@blamejs/pki 0.8.3 → 0.8.5

package/lib/schema-cms.js

@@ -127,7 +127,7 @@ function _checkAttrPlacement(attrs, place) {
   }
 }
 
-function _checkContentBindingAttrs(attrs, mode) {
+function _checkContentBindingAttrs(attrs, mode, ctx) {
   var ct = 0, md = 0, seen = Object.create(null);
   for (var i = 0; i < attrs.length; i++) {
     var a = attrs[i];
@@ -141,16 +141,16 @@ function _checkContentBindingAttrs(attrs, mode) {
       ct += 1;
       if (mode === "countersig") throw NS.E("cms/misplaced-attr", "a countersignature's signedAttrs must not carry a content-type attribute (RFC 5652 sec. 11.4)");
       if (a.values.length !== 1) throw NS.E("cms/bad-content-type-attr", "the content-type attribute must be single-valued");
-      try { asn1.read.oid(asn1.decode(a.values[0])); }
+      try { asn1.read.oid(pkix.decodeNested(a.values[0], ctx, "a content-type attribute value")); }
       catch (e) { throw NS.E("cms/bad-content-type-attr", "the content-type attribute value must be a valid OBJECT IDENTIFIER", e); }
     } else if (a.type === OID_MESSAGE_DIGEST) {
       md += 1;
       if (a.values.length !== 1) throw NS.E("cms/bad-message-digest-attr", "the message-digest attribute must be single-valued");
-      try { asn1.read.octetString(asn1.decode(a.values[0])); }
+      try { asn1.read.octetString(pkix.decodeNested(a.values[0], ctx, "a message-digest attribute value")); }
       catch (e) { throw NS.E("cms/bad-message-digest-attr", "the message-digest attribute value must be an OCTET STRING", e); }
     } else if (a.type === OID_SIGNING_TIME) {
       if (a.values.length !== 1) throw NS.E("cms/bad-signing-time-attr", "the signing-time attribute must be single-valued (RFC 5652 sec. 11.3)");
-      try { asn1.read.time(asn1.decode(a.values[0])); }
+      try { asn1.read.time(pkix.decodeNested(a.values[0], ctx, "a signing-time attribute value")); }
       catch (e) { throw NS.E("cms/bad-signing-time-attr", "the signing-time attribute value must be a Time (RFC 5652 sec. 11.3)", e); }
     }
   }
@@ -187,6 +187,7 @@ function _ascendingDer(nodes) {
 function looksLikeSignedAttributes(bytes) {
   if (!bytes || !bytes.length) return false;
   var node;
+  // allow:bare-decode a shape probe on bytes a caller hands the signer or verifier, outside any parse.
   try { node = asn1.decode(bytes); }
   catch (_e) { return false; }
   if (!schema.isUniversal(node, asn1.TAGS.SET) || !node.constructed) return false;
@@ -225,12 +226,12 @@ function looksLikeSignedAttributes(bytes) {
   return sawContentType && sawMessageDigest;
 }
 
-function _assertContentTypeMatchesAttrs(attrs, eContentType) {
+function _assertContentTypeMatchesAttrs(attrs, eContentType, ctx) {
   for (var i = 0; i < attrs.length; i++) {
     if (attrs[i].type !== OID_CONTENT_TYPE) continue;
     if (attrs[i].values.length !== 1) throw NS.E("cms/bad-content-type-attr", "the content-type attribute must be single-valued (RFC 5652 sec. 11.1)");
     var ctv;
-    try { ctv = asn1.read.oid(asn1.decode(attrs[i].values[0])); }
+    try { ctv = asn1.read.oid(pkix.decodeNested(attrs[i].values[0], ctx, "a content-type attribute value")); }
     catch (e) { throw NS.E("cms/bad-content-type-attr", "the content-type attribute value must be a valid OBJECT IDENTIFIER", e); }
     if (ctv !== eContentType) throw NS.E("cms/content-type-mismatch", "the content-type attribute (" + ctv + ") must equal the eContentType (" + eContentType + ") (RFC 5652 sec. 5.3)");
   }
@@ -244,13 +245,13 @@ function _checkNoDuplicateAttrs(attrs) {
   }
 }
 
-function _validateAeadParams(alg, macLen) {
+function _validateAeadParams(alg, macLen, ctx) {
   var kind = AEAD_ALGS[alg.oid];
   if (!kind) return null;
   var K = kind.toUpperCase();
   if (alg.parameters === null) throw NS.E("cms/bad-aead-params", "an AES-" + K + " content-encryption algorithm MUST carry its parameters (RFC 5084 sec. 3." + (kind === "gcm" ? "2" : "1") + ")");
   var node;
-  try { node = asn1.decode(alg.parameters); }
+  try { node = pkix.decodeNested(alg.parameters, ctx, "AES-" + K + " content-encryption parameters"); }
   catch (e) { throw NS.E("cms/bad-aead-params", "malformed AES-" + K + " parameters", e); }
   if (node.tagClass !== "universal" || node.tagNumber !== T.SEQUENCE || !node.children || node.children.length < 1 || node.children.length > 2) {
     throw NS.E("cms/bad-aead-params", "AES-" + K + " parameters must be a SEQUENCE { aes-nonce, aes-ICVlen DEFAULT 12 } (RFC 5084)");
@@ -275,8 +276,8 @@ function _validateAeadParams(alg, macLen) {
   return { kind: kind, nonce: nonce, icvLen: icvLen };
 }
 
