@blamejs/pki 0.8.59 → 0.8.60

package/lib/revocation-fetch.js

@@ -14,10 +14,19 @@ var ocsp = require("./ocsp");
 var crlSchema = require("./schema-crl");
 var crlVerify = require("./crl-verify");
 var httpTransport = require("./http-transport");
-var mime = require("./mime");
 var pathValidate = require("./path-validate");
 var ocspSchema = require("./schema-ocsp");
 
+/** @internal Taken when the module loads, so a replaced prototype cannot decide what a host, a media
+ * type or a reason string reads as at the moment one is used. `isIP` is taken for the same reason and
+ * decides more: read off the module object at call time, a replacement answering 0 made every
+ * address literal look like a name, so the blocked-address check was skipped and a distribution point
+ * naming a loopback or link-local address was fetched. */
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _isIP = net.isIP;
+var _isBlockedIp = httpTransport.isBlockedIp;
+
 var PathError = frameworkError.PathError;
 function E(code, message, cause) { return new PathError(code, message, cause); }
 
@@ -64,7 +73,12 @@ var TRANSPORT_SHAPE = "(request) => Promise<{ status, headers, body }>";
  * status, so the difference lives in the reason, and the refusal is recorded as a skip rather than
  * swallowed. */
 function _softDecode(holder, extOid, skips) {
-  var list = holder.extensions || holder.crlExtensions || [];
+  /** @internal Own reads. A certificate or CRL carrying no extensions has no own slot for either
+   * name, so the read answered from `Object.prototype`, and an inherited getter supplied a list whose
+   * entries this then decoded and reported on. */
+  var list = intrinsic.hasOwn(holder, "extensions") ? holder.extensions
+    : intrinsic.hasOwn(holder, "crlExtensions") ? holder.crlExtensions : [];
+  if (!intrinsic.isArray(list)) list = [];
   var found = guard.list.anyMatches(list, function (e) { return !!e && e.oid === extOid; })
     ? _firstWithOid(list, extOid) : null;
   if (found === null) return null;
@@ -175,9 +189,10 @@ function _acceptableUrl(value, net_) {
   var scheme = _urlProtocol(u);
   if (scheme !== "https:" && !(net_.allowHttp && scheme === "http:")) return _no("is not one this client fetches");
   var host = _urlHostname(u);
-  if (host.charAt(0) === "[" && host.charAt(host.length - 1) === "]") host = host.slice(1, -1);
-  if (net.isIP(host) !== 0) {
-    if (httpTransport.isBlockedIp(host)) return _no("is not one this client fetches");
+  /** @internal 0x5b and 0x5d are `[` and `]`, which bracket an IPv6 literal in an authority. */
+  if (_charCodeAt(host, 0) === 0x5b && _charCodeAt(host, host.length - 1) === 0x5d) host = _strSlice(host, 1, -1);
+  if (_isIP(host) !== 0) {
+    if (_isBlockedIp(host)) return _no("is not one this client fetches");
   } else if (!net_.guardsAddresses) {
     return _no("names a host whose resolved address opts.transport does not declare it filters");
   }
@@ -285,27 +300,71 @@ async function _fetchOne(state, req, what) {
         allowPlaintextHttp: state.allowPlaintextHttp }],
       E, "path/bad-input", "opts.transport"),
     timeout, E, "path/revocation-fetch-failed", what);
-  res = res || {};
-  if (res.status !== 200) {
-    throw E("path/revocation-fetch-failed", what + " returned HTTP " + res.status + " (only 200 carries a revocation object; no redirect is followed)");
+  /** @internal The response read as a record of its OWN fields. The transport contract is a plain
+   * `{ status, headers, body, tls }`, and a transport can hand back an object carrying none of them:
+   * each read then answered from `Object.prototype`, so an inherited status of 200 with an inherited
+   * body and headers was accepted as a revocation response. The status is reported through the safe
+   * formatter rather than concatenated, since concatenating it ran the value's own conversion. */
+  var out = guard.identifier.ownOptions(res);
+  if (out.status !== 200) {
+    throw E("path/revocation-fetch-failed", what + " returned HTTP " + guard.text.showValue(out.status) +
+      " (only 200 carries a revocation object; no redirect is followed)");
+  }
+  /** @internal A byte source, a primitive string, or absent. Converting anything else through
+   * `String` ran the value's OWN `toString`, so a transport handing back an object decided the bytes
+   * a CRL or an OCSP response is then parsed from, and capturing `String` does not close that: the
+   * capture fixes which function runs, not which hook it calls on its argument. */
+  var raw = out.body;
+  var body;
+  if (guard.bytes.isByteSource(raw)) {
+    body = guard.bytes.source(raw, PathError, "path/revocation-fetch-failed", "the revocation response body");
+  } else if (raw === null || raw === undefined) {
+    body = intrinsic.bufferFrom("", "latin1");
+  } else if (typeof raw === "string") {
+    body = intrinsic.bufferFrom(raw, "latin1");
+  } else {
+    throw E("path/revocation-fetch-failed", what + " returned a body that is neither bytes nor a " +
+      "string, so what it holds would be decided by converting it");
   }
-  var body = guard.bytes.isByteSource(res.body)
-    ? guard.bytes.source(res.body, PathError, "path/revocation-fetch-failed", "the revocation response body")
-    : Buffer.from(res.body == null ? "" : String(res.body), "latin1");
   if (body.length === 0) throw E("path/revocation-fetch-failed", what + " returned an empty body");
   if (body.length > state.maxResponseBytes) {
     throw E("path/revocation-fetch-failed", what + " returned " + body.length + " bytes, over the " + state.maxResponseBytes + "-byte cap");
   }
-  return { body: body, contentType: _contentType(res.headers) };
+  return { body: body, contentType: _contentType(out.headers) };
+}
+
+/** @internal 0x20 space, 0x09 tab, 0x0a line feed, 0x0d carriage return. */
+function _isAsciiSpace(code) {
+  return code === 0x20 || code === 0x09 || code === 0x0a || code === 0x0d;
 }
 
