@blamejs/pki 0.8.2 → 0.8.4

package/lib/schema-tsp.js

@@ -46,6 +46,8 @@ var PemError = frameworkError.PemError;
 
 var NS = pkix.makeNS("tsp", TspError, oid);
 
+var _TOKEN_PARSE_OPTS = pkix.parseOpts({ ErrorClass: TspError, prefix: "tsp", what: "the timeStampToken" });
+
 var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
 var EXTENSION = pkix.extension(NS);
 
@@ -202,7 +204,7 @@ var TIME_STAMP_RESP = schema.seq([
   schema.optional("timeStampToken", schema.any(), { whenUniversal: [TAGS.SEQUENCE] }),
 ], {
   assert: "sequence", arity: { min: 1 }, code: "tsp/bad-response", what: "TimeStampResp",
-  build: function (m) {
+  build: function (m, ctx) {
     var status = m.fields.status.value.result;
     var present = m.fields.timeStampToken.present;
     var granted = status.status === 0 || status.status === 1;
@@ -213,7 +215,9 @@ var TIME_STAMP_RESP = schema.seq([
       status: status.status,
       statusString: status.statusString,
       failInfo: status.failInfo,
-      timeStampToken: present ? parseToken(m.fields.timeStampToken.value.bytes) : null,
+      /** @internal The token is a second parse of bytes carried inside this one, so it takes the
+       *  caps this door was given rather than the built-in ceilings. */
+      timeStampToken: present ? parseToken(m.fields.timeStampToken.value.bytes, ctx ? ctx.caps : undefined) : null,
     };
   },
 });
@@ -250,7 +254,7 @@ var TIME_STAMP_REQ = schema.seq([
 
 /**
  * @primitive  pki.schema.tsp.parseRequest
- * @signature  pki.schema.tsp.parseRequest(input) -> timeStampReq
+ * @signature  pki.schema.tsp.parseRequest(input, caps?) -> timeStampReq
  * @since      0.2.19
  * @status     stable
  * @spec       RFC 3161
@@ -268,12 +272,17 @@ var TIME_STAMP_REQ = schema.seq([
  *   var req = pki.schema.tsp.parseRequest(der);
  *   req.certReq;                        // -> boolean
  *   req.messageImprint.hashedMessage;   // -> Buffer (the raw digest)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseRequest = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp", what: "TimeStampReq", topSchema: TIME_STAMP_REQ, ns: NS });
 
 /**
  * @primitive  pki.schema.tsp.parseTstInfo
- * @signature  pki.schema.tsp.parseTstInfo(input) -> tstInfo
+ * @signature  pki.schema.tsp.parseTstInfo(input, caps?) -> tstInfo
  * @since      0.1.13
  * @status     stable
  * @spec       RFC 3161
@@ -299,12 +308,17 @@ var parseRequest = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorCl
  *   var tst = pki.schema.tsp.parseTstInfo(der);
  *   tst.genTime;                       // -> Date
  *   tst.messageImprint.hashedMessage;  // -> Buffer (the raw digest)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseTstInfo = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp", what: "TSTInfo", topSchema: TST_INFO, ns: NS });
 
 /**
  * @primitive  pki.schema.tsp.parse
- * @signature  pki.schema.tsp.parse(input) -> timeStampResp
+ * @signature  pki.schema.tsp.parse(input, caps?) -> timeStampResp
  * @since      0.1.13
  * @status     stable
  * @spec       RFC 3161
@@ -329,12 +343,17 @@ var parseTstInfo = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorCl
  *   var res = pki.schema.tsp.parse(der);
  *   res.status;                              // -> 0 (granted)
  *   res.timeStampToken.tstInfo.genTime;      // -> Date (a granted token is decoded)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp", what: "TimeStampResp", topSchema: TIME_STAMP_RESP, ns: NS });
 
