@blamejs/pki 0.8.55 → 0.8.56

package/lib/path-validate.js

@@ -60,6 +60,13 @@ var _pop = intrinsic.pop;
 var _splice = intrinsic.splice;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _strIndexOf = intrinsic.uncurry(String.prototype.indexOf);
+/** @internal The case fold a name constraint is compared under. Read off the live prototype, it is
+ * the replaceable operation that decides whether a name falls inside an EXCLUDED subtree, and a
+ * replacement that mangles the constraint alone while leaving the host as it is makes the exclusion
+ * stop matching: measured, a leaf naming `www.bad.example` under an `excludedSubtrees` of
+ * `bad.example` was ADMITTED with no failure code at all. Appending to both sides preserves the
+ * suffix relation and hides this, so only the asymmetric replacement shows it. */
+var _strToLowerCase = intrinsic.toLowerCase;
 var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _reject = intrinsic.uncurry(intrinsic.promiseReject);
 /** @internal The promise constructor, captured at load. `promiseResolve` builds its promise from the
@@ -81,6 +88,12 @@ var validator = require("./validator-all");
 var cms = require("./schema-cms");
 var httpTransport = require("./http-transport");
 var net = require("net");
+/** @internal The address-family classification, captured at load. It decides the SSRF question for an
+ * AIA URL: a host the classifier calls an IP LITERAL is fetched without requiring the transport to
+ * declare that it filters resolved addresses, so a replacement answering that a DNS name is a
+ * literal fetches it under a guarantee nothing made. The export is writable, and this runs before
+ * the blocklist it feeds. */
+var _netIsIP = net.isIP;
 var compositeSig = require("./composite-sig");
 /** @internal Captured at load: `pki.shbs` is the same module object the public surface exposes, and its
  * `verify` is a writable property, so reading it when a signature is checked would let whoever wrote it
@@ -92,7 +105,7 @@ var PathError = errors.PathError;
 function E(code, message, cause) { return new PathError(code, message, cause); }
 function pathCode(e, fallback) {
   if (!e || typeof e.code !== "string") return fallback;
-  if (e.code.indexOf("path/") === 0) return e.code;
+  if (_strIndexOf(e.code, "path/") === 0) return e.code;
   if (e.code === "webcrypto/not-supported" || e.code === "webcrypto/data") return "path/unsupported-algorithm";
   return fallback;
 }
@@ -218,7 +231,7 @@ function resolveRsaPss(paramsBytes) {
     throw E("path/unsupported-algorithm", "RSASSA-PSS parameters must be an RSASSA-PSS-params SEQUENCE (RFC 4055)");
   }
   var pssLastTag = -1;
-  n.children.forEach(function (f) {
+  intrinsic.forEach(n.children, function (f) {
     if (f.tagClass !== "context") throw E("path/unsupported-algorithm", "RSASSA-PSS-params fields must be context-tagged (RFC 4055)");
     if (f.tagNumber > 3 || f.tagNumber <= pssLastTag) throw E("path/unsupported-algorithm", "RSASSA-PSS-params has an unexpected, duplicate, or out-of-order field [" + f.tagNumber + "]");
     pssLastTag = f.tagNumber;
@@ -492,12 +505,18 @@ function builtinVerify(state, cert) {
   if (d.composite) return compositeSig.compositeVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature");
   if (d.shbs) return _resolve(_Promise, _shbsVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes));
   var key;
-  return _importVerifyKey(state.workingPublicKey, d).then(function (k) {
+  /** @internal Both continuations come from the capture. A continuation is read off the promise at
+   * the call, and the one below IS where the signature verdict is decided: a replacement settling
+   * the import step hands this a key nothing imported, and one settling the verify step reports
+   * `ok: true` for a signature that was never checked, after which a chain whose issuer name matches
+   * a supplied root is accepted on a signature that does not verify. */
+  var verified = intrinsic.chain(_importVerifyKey(state.workingPublicKey, d), function (k) {
     key = k;
     var sig = cert.signatureValue.bytes;
     if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
     return _subtleVerify(subtle, d.verify, key, sig, cert.tbsBytes);
-  }).then(function (ok) {
+  });
+  return intrinsic.chain(verified, function (ok) {
     return guard.verdict.of({ ok: ok === true });
   }, function (e) {
     return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-signature"), error: e });
@@ -542,7 +561,7 @@ var splitMailbox = guard.name.splitMailbox;
 function emailMatch(constraint, mailbox) {
   var mb = splitMailbox(mailbox);
   if (mb === "ambiguous") return "unsupported";
-  if (constraint.indexOf("@") !== -1) {
+  if (_strIndexOf(constraint, "@") !== -1) {
     var cb = splitMailbox(constraint);
     if (cb === "ambiguous" || cb === null || mb === null) return "unsupported";
     /** @internal A constraint naming a whole mailbox asks the RFC 5280 sec. 7.5 question, so it is
@@ -555,10 +574,10 @@ function emailMatch(constraint, mailbox) {
     return "unsupported";
   }
   if (mb === null) return "unsupported";
-  var host = stripTrailingDot(mb[1].toLowerCase());
+  var host = stripTrailingDot(_strToLowerCase(mb[1]));
   if (host === "") return "unsupported";
-  var c = stripTrailingDot(constraint.toLowerCase());
-  if (c.charAt(0) === ".") return host.length > c.length && host.slice(-c.length) === c;
+  var c = stripTrailingDot(_strToLowerCase(constraint));
+  if (_charCodeAt(c, 0) === 46) return host.length > c.length && _strSlice(host, -c.length) === c;
   return host === c;
 }
 
