@blamejs/pki 0.8.2 → 0.8.4

package/lib/schema-ocsp.js

@@ -98,9 +98,9 @@ function _rawSignature(field) {
 var CERTS = schema.seqOf(certificateBytes(), { assert: "sequence", code: "ocsp/bad-certs", what: "certs", max: constants.LIMITS.OCSP_MAX_CERTS, maxCode: "ocsp/too-many-certs" });
 
 /** @internal RFC 6960 sec. 4.4.4: ArchiveCutoff ::= GeneralizedTime, carried as a singleExtension. */
-function _readArchiveCutoff(ext) {
+function _readArchiveCutoff(ext, ctx) {
   var node;
-  try { node = asn1.decode(ext.value); }
+  try { node = pkix.decodeNested(ext.value, ctx, "an archiveCutoff extension value"); }
   catch (e) { throw NS.E("ocsp/bad-archive-cutoff", "the archiveCutoff extension value did not decode: " + ((e && e.message) || _String(e)), e); }
   if (!(node.tagClass === "universal" && node.tagNumber === asn1.TAGS.GENERALIZED_TIME)) {
     throw NS.E("ocsp/bad-archive-cutoff", "the archiveCutoff extension value must be a GeneralizedTime (RFC 6960 sec. 4.4.4)");
@@ -112,10 +112,10 @@ function _readArchiveCutoff(ext) {
 /** @internal RFC 6960 sec. 4.4.2: CrlID ::= SEQUENCE { crlUrl [0] EXPLICIT IA5String OPTIONAL,
  *  crlNum [1] EXPLICIT INTEGER OPTIONAL, crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }. Every
  *  field is optional and each may appear at most once, in tag order. */
-function _readCrlId(ext) {
+function _readCrlId(ext, ctx) {
   var C = "ocsp/bad-crl-id";
   var node;
-  try { node = asn1.decode(ext.value); }
+  try { node = pkix.decodeNested(ext.value, ctx, "a crlID extension value"); }
   catch (e) { throw NS.E(C, "the CRL references extension value did not decode: " + ((e && e.message) || _String(e)), e); }
   if (!(node.tagClass === "universal" && node.tagNumber === asn1.TAGS.SEQUENCE && node.children)) {
     throw NS.E(C, "CrlID must be a SEQUENCE (RFC 6960 sec. 4.4.2)");
@@ -154,15 +154,15 @@ function _readCrlId(ext) {
 /** @internal The extensions this profile reads are decoded onto their entry beside the raw value,
  *  so a consumer gets the value by name and a malformed one is refused here rather than passed
  *  through as opaque bytes. The nonce is RFC 9654; the other two are RFC 6960 sec. 4.4. */
-function _validateOcspExtensions(list) {
+function _validateOcspExtensions(list, ctx) {
   if (!list) return list;
   for (var i = 0; i < list.length; i++) {
     var ext = list[i];
-    if (ext.oid === OID_OCSP_ARCHIVE_CUTOFF) { ext.archiveCutoff = _readArchiveCutoff(ext); continue; }
-    if (ext.oid === OID_OCSP_CRL) { ext.crlReferences = _readCrlId(ext); continue; }
+    if (ext.oid === OID_OCSP_ARCHIVE_CUTOFF) { ext.archiveCutoff = _readArchiveCutoff(ext, ctx); continue; }
+    if (ext.oid === OID_OCSP_CRL) { ext.crlReferences = _readCrlId(ext, ctx); continue; }
     if (ext.oid !== OID_OCSP_NONCE) continue;
     var node;
-    try { node = asn1.decode(ext.value); }
+    try { node = pkix.decodeNested(ext.value, ctx, "a nonce extension value"); }
     catch (e) { throw NS.E("ocsp/bad-nonce", "the nonce extension value did not decode: " + ((e && e.message) || String(e)), e); }
     if (!(node.tagClass === "universal" && node.tagNumber === asn1.TAGS.OCTET_STRING && node.content)) {
       throw NS.E("ocsp/bad-nonce", "the nonce extension value must be an OCTET STRING (RFC 9654 sec. 2.1)");
