERTIFICATE_ISSUER) return decodeExt(ext, undefined, ctx);
   var names;
-  try { names = schema.walk(CERTIFICATE_ISSUER_NAMES, asn1.decode(ext.value), NS).result; }
+  try { names = schema.walk(CERTIFICATE_ISSUER_NAMES, pkix.decodeNested(ext.value, ctx, "a certificateIssuer extension value"), ctx || NS).result; }
   catch (e) {
     throw NS.E("crl/bad-extension-value", "malformed certificateIssuer extension value: " + ((e && e.message) || intrinsic.String(e)), e);
   }

package/lib/schema-crmf.js

@@ -170,12 +170,12 @@ function popoPrivKey(type) {
       }
     }
     if (inner.tagNumber === 3) {
-      try { schema.embeddedDer(PKMAC_VALUE, asn1.sequenceTlv(inner), NS, { code: "crmf/bad-popo", what: "agreeMAC [3] PKMACValue" }); }
+      try { schema.embeddedDer(PKMAC_VALUE, asn1.sequenceTlv(inner), schema.withResources(NS, ctx), { code: "crmf/bad-popo", what: "agreeMAC [3] PKMACValue" }); }
       catch (e) { throw ctx.E("crmf/bad-popo", "agreeMAC [3] must be a PKMACValue SEQUENCE { algId, BIT STRING } (RFC 4211 sec. 4.2)", e); }
     }
     if (inner.tagNumber === 4) {
       var env;
-      try { env = cms.walkEnvelopedData(asn1.decode(asn1.sequenceTlv(inner))); }
+      try { env = cms.walkEnvelopedData(pkix.decodeNested(asn1.sequenceTlv(inner), ctx, "an encryptedKey [4] EnvelopedData"), ctx); }
       catch (e) { throw ctx.E("crmf/bad-popo", "encryptedKey [4] must be a well-formed EnvelopedData (RFC 4211 sec. 4.2, RFC 5652 sec. 6.1)", e); }
       if (env.encryptedContentInfo.contentType !== oid.byName("encKeyWithID")) {
         throw ctx.E("crmf/bad-popo", "encryptedKey [4] EnvelopedData content type MUST be id-ct-encKeyWithID (RFC 4211 sec. 4.2)");
@@ -311,7 +311,7 @@ var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
 
 /**
  * @primitive  pki.schema.crmf.parse
- * @signature  pki.schema.crmf.parse(input) -> certReqMessages
+ * @signature  pki.schema.crmf.parse(input, caps?) -> certReqMessages
  * @since      0.1.17
  * @status     stable
  * @spec       RFC 4211
@@ -348,6 +348,11 @@ var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
  *     { key: await pki.key.export(pair.privateKey) });
  *   var m = pki.schema.crmf.parse(der);
  *   m.messages[0].certReq.certTemplate.subject.dn;   // "CN=req.example"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({
   pemLabel: null, PemError: PemError, ErrorClass: CrmfError, prefix: "crmf",
@@ -409,16 +414,21 @@ function matches(root) {
     schema.isUniversal(tpl, TAGS.SEQUENCE) && !!tpl.children;
 }
 
-function walkCertReqMessages(node, opts) {
-  var ctx = NS;
+/** @internal `outer` is the walk context of the parse that reached these messages, when another
+ *  format carries them. Only its caps and budget cross over: the messages are still read in this
+ *  namespace, so a fault in one keeps the CRMF error class and code. */
+function walkCertReqMessages(node, opts, outer) {
+  var ctx = schema.withResources(NS, outer);
   if (opts && (opts.allowSigningAlg || opts.allowV1Version)) {
-    ctx = Object.assign({}, NS);
+    ctx = Object.assign({}, ctx);
     if (opts.allowSigningAlg) ctx.allowSigningAlg = true;
     if (opts.allowV1Version) ctx.allowV1Version = true;
   }
   return schema.walk(CERT_REQ_MESSAGES, node, ctx).result;
 }
-function walkCertTemplate(node) { return schema.walk(CERT_TEMPLATE, node, NS).result; }
+function walkCertTemplate(node, outer) {
+  return schema.walk(CERT_TEMPLATE, node, schema.withResources(NS, outer)).result;
+}
 
 module.exports = {
   parse: parse,

package/lib/schema-csr.js

@@ -121,7 +121,7 @@ var CERTIFICATION_REQUEST = pkix.signedEnvelope(NS, CERTIFICATION_REQUEST_INFO,
 