-function _assertDerEncodedAttrs(node, code) {
-  try { asn1.decode(node.bytes); }
+function _assertDerEncodedAttrs(node, code, ctx) {
+  try { pkix.decodeNested(node.bytes, ctx, "an attribute set"); }
   catch (e) { throw NS.E(code, "the attribute set must be DER encoded even inside a BER envelope (RFC 5652 sec. 5.3)", e); }
 }
 
@@ -373,10 +374,10 @@ function makeSignerInfo(mode) {
       }
       var signedAttrs = null, signedAttrsBytes = null;
       if (m.fields.signedAttrs.present) {
-        _assertDerEncodedAttrs(m.fields.signedAttrs.node, "cms/bad-signed-attrs");
+        _assertDerEncodedAttrs(m.fields.signedAttrs.node, "cms/bad-signed-attrs", ctx);
         signedAttrs = m.fields.signedAttrs.value.items.map(function (it) { return it.value.result; });
         _checkAttrPlacement(signedAttrs, "signed");
-        _checkContentBindingAttrs(signedAttrs, mode);
+        _checkContentBindingAttrs(signedAttrs, mode, ctx);
         signedAttrsBytes = m.fields.signedAttrs.node.bytes;
       }
       var unsignedAttrs = null;
@@ -387,7 +388,7 @@ function makeSignerInfo(mode) {
           if (unsignedAttrs[u].type !== OID_COUNTERSIGNATURE) continue;
           for (var v = 0; v < unsignedAttrs[u].values.length; v++) {
             var csNode;
-            try { csNode = asn1.decode(unsignedAttrs[u].values[v]); }
+            try { csNode = pkix.decodeNested(unsignedAttrs[u].values[v], ctx, "a countersignature attribute value"); }
             catch (e) { throw NS.E("cms/bad-countersignature", "a countersignature attribute value must be DER (RFC 5652 sec. 11.4)", e); }
             schema.walk(COUNTERSIGNATURE_SIGNER_INFO, csNode, ctx);
           }
@@ -418,7 +419,7 @@ var SIGNED_DATA = schema.seq([
   schema.field("signerInfos", schema.setOf(SIGNER_INFO, { min: 0, code: "cms/bad-signer-infos", what: "signerInfos" })),
 ], {
   assert: "sequence", code: "cms/bad-signed-data", what: "SignedData",
-  build: function (m) {
+  build: function (m, ctx) {
     var version = m.fields.version.value;
     var encapContentInfo = m.fields.encapContentInfo.value.result;
     var certificates = m.fields.certificates.present ? m.fields.certificates.value.items.map(rawChoiceElement(CERT_CHOICE_TAGS, "cms/bad-certificates", "certificates")) : [];
@@ -432,7 +433,7 @@ var SIGNED_DATA = schema.seq([
     }
 
     for (var si = 0; si < signerInfos.length; si++) {
-      if (signerInfos[si].signedAttrs) _assertContentTypeMatchesAttrs(signerInfos[si].signedAttrs, encapContentInfo.eContentType);
+      if (signerInfos[si].signedAttrs) _assertContentTypeMatchesAttrs(signerInfos[si].signedAttrs, encapContentInfo.eContentType, ctx);
     }
 
     var expected = _expectedSignedDataVersion(certificates, crls, signerInfos, encapContentInfo.eContentType);
@@ -771,7 +772,7 @@ var AUTHENTICATED_DATA = schema.seq([
   schema.optional("unauthAttrs", schema.implicitSetOf(3, ATTRIBUTE, { min: 1, code: "cms/bad-unauth-attrs", what: "unauthAttrs" }), { tag: 3 }),
 ], {
   assert: "sequence", code: "cms/bad-auth-data", what: "AuthenticatedData",
-  build: function (m) {
+  build: function (m, ctx) {
     var version = m.fields.version.value;
     var originatorInfo = m.fields.originatorInfo.present ? m.fields.originatorInfo.value.result : null;
     var encapContentInfo = m.fields.encapContentInfo.value.result;
@@ -789,11 +790,11 @@ var AUTHENTICATED_DATA = schema.seq([
 
     var authAttrs = null, authAttrsBytes = null;
     if (hasAuthAttrs) {
-      _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs");
+      _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs", ctx);
       authAttrs = m.fields.authAttrs.value.items.map(function (it) { return it.value.result; });
       _checkAttrPlacement(authAttrs, "auth");
-      _checkContentBindingAttrs(authAttrs, "content");
-      _assertContentTypeMatchesAttrs(authAttrs, encapContentInfo.eContentType);
+      _checkContentBindingAttrs(authAttrs, "content", ctx);
+      _assertContentTypeMatchesAttrs(authAttrs, encapContentInfo.eContentType, ctx);
       authAttrsBytes = m.fields.authAttrs.node.bytes;
     }
     var unauthAttrs = null;
@@ -826,10 +827,10 @@ var AUTH_ENVELOPED_DATA = schema.seq([
   schema.optional("unauthAttrs", schema.implicitSetOf(2, ATTRIBUTE, { min: 1, code: "cms/bad-unauth-attrs", what: "unauthAttrs" }), { tag: 2 }),
 ], {
   assert: "sequence", code: "cms/bad-auth-enveloped-data", what: "AuthEnvelopedData",
-  build: function (m) {
+  build: function (m, ctx) {
     var encryptedContentInfo = m.fields.authEncryptedContentInfo.value.result;
     var mac = m.fields.mac.value;
-    var aead = _validateAeadParams(encryptedContentInfo.contentEncryptionAlgorithm, mac.length);
+    var aead = _validateAeadParams(encryptedContentInfo.contentEncryptionAlgorithm, mac.length, ctx);
 
