tr-fetch 0.9.0 → 0.9.1

package/README.md

@@ -308,6 +308,9 @@ CRL retrieval:
 - Allows at most five redirects, 16 MiB of decoded response data and ten seconds
   per download including redirects and body reading. Caller cancellation also
   cancels CRL retrieval. At most 32 distribution URIs are tried per certificate.
+- Parses at most 1,000,000 ASN.1 nodes per CRL, enough for several hundred
+  thousand revoked entries. This bounds the memory that a hostile CRL can use
+  (about 0.6 GB); larger CRLs are invalid.
 - Allows private-network HTTP(S) endpoints, including loopback, for private PKI.
   It does not perform filesystem or LDAP lookup.
 - Does not recursively check the CRL download server's CRLs or OCSP status.
@@ -388,7 +391,14 @@ checks. Only `http:` and `https:` URLs are supported; a URL without a scheme
 defaults to `http://`.
 
 ```sh
-npx tr-curl -v https://example.com/
+npx -p tr-fetch tr-curl -v https://example.com/
+```
+
+The command is in the `tr-fetch` package, so `npx` needs `-p tr-fetch`.
+After `npm install -g tr-fetch`, or inside a project that depends on it,
+`tr-curl` can be run directly:
+
+```sh
 tr-curl -fsSL -o page.html https://example.com/
 tr-curl --json '{"a":1}' -u user:password https://api.example.com/items
 tr-curl --cacert private-ca.pem --crlfile current.crl https://internal.example/

package/crl.js

@@ -5,6 +5,10 @@ const pki = require('pkijs');
 const { cryptoEngine, parseDer, extensionsById, extensionValue, parseCertificate } = require('./pkiutils');
 
 const MAX_CRL_BYTES = 16 * 1024 * 1024;
+// A revoked entry takes three to seven ASN.1 nodes, so this allows CRLs of
+// several hundred thousand entries. Unlike the byte limit, it also bounds the
+// memory used by hostile input made of minimal nodes (about 0.6 GB).
+const MAX_CRL_NODES = 1000000;
 
 function distributionPoints(certificate) {
     const extension = extensionsById(certificate.extensions).get('2.5.29.31');
@@ -39,7 +43,7 @@ function parseCrl(bytes) {
             throw new Error('Malformed base64 in PEM CRL');
         }
     }
-    return parseDer(bytes, pki.CertificateRevocationList);
+    return parseDer(bytes, pki.CertificateRevocationList, { maxNodes: MAX_CRL_NODES, maxContentLength: MAX_CRL_BYTES });
 }
 
 function checkValidity(crl, now = Date.now()) {
@@ -161,4 +165,4 @@ async function validateCrl(crl, certificate, issuer, urls, now = Date.now()) {
     return { revoked, nextUpdate };
 }
 
-module.exports = { MAX_CRL_BYTES, parseCertificate, distributionPoints, parseCrl, validateCrl };
+module.exports = { MAX_CRL_BYTES, MAX_CRL_NODES, parseCertificate, distributionPoints, parseCrl, validateCrl };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tr-fetch",
-    "version": "0.9.0",
+    "version": "0.9.1",
     "description": "Node.js fetch with CRL and OCSP certificate revocation checking, plus tr-curl, a curl-like test tool",
     "main": "index.js",
     "exports": {

package/pkiutils.js

@@ -6,10 +6,14 @@ const { webcrypto } = require('node:crypto');
 
 const cryptoEngine = new pki.CryptoEngine({ name: 'tr-fetch', crypto: webcrypto });
 
-function parseDer(bytes, Type) {
-    const decoded = asn1.fromBER(bytes);
-    if ((decoded.offset !== bytes.length) || decoded.result.error) {
-        throw new Error('Malformed ASN.1 data or trailing bytes');
+// Limits default to asn1js's own; see its fromBER() resource limits.
+function parseDer(bytes, Type, limits) {
+    const decoded = asn1.fromBER(bytes, limits);
+    if (decoded.result.error) {
+        throw new Error(`Malformed ASN.1 data: ${decoded.result.error}`);
+    }
+    if (decoded.offset !== bytes.length) {
+        throw new Error('Malformed ASN.1 data: trailing bytes');
     }
     return new Type({ schema: decoded.result });
 }