@@ -575,10 +594,10 @@ var stripTrailingDot = guard.name.stripTrailingDot;
  * fail-open mirror, so it is asked for only where the caller wants reach. A wildcard reaches exactly
  * one label, so a base below the wildcard's parent is reached only when it is one label below it. */
 function hostConstraintMatch(constraint, host, reachIntoBase) {
-  var c = stripTrailingDot(constraint.toLowerCase()), h = stripTrailingDot(host.toLowerCase());
+  var c = stripTrailingDot(_strToLowerCase(constraint)), h = stripTrailingDot(_strToLowerCase(host));
   if (c === "") return true;
-  if (c.charAt(0) === ".") return h.length > c.length && h.slice(-c.length) === c;
-  if (h === c || (h.length > c.length && h.slice(-(c.length + 1)) === "." + c)) return true;
+  if (_charCodeAt(c, 0) === 46) return h.length > c.length && _strSlice(h, -c.length) === c;
+  if (h === c || (h.length > c.length && _strSlice(h, -(c.length + 1)) === "." + c)) return true;
   if (reachIntoBase === true && h.length > 2 && _charCodeAt(h, 0) === 42 && _charCodeAt(h, 1) === 46) {
     var parent = _strSlice(h, 2);
     if (parent.length > 0 && c.length > parent.length && _strSlice(c, -(parent.length + 1)) === "." + parent) {
@@ -596,16 +615,16 @@ var isFqdnHost = guard.name.isFqdnHost;
  * without them. */
 function _stripBrackets(s) {
   var n = s.length;
-  return (n >= 2 && _charCodeAt(s, 0) === 91 && _charCodeAt(s, n - 1) === 93) ? s.slice(1, n - 1) : s;
+  return (n >= 2 && _charCodeAt(s, 0) === 91 && _charCodeAt(s, n - 1) === 93) ? _strSlice(s, 1, n - 1) : s;
 }
 
 function uriMatch(constraint, uri) {
   var host = uriHost(uri);
   if (host === null) return "unsupported";
   if (!isFqdnHost(host)) return "unsupported";
-  var c = stripTrailingDot(constraint.toLowerCase()), h = stripTrailingDot(host.toLowerCase());
-  if (!isFqdnHost(c.charAt(0) === "." ? c.slice(1) : c)) return "unsupported";
-  if (c.charAt(0) === ".") return h.length > c.length && h.slice(-c.length) === c;
+  var c = stripTrailingDot(_strToLowerCase(constraint)), h = stripTrailingDot(_strToLowerCase(host));
+  if (!isFqdnHost(_charCodeAt(c, 0) === 46 ? _strSlice(c, 1) : c)) return "unsupported";
+  if (_charCodeAt(c, 0) === 46) return h.length > c.length && _strSlice(h, -c.length) === c;
   return h === c;
 }
 
@@ -660,15 +679,20 @@ function certNameForms(cert) {
   var forms = [];
   var san = decodeExt(cert, OID.subjectAltName);
   var hasRfc822San = false;
+  /** @internal The walks that collect the certificate's OWN names come from the captures. A replaced
+   * `Array.prototype.forEach` that skips an entry here leaves the name out of `forms`, and a name
+   * that was never collected is a name no constraint can match: measured, skipping the leaf's
+   * `subjectAltName` entry admitted it under an exclusion that named it exactly. The comparison
+   * operations and the subtree collection were converted first and neither covers this. */
   if (san) {
-    san.value.names.forEach(function (nm) {
+    intrinsic.forEach(san.value.names, function (nm) {
       if (nm.tagNumber === 1) hasRfc822San = true;
       guard.list.append(forms, { tag: nm.tagNumber, value: nm.value === undefined ? null : nm.value });
     });
   }
   if (!hasRfc822San) {
-    cert.subject.rdns.forEach(function (rdn) {
-      rdn.forEach(function (atv) {
+    intrinsic.forEach(cert.subject.rdns, function (rdn) {
+      intrinsic.forEach(rdn, function (atv) {
         if (atv.type === OID.emailAddress && typeof atv.value === "string") guard.list.append(forms, { tag: 1, value: atv.value });
       });
     });
@@ -690,10 +714,15 @@ function checkNameConstraints(state, cert) {
   for (var f = 0; f < forms.length; f++) {
     var nf = forms[f];
     for (var g = 0; g < state.permittedGenerations.length; g++) {
-      var formSubtrees = state.permittedGenerations[g].filter(function (s) { return s.tag === nf.tag; });
+      /** @internal The filter and the walk come from the captures. An EMPTY result here means "this
+       * generation constrains no name of this form", which SKIPS the permitted check for it, so a
+       * replaced `filter` answering with an empty array admits a name no subtree permits. The
+       * excluded direction refuses on a match and the permitted direction refuses on the absence of
+       * one, so this is the arm where a dropped entry opens rather than closes. */
+      var formSubtrees = intrinsic.selectList(state.permittedGenerations[g], function (s) { return s.tag === nf.tag; });
       if (!formSubtrees.length) continue;
       var permitted = false, unsupported = false;
-      formSubtrees.forEach(function (s) {
+      intrinsic.forEach(formSubtrees, function (s) {
         var r = nameMatchesConstraint(nf.tag, nf.value, { tagNumber: s.tag, value: s.base });
         if (r === true) permitted = true;
         else if (r === "unsupported") unsupported = true;
@@ -704,13 +733,18 @@ function checkNameConstraints(state, cert) {
   return guard.verdict.of({ ok: true });
 }
 