@@ -244,13 +244,13 @@ var SINGLE_RESPONSE = schema.seq([
   ], { minTag: 0, maxTag: 1, unexpectedCode: "ocsp/bad-single-response", orderCode: "ocsp/bad-single-response" }),
 ], {
   assert: "sequence", code: "ocsp/bad-single-response", what: "SingleResponse",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       certID: m.fields.certID.value.result,
       certStatus: _shapeCertStatus(m.fields.certStatus),
       thisUpdate: m.fields.thisUpdate.value,
       nextUpdate: m.fields.nextUpdate.present ? m.fields.nextUpdate.value : null,
-      singleExtensions: m.fields.singleExtensions.present ? _validateOcspExtensions(m.fields.singleExtensions.value.result) : null,
+      singleExtensions: m.fields.singleExtensions.present ? _validateOcspExtensions(m.fields.singleExtensions.value.result, ctx) : null,
     };
   },
 });
@@ -277,13 +277,13 @@ var RESPONSE_DATA = schema.seq([
   ], { minTag: 1, maxTag: 1, unexpectedCode: "ocsp/bad-response-data", orderCode: "ocsp/bad-response-data" }),
 ], {
   assert: "sequence", code: "ocsp/bad-response-data", what: "ResponseData",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       version: m.fields.version.value,
       responderID: _shapeResponderID(m.fields.responderID),
       producedAt: m.fields.producedAt.value,
       responses: m.fields.responses.value.items.map(function (it) { return it.value.result; }),
-      responseExtensions: m.fields.responseExtensions.present ? _validateOcspExtensions(m.fields.responseExtensions.value.result) : null,
+      responseExtensions: m.fields.responseExtensions.present ? _validateOcspExtensions(m.fields.responseExtensions.value.result, ctx) : null,
     };
   },
 });
@@ -362,10 +362,10 @@ var REQUEST = schema.seq([
   ], { minTag: 0, maxTag: 0, unexpectedCode: "ocsp/bad-request", orderCode: "ocsp/bad-request" }),
 ], {
   assert: "sequence", code: "ocsp/bad-request", what: "Request",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       certID: m.fields.reqCert.value.result,
-      singleRequestExtensions: m.fields.singleRequestExtensions.present ? _validateOcspExtensions(m.fields.singleRequestExtensions.value.result) : null,
+      singleRequestExtensions: m.fields.singleRequestExtensions.present ? _validateOcspExtensions(m.fields.singleRequestExtensions.value.result, ctx) : null,
     };
   },
 });
@@ -396,13 +396,13 @@ var TBS_REQUEST = schema.seq([
   ], { minTag: 2, maxTag: 2, unexpectedCode: "ocsp/bad-tbs-request", orderCode: "ocsp/bad-tbs-request" }),
 ], {
   assert: "sequence", code: "ocsp/bad-tbs-request", what: "TBSRequest",
-  build: function (m) {
+  build: function (m, ctx) {
     var rn = m.fields.requestorName;
     return {
       version: m.fields.version.value,
       requestorName: rn.present ? { bytes: rn.value.bytes, tagClass: rn.value.tagClass, tagNumber: rn.value.tagNumber, value: rn.value.value } : null,
       requestList: m.fields.requestList.value.items.map(function (it) { return it.value.result; }),
-      requestExtensions: m.fields.requestExtensions.present ? _validateOcspExtensions(m.fields.requestExtensions.value.result) : null,
+      requestExtensions: m.fields.requestExtensions.present ? _validateOcspExtensions(m.fields.requestExtensions.value.result, ctx) : null,
     };
   },
 });
@@ -431,7 +431,7 @@ var OCSP_REQUEST = schema.seq([
 