 /**
  * @primitive  pki.schema.csr.parse
- * @signature  pki.schema.csr.parse(input) -> csr
+ * @signature  pki.schema.csr.parse(input, caps?) -> csr
  * @since      0.1.8
  * @status     stable
  * @spec       RFC 2986
@@ -147,6 +147,11 @@ var CERTIFICATION_REQUEST = pkix.signedEnvelope(NS, CERTIFICATION_REQUEST_INFO,
  *   var csr = pki.schema.csr.parse(der);
  *   csr.subject.dn;             // -> "CN=req.example"
  *   csr.attributes[0].type;     // -> "1.2.840.113549.1.9.14"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({ pemLabel: "CERTIFICATE REQUEST", PemError: PemError, ErrorClass: CsrError, prefix: "csr", what: "certification request", topSchema: CERTIFICATION_REQUEST, ns: NS }, "csr");
 

package/lib/schema-csrattrs.js

@@ -158,12 +158,13 @@ var CERT_REQ_INFO_TEMPLATE = schema.seq([
         hasExtReq = true;
         extReqs += 1;
         if (a.values.length !== 1) throw NS.E("csrattrs/bad-template-attrs", "a template id-ExtensionReq values must be a SET of exactly one Extensions (RFC 9908 sec. 3.2)");
-        extensions = schema.walk(EXTENSIONS, asn1.decode(a.values[0]), ctx).result;
+        extensions = schema.walk(EXTENSIONS, pkix.decodeNested(a.values[0], ctx, "a template id-ExtensionReq value"), ctx).result;
       }
       if (a.type === OID_EXT_REQ_TEMPLATE) {
         extReqTemplates += 1;
         if (a.values.length !== 1) throw NS.E("csrattrs/bad-template-attrs", "an id-aa-extensionReqTemplate values must be a SET of exactly one ExtensionReqTemplate (RFC 9908 sec. 3.4)");
-        extensionTemplates = extensionTemplates.concat(schema.walk(EXTENSION_REQ_TEMPLATE, asn1.decode(a.values[0]), ctx).result);
+        extensionTemplates = extensionTemplates.concat(schema.walk(EXTENSION_REQ_TEMPLATE,
+          pkix.decodeNested(a.values[0], ctx, "an id-aa-extensionReqTemplate value"), ctx).result);
       }
     }
     if (extReqs > 1) throw NS.E("csrattrs/bad-template-attrs", "a template must not carry more than one id-ExtensionReq (RFC 9908 sec. 3.2)");
@@ -185,25 +186,26 @@ function _enrichAttribute(item, ctx) {
   if (KEY_TYPE_OIDS.has(item.oid)) item.isKeyType = true;
   if (item.oid === OID_EXTENSION_REQUEST) {
     if (item.values.length !== 1) throw ctx.E("csrattrs/bad-extension-req", "an id-ExtensionReq attribute values must be a SET of exactly one Extensions (RFC 9908 sec. 3.2)");
-    item.extensions = schema.walk(EXTENSIONS, asn1.decode(item.values[0]), ctx).result;
+    item.extensions = schema.walk(EXTENSIONS, pkix.decodeNested(item.values[0], ctx, "an id-ExtensionReq value"), ctx).result;
   } else if (item.oid === OID_EC_PUBLIC_KEY) {
     if (item.values.length > 1) throw ctx.E("csrattrs/bad-key-type-attr", "an ecPublicKey attribute values must be empty or a SET of exactly one named-curve OBJECT IDENTIFIER (RFC 9908 sec. 3.2)");
     if (item.values.length === 1) {
-      try { item.curve = asn1.read.oid(asn1.decode(item.values[0])); }
+      try { item.curve = asn1.read.oid(pkix.decodeNested(item.values[0], ctx, "an ecPublicKey attribute value")); }
       catch (e) { throw ctx.E("csrattrs/bad-key-type-attr", "an ecPublicKey attribute value must be a named-curve OBJECT IDENTIFIER (RFC 9908 sec. 3.2)", e); }
     }
   } else if (item.oid === OID_RSA_ENCRYPTION) {
     if (item.values.length > 1) throw ctx.E("csrattrs/bad-key-type-attr", "an rsaEncryption attribute values must be empty or a SET of exactly one INTEGER key size (RFC 9908 sec. 3.2)");
     if (item.values.length === 1) {
       var sz;
-      try { sz = asn1.read.integer(asn1.decode(item.values[0])); }
+      try { sz = asn1.read.integer(pkix.decodeNested(item.values[0], ctx, "an rsaEncryption attribute value")); }
       catch (e) { throw ctx.E("csrattrs/bad-key-type-attr", "an rsaEncryption attribute value must be an INTEGER key size (RFC 9908 sec. 3.2)", e); }
       if (sz < 1n || sz > 65536n) throw ctx.E("csrattrs/bad-key-type-attr", "the rsaEncryption key size " + sz + " is out of range (1..65536 bits)");
       item.keySize = Number(sz);
     }
   } else if (item.oid === OID_TEMPLATE) {
     if (item.values.length !== 1) throw ctx.E("csrattrs/bad-template", "a certificationRequestInfoTemplate attribute values must be a SET of exactly one template (RFC 9908 sec. 3.4)");
-    item.template = schema.walk(CERT_REQ_INFO_TEMPLATE, asn1.decode(item.values[0]), ctx).result;
+    item.template = schema.walk(CERT_REQ_INFO_TEMPLATE,
+      pkix.decodeNested(item.values[0], ctx, "a certificationRequestInfoTemplate value"), ctx).result;
   }
 }
 