+/** @internal The walks that COLLECT the constraints come from the captures, not the live prototypes.
+ * Converting the comparisons alone does not cover the collection that feeds them: a replaced
+ * `Array.prototype.forEach` that skips an excluded-subtree entry means the exclusion is never
+ * recorded, so there is nothing left to compare against. Measured, a leaf naming `www.bad.example`
+ * was ADMITTED with no failure code when the entry was skipped on its way in. */
 function absorbNameConstraints(state, decoded) {
   if (decoded.permittedSubtrees.length) {
-    guard.list.append(state.permittedGenerations, decoded.permittedSubtrees.map(function (st) {
+    guard.list.append(state.permittedGenerations, intrinsic.mapList(decoded.permittedSubtrees, function (st) {
       return { tag: st.base.tagNumber, base: st.base.value };
     }));
   }
-  decoded.excludedSubtrees.forEach(function (st) {
+  intrinsic.forEach(decoded.excludedSubtrees, function (st) {
     guard.list.append(state.excludedSubtrees, { tag: st.base.tagNumber, base: st.base.value });
   });
 }
@@ -761,19 +795,22 @@ function addPolicyNode(state, depth, validPolicy, qualifiers, expectedPolicySet,
     state.policyNodeCount++;
   }
   for (var i = 0; i < parents.length; i++) {
-    if (node.parents.indexOf(parents[i]) !== -1) continue;
+    if (intrinsic.indexOf(node.parents, parents[i]) !== -1) continue;
     guard.list.append(node.parents, parents[i]);
     guard.list.append(parents[i].children, node);
   }
   return node;
 }
 function removePolicyNode(state, node) {
-  node.parents.forEach(function (p) {
-    var idx = p.children.indexOf(node);
+  /** @internal The unlinking walks come from the captures. Removing a node is how a policy stops
+   * being valid for the chain, so a walk that skips an edge leaves the node reachable and the policy
+   * still counted after the step that disqualified it. */
+  intrinsic.forEach(node.parents, function (p) {
+    var idx = intrinsic.indexOf(p.children, node);
     if (idx !== -1) _splice(p.children, idx, 1);
   });
-  node.children.forEach(function (c) {
-    var idx = c.parents.indexOf(node);
+  intrinsic.forEach(node.children, function (c) {
+    var idx = intrinsic.indexOf(c.parents, node);
     if (idx !== -1) _splice(c.parents, idx, 1);
   });
   node.parents = [];
@@ -787,7 +824,10 @@ function removePolicyNode(state, node) {
  *  as NULL. */
 function prunePolicyChildless(state, depth) {
   for (var d = depth; d > 0; d--) {
-    nodesAt(state, d).forEach(function (node) {
+    /** @internal The pruning walk is captured. A node with no children is one no policy below it
+     * depends on, and leaving it in place is what makes an emptied graph read as non-empty, which is
+     * the test `initialExplicitPolicy` fails a chain on. */
+    intrinsic.forEach(nodesAt(state, d), function (node) {
       if (node.children.length === 0) removePolicyNode(state, node);
     });
   }
@@ -809,7 +849,7 @@ function graphSnapshot(root) {
     if (intrinsic.mapHas(indexOfNode, node)) return;
     intrinsic.mapSet(indexOfNode, node, originals.length);
     guard.list.append(originals, node);
-    node.children.forEach(walk);
+    intrinsic.forEach(node.children, walk);
   })(root);
   function idsOf(list) {
     var out = [];
@@ -930,9 +970,9 @@ function _mergedPolicySet(callerSet, anchorSet) {
   var callerAny = callerSet === undefined || callerSet === null || contains(callerSet, OID.anyPolicy);
   var anchorAny = contains(anchorSet, OID.anyPolicy);
   if (anchorAny && callerAny) return [OID.anyPolicy];
-  if (anchorAny) return intrinsic.map(callerSet, function (p) { return p; });
-  if (callerAny) return intrinsic.map(anchorSet, function (p) { return p; });
-  return intrinsic.filter(anchorSet, function (p) { return contains(callerSet, p); });
+  if (anchorAny) return intrinsic.mapList(callerSet, function (p) { return p; });
+  if (callerAny) return intrinsic.mapList(anchorSet, function (p) { return p; });
+  return intrinsic.selectList(anchorSet, function (p) { return contains(callerSet, p); });
 }
 