 /**
  * @primitive  pki.schema.ocsp.parseRequest
- * @signature  pki.schema.ocsp.parseRequest(input) -> ocspRequest
+ * @signature  pki.schema.ocsp.parseRequest(input, caps?) -> ocspRequest
  * @since      0.1.11
  * @status     stable
  * @spec       RFC 6960
@@ -458,12 +458,17 @@ var OCSP_REQUEST = schema.seq([
  *   var der = await pki.ocsp.buildRequest({ cert: leafDer, issuer: caDer }, {});
  *   var req = pki.schema.ocsp.parseRequest(der);
  *   req.requestList[0].certID.serialNumberHex;   // -> "1332"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseRequest = pkix.makeParser({ pemLabel: "OCSP REQUEST", PemError: PemError, ErrorClass: OcspError, prefix: "ocsp", what: "OCSP request", topSchema: OCSP_REQUEST, ns: NS });
 
 /**
  * @primitive  pki.schema.ocsp.parseResponse
- * @signature  pki.schema.ocsp.parseResponse(input) -> ocspResponse
+ * @signature  pki.schema.ocsp.parseResponse(input, caps?) -> ocspResponse
  * @since      0.1.11
  * @status     stable
  * @spec       RFC 6960
@@ -495,6 +500,11 @@ var parseRequest = pkix.makeParser({ pemLabel: "OCSP REQUEST", PemError: PemErro
  *   var res = pki.schema.ocsp.parseResponse(der);
  *   res.responseStatus.name;                       // -> "successful"
  *   res.basicResponse.responses[0].certStatus.type; // -> "good" | "revoked" | "unknown"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseResponse = pkix.makeRecordingParser({ pemLabel: "OCSP RESPONSE", PemError: PemError, ErrorClass: OcspError, prefix: "ocsp", what: "OCSP response", topSchema: OCSP_RESPONSE, ns: NS }, "ocspResponse");
 
@@ -582,6 +592,7 @@ module.exports = {
    *  reads. Throws the parser's own ocsp/* code for a malformed entry. */
   readSingleExtensionsDer: function (derList) {
     var node;
+    // allow:bare-decode reached from the signer, not from a parse, so no parse context carries caps here.
     try { node = asn1.decode(asn1.build.sequence(intrinsic.map(derList, function (d) { return asn1.build.raw(d); }))); }
     catch (e) { throw NS.E("ocsp/bad-single-response", "a pre-encoded singleExtension is not DER", e); }
     return _validateOcspExtensions(schema.walk(EXTENSIONS, node, NS).result);

package/lib/schema-pkcs12.js

@@ -188,7 +188,8 @@ var SAFE_BAG = schema.seq([
         }
         if (a.type === OID_LOCAL_KEY_ID) {
           if (seen[a.type] || a.values.length !== 1) throw ctx.E("pkcs12/bad-local-key-id", "localKeyId carries exactly one OCTET STRING value (PKCS#9 SINGLE VALUE)");
-          localKeyId = _octetContent(asn1.decode(a.values[0], { ber: true }), ctx, "a localKeyId value", "pkcs12/bad-local-key-id");
+          localKeyId = _octetContent(pkix.decodeNested(a.values[0], ctx, "a localKeyId value", { ber: true }), ctx,
+            "a localKeyId value", "pkcs12/bad-local-key-id");
         }
         seen[a.type] = true;
       }
@@ -255,7 +256,7 @@ var PFX = schema.seq([
     }
     if (authSafe.contentType === OID_SIGNED_DATA) {
       if (macPresent) throw ctx.E("pkcs12/bad-integrity-mode", "an id-signedData authSafe (public-key integrity) must omit macData (RFC 7292 sec. 4)");
-      var signed = cms.walkSignedData(authSafe.innerNode);
+      var signed = cms.walkSignedData(authSafe.innerNode, ctx);
       if (signed.encapContentInfo.eContentType !== OID_DATA) {
         throw ctx.E("pkcs12/bad-authsafe", "a public-key-integrity authSafe must encapsulate id-data carrying the AuthenticatedSafe (RFC 7292 sec. 4.1)");
       }
@@ -296,7 +297,7 @@ function _privacySafe(content, ctx) {
 }
 
 function _bmpValue(bytes, ctx) {
-  var node = asn1.decode(bytes, { ber: true });
+  var node = pkix.decodeNested(bytes, ctx, "a friendlyName value", { ber: true });
   if (!(node.tagClass === "universal" && node.tagNumber === TAGS.BMP_STRING)) {
     throw ctx.E("pkcs12/bad-friendly-name", "a friendlyName value must be a BMPString (RFC 7292 sec. 4.2)");
   }
@@ -310,12 +311,15 @@ function _walkAuthenticatedSafe(bytes, state, ctx) {
   });
 }
 
