tina4ruby 3.13.137 → 3.13.139

data/lib/tina4/graphql.rb

@@ -1,6 +1,13 @@
 # frozen_string_literal: false
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
+require_relative "parse_json"
 
 module Tina4
   # Lightweight, zero-dependency GraphQL implementation for Tina4 Ruby.
@@ -140,9 +147,15 @@ module Tina4
       # ── Queries ──
 
       # Single record: user(id: ID!): User
+      # The row an ID argument addresses, or nil. The ID is bound, never
+      # interpolated, and a non-integer ID on an integer key addresses nothing.
+      find_addressed = lambda do |raw_id|
+        pk_value = klass.respond_to?(:coerce_primary_key) ? klass.coerce_primary_key(raw_id) : raw_id
+        pk_value.nil? ? nil : klass.find_by_id(pk_value)
+      end
+
       add_query(table_lower, { pk_field => { type: "ID!" } }, type_name) do |_root, args, _ctx|
-        record = klass.find_by_id(args[pk_field])
-        record&.to_hash
+        find_addressed.call(args[pk_field])&.to_hash
       end
 
       # List: users(limit: Int, offset: Int): [User]
@@ -163,8 +176,10 @@ module Tina4
 
       # Update
       add_mutation("update#{model_name}", { pk_field => { type: "ID!" }, "input" => { type: "#{type_name}Input!" } }, type_name) do |_root, args, _ctx|
-        record = klass.find_by_id(args[pk_field])
-        return nil unless record
+        record = find_addressed.call(args[pk_field])
+        # `next`, not `return`: this block outlives from_orm, so a `return` here
+        # raised LocalJumpError (an internal error) for a non-matching id.
+        next nil unless record
         (args["input"] || {}).each { |k, v| record.send(:"#{k}=", v) if record.respond_to?(:"#{k}=") }
         record.save
         record.to_hash
@@ -172,8 +187,8 @@ module Tina4
 
       # Delete
       add_mutation("delete#{model_name}", { pk_field => { type: "ID!" } }, "Boolean") do |_root, args, _ctx|
-        record = klass.find_by_id(args[pk_field])
-        return false unless record
+        record = find_addressed.call(args[pk_field])
+        next false unless record
         record.delete
         true
       end
@@ -212,13 +227,19 @@ module Tina4
       @source = source
       @tokens = tokenize(source)
       @pos = 0
+      # F2: bound the parser's own recursion. A deeply nested query
+      # ("{a{a{a...}}}") otherwise recurses in parse_selection_set until Ruby
+      # raises SystemStackError — which is NOT a StandardError, so the public
+      # execute's `rescue => e` misses it and it escapes as a 500. Raising a
+      # GraphQLError (a StandardError) at the depth bound keeps it caught and
+      # returned as a clean GraphQL error. Reuses TINA4_GRAPHQL_MAX_DEPTH.
+      @depth = 0
+      @max_depth = Integer(ENV.fetch("TINA4_GRAPHQL_MAX_DEPTH", "50"), exception: false) || 50
     end
 
     def parse
       document = { kind: :document, definitions: [] }
       while current
-        skip(:comma)
-        break unless current
         document[:definitions] << parse_definition
       end
       document
@@ -234,8 +255,10 @@ module Tina4
       while i < src.length
         ch = src[i]
 
-        # Skip whitespace
-        if ch =~ /\s/
+        # Skip whitespace. Commas are insignificant in GraphQL (spec 2.1.7) and
+        # are skipped with it; emitting them as punctuation made every
+        # comma-separated argument or field list a parse error.
+        if ch =~ /\s/ || ch == ","
           i += 1
           next
         end
@@ -247,7 +270,7 @@ module Tina4
         end
 
         # Punctuation
-        if "{}()[]!:=@$,".include?(ch)
+        if "{}()[]!:=@$".include?(ch)
           tokens << Token.new(:punct, ch, i)
           i += 1
           next
@@ -355,10 +378,6 @@ module Tina4
       advance
     end
 
-    def skip(type, value = nil)
-      match(type, value) while current && current.type == type && (value.nil? || current.value == value)
-    end
-
     # ── Parse rules ──
 
     def parse_definition
@@ -401,8 +420,6 @@ module Tina4
       expect(:punct, "(")
       vars = []
       until current&.value == ")"
-        skip(:comma)
-        break if current&.value == ")"
         expect(:punct, "$")
         vname = expect(:name).value
         expect(:punct, ":")
@@ -430,11 +447,22 @@ module Tina4
     end
 
     def parse_selection_set
+      @depth += 1
+      if @max_depth.positive? && @depth > @max_depth
+        @depth -= 1
+        raise GraphQLError, "Query exceeds maximum depth of #{@max_depth}"
+      end
+      begin
+        parse_selection_set_inner
+      ensure
+        @depth -= 1
+      end
+    end
+
+    def parse_selection_set_inner
       expect(:punct, "{")
       selections = []
       until current&.value == "}"
-        skip(:comma)
-        break if current&.value == "}"
 
         if current&.type == :spread
           selections << parse_fragment_spread
@@ -496,8 +524,6 @@ module Tina4
       expect(:punct, "(")
       args = {}
       until current&.value == ")"
-        skip(:comma)
-        break if current&.value == ")"
         arg_name = expect(:name).value
         expect(:punct, ":")
         args[arg_name] = parse_value
@@ -547,8 +573,6 @@ module Tina4
       expect(:punct, "[")
       items = []
       until current&.value == "]"
-        skip(:comma)
-        break if current&.value == "]"
         items << parse_value
       end
       expect(:punct, "]")
@@ -559,8 +583,6 @@ module Tina4
       expect(:punct, "{")
       obj = {}
       until current&.value == "}"
-        skip(:comma)
-        break if current&.value == "}"
         key = expect(:name).value
         expect(:punct, ":")
         obj[key] = parse_value
@@ -598,14 +620,47 @@ module Tina4
   class GraphQLExecutor
     # max_depth bounds selection-set nesting (DoS / stack-overflow guard).
     # Threaded down from the owning GraphQL instance; <= 0 disables the guard.
-    attr_accessor :max_depth
+    attr_accessor :max_depth, :max_nodes
 
