@peac/protocol 0.16.3 → 0.16.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/_internal/address-policy.d.ts +28 -0
- package/dist/_internal/address-policy.d.ts.map +1 -0
- package/dist/_internal/record-core/validators/jose-hardening.d.ts +1 -1
- package/dist/_internal/record-core/validators/jose-hardening.d.ts.map +1 -1
- package/dist/_internal/test-helpers/fixture-manifest.d.ts.map +1 -1
- package/dist/index.cjs +383 -93
- package/dist/index.cjs.map +1 -1
- package/dist/index.mjs +384 -94
- package/dist/index.mjs.map +1 -1
- package/dist/issue.d.ts +2 -2
- package/dist/issue.d.ts.map +1 -1
- package/dist/jwks-resolver.d.ts +1 -1
- package/dist/jwks-resolver.d.ts.map +1 -1
- package/dist/ssrf-safe-fetch.d.ts +18 -11
- package/dist/ssrf-safe-fetch.d.ts.map +1 -1
- package/dist/verifier-core.d.ts.map +1 -1
- package/dist/verify-local.cjs +21 -2
- package/dist/verify-local.cjs.map +1 -1
- package/dist/verify-local.mjs +21 -2
- package/dist/verify-local.mjs.map +1 -1
- package/package.json +5 -5
package/dist/issue.d.ts
CHANGED
|
@@ -75,7 +75,7 @@ export interface IssueWire01Options {
|
|
|
75
75
|
workflow_context?: WorkflowContext;
|
|
76
76
|
/** Ed25519 private key (32 bytes) */
|
|
77
77
|
privateKey: Uint8Array;
|
|
78
|
-
/** Key ID
|
|
78
|
+
/** Key ID; non-empty, well-formed Unicode, at most 256 UTF-8 bytes */
|
|
79
79
|
kid: string;
|
|
80
80
|
/** Telemetry hook (optional, fire-and-forget) */
|
|
81
81
|
telemetry?: TelemetryHook;
|
|
@@ -151,7 +151,7 @@ export interface IssueWire02Options {
|
|
|
151
151
|
type: string;
|
|
152
152
|
/** Ed25519 private key (32 bytes) */
|
|
153
153
|
privateKey: Uint8Array;
|
|
154
|
-
/** Key ID
|
|
154
|
+
/** Key ID: non-empty, well-formed Unicode, at most 256 UTF-8 bytes (a PEAC constraint; RFC 7515 leaves kid structure unspecified) */
|
|
155
155
|
kid: string;
|
|
156
156
|
/**
|
|
157
157
|
* Unique receipt identifier.
|
package/dist/issue.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../src/issue.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAcH,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3E,OAAO,EACL,iBAAiB,EAEjB,sBAAsB,EAOtB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAKlB,KAAK,eAAe,EAQrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAkC,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IAEZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IAEZ,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IAEZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IAEZ,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEtB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,SAAS,CAAC;IAErB,iCAAiC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE/B,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;;;OAKG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,EAAE,CAAC;IAExC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAE/B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAEnC,qCAAqC;IACrC,UAAU,EAAE,UAAU,CAAC;IAEvB,
|
|
1
|
+
{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../src/issue.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAcH,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3E,OAAO,EACL,iBAAiB,EAEjB,sBAAsB,EAOtB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAKlB,KAAK,eAAe,EAQrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAkC,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IAEZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IAEZ,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IAEZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IAEZ,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEtB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,SAAS,CAAC;IAErB,iCAAiC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE/B,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;;;OAKG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,EAAE,CAAC;IAExC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAE/B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAEnC,qCAAqC;IACrC,UAAU,EAAE,UAAU,CAAC;IAEvB,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IAEZ,iDAAiD;IACjD,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IAEZ,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;gBAElB,SAAS,EAAE,SAAS;CAMjC;AAoCD;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAmLnF;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE7E;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ,iDAAiD;IACjD,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IAE/B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb,qCAAqC;IACrC,UAAU,EAAE,UAAU,CAAC;IAEvB,qIAAqI;IACrI,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAE3B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CA6HnF"}