 /**
@@ -971,7 +1011,7 @@ function _initialState(certs, params, seeds, anchor, n, ta, policySwitches) {
     policyNodeCount: 1,
     maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
     minRsaModulusBits: params.minRsaModulusBits !== undefined ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
-    permittedGenerations: intrinsic.filter(seeds.permittedGenerations, function (g) { return g.length > 0; }),
+    permittedGenerations: intrinsic.selectList(seeds.permittedGenerations, function (g) { return g.length > 0; }),
     excludedSubtrees: seeds.excluded,
     explicitPolicy: _flagSet(policySwitches.initialExplicitPolicy, ta.policyFlags, "requireExplicitPolicy") ? 0 : n + 1,
     inhibitAnyPolicy: _flagSet(policySwitches.initialAnyPolicyInhibit, ta.policyFlags, "inhibitAnyPolicy") ? 0 : n + 1,
@@ -1009,9 +1049,14 @@ function processPolicies(state, cert, i, checks) {
 
     /** @internal RFC 9618 sec. 5.3 step (d)(1): ONE node per policy, carrying every depth i-1 node
      * that expected it. Creating one per parent instead is what made the structure exponential. */
-    policies.forEach(function (p) {
+    /** @internal The walk comes from the capture. It decides which of the certificate's SIGNED
+     * policy entries reach the graph, so a replacement calling the callback with a fabricated
+     * `policyIdentifier` builds a node for an OID the certificate never asserted, and under
+     * `initialExplicitPolicy` with a stated `userInitialPolicySet` that is what makes an otherwise
+     * policy-invalid chain acceptable. */
+    intrinsic.forEach(policies, function (p) {
       if (p.policyIdentifier === OID.anyPolicy) { anyPolicyPresent = true; anyPolicyQualifiers = p.qualifiersBytes; return; }
-      var parents = intrinsic.filter(nodesAt(state, prev), function (node) {
+      var parents = intrinsic.selectList(nodesAt(state, prev), function (node) {
         return contains(node.expectedPolicySet, p.policyIdentifier);
       });
       if (parents.length === 0) {
@@ -1028,14 +1073,16 @@ function processPolicies(state, cert, i, checks) {
      * yet, one node carrying every parent that expected it. */
     if (anyPolicyPresent && anyPolicyActive) {
       var expected = [];
-      nodesAt(state, prev).forEach(function (node) {
-        node.expectedPolicySet.forEach(function (ep) {
-          if (expected.indexOf(ep) === -1) guard.list.append(expected, ep);
+      /** @internal The anyPolicy arm's three walks and its membership test come from the captures
+       * for the same reason: each decides which policies the graph carries at this depth. */
+      intrinsic.forEach(nodesAt(state, prev), function (node) {
+        intrinsic.forEach(node.expectedPolicySet, function (ep) {
+          if (intrinsic.indexOf(expected, ep) === -1) guard.list.append(expected, ep);
         });
       });
-      expected.forEach(function (ep) {
+      intrinsic.forEach(expected, function (ep) {
         if (nodeAt(state, i, ep) !== null) return;
-        var parents = intrinsic.filter(nodesAt(state, prev), function (node) {
+        var parents = intrinsic.selectList(nodesAt(state, prev), function (node) {
           return contains(node.expectedPolicySet, ep);
         });
         addPolicyNode(state, i, ep, anyPolicyQualifiers, [ep], parents);
@@ -1178,15 +1225,23 @@ function prepareNext(state, cert, i, checks) {
 function applyPolicyMappings(state, mappings, i) {
   if (state.policyMapping > 0) {
     var mappedFrom = intrinsic.create(null);
-    mappings.forEach(function (m) {
+    /** @internal Both mapping walks are captured. The pair a mapping carries is what substitutes one
+     * policy for another down the chain, so a walk handing back a fabricated pair maps a policy the
+     * certificate does not state, and one that skips a pair leaves the issuer's policy in place
+     * where the step requires it to be replaced. */
+    intrinsic.forEach(mappings, function (m) {
       if (m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy) return;
       guard.list.append(mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || [], m.subjectDomainPolicy);
     });
     intrinsic.forEach(intrinsic.keys(mappedFrom), function (idp) {
       var node = nodeAt(state, i, idp);
       if (node !== null) {
-        /** @internal (b)(1) */
-        node.expectedPolicySet = mappedFrom[idp].slice();
+        /** @internal (b)(1). The copy is built through a value this toolkit constructs itself. A
+         * captured `slice` still builds its result through the constructor it reads off the
+         * receiver, and this copy BECOMES the node's expectedPolicySet, so a construction that
+         * substitutes an element maps an issuer domain policy to a subject policy the certificate
+         * never authorized and the path reports valid. */
+        node.expectedPolicySet = intrinsic.copyList(mappedFrom[idp]);
         return;
       }
       /** @internal (b)(2): no node for the issuer domain policy, so one is generated under the
@@ -1195,7 +1250,7 @@ function applyPolicyMappings(state, mappings, i) {
       if (anyHere === null) return;
       var anyPrev = nodeAt(state, i - 1, OID.anyPolicy);
       if (anyPrev === null) return;
-      addPolicyNode(state, i, idp, anyHere.qualifierSet[0] || null, mappedFrom[idp].slice(), [anyPrev]);
+      addPolicyNode(state, i, idp, anyHere.qualifierSet[0] || null, intrinsic.copyList(mappedFrom[idp]), [anyPrev]);
     });
     return;
   }
@@ -1203,7 +1258,7 @@ function applyPolicyMappings(state, mappings, i) {
    * and every ancestor it leaves childless goes with it. */
   if (!state.validPolicyGraph) return;
   var deleted = false;
-  mappings.forEach(function (m) {
+  intrinsic.forEach(mappings, function (m) {
     if (m.issuerDomainPolicy === OID.anyPolicy) return;
     var node = nodeAt(state, i, m.issuerDomainPolicy);
     if (node !== null) { removePolicyNode(state, node); deleted = true; }
@@ -1479,7 +1534,13 @@ async function _validate(path, opts, run, scope) {
