@blamejs/pki 0.8.61 → 0.9.1

package/lib/jose.js

@@ -325,7 +325,7 @@ function assertPublicJwk(jwk) {
  */
 var _VERIFY_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, profile: 1 });
 async function verify(jws, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, E, "jose/bad-input", "unknown pki.jose.verify option ");
   /** @internal opts.key is examined several times: the type gate, the RFC 7638 thumbprint comparison
    *  against the embedded jwk, and the key the signature is verified under. An option reached through
@@ -456,7 +456,7 @@ function _fixedPayload(supplied) {
 }
 
 async function sign(opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, _SIGN_KEYS, E, "jose/bad-input", "unknown pki.jose.sign option ");
   var fixedPayload = _fixedPayload(opts.payload);
   var headerJson;
@@ -496,7 +496,7 @@ async function sign(opts) {
   var protectedB64 = b64uEncode(headerBytes);
   var payloadB64 = payload.length === 0 ? "" : b64uEncode(payload);
   var signingInput = _bufferFrom(protectedB64 + "." + payloadB64, "ascii");
-  var jwk = header.jwk || opts.jwk || {};
+  var jwk = header.jwk || opts.jwk || intrinsic.create(null);
   /** @internal `suppliedKey` is the reading taken at the top, so the key adopted for signing, the key the
    *  hash-to-algorithm check approved and the key the expected signature width is computed from are all
    *  one key. */

package/lib/merkle.js

@@ -274,7 +274,7 @@ function emptyRootHash() {
  */
 var _INCLUSION_KEYS = _assign(_create(null), { leafIndex: 1, treeSize: 1, leafHash: 1, rootHash: 1, proof: 1 });
 function verifyInclusion(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _INCLUSION_KEYS, function (c, m) { return new MerkleError(c, m); },
     "merkle/bad-input", "unknown verifyInclusion option ");
   var leafIndex = _coerceCoord(opts.leafIndex, "leafIndex");
@@ -346,7 +346,7 @@ function verifyInclusion(opts) {
  */
 var _CONSISTENCY_KEYS = _assign(_create(null), { oldSize: 1, newSize: 1, oldRoot: 1, newRoot: 1, proof: 1 });
 function verifyConsistency(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _CONSISTENCY_KEYS, function (c, m) { return new MerkleError(c, m); },
     "merkle/bad-input", "unknown verifyConsistency option ");
   var oldSize = _coerceCoord(opts.oldSize, "oldSize");
@@ -456,7 +456,7 @@ function root(leafHashes) {
  */
 var _INCLUSION_PROOF_KEYS = _assign(_create(null), { leafHashes: 1, leafIndex: 1 });
 function inclusionProof(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _INCLUSION_PROOF_KEYS, _merkleErr,
     "merkle/bad-input", "unknown inclusionProof option ");
   var leaves = _leafArray(opts.leafHashes, "leafHashes");
@@ -498,7 +498,7 @@ function inclusionProof(opts) {
  */
 var _CONSISTENCY_PROOF_KEYS = _assign(_create(null), { leafHashes: 1, oldSize: 1 });
 function consistencyProof(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _CONSISTENCY_PROOF_KEYS, _merkleErr,
     "merkle/bad-input", "unknown consistencyProof option ");
   var leaves = _leafArray(opts.leafHashes, "leafHashes");

package/lib/mime.js

@@ -26,6 +26,9 @@ var _push = guard.list.append;
 var CRLF = Buffer.from("\r\n");
 
 function _buf(v, E, code, label) { return guard.bytes.view(v, E, code, label); }
+/** @internal `guard.limits.counter` throws `E(code, ...)`, and every consumer of this module hands in
+ *  its error CLASS. */
+function _factory(E) { return function (c, m) { return new E(c, m); }; }
 
 function _splitPoint(bytes) {
   for (var i = 0; i < bytes.length; i++) {
@@ -57,27 +60,83 @@ function _stripLeadingHtab(s) {
   return s.slice(i);
 }
 