|
package/dist/jwks-resolver.d.ts
CHANGED
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
* 2. Validate issuer config (schema, issuer match)
|
|
7
7
|
* 3. Validate jwks_uri is HTTPS (protocol-level enforcement)
|
|
8
8
|
* 4. Fetch JWKS from jwks_uri (SSRF-safe, 64KB cap)
|
|
9
|
-
* 5. Validate JWKS shape
|
|
9
|
+
* 5. Validate JWKS shape; skip entries that are not Ed25519 public verification keys
|
|
10
10
|
*
|
|
11
11
|
* No fallback paths: peac-issuer.json with jwks_uri is the only
|
|
12
12
|
* supported key discovery mechanism.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks-resolver.d.ts","sourceRoot":"","sources":["../src/jwks-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAO3D;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,GAAG,EAAE,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,wDAAwD;IACxD,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAC;IACV,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAeD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEhC,GACL,MAAM,CAMR;AAWD,iFAAiF;AACjF,wBAAgB,sBAAsB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAE9E;AAmGD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAgCD;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;
|
|
1
|
+
{"version":3,"file":"jwks-resolver.d.ts","sourceRoot":"","sources":["../src/jwks-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAO3D;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,GAAG,EAAE,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,wDAAwD;IACxD,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAC;IACV,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAeD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEhC,GACL,MAAM,CAMR;AAWD,iFAAiF;AACjF,wBAAgB,sBAAsB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAE9E;AAmGD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAgCD;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAwHD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAwL5B"}
|
|
@@ -3,9 +3,12 @@
|
|
|
3
3
|
*
|
|
4
4
|
* Implements SSRF protection per VERIFIER-SECURITY-MODEL.md:
|
|
5
5
|
* - HTTPS only
|
|
6
|
-
* -
|
|
7
|
-
*
|
|
8
|
-
* -
|
|
6
|
+
* - Allow only global unicast addresses: every block in the IANA IPv4 and IPv6
|
|
7
|
+
* special-purpose registries is refused, including private, loopback,
|
|
8
|
+
* link-local, shared, multicast and reserved ranges; IPv4-mapped and NAT64
|
|
9
|
+
* forms are judged by the embedded IPv4 address
|
|
10
|
+
* - Fail closed when DNS returns no addresses
|
|
11
|
+
* - Connect only to the vetted addresses (no second resolution)
|
|
9
12
|
* - Redirect limits and scheme downgrade protection
|
|
10
13
|
*
|
|
11
14
|
* ## Security Model: Best-Effort Protection
|
|
@@ -34,9 +37,8 @@
|
|
|
34
37
|
*
|
|
35
38
|
* | Protection | Requires |
|
|
36
39
|
* |------------|----------|
|
|
37
|
-
* |
|
|
38
|
-
* |
|
|
39
|
-
* | Link-local blocking (169.254.0.0/16) | DNS pre-resolution |
|
|
40
|
+
* | Special-purpose address blocking (global unicast only) | DNS pre-resolution |
|
|
41
|
+
* | Connection to the vetted address only | DNS pre-resolution + `https` module |
|
|
40
42
|
*
|
|
41
43
|
* ## Runtime Capability Model
|
|
42
44
|
*
|
|
@@ -44,7 +46,7 @@
|
|
|
44
46
|
*
|
|
45
47
|
* | Runtime | DNS Pre-Resolution | IP Blocking | Notes |
|
|
46
48
|
* |-------------------|-------------------|-------------|-------|
|
|
47
|
-
* | Node.js | YES | YES |
|
|
49
|
+
* | Node.js | YES | YES | Resolve once, vet, connect to the vetted address |
|
|
48
50
|
* | Browser | NO | NO | Relies on server-side validation |
|
|
49
51
|
* | Cloudflare Workers| NO | NO | No DNS access, relies on CF network |
|
|
50
52
|
* | Deno | NO | NO | dns module not available by default |
|
|
@@ -170,7 +172,12 @@ export interface SSRFFetchError {
|
|
|
170
172
|
blockedUrl?: string;
|
|
171
173
|
}
|
|
172
174
|
/**
|
|
173
|
-
* Check if an IP address is
|
|
175
|
+
* Check if an IP address is outside the allowed address space.
|
|
176
|
+
*
|
|
177
|
+
* Only global unicast addresses outside the IANA IPv4 and IPv6 special-purpose
|
|
178
|
+
* blocks are allowed. IPv4-mapped and NAT64 (64:ff9b::/96) IPv6 addresses are
|
|
179
|
+
* judged by the embedded IPv4 address; input that does not parse as an address
|
|
180
|
+
* is blocked.