       throw E("path/bad-input", "validate: opts.minRsaModulusBits may only raise the " + constants.LIMITS.RSA_MIN_MODULUS_BITS + "-bit minimum, not lower it");
     }
   }
-  var certs = path.map(function (c, ci) { return coerceCert(c, "validate: path[" + ci + "]"); });
+  /** @internal The certificate list is built through a value this toolkit constructs itself, because
+   * its LENGTH is what bounds the validation loop below. A built-in projection builds its result
+   * through the constructor it reads off the receiver, and one answering with a shorter object drops
+   * certificates from the middle of the path: the loop then never reaches the intermediate that
+   * carried a name constraint or a basicConstraints path-length bound, and the shortened path is
+   * what gets validated. */
+  var certs = intrinsic.mapList(path, function (c, ci) { return coerceCert(c, "validate: path[" + ci + "]"); });
   var n = certs.length;
   if (n < 1) throw E("path/empty-path", "validate: the certification path is empty");
   /** @internal The four switches that turn a requirement on, each read as the boolean it documents
@@ -1564,7 +1625,7 @@ async function _validate(path, opts, run, scope) {
   var taConstraints = _anchorRfc5914Constraints(anchor);
   var seeds = {
     permittedGenerations: [callerPermitted, anchorNc.permitted, taConstraints.permitted],
-    excluded: intrinsic.concat(intrinsic.concat(callerExcluded, anchorNc.excluded), taConstraints.excluded),
+    excluded: intrinsic.concatList(intrinsic.concatList(callerExcluded, anchorNc.excluded), taConstraints.excluded),
   };
   var anchorNameConstraintsApplied = anchorNc.permitted.length > 0 || anchorNc.excluded.length > 0 ||
     taConstraints.permitted.length > 0 || taConstraints.excluded.length > 0;
@@ -1855,12 +1916,16 @@ function shieldResults(results) {
 function userConstrainedPolicies(state, n) {
   if (!state.validPolicyGraph) return [];
   var authority = [];
+  /** @internal The walks and membership tests that build this set are captured. This IS the policy
+   * answer the caller reads and the one `initialExplicitPolicy` requires to be non-empty, so a walk
+   * that adds a policy no node carries reports a chain as valid for it, and one that drops a policy
+   * fails a chain that satisfies the stated set. */
   function note(node) {
-    if (authority.indexOf(node.validPolicy) === -1) guard.list.append(authority, node.validPolicy);
+    if (intrinsic.indexOf(authority, node.validPolicy) === -1) guard.list.append(authority, node.validPolicy);
   }
   /** @internal (g)(2) */
   for (var d = 1; d <= n; d++) {
-    nodesAt(state, d).forEach(function (node) {
+    intrinsic.forEach(nodesAt(state, d), function (node) {
       if (node.validPolicy === OID.anyPolicy) return;
       if (node.parents.length === 1 && node.parents[0].validPolicy === OID.anyPolicy) note(node);
     });
@@ -1872,9 +1937,9 @@ function userConstrainedPolicies(state, n) {
   /** @internal (g)(5) and (g)(6) */
   var uips = state.userInitialPolicySet;
   if (contains(uips, OID.anyPolicy)) return authority;
-  var out = intrinsic.filter(authority, function (p) { return contains(uips, p); });
+  var out = intrinsic.selectList(authority, function (p) { return contains(uips, p); });
   if (contains(authority, OID.anyPolicy)) {
-    uips.forEach(function (p) { if (out.indexOf(p) === -1) guard.list.append(out, p); });
+    intrinsic.forEach(uips, function (p) { if (intrinsic.indexOf(out, p) === -1) guard.list.append(out, p); });
   }
   return out;
 }
@@ -2077,7 +2142,10 @@ function crlChecker(crls, opts) {
   if (crls !== undefined && crls !== null && !intrinsic.isArray(crls)) {
     throw E("path/bad-input", "crlChecker: crls must be an array of CRLs");
   }
-  var parsed = (crls || []).map(function (c, ci) {
+  /** @internal Mapped with the protocol-free verb: `map` builds its result through a constructor read
+   * off the receiver and a species read off that, and a caller's array is where that constructor comes
+   * from. A result that reads as empty is a checker with no CRLs, which answers "nothing revoked". */
+  var parsed = intrinsic.mapList(crls || [], function (c, ci) {
     return guard.parsed.acceptDerived(c, "crl", crl.parse, E, "path/bad-input",
       "crlChecker: crls[" + ci + "]");
   });
@@ -2277,15 +2345,22 @@ function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
     d = resolveDescriptor(sigAlg);
     assertKeyMatchesSigAlg(spkiBytes, sigAlg.oid, d);
   } catch (_e) { return _resolve(_Promise, false); }
-  if (d.composite) return compositeSig.compositeVerify(spkiBytes, rawSig, tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature").then(function (r) { return r.ok === true; });
+  if (d.composite) {
+    return intrinsic.chain(compositeSig.compositeVerify(spkiBytes, rawSig, tbsBytes, d.composite,
+      PathError, "path/unsupported-algorithm", "path/bad-signature"), function (r) { return r.ok === true; });
+  }
   /** @internal RFC 9802 sec. 6 names the CertificateList as well as the Certificate, so a revocation list
    * signed with a stateful hash-based key reaches the same engine the certificate path uses. */
   if (d.shbs) return _resolve(_Promise, _shbsVerify(spkiBytes, rawSig, tbsBytes).ok === true);
-  return _importVerifyKey(spkiBytes, d).then(function (key) {
+  /** @internal The same two continuations, for the engine every other verifier in this toolkit is
+   * wired to: this is what tells a CRL, a CSR, a CRMF proof and an OCSP response's signature from
+   * one that does not verify, and a `true` resolved past the callback is that verdict. */
+  var checked = intrinsic.chain(_importVerifyKey(spkiBytes, d), function (key) {
     var sig = rawSig;
     if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
     return _subtleVerify(subtle, d.verify, key, sig, tbsBytes);
-  }).then(function (ok) { return ok === true; }, function () { return false; });
+  });
+  return intrinsic.chain(checked, function (ok) { return ok === true; }, function () { return false; });
 }
 