-function _unfoldHeaders(headerText) {
-  var lines = _toLf(headerText).split("\n");
+/** @internal The end of the line starting at `from`, and where the next one starts. A line is ended by
+ *  CRLF, by a lone CR or by LF, which is the separator set `_toLf` followed by a split produces. */
+function _lineEnd(s, from) {
+  for (var i = from; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    if (c === 0x0a) return { end: i, next: i + 1 };
+    if (c === 0x0d) return { end: i, next: (s.charCodeAt(i + 1) === 0x0a) ? i + 2 : i + 1 };
+  }
+  return { end: s.length, next: s.length };
+}
+
+/** @internal One line is cut at a time and EVERY line is charged, folded continuations and empty lines
+ *  included, so the refusal costs the cap rather than the input. Splitting the whole header area first
+ *  and counting fields afterwards read a 16 MiB area of 2,097,150 one-line fields in 1114 ms and
+ *  653 MiB of resident memory before the count refused it, and charging only fields left a 16 MiB area
+ *  of 1,864,130 continuation lines folding into one 13 MB value in 1648 ms without the count ever
+ *  reaching two. */
+function _unfoldHeaders(headerText, counted) {
   var out = [];
-  for (var i = 0; i < lines.length; i++) {
-    var ln = lines[i];
+  for (var at = 0; at < headerText.length;) {
+    var cut = _lineEnd(headerText, at);
+    var ln = headerText.slice(at, cut.end);
+    at = cut.next;
+    counted.tick();
     if (ln === "") continue;
-    if ((ln[0] === " " || ln[0] === "\t") && out.length) out[out.length - 1] += " " + _stripLeadingHtab(ln);
-    else _push(out,ln);
+    if ((ln.charAt(0) === " " || ln.charAt(0) === "\t") && out.length) {
+      out[out.length - 1] += " " + _stripLeadingHtab(ln);
+    } else {
+      _push(out, ln);
+    }
   }
   return out;
 }
 
-function _parseStructured(headerValue) {
-  var parts = _splitSemicolons(headerValue);
+/**
+ * @internal
+ * RFC 2045 sec. 5.1 gives a parameter one occurrence, so a header naming one twice has no value this
+ * function can resolve: reading the last occurrence and reading the first are both conforming, and they
+ * disagree. These values decide what a signature covers (`boundary` sets where the parts begin),
+ * whether the entity is accepted (`protocol`, `smime-type`) and which digest is reported (`micalg`), so
+ * a repeat is refused here, where the record is built, rather than per parameter at each reader. An
+ * occurrence counts whether or not it carries a value, which is the `hp; hp="clear"` form; a single
+ * bare attribute still reaches the reader that owns it.
+ *
+ * What is refused is two readings that produce DIFFERENT VALUES, which is why the two RFC 2231
+ * spellings are not treated alike. A plain occurrence beside a starred one of the same attribute,
+ * `boundary*=us-ascii''DECOY; boundary=REAL`, gives this reader REAL and an RFC 2231 reader DECOY, so
+ * it is refused. Continuation segments alone, `name*0=a; name*1=b`, give this reader NO value for that
+ * attribute, so a consumer sees it as absent and the one place absence matters already fails closed:
+ * `splitMultipart` refuses an entity with no boundary. Refusing those would reject a conforming
+ * message over a parameter that cannot change what the signature covers.
+ */
+function _parseStructured(headerValue, E, code, label) {
+  var counted = guard.limits.counter(C.LIMITS.MIME_MAX_PARAMS, _factory(E), code, label + " parameter");
+  var parts = _splitSemicolons(headerValue, counted);
   var type = _stripComments(parts[0]).trim().toLowerCase();
   var params = Object.create(null);
+  var seenExact = Object.create(null), seenPlain = Object.create(null), seenStarred = Object.create(null);
   for (var i = 1; i < parts.length; i++) {
     var p = _stripComments(parts[i]);
     var eq = p.indexOf("=");
+    var name = (eq < 0 ? p : p.slice(0, eq)).trim().toLowerCase();
+    if (name === "") continue;
+    var base = _baseAttribute(name);
+    var starred = base !== name;
+    if (seenExact[name] === true) {
+      throw new E(code, label + " declares the " + JSON.stringify(name) +
+        " parameter more than once, so its value is ambiguous (RFC 2045 sec. 5.1)");
+    }
+    if (starred ? seenPlain[base] === true : seenStarred[base] === true) {
+      throw new E(code, label + " spells the " + JSON.stringify(base) +
+        " parameter both plainly and as an RFC 2231 extended or continued value, and the two spellings " +
+        "carry different values (RFC 2231 sec. 7)");
+    }
+    seenExact[name] = true;
+    if (starred) seenStarred[base] = true; else seenPlain[base] = true;
     if (eq < 0) continue;
-    var name = p.slice(0, eq).trim().toLowerCase();
     var val = p.slice(eq + 1).trim();
     if (val.length >= 2 && val[0] === '"' && val[val.length - 1] === '"') val = val.slice(1, -1);
     params[name] = val;
@@ -99,7 +158,28 @@ function _stripComments(s) {
   return out;
 }
 
