Input validation and bounds-checking hardening

packages/bun-uws/src/HttpParser.h

@@ -750,6 +750,11 @@ namespace uWS
                     /* Error: invalid chars in field name */
                     return HttpParserResult::error(HTTP_ERROR_400_BAD_REQUEST, HTTP_PARSER_ERROR_INVALID_HEADER_TOKEN);
                 }
+                /* Reject zero-length header names (RFC 9110 §5.6.3): an empty key is
+                 * indistinguishable from the headers-array terminator and would truncate iteration. */
+                if (postPaddedBuffer == preliminaryKey) [[unlikely]] {
+                    return HttpParserResult::error(HTTP_ERROR_400_BAD_REQUEST, HTTP_PARSER_ERROR_INVALID_HEADER_TOKEN);
+                }
                 postPaddedBuffer++;
 
                 preliminaryValue = postPaddedBuffer;

packages/bun-uws/src/HttpResponse.h

@@ -257,7 +257,11 @@ struct HttpResponse : public AsyncSocket<SSL> {
 
         /* Note: OpenSSL can be used here to speed this up somewhat */
         char secWebSocketAccept[29] = {};
-        WebSocketHandshake::generate(secWebSocketKey.data(), secWebSocketAccept);
+        /* WebSocketHandshake::generate reads exactly 24 bytes; the client-controlled
+         * header may be shorter, so copy into a zero-padded fixed buffer first. */
+        char secWebSocketKeyBuf[24] = {};
+        secWebSocketKey.copy(secWebSocketKeyBuf, sizeof(secWebSocketKeyBuf));
+        WebSocketHandshake::generate(secWebSocketKeyBuf, secWebSocketAccept);
 
         writeStatus("101 Switching Protocols")
             ->writeHeader("Upgrade", "websocket")

src/base64/lib.rs

@@ -325,7 +325,9 @@ pub mod vlq {
         let encoded_ = &encoded[start..][0..(encoded.len() - start).min(VLQ_MAX_IN_BYTES + 1)];
 
         // inlining helps for the 1 or 2 byte case, hurts a little for larger
-        for i in 0..(VLQ_MAX_IN_BYTES + 1) {
+        // Bound by the clamped slice length, not VLQ_MAX_IN_BYTES + 1, to avoid
+        // OOB reads on truncated/attacker-controlled mappings.
+        for i in 0..encoded_.len() {
             if ASSERT_VALID {
                 debug_assert!(encoded_[i] < U7_MAX); // invalid base64 character
             }

src/bundler/linker_context/postProcessCSSChunk.rs

@@ -74,8 +74,26 @@ pub fn post_process_css_chunk(
             j.push_static(b"/* ");
             line_offset.advance(b"/* ");
 
-            j.push_static(pretty);
-            line_offset.advance(pretty);
+            // Escape `*/` so a hostile package path can't terminate the
+            // comment and inject arbitrary CSS into the bundle output.
+            if bun_core::immutable::contains(pretty, b"*/") {
+                let mut escaped: Vec<u8> = Vec::with_capacity(pretty.len() + 1);
+                let mut i = 0;
+                while i < pretty.len() {
+                    if pretty[i] == b'*' && pretty.get(i + 1) == Some(&b'/') {
+                        escaped.extend_from_slice(b"*\\/");
+                        i += 2;
+                    } else {
+                        escaped.push(pretty[i]);
+                        i += 1;
+                    }
+                }
+                line_offset.advance(&escaped);
+                j.push_owned(escaped.into_boxed_slice());
+            } else {
+                j.push_static(pretty);
+                line_offset.advance(pretty);
+            }
 
             j.push_static(b" */\n");
             line_offset.advance(b" */\n");

src/bundler/linker_context/postProcessJSChunk.rs

@@ -681,8 +681,26 @@ pub fn post_process_js_chunk(
                 }
             }
 
