@blamejs/pki 0.8.48 → 0.8.49

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.49 — 2026-10-05
+
+Contact the certificate-transparency log the caller named, and refuse an options object that answers a second read differently.
+
+### Fixed
+
+- `pki.ct.getSth`, `pki.ct.getProofByHash`, `pki.ct.getSthConsistency`, `pki.ct.getEntries`, `pki.ct.getRoots` and `pki.ct.addChain` read `opts.url` once to check it was present and again to build the endpoint. An options object whose `url` is an accessor therefore answered the two separately: the check saw the log the caller named and the request went wherever the second read pointed, which for a measured case was a different host entirely. `opts.tls` was read the same way, once for the trust-anchor check that refuses an unpinned log and once more for the connection, so the anchors that satisfied the check need not have been the anchors the socket used. Each verb now takes its options through one door at its own entry, and that door refuses an options object carrying an accessor, which is the rule `pki.ct.signSct` in the same module already applied. It also refuses an object that changes which options it carries while they are being read, since no set of checks can answer for one. A caller passing a plain object sees no change. The refusal is `ct/bad-input` and it happens before any request is sent, so a rejected options object cannot reach a log. Refusing an accessor on the options object is not the whole rule, because the door never inspects the members of a value, and a getter on a header name runs while the request headers are being copied. Three things it could reach from there are now taken before it runs. The URL is taken and converted to text at the same point, since holding the value alone is not enough when the value is an object whose text form names the host: a getter that rewrote an object-valued URL's `href` moved the request just as a second read would have. The TLS settings are flattened at that point too, and the anchor list is copied rather than shared, because a getter that emptied the pinned list after the trust-anchor check had approved it left the connection pinned to nothing. A caller that supplies options through a defaults object on the prototype chain is unaffected, including a function-valued `transport`. `pki.ct.fetchLogList` checked which option names it had been given and never entered that door at all, so its `url` was read once to parse and once to fetch, its `sigUrl` twice, and its TLS configuration once for the anchor check and once for the connection; it enters the same door now, over its own option set. Note that this is stricter than before: an options object with an accessor property was previously accepted, and the toolkit answered from whichever read it happened to make. Pass plain values.
+
 ## v0.8.48 — 2026-10-05
 
 Assemble a verification verdict out of component results through the operation the package captured at load, and refuse the reserved end-of-contents encoding where an element belongs.

package/lib/ct.js

@@ -1171,9 +1171,17 @@ var DEFAULT_FETCH_TIMEOUT = C.TIME.seconds(30);
 var MAX_FETCH_TIMEOUT = C.TIME.seconds(600);
 var KNOWN_FETCH_OPTS = intrinsic.assign(intrinsic.create(null), { url: 1, signerKey: 1, sigUrl: 1, transport: 1, tls: 1, headers: 1, timeout: 1, maxResponseBytes: 1, requireJsonContentType: 1 });
 
+/** @internal The TLS settings flattened into a record of plain values, with the anchor LIST copied.
+ *  `opts.tls` is the caller's object and its members are read later than the trust-anchor check that
+ *  approves them, so leaving either shared let a getter elsewhere in the bag empty the pinned anchors
+ *  and rewrite the servername after the check had passed: the anchors checked were then not the anchors
+ *  the connection used. Copying the list is what closes that, since emptying an array the caller still
+ *  holds is the lever. Flatten once, check that record, and connect under the same one. */
 function _tlsForFetch(opts) {
   var t = opts.tls || {};
-  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+  var anchors = t.anchors;
+  if (intrinsic.isArray(anchors)) anchors = intrinsic.arraySlice(anchors);
+  return { anchors: anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
 }
 
 function _sameOrigin(a, b) { return new URL(a).origin === new URL(b).origin; }
@@ -1252,38 +1260,81 @@ function _endpoint(url, message) {
   return out;
 }
 
