@blamejs/pki 0.8.49 → 0.8.51

package/lib/ct.js

@@ -67,7 +67,17 @@ var _bufCopy = intrinsic.uncurry(Buffer.prototype.copy);
 var _writeU64BE = intrinsic.uncurry(Buffer.prototype.writeBigUInt64BE);
 var _searchSet = intrinsic.uncurry(URLSearchParams.prototype.set);
 var _numberOf = intrinsic.Number;
-var _URL = URL;
+var _URL = intrinsic.URL;
+/** @internal Every part of a parsed destination is read through the accessor captured at load, not off
+ *  the value's own prototype: a header getter that redefined `URL.prototype.href` had the request go to
+ *  the host its getter named while the url the caller passed was still the one reported. */
+var _urlHref = intrinsic.urlHref;
+var _urlOrigin = intrinsic.urlOrigin;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlPathname = intrinsic.urlPathname;
+var _urlSearchParams = intrinsic.urlSearchParams;
+var _urlSetPathname = intrinsic.urlSetPathname;
+var _urlSetSearch = intrinsic.urlSetSearch;
 var _JSON_SUFFIX = ".json";
 function _endsWithJson(s) { return s.length >= _JSON_SUFFIX.length && _strSlice(s, s.length - _JSON_SUFFIX.length) === _JSON_SUFFIX; }
 var ByteReader = require("./byte-reader.js");
@@ -1177,14 +1187,42 @@ var KNOWN_FETCH_OPTS = intrinsic.assign(intrinsic.create(null), { url: 1, signer
  *  and rewrite the servername after the check had passed: the anchors checked were then not the anchors
  *  the connection used. Copying the list is what closes that, since emptying an array the caller still
  *  holds is the lever. Flatten once, check that record, and connect under the same one. */
+/** @internal One piece of trust material, copied rather than referenced. An anchor, a client
+ *  certificate and a client key are each a Buffer the caller still holds, and copying the list that
+ *  holds them copies the references in it: a header getter that wrote an attacker's PEM OVER an
+ *  anchor's bytes left every reference pointing where it did and still opened the connection under
+ *  trust material the unpinned-log check had already approved, MEASURED on this module. A PEM string
+ *  cannot be changed after the fact and is taken as it is; anything that is neither is handed on
+ *  unchanged, so the transport keeps giving the refusal it gives today for a shape it does not
+ *  accept. */
+function _trustValue(v, field) {
+  if (typeof v === "string") return v;
+  if (guard.bytes.isByteSource(v)) return _toBuffer(v, field, _ctErr, "ct/bad-input");
+  return v;
+}
+
 function _tlsForFetch(opts) {
-  var t = opts.tls || {};
+  /** @internal A record with NO prototype where the caller supplied no TLS at all, because the empty
+   *  object a literal gives inherits from `Object.prototype` and every field below is then answerable
+   *  from there. MEASURED: a getter inside `opts.sth` set `Object.prototype.useSystemStore = true`, the
+   *  record built here inherited it, and the refusal that turns away an unpinned log was skipped, so a
+   *  call that had named neither a transport nor an anchor opened a connection trusting the system
+   *  store. Where the caller DID supply a TLS record this is settled at the door and the record read
+   *  here is the flat one taken then, whose seven fields are its own. */
+  var t = opts.tls != null ? opts.tls : intrinsic.create(null);
   var anchors = t.anchors;
-  if (intrinsic.isArray(anchors)) anchors = intrinsic.arraySlice(anchors);
-  return { anchors: anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+  /** @internal Copied by index rather than with `slice`, which consults the array's species and so
+   *  would run a caller's constructor. `guard.list.copyMap` walks it with a narrowed count and copies
+   *  each element's bytes as it goes. */
+  anchors = intrinsic.isArray(anchors)
+    ? guard.list.copyMap(anchors, function (a, i) { return _trustValue(a, "opts.tls.anchors[" + i + "]"); })
+    : _trustValue(anchors, "opts.tls.anchors");
+  return { anchors: anchors, useSystemStore: t.useSystemStore, cert: _trustValue(t.cert, "opts.tls.cert"),
+    key: _trustValue(t.key, "opts.tls.key"), minVersion: t.minVersion, servername: t.servername,
+    checkServerIdentity: t.checkServerIdentity };
 }
 
-function _sameOrigin(a, b) { return new URL(a).origin === new URL(b).origin; }
+function _sameOrigin(a, b) { return _urlOrigin(new _URL(a)) === _urlOrigin(new _URL(b)); }
 