-            j.push_static(pretty);
-            line_offset.advance(pretty);
+            // Escape `*/` so a hostile package path can't terminate the multiline
+            // comment and inject JS. (Single-line is safe: no line terminators above.)
+            if matches!(comment_type, CommentType::Multiline) && strings::contains(pretty, b"*/") {
+                let mut escaped: Vec<u8> = Vec::with_capacity(pretty.len() + 1);
+                let mut i = 0;
+                while i < pretty.len() {
+                    if pretty[i] == b'*' && pretty.get(i + 1) == Some(&b'/') {
+                        escaped.extend_from_slice(b"*\\/");
+                        i += 2;
+                    } else {
+                        escaped.push(pretty[i]);
+                        i += 1;
+                    }
+                }
+                line_offset.advance(&escaped);
+                j.push_owned(escaped.into_boxed_slice());
+            } else {
+                j.push_static(pretty);
+                line_offset.advance(pretty);
+            }
 
             if emit_targets_in_commands {
                 j.push_static(b" (");

src/bundler/options.rs

@@ -2600,10 +2600,21 @@ pub(crate) fn path_template_print<W: bun_io::Write>(
         };
 
         match field {
-            PlaceholderField::Dir => PathTemplate::write_replacing_slashes_on_windows(
-                writer,
-                if !dir.is_empty() { dir } else { b"." },
-            )?,
+            PlaceholderField::Dir => {
+                // Rewrite leading `..` segments to `_.._` so `[dir]` can't place
+                // output above `outdir` (mirrors esbuild's `outbase` behavior).
+                let mut d: &[u8] = if !dir.is_empty() { dir } else { b"." };
+                while d.starts_with(b"../") || d.starts_with(b"..\\") {
+                    writer.write_all(b"_.._")?;
+                    PathTemplate::write_replacing_slashes_on_windows(writer, &d[2..3])?;
+                    d = &d[3..];
+                }
+                if d == b".." {
+                    writer.write_all(b"_.._")?;
+                } else {
+                    PathTemplate::write_replacing_slashes_on_windows(writer, d)?;
+                }
+            }
             PlaceholderField::Name => {
                 PathTemplate::write_replacing_slashes_on_windows(writer, name)?
             }

src/css/css_parser.rs

@@ -668,7 +668,16 @@ fn parse_nested_block<T>(
     let saved_stop_before = parser.stop_before;
     parser.stop_before = closing_delimiter;
     parser.at_start_of = None;
-    let result = parser.parse_entirely((), |(), p| parsefn(p));
+    // Bound recursive descent so deeply nested blocks (e.g. `calc(calc(...))`)
+    // can't overflow the native stack; the error path leaves the parser recoverable.
+    let result = if parser.nesting_depth >= MAX_NESTING_DEPTH {
+        Err(parser.new_custom_error(ParserError::maximum_nesting_depth))
+    } else {
+        parser.nesting_depth += 1;
+        let r = parser.parse_entirely((), |(), p| parsefn(p));
+        parser.nesting_depth -= 1;
+        r
+    };
     if let Some(block_type2) = parser.at_start_of.take() {
         consume_until_end_of_block(block_type2, &mut parser.input.tokenizer);
     }
@@ -3439,8 +3448,14 @@ pub struct Parser<'a> {
     /// materialises a fresh short-lived `&mut` instead.
     pub import_records: Option<core::ptr::NonNull<Vec<ImportRecord>>>,
     pub extra: Option<&'a mut ParserExtra>,
+    /// Current nested-block depth; bounded by [`MAX_NESTING_DEPTH`] to prevent
+    /// stack overflow from deeply nested input.
+    pub nesting_depth: u32,
 }
 
+/// Hard cap on nested-block depth (matches WebKit's CSS tokenizer limit).
+pub const MAX_NESTING_DEPTH: u32 = 128;
+
 impl<'a> Parser<'a> {
     pub fn add_symbol_for_name(
         &mut self,
@@ -3563,6 +3578,7 @@ impl<'a> Parser<'a> {
             flags,
             import_records,
             extra,
+            nesting_depth: 0,
         }
     }
 

src/http_jsc/websocket_client.rs

@@ -310,16 +310,21 @@ impl<const SSL: bool> WebSocket<SSL> {
                 // null is well-defined (BoringSSL returns null).
                 let servername =
                     unsafe { boringssl::c::SSL_get_servername(ssl_ptr, TLSEXT_NAMETYPE_HOST_NAME) };
-                if !servername.is_null() {
+                // SNI may be null (e.g. IP literal); with no hostname there is nothing
+                // to verify the certificate against, so reject rather than skip verification.
+                let hostname: &[u8] = if !servername.is_null() {
                     // SAFETY: servername is a NUL-terminated C string owned by the SSL session.
-                    let hostname = unsafe { bun_core::ffi::cstr(servername) }.to_bytes();
-                    // SAFETY: ssl_ptr is non-null (connected SSL socket on the handshake path).
-                    if !ssl_ptr.is_null()
-                        && !boringssl::check_server_identity(unsafe { &mut *ssl_ptr }, hostname)
-                    {
-                        self.outgoing_websocket = None;
-                        ws_ref.did_abrupt_close(ErrorCode::FailedToConnect);
-                    }
+                    unsafe { bun_core::ffi::cstr(servername) }.to_bytes()
+                } else {
+                    b""
+                };
+                if ssl_ptr.is_null()
+                    || hostname.is_empty()
+                    // SAFETY: ssl_ptr is non-null (checked above) for the open socket's lifetime.
+                    || !boringssl::check_server_identity(unsafe { &mut *ssl_ptr }, hostname)
+                {
+                    self.outgoing_websocket = None;
+                    ws_ref.did_abrupt_close(ErrorCode::FailedToConnect);
                 }
             }
             // If reject_unauthorized is false, we accept the connection regardless of SSL errors