-function _splitSemicolons(s) {
+/** @internal The attribute an RFC 2231 name belongs to. Sections 3 and 4 spell one parameter three
+ *  ways, `name`, `name*` for an extended value and `name*0` / `name*1` for a continuation, and
+ *  section 7 makes them the same logical parameter. This module assembles neither starred form, so a
+ *  reader that does takes a different value from the same bytes: measured, `boundary*=us-ascii''DECOY;
+ *  boundary=REAL` verified here while an RFC 2231 reader splits the body on DECOY. Comparing the
+ *  attribute rather than the spelling is what makes the two the same occurrence. A leading asterisk
+ *  is a name in its own right and keeps it. */
+function _baseAttribute(name) {
+  var star = name.indexOf("*");
+  return star > 0 ? name.slice(0, star) : name;
+}
+
+/** @internal The first segment is the media type rather than a parameter, so it is not charged. The
+ *  charge comes BEFORE the segment is stored, so the refusal costs the cap and not the input: charging
+ *  the segments after the split instead read a 3.8 MiB Content-Type of 1,000,000 parameters in 192 ms
+ *  and 73 MiB of resident memory before the same cap refused it. */
+function _pushSegment(out, seg, counted) {
+  if (counted !== undefined && out.length > 0) counted.tick();
+  _push(out, seg);
+}
+
+function _splitSemicolons(s, counted) {
   var out = [], cur = "", inQ = false, depth = 0;
   for (var i = 0; i < s.length; i++) {
     var ch = s[i];
@@ -107,21 +187,29 @@ function _splitSemicolons(s) {
     else if (ch === '"' && depth === 0) { inQ = !inQ; cur += ch; }
     else if (ch === "(" && !inQ) { depth++; cur += ch; }
     else if (ch === ")" && !inQ && depth > 0) { depth--; cur += ch; }
-    else if (ch === ";" && !inQ && depth === 0) { _push(out,cur); cur = ""; }
+    else if (ch === ";" && !inQ && depth === 0) { _pushSegment(out, cur, counted); cur = ""; }
     else cur += ch;
   }
-  _push(out,cur);
+  _pushSegment(out, cur, counted);
   return out;
 }
 
