deps: @sigstore/core@4.0.1

Author: Michael Smith

node_modules/pacote/node_modules/@sigstore/core/dist/asn1/length.js

@@ -37,12 +37,23 @@ function decodeLength(stream) {
     // Iterate over the bytes that encode the length.
     let len = 0;
     for (let i = 0; i < byteCount; i++) {
-        len = len * 256 + stream.getUint8();
+        const byte = stream.getUint8();
+        // The first byte of a multi-byte length must not be zero; a leading zero
+        // means the length could have been encoded in fewer bytes (non-minimal).
+        if (i === 0 && byte === 0x00) {
+            throw new error_1.ASN1ParseError('non-minimal length encoding');
+        }
+        len = len * 256 + byte;
     }
     // This is a valid ASN.1 length encoding, but we don't support it.
     if (len === 0) {
         throw new error_1.ASN1ParseError('indefinite length encoding not supported');
     }
+    // Lengths less than 128 must use the short form; rejecting them here ensures
+    // the encoding is minimal (strict DER).
+    if (len < 128) {
+        throw new error_1.ASN1ParseError('non-minimal length encoding');
+    }
     return len;
 }
 // Translates the supplied value to a DER-encoded length.

node_modules/pacote/node_modules/@sigstore/core/dist/asn1/obj.js

@@ -32,7 +32,14 @@ class ASN1Obj {
     }
     // Constructs an ASN.1 object from a Buffer of DER-encoded bytes.
     static parseBuffer(buf) {
-        return parseStream(new stream_1.ByteStream(buf));
+        const stream = new stream_1.ByteStream(buf);
+        const obj = parseStream(stream);
+        // Ensure the entire buffer was consumed; trailing data after the top-level
+        // object indicates a malformed (or maliciously padded) encoding.
+        if (stream.position !== stream.length) {
+            throw new error_1.ASN1ParseError('invalid trailing data');
+        }
+        return obj;
     }
     toDER() {
         const valueStream = new stream_1.ByteStream();
@@ -103,7 +110,14 @@ class ASN1Obj {
 exports.ASN1Obj = ASN1Obj;
 /////////////////////////////////////////////////////////////////////////////
 // Internal stream parsing functions
-function parseStream(stream) {
+// Maximum nesting depth for parsed ASN.1 objects. Bounds the mutual recursion
+// between parseStream and collectSubs so that deeply nested DER cannot exhaust
+// the call stack (denial of service).
+const MAX_DEPTH = 100;
+function parseStream(stream, depth = 0) {
+    if (depth > MAX_DEPTH) {
+        throw new error_1.ASN1ParseError('maximum nesting depth exceeded');
+    }
     // Parse tag, length, and value from stream
     const tag = new tag_1.ASN1Tag(stream.getUint8());
     const len = (0, length_1.decodeLength)(stream);
@@ -114,13 +128,17 @@ function parseStream(stream) {
     // are embedded in OCTESTRING objects, so we need to check those
     // for children as well.
     if (tag.constructed) {
-        subs = collectSubs(stream, len);
+        subs = collectSubs(stream, len, depth);
     }
     else if (tag.isOctetString()) {
         // Attempt to parse children of OCTETSTRING objects. If anything fails,
-        // assume the object is not constructed and treat as primitive.
+        // assume the object is not constructed and treat as primitive. This is
+        // intentional: it transparently unwraps DER content embedded in an OCTET
+        // STRING (e.g. X.509 extnValue, CMS eContent). The error is swallowed
+        // because a parse failure simply means the bytes are an opaque primitive
+        // value rather than a nested structure.
         try {
-            subs = collectSubs(stream, len);
+            subs = collectSubs(stream, len, depth);
         }
         catch (e) {
             // Fail silently and treat as primitive
@@ -132,7 +150,7 @@ function parseStream(stream) {
     }
     return new ASN1Obj(tag, value, subs);
 }
-function collectSubs(stream, len) {
+function collectSubs(stream, len, depth) {
     // Calculate end of object content
     const end = stream.position + len;
     // Make sure there are enough bytes left in the stream. This should never
@@ -145,7 +163,7 @@ function collectSubs(stream, len) {
     // Parse all children
     const subs = [];
     while (stream.position < end) {
-        subs.push(parseStream(stream));
+        subs.push(parseStream(stream, depth + 1));
     }
     // When we're done parsing children, we should be at the end of the object
     if (stream.position !== end) {