 crlVerify.setEngine(_verifyWithSpki);
@@ -2364,7 +2439,9 @@ function ocspChecker(responses) {
   if (responses !== undefined && responses !== null && !intrinsic.isArray(responses)) {
     throw E("path/bad-input", "ocspChecker: responses must be an array of OCSP responses");
   }
-  var parsed = (responses || []).map(function (r) { return _ocspFromBytes(r); });
+  /** @internal Mapped with the protocol-free verb, for the reason at `crlChecker`: a result reading as
+   * empty is a checker holding no responses, and every certificate it is asked about is "unknown". */
+  var parsed = intrinsic.mapList(responses || [], function (r) { return _ocspFromBytes(r); });
   return {
     check: async function (cert, issuer, ctx) {
       var time = ctx.time;
@@ -2501,7 +2578,10 @@ function _ocspFromBytes(response) {
 
 function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   opts = opts || {};
-  if (!guard.time.isDate(time) || isNaN(guard.time.instantOf(time))) {
+  /** @internal The captured finite test rather than a live `isNaN`: a valid Date's instant is always
+   * finite and an invalid one's is not, so the two answer the same question, and the instant is read
+   * ONCE into the value the test decides on. */
+  if (!guard.time.isDate(time) || !intrinsic.numberIsFinite(guard.time.instantOf(time))) {
     return _reject(_Promise, E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
   }
   /** @internal Snapshotted in the synchronous prologue: the bytes compared are the bytes the caller
@@ -2525,7 +2605,11 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   if (!boundName) {
     return _resolve(_Promise, unbound("the supplied issuer certificate's subject does not match the target certificate's issuer"));
   }
-  return builtinVerify({ workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes }, cert).then(function (sig) {
+  /** @internal Both continuations are taken from the capture, for the reason the verifier's own are:
+   * the first reads the signature verdict that binds this certificate to the supplied issuer, and
+   * the second reads the revocation status the response carries. A settled value in place of either
+   * reports a status for a certificate whose issuer was never confirmed. */
+  return intrinsic.chain(builtinVerify({ workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes }, cert), function (sig) {
     if (!sig.ok) return unbound("the target certificate's signature does not verify under the supplied issuer certificate's key");
     var issuerCtx = { workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes, workingIssuerName: issuerCert.subject, issuerCert: issuerCert };
     var issuerNameCandidates = [cert.issuer.bytes];
@@ -2534,7 +2618,8 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     var issuerKeyBits;
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
     catch (_e) { return unbound("the issuer public key could not be read to recompute the OCSP CertID"); }
-    return ocspCore.evaluateResponse(parsedResponse, cert, issuerCtx, issuerKeyBits, issuerNameCandidates, time, opts.historicalMode === true).then(function (v) {
+    return intrinsic.chain(ocspCore.evaluateResponse(parsedResponse, cert, issuerCtx, issuerKeyBits,
+      issuerNameCandidates, time, opts.historicalMode === true), function (v) {
       if (v.revoked) return _withNonceRule(guard.verdict.of({ status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason }), parsedResponse, wantNonce, nonce);
       if (v.sawGood) return _withNonceRule(guard.verdict.of({ status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" }), parsedResponse, wantNonce, nonce);
       return _withNonceRule(guard.verdict.of({ status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason }), parsedResponse, wantNonce, nonce);
@@ -2606,7 +2691,7 @@ function resolvePurposeOpts(opts) {
     if (!intrinsic.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
       throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
     }
-    requiredEku = opts.requiredEku.map(function (p) {
+    requiredEku = intrinsic.mapList(opts.requiredEku, function (p) {
       if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
       if (_startsWithDigit(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
       var dotted = oid.byName(p);
@@ -3197,7 +3282,7 @@ function _assertUserInitialPolicySet(uips, prefix) {
  * A candidate whose path length constraint cannot cover the certificates below it sorts under every candidate
  * that can, whatever the heuristics score it, and the score orders within each of the two groups. */
 function _pushCandidates(frame, scored, stack, counter, down) {
-  scored.sort(function (a, b) {
+  intrinsic.sort(scored, function (a, b) {
     if (!a.ineligible !== !b.ineligible) return a.ineligible ? -1 : 1;
     return a.score - b.score;
   });
@@ -3210,21 +3295,23 @@ function _pushCandidates(frame, scored, stack, counter, down) {
     var childKeys = new Set(frame.keys);
     intrinsic.setAdd(childKeys, candKey);
     guard.list.append(stack, down
-      ? { chain: intrinsic.concat(frame.chain, [cand]), hop: frame.hop + 1, keys: childKeys, anchor: frame.anchor }
-      : { chain: intrinsic.concat([cand], frame.chain), hop: frame.hop + 1, keys: childKeys });
+      ? { chain: intrinsic.concatList(frame.chain, [cand]), hop: frame.hop + 1, keys: childKeys, anchor: frame.anchor }
+      : { chain: intrinsic.concatList([cand], frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
   return n;
 }
 