@@ -244,7 +246,7 @@ var CSR_ATTRS = schema.seqOf(ATTR_OR_OID, {
 
 /**
  * @primitive  pki.schema.csrattrs.parse
- * @signature  pki.schema.csrattrs.parse(der) -> { items }
+ * @signature  pki.schema.csrattrs.parse(der, caps?) -> { items }
  * @since      0.1.24
  * @status     stable
  * @spec       RFC 8951, RFC 9908, RFC 7030
@@ -269,6 +271,11 @@ var CSR_ATTRS = schema.seqOf(ATTR_OR_OID, {
  *   ]);
  *   var a = pki.schema.csrattrs.parse(der);
  *   a.items[0].kind;   // -> "oid" | "attribute"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeParser({ pemLabel: null, PemError: frameworkError.PemError, ErrorClass: CsrattrsError, prefix: "csrattrs", what: "CsrAttrs", topSchema: CSR_ATTRS, ns: NS });
 

package/lib/schema-engine.js

@@ -75,6 +75,66 @@ function _assertArity(schema, kids, ctx) {
 }
 
 
+var RESOURCE_REFUSALS = Object.assign(Object.create(null), {
+  "asn1/too-large": 1, "asn1/too-deep": 1, "asn1/too-many-items": 1,
+});
+
+/** @internal The codec's resource refusals, as distinct from its malformed-input refusals. A
+ *  caller who tightened a cap has to be able to tell "your bytes are wrong" from "your cap is
+ *  too small", and only the second is answered by raising the cap. */
+function isResourceRefusal(e) {
+  return !!(e && typeof e.code === "string" && RESOURCE_REFUSALS[e.code] === 1);
+}
+
+/** @internal Carries a parse's caps and budget onto another namespace. A format whose structure
+ *  is carried inside another format walks it in its OWN namespace, so a refusal names the domain
+ *  that owns the fault and keeps its own error class; the caps and the budget are the only things
+ *  that cross the boundary. Returns `ns` unchanged when there is nothing to carry. */
+function withResources(ns, source) {
+  if (!source || (source.caps == null && source.budget == null)) return ns;
+  var out = Object.create(null);
+  var keys = Object.keys(ns);
+  for (var i = 0; i < keys.length; i++) out[keys[i]] = ns[keys[i]];
+  out.caps = source.caps;
+  out.budget = source.budget;
+  return out;
+}
+
+/** @internal The decode a parse performs on a value it has already read out of its input: an
+ *  embedded OCTET STRING payload, an encapsulated protocol body. `ctx` is the walk context the
+ *  door built, so the caps a caller named at the door hold at every level rather than at the
+ *  root alone, and a resource refusal down here trips the parse budget before the original
+ *  error is re-thrown. The error itself is re-thrown unchanged, because a format's existing
+ *  code for a malformed embedded value is one callers pin.
+ *
+ *  `opts.ber` is read once into a local and carries the relaxed acceptance a format whose door
+ *  is BER-tolerant already applies at the root. The decode options are built fresh per call. */