 function _contentType(headers) {
-  var h = headers || {};
+  /** @internal Snapshotted to its own fields ONCE, then read from the snapshot. Enumerated and then
+   * re-read, the two reads could disagree: a headers proxy deleted its own `content-type` during the
+   * enumeration, so the read that followed answered from the prototype and named a media type the
+   * headers no longer carried. */
+  var h = guard.identifier.ownOptions(headers);
   var keys = guard.identifier.optionNames(h);
   for (var i = 0; i < keys.length; i++) {
-    if (keys[i].toLowerCase() !== "content-type") continue;
-    try { return mime.parse(String(h[keys[i]])).type; }
-    catch (_e) { return null; }     // allow:swallow-unverified an unreadable media type is reported as absent, and it never selects a parser
+    if (intrinsic.toLowerCase(keys[i]) !== "content-type") continue;
+    /** @internal Only a primitive string. Converted through `String`, a header holding an object ran
+     * that object's own `toString` and named the media type from it. An absent media type never
+     * selects a parser, so anything else is reported as absent. */
+    var value = h[keys[i]];
+    if (typeof value !== "string") return null;
+    /** @internal The media type is the span before the first `;`, with surrounding ASCII space
+     * dropped and the case folded. `mime.parse` reads a whole MIME ENTITY out of BYTES, so handing
+     * it this header value threw on every response and the catch reported EVERY media type as
+     * absent, which left the notes that compare it unable to fire at all. 0x3b is `;`. */
+    var end = value.length;
+    for (var c = 0; c < value.length; c++) {
+      if (_charCodeAt(value, c) === 0x3b) { end = c; break; }
+    }
+    var start = 0;
+    while (start < end && _isAsciiSpace(_charCodeAt(value, start))) start += 1;
+    while (end > start && _isAsciiSpace(_charCodeAt(value, end - 1))) end -= 1;
+    if (end === start) return null;
+    return intrinsic.toLowerCase(_strSlice(value, start, end));
   }
   return null;
 }
@@ -771,9 +830,9 @@ function _unknown(reason, notes, skips) {
  * second error code. */
 function _reason(head, notes, skips) {
   var parts = [head];
-  if (skips.length) _append(parts, "skipped: " + skips.join("; "));
-  if (notes.length) _append(parts, "noted: " + notes.join("; "));
-  return parts.join(" | ");
+  if (skips.length) _append(parts, "skipped: " + intrinsic.join(skips, "; "));
+  if (notes.length) _append(parts, "noted: " + intrinsic.join(notes, "; "));
+  return intrinsic.join(parts, " | ");
 }
 
 module.exports = { fetchingChecker: fetchingChecker };