 /** @internal Refused at the door and again where the value is used. */
 function _assertTransport(opts) {
@@ -1196,17 +1234,20 @@ function _fetchCtypeToken(headers) { return String((headers || {})["content-type
 
 function _parseHttpsUrl(u, label) {
   var parsed;
-  try { parsed = new URL(String(u)); }
-  catch (e) { throw _ctErr("ct/bad-url", "the CT log-list " + label + " did not parse: " + String(u), e); }
-  if (parsed.protocol !== "https:") throw _ctErr("ct/insecure-url", "the CT log-list " + label + " must be https, got " + parsed.protocol + " for " + String(u));
+  var text = _stringOf(u);
+  try { parsed = new _URL(text); }
+  catch (e) { throw _ctErr("ct/bad-url", "the CT log-list " + label + " did not parse: " + text, e); }
+  var scheme = _urlProtocol(parsed);
+  if (scheme !== "https:") throw _ctErr("ct/insecure-url", "the CT log-list " + label + " must be https, got " + scheme + " for " + text);
   return parsed;
 }
 
 function _sigUrlFor(parsed) {
-  if (!_endsWithJson(parsed.pathname)) throw _ctErr("ct/bad-input", "cannot derive the detached-signature URL from a non-.json path (" + JSON.stringify(parsed.pathname) + "); pass opts.sigUrl explicitly");
-  var sig = new URL(parsed.href);
-  sig.pathname = _strSlice(parsed.pathname, 0, parsed.pathname.length - _JSON_SUFFIX.length) + ".sig";
-  return sig.href;
+  var path = _urlPathname(parsed);
+  if (!_endsWithJson(path)) throw _ctErr("ct/bad-input", "cannot derive the detached-signature URL from a non-.json path (" + JSON.stringify(path) + "); pass opts.sigUrl explicitly");
+  var sig = new _URL(_urlHref(parsed));
+  _urlSetPathname(sig, _strSlice(path, 0, path.length - _JSON_SUFFIX.length) + ".sig");
+  return _urlHref(sig);
 }
 
 function _fetchBody(transport, url, req, label) {
@@ -1239,6 +1280,10 @@ var STH_PREIMAGE_BYTES = 50;
 var CT_VERSION_V1 = 0;
 var SIG_TYPE_TREE_HASH = 1;
 var CT_V1_PREFIX = "ct/v1/";
+/** @internal The union across the sec. 4 messages rather than one set per message, because a caller
+ *  drives several of them from a single options bag: the same record carries the pinned key for the
+ *  tree head and the range for the entries. An option a message does not read is ignored by it, so the
+ *  refusal this list makes is of a name no message knows. */
 var KNOWN_CLIENT_OPTS = intrinsic.assign(intrinsic.create(null), {
   url: 1, logKey: 1, transport: 1, tls: 1, headers: 1, timeout: 1, maxResponseBytes: 1,
   sth: 1, oldSth: 1, newSth: 1, leafHash: 1, start: 1, end: 1, chain: 1,
@@ -1249,14 +1294,14 @@ var KNOWN_CLIENT_OPTS = intrinsic.assign(intrinsic.create(null), {
  *  with or without the `ct/v1/` prefix the specification fixes, and neither spelling doubles it. */
 function _endpoint(url, message) {
   var parsed = _parseHttpsUrl(url, "log URL");
-  var path = parsed.pathname;
+  var path = _urlPathname(parsed);
   if (path.length === 0 || path[path.length - 1] !== "/") path += "/";
   var tail = CT_V1_PREFIX;
   if (path.length >= CT_V1_PREFIX.length + 1 &&
       _strSlice(path, path.length - CT_V1_PREFIX.length) === CT_V1_PREFIX) tail = "";
-  var out = new _URL(parsed.href);
-  out.pathname = path + tail + message;
-  out.search = "";
+  var out = new _URL(_urlHref(parsed));
+  _urlSetPathname(out, path + tail + message);
+  _urlSetSearch(out, "");
   return out;
 }
 