node_modules/pacote/node_modules/@sigstore/core/dist/asn1/parse.js

@@ -21,6 +21,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
+const error_1 = require("./error");
 const RE_TIME_SHORT_YEAR = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
 const RE_TIME_LONG_YEAR = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
 // Parse a BigInt from the DER-encoded buffer
@@ -83,30 +84,48 @@ function parseOID(buf) {
     const first = Math.floor(n / 40);
     const second = n % 40;
     let oid = `${first}.${second}`;
-    // Consume remaining bytes
-    let val = 0;
+    // Consume remaining bytes. Use a BigInt accumulator so that arcs which
+    // exceed 32 bits are not silently truncated (a truncated arc could be made
+    // to collide with a trusted OID).
+    let val = 0n;
     for (; pos < end; ++pos) {
         n = buf[pos];
-        val = (val << 7) + (n & 0x7f);
+        val = (val << 7n) + BigInt(n & 0x7f);
         // If the left-most bit is NOT set, then this is the last byte in the
         // sequence and we can add the value to the OID and reset the accumulator
         if ((n & 0x80) === 0) {
             oid += `.${val}`;
-            val = 0;
+            val = 0n;
         }
     }
     return oid;
 }
 // Parse a boolean from the DER-encoded buffer
 // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-basic-types#boolean
 function parseBoolean(buf) {
-    return buf[0] !== 0;
+    // DER requires a BOOLEAN to be a single byte that is either 0x00 (false) or
+    // 0xff (true). Reject any other (non-canonical) encoding.
+    if (buf.length !== 1) {
+        throw new error_1.ASN1ParseError('invalid boolean');
+    }
+    switch (buf[0]) {
+        case 0x00:
+            return false;
+        case 0xff:
+            return true;
+        default:
+            throw new error_1.ASN1ParseError('invalid boolean');
+    }
 }
 // Parse a bit string from the DER-encoded buffer
 // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-bit-string
 function parseBitString(buf) {
     // First byte tell us how many unused bits are in the last byte
     const unused = buf[0];
+    // The number of unused bits must be in the range 0-7.
+    if (unused > 7) {
+        throw new error_1.ASN1ParseError('invalid bit string');
+    }
     const start = 1;
     const end = buf.length;
     const bits = [];

node_modules/pacote/node_modules/@sigstore/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigstore/core",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Base library for Sigstore",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package-lock.json

@@ -10552,9 +10552,9 @@
       }
     },
     "node_modules/pacote/node_modules/@sigstore/core": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-4.0.0.tgz",
-      "integrity": "sha512-uFGJpKiMCKXV+61jsxQ0ECfr0wjDP+8qnT6pgfsOXbIk0j/KPfBSp2Dks/YcNcT/S4e3P267JKPL6gAwygJRuw==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-4.0.1.tgz",
+      "integrity": "sha512-9v5hRjujn5NXq8o7XFEUgLyAtdr5Iisb4pzM05u3K61IS5q3hP3luWAndk0RkPPLTUFoTbg7Vb84UQ1ZQeajWQ==",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -16356,6 +16356,15 @@
         "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
       }
     },
+    "workspaces/libnpmpublish/node_modules/@sigstore/core": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-4.0.1.tgz",
+      "integrity": "sha512-9v5hRjujn5NXq8o7XFEUgLyAtdr5Iisb4pzM05u3K61IS5q3hP3luWAndk0RkPPLTUFoTbg7Vb84UQ1ZQeajWQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+      }
+    },
     "workspaces/libnpmpublish/node_modules/sigstore": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/sigstore/-/sigstore-5.0.0.tgz",
@@ -16385,15 +16394,6 @@
         "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
       }
     },
-    "workspaces/libnpmpublish/node_modules/sigstore/node_modules/@sigstore/core": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-4.0.0.tgz",
-      "integrity": "sha512-uFGJpKiMCKXV+61jsxQ0ECfr0wjDP+8qnT6pgfsOXbIk0j/KPfBSp2Dks/YcNcT/S4e3P267JKPL6gAwygJRuw==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
-      }
-    },
     "workspaces/libnpmpublish/node_modules/sigstore/node_modules/@sigstore/sign": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/@sigstore/sign/-/sign-5.0.0.tgz",