     var hasAuthAttrs = m.fields.authAttrs.present;
     if (!hasAuthAttrs && encryptedContentInfo.contentType !== OID_DATA) {
@@ -837,11 +838,11 @@ var AUTH_ENVELOPED_DATA = schema.seq([
     }
     var authAttrs = null, authAttrsBytes = null;
     if (hasAuthAttrs) {
-      _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs");
+      _assertDerEncodedAttrs(m.fields.authAttrs.node, "cms/bad-auth-attrs", ctx);
       authAttrs = m.fields.authAttrs.value.items.map(function (it) { return it.value.result; });
       _checkAttrPlacement(authAttrs, "auth");
       _checkNoDuplicateAttrs(authAttrs);
-      _assertContentTypeMatchesAttrs(authAttrs, encryptedContentInfo.contentType);
+      _assertContentTypeMatchesAttrs(authAttrs, encryptedContentInfo.contentType, ctx);
       authAttrsBytes = m.fields.authAttrs.node.bytes;
     }
     var unauthAttrs = null;
@@ -1030,13 +1031,23 @@ function matches(root) {
   return true;
 }
 
-function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).result; }
+/** @internal `ctx` is the walk context of the parse that reached this structure, when another
+ *  format carries it. Only its caps and budget cross over: a cap the caller named at that
+ *  format's door has to reach this walk, and a fault in this structure is still CMS's to report. */
+function walkEnvelopedData(node, ctx) {
+  return schema.walk(ENVELOPED_DATA, node, schema.withResources(NS, ctx)).result;
+}
 
-var walkSignedData = guard.parsed.recordingWalker("cms", function (node) {
-  return schema.walk(SIGNED_DATA, node, NS).result;
+var walkSignedData = guard.parsed.recordingWalker("cms", function (node, ctx) {
+  return schema.walk(SIGNED_DATA, node, schema.withResources(NS, ctx)).result;
+  // allow:bare-decode the re-decode a recording walker performs on raw DER a caller hands it, outside any parse.
 }, function (der) { return asn1.decode(der, { ber: true }); });
-function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
-function walkCountersignature(node) { return schema.walk(COUNTERSIGNATURE_SIGNER_INFO, node, NS).result; }
+function walkEncryptedData(node, ctx) {
+  return schema.walk(ENCRYPTED_DATA, node, schema.withResources(NS, ctx)).result;
+}
+function walkCountersignature(node, ctx) {
+  return schema.walk(COUNTERSIGNATURE_SIGNER_INFO, node, schema.withResources(NS, ctx)).result;
+}
 
 function assertAttachedCiphertext(eci, E, code, label) {
   if (!eci || eci.encryptedContent === null || eci.encryptedContent.length === 0) {

package/lib/schema-crl.js

@@ -51,20 +51,20 @@ var TIME = pkix.time(NS);
 
 var CRL_VERSION = pkix.versionReader(NS, { "1": 2 });
 
-function decodeExt(ext, scope) {
+function decodeExt(ext, scope, ctx) {
   var value = ext.value;
   var atCrl = scope !== "entry";
   var atEntry = scope !== "crl";
   try {
     if (ext.oid === OID_CRL_NUMBER && atCrl) {
-      value = asn1.read.integer(asn1.decode(ext.value));
+      value = asn1.read.integer(pkix.decodeNested(ext.value, ctx, "a cRLNumber extension value"));
       if (value < 0n) throw new Error("cRLNumber must be non-negative (INTEGER 0..MAX)");
     } else if (ext.oid === OID_REASON_CODE && atEntry) {
-      var reason = asn1.read.enumerated(asn1.decode(ext.value));
+      var reason = asn1.read.enumerated(pkix.decodeNested(ext.value, ctx, "a reasonCode extension value"));
       if (!_hasOwn(CRL_REASONS, reason.toString())) throw new Error("undefined CRLReason " + reason.toString());
       value = Number(reason);
     } else if (ext.oid === OID_INVALIDITY_DATE && atEntry) {
-      var n = asn1.decode(ext.value);
+      var n = pkix.decodeNested(ext.value, ctx, "an invalidityDate extension value");
       if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
         throw new Error("invalidityDate must be a GeneralizedTime");
       }
@@ -82,13 +82,13 @@ var REVOKED_ENTRY = schema.seq([
   schema.optional("crlEntryExtensions", EXTENSIONS, { whenUniversal: [TAGS.SEQUENCE] }),
 ], {
   assert: "sequence", arity: { min: 2 }, code: "crl/bad-revoked-entry", what: "RevokedCertificate",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       serialNumber: m.fields.userCertificate.value,
       serialNumberHex: m.fields.userCertificate.node.content.toString("hex"),
       revocationDate: m.fields.revocationDate.value,
       crlEntryExtensions: m.fields.crlEntryExtensions.present
-        ? m.fields.crlEntryExtensions.value.result.map(function (e) { return decodeExt(e, "entry"); })
+        ? m.fields.crlEntryExtensions.value.result.map(function (e) { return decodeExt(e, "entry", ctx); })
         : [],
     };
   },
@@ -111,7 +111,7 @@ var TBS_CERTLIST = schema.seq([
     { minTag: 0, maxTag: 0, unexpectedCode: "crl/bad-tbs", orderCode: "crl/bad-tbs" }),
 ], {
   assert: "sequence", code: "crl/bad-tbs", what: "tbsCertList",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       version: m.fields.version.present ? m.fields.version.value : 1,
       issuer: m.fields.issuer.value.result,
@@ -119,7 +119,7 @@ var TBS_CERTLIST = schema.seq([
       nextUpdate: m.fields.nextUpdate.present ? m.fields.nextUpdate.value : null,
       revokedCertificates: m.fields.revokedCertificates.present ? m.fields.revokedCertificates.value.result : [],
       crlExtensions: m.fields.crlExtensions.present
-        ? m.fields.crlExtensions.value.result.map(function (e) { return decodeExt(e, "crl"); })
+        ? m.fields.crlExtensions.value.result.map(function (e) { return decodeExt(e, "crl", ctx); })
         : [],
       crlExtensionsPresent: m.fields.crlExtensions.present,
     };
@@ -265,10 +265,10 @@ function entryExtensionCriticality(oidRegistry) {
  *  raw. Returns the record with its decoded `value`; throws `crl/bad-extension-value`. */
 var OID_CERTIFICATE_ISSUER = oid.byName("certificateIssuer");
 var CERTIFICATE_ISSUER_NAMES = pkix.generalNames(NS, { code: "crl/bad-extension-value" });
-function readEntryExtension(ext) {
-  if (ext.oid !== OID_CERTIFICATE_ISSUER) return decodeExt(ext);
+function readEntryExtension(ext, ctx) {
+  if (ext.oid !== OID_CERTIFICATE_ISSUER) return decodeExt(ext, undefined, ctx);
   var names;
-  try { names = schema.walk(CERTIFICATE_ISSUER_NAMES, asn1.decode(ext.value), NS).result; }
+  try { names = schema.walk(CERTIFICATE_ISSUER_NAMES, pkix.decodeNested(ext.value, ctx, "a certificateIssuer extension value"), ctx || NS).result; }
   catch (e) {
     throw NS.E("crl/bad-extension-value", "malformed certificateIssuer extension value: " + ((e && e.message) || intrinsic.String(e)), e);
   }

