tina4ruby 3.13.137 → 3.13.138

data/lib/tina4/cors.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   # CORS policy — reads config from env, computes the response headers.
@@ -37,6 +43,13 @@ module Tina4
         @warned = nil
       end
 
+      # The reasons warned about so far in this process - bounded by
+      # construction, never an origin (ADR-0048). Node's corsWarningReasons(),
+      # PHP's CorsMiddleware::warnedReasons().
+      def warned_reasons
+        (@warned || {}).keys.map(&:to_s)
+      end
+
       # The configured origins, split and emptied of blanks.
       def allowed_origins
         config[:origins].split(",").map(&:strip).reject(&:empty?)
@@ -56,8 +69,13 @@ module Tina4
         allowed = allowed_origins
         request_origin = env["HTTP_ORIGIN"]
 
+        # A same-origin request (browsers send Origin on every same-origin
+        # POST/PUT/PATCH/DELETE) is not a CORS request: it is never warned
+        # about. That ONLY silences the warning - it grants no CORS access.
+        cross_origin = present?(request_origin) && !same_origin?(env)
+
         if allowed.empty?
-          warn_once(:unconfigured, request_origin) if present?(request_origin)
+          warn_once(:unconfigured, request_origin) if cross_origin
           return {}
         end
 
@@ -70,7 +88,7 @@ module Tina4
 
         origin = resolve_origin(env)
         if origin.nil?
-          warn_once(:denied, request_origin) if present?(request_origin)
+          warn_once(:denied, request_origin) if cross_origin
           return headers
         end
 
@@ -150,6 +168,22 @@ module Tina4
         %w[true 1 yes].include?(config[:credentials].to_s.downcase)
       end
 
+      # Whether the request's Origin is the request's OWN origin
+      # (tina4-python #139). Own origin = scheme://host[:port], the scheme
+      # proxy-aware (Request.secure_scheme?, X-Forwarded-Proto first hop) and
+      # the host from X-Forwarded-Host, else Host. Both sides are normalised:
+      # lower-cased, default ports (http:80, https:443) dropped.
+      def same_origin?(env)
+        origin = normalize_origin(env["HTTP_ORIGIN"])
+        return false if origin.nil?
+
+        scheme = Tina4::Request.secure_scheme?(env) ? "https" : "http"
+        host = (env["HTTP_X_FORWARDED_HOST"] || env["HTTP_HOST"]).to_s.split(",").first.to_s.strip
+        return false if host.empty?
+
+        origin == normalize_origin("#{scheme}://#{host}")
+      end
+
       private
 
       def load_config
@@ -186,6 +220,20 @@ module Tina4
         !value.nil? && !value.to_s.empty?
       end
 
+      DEFAULT_PORTS = { "http" => 80, "https" => 443 }.freeze
+
+      # "scheme://host[:port]" lower-cased with a default port dropped, or nil
+      # for anything that is not an http(s) origin (e.g. "null").
+      def normalize_origin(value)
+        match = value.to_s.strip.chomp("/").match(%r{\A(https?)://([^/:\s]+|\[[^\]]+\])(?::(\d+))?\z}i)
+        return nil unless match
+
+        scheme = match[1].downcase
+        host = match[2].downcase
+        port = match[3]&.to_i
+        port.nil? || port == DEFAULT_PORTS[scheme] ? "#{scheme}://#{host}" : "#{scheme}://#{host}:#{port}"
+      end
+
       def merge_vary(current, field_name)
         parts = current.to_s.split(",").map(&:strip).reject(&:empty?)
         return parts.join(", ") if parts.any? { |p| p.casecmp?(field_name) }
@@ -193,17 +241,22 @@ module Tina4
         (parts + [field_name]).join(", ")
       end
 
-      # Log an actionable warning at most once per reason per process.
+      # Log an actionable warning at most once per REASON per process.
       #
       # A rejected cross-origin request is otherwise invisible: the browser
       # reports a generic CORS failure and the server log says nothing, so the
       # operator has to read the framework source to find the env var to set.
+      #
+      # BOUNDED (ADR-0048): keyed by reason only, never by origin. Keying
+      # :denied by "denied:<origin>" gave every attacker-chosen Origin header its
+      # own @warned entry (never freed) and its own log line - an unbounded
+      # ledger and an unbounded log. The message still names the origin that
+      # triggered it, the first time per reason.
       def warn_once(reason, request_origin)
         @warned ||= {}
-        key = reason == :denied ? "denied:#{request_origin}" : reason
-        return if @warned[key]
+        return if @warned[reason]
 