@@ -1268,7 +1313,13 @@ function _endpoint(url, message) {
  *  would be a pin approved on one object and a socket opened under another. Reading from the record
  *  afterwards means the value that was checked is the value that is used. Every verb calls this at its
  *  own entry and passes the record down, rather than relying on a check further in. */
-function _clientDoor(opts) {
+/** @internal `keyName` is the option this message VERIFIES against, or null for one that verifies
+ *  nothing. The option list is the union across the messages so that one bag drives several of them,
+ *  and an option a message does not read is ignored by it; settling the pinned key at every door
+ *  instead would make a message that never checks a signature refuse a bag over a field it does not
+ *  consume. `getSth` and the two chain submissions name it; the proof, consistency, entries and roots
+ *  messages pass null. */
+function _clientDoor(opts, keyName) {
   /** @internal `optionsObject` is the door `signSct` in this module already enters by, and it REFUSES
    *  an options bag carrying an accessor rather than tolerating one: a bag whose properties are not
    *  plain values is a shape no set of checks can answer for, and it also refuses one that changes
@@ -1286,15 +1337,93 @@ function _clientDoor(opts) {
    *  therefore dropped an inherited `transport`, and dropping a transport is not a smaller result: it
    *  falls through to opening a real connection where the caller passed a fake one. What makes the
    *  repeated reads safe instead is that this door refuses a bag whose properties are not plain values,
-   *  and that each option below is taken into a local ONCE, before anything that could run caller code. */
-  return bag;
+   *  and that each option below is taken into a local ONCE, before anything that could run caller code.
+   *  EVERY DECLARED OPTION IS TAKEN HERE, and the ones a verdict rests on are made immune, but the
+   *  request is NOT shaped here. Shaping it here was tried and is wrong: copying the request headers
+   *  runs whatever getters the caller's header object carries, and doing that before a verb reads its
+   *  own options put every verification input at the mercy of one. A header getter swapped `logKey` for
+   *  an attacker's SPKI, then overwrote the same buffer in place once the reference was held, then
+   *  overwrote `sth.rootHash` so an empty audit proof verified. Each was worse than the wrong-host case
+   *  the move was meant to close. The verb's inputs are the more valuable thing, so the headers are
+   *  copied at send time as they always were, and the destination is protected by making it immune
+   *  instead: a string url cannot be rewritten, and a flattened tls with its anchor list copied cannot
+   *  be emptied. Taking the top level is safe because the door has already refused a bag whose
+   *  properties are not plain values, so no read here runs caller code. */
+  return { o: _settleDecisive(_takeTopLevel(bag, KNOWN_CLIENT_OPTS), keyName) };
+}
+
+/** @internal Every DECLARED option the bag can answer, read once into a record of plain values, before
+ *  anything derives from one. `in` is used rather than an enumeration because the door accepts an option
+ *  supplied through a caller's defaults object, and an enumeration omits an inherited FUNCTION member,
+ *  which silently dropped a `transport` and fell through to opening a real connection. It consults the
+ *  prototype chain exactly as the direct reads it replaces did, so it carries no new exposure, and
+ *  absence survives: a name the bag cannot answer is left out rather than materialized as `undefined`,
+ *  which a guard that tells absent from present-and-undefined depends on. */
+function _takeTopLevel(bag, known) {
+  var o = intrinsic.create(null);
+  intrinsic.forEach(intrinsic.keys(known), function (k) {
+    if (k in bag) o[k] = bag[k];
+  });
+  return o;
+}
+
+/** @internal The two values a verdict rests on, made IMMUNE rather than merely taken. Holding a
+ *  reference is not holding a value: a header getter copied an attacker's SPKI OVER the caller's
+ *  `logKey` buffer in place and an attacker-signed tree head was accepted, and a getter inside `tls`
+ *  rewrote an object-valued url's `hostname` and the request went to another host. Both happened after
+ *  the option had been taken, because what was taken could still be changed from outside. A string and
+ *  a copied buffer cannot be, so the destination and the pin stop depending on what the caller does
+ *  next. Done here, before anything nested is read, for the same reason the taking is. */
+function _settleDecisive(o, keyName) {
+  /** @internal There is no order that fixes this by itself, which is what two rounds of reordering
+   *  showed: converting the url asks an object for its text and that runs the caller's code, which
+   *  emptied the anchor list not yet flattened; flattening the anchors first reads `tls.anchors` and
+   *  that runs the caller's code too, which rewrote the url not yet converted. So the caller's code is
+   *  refused HERE instead of ordered around. A url has to be a string, which needs no conversion, and
+   *  a tls carries no accessor, which makes reading its members inert. After that nothing in settling
+   *  runs caller code and the order stops mattering. */
+  if (o.url != null && typeof o.url !== "string") {
+    throw _ctErr("ct/bad-input", "opts.url must be a string -- an object is asked for its text form, " +
+      "and asking runs the caller's code, which is how a request reached a host its URL had not named");
+  }
+  /** @internal The detached-signature URL is a destination too, and only the log-list fetch declares
+   *  it, so the rule is the same one: a value that has to be converted is a value whose conversion
+   *  runs here, after everything else has been settled, where it could still rewrite what was. */
+  if (o.sigUrl != null && typeof o.sigUrl !== "string") {
+    throw _ctErr("ct/bad-input", "opts.sigUrl must be a string -- an object is asked for its text " +
+      "form, and asking runs the caller's code after the other options have been settled");
+  }
+  if (o.tls != null) {
+    guard.identifier.refuseAccessorFields(o.tls,
+      guard.identifier.readableNames(o.tls, _ctErr, "ct/bad-input", "opts.tls"),
+      _ctErr, "ct/bad-input", "opts.tls");
+    /** @internal And the ELEMENTS of the anchor list, which refusing accessors on `tls` itself does not
+     *  reach. An accessor on `anchors[0]` runs when the list is copied, and one that overwrote
+     *  `sth.rootHash` with the leaf being proven had an empty audit path verify. The refusal has to go
+     *  as deep as the reading does. */
+    var suppliedAnchors = o.tls.anchors;
+    if (suppliedAnchors != null) {
+      guard.identifier.refuseAccessorFields(suppliedAnchors,
+        guard.identifier.readableIndices(suppliedAnchors, _ctErr, "ct/bad-input", "opts.tls.anchors"),
+        _ctErr, "ct/bad-input", "opts.tls.anchors");
+    }
+    /** @internal Flattened HERE, with the anchor list copied, because the caller still holds the object
+     *  and a getter anywhere else in the bag emptied the list after the trust-anchor check approved it.
+     *  Reading its members and its elements is inert now that both refuse an accessor, so this runs no
+     *  caller code and the order it runs in stops mattering. */
+    o.tls = _tlsForFetch(o);
+  }
+  if (keyName !== null && o[keyName] != null) {
+    o[keyName] = _toBuffer(o[keyName], "opts." + keyName, _ctErr, "ct/bad-input");
+  }
+  return o;
 }
 