package/lib/schema-crmf.js

@@ -170,12 +170,12 @@ function popoPrivKey(type) {
       }
     }
     if (inner.tagNumber === 3) {
-      try { schema.embeddedDer(PKMAC_VALUE, asn1.sequenceTlv(inner), NS, { code: "crmf/bad-popo", what: "agreeMAC [3] PKMACValue" }); }
+      try { schema.embeddedDer(PKMAC_VALUE, asn1.sequenceTlv(inner), schema.withResources(NS, ctx), { code: "crmf/bad-popo", what: "agreeMAC [3] PKMACValue" }); }
       catch (e) { throw ctx.E("crmf/bad-popo", "agreeMAC [3] must be a PKMACValue SEQUENCE { algId, BIT STRING } (RFC 4211 sec. 4.2)", e); }
     }
     if (inner.tagNumber === 4) {
       var env;
-      try { env = cms.walkEnvelopedData(asn1.decode(asn1.sequenceTlv(inner))); }
+      try { env = cms.walkEnvelopedData(pkix.decodeNested(asn1.sequenceTlv(inner), ctx, "an encryptedKey [4] EnvelopedData"), ctx); }
       catch (e) { throw ctx.E("crmf/bad-popo", "encryptedKey [4] must be a well-formed EnvelopedData (RFC 4211 sec. 4.2, RFC 5652 sec. 6.1)", e); }
       if (env.encryptedContentInfo.contentType !== oid.byName("encKeyWithID")) {
         throw ctx.E("crmf/bad-popo", "encryptedKey [4] EnvelopedData content type MUST be id-ct-encKeyWithID (RFC 4211 sec. 4.2)");
@@ -414,16 +414,21 @@ function matches(root) {
     schema.isUniversal(tpl, TAGS.SEQUENCE) && !!tpl.children;
 }
 
-function walkCertReqMessages(node, opts) {
-  var ctx = NS;
+/** @internal `outer` is the walk context of the parse that reached these messages, when another
+ *  format carries them. Only its caps and budget cross over: the messages are still read in this
+ *  namespace, so a fault in one keeps the CRMF error class and code. */
+function walkCertReqMessages(node, opts, outer) {
+  var ctx = schema.withResources(NS, outer);
   if (opts && (opts.allowSigningAlg || opts.allowV1Version)) {
-    ctx = Object.assign({}, NS);
+    ctx = Object.assign({}, ctx);
     if (opts.allowSigningAlg) ctx.allowSigningAlg = true;
     if (opts.allowV1Version) ctx.allowV1Version = true;
   }
   return schema.walk(CERT_REQ_MESSAGES, node, ctx).result;
 }
-function walkCertTemplate(node) { return schema.walk(CERT_TEMPLATE, node, NS).result; }
+function walkCertTemplate(node, outer) {
+  return schema.walk(CERT_TEMPLATE, node, schema.withResources(NS, outer)).result;
+}
 