 
 function _isBlockedAiaHost(host) {
-  if (host.charAt(0) === "[" && host.charAt(host.length - 1) === "]") host = host.slice(1, -1);
-  if (net.isIP(host) === 0) return false;
+  if (_charCodeAt(host, 0) === 91 && _charCodeAt(host, host.length - 1) === 93) host = _strSlice(host, 1, -1);
+  if (_netIsIP(host) === 0) return false;
   return httpTransport.isBlockedIp(host);
 }
 
 function _aiaParseBody(body, contentType, maxCerts) {
-  var certsFirst = String(contentType || "").toLowerCase().indexOf("pkcs7") >= 0;
+  /** @internal The conversion and the fold are captured: together they decide HOW a fetched AIA
+   * response body is parsed, and therefore which certificates are taken out of it. */
+  var certsFirst = _strIndexOf(_strToLowerCase(intrinsic.String(contentType || "")), "pkcs7") >= 0;
   var order = certsFirst ? ["certs", "cert"] : ["cert", "certs"];
   for (var i = 0; i < order.length; i++) {
     try {
@@ -3267,7 +3354,7 @@ async function _fetchAiaIssuers(current, aia) {
      * and the literal-versus-name question have to be answered about the same host. */
     var uHost = _urlHostname(u);
     if (_isBlockedAiaHost(uHost)) continue;
-    if (net.isIP(_stripBrackets(uHost)) === 0 && !aia.transportGuardsAddresses) continue;
+    if (_netIsIP(_stripBrackets(uHost)) === 0 && !aia.transportGuardsAddresses) continue;
     _urlSetHash(u, "");
     var uHref = _urlHref(u);
     if (intrinsic.setHas(aia.fetchedUrls, uHref) || intrinsic.setHas(seenThisCert, uHref)) continue;
@@ -3397,7 +3484,7 @@ var _BUILD_OPTS = (function () {
     maxAiaPerCert: 1, maxCandidatesConsidered: 1, maxDepth: 1, maxPathCerts: 1,
     maxResponseBytes: 1, time: 1, tls: 1, transport: 1, trustAnchors: 1, validate: 1
   });
-  Object.keys(_VALIDATE_OPTS).forEach(function (k) { o[k] = 1; });
+  intrinsic.forEach(intrinsic.keys(_VALIDATE_OPTS), function (k) { o[k] = 1; });
   return o;
 })();
 
@@ -3453,7 +3540,7 @@ async function build(leaf, opts) {
   var poolCeiling = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES;
   if (poolInput.length > poolCeiling) throw E("path/bad-input", "build: the candidate pool has " + poolInput.length + " certificates, exceeding the " + poolCeiling + " ceiling");
   var pool;
-  try { pool = intrinsic.map(poolInput, coerceCert); }
+  try { pool = intrinsic.mapList(poolInput, coerceCert); }
   catch (e) { throw E("path/bad-input", "build: a candidate certificate did not parse", e); }
   var poolDerKeys = new Set();
   for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
@@ -3539,7 +3626,7 @@ async function build(leaf, opts) {
   if (buildExclRaw != null) forwarded.initialExcludedSubtrees = buildExclSeeds;
   function validateOpts(anchor) {
     var vo = Object.create(null);
-    Object.keys(forwarded).forEach(function (f) { vo[f] = forwarded[f]; });
+    intrinsic.forEach(intrinsic.keys(forwarded), function (f) { vo[f] = forwarded[f]; });
     vo.trustAnchors = anchor;
     return vo;
   }
@@ -3578,7 +3665,7 @@ async function build(leaf, opts) {
       var frontierCert = rframe.chain.length ? rframe.chain[rframe.chain.length - 1] : null;
       var frontierName = frontierCert ? frontierCert.subject.rdns : rframe.anchor.name.rdns;
       if (nameMatchSoft(leafCert.issuer.rdns, frontierName)) {
-        var rpath = intrinsic.concat(rframe.chain, [leafCert]);
+        var rpath = intrinsic.concatList(rframe.chain, [leafCert]);
         if (!doValidate) { success = { path: rpath, trustAnchor: rframe.anchor }; break; }
         anyChainAssembled = true;
         var rres = await validate(rpath, validateOpts(rframe.anchor));
@@ -3650,15 +3737,17 @@ async function build(leaf, opts) {
 