 /**
  * @primitive  pki.schema.tsp.parseToken
- * @signature  pki.schema.tsp.parseToken(input) -> tstInfo
+ * @signature  pki.schema.tsp.parseToken(input, caps?) -> tstInfo
  * @since      0.1.13
  * @status     stable
  * @spec       RFC 3161, RFC 5652
@@ -364,13 +383,28 @@ var parse = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: Ts
  *   var token = pki.schema.tsp.parseToken(tokenDer);
  *   token.tstInfo.genTime;   // -> Date
  *   token.signerInfo.sid;    // -> the TSA signer identifier
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parseToken(input) {
+function parseToken(input, callerOpts) {
+  /** @internal The caller's options are this door's to answer for, so they are read here rather
+   *  than inside the CMS parser: a complaint about an option must not come back wearing the
+   *  delegate's verdict about the content. The snapshot travels onward, because handing the
+   *  caller's own object to the CMS parser would read each cap a second time. */
+  var caps = pkix.parseCaps(callerOpts, _TOKEN_PARSE_OPTS);
   var der = pkix.coerceToDer(input, { pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp" });
   var signed;
-  try { signed = cms.parse(der); }
+  try { signed = cms.parse(der, caps); }
   catch (e) {
     if (e instanceof TspError) throw e;
+    /** @internal A resource refusal says the cap was too small, not that the token is malformed,
+     *  so it keeps that meaning rather than becoming a statement about the bytes. */
+    if (e && typeof e.code === "string" && e.code.indexOf("/too-large") !== -1) {
+      throw new TspError("tsp/too-large", "the timeStampToken exceeds the decode budget for this parse: " + (e.message || ""), e);
+    }
     throw new TspError("tsp/bad-token", "the timeStampToken did not decode as a CMS SignedData: " + ((e && e.message) || String(e)), e);
   }
   if (signed.contentTypeName !== "signedData") {
@@ -392,12 +426,23 @@ function parseToken(input) {
   if (!hasSigningCert) {
     throw new TspError("tsp/missing-signing-certificate", "a TimeStampToken signerInfo must carry a SigningCertificate or SigningCertificateV2 signed attribute (RFC 3161 sec. 2.4.2, RFC 5816)");
   }
+  /** @internal The TSTInfo is decoded out of the eContent the CMS layer handed back, so it is a
+   *  second decode and takes the caller's caps the way the carrier did. The latch is re-read
+   *  below, because the catch here answers in this domain and would otherwise report a cap that
+   *  was too small as a malformed TSTInfo. */
+  var nested = pkix.nestedContext(NS, caps);
   var tstInfo;
-  try { tstInfo = schema.embeddedDer(TST_INFO, encap.eContent, NS, { code: "tsp/bad-der", what: "the encapsulated TSTInfo" }); }
+  try { tstInfo = schema.embeddedDer(TST_INFO, encap.eContent, nested.ns, { code: "tsp/bad-der", what: "the encapsulated TSTInfo" }); }
   catch (e) {
+    if (nested.budget.exhausted()) {
+      throw new TspError("tsp/too-large", "the timeStampToken exceeds the decode budget for this parse", e);
+    }
     if (e instanceof TspError) throw e;
     throw new TspError("tsp/bad-der", "the encapsulated TSTInfo did not decode: " + ((e && e.message) || String(e)), e);
   }
+  if (nested.budget.exhausted()) {
+    throw new TspError("tsp/too-large", "the timeStampToken exceeds the decode budget for this parse");
+  }
   return { tstInfo: tstInfo.result, eContent: encap.eContent, signerInfo: signed.signerInfos[0], certificates: signed.certificates };
 }
 

package/lib/schema-x509.js

@@ -165,7 +165,7 @@ var CERTIFICATE = pkix.signedEnvelope(NS, CERTIFICATE_TBS, {
 
 /**
  * @primitive  pki.schema.x509.parse
- * @signature  pki.schema.x509.parse(input) -> certificate
+ * @signature  pki.schema.x509.parse(input, caps?) -> certificate
  * @since      0.1.7
  * @status     stable
  * @spec       RFC 5280, X.509
@@ -194,6 +194,11 @@ var CERTIFICATE = pkix.signedEnvelope(NS, CERTIFICATE_TBS, {
  *   cert.subject.dn;                 // "CN=example.com, O=Example"
  *   cert.validity.notAfter;          // Date
  *   cert.signatureAlgorithm.name;    // "Ed25519" (the algorithm the issuer signed with)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({ pemLabel: "CERTIFICATE", PemError: PemError, ErrorClass: CertificateError, prefix: "x509", what: "certificate", topSchema: CERTIFICATE, ns: NS }, "certificate");
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b0bab233-a055-413d-8f5b-3ed8a3f7a8c4",
+  "serialNumber": "urn:uuid:ca3c695a-64b2-4346-9529-6a6c719eb6bb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-20T02:50:18.934Z",
+    "timestamp": "2026-09-20T06:26:19.862Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.2",
+      "bom-ref": "@blamejs/pki@0.8.4",
       "type": "application",
       "name": "pki",
-      "version": "0.8.2",
+      "version": "0.8.4",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.2",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.4",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.2",
+      "ref": "@blamejs/pki@0.8.4",
       "dependsOn": []
     }
   ]