 function parse(input, E, code) {
-  var bytes = _buf(input, E, code, "the MIME entity");
-  if (bytes.length > C.LIMITS.MIME_MAX_BYTES) throw new E(code, "MIME entity exceeds the size cap");
+  /** @internal A snapshot, not a view: the record below holds `subarray`s of these bytes and a caller
+   *  reads them back after the parse returns, so a view would let the caller's own later write change
+   *  what the record says the entity was. Measured on the shipped verb: `pki.smime.verify` returned
+   *  `valid: true` with `content` sharing the caller's store, and a write into that store afterwards
+   *  changed the bytes the caller read as verified. The copy is byte-identical, so the octets a
+   *  signature covers are unchanged. */
+  var viewed = _buf(input, E, code, "the MIME entity");
+  guard.limits.byteCap(viewed, C.LIMITS.MIME_MAX_BYTES, _factory(E), code, "the MIME entity");
+  var bytes = guard.bytes.snapshot(viewed, E, code, "the MIME entity");
   var sp = _splitPoint(bytes);
   var headerBytes = sp ? bytes.subarray(0, sp.headerEnd) : bytes;
   var bodyBytes = sp ? bytes.subarray(sp.bodyStart) : Buffer.alloc(0);
   var headerText = guard.text.decode(headerBytes, C.LIMITS.MIME_MAX_BYTES, E, { charset: "latin1", tooLarge: code, badInput: code, label: "the MIME headers" });
-  var rawHeaders = _unfoldHeaders(headerText);
+  var countedHeaders = guard.limits.counter(C.LIMITS.MIME_MAX_HEADERS, _factory(E), code, "the MIME header line");
+  var rawHeaders = _unfoldHeaders(headerText, countedHeaders);
   var headers = [];
   for (var i = 0; i < rawHeaders.length; i++) {
     var colon = rawHeaders[i].indexOf(":");
@@ -130,12 +218,29 @@ function parse(input, E, code) {
     var body = rawHeaders[i].slice(colon + 1);
     _push(headers,{ name: nm, lname: nm.toLowerCase(), value: body.trim(), rawValue: body.charAt(0) === " " ? body.slice(1) : body });
   }
-  function header(name) { var l = name.toLowerCase(); for (var j = 0; j < headers.length; j++) if (headers[j].lname === l) return headers[j].value; return null; }
+  /** @internal Resolving a field that occurs more than once means choosing an occurrence, and reading
+   *  the first and reading the last are both conforming (RFC 5322 sec. 3.6 gives a singleton field one
+   *  occurrence). The media type decides which reader a body goes to and the transfer encoding decides
+   *  how its octets are recovered, so a repeat is refused rather than resolved by position. Every
+   *  occurrence stays in `headers`, where a field that may legally repeat, such as `Received`, is
+   *  read instead. */
+  function header(name) {
+    var l = name.toLowerCase(), found = null;
+    for (var j = 0; j < headers.length; j++) {
+      if (headers[j].lname !== l) continue;
+      if (found !== null) {
+        throw new E(code, "the entity declares the " + JSON.stringify(headers[j].name) +
+          " field more than once, so resolving it to a single value is ambiguous (RFC 5322 sec. 3.6)");
+      }
+      found = headers[j];
+    }
+    return found === null ? null : found.value;
+  }
   var ctv = header("content-type");
   var cte = (header("content-transfer-encoding") || "").trim().toLowerCase() || "7bit";
   return {
     headers: headers, header: header,
-    contentType: ctv != null ? _parseStructured(ctv) : { value: "text/plain", type: "text/plain", params: Object.create(null) },
+    contentType: ctv != null ? _parseStructured(ctv, E, code, "the Content-Type") : { value: "text/plain", type: "text/plain", params: Object.create(null) },
     cte: cte,
     headerBytes: headerBytes, bodyBytes: bodyBytes, body: bodyBytes, bytes: bytes,
   };
@@ -158,7 +263,9 @@ function splitMultipart(bodyBytes, boundary, E, code) {
   if (idx < 0) throw new E(code, "no boundary delimiter found in the multipart body");
   var pos = _afterLine(body, idx + delim.length, E, code);
   var parts = [];
+  var counted = guard.limits.counter(C.LIMITS.MIME_MAX_PARTS, _factory(E), code, "the multipart body part");
   while (true) {
+    counted.tick();
     var next = _findDelim(body, delim, pos);
     if (next < 0) throw new E(code, "an unterminated multipart body part (no closing boundary)");
     var partEnd = next;