package/lib/scep.js

@@ -38,6 +38,11 @@
 var frameworkError = require("./framework-error");
 var ScepError = frameworkError.ScepError;
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with. `push` STORES at the index, and a store walks
+ *  the prototype chain for a setter, so an accessor inherited at an array index receives each element
+ *  as it is appended and the index reads back whatever its getter answers. A CertRep's attribute list
+ *  is signed, so a discarded failInfo is a FAILURE response signed with other failure semantics. */
+var _push = intrinsic.append;
 /** @internal The URL parser, taken at load: what it returns names the host an operation is sent to,
  *  and a redirect is resolved against the current operation URL with it. The conversion the parser is
  *  handed is taken with it, since a replacement answers with a host of its own. */
@@ -136,13 +141,16 @@ function _readIssuancePayload(der) {
     if (rc[i].tagClass !== "universal") throw _err("scep/bad-certificate", "a SUCCESS CertRep certificates field carried a tagged CertificateChoices alternative, not a plain X.509 certificate (RFC 8894 sec. 3.4)");
     try { schemaX509.parse(rc[i].bytes); }
     catch (e) { throw _err("scep/bad-certificate", "a SUCCESS CertRep carried a non-certificate in its certificates field", e); }
-    certs[i] = rc[i].bytes;
+    /** @internal Appended by defining the index. A store consults a setter inherited at the index,
+     *  which would take the bytes the parse above just accepted and leave the list reading back
+     *  whatever the getter answers, so the certificate returned is not the one that was checked. */
+    intrinsic.append(certs, rc[i].bytes);
   }
   for (i = 0; i < rl.length; i++) {
     if (rl[i].tagClass !== "universal") throw _err("scep/bad-crl", "a SUCCESS CertRep crls field carried a tagged RevocationInfoChoice alternative, not a plain X.509 CRL (RFC 5652 sec. 10.2.1)");
     try { schemaCrl.parse(rl[i].bytes); }
     catch (e) { throw _err("scep/bad-crl", "a SUCCESS CertRep carried a non-CRL in its crls field", e); }
-    crls[i] = rl[i].bytes;
+    intrinsic.append(crls, rl[i].bytes);
   }
   if (certs.length === 0 && crls.length === 0) {
     throw _err("scep/empty-response", "a SUCCESS CertRep messageData carried neither a certificate nor a CRL (RFC 8894 sec. 3.3.2)");
@@ -378,8 +386,8 @@ async function _buildCertRep(spec) {
     if (spec.pkiStatus === "FAILURE") {
       var failCode = FAIL_INFO[guard.text.keyOf(spec.failInfo)];
       if (failCode == null) throw _err("scep/bad-input", "a FAILURE CertRep must carry a failInfo of badAlg / badMessageCheck / badRequest / badTime / badCertId (RFC 8894 sec. 3.2.1.4), got " + _showValue(spec.failInfo));
-      attrs.push(_attr("scepFailInfo", b.printable(failCode)));
-      if (spec.failInfoText != null) attrs.push(_attr("scepFailInfoText", b.utf8(String(spec.failInfoText))));
+      _push(attrs,_attr("scepFailInfo", b.printable(failCode)));
+      if (spec.failInfoText != null) _push(attrs,_attr("scepFailInfoText", b.utf8(String(spec.failInfoText))));
     }
   }
   var signOpts = { additionalSignedAttributes: attrs };
@@ -794,8 +802,8 @@ var CAP_CANON = Object.assign(Object.create(null), { AES: "AES", DES3: "DES3", G
   RENEWAL: "Renewal", "SHA-1": "SHA-1", "SHA-256": "SHA-256", "SHA-512": "SHA-512", SCEPSTANDARD: "SCEPStandard" });
 function _splitLines(s) {
   var out = [], start = 0, i, n = s.length;
-  for (i = 0; i < n; i++) if (s.charCodeAt(i) === 0x0a) { out.push(s.slice(start, i)); start = i + 1; }
-  out.push(s.slice(start));
+  for (i = 0; i < n; i++) if (s.charCodeAt(i) === 0x0a) { _push(out,s.slice(start, i)); start = i + 1; }
+  _push(out,s.slice(start));
   return out;
 }
 

package/lib/schema-attrcert.js

@@ -479,13 +479,15 @@ function _decodeClassList(node, C) {
   var bs;
   try { bs = asn1.read.bitString(node); } catch (e) { throw NS.E(C, "Clearance classList must be a BIT STRING", e); }
   schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw NS.E(C, m); });
+  /** @internal Both lists are APPENDED to by defining the index: a store at an index an array has no
+   * own property at walks the prototype chain for a setter, which takes the element being appended. */
   // allow:registry-table-inherits-object-prototype -- the classList record an operator reads by field name, whose keys are the fixed _CLASSLIST_NAMES; the omitted-classList default at the foot of this file builds the same shape
   var names = [], flags = {}, reserved = [];
   var total = bs.bytes.length * 8 - bs.unusedBits;
   for (var bit = 0; bit < total; bit++) {
     if ((bs.bytes[bit >> 3] & (0x80 >> (bit & 7))) === 0) continue;
-    if (bit < _CLASSLIST_NAMES.length) { names.push(_CLASSLIST_NAMES[bit]); flags[_CLASSLIST_NAMES[bit]] = true; }
-    else reserved.push(bit);
+    if (bit < _CLASSLIST_NAMES.length) { intrinsic.append(names, _CLASSLIST_NAMES[bit]); flags[_CLASSLIST_NAMES[bit]] = true; }
+    else intrinsic.append(reserved, bit);
   }
   return { names: names, flags: flags, reservedBits: reserved };
 }