 module.exports = {
   parse: parse,

package/lib/schema-csrattrs.js

@@ -158,12 +158,13 @@ var CERT_REQ_INFO_TEMPLATE = schema.seq([
         hasExtReq = true;
         extReqs += 1;
         if (a.values.length !== 1) throw NS.E("csrattrs/bad-template-attrs", "a template id-ExtensionReq values must be a SET of exactly one Extensions (RFC 9908 sec. 3.2)");
-        extensions = schema.walk(EXTENSIONS, asn1.decode(a.values[0]), ctx).result;
+        extensions = schema.walk(EXTENSIONS, pkix.decodeNested(a.values[0], ctx, "a template id-ExtensionReq value"), ctx).result;
       }
       if (a.type === OID_EXT_REQ_TEMPLATE) {
         extReqTemplates += 1;
         if (a.values.length !== 1) throw NS.E("csrattrs/bad-template-attrs", "an id-aa-extensionReqTemplate values must be a SET of exactly one ExtensionReqTemplate (RFC 9908 sec. 3.4)");
-        extensionTemplates = extensionTemplates.concat(schema.walk(EXTENSION_REQ_TEMPLATE, asn1.decode(a.values[0]), ctx).result);
+        extensionTemplates = extensionTemplates.concat(schema.walk(EXTENSION_REQ_TEMPLATE,
+          pkix.decodeNested(a.values[0], ctx, "an id-aa-extensionReqTemplate value"), ctx).result);
       }
     }
     if (extReqs > 1) throw NS.E("csrattrs/bad-template-attrs", "a template must not carry more than one id-ExtensionReq (RFC 9908 sec. 3.2)");
@@ -185,25 +186,26 @@ function _enrichAttribute(item, ctx) {
   if (KEY_TYPE_OIDS.has(item.oid)) item.isKeyType = true;
   if (item.oid === OID_EXTENSION_REQUEST) {
     if (item.values.length !== 1) throw ctx.E("csrattrs/bad-extension-req", "an id-ExtensionReq attribute values must be a SET of exactly one Extensions (RFC 9908 sec. 3.2)");
-    item.extensions = schema.walk(EXTENSIONS, asn1.decode(item.values[0]), ctx).result;
+    item.extensions = schema.walk(EXTENSIONS, pkix.decodeNested(item.values[0], ctx, "an id-ExtensionReq value"), ctx).result;
   } else if (item.oid === OID_EC_PUBLIC_KEY) {
     if (item.values.length > 1) throw ctx.E("csrattrs/bad-key-type-attr", "an ecPublicKey attribute values must be empty or a SET of exactly one named-curve OBJECT IDENTIFIER (RFC 9908 sec. 3.2)");
     if (item.values.length === 1) {
-      try { item.curve = asn1.read.oid(asn1.decode(item.values[0])); }
+      try { item.curve = asn1.read.oid(pkix.decodeNested(item.values[0], ctx, "an ecPublicKey attribute value")); }
       catch (e) { throw ctx.E("csrattrs/bad-key-type-attr", "an ecPublicKey attribute value must be a named-curve OBJECT IDENTIFIER (RFC 9908 sec. 3.2)", e); }
     }
   } else if (item.oid === OID_RSA_ENCRYPTION) {
     if (item.values.length > 1) throw ctx.E("csrattrs/bad-key-type-attr", "an rsaEncryption attribute values must be empty or a SET of exactly one INTEGER key size (RFC 9908 sec. 3.2)");
     if (item.values.length === 1) {
       var sz;
-      try { sz = asn1.read.integer(asn1.decode(item.values[0])); }
+      try { sz = asn1.read.integer(pkix.decodeNested(item.values[0], ctx, "an rsaEncryption attribute value")); }
       catch (e) { throw ctx.E("csrattrs/bad-key-type-attr", "an rsaEncryption attribute value must be an INTEGER key size (RFC 9908 sec. 3.2)", e); }
       if (sz < 1n || sz > 65536n) throw ctx.E("csrattrs/bad-key-type-attr", "the rsaEncryption key size " + sz + " is out of range (1..65536 bits)");
       item.keySize = Number(sz);
     }
   } else if (item.oid === OID_TEMPLATE) {
     if (item.values.length !== 1) throw ctx.E("csrattrs/bad-template", "a certificationRequestInfoTemplate attribute values must be a SET of exactly one template (RFC 9908 sec. 3.4)");
-    item.template = schema.walk(CERT_REQ_INFO_TEMPLATE, asn1.decode(item.values[0]), ctx).result;
+    item.template = schema.walk(CERT_REQ_INFO_TEMPLATE,
+      pkix.decodeNested(item.values[0], ctx, "a certificationRequestInfoTemplate value"), ctx).result;
   }
 }
 