 /** @internal The shared request shape every message uses: the caller's transport or a pinned-anchor
  *  one, the caps, and the header filter. Factored so a verb adds a path and a body and nothing else,
  *  and so a rule about reaching a log is stated once. `o` has already been through `_clientDoor`, so
  *  every read here is of a plain value. */
-function _clientRequest(o, label) {
+function _clientRequest(o) {
   var transport = _assertTransport(o);
   /** @internal ONE read, and the presence check and the endpoint both decide from it. Read again after
    *  the header copy below, which runs whatever getters the caller's header object carries, it was
@@ -1326,16 +1455,18 @@ function _clientRequest(o, label) {
     if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = supplied[k];
   });
   return { transport: transport, url: url, req: { headers: headers, tls: tls, timeout: timeout,
-    maxResponseBytes: maxResponseBytes }, label: label };
+    maxResponseBytes: maxResponseBytes } };
 }
 
 /** @internal A sec. 4 message, fetched and read as JSON. The specification returns every error as a
  *  4xx or 5xx with a human-readable message, which `_fetchBody` already turns into a typed refusal,
  *  so a non-200 never reaches the reader. */
-async function _clientJson(o, message, label, query, body) {
-  var ctx = _clientRequest(o, label);
+async function _clientJson(door, message, label, query, body) {
+  /** @internal Shaped at send time, from the record the door settled. Shaping it at the door instead
+   *  ran the caller's header getters before any verb had captured its verification inputs. */
+  var ctx = _clientRequest(door.o);
   var url = _endpoint(ctx.url, message);
-  if (query) intrinsic.keys(query).forEach(function (k) { _searchSet(url.searchParams, k, query[k]); });
+  if (query) intrinsic.keys(query).forEach(function (k) { _searchSet(_urlSearchParams(url), k, query[k]); });
   var req = ctx.req;
   if (body !== undefined) {
     req = intrinsic.assign(intrinsic.create(null), req);
@@ -1346,7 +1477,7 @@ async function _clientJson(o, message, label, query, body) {
     h["content-type"] = "application/json";
     req.headers = h;
   }
-  var res = await _fetchBody(ctx.transport, url.href, req, label);
+  var res = await _fetchBody(ctx.transport, _urlHref(url), req, label);
   /** @internal The exact-integer rule applies to the NAMED members, the ones `_uintField` reads. RFC 6962
    *  responses are ordinary JSON, where `1e3` is legal, so the stricter `integersOnly` would refuse a
    *  document a conforming log may emit; what this refuses is a spelling whose value is not exactly its
@@ -1517,7 +1648,8 @@ async function verifySth(sth, logKey) {
  *   sth.treeSize;   // -> 3n
  */
 async function getSth(opts) {
-  opts = _clientDoor(opts || {});
+  var door = _clientDoor(opts || {}, "logKey");
+  opts = door.o;
   /** @internal ONE read of the option, and the presence check and the copy both decide from it. Reading
    *  it twice let an accessor answer the two separately: a non-null value for the check and an
    *  attacker's SPKI for the copy, and the tree head was then verified against a key the caller never
@@ -1529,7 +1661,7 @@ async function getSth(opts) {
     throw _ctErr("ct/bad-input", "opts.logKey is required -- the caller-pinned log SPKI; an unverified tree head is not a result");
   }
   var pinnedKey = _toBuffer(suppliedLogKey, "opts.logKey", _ctErr, "ct/bad-input");
-  var doc = await _clientJson(opts, "get-sth", "sth");
+  var doc = await _clientJson(door,"get-sth", "sth");
   var sth = {
     treeSize: _uintField(doc, "tree_size", "ct/bad-sth", "sth"),
     timestamp: _uintField(doc, "timestamp", "ct/bad-sth", "sth"),
@@ -1575,7 +1707,8 @@ async function getSth(opts) {
  *   p.verified;   // -> true
  */
 async function getProofByHash(opts) {
-  opts = _clientDoor(opts || {});
+  var door = _clientDoor(opts || {}, null);
+  opts = door.o;
   var sth = _assertSth(opts.sth, "opts.sth");
   /** @internal Copied for the reason the tree head is: it is sent on the wire and then folded against the
    *  head after the fetch returns, so a view would let the leaf being proved differ from the leaf asked
@@ -1584,7 +1717,7 @@ async function getProofByHash(opts) {
   if (leafHash.length !== 32) {
     throw _ctErr("ct/bad-input", "opts.leafHash must be exactly 32 bytes (a v1 leaf hash), got " + leafHash.length);
   }
-  var doc = await _clientJson(opts, "get-proof-by-hash", "audit proof", {
+  var doc = await _clientJson(door,"get-proof-by-hash", "audit proof", {
     hash: _bufToString(leafHash, "base64"), tree_size: _stringOf(sth.treeSize),
   });
   var leafIndex = _uintField(doc, "leaf_index", "ct/bad-proof", "audit proof");
@@ -1630,14 +1763,15 @@ async function getProofByHash(opts) {
  *   c.verified;   // -> true
  */
 async function getSthConsistency(opts) {
-  opts = _clientDoor(opts || {});
+  var door = _clientDoor(opts || {}, null);
+  opts = door.o;
   var oldSth = _assertSth(opts.oldSth, "opts.oldSth");
   var newSth = _assertSth(opts.newSth, "opts.newSth");
   if (oldSth.treeSize > newSth.treeSize) {
     throw _ctErr("ct/bad-input", "opts.oldSth names tree size " + oldSth.treeSize +
       ", which is larger than opts.newSth's " + newSth.treeSize);
   }
-  var doc = await _clientJson(opts, "get-sth-consistency", "consistency proof", {
+  var doc = await _clientJson(door,"get-sth-consistency", "consistency proof", {
     first: _stringOf(oldSth.treeSize), second: _stringOf(newSth.treeSize),
   });
   var consistency = _b64Array(doc, "consistency", "ct/bad-consistency", "consistency proof", 32, C.LIMITS.MERKLE_MAX_PROOF_NODES);
@@ -1687,7 +1821,8 @@ async function getSthConsistency(opts) {
  *   e.entries[0].leafInput;   // -> <Buffer ...>
  */
 async function getEntries(opts) {
-  opts = _clientDoor(opts || {});
+  var door = _clientDoor(opts || {}, null);
+  opts = door.o;
   var start = guard.range.uint64(opts.start, _ctErr, "ct/bad-input", "opts.start");
   var end = guard.range.uint64(opts.end, _ctErr, "ct/bad-input", "opts.end");
   if (end < start) {
@@ -1698,7 +1833,7 @@ async function getEntries(opts) {
     throw _ctErr("ct/bad-input", "a range of " + requested + " entries exceeds the " +
       C.LIMITS.CT_MAX_ENTRIES_PER_REQUEST + "-entry request cap");
   }
-  var doc = await _clientJson(opts, "get-entries", "entries", { start: _stringOf(start), end: _stringOf(end) });
+  var doc = await _clientJson(door,"get-entries", "entries", { start: _stringOf(start), end: _stringOf(end) });
   var raw = doc.entries;
   if (!intrinsic.isArray(raw)) throw _ctErr("ct/bad-entries", "the entries field is not an array");
   if (intrinsic.BigInt(raw.length) > requested) {
@@ -1743,8 +1878,9 @@ async function getEntries(opts) {
  *   r.certificates.length;   // -> 2
  */
 async function getRoots(opts) {
-  opts = _clientDoor(opts || {});
-  var doc = await _clientJson(opts, "get-roots", "roots");
+  /** @internal This message carries no options of its own, so the door's record is all that is used. */
+  var door = _clientDoor(opts || {}, null);
+  var doc = await _clientJson(door, "get-roots", "roots");
   return guard.verdict.of({ certificates: _b64Array(doc, "certificates", "ct/bad-roots", "roots", undefined, C.LIMITS.CT_MAX_ROOTS) });
 }
 