+/** @internal The door every sec. 4 message enters by: the declared options refused if one is not
+ *  recognized, then taken ONCE into a plain record. A caller's bag is the caller's, so an option
+ *  reached through an accessor answers each read separately, and this code read several of them twice:
+ *  `url` for a presence check and again to build the endpoint, which let the check approve one host
+ *  while the request went to another; `tls` for the anchor check and again for the connection, which
+ *  would be a pin approved on one object and a socket opened under another. Reading from the record
+ *  afterwards means the value that was checked is the value that is used. Every verb calls this at its
+ *  own entry and passes the record down, rather than relying on a check further in. */
+function _clientDoor(opts) {
+  /** @internal `optionsObject` is the door `signSct` in this module already enters by, and it REFUSES
+   *  an options bag carrying an accessor rather than tolerating one: a bag whose properties are not
+   *  plain values is a shape no set of checks can answer for, and it also refuses one that changes
+   *  which options it carries while they are read. Refusing beats copying, because a copy leaves the
+   *  caller's shape acceptable and every future read in this module has to remember to use the copy.
+   *  It also leaves ABSENCE intact, which materializing the declared names would not: an absent
+   *  `transport` means "open the connection yourself, under the pinned anchors", while one present
+   *  holding `undefined` is a transport that is not callable. */
+  var bag = guard.identifier.optionsObject(opts, _ctErr, "ct/bad-input", "pki.ct client options");
+  guard.identifier.assertKnownKeys(bag, KNOWN_CLIENT_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
+  /** @internal The bag is returned as it came, not copied. A copy cannot reproduce what reading it
+   *  does: an option supplied through a caller's defaults object is reached along the prototype chain,
+   *  and the enumeration that would drive a copy deliberately omits an inherited FUNCTION member,
+   *  because that is how `Object.prototype.toString` is kept from counting as an option. Copying
+   *  therefore dropped an inherited `transport`, and dropping a transport is not a smaller result: it
+   *  falls through to opening a real connection where the caller passed a fake one. What makes the
+   *  repeated reads safe instead is that this door refuses a bag whose properties are not plain values,
+   *  and that each option below is taken into a local ONCE, before anything that could run caller code. */
+  return bag;
+}
+
 /** @internal The shared request shape every message uses: the caller's transport or a pinned-anchor
  *  one, the caps, and the header filter. Factored so a verb adds a path and a body and nothing else,
- *  and so a rule about reaching a log is stated once. */
-function _clientRequest(opts, label) {
-  guard.identifier.assertKnownKeys(opts, KNOWN_CLIENT_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
-  var transport = _assertTransport(opts);
-  if (opts.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log's base URL (there is no baked-in log)");
+ *  and so a rule about reaching a log is stated once. `o` has already been through `_clientDoor`, so
+ *  every read here is of a plain value. */
+function _clientRequest(o, label) {
+  var transport = _assertTransport(o);
+  /** @internal ONE read, and the presence check and the endpoint both decide from it. Read again after
+   *  the header copy below, which runs whatever getters the caller's header object carries, it was
+   *  whatever that code had since made it: a getter on a header name rewrote `url` and moved the request
+   *  to another host after this check had approved the original.
+   *  AND CONVERTED HERE, not at the endpoint. Holding the value alone is not enough when it is an
+   *  object, because the text form is what names the host and `String()` asks the object for it: a
+   *  header getter that rewrote an object-valued url's `href` moved the request just the same, the
+   *  conversion being the last reader. The endpoint is built from this string. */
+  if (o.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log's base URL (there is no baked-in log)");
+  var url = _stringOf(o.url);
+  /** @internal Flattened BEFORE the header copy below, which invokes whatever getters the caller's
+   *  header object carries. One of those emptied the pinned anchors after this check had approved them,
+   *  so the check and the connection have to read the same flat record and it has to exist first. */
+  var tls = _tlsForFetch(o);
   if (!transport) {
-    var t = opts.tls || {};
-    var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(intrinsic.isArray(t.anchors) && t.anchors.length === 0);
-    if (!hasAnchors && t.useSystemStore !== true) {
+    var hasAnchors = tls.anchors !== undefined && tls.anchors !== null && !(intrinsic.isArray(tls.anchors) && tls.anchors.length === 0);
+    if (!hasAnchors && tls.useSystemStore !== true) {
       throw _ctErr("ct/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned CT log server (RFC 6962 sec. 3.2)");
     }
     transport = httpTransport.https({ E: _ctErr, errPrefix: "ct" });
   }
-  var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_FETCH_TIMEOUT, { E: _ctErr, code: "ct/bad-input", min: 1, max: MAX_FETCH_TIMEOUT });
-  var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.CT_LOG_LIST_MAX_BYTES, { E: _ctErr, code: "ct/bad-input", min: 1, max: C.LIMITS.CT_LOG_LIST_MAX_BYTES });
+  var timeout = guard.limits.cap(o.timeout, "timeout", DEFAULT_FETCH_TIMEOUT, { E: _ctErr, code: "ct/bad-input", min: 1, max: MAX_FETCH_TIMEOUT });
+  var maxResponseBytes = guard.limits.cap(o.maxResponseBytes, "maxResponseBytes", C.LIMITS.CT_LOG_LIST_MAX_BYTES, { E: _ctErr, code: "ct/bad-input", min: 1, max: C.LIMITS.CT_LOG_LIST_MAX_BYTES });
   var headers = intrinsic.create(null);
-  guard.identifier.optionNames(opts.headers).forEach(function (k) {
+  var supplied = o.headers;
+  intrinsic.forEach(guard.identifier.optionNames(supplied), function (k) {
     var lk = _toLowerCase(k);
-    if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = opts.headers[k];
+    if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = supplied[k];
   });
-  return { transport: transport, req: { headers: headers, tls: _tlsForFetch(opts), timeout: timeout,
+  return { transport: transport, url: url, req: { headers: headers, tls: tls, timeout: timeout,
     maxResponseBytes: maxResponseBytes }, label: label };
 }
 