-// @internal
-function walkSafeContents(der) {
-  var walked = schema.walk(SAFE_CONTENTS, asn1.decode(der, { ber: true }), NS);
+/** @internal Reads a decrypted SafeContents. `ctx` is the parse context of the door that produced
+ *  the bytes when there is one, so its caps and budget reach the bags; the decrypt path in
+ *  pki.pkcs12.open has none and takes the built-in ceilings. */
+function walkSafeContents(der, ctx) {
+  var ns = schema.withResources(NS, ctx);
+  var walked = schema.walk(SAFE_CONTENTS, pkix.decodeNested(der, ns, "a SafeContents", { ber: true }), ns);
   var state = { budget: { remaining: C.LIMITS.PKCS12_MAX_REDECODES }, bagDepth: 0 };
   var bags = [];
-  for (var i = 0; i < walked.items.length; i++) bags.push(_buildBag(walked.items[i].value.result, state, NS));
+  for (var i = 0; i < walked.items.length; i++) bags.push(_buildBag(walked.items[i].value.result, state, ns));
   return bags;
 }
 
@@ -333,9 +337,9 @@ function _dispatchSafes(asMatch, state, ctx) {
         safeBags.push(_buildBag(contents.items[j].value.result, state, ctx));
       }
     } else if (el.contentType === OID_ENCRYPTED_DATA) {
-      encryptedSafes.push({ type: "encryptedData", content: _privacySafe(cms.walkEncryptedData(el.innerNode), ctx) });
+      encryptedSafes.push({ type: "encryptedData", content: _privacySafe(cms.walkEncryptedData(el.innerNode, ctx), ctx) });
     } else if (el.contentType === OID_ENVELOPED_DATA) {
-      encryptedSafes.push({ type: "envelopedData", content: _privacySafe(cms.walkEnvelopedData(el.innerNode), ctx), envelopedDataDer: el.innerNode.bytes });
+      encryptedSafes.push({ type: "envelopedData", content: _privacySafe(cms.walkEnvelopedData(el.innerNode, ctx), ctx), envelopedDataDer: el.innerNode.bytes });
     } else {
       throw ctx.E("pkcs12/bad-safe-contentinfo-type", "an AuthenticatedSafe element must be id-data, id-encryptedData, or id-envelopedData (RFC 7292 sec. 4.1), got " +
         (ctx.oid.name(el.contentType) || el.contentType));
@@ -351,13 +355,13 @@ function _buildBag(rec, state, ctx) {
   };
   if (rec.bagId === OID_KEY_BAG) {
     bag.type = "keyBag";
-    bag.key = pkcs8.walkPrivateKeyInfo(rec.valueNode);
+    bag.key = pkcs8.walkPrivateKeyInfo(rec.valueNode, ctx);
     bag.keyDer = rec.valueNode.bytes;
     return bag;
   }
   if (rec.bagId === OID_SHROUDED_KEY_BAG) {
     bag.type = "pkcs8ShroudedKeyBag";
-    bag.encrypted = pkcs8.walkEncryptedPrivateKeyInfo(rec.valueNode);
+    bag.encrypted = pkcs8.walkEncryptedPrivateKeyInfo(rec.valueNode, ctx);
     return bag;
   }
   if (rec.bagId === OID_CERT_BAG) {
@@ -396,7 +400,7 @@ function _buildBag(rec, state, ctx) {
 
 /**
  * @primitive  pki.schema.pkcs12.parse
- * @signature  pki.schema.pkcs12.parse(input) -> pfx
+ * @signature  pki.schema.pkcs12.parse(input, caps?) -> pfx
  * @since      0.1.18
  * @status     stable
  * @spec       RFC 7292, RFC 9579
@@ -441,6 +445,11 @@ function _buildBag(rec, state, ctx) {
  *   var der = await pki.pkcs12.build({ key: key, cert: cert }, { password: "changeit" });
  *   var store = pki.schema.pkcs12.parse(der);
  *   store.safeBags.map(function (b) { return b.type; });
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({
   pemLabel: "PKCS12", PemError: PemError, ErrorClass: Pkcs12Error,

package/lib/schema-pkcs8.js

@@ -88,7 +88,7 @@ var ENCRYPTED_PRIVATE_KEY_INFO = schema.seq([
 
 /**
  * @primitive  pki.schema.pkcs8.parse
- * @signature  pki.schema.pkcs8.parse(input) -> privateKey
+ * @signature  pki.schema.pkcs8.parse(input, caps?) -> privateKey
  * @since      0.1.9
  * @status     stable
  * @spec       RFC 5208, RFC 5958
@@ -107,12 +107,17 @@ var ENCRYPTED_PRIVATE_KEY_INFO = schema.seq([
  *   var key = pki.schema.pkcs8.parse(der);
  *   key.privateKeyAlgorithm.oid;   // -> "1.3.101.112" (Ed25519)
  *   key.privateKey;                // -> Buffer (the inner key encoding)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeParser({ pemLabel: "PRIVATE KEY", PemError: PemError, ErrorClass: Pkcs8Error, prefix: "pkcs8", what: "private key", topSchema: PRIVATE_KEY_INFO, ns: NS });
 