package/lib/schema-engine.js

@@ -75,6 +75,66 @@ function _assertArity(schema, kids, ctx) {
 }
 
 
+var RESOURCE_REFUSALS = Object.assign(Object.create(null), {
+  "asn1/too-large": 1, "asn1/too-deep": 1, "asn1/too-many-items": 1,
+});
+
+/** @internal The codec's resource refusals, as distinct from its malformed-input refusals. A
+ *  caller who tightened a cap has to be able to tell "your bytes are wrong" from "your cap is
+ *  too small", and only the second is answered by raising the cap. */
+function isResourceRefusal(e) {
+  return !!(e && typeof e.code === "string" && RESOURCE_REFUSALS[e.code] === 1);
+}
+
+/** @internal Carries a parse's caps and budget onto another namespace. A format whose structure
+ *  is carried inside another format walks it in its OWN namespace, so a refusal names the domain
+ *  that owns the fault and keeps its own error class; the caps and the budget are the only things
+ *  that cross the boundary. Returns `ns` unchanged when there is nothing to carry. */
+function withResources(ns, source) {
+  if (!source || (source.caps == null && source.budget == null)) return ns;
+  var out = Object.create(null);
+  var keys = Object.keys(ns);
+  for (var i = 0; i < keys.length; i++) out[keys[i]] = ns[keys[i]];
+  out.caps = source.caps;
+  out.budget = source.budget;
+  return out;
+}
+
+/** @internal The decode a parse performs on a value it has already read out of its input: an
+ *  embedded OCTET STRING payload, an encapsulated protocol body. `ctx` is the walk context the
+ *  door built, so the caps a caller named at the door hold at every level rather than at the
+ *  root alone, and a resource refusal down here trips the parse budget before the original
+ *  error is re-thrown. The error itself is re-thrown unchanged, because a format's existing
+ *  code for a malformed embedded value is one callers pin.
+ *
+ *  `opts.ber` is read once into a local and carries the relaxed acceptance a format whose door
+ *  is BER-tolerant already applies at the root. The decode options are built fresh per call. */
+function decodeNested(bytes, ctx, label, opts) {
+  var caps = ctx ? ctx.caps : null;
+  var ber = !!(opts && opts.ber === true);
+  var decodeOpts = Object.create(null);
+  if (caps) {
+    decodeOpts.maxBytes = caps.maxBytes;
+    decodeOpts.maxDepth = caps.maxDepth;
+    decodeOpts.maxItems = caps.maxItems;
+  }
+  if (ber) decodeOpts.ber = true;
+  try {
+    // allow:bare-decode this IS the primitive every other nested decode routes through.
+    return asn1.decode(bytes, decodeOpts);
+  } catch (e) {
+    if (isResourceRefusal(e) && ctx && ctx.budget) {
+      try {
+        ctx.budget.trip(label || "an embedded value");
+      } catch (_b) {
+        /* allow:swallow-unverified the latch is the point; the original error is re-thrown below */
+      }
+    }
+    throw e;
+  }
+}
+
+// allow:bare-decode a round trip through the codec on an integer this module just encoded.
 function _implicitIntContent(v) { return asn1.decode(asn1.build.integer(v)).content; }
 function oidLeaf()        { return { kind: "leaf", read: asn1.read.oid, write: function (v) { return asn1.build.oid(v); } }; }
 function integerLeaf()    { return { kind: "leaf", read: asn1.read.integer, write: function (v) { return asn1.build.integer(v); } }; }
@@ -436,6 +496,7 @@ function _encodeRepeat(schema, items, ctx) {
   if (schema.unique) {
     var seen = new Set();
     parts.forEach(function (tlv) {
+      // allow:bare-decode a round trip through the codec on a TLV this encoder just produced.
       var item = { node: asn1.decode(tlv) };
       item.value = walk(schema.item, item.node, ctx);
       var key = schema.unique(item);
@@ -500,7 +561,7 @@ function embeddedDer(schema, bytes, ctx, opts) {
   }
   var node;
   try {
-    node = asn1.decode(bytes, opts.ber ? { ber: true } : undefined);
+    node = decodeNested(bytes, ctx, opts.what || "embedded DER", { ber: !!opts.ber });
   } catch (e) {
     throw ctx.E(opts.code, (opts.what || "embedded DER") + " did not decode: " + e.message, e);
   }
@@ -540,7 +601,9 @@ module.exports = {
   bitString: bitString, implicitBitString: implicitBitString, implicitOctetString: implicitOctetString,
   implicitNull: implicitNull, implicitInteger: implicitInteger, implicitBoolean: implicitBoolean,
   any: any, decode: decode, time: time,
-  walk: walk, encode: encode, embeddedDer: embeddedDer, assertMinimalNamedBits: assertMinimalNamedBits,
+  walk: walk, encode: encode, embeddedDer: embeddedDer, decodeNested: decodeNested,
+  isResourceRefusal: isResourceRefusal, withResources: withResources,
+  assertMinimalNamedBits: assertMinimalNamedBits,
   isUniversal: isUniversal, isContext: isContext,
   isUniversalOneOf: isUniversalOneOf, isContextOneOf: isContextOneOf, isContextInRange: isContextInRange,
 };

package/lib/schema-ocsp.js

@@ -98,9 +98,9 @@ function _rawSignature(field) {
 var CERTS = schema.seqOf(certificateBytes(), { assert: "sequence", code: "ocsp/bad-certs", what: "certs", max: constants.LIMITS.OCSP_MAX_CERTS, maxCode: "ocsp/too-many-certs" });
 
