client-certificate-auth 1.3.6 → 1.3.8

package/lib/clientCertificateAuth.cjs

@@ -32,6 +32,19 @@ function isThenable(value) {
         && typeof value.then === 'function';
 }
 
+/**
+ * Wrap primitive values thrown or rejected by the validation callback in an
+ * Error so `.message` and `.status` access is safe; objects pass through.
+ * @param {unknown} err
+ * @returns {any}
+ */
+function normalizeCallbackError(err) {
+    if (err !== null && (typeof err === 'object' || typeof err === 'function')) {
+        return err;
+    }
+    return new Error(err === null || err === undefined ? '' : String(err));
+}
+
 /**
  * Options not supported by the sync CJS wrapper.
  * These require the ESM module's async header parsing.
@@ -132,7 +145,8 @@ function clientCertificateAuth(callback, options = {}) {
         try {
             const result = callback(cert, req);
             if (isThenable(result)) {
-                Promise.resolve(result).then(doneAuthorizing).catch((err) => {
+                Promise.resolve(result).then(doneAuthorizing).catch((rejection) => {
+                    const err = normalizeCallbackError(rejection);
                     safeCallHook(onRejected, cert, req, err.message || 'callback_threw');
                     if (err.status === undefined) {
                         err.status = 401;
@@ -142,7 +156,8 @@ function clientCertificateAuth(callback, options = {}) {
             } else {
                 doneAuthorizing(result);
             }
-        } catch (err) {
+        } catch (thrown) {
+            const err = normalizeCallbackError(thrown);
             safeCallHook(onRejected, cert, req, err.message || 'callback_threw');
             if (err.status === undefined) {
                 err.status = 401;

package/lib/clientCertificateAuth.js

@@ -20,6 +20,19 @@ function isThenable(value) {
     && typeof /** @type {{then?: unknown}} */ (value).then === 'function';
 }
 
+/**
+ * Wrap primitive values thrown or rejected by the validation callback in an
+ * Error so `.message` and `.status` access is safe; objects pass through.
+ * @param {unknown} err
+ * @returns {any}
+ */
+function normalizeCallbackError(err) {
+  if (err !== null && (typeof err === 'object' || typeof err === 'function')) {
+    return err;
+  }
+  return new Error(err === null || err === undefined ? '' : String(err));
+}
+
 /**
  * @typedef {import('http').IncomingMessage & { secure?: boolean; socket: import('tls').TLSSocket & { authorized?: boolean; authorizationError?: string }; clientCertificate?: import('tls').PeerCertificate }} ClientCertRequest
  * @typedef {import('http').ServerResponse & { redirect: (statusOrUrl: number | string, url?: string) => void }} ClientCertResponse
@@ -191,7 +204,8 @@ export default function clientCertificateAuth(callback, options = {}) {
     try {
       const callbackResult = callback(cert, req);
       if (isThenable(callbackResult)) {
-        Promise.resolve(callbackResult).then(doneAuthorizing).catch((err) => {
+        Promise.resolve(callbackResult).then(doneAuthorizing).catch((rejection) => {
+          const err = normalizeCallbackError(rejection);
           safeCallHook(onRejected, cert, req, err.message || 'callback_threw');
           if (err.status === undefined) {
             err.status = 401;
@@ -201,7 +215,8 @@ export default function clientCertificateAuth(callback, options = {}) {
       } else {
         doneAuthorizing(callbackResult);
       }
-    } catch (err) {
+    } catch (thrown) {
+      const err = normalizeCallbackError(thrown);
       safeCallHook(onRejected, cert, req, err.message || 'callback_threw');
       if (err.status === undefined) {
         err.status = 401;