 /**
  * @primitive  pki.schema.pkcs8.parseEncrypted
- * @signature  pki.schema.pkcs8.parseEncrypted(input) -> encrypted
+ * @signature  pki.schema.pkcs8.parseEncrypted(input, caps?) -> encrypted
  * @since      0.1.9
  * @status     stable
  * @spec       RFC 5958, RFC 5208
@@ -128,6 +133,11 @@ var parse = pkix.makeParser({ pemLabel: "PRIVATE KEY", PemError: PemError, Error
  *   var der = await pki.key.encrypt(await pki.key.export(pair.privateKey), "s3cr3t");
  *   var enc = pki.schema.pkcs8.parseEncrypted(der);
  *   enc.encryptionAlgorithm.oid;   // -> "1.2.840.113549.1.5.13" (PBES2)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseEncrypted = pkix.makeParser({ pemLabel: "ENCRYPTED PRIVATE KEY", PemError: PemError, ErrorClass: Pkcs8Error, prefix: "pkcs8", what: "encrypted private key", topSchema: ENCRYPTED_PRIVATE_KEY_INFO, ns: NS });
 
@@ -183,8 +193,15 @@ function matches(root) {
 }
 
 
-function walkPrivateKeyInfo(node) { return schema.walk(PRIVATE_KEY_INFO, node, NS).result; }
-function walkEncryptedPrivateKeyInfo(node) { return schema.walk(ENCRYPTED_PRIVATE_KEY_INFO, node, NS).result; }
+/** @internal `ctx` is the walk context of the parse that reached this key, when another format
+ *  carries it. Only its caps and budget cross over: the key is still read in this namespace, so a
+ *  fault in it keeps the PKCS#8 error class and code. */
+function walkPrivateKeyInfo(node, ctx) {
+  return schema.walk(PRIVATE_KEY_INFO, node, schema.withResources(NS, ctx)).result;
+}
+function walkEncryptedPrivateKeyInfo(node, ctx) {
+  return schema.walk(ENCRYPTED_PRIVATE_KEY_INFO, node, schema.withResources(NS, ctx)).result;
+}
 
 module.exports = {
   parse: parse,

package/lib/schema-pkix.js

@@ -219,15 +219,174 @@ function _isPemArmor(buf) {
   return true;
 }
 
-function decodeRoot(der, opts) {
-  try { return asn1.decode(der, opts.ber ? { ber: true } : undefined); }
+/** @internal The codec's resource refusals, as distinct from its malformed-input refusals. A
+ *  caller who tightened a cap has to be able to tell "your bytes are wrong" from "your cap is
+ *  too small", and only the second is answered by raising the cap. */
+var _isResourceRefusal = schema.isResourceRefusal;
+
+function decodeRoot(der, opts, caps, budget) {
+  // allow:bare-decode the root decode a door performs, which is where the caller's caps enter.
+  try { return asn1.decode(der, _decodeOptions(opts, caps)); }
   catch (e) {
+    /** @internal `rawDecodeErrors` keeps the codec's own code for a malformed body, which some
+     *  callers pin. A resource refusal is still translated, that code being new. */
+    if (opts.rawDecodeErrors && !_isResourceRefusal(e)) throw e;
+    if (_isResourceRefusal(e)) {
+      if (budget) {
+        try {
+          budget.trip(opts.what || "the input");
+        } catch (_b) {
+          /* allow:swallow-unverified the latch is the point here; the refusal below carries the cause */
+        }
+      }
+      throw new opts.ErrorClass(opts.prefix + "/too-large",
+        (opts.what || "the input") + " exceeds the decode budget for this parse: " + (e.message || _String(e)), e);
+    }
     throw new opts.ErrorClass(opts.prefix + "/bad-der", (opts.what || "input") + " DER did not decode: " + ((e && e.message) || _String(e)), e);
   }
 }
 