@@ -1826,7 +1962,8 @@ async function addPreChain(opts) {
  *  The chain encoding, the response shape, and the refusal when the receipt does not verify are one
  *  rule stated once. */
 async function _addChain(opts, message, entryType) {
-  opts = _clientDoor(opts || {});
+  var door = _clientDoor(opts || {}, "logKey");
+  opts = door.o;
   /** @internal ONE read of the option, used by the presence check here and by the copy below. Reading it
    *  twice let an accessor answer the two separately, presenting a non-null value to the check and an
    *  attacker's SPKI to the copy, and the returned receipt was then verified against a key the caller
@@ -1859,7 +1996,7 @@ async function _addChain(opts, message, entryType) {
     : { entryType: 1, tbsCertificate: _snap(opts.tbsCertificate, "opts.tbsCertificate"),
       issuerKeyHash: _snap(opts.issuerKeyHash, "opts.issuerKeyHash") };
   var pinnedKey = _snap(suppliedLogKey, "opts.logKey");
-  var doc = await _clientJson(opts, message, "SCT", null, _jsonStringify({ chain: chain }));
+  var doc = await _clientJson(door,message, "SCT", null, _jsonStringify({ chain: chain }));
   var version = doc.sct_version;
   if (version !== 0) {
     throw _ctErr("ct/bad-sct", "the log returned sct_version " + guard.text.showValue(version) +
@@ -2056,9 +2193,16 @@ async function fetchLogList(opts) {
    *  once to parse and once to fetch, so an accessor sent the request somewhere the parse never saw. */
   opts = guard.identifier.optionsObject(opts, _ctErr, "ct/bad-input", "pki.ct.fetchLogList options");
   guard.identifier.assertKnownKeys(opts, KNOWN_FETCH_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
+  /** @internal Every declared option taken before anything derives from one, for the reason
+   *  `_clientDoor` does it: there is no safe order, because reading a NESTED value inside any of them
+   *  runs the caller's code and that code can rewrite the ones not yet taken. Parsing the url first let
+   *  its `toString` empty the pinned anchor list; taking the tls first let a getter on `tls.anchors`
+   *  rewrite the url and the signer key. Taking the top level first closes both. */
+  opts = _settleDecisive(_takeTopLevel(opts, KNOWN_FETCH_OPTS), "signerKey");
   /** @internal Read once, at the door, and carried from here. Asking again would let an option that
    * answers differently on each read hand back something other than the value that was checked. */
   var transport = _assertTransport(opts);
+  var fetchTls = _tlsForFetch(opts);
   /** @internal ONE read, and both the presence check and the copy decide from it. Reading it twice let an
    *  accessor present a non-null value to the check and an attacker's SPKI to the copy, so the list was
    *  verified under a distributor key the caller never pinned.
@@ -2070,14 +2214,17 @@ async function fetchLogList(opts) {
   var pinnedSigner = _toBuffer(suppliedSignerKey, "opts.signerKey", _ctErr, "ct/bad-input");
   if (opts.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log_list.json URL (there is no baked-in vendor URL)");
   var jsonParsed = _parseHttpsUrl(opts.url, "URL");
-  var jsonUrl = jsonParsed.href;
+  var jsonUrl = _urlHref(jsonParsed);
   /** @internal ONE read: the presence test and the parse decide from the same value. */
   var suppliedSigUrl = opts.sigUrl;
-  var sigUrl = suppliedSigUrl != null ? _parseHttpsUrl(suppliedSigUrl, "signature URL").href : _sigUrlFor(jsonParsed);
-  if (!_sameOrigin(jsonUrl, sigUrl)) throw _ctErr("ct/bad-input", "opts.sigUrl must share the log-list URL's origin (" + jsonParsed.origin + "); a cross-origin detached-signature host is not supported");
-  /** @internal Flattened once, for the reason `_clientRequest` does it: the header copy below runs the
-   *  caller's getters, and the check and the connection have to read the same flat record. */
-  var fetchTls = _tlsForFetch(opts);
+  /** @internal Through the captured accessor like every other read of a parsed destination here. No
+   *  caller code can run between the settle above and this line, the bag refusing an accessor and both
+   *  urls having to be strings, so this one has no vector of its own; it is read this way because a
+   *  site that reads a destination off the prototype is the shape that has to stay absent. */
+  var sigUrl = suppliedSigUrl != null
+    ? _urlHref(_parseHttpsUrl(suppliedSigUrl, "signature URL"))
+    : _sigUrlFor(jsonParsed);
+  if (!_sameOrigin(jsonUrl, sigUrl)) throw _ctErr("ct/bad-input", "opts.sigUrl must share the log-list URL's origin (" + _urlOrigin(jsonParsed) + "); a cross-origin detached-signature host is not supported");
   if (!transport) {
     var hasAnchors = fetchTls.anchors !== undefined && fetchTls.anchors !== null && !(intrinsic.isArray(fetchTls.anchors) && fetchTls.anchors.length === 0);
     if (!hasAnchors && fetchTls.useSystemStore !== true) throw _ctErr("ct/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned CT server (RFC 6962 sec. 3.2)");