package/lib/ocsp.js

@@ -350,7 +350,7 @@ function _sign(responseData, responder, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.sign options");
   guard.identifier.assertKnownKeys(opts, _SIGN_OPTS, _err, "ocsp/bad-input",
     "pki.ocsp.sign has an unknown option (the nonce to echo back is `nonce`): ");
-  responseData = responseData || {};
+  responseData = responseData || _ocspIntrinsic.create(null);
   if (typeof responseData !== "object") throw _err("ocsp/bad-input", "the responseData must be an object { responderID, responses, producedAt? }");
   guard.identifier.assertKnownKeys(responseData, _RESPONSE_DATA_KEYS, _err, "ocsp/bad-input", "unknown responseData field (accepted: responderID, responses, producedAt): ");
   if (!responder || typeof responder !== "object") throw _err("ocsp/bad-input", "a responder must be { cert, key }");
@@ -449,7 +449,7 @@ function _responderID(rid, respCert) {
   throw _err("ocsp/bad-input", "responderID must be \"byName\" or \"byKey\"");
 }
 function _buildSingleResponse(r, opts) {
-  r = r || {};
+  r = r || _ocspIntrinsic.create(null);
   var certIdP;
   if (typeof r !== "object") return _promiseReject(_Promise, _err("ocsp/bad-input", "each response entry must be an object"));
   try { guard.identifier.assertKnownKeys(r, _SINGLE_RESPONSE_KEYS, _err, "ocsp/bad-input", "unknown response entry field (accepted: cert, issuer, certID, hashAlgorithm, status, thisUpdate, nextUpdate, singleExtensions): "); }

package/lib/path-validate.js

@@ -1867,7 +1867,7 @@ async function _validate(path, opts, run, scope) {
   }
 
   if (opts.ctLogList != null) {
-    var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || {}, n, opts.time);
+    var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || intrinsic.create(null), n, opts.time);
     var target = null;
     for (var tr = 0; tr < state.results.length; tr++) { if (state.results[tr].index === n - 1) { target = state.results[tr]; break; } }
     if (target) guard.list.append(target.checks, ctCheck);
@@ -2599,7 +2599,7 @@ function _ocspFromBytes(response) {
 }
 
 function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   /** @internal The captured finite test rather than a live `isNaN`: a valid Date's instant is always
    * finite and an invalid one's is not, so the two answer the same question, and the instant is read
    * ONCE into the value the test decides on. */
@@ -3356,7 +3356,7 @@ async function _aiaFetchOne(uri, aia) {
   var res = await guard.async.invoked(aia.transport,
     [{ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true }],
     E, "path/bad-input", "opts.transport");
-  res = res || {};
+  res = res || intrinsic.create(null);
   if (res.status !== 200) throw E("path/aia-status", "an AIA fetch returned HTTP " + res.status + " (only 200 is a cert source; no redirect following)");
   var body = guard.bytes.isByteSource(res.body)
     ? guard.bytes.source(res.body, PathError, "path/aia-bad-body", "the AIA response body")

package/lib/pbes2.js

@@ -4,6 +4,9 @@
 // @internal
 
 var asn1 = require("./asn1-der");
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 25 live runtime reads. */
+var _create = Object.create;
 var oid = require("./oid");
 var webcrypto = require("./webcrypto");
 var guard = require("./guard-all");
@@ -110,7 +113,7 @@ function cbcDecrypt(key, iv, ct, keyBits, E, code) {
 }
 
 function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var cipherName = opts.cipher || "aes256-CBC";
   var keyBits = CONTENT_KEYBITS[O(cipherName)];
   if (!keyBits || cipherName.indexOf("CBC") === -1) throw E(prefix + "/bad-input", "unsupported PBES2 cipher " + cipherName + " (AES-CBC only)");
@@ -168,9 +171,10 @@ function pbmac1AlgId(desc) {
 