 /** @internal A sec. 4 message, fetched and read as JSON. The specification returns every error as a
  *  4xx or 5xx with a human-readable message, which `_fetchBody` already turns into a typed refusal,
  *  so a non-200 never reaches the reader. */
-async function _clientJson(opts, message, label, query, body) {
-  var ctx = _clientRequest(opts, label);
-  var url = _endpoint(opts.url, message);
+async function _clientJson(o, message, label, query, body) {
+  var ctx = _clientRequest(o, label);
+  var url = _endpoint(ctx.url, message);
   if (query) intrinsic.keys(query).forEach(function (k) { _searchSet(url.searchParams, k, query[k]); });
   var req = ctx.req;
   if (body !== undefined) {
@@ -1466,7 +1517,7 @@ async function verifySth(sth, logKey) {
  *   sth.treeSize;   // -> 3n
  */
 async function getSth(opts) {
-  opts = opts || {};
+  opts = _clientDoor(opts || {});
   /** @internal ONE read of the option, and the presence check and the copy both decide from it. Reading
    *  it twice let an accessor answer the two separately: a non-null value for the check and an
    *  attacker's SPKI for the copy, and the tree head was then verified against a key the caller never
@@ -1524,7 +1575,7 @@ async function getSth(opts) {
  *   p.verified;   // -> true
  */
 async function getProofByHash(opts) {
-  opts = opts || {};
+  opts = _clientDoor(opts || {});
   var sth = _assertSth(opts.sth, "opts.sth");
   /** @internal Copied for the reason the tree head is: it is sent on the wire and then folded against the
    *  head after the fetch returns, so a view would let the leaf being proved differ from the leaf asked
@@ -1579,7 +1630,7 @@ async function getProofByHash(opts) {
  *   c.verified;   // -> true
  */
 async function getSthConsistency(opts) {
-  opts = opts || {};
+  opts = _clientDoor(opts || {});
   var oldSth = _assertSth(opts.oldSth, "opts.oldSth");
   var newSth = _assertSth(opts.newSth, "opts.newSth");
   if (oldSth.treeSize > newSth.treeSize) {
@@ -1636,7 +1687,7 @@ async function getSthConsistency(opts) {
  *   e.entries[0].leafInput;   // -> <Buffer ...>
  */
 async function getEntries(opts) {
-  opts = opts || {};
+  opts = _clientDoor(opts || {});
   var start = guard.range.uint64(opts.start, _ctErr, "ct/bad-input", "opts.start");
   var end = guard.range.uint64(opts.end, _ctErr, "ct/bad-input", "opts.end");
   if (end < start) {
@@ -1692,7 +1743,7 @@ async function getEntries(opts) {
  *   r.certificates.length;   // -> 2
  */
 async function getRoots(opts) {
-  opts = opts || {};
+  opts = _clientDoor(opts || {});
   var doc = await _clientJson(opts, "get-roots", "roots");
   return guard.verdict.of({ certificates: _b64Array(doc, "certificates", "ct/bad-roots", "roots", undefined, C.LIMITS.CT_MAX_ROOTS) });
 }
@@ -1775,7 +1826,7 @@ async function addPreChain(opts) {
  *  The chain encoding, the response shape, and the refusal when the receipt does not verify are one
  *  rule stated once. */
 async function _addChain(opts, message, entryType) {
-  opts = opts || {};
+  opts = _clientDoor(opts || {});
   /** @internal ONE read of the option, used by the presence check here and by the copy below. Reading it
    *  twice let an accessor answer the two separately, presenting a non-null value to the check and an
    *  attacker's SPKI to the copy, and the returned receipt was then verified against a key the caller
@@ -2000,7 +2051,10 @@ function _b64Array(obj, name, code, label, exactLen, maxCount) {
  *   r.logs[0] && r.logs[0].trusted;   // the verified, trusted-log set (the detached signature checked first)
  */
 async function fetchLogList(opts) {
-  opts = opts || {};
+  /** @internal The same door the sec. 4 verbs enter by, over this verb's own option set. Checking the
+   *  NAMES alone left every value still to be read from the caller's object, and `url` was read twice,
+   *  once to parse and once to fetch, so an accessor sent the request somewhere the parse never saw. */
+  opts = guard.identifier.optionsObject(opts, _ctErr, "ct/bad-input", "pki.ct.fetchLogList options");