-function runParse(input, opts) {
-  return schema.walk(opts.topSchema, decodeRoot(coerceToDer(input, opts), opts), opts.ns).result;
+/** @internal A fresh options object per decode. The strictness a format declares and the caps
+ *  a caller asked for are combined here and nowhere else, so neither can be written onto the
+ *  other's object and outlive this call. */
+function _decodeOptions(opts, caps) {
+  if (!caps) return opts.ber ? { ber: true } : undefined;
+  var out = { maxBytes: caps.maxBytes, maxDepth: caps.maxDepth, maxItems: caps.maxItems };
+  if (opts.ber) out.ber = true;
+  return out;
+}
+
+/** @internal The decode caps a caller may name, each paired with the `C.LIMITS` default that
+ *  is also its ceiling. A cap may tighten and may not loosen: the defaults are the resource
+ *  the toolkit is willing to spend, and a caller raising one past them would be granting
+ *  themselves more than the built-in refusal allows. */
+var PARSE_CAPS = intrinsic.assign(intrinsic.create(null), {
+  maxBytes: "DER_MAX_BYTES",
+  maxDepth: "DER_MAX_DEPTH",
+  maxItems: "DER_MAX_ITEMS",
+});
+
+/** @internal A format that reads something other than DER declares its own ceilings through
+ *  `opts.capLimits`, so the bound a caller is held to is the one their parser actually uses. */
+var CBOR_PARSE_CAPS = intrinsic.assign(intrinsic.create(null), {
+  maxBytes: "CBOR_MAX_BYTES",
+  maxDepth: "CBOR_MAX_DEPTH",
+  maxItems: "CBOR_MAX_ITEMS",
+});
+
+var CBOR_RESOURCE_REFUSALS = intrinsic.assign(intrinsic.create(null), {
+  "cbor/too-large": 1, "cbor/too-deep": 1, "cbor/too-many-items": 1,
+});
+
+function isCborResourceRefusal(e) {
+  return !!(e && typeof e.code === "string" && CBOR_RESOURCE_REFUSALS[e.code] === 1);
+}
+
+function cborParseOpts(ErrorClass, prefix, what) {
+  var out = intrinsic.create(null);
+  out.ErrorClass = ErrorClass;
+  out.prefix = prefix;
+  out.what = what;
+  out.capLimits = CBOR_PARSE_CAPS;
+  return out;
+}
+
+/** @internal A parser door's options, held on a prototype-less object so a computed lookup on
+ *  it answers from what the format declared. Every hand-rolled door builds its options here
+ *  rather than as a literal in its own module. */
+function parseOpts(spec) {
+  var out = intrinsic.create(null);
+  _forEach(intrinsic.keys(spec), function (k) { out[k] = spec[k]; });
+  return out;
+}
+
+/** @internal Reads the caller's caps into a FRESH object. Nothing is written back onto what
+ *  the caller passed, and nothing else is ever written onto the returned one, so a resource
+ *  option cannot become a strictness flag on a shared object. */
+function parseCaps(callerOpts, opts) {
+  var E = function (message) { return new opts.ErrorClass(opts.prefix + "/bad-input", message); };
+  if (callerOpts === undefined || callerOpts === null) callerOpts = _emptyOptions;
+  if (typeof callerOpts !== "object" || intrinsic.isArray(callerOpts) || guard.bytes.isByteSource(callerOpts)) {
+    throw E("parse options must be an object of decode caps");
+  }
+  var capLimits = opts.capLimits || PARSE_CAPS;
+  guard.identifier.assertKnownKeys(callerOpts, capLimits,
+    function (code, message) { return new opts.ErrorClass(code, message); },
+    opts.prefix + "/bad-input", "parse does not take the option ");
+  var caps = intrinsic.create(null);
+  _forEach(intrinsic.keys(capLimits), function (key) {
+    var ceiling = constants.LIMITS[capLimits[key]];
+    var asked = callerOpts[key];
+    if (asked === undefined) { caps[key] = ceiling; return; }
+    if (!intrinsic.isInteger(asked) || asked < 0) {
+      throw E(key + " must be a non-negative integer no greater than " + ceiling);
+    }
+    if (asked > ceiling) {
+      throw E(key + " " + asked + " is above the built-in ceiling " + ceiling + "; a cap may only tighten");
+    }
+    caps[key] = asked;
+  });
+  return caps;
+}
+var _emptyOptions = intrinsic.freeze(intrinsic.create(null));
+
+/** @internal The door every format parser opens, whether it composes the shared factory or
+ *  hand-rolls its walk. `build(rootNode, ns)` does the format's own work; everything around it
+ *  is the part that must not be re-implemented per parser, because each re-implementation is
+ *  another place the caller's caps can go missing or the latch can go unread. */
+function runParseWith(input, opts, callerOpts, build) {
+  var caps = parseCaps(callerOpts, opts);
+  var budget = guard.limits.budget({ maxBytes: caps.maxBytes });
+  var ns = _nsWithBudget(opts.ns, budget, caps);
+  var result;
+  try {
+    result = build(decodeRoot(coerceToDer(input, opts), opts, caps, budget), ns, caps, budget);
+  } catch (e) {
+    if (guard.limits.isBudgetExceeded(e)) throw _budgetRefusal(opts, e);
+    /** @internal A refusal that is already this door's own resource verdict has been translated
+     *  once and carries the codec's refusal as its cause; wrapping it again would put a copy of
+     *  the verdict where a caller looks for the cap that was exceeded. */
+    if (budget.exhausted() && !(e && e.code === opts.prefix + "/too-large")) {
+      throw _budgetRefusal(opts, e);
+    }
+    throw e;
+  }
+  if (budget.exhausted()) throw _budgetRefusal(opts, null);
+  return result;
+}
+
+function runParse(input, opts, callerOpts) {
+  return runParseWith(input, opts, callerOpts, function (root, ns) {
+    return schema.walk(opts.topSchema, root, ns).result;
+  });
+}
+
+/** @internal The re-read at the door is what makes the latch worth having: a catch anywhere
+ *  under the walk may absorb the exception or rewrap it as a domain error, and this still
+ *  refuses. The rewrapped error is carried as the cause. */
+function _budgetRefusal(opts, cause) {
+  return new opts.ErrorClass(opts.prefix + "/too-large",
+    (opts.what || "the input") + " exceeds the decode budget for this parse", cause || undefined);
+}
+
+function _nsWithBudget(ns, budget, caps) {
+  return schema.withResources(ns, { budget: budget, caps: caps });
+}
+
+/** @internal The walk context a hand-rolled door builds for the structures it reads out of its
+ *  own input, so the caller's caps reach them the way `runParseWith` makes them reach a factory
+ *  parser's. The door re-reads `budget.exhausted()` before it returns a result. */
+function nestedContext(ns, caps) {
+  var budget = guard.limits.budget({ maxBytes: caps.maxBytes });
+  return { ns: _nsWithBudget(ns, budget, caps), budget: budget };
+}
+
+/** @internal The decode a format performs on a value it has already read out of its input: an
+ *  embedded OCTET STRING payload, an encapsulated protocol body. The engine owns it, because
+ *  `schema.embeddedDer` performs the same decode from inside a walk and the two must apply the
+ *  caller's caps and trip the parse budget the same way. This is the name format modules call. */
+function decodeNested(bytes, ctx, label, opts) {
+  return schema.decodeNested(bytes, ctx, label, opts);
 }
 