 function pbmac1(pwBytes, salt, iterationCount, keyLength, prfHash, macHash, message) {
   var subtle = webcrypto.webcrypto.subtle;
-  /** @internal Every step is continued through the capture, and the wipe is attached on BOTH outcomes
-   * rather than through `finally`, which calls the receiver's own `then`. These steps derive the key
-   * a PBMAC1 integrity tag is computed under, so a replacement settling one hands back a tag computed
+  /** @internal Every step is continued through the capture, and the wipe is attached on the success
+   * outcome and the failure outcome separately, not through `finally`, which calls the receiver's own
+   * `then`. These steps derive the key a PBMAC1 integrity tag is computed under, so a replacement
+   * settling one hands back a tag computed
    * under bytes nobody derived, and skips the wipe that keeps the derived key from outliving it. */
   var base = guard.async.chain(subtle.importKey("raw", pwBytes, { name: "PBKDF2" }, false, ["deriveBits"]),
     function (baseKey) {

package/lib/pkcs12-build.js

@@ -237,7 +237,7 @@ function _buildBag(bag, opts, depth) {
     case "shroudedKey": {
       var kDer = _coerceDer(bag.key, "shroudedKey key");
       try { pkcs8.parse(kDer); } catch (e2) { throw _err("pkcs12/bad-input", "shroudedKey key is not a well-formed PKCS#8 PrivateKeyInfo", e2); }
-      var enc = bag.encrypt || {};
+      var enc = bag.encrypt || intrinsic.create(null);
       var bagPbe = _pbeOpts(enc);
       var pw = _pbePasswordOwned(enc.password != null ? enc.password : opts.password);
       var r;
@@ -552,7 +552,7 @@ function build(spec, opts) {
 }
 
 async function _build(spec, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var form = _specForm(spec);
   if (form.isObject) {
     guard.identifier.assertKnownKeys(spec, form.full ? _BUILD_SPEC_FULL_KEYS : _BUILD_SPEC_SHORTHAND_KEYS,
@@ -621,7 +621,7 @@ async function _build(spec, opts) {
             : "");
       });
     }
-    if (opts.mac !== false) _push(pfxChildren,await _buildMacData(opts.mac || {}, opts.password, authSafeDer));
+    if (opts.mac !== false) _push(pfxChildren,await _buildMacData(opts.mac || intrinsic.create(null), opts.password, authSafeDer));
     pfx = b.sequence(pfxChildren);
   }
 
@@ -676,7 +676,7 @@ async function verifyMac(pfx, password, opts) {
 }
 
 async function _verifyMacOfStore(m, password, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (m.integrityMode !== "password" || !m.mac) throw _err("pkcs12/bad-input", "the store carries no password MAC (integrityMode " + m.integrityMode + ")");
   var expected = m.mac.macValue;
   var computed;
@@ -767,7 +767,7 @@ function _capWork(iterations, salt, opts, keyLength, hardCap) {
  *   var keyDer = store.keys[0].pkcs8, certDer = store.certs[0].cert;
  */
 async function open(pfx, password, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, _OPEN_OPTS, _err, "pkcs12/bad-input", "pki.pkcs12.open has an unknown option ");
   /** @internal Every option is taken once, here, and everything below reads the snapshot. A store
    * is opened in many passes, the MAC and then each bag, so an option left on the caller's object is

package/lib/scep.js

@@ -745,7 +745,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
     if (proxySnap != null) req.proxy = proxySnap;
     if (curBody != null) req.body = curBody;
     return guard.async.invoked(transport, [req], _err, "scep/bad-input", "opts.transport").then(function (res) {
-      res = res || {};
+      res = res || intrinsic.create(null);
       var blen = _responseLen(res.body);
       if (blen > budgets.maxResponseBytes) throw _err("scep/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");
       var status = res.status;