|
|
174
181
|
*/
|
|
175
182
|
export declare function isBlockedIP(ip: string): {
|
|
176
183
|
blocked: true;
|
|
@@ -183,9 +190,9 @@ export declare function isBlockedIP(ip: string): {
|
|
|
183
190
|
*
|
|
184
191
|
* This function implements the SSRF protection algorithm from VERIFIER-SECURITY-MODEL.md:
|
|
185
192
|
* 1. Parse URL; reject if not https://
|
|
186
|
-
* 2. Resolve hostname to IP(s)
|
|
187
|
-
* 3. For each IP: reject
|
|
188
|
-
* 4. Perform
|
|
193
|
+
* 2. Resolve hostname to IP(s); an empty answer is a failure
|
|
194
|
+
* 3. For each IP: reject unless it is a global unicast address
|
|
195
|
+
* 4. Perform the request with timeout, connecting only to the vetted IPs
|
|
189
196
|
* 5. On redirect: increment counter, reject if > max, apply checks to redirect URL
|
|
190
197
|
* 6. Validate response size
|
|
191
198
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ssrf-safe-fetch.d.ts","sourceRoot":"","sources":["../src/ssrf-safe-fetch.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"ssrf-safe-fetch.d.ts","sourceRoot":"","sources":["../src/ssrf-safe-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAUH;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,KAAK,GACL,MAAM,GACN,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,SAAS,CAAC;AAEd;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,OAAO,EAAE,WAAW,CAAC;IACrB,oDAAoD;IACpD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAC;IACpB,+CAA+C;IAC/C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qDAAqD;IACrD,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IAChD,mCAAmC;IACnC,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAOD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,CAOtD;AA4GD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,EAAE,UAAU,CAAC;IACrB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB;IACnB,EAAE,EAAE,KAAK,CAAC;IACV,wBAAwB;IACxB,MAAM,EACF,aAAa,GACb,WAAW,GACX,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,aAAa,GACb,oBAAoB,GACpB,kBAAkB,GAClB,uBAAuB,GACvB,SAAS,GACT,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,CAAC;IACpB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,GACT;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,YAAY,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAG1F;AAgND;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,GAAG,cAAc,CAAC,CAwS3C;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,eAAe,GAAG,cAAc,CAAC,CAS3C;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,eAAe,GAAG,cAAc,CAAC,CAS3C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier-core.d.ts","sourceRoot":"","sources":["../src/verifier-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,OAAO,EAAE,iBAAiB,EAAiB,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"verifier-core.d.ts","sourceRoot":"","sources":["../src/verifier-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,OAAO,EAAE,iBAAiB,EAAiB,MAAM,cAAc,CAAC;AAKhE,OAAO,KAAK,EAAa,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAqCzF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,0BAA0B;IAC1B,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,0BAA0B;IAC1B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,+BAA+B;IAC/B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAyGD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgd7F"}
|
package/dist/verify-local.cjs
CHANGED
|
@@ -240,13 +240,32 @@ function validateTypeExtensionMappingInternal(input) {
|
|
|
240
240
|
}
|
|
241
241
|
|
|
242
242
|
// src/_internal/record-core/validators/jose-hardening.ts
|
|
243
|
-
var
|
|
243
|
+
var KID_MAX_UTF8_BYTES = 256;
|
|
244
|
+
function isAcceptableKid(kid) {
|
|
245
|
+
if (typeof kid !== "string" || kid.length === 0) return false;
|
|
246
|
+
let bytes = 0;
|
|
247
|
+
for (let i = 0; i < kid.length; i++) {
|
|
248
|
+
const c = kid.charCodeAt(i);
|
|
249
|
+
if (c < 128) bytes += 1;
|
|
250
|
+
else if (c < 2048) bytes += 2;
|
|
251
|
+
else if (c >= 55296 && c <= 56319) {
|
|
252
|
+
const next = i + 1 < kid.length ? kid.charCodeAt(i + 1) : 0;
|
|
253
|
+
if (next < 56320 || next > 57343) return false;
|
|
254
|
+
bytes += 4;
|
|
255
|
+
i++;
|
|
256
|
+
} else if (c >= 56320 && c <= 57343) {
|
|
257
|
+
return false;
|
|
258
|
+
} else bytes += 3;
|
|
259
|
+
if (bytes > KID_MAX_UTF8_BYTES) return false;
|
|
260
|
+
}
|
|
261
|
+
return true;
|
|
262
|
+
}
|
|
244
263
|
var ACCEPTED = { accepted: true };
|
|
245
264
|
function rejected(errorCode) {
|
|
246
265
|
return { accepted: false, errorCode };
|
|
247
266
|
}
|
|
248
267
|
function validateJoseHardeningInternal(header) {
|
|
249
|
-
if (!header.kid
|
|
268
|
+
if (!isAcceptableKid(header.kid)) {
|
|
250
269
|
return rejected("CRYPTO_JWS_MISSING_KID");
|
|
251
270
|
}
|
|
252
271
|
if (header.jwk !== void 0 || header.x5c !== void 0 || header.x5u !== void 0 || header.jku !== void 0) {
|