-        @warned[key] = true
+        @warned[reason] = true
         Tina4::Log.warning(warning_message(reason, request_origin))
       rescue StandardError
         nil # logging must never break a request
@@ -211,13 +264,16 @@ module Tina4
 
       def warning_message(reason, request_origin)
         case reason
+        # Neither message ever suggests the wildcard: allowing every website to
+        # silence one warning is the wrong fix. Each names the ONE origin to add.
         when :unconfigured
-          "CORS: refused cross-origin request from #{request_origin} - no policy is configured. " \
-            "Set TINA4_CORS_ORIGINS to the origins you want to allow, e.g. " \
-            "TINA4_CORS_ORIGINS=https://app.example.com (or '*' to allow any origin)."
+          "CORS: cross-origin request from #{request_origin}, but no CORS policy is configured, " \
+            "so the browser will block this response. If that origin should be allowed, " \
+            "add it: TINA4_CORS_ORIGINS=#{request_origin}"
         when :denied
           "CORS: origin #{request_origin} is not in TINA4_CORS_ORIGINS (#{config[:origins]}) " \
-            "- the browser will block this response."
+            "- the browser will block this response. If it should be allowed, add it: " \
+            "TINA4_CORS_ORIGINS=#{config[:origins]},#{request_origin}"
         else
           "CORS: TINA4_CORS_CREDENTIALS is true but TINA4_CORS_ORIGINS is '*'. The Fetch Standard " \
             "forbids Access-Control-Allow-Origin: * with credentials, so credentials are NOT being " \

data/lib/tina4/crud.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "json"
 
 module Tina4
@@ -59,7 +65,7 @@ module Tina4
         query_params = request.respond_to?(:query) ? request.query : {}
         page       = [(query_params["page"] || 1).to_i, 1].max
         search     = query_params["search"].to_s.strip
-        sort_col   = query_params["sort"] || pk
+        sort_col   = crud_sort_column(model, sql, query_params["sort"], pk)
         sort_dir   = query_params["sort_dir"] == "desc" ? "desc" : "asc"
         offset     = (page - 1) * limit
 
@@ -213,8 +219,8 @@ module Tina4
         # POST create
         Tina4::Router.add("POST", api_path, proc { |req, res|
           begin
-            data = req.body_parsed
-            result = db.insert(table_name, data)
+            data = table_column_attributes(db, table_name, req.body_parsed)
+            db.insert(table_name, data)
             res.json({ data: data, message: "Created" }, status: 201)
           rescue => e
             res.json({ error: e.message }, status: 500)
@@ -225,7 +231,8 @@ module Tina4
         Tina4::Router.add("PUT", "#{api_path}/{id}", proc { |req, res|
           begin
             id = req.params["id"]
-            data = req.body_parsed
+            # The row is addressed by the URL id only, never by a body pk.
+            data = table_column_attributes(db, table_name, req.body_parsed, strip: pk)
             db.update(table_name, data, { pk => id })
             res.json({ data: data, message: "Updated" })
           rescue => e
@@ -245,6 +252,68 @@ module Tina4
         })
       end
 