package/lib/schema-engine.js

@@ -169,7 +169,7 @@ function time(ns) {
 
 function field(name, schema)          { return { fkind: "required", name: name, schema: schema }; }
 function optional(name, schema, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var match = opts.whenAny
     ? function () { return true; }
     : opts.whenUniversal
@@ -182,51 +182,51 @@ function optional(name, schema, opts) {
            defaultCode: opts.defaultCode };
 }
 function trailing(members, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { fkind: "trailing", members: members, minTag: opts.minTag, maxTag: opts.maxTag,
            unexpectedCode: opts.unexpectedCode, orderCode: opts.orderCode };
 }
 
 
 function seq(fields, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "seq", fields: fields, assert: opts.assert || "sequence", implicitTag: opts.implicitTag, arity: opts.arity,
            code: opts.code, what: opts.what, build: opts.build, checks: opts.checks || [] };
 }
 
 function explicit(tag, schema, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "explicit", tag: tag, schema: schema, emptyCode: opts.emptyCode, code: opts.code, what: opts.what };
 }
 
 function choice(alts, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "choice", alts: alts, code: opts.code, what: opts.what };
 }
 
 function seqOf(item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: opts.assert || "sequence", code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOf(item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: opts.assert || "set", derSetOrder: true, code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOfUnique(item, keyFn, opts) {
-  return setOf(item, Object.assign({ unique: keyFn }, opts || {}));
+  return setOf(item, Object.assign({ unique: keyFn }, opts || intrinsic.create(null)));
 }
 function implicitSetOf(tag, item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, derSetOrder: true, code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function implicitSeqOf(tag, item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
@@ -471,7 +471,7 @@ function _wrapConstructed(schema, parts) {
 function _present(v) { return v !== undefined && v !== null; }
 
 function _encodeSeq(schema, value, ctx) {
-  value = value || {};
+  value = value || intrinsic.create(null);
   var parts = [];
   for (var f = 0; f < schema.fields.length; f++) {
     var fld = schema.fields[f];
@@ -578,7 +578,7 @@ function _encodeChoice(schema, value, ctx) {
  *     { code: "app/bad-der", what: "the embedded structure" });
  */
 function embeddedDer(schema, bytes, ctx, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (opts.budget) {
     if (!(opts.budget.remaining > 0)) {
       throw ctx.E(opts.budgetCode || opts.code, (opts.what || "embedded DER") +

package/lib/schema-pkix.js

@@ -330,7 +330,7 @@ function _blockCap(given, ceiling, what, PemError) {
  * label is the only thing separating a CERTIFICATE from a TRUSTED CERTIFICATE or a PRIVATE KEY, and
  * the byte offset it started at, so a fault in a file of hundreds names the one object it is about. */
 function pemDecodeBundle(text, opts, PemError, detect) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var maxBlocks = _blockCap(opts.maxBlocks, constants.LIMITS.PEM_MAX_BLOCKS, "maxBlocks", PemError);
   var maxDecoded = _blockCap(opts.maxDecodedBytes, constants.LIMITS.PEM_MAX_DECODED_BYTES, "maxDecodedBytes", PemError);
   var route = opts.route === true;
@@ -739,7 +739,7 @@ function versionReader(ns, accept) {
 }
 
 function algorithmIdentifier(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   return schema.seq([
     schema.field("algorithm", schema.oidLeaf()),
     schema.optional("parameters", schema.any(), { whenAny: true }),
@@ -761,7 +761,7 @@ function algorithmIdentifier(ns, opts) {
  *  (RFC 5652 sec. 10.2.4). CMS names the type and RFC 9763 sec. 3.1 reuses it inside a CSR attribute,
  *  so the shape is defined once and each caller supplies its own code and name for the refusal. */
 function issuerAndSerialNumber(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   return schema.seq([
     schema.field("issuer", name(ns)),
     schema.field("serialNumber", schema.integerLeaf()),
@@ -952,7 +952,7 @@ function relativeDistinguishedName(ns) {
   return schema.setOf(attributeTypeAndValue(ns), { assert: "set", min: 1, code: ns.prefix + "/bad-rdn", what: "RelativeDistinguishedName" });
 }
 function name(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   function nameBuild(m) {
     var rdns = [], parts = [];
     _forEach(m.items, function (rdnItem) {
@@ -978,7 +978,7 @@ function name(ns, opts) {
 }
 