package/lib/parsers.js

@@ -103,8 +103,9 @@ function splitPemBlocks(pem) {
 
 /**
  * Parse a multi-block PEM blob into a chained PeerCertificate. Splits the
- * input into individual blocks, parses each, drops blocks that fail to
- * parse, and links the remainder via issuerCertificate.
+ * input into individual blocks and links them via issuerCertificate. The
+ * first block is the leaf and must parse; later blocks that fail to parse
+ * are dropped and the chain links past them.
  *
  * Used by parsers whose proxies forward the full chain in a single field
  * (parseUrlPemAws, parseXfcc Chain). Without explicit chain linking, calling
@@ -117,22 +118,33 @@ function splitPemBlocks(pem) {
  */
 function chainFromMultiBlockPem(pem) {
     const pemBlocks = splitPemBlocks(pem);
-    // Stryker disable next-line BlockStatement,ConditionalExpression: short-circuit; falling through hits the next certs.length===0 check with the same null result
+    // Stryker disable next-line BlockStatement,ConditionalExpression: short-circuit; falling through hands undefined to pemToCertificate, which throws for the same null result
     if (pemBlocks.length === 0) {
         return null;
     }
 
-    const certs = pemBlocks.map(block => {
+    // Junk ahead of the leaf block means the leaf was damaged past recognition;
+    // the next block must not slide into its place. Leading whitespace is fine.
+    if (pem.slice(0, pem.indexOf(pemBlocks[0])).trim() !== '') {
+        return null;
+    }
+
+    // An unparseable leaf rejects the whole blob. Promoting the next block
+    // would authenticate the request as whichever certificate parsed first.
+    let leaf;
+    try {
+        leaf = pemToCertificate(pemBlocks[0]);
+    } catch {
+        return null;
+    }
+
+    const certs = [leaf];
+    for (const block of pemBlocks.slice(1)) {
         try {
-            return pemToCertificate(block);
+            certs.push(pemToCertificate(block));
         } catch {
-            // Stryker disable next-line BlockStatement: empty catch returns undefined which .filter(Boolean) drops alongside null — same chain output
-            return null;
+            // Dropped; the chain links past it.
         }
-    }).filter(Boolean);
-
-    if (certs.length === 0) {
-        return null;
     }
 
     // Stryker disable next-line EqualityOperator: setting issuerCertificate = undefined on last cert is same as not setting it
@@ -271,27 +283,25 @@ export function parseBase64Der(headerValue) {
     }
 
     // Handle comma-separated cert chains (Traefik format)
-    // Stryker disable next-line MethodExpression: .trim() no-op (base64 ignores whitespace); .filter(Boolean) redundant (empty strings throw in X509Certificate, caught below)
-    const certParts = headerValue.split(',').map(s => s.trim()).filter(Boolean);
+    // Stryker disable next-line MethodExpression: .trim() no-op (base64 ignores whitespace)
+    const certParts = headerValue.split(',').map(s => s.trim());
 
-    // Stryker disable next-line BlockStatement,ConditionalExpression: →false equivalent (empty array → zero certs → certs.length===0 catches it); →true killed by valid base64-der tests
-    if (certParts.length === 0) {
+    // An empty or unparseable leaf rejects the whole header. Promoting the next
+    // entry would authenticate the request as whichever certificate parsed first.
+    let leaf;
+    try {
+        leaf = derToCertificate(Buffer.from(certParts[0], 'base64'));
+    } catch {
         return null;
     }
 
-    // Parse all certs in the chain
-    const certs = certParts.map(base64 => {
+    const certs = [leaf];
+    for (const base64 of certParts.slice(1)) {
         try {
-            const derBuffer = Buffer.from(base64, 'base64');
-            return derToCertificate(derBuffer);
+            certs.push(derToCertificate(Buffer.from(base64, 'base64')));
         } catch {
-            // Equivalent mutant (undefined also filtered by .filter(Boolean)) — catch-body BlockStatement unsuppressible via Stryker comments
-            return null;
+            // Dropped; the chain links past it.
         }
-    }).filter(Boolean);
-
-    if (certs.length === 0) {
-        return null;
     }
 
     // Link the cert chain via issuerCertificate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "client-certificate-auth",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "description": "Express/Connect middleware for mTLS client certificate authentication with reverse proxy support (AWS ALB, Envoy, Cloudflare, Traefik)",
   "homepage": "https://github.com/tgies/client-certificate-auth",
   "bugs": {
@@ -145,6 +145,7 @@
     "lib/**/*.d.cts"
   ],
   "overrides": {
-    "fflate": "0.8.2"
+    "fflate": "0.8.2",
+    "qs": "^6.15.2"
   }
 }