package/lib/est.js

@@ -80,6 +80,20 @@ var _toLowerCase = intrinsic.uncurry(String.prototype.toLowerCase);
  *  and both build from the RECEIVER, so reading the global binding at the call decides whether the body
  *  runs and whether a refusal stays a refusal. Taken at load. */
 var _Promise = intrinsic.Promise;
+/** @internal The URL parser, taken at load: what it returns names the host an enrollment request goes
+ *  to, and a redirect is resolved against the current operation URL with it. The conversion the parser
+ *  is handed is taken with it, since a replacement answers with a host of its own. */
+var _URL = intrinsic.URL;
+var _stringOf = intrinsic.String;
+/** @internal And the accessors its result is read through: capturing the constructor does not capture
+ *  the prototype the value reads its parts off, and each part here decides something, the scheme
+ *  whether the request is allowed, the origin whether credentials may still be sent after a redirect. */
+var _urlHref = intrinsic.urlHref;
+var _urlOrigin = intrinsic.urlOrigin;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlPathname = intrinsic.urlPathname;
+var _urlSearch = intrinsic.urlSearch;
+var _urlHash = intrinsic.urlHash;
 var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var pkix = require("./schema-pkix");
@@ -803,25 +817,28 @@ function _csrDer(input) {
 
 function _parseUrl(urlStr) {
   var url;
-  try { url = new URL(String(urlStr)); }
+  try { url = new _URL(_stringOf(urlStr)); }
   catch (e) { throw E("est/bad-url", "the EST server URL did not parse: " + String(urlStr), e); }
-  if (url.protocol !== "https:") throw E("est/insecure-url", "EST requires https (RFC 7030 sec. 3.3), got " + url.protocol + " for " + urlStr);
+  var scheme = _urlProtocol(url);
+  if (scheme !== "https:") throw E("est/insecure-url", "EST requires https (RFC 7030 sec. 3.3), got " + scheme + " for " + urlStr);
   return url;
 }
 