+function decodeNested(bytes, ctx, label, opts) {
+  var caps = ctx ? ctx.caps : null;
+  var ber = !!(opts && opts.ber === true);
+  var decodeOpts = Object.create(null);
+  if (caps) {
+    decodeOpts.maxBytes = caps.maxBytes;
+    decodeOpts.maxDepth = caps.maxDepth;
+    decodeOpts.maxItems = caps.maxItems;
+  }
+  if (ber) decodeOpts.ber = true;
+  try {
+    // allow:bare-decode this IS the primitive every other nested decode routes through.
+    return asn1.decode(bytes, decodeOpts);
+  } catch (e) {
+    if (isResourceRefusal(e) && ctx && ctx.budget) {
+      try {
+        ctx.budget.trip(label || "an embedded value");
+      } catch (_b) {
+        /* allow:swallow-unverified the latch is the point; the original error is re-thrown below */
+      }
+    }
+    throw e;
+  }
+}
+
+// allow:bare-decode a round trip through the codec on an integer this module just encoded.
 function _implicitIntContent(v) { return asn1.decode(asn1.build.integer(v)).content; }
 function oidLeaf()        { return { kind: "leaf", read: asn1.read.oid, write: function (v) { return asn1.build.oid(v); } }; }
 function integerLeaf()    { return { kind: "leaf", read: asn1.read.integer, write: function (v) { return asn1.build.integer(v); } }; }
@@ -436,6 +496,7 @@ function _encodeRepeat(schema, items, ctx) {
   if (schema.unique) {
     var seen = new Set();
     parts.forEach(function (tlv) {
+      // allow:bare-decode a round trip through the codec on a TLV this encoder just produced.
       var item = { node: asn1.decode(tlv) };
       item.value = walk(schema.item, item.node, ctx);
       var key = schema.unique(item);
@@ -500,7 +561,7 @@ function embeddedDer(schema, bytes, ctx, opts) {
   }
   var node;
   try {
-    node = asn1.decode(bytes, opts.ber ? { ber: true } : undefined);
+    node = decodeNested(bytes, ctx, opts.what || "embedded DER", { ber: !!opts.ber });
   } catch (e) {
     throw ctx.E(opts.code, (opts.what || "embedded DER") + " did not decode: " + e.message, e);
   }
@@ -540,7 +601,9 @@ module.exports = {
   bitString: bitString, implicitBitString: implicitBitString, implicitOctetString: implicitOctetString,
   implicitNull: implicitNull, implicitInteger: implicitInteger, implicitBoolean: implicitBoolean,
   any: any, decode: decode, time: time,
-  walk: walk, encode: encode, embeddedDer: embeddedDer, assertMinimalNamedBits: assertMinimalNamedBits,
+  walk: walk, encode: encode, embeddedDer: embeddedDer, decodeNested: decodeNested,
+  isResourceRefusal: isResourceRefusal, withResources: withResources,
+  assertMinimalNamedBits: assertMinimalNamedBits,
   isUniversal: isUniversal, isContext: isContext,
   isUniversalOneOf: isUniversalOneOf, isContextOneOf: isContextOneOf, isContextInRange: isContextInRange,
 };