   guard.identifier.assertKnownKeys(opts, KNOWN_FETCH_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
   /** @internal Read once, at the door, and carried from here. Asking again would let an option that
    * answers differently on each read hand back something other than the value that was checked. */
@@ -2017,22 +2071,27 @@ async function fetchLogList(opts) {
   if (opts.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log_list.json URL (there is no baked-in vendor URL)");
   var jsonParsed = _parseHttpsUrl(opts.url, "URL");
   var jsonUrl = jsonParsed.href;
-  var sigUrl = opts.sigUrl != null ? _parseHttpsUrl(opts.sigUrl, "signature URL").href : _sigUrlFor(jsonParsed);
+  /** @internal ONE read: the presence test and the parse decide from the same value. */
+  var suppliedSigUrl = opts.sigUrl;
+  var sigUrl = suppliedSigUrl != null ? _parseHttpsUrl(suppliedSigUrl, "signature URL").href : _sigUrlFor(jsonParsed);
   if (!_sameOrigin(jsonUrl, sigUrl)) throw _ctErr("ct/bad-input", "opts.sigUrl must share the log-list URL's origin (" + jsonParsed.origin + "); a cross-origin detached-signature host is not supported");
+  /** @internal Flattened once, for the reason `_clientRequest` does it: the header copy below runs the
+   *  caller's getters, and the check and the connection have to read the same flat record. */
+  var fetchTls = _tlsForFetch(opts);
   if (!transport) {
-    var t = opts.tls || {};
-    var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(Array.isArray(t.anchors) && t.anchors.length === 0);
-    if (!hasAnchors && t.useSystemStore !== true) throw _ctErr("ct/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned CT server (RFC 6962 sec. 3.2)");
+    var hasAnchors = fetchTls.anchors !== undefined && fetchTls.anchors !== null && !(intrinsic.isArray(fetchTls.anchors) && fetchTls.anchors.length === 0);
+    if (!hasAnchors && fetchTls.useSystemStore !== true) throw _ctErr("ct/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned CT server (RFC 6962 sec. 3.2)");
     transport = httpTransport.https({ E: _ctErr, errPrefix: "ct" });
   }
   var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_FETCH_TIMEOUT, { E: _ctErr, code: "ct/bad-input", min: 1, max: MAX_FETCH_TIMEOUT });
   var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.CT_LOG_LIST_MAX_BYTES, { E: _ctErr, code: "ct/bad-input", min: 1, max: C.LIMITS.CT_LOG_LIST_MAX_BYTES });
   var headers = intrinsic.create(null);
-  guard.identifier.optionNames(opts.headers).forEach(function (k) {
-    var lk = k.toLowerCase();
-    if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = opts.headers[k];
+  var suppliedHeaders = opts.headers;
+  intrinsic.forEach(guard.identifier.optionNames(suppliedHeaders), function (k) {
+    var lk = _toLowerCase(k);
+    if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = suppliedHeaders[k];
   });
-  var req = { headers: headers, tls: _tlsForFetch(opts), timeout: timeout, maxResponseBytes: maxResponseBytes };
+  var req = { headers: headers, tls: fetchTls, timeout: timeout, maxResponseBytes: maxResponseBytes };
   /** @internal Read before the request goes out, so the option that decides the check is the one the call
    *  was made with rather than whatever it says once the response is back. */
   var requireJsonContentType = opts.requireJsonContentType === true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.48",
+  "version": "0.8.49",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:0f0eb9a3-9ce3-42bb-ba73-3ad3528eccf7",
+  "serialNumber": "urn:uuid:850d86e8-9f55-4854-9b3a-89ed4e16dfd5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-05T06:06:36.873Z",
+    "timestamp": "2026-10-05T08:10:11.062Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.48",
+      "bom-ref": "@blamejs/pki@0.8.49",
       "type": "application",
       "name": "pki",
-      "version": "0.8.48",
+      "version": "0.8.49",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.48",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.49",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.48",
+      "ref": "@blamejs/pki@0.8.49",
       "dependsOn": []
     }
   ]