 /** @internal RFC 6960 sec. 4.4.4: ArchiveCutoff ::= GeneralizedTime, carried as a singleExtension. */
-function _readArchiveCutoff(ext) {
+function _readArchiveCutoff(ext, ctx) {
   var node;
-  try { node = asn1.decode(ext.value); }
+  try { node = pkix.decodeNested(ext.value, ctx, "an archiveCutoff extension value"); }
   catch (e) { throw NS.E("ocsp/bad-archive-cutoff", "the archiveCutoff extension value did not decode: " + ((e && e.message) || _String(e)), e); }
   if (!(node.tagClass === "universal" && node.tagNumber === asn1.TAGS.GENERALIZED_TIME)) {
     throw NS.E("ocsp/bad-archive-cutoff", "the archiveCutoff extension value must be a GeneralizedTime (RFC 6960 sec. 4.4.4)");
@@ -112,10 +112,10 @@ function _readArchiveCutoff(ext) {
 /** @internal RFC 6960 sec. 4.4.2: CrlID ::= SEQUENCE { crlUrl [0] EXPLICIT IA5String OPTIONAL,
  *  crlNum [1] EXPLICIT INTEGER OPTIONAL, crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }. Every
  *  field is optional and each may appear at most once, in tag order. */
-function _readCrlId(ext) {
+function _readCrlId(ext, ctx) {
   var C = "ocsp/bad-crl-id";
   var node;
-  try { node = asn1.decode(ext.value); }
+  try { node = pkix.decodeNested(ext.value, ctx, "a crlID extension value"); }
   catch (e) { throw NS.E(C, "the CRL references extension value did not decode: " + ((e && e.message) || _String(e)), e); }
   if (!(node.tagClass === "universal" && node.tagNumber === asn1.TAGS.SEQUENCE && node.children)) {
     throw NS.E(C, "CrlID must be a SEQUENCE (RFC 6960 sec. 4.4.2)");
@@ -154,15 +154,15 @@ function _readCrlId(ext) {
 /** @internal The extensions this profile reads are decoded onto their entry beside the raw value,
  *  so a consumer gets the value by name and a malformed one is refused here rather than passed
  *  through as opaque bytes. The nonce is RFC 9654; the other two are RFC 6960 sec. 4.4. */
-function _validateOcspExtensions(list) {
+function _validateOcspExtensions(list, ctx) {
   if (!list) return list;
   for (var i = 0; i < list.length; i++) {
     var ext = list[i];
-    if (ext.oid === OID_OCSP_ARCHIVE_CUTOFF) { ext.archiveCutoff = _readArchiveCutoff(ext); continue; }
-    if (ext.oid === OID_OCSP_CRL) { ext.crlReferences = _readCrlId(ext); continue; }
+    if (ext.oid === OID_OCSP_ARCHIVE_CUTOFF) { ext.archiveCutoff = _readArchiveCutoff(ext, ctx); continue; }
+    if (ext.oid === OID_OCSP_CRL) { ext.crlReferences = _readCrlId(ext, ctx); continue; }
     if (ext.oid !== OID_OCSP_NONCE) continue;
     var node;
-    try { node = asn1.decode(ext.value); }
+    try { node = pkix.decodeNested(ext.value, ctx, "a nonce extension value"); }
     catch (e) { throw NS.E("ocsp/bad-nonce", "the nonce extension value did not decode: " + ((e && e.message) || String(e)), e); }
     if (!(node.tagClass === "universal" && node.tagNumber === asn1.TAGS.OCTET_STRING && node.content)) {
       throw NS.E("ocsp/bad-nonce", "the nonce extension value must be an OCTET STRING (RFC 9654 sec. 2.1)");
@@ -244,13 +244,13 @@ var SINGLE_RESPONSE = schema.seq([
   ], { minTag: 0, maxTag: 1, unexpectedCode: "ocsp/bad-single-response", orderCode: "ocsp/bad-single-response" }),
 ], {
   assert: "sequence", code: "ocsp/bad-single-response", what: "SingleResponse",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       certID: m.fields.certID.value.result,
       certStatus: _shapeCertStatus(m.fields.certStatus),
       thisUpdate: m.fields.thisUpdate.value,
       nextUpdate: m.fields.nextUpdate.present ? m.fields.nextUpdate.value : null,
-      singleExtensions: m.fields.singleExtensions.present ? _validateOcspExtensions(m.fields.singleExtensions.value.result) : null,
+      singleExtensions: m.fields.singleExtensions.present ? _validateOcspExtensions(m.fields.singleExtensions.value.result, ctx) : null,
     };
   },
 });
@@ -277,13 +277,13 @@ var RESPONSE_DATA = schema.seq([
   ], { minTag: 1, maxTag: 1, unexpectedCode: "ocsp/bad-response-data", orderCode: "ocsp/bad-response-data" }),
 ], {
   assert: "sequence", code: "ocsp/bad-response-data", what: "ResponseData",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       version: m.fields.version.value,
       responderID: _shapeResponderID(m.fields.responderID),
       producedAt: m.fields.producedAt.value,
       responses: m.fields.responses.value.items.map(function (it) { return it.value.result; }),
-      responseExtensions: m.fields.responseExtensions.present ? _validateOcspExtensions(m.fields.responseExtensions.value.result) : null,
+      responseExtensions: m.fields.responseExtensions.present ? _validateOcspExtensions(m.fields.responseExtensions.value.result, ctx) : null,
     };
   },
 });
@@ -362,10 +362,10 @@ var REQUEST = schema.seq([
   ], { minTag: 0, maxTag: 0, unexpectedCode: "ocsp/bad-request", orderCode: "ocsp/bad-request" }),
 ], {
   assert: "sequence", code: "ocsp/bad-request", what: "Request",
-  build: function (m) {
+  build: function (m, ctx) {
     return {
       certID: m.fields.reqCert.value.result,
-      singleRequestExtensions: m.fields.singleRequestExtensions.present ? _validateOcspExtensions(m.fields.singleRequestExtensions.value.result) : null,
+      singleRequestExtensions: m.fields.singleRequestExtensions.present ? _validateOcspExtensions(m.fields.singleRequestExtensions.value.result, ctx) : null,
     };
   },
 });
@@ -396,13 +396,13 @@ var TBS_REQUEST = schema.seq([
   ], { minTag: 2, maxTag: 2, unexpectedCode: "ocsp/bad-tbs-request", orderCode: "ocsp/bad-tbs-request" }),
 ], {
   assert: "sequence", code: "ocsp/bad-tbs-request", what: "TBSRequest",
-  build: function (m) {
+  build: function (m, ctx) {
     var rn = m.fields.requestorName;
     return {
       version: m.fields.version.value,
       requestorName: rn.present ? { bytes: rn.value.bytes, tagClass: rn.value.tagClass, tagNumber: rn.value.tagNumber, value: rn.value.value } : null,
       requestList: m.fields.requestList.value.items.map(function (it) { return it.value.result; }),
-      requestExtensions: m.fields.requestExtensions.present ? _validateOcspExtensions(m.fields.requestExtensions.value.result) : null,
+      requestExtensions: m.fields.requestExtensions.present ? _validateOcspExtensions(m.fields.requestExtensions.value.result, ctx) : null,
     };
   },
 });
@@ -592,6 +592,7 @@ module.exports = {
    *  reads. Throws the parser's own ocsp/* code for a malformed entry. */
   readSingleExtensionsDer: function (derList) {
     var node;
+    // allow:bare-decode reached from the signer, not from a parse, so no parse context carries caps here.
     try { node = asn1.decode(asn1.build.sequence(intrinsic.map(derList, function (d) { return asn1.build.raw(d); }))); }
     catch (e) { throw NS.E("ocsp/bad-single-response", "a pre-encoded singleExtension is not DER", e); }
     return _validateOcspExtensions(schema.walk(EXTENSIONS, node, NS).result);