src/install/bin.rs

@@ -737,6 +737,17 @@ pub fn normalized_bin_name(name: &[u8]) -> &[u8] {
     name
 }
 
+/// True when `abs_target` is contained in `package_dir`. `bin` targets are
+/// untrusted package.json values; a `../../..` target would be symlinked + chmod 0o777.
+fn bin_target_within_package_dir(abs_target: &[u8], package_dir: &[u8]) -> bool {
+    debug_assert!(matches!(package_dir.last(), Some(&b'/') | Some(&b'\\')));
+    let dir = strings::without_trailing_slash(package_dir);
+    if !strings::has_prefix(abs_target, dir) {
+        return false;
+    }
+    matches!(abs_target.get(dir.len()), None | Some(&b'/') | Some(&b'\\'))
+}
+
 pub struct Linker<'a> {
     pub bin: Bin,
 
@@ -1436,6 +1447,11 @@ impl<'a> Linker<'a> {
                             target,
                             unscoped_package_name,
                         );
+                        // SECURITY: refuse `bin` targets that traverse outside the
+                        // package directory (would otherwise be symlinked + chmod 0o777).
+                        if !bin_target_within_package_dir(r.as_bytes(), package_dir) {
+                            return;
+                        }
                         // SAFETY: `resolve_bin_target` writes into the thread-local
                         // `PARSER_JOIN_INPUT_BUFFER` (via `join_abs_string_z`); the
                         // returned slice does not actually borrow `self` or
@@ -1476,6 +1492,11 @@ impl<'a> Linker<'a> {
                             target,
                             normalized_name,
                         );
+                        // SECURITY: refuse `bin` targets that traverse outside the
+                        // package directory (would otherwise be symlinked + chmod 0o777).
+                        if !bin_target_within_package_dir(r.as_bytes(), package_dir) {
+                            return;
+                        }
                         // SAFETY: thread-local buffer; see Tag::File above.
                         ZStr::from_raw(r.as_bytes().as_ptr(), r.len())
                     };
@@ -1521,6 +1542,12 @@ impl<'a> Linker<'a> {
                                 bin_target,
                                 normalized_bin_dest,
                             );
+                            // SECURITY: refuse `bin` targets that traverse outside the
+                            // package directory (would otherwise be symlinked + chmod 0o777).
+                            if !bin_target_within_package_dir(r.as_bytes(), package_dir) {
+                                i += 2;
+                                continue;
+                            }
                             // SAFETY: thread-local buffer; see Tag::File above.
                             ZStr::from_raw(r.as_bytes().as_ptr(), r.len())
                         };
@@ -1551,6 +1578,11 @@ impl<'a> Linker<'a> {
                         let package_dir = &self.abs_target_buf[0..package_dir_len];
                         let r =
                             resolve_path::join_abs_string_z::<PlatformAuto>(package_dir, &[target]);
+                        // SECURITY: refuse `directories.bin` targets that traverse
+                        // outside the package directory.
+                        if !bin_target_within_package_dir(r.as_bytes(), package_dir) {
+                            return;
+                        }
                         // SAFETY: `join_abs_string_z` writes into the thread-local
                         // `PARSER_JOIN_INPUT_BUFFER`; result does not borrow
                         // `package_dir`. Detached so `abs_target_buf` can be