+      # tina4: ADR-0069 - a SQL-mode write body is allow-listed against the
+      # table's REAL columns (matched case-insensitively, written in the
+      # introspected spelling); unknown keys are dropped, is_deleted is never
+      # client-writable, and +strip+ (the pk on update) is removed. Same write
+      # rule as AutoCrud (CRUD-DEC-02).
+      def table_column_attributes(db, table_name, data, strip: nil)
+        return {} unless data.is_a?(Hash)
+
+        columns = db.columns(table_name).to_h { |column| [column[:name].to_s.downcase, column[:name].to_s] }
+        blocked = ["is_deleted", strip.to_s.downcase]
+        data.each_with_object({}) do |(key, value), allowed|
+          column = columns[key.to_s.downcase]
+          next if column.nil? || blocked.include?(column.downcase)
+
+          allowed[column] = value
+        end
+      end
+
+      # tina4: ADR-0069 - ?sort reaches ORDER BY only as a column the source
+      # itself declares: a model's declared field (resolved to its DB column) or
+      # a column of the SQL query's own result set. Anything else falls back to
+      # the primary key - this is a rendered page, not an API, so no error.
+      def crud_sort_column(model, sql, requested, pk)
+        return pk if requested.nil? || requested.empty?
+        return model.resolve_field_column(requested) || pk if model
+
+        sql_result_columns(sql).include?(requested) ? requested : pk
+      end
+
+      # The query with any ORDER BY / LIMIT clause removed, then stripped.
+      #
+      # Line by line with plain string operations - a case-insensitive search
+      # for the keyword, then a cut to the end of that line - so it is linear on
+      # any input (the regex it replaces was flagged as polynomial by CodeQL).
+      # Same result: a keyword is removed with the rest of its line only when at
+      # least one character follows it, and the line break is kept.
+      def strip_order_and_limit(sql)
+        sql.to_s.each_line.map do |line|
+          cut_from_keyword(cut_from_keyword(line, /ORDER BY /i), /LIMIT /i)
+        end.join.strip
+      end
+
+      # +keyword+ is a fixed literal with no quantifier, so the search is linear.
+      def cut_from_keyword(line, keyword)
+        ending = line.end_with?("\n") ? "\n" : ""
+        content = ending.empty? ? line : line[0...-1]
+        at = content.index(keyword)
+        return line if at.nil? || content.length <= at + keyword.source.length
+
+        content[0...at] + ending
+      end
+
+      # Column names of the SQL query's result set, read from one probe row.
+      def sql_result_columns(sql)
+        db = Tina4.database
+        return [] unless db
+
+        base = strip_order_and_limit(sql)
+        row = db.fetch("SELECT * FROM (#{base}) AS _crud_sub", [], limit: 1).first
+        row ? row.keys.map(&:to_s) : []
+      end
+
       # Fetch data using an ORM model class
       def fetch_model_data(model, search: "", sort: "id", sort_dir: "asc", limit: 10, offset: 0)
         order_by = "#{sort} #{sort_dir.upcase}"
@@ -280,12 +349,12 @@ module Tina4
         return [[], 0] unless db
 
         # Wrap the original SQL for sorting
-        query = sql.gsub(/ORDER BY .+$/i, "").gsub(/LIMIT .+$/i, "").strip
-        query += " ORDER BY #{sort} #{sort_dir.upcase}"
+        base = strip_order_and_limit(sql)
+        query = "#{base} ORDER BY #{sort} #{sort_dir.upcase}"
 
         if !search.empty?
           # Wrap in a subquery to add search filtering
-          wrapped = "SELECT * FROM (#{sql.gsub(/ORDER BY .+$/i, '').gsub(/LIMIT .+$/i, '').strip}) AS _crud_sub WHERE "
+          wrapped = "SELECT * FROM (#{base}) AS _crud_sub WHERE "
           columns = extract_columns(sql)
           search_parts = columns.map { |col| "CAST(#{col} AS TEXT) LIKE ?" }
           wrapped += search_parts.join(" OR ")
@@ -293,14 +362,14 @@ module Tina4
           params = columns.map { "%#{search}%" }
 
           # Get total count
-          count_sql = "SELECT COUNT(*) as cnt FROM (#{sql.gsub(/ORDER BY .+$/i, '').gsub(/LIMIT .+$/i, '').strip}) AS _crud_cnt WHERE #{search_parts.join(' OR ')}"
+          count_sql = "SELECT COUNT(*) as cnt FROM (#{base}) AS _crud_cnt WHERE #{search_parts.join(' OR ')}"
           count_result = db.fetch_one(count_sql, params)
           total = count_result ? (count_result[:cnt] || count_result["cnt"] || 0).to_i : 0
 
           results = db.fetch(wrapped, params, limit: limit, offset: offset)
         else
           # Get total count
-          count_sql = "SELECT COUNT(*) as cnt FROM (#{sql.gsub(/ORDER BY .+$/i, '').gsub(/LIMIT .+$/i, '').strip}) AS _crud_cnt"
+          count_sql = "SELECT COUNT(*) as cnt FROM (#{base}) AS _crud_cnt"
           count_result = db.fetch_one(count_sql)
           total = count_result ? (count_result[:cnt] || count_result["cnt"] || 0).to_i : 0
 

data/lib/tina4/database/sqlite3_adapter.rb

@@ -1,4 +1,12 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+
+require_relative "../sqlite3_gem"
 
 module Tina4
   module Adapters
@@ -13,7 +21,7 @@ module Tina4
       end
 
       def connect(connection_string)
-        require "sqlite3"
+        Tina4.require_sqlite3!
         @db_path = self.class.resolve_path(connection_string)
         @connection = SQLite3::Database.new(@db_path)
         @connection.results_as_hash = true