package/lib/schema-pkcs12.js

@@ -188,7 +188,8 @@ var SAFE_BAG = schema.seq([
         }
         if (a.type === OID_LOCAL_KEY_ID) {
           if (seen[a.type] || a.values.length !== 1) throw ctx.E("pkcs12/bad-local-key-id", "localKeyId carries exactly one OCTET STRING value (PKCS#9 SINGLE VALUE)");
-          localKeyId = _octetContent(asn1.decode(a.values[0], { ber: true }), ctx, "a localKeyId value", "pkcs12/bad-local-key-id");
+          localKeyId = _octetContent(pkix.decodeNested(a.values[0], ctx, "a localKeyId value", { ber: true }), ctx,
+            "a localKeyId value", "pkcs12/bad-local-key-id");
         }
         seen[a.type] = true;
       }
@@ -255,7 +256,7 @@ var PFX = schema.seq([
     }
     if (authSafe.contentType === OID_SIGNED_DATA) {
       if (macPresent) throw ctx.E("pkcs12/bad-integrity-mode", "an id-signedData authSafe (public-key integrity) must omit macData (RFC 7292 sec. 4)");
-      var signed = cms.walkSignedData(authSafe.innerNode);
+      var signed = cms.walkSignedData(authSafe.innerNode, ctx);
       if (signed.encapContentInfo.eContentType !== OID_DATA) {
         throw ctx.E("pkcs12/bad-authsafe", "a public-key-integrity authSafe must encapsulate id-data carrying the AuthenticatedSafe (RFC 7292 sec. 4.1)");
       }
@@ -296,7 +297,7 @@ function _privacySafe(content, ctx) {
 }
 
 function _bmpValue(bytes, ctx) {
-  var node = asn1.decode(bytes, { ber: true });
+  var node = pkix.decodeNested(bytes, ctx, "a friendlyName value", { ber: true });
   if (!(node.tagClass === "universal" && node.tagNumber === TAGS.BMP_STRING)) {
     throw ctx.E("pkcs12/bad-friendly-name", "a friendlyName value must be a BMPString (RFC 7292 sec. 4.2)");
   }
@@ -310,12 +311,15 @@ function _walkAuthenticatedSafe(bytes, state, ctx) {
   });
 }
 
-// @internal
-function walkSafeContents(der) {
-  var walked = schema.walk(SAFE_CONTENTS, asn1.decode(der, { ber: true }), NS);
+/** @internal Reads a decrypted SafeContents. `ctx` is the parse context of the door that produced
+ *  the bytes when there is one, so its caps and budget reach the bags; the decrypt path in
+ *  pki.pkcs12.open has none and takes the built-in ceilings. */
+function walkSafeContents(der, ctx) {
+  var ns = schema.withResources(NS, ctx);
+  var walked = schema.walk(SAFE_CONTENTS, pkix.decodeNested(der, ns, "a SafeContents", { ber: true }), ns);
   var state = { budget: { remaining: C.LIMITS.PKCS12_MAX_REDECODES }, bagDepth: 0 };
   var bags = [];
-  for (var i = 0; i < walked.items.length; i++) bags.push(_buildBag(walked.items[i].value.result, state, NS));
+  for (var i = 0; i < walked.items.length; i++) bags.push(_buildBag(walked.items[i].value.result, state, ns));
   return bags;
 }
 
@@ -333,9 +337,9 @@ function _dispatchSafes(asMatch, state, ctx) {
         safeBags.push(_buildBag(contents.items[j].value.result, state, ctx));
       }
     } else if (el.contentType === OID_ENCRYPTED_DATA) {
-      encryptedSafes.push({ type: "encryptedData", content: _privacySafe(cms.walkEncryptedData(el.innerNode), ctx) });
+      encryptedSafes.push({ type: "encryptedData", content: _privacySafe(cms.walkEncryptedData(el.innerNode, ctx), ctx) });
     } else if (el.contentType === OID_ENVELOPED_DATA) {
-      encryptedSafes.push({ type: "envelopedData", content: _privacySafe(cms.walkEnvelopedData(el.innerNode), ctx), envelopedDataDer: el.innerNode.bytes });
+      encryptedSafes.push({ type: "envelopedData", content: _privacySafe(cms.walkEnvelopedData(el.innerNode, ctx), ctx), envelopedDataDer: el.innerNode.bytes });
     } else {
       throw ctx.E("pkcs12/bad-safe-contentinfo-type", "an AuthenticatedSafe element must be id-data, id-encryptedData, or id-envelopedData (RFC 7292 sec. 4.1), got " +
         (ctx.oid.name(el.contentType) || el.contentType));
@@ -351,13 +355,13 @@ function _buildBag(rec, state, ctx) {
   };
   if (rec.bagId === OID_KEY_BAG) {
     bag.type = "keyBag";
-    bag.key = pkcs8.walkPrivateKeyInfo(rec.valueNode);
+    bag.key = pkcs8.walkPrivateKeyInfo(rec.valueNode, ctx);
     bag.keyDer = rec.valueNode.bytes;
     return bag;
   }
   if (rec.bagId === OID_SHROUDED_KEY_BAG) {
     bag.type = "pkcs8ShroudedKeyBag";
-    bag.encrypted = pkcs8.walkEncryptedPrivateKeyInfo(rec.valueNode);
+    bag.encrypted = pkcs8.walkEncryptedPrivateKeyInfo(rec.valueNode, ctx);
     return bag;
   }
   if (rec.bagId === OID_CERT_BAG) {