+/** @internal The settings this client forwards to its transport. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
 function _tlsForRequest(opts) {
-  var t = opts.tls || {};
-  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+  return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
 }
 
 function _redirectTarget(current, location, method, opts) {
   if (location == null || String(location).trim() === "") throw E("est/http-error", "a redirect response carried no Location header");
   var resolved;
-  try { resolved = new URL(String(location), current.href); }
+  try { resolved = new _URL(_stringOf(location), _urlHref(current)); }
   catch (e) { throw E("est/bad-url", "a redirect Location did not parse: " + location, e); }
-  if (resolved.protocol !== "https:") throw E("est/insecure-redirect", "a redirect to a non-https URL is refused (RFC 7030 sec. 3.2.1): " + resolved.protocol);
+  var resolvedScheme = _urlProtocol(resolved);
+  if (resolvedScheme !== "https:") throw E("est/insecure-redirect", "a redirect to a non-https URL is refused (RFC 7030 sec. 3.2.1): " + resolvedScheme);
   var safeMethod = method === "GET" || method === "HEAD";
-  if (resolved.origin !== current.origin && !safeMethod && !opts.allowCrossOriginRedirect) {
+  if (_urlOrigin(resolved) !== _urlOrigin(current) && !safeMethod && !opts.allowCrossOriginRedirect) {
     throw E("est/cross-origin-redirect", "a cross-origin redirect on a " + method + " needs opts.allowCrossOriginRedirect (RFC 7030 sec. 3.2.1)");
   }
   return resolved;
@@ -884,10 +901,10 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   var staleRetries = 0;
   var authSpaces = 0;
   var lastDigestNonce = null;
-  var initialOrigin = url.origin;
+  var initialOrigin = _urlOrigin(url);
   function _tlsFor(u) {
     var t = budgets.tls;
-    if (t && u.origin !== initialOrigin) {
+    if (t && _urlOrigin(u) !== initialOrigin) {
       t = Object.assign({}, t);
       t.cert = null; t.key = null; t.servername = null;
     }
@@ -899,20 +916,26 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   var digestSent = false;
   function _headersFor(u) {
     digestSent = false;
-    if (u.origin !== initialOrigin || (!authValue && !digestChallenge)) return headers;
+    /** @internal The origin and the request target are each read ONCE and both the protection-space
+     *  test and the answer are built from those locals: the credential is bound to the target it is
+     *  computed over, so a part answering two reads differently would answer for one target and be
+     *  sent to another. */
+    var uOrigin = _urlOrigin(u);
+    var uTarget = _urlPathname(u) + _urlSearch(u);
+    if (uOrigin !== initialOrigin || (!authValue && !digestChallenge)) return headers;
     var hh = guard.identifier.ownOptions(headers);
     if (digestChallenge) {
-      if (!httpDigest.inProtectionSpace(digestChallenge, u.origin, u.pathname + u.search)) return headers;
+      if (!httpDigest.inProtectionSpace(digestChallenge, uOrigin, uTarget)) return headers;
       var nkey = digestChallenge.nonce;
       digestNcByNonce[nkey] = (digestNcByNonce[nkey] || 0) + 1;
-      hh.authorization = httpDigest.answer(digestChallenge, { method: method, uri: u.pathname + u.search, username: _authUser(opts), password: _authPass(opts), body: body, nc: digestNcByNonce[nkey], policy: _digestPolicy(opts) }, E);
+      hh.authorization = httpDigest.answer(digestChallenge, { method: method, uri: uTarget, username: _authUser(opts), password: _authPass(opts), body: body, nc: digestNcByNonce[nkey], policy: _digestPolicy(opts) }, E);
       digestSent = true;
     } else { hh.authorization = authValue; }
     return hh;
   }
   function step() {
     var hopBody = (typeof body === "function" && budgets.onAttempt) ? budgets.onAttempt() : body;
-    return guard.async.invoked(transport, [{ method: method, url: url.href, headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "est/bad-input", "opts.transport").then(function (res) {
+    return guard.async.invoked(transport, [{ method: method, url: _urlHref(url), headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "est/bad-input", "opts.transport").then(function (res) {
       res = res || {};
       var blen = _bodyLen(res);
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
@@ -933,7 +956,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
         return step();
       }
       if (status === 401) {
-        if (url.origin !== initialOrigin) throw E("est/auth-required", "refusing to send HTTP credentials to a redirected origin (RFC 7030 sec. 3.6)");
+        if (_urlOrigin(url) !== initialOrigin) throw E("est/auth-required", "refusing to send HTTP credentials to a redirected origin (RFC 7030 sec. 3.6)");
         var www = String(h["www-authenticate"] || "");
         if (www.length > constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES) throw E("est/auth-required", "the WWW-Authenticate header exceeds the " + constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES + "-byte cap (RFC 7030 sec. 3.2.3)");
         var scheme = _authScheme(opts);
@@ -945,8 +968,8 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
           selPol.preferStale = digestSent;
           selPol.priorNonce = lastDigestNonce;
           selPol.priorRealm = digestChallenge && digestChallenge.realm;
-          selPol.requestOrigin = url.origin;
-          selPol.requestTarget = url.pathname + url.search;
+          selPol.requestOrigin = _urlOrigin(url);
+          selPol.requestTarget = _urlPathname(url) + _urlSearch(url);
           var ch = httpDigest.parseChallenge(www, E, "est/digest-bad-challenge", selPol);
           if (!ch) throw E("est/auth-required", "the server offered no usable Digest challenge: " + www);
           if (digestSent && digestChallenge && ch.realm === digestChallenge.realm) {
@@ -980,13 +1003,13 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
  * answer, so a verb that holds one passes it and this reads the option only when none was held. */
 function _client(op, method, baseUrl, body, headers, opts, proxySnap, onAttempt, checked) {
   var base;
-  try { base = new URL(String(baseUrl)); }
+  try { base = new _URL(_stringOf(baseUrl)); }
   catch (e) { throw E("est/bad-url", "the EST base URL did not parse: " + guard.text.showValue(baseUrl), e); }
-  if (base.search || base.hash) throw E("est/bad-url", "the EST base URL must not carry a query or fragment component (RFC 7030 sec. 3.2.2)");
+  if (_urlSearch(base) || _urlHash(base)) throw E("est/bad-url", "the EST base URL must not carry a query or fragment component (RFC 7030 sec. 3.2.2)");
   var url = _parseUrl(paths(baseUrl, { label: opts.label })[op]);
   var transport = checked !== undefined ? checked : _assertTransport(opts);
   if (!transport) {
-    var t = opts.tls || {};
+    var t = opts.tls != null ? opts.tls : intrinsic.create(null);
     var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(Array.isArray(t.anchors) && t.anchors.length === 0);
     if (!hasAnchors && t.useSystemStore !== true) throw E("est/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned server (RFC 7030 sec. 3.6)");
     transport = httpTransport.https({ E: E, errPrefix: "est" });