src/js/bun/sql.ts

@@ -744,8 +744,11 @@ const SQL: typeof Bun.SQL = function SQL(
         if (!$isCallable(savepoint_callback)) {
           throw $ERR_INVALID_ARG_VALUE("fn", callback, "must be a function");
         }
-        // matchs the format of the savepoint name in postgres package
-        const save_point_name = `s${savepoints++}${name ? `_${name}` : ""}`;
+        // matchs the format of the savepoint name in postgres package.
+        // Strip non-[A-Za-z0-9_] from the user-supplied name; it is interpolated
+        // unquoted into SAVEPOINT / RELEASE / ROLLBACK statements.
+        const safe_name = name ? String(name).replace(/[^A-Za-z0-9_]/g, "") : "";
+        const save_point_name = `s${savepoints++}${safe_name ? `_${safe_name}` : ""}`;
         const promise = run_internal_savepoint(save_point_name, savepoint_callback);
         transactionSavepoints.add(promise);
         return await promise.finally(onSavepointFinished.bind(null, promise));

src/js/internal/debugger.ts

@@ -592,7 +592,9 @@ function parseUrl(input: string): URL {
 }
 
 function randomId() {
-  return Math.random().toString(36).slice(2);
+  // Sole auth token for the debugger WebSocket — must be unpredictable.
+  // Strip hyphens to keep the historical `[a-z0-9]+` path shape.
+  return crypto.randomUUID().replace(/-/g, "");
 }
 
 const { enableANSIColors } = Bun;

src/js/internal/sql/mysql.ts

@@ -539,7 +539,15 @@ class MySQLAdapter
     };
   }
 
-  validateTransactionOptions(_options: string): { valid: boolean; error?: string } {
+  validateTransactionOptions(options: string): { valid: boolean; error?: string } {
+    // Options are interpolated unquoted into `START TRANSACTION ${options}`;
+    // restrict to letters/spaces/commas to prevent statement injection.
+    if (options && !/^[a-zA-Z, ]+$/.test(options)) {
+      return {
+        valid: false,
+        error: "Transaction options may only contain letters, spaces, and commas.",
+      };
+    }
     return { valid: true };
   }
 

src/js/internal/sql/postgres.ts

@@ -204,13 +204,20 @@ function arrayValueSerializer(type: ArrayType, is_numeric: boolean, is_json: boo
       return `"${arrayEscape(JSON.stringify(value))}"`;
   }
 }
+// `arrayType` is interpolated unquoted as `$N::<arrayType>[]`; restrict to
+// PostgreSQL type-name characters to prevent SQL injection.
+const VALID_ARRAY_TYPE_RE = /^[A-Z_][A-Z0-9_]*(?:[ .][A-Z_][A-Z0-9_]*)*$/;
 function getArrayType(typeNameOrID: number | ArrayType | undefined = undefined): ArrayType {
   const typeOfType = typeof typeNameOrID;
   if (typeOfType === "number") {
     return getPostgresArrayType(typeNameOrID as number) ?? "JSON";
   }
   if (typeOfType === "string") {
-    return (typeNameOrID as string)?.toUpperCase();
+    const arrayType = (typeNameOrID as string).toUpperCase();
+    if (!VALID_ARRAY_TYPE_RE.test(arrayType)) {
+      throw new Error(`Invalid PostgreSQL array type: ${JSON.stringify(typeNameOrID)}`);
+    }
+    return arrayType;
   }
   // default to JSON so we accept most of the types
   return "JSON";
@@ -766,8 +773,15 @@ class PostgresAdapter
     };
   }
 
-  validateTransactionOptions(_options: string): { valid: boolean; error?: string } {
-    // PostgreSQL accepts any transaction options
+  validateTransactionOptions(options: string): { valid: boolean; error?: string } {
+    // Options are interpolated unquoted into `BEGIN ${options}` (simple-query
+    // protocol allows stacked statements); restrict to letters/spaces/commas.
+    if (options && !/^[a-zA-Z, ]+$/.test(options)) {
+      return {
+        valid: false,
+        error: "Transaction options may only contain letters, spaces, and commas.",
+      };
+    }
     return { valid: true };
   }
 

src/js/internal/sql/sqlite.ts

@@ -686,6 +686,15 @@ class SQLiteAdapter implements DatabaseAdapter<BunSQLiteModule.Database, BunSQLi
       return { valid: true };
     }
 
+    // Options are interpolated unquoted into `BEGIN ${options}`; restrict to
+    // letters/spaces to prevent statement injection.
+    if (!/^[a-zA-Z ]+$/.test(options)) {
+      return {
+        valid: false,
+        error: "Transaction options may only contain letters and spaces.",
+      };
+    }
+
     const upperOptions = options.toUpperCase();
     if (upperOptions === "READONLY" || upperOptions === "READ") {
       return {