     for (var ai = 0; ai < anchors.length; ai++) {
       if (!nameMatchSoft(current.issuer.rdns, anchors[ai].name.rdns)) continue;
-      if (!doValidate) { success = { path: frame.chain.slice(), trustAnchor: anchors[ai] }; break; }
+      /** @internal The REPORTED path is copied the same way the validated one is read, so the chain
+       * an operator sees in the result cannot differ from the chain that was checked. */
+      if (!doValidate) { success = { path: intrinsic.copyList(frame.chain), trustAnchor: anchors[ai] }; break; }
       anyChainAssembled = true;
       var res = await validate(frame.chain, validateOpts(anchors[ai]));
       if (res.valid) {
-        var acc = { valid: true, path: frame.chain.slice(), trustAnchor: anchors[ai], result: res };
+        var acc = { valid: true, path: intrinsic.copyList(frame.chain), trustAnchor: anchors[ai], result: res };
         if (!selectByPolicy) { success = acc; break; }
         if (_policyScore(res, uipsDistinct) >= uipsDistinct.length) { success = acc; break; }
         guard.list.append(accepted, acc);
-      } else if (!bestFail) bestFail = { path: frame.chain.slice(), trustAnchor: anchors[ai], result: res };
+      } else if (!bestFail) bestFail = { path: intrinsic.copyList(frame.chain), trustAnchor: anchors[ai], result: res };
     }
     if (success) continue;
 
@@ -3729,7 +3818,11 @@ function _anyExpandable(scored, frame) {
  * the documented reason an inline require is permitted. */
 function fetchingChecker(opts) { return require("./revocation-fetch").fetchingChecker(opts); }
 
-module.exports = {
+/** @internal Frozen, because a consumer reads a verb off this object at the call and the verb IS the
+ *  check at that point. The metadata anchoring fold reaches `validate` this way, so a replacement
+ *  resolving `{ valid: true }` makes an x5c leaf unrelated to every supplied root pass, and the
+ *  catalogue that leaf signed is then branded verified. */
+module.exports = intrinsic.freeze({
   validate: validate,
   build: build,
   anchorFromCert: anchorFromCert,
@@ -3739,4 +3832,4 @@ module.exports = {
   verifyOcspResponse: verifyOcspResponse,
   PROCESSED_EXTENSIONS: PROCESSED_EXTENSIONS,
   TARGET_UNPROCESSED_IF_CRITICAL: TARGET_UNPROCESSED_IF_CRITICAL,
-};
+});

package/lib/pbes2.js

@@ -165,16 +165,23 @@ function pbmac1AlgId(desc) {
 
 function pbmac1(pwBytes, salt, iterationCount, keyLength, prfHash, macHash, message) {
   var subtle = webcrypto.webcrypto.subtle;
-  return subtle.importKey("raw", pwBytes, { name: "PBKDF2" }, false, ["deriveBits"]).then(function (baseKey) {
-    return subtle.deriveBits({ name: "PBKDF2", salt: salt, iterations: iterationCount, hash: prfHash }, baseKey, keyLength * 8);
-  }).then(function (bits) {
+  /** @internal Every step is continued through the capture, and the wipe is attached on BOTH outcomes
+   * rather than through `finally`, which calls the receiver's own `then`. These steps derive the key
+   * a PBMAC1 integrity tag is computed under, so a replacement settling one hands back a tag computed
+   * under bytes nobody derived, and skips the wipe that keeps the derived key from outliving it. */
+  var base = guard.async.chain(subtle.importKey("raw", pwBytes, { name: "PBKDF2" }, false, ["deriveBits"]),
+    function (baseKey) {
+      return subtle.deriveBits({ name: "PBKDF2", salt: salt, iterations: iterationCount, hash: prfHash }, baseKey, keyLength * 8);
+    });
+  var tagged = guard.async.chain(base, function (bits) {
     var mk = Buffer.from(bits);
-    return subtle.importKey("raw", mk, { name: "HMAC", hash: macHash }, false, ["sign"]).then(function (hmacKey) {
-      return subtle.sign({ name: "HMAC" }, hmacKey, message);
-    }).finally(function () {
+    var signed = guard.async.chain(subtle.importKey("raw", mk, { name: "HMAC", hash: macHash }, false, ["sign"]),
+      function (hmacKey) { return subtle.sign({ name: "HMAC" }, hmacKey, message); });
+    return guard.async.cleanup(signed, function () {
       guard.secret.zeroize(mk, webcrypto.WebCryptoError, "webcrypto/operation", "the PBMAC1 key");
     });
-  }).then(function (sig) { return Buffer.from(sig); });
+  });
+  return guard.async.chain(tagged, function (sig) { return Buffer.from(sig); });
 }
 
 module.exports = {