package/lib/guard-bytes.js

@@ -247,14 +247,29 @@ function source(input, ErrorClass, code, label) {
   throw _raise(ErrorClass, code, label + ": expected a BufferSource (ArrayBuffer / TypedArray / Buffer)");
 }
 
+/** @internal Into a store of its own, not through `Buffer.from`. A small `Buffer.from` takes its result
+ *  out of the 64 KiB allocation pool, so a caller whose own input came from that pool holds a view of
+ *  the whole store and the copy lands inside it at another offset. MEASURED through a shipped verb: a
+ *  caller's transport, which runs after the key is copied and before the signature is checked, found
+ *  the copy in the pool it shared, wrote an attacker's SPKI over it, and the forged tree head was
+ *  accepted. Every consumer of this door relies on the copy being out of the caller's reach, which is
+ *  the whole reason the copy is taken. The deep copy below has always allocated its own store; this is
+ *  the same allocation. */
+function _ownedCopy(src) {
+  var len = _lengthOf(src);
+  var owned = new _ArrayBuffer(len);
+  _taSet(new _Uint8Array(owned), src);
+  return _bufferFrom(owned, 0, len);
+}
+
 // @enforced-by behavioral -- a copy has no rename-proof code shape to detect (any
 function snapshot(input, ErrorClass, code, label) {
-  return _bufferFrom(view(input, ErrorClass, code, label));
+  return _ownedCopy(view(input, ErrorClass, code, label));
 }
 
 // @enforced-by behavioral -- a copy has no rename-proof shape to detect; the guard
 function snapshotSource(input, ErrorClass, code, label) {
-  return _bufferFrom(source(input, ErrorClass, code, label));
+  return _ownedCopy(source(input, ErrorClass, code, label));
 }
 
 // @enforced-by behavioral -- a copy has no rename-proof code shape to detect (any `Buffer.from(x)`

package/lib/guard-identifier.js

@@ -124,6 +124,27 @@ function optionNames(obj, known) {
   return out;
 }
 
+/** @internal The named settings of a caller's nested record, taken into a record with NO prototype.
+ *  Each module declares its own `names`, because which settings a verb forwards is that verb's
+ *  statement and a shared list would name settings for a verb that does not read them; what is shared
+ *  is that the result cannot inherit. An absent record yields the same shape with every name
+ *  undefined, where the empty object literal it replaces inherited from `Object.prototype`: MEASURED,
+ *  a `useSystemStore` installed there was read as a caller's opt-in and the refusal of a server with
+ *  no pinned anchor was skipped. A name is read off the record itself, so a caller's own defaults
+ *  object on the chain still answers for it.
+ *
+ * @enforced-by behavioral -- a read into a fresh record has no rename-proof shape of its own; the
+ * conformance vectors are each module's own refusal of an unpinned server under a polluted prototype.
+ */
+function pickSettings(record, names) {
+  var out = _create(null);
+  var src = record === null || record === undefined ? null : record;
+  for (var i = 0; i < names.length; i++) {
+    out[names[i]] = src === null ? undefined : src[names[i]];
+  }
+  return out;
+}
+
 /** @internal A caller's options bag copied onto a prototype-less object, keyed by every own string
  *  property, not the enumerable ones alone. Each is read once, so an accessor-backed option
  *  answers the copy and not the later reads. Inherited properties are left behind: the copy is
@@ -609,6 +630,7 @@ module.exports = intrinsic.freeze({
   snapshotOptions: snapshotOptions,
   optionNames: optionNames,
   ownOptions: ownOptions,
+  pickSettings: pickSettings,
   readableNames: readableNames,
   readableIndices: readableIndices
 });