 function generalizedTime(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-time");
   var message = opts.message || "the time must be a GeneralizedTime";
   var readOpts = opts.allowFractional ? { allowFractional: true } : undefined;
@@ -991,7 +991,7 @@ function generalizedTime(ns, opts) {
 }
 
 function utf8Text(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-freetext");
   var message = opts.message || "the element must be a UTF8String";
   return schema.decode(function (n, ctx) {
@@ -1003,7 +1003,7 @@ function utf8Text(ns, opts) {
 }
 
 function rawNonEmptySequence(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-sequence");
   var message = opts.message || "expected a non-empty universal SEQUENCE";
   return schema.decode(function (n, ctx) {
@@ -1069,7 +1069,7 @@ var GN_IA5 = _assign(_create(null), { 1: 1, 2: 1, 6: 1 });
 var DIRECTORY_STRING_TAGS = [asn1.TAGS.UTF8_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.TELETEX_STRING,
   asn1.TAGS.UNIVERSAL_STRING, asn1.TAGS.BMP_STRING];
 function generalName(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-general-name");
   var decodeValue = opts.decodeValue === true;
   var subtreeBase = opts.subtreeBase === true;
@@ -1165,7 +1165,7 @@ function generalName(ns, opts) {
 }
 
 function generalNames(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-general-names");
   var gn = generalName(ns, { code: code, decodeValue: opts.decodeValue === true, subtreeBase: opts.subtreeBase === true });
   function build(m) { return { names: _map(m.items, function (it) { return it.value; }), bytes: m.node.bytes }; }
@@ -2528,7 +2528,7 @@ function extension(ns) {
   });
 }
 function extensions(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var EXT = extension(ns);
   var extOpts = {
     min: 1, code: ns.prefix + "/bad-extensions", what: "Extensions",
@@ -2540,7 +2540,7 @@ function extensions(ns, opts) {
 }
 
 function spki(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   return schema.seq([
     schema.field("algorithm", algorithmIdentifier(ns)),
     schema.field("subjectPublicKey", schema.bitString()),
@@ -2558,7 +2558,7 @@ function spki(ns, opts) {
 }
 
 function attribute(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var minValues = opts.minValues === undefined ? 1 : opts.minValues;
   return schema.seq([
     schema.field("type", schema.oidLeaf()),

package/lib/sign-scheme.js

@@ -124,7 +124,7 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
 }
 
 function _resolveSignScheme(cert, so, noSignedAttrs, E) {
-  so = so || {};
+  so = so || intrinsic.create(null);
   var alg = cert.subjectPublicKeyInfo.algorithm;
   var keyOid = alg.oid;
   var comp = compositeSig.COMPOSITE_ALGS[keyOid];
@@ -180,7 +180,7 @@ function _resolveSignScheme(cert, so, noSignedAttrs, E) {
 }
 
 function _assertKeyMatchesScheme(key, imp, E, what) {
-  var ka = key.algorithm || {};
+  var ka = key.algorithm || intrinsic.create(null);
   var subject = what || "CryptoKey";
   if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) {
     var hint = (_toUpperCase(_String(ka.name)) === "RSA-PSS" && _toUpperCase(_String(imp.name)) === "RSASSA-PKCS1-V1_5")

package/lib/sigstore.js

@@ -1715,7 +1715,7 @@ async function verifyBundle(bundle, opts) {
   if (bundle === null || typeof bundle !== "object" && typeof bundle !== "string" && !_isBuffer(bundle)) {
     throw new TypeError("verifyBundle: bundle must be an object, JSON string, or Buffer");
   }
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _VERIFY_BUNDLE_OPTS, _err, "sigstore/bad-input", "pki.sigstore.verifyBundle has an unknown option ");
   /** @internal parseBundle takes the copy, so every check below runs on plain data that cannot change
    * under it, whichever field it reads and however many times. */