 var DN_SHORT = constants.NAMES.DN_SHORT;
@@ -349,6 +508,7 @@ function attrValueToString(ns) {
         throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must be a non-empty even run of hex digits (RFC 4514 sec. 2.4)");
       }
       var raw = guard.encoding.hex(hex, null, ns.E, ns.prefix + "/bad-atv", "a #hex attribute value");
+      // allow:bare-decode the encoder side, checking bytes a caller wrote by hand, outside any parse.
       try { asn1.decode(raw); }
       catch (e) { throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must encode exactly one DER TLV", e); }
       return raw;
@@ -686,7 +846,7 @@ function decodeIssuingDistributionPointValue(ns, bytes, code) {
     indirect: false, onlyAttr: false, fields: null };
   var m;
   try {
-    m = schema.walk(issuingDistributionPoint(code), asn1.decode(bytes), ns);
+    m = schema.walk(issuingDistributionPoint(code), schema.decodeNested(bytes, ns, "an IssuingDistributionPoint value"), ns);
     if (m.fields.distributionPoint.present) {
       var wrap = m.fields.distributionPoint.node;
       if (!wrap.children || wrap.children.length !== 1) {
@@ -788,15 +948,20 @@ function userNoticeTexts(qualifier) {
   return i === kids.length ? out : [];
 }
 
+/** @internal The readers an extension or attribute value is decoded through. `ctx` is the walk
+ *  context of the parse that reached the value, when one did: the bytes here are an OCTET STRING
+ *  payload the root decode stopped at, so this decode restarts depth and item counting and needs
+ *  the caller's caps handed to it. A caller outside a parse passes none and takes the built-in
+ *  ceilings, which is what `ns` carries. */
 function _decodeHelpers(ns) {
-  function decodeTop(buf, code, what) {
+  function decodeTop(buf, code, what, ctx) {
     var n;
-    try { n = asn1.decode(buf); }
+    try { n = schema.decodeNested(buf, ctx || ns, what); }
     catch (e) { throw ns.E(code, "malformed " + what + " value: " + ((e && e.message) || _String(e)), e); }
     return n;
   }
-  function seqChildren(buf, code, what) {
-    var n = decodeTop(buf, code, what);
+  function seqChildren(buf, code, what, ctx) {
+    var n = decodeTop(buf, code, what, ctx);
     if (n.tagClass !== "universal" || n.tagNumber !== _T.SEQUENCE || !n.children) {
       throw ns.E(code, what + " must be a SEQUENCE (RFC 5280 sec. 4.2.1)");
     }
@@ -1356,7 +1521,7 @@ function rootSequenceChildren(root, minLen, maxLen) {
 }
 
 function makeParser(opts) {
-  return function (input) { return runParse(input, opts); };
+  return function (input, callerOpts) { return runParse(input, opts, callerOpts); };
 }
 
 function makeRecordingParser(opts, kind) {
@@ -1430,6 +1595,14 @@ module.exports = {
   isPemArmor: _isPemArmor,
   decodeRoot: decodeRoot,
   runParse: runParse,
+  runParseWith: runParseWith,
+  parseCaps: parseCaps,
+  CBOR_PARSE_CAPS: CBOR_PARSE_CAPS,
+  isCborResourceRefusal: isCborResourceRefusal,
+  cborParseOpts: cborParseOpts,
+  parseOpts: parseOpts,
+  decodeNested: decodeNested,
+  nestedContext: nestedContext,
   makeNS: makeNS,
   versionReader: versionReader,
   DN_SHORT: DN_SHORT,

package/lib/schema-smime.js

@@ -187,7 +187,7 @@ var SMIME_CAPABILITIES = schema.seqOf(SMIME_CAPABILITY, {
 
 /**
  * @primitive  pki.schema.smime.parseSigningCertificate
- * @signature  pki.schema.smime.parseSigningCertificate(der) -> { certs, policies }
+ * @signature  pki.schema.smime.parseSigningCertificate(der, caps?) -> { certs, policies }
  * @since      0.1.22
  * @status     stable
  * @spec       RFC 5035, RFC 2634
@@ -207,6 +207,11 @@ var SMIME_CAPABILITIES = schema.seqOf(SMIME_CAPABILITY, {
  *   var av = b.sequence([b.sequence([essCertId])]);                     // SigningCertificate { certs }
  *   var sc = pki.schema.smime.parseSigningCertificate(av);
  *   sc.certs[0].hashAlgorithm.name;    // "sha1" (implied)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseSigningCertificate = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: SmimeError, prefix: "smime", what: "SigningCertificate", topSchema: SIGNING_CERTIFICATE, ns: NS });
 
@@ -236,7 +241,7 @@ var parseSigningCertificateV2 = pkix.makeParser({ pemLabel: null, PemError: PemE
 
 /**
  * @primitive  pki.schema.smime.parseSmimeCapabilities
- * @signature  pki.schema.smime.parseSmimeCapabilities(der) -> { capabilities }
+ * @signature  pki.schema.smime.parseSmimeCapabilities(der, caps?) -> { capabilities }
  * @since      0.1.22
  * @status     stable
  * @spec       RFC 8551
@@ -253,6 +258,11 @@ var parseSigningCertificateV2 = pkix.makeParser({ pemLabel: null, PemError: PemE
  *   var cap = b.sequence([b.oid(pki.oid.byName("aes256-CBC"))]);
  *   var caps = pki.schema.smime.parseSmimeCapabilities(b.sequence([cap]));
  *   caps.capabilities[0].name;    // "aes256-CBC"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseSmimeCapabilities = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: SmimeError, prefix: "smime", what: "SMIMECapabilities", topSchema: SMIME_CAPABILITIES, ns: NS });