-    def initialize(schema, max_depth: 50)
+    def initialize(schema, max_depth: 50, max_nodes: 1000)
       @schema = schema
       @max_depth = max_depth
+      # F2: maximum expanded selection nodes per query. The depth guard bounds
+      # NESTING but not WIDTH — a fragment bomb stays shallow while expanding to
+      # millions of fields, and an alias explosion is not deep at all. This
+      # budget bounds the expanded selection tree (fragments expanded, each
+      # alias counted) so both are rejected before any resolver runs.
+      @max_nodes = max_nodes
     end
 
-    def execute(document, variables: {}, context: {}, operation_name: nil)
+    # F2: count the expanded selection nodes, aborting past max_nodes. Fragment
+    # spreads are expanded (so a fragment bomb is counted, not the small
+    # unexpanded document) and every field — including each alias — counts once.
+    # Capped by max_nodes and by the depth cap, so a circular fragment trips the
+    # budget instead of looping and the check can never cost more than the budget.
+    def query_complexity(selections, fragments, depth, count)
+      depth_cap = (@max_depth && @max_depth.positive?) ? @max_depth : 1000
+      return count if depth > depth_cap
+
+      selections.each do |sel|
+        count += 1
+        return count if count > @max_nodes
+
+        case sel[:kind]
+        when :fragment_spread
+          frag = fragments[sel[:name]]
+          count = query_complexity(frag[:selection_set], fragments, depth + 1, count) if frag
+        when :inline_fragment
+          count = query_complexity(sel[:selection_set] || [], fragments, depth + 1, count)
+        else
+          count = query_complexity(sel[:selection_set], fragments, depth + 1, count) if sel[:selection_set]
+        end
+        return count if count > @max_nodes
+      end
+      count
+    end
+
+    def execute(document, variables: {}, context: {}, operation_name: nil, allow_mutations: true)
       # Collect fragments
       fragments = {}
       operations = []
@@ -630,9 +685,28 @@ module Tina4
 
       raise GraphQLError, "Unknown operation: #{operation_name}" unless operation
 
+      # F2: reject an over-complex query (fragment bomb / alias explosion) before
+      # any resolver runs.
+      if @max_nodes && @max_nodes.positive?
+        complexity = query_complexity(operation[:selection_set], fragments, 1, 0)
+        if complexity > @max_nodes
+          return { "data" => nil,
+                   "errors" => [{ "message" => "Query exceeds maximum complexity of #{@max_nodes} nodes" }] }
+        end
+      end
+
       # Resolve variables
       resolved_vars = resolve_variables(operation[:variables], variables)
 
+      # F4 (CSRF): a mutation must never run over a GET. A cross-site GET (an
+      # <img>/<script> src, a pre-rendered link) carries the victim's cookies
+      # and would otherwise trigger a state change. The GET handler passes
+      # allow_mutations: false; POST (which a browser cannot cross-site forge
+      # with a JSON content-type without a CORS preflight) still allows them.
+      if operation[:operation] == :mutation && !allow_mutations
+        raise GraphQLError, "Mutations are not allowed over GET"
+      end
+
       # Choose root fields
       root_fields = case operation[:operation]
                     when :query    then @schema.queries
@@ -896,6 +970,15 @@ module Tina4
       @executor&.max_depth = value
     end
 
+    # F2 complexity budget — see GraphQLExecutor#max_nodes. Writer keeps the
+    # executor in sync so tests/app code can override it.
+    attr_reader :max_nodes
+
+    def max_nodes=(value)
+      @max_nodes = value
+      @executor&.max_nodes = value
+    end
+
     # Class-level toggle for ORM auto-schema generation. Defaults to true,
     # can be disabled via TINA4_GRAPHQL_AUTO_SCHEMA=false. Initializers and
     # user app code can branch on this before calling `schema.from_orm(...)`.
@@ -968,7 +1051,10 @@ module Tina4
       # GraphQL DoS / stack-overflow vector. Default 50 is far beyond any
       # legitimate query; TINA4_GRAPHQL_MAX_DEPTH <= 0 disables the guard.
       @max_depth = Integer(ENV.fetch("TINA4_GRAPHQL_MAX_DEPTH", "50"), exception: false) || 50
-      @executor = GraphQLExecutor.new(@schema, max_depth: @max_depth)
+      # F2: expanded-node (complexity) budget — bounds query WIDTH (fragment
+      # bombs, alias explosions), which the depth guard does not.
+      @max_nodes = Integer(ENV.fetch("TINA4_GRAPHQL_MAX_NODES", "1000"), exception: false) || 1000
+      @executor = GraphQLExecutor.new(@schema, max_depth: @max_depth, max_nodes: @max_nodes)
       @field_resolvers = {}
 
       # Drain any resolvers registered via the class-level GraphQL.resolve()
@@ -1009,10 +1095,11 @@ module Tina4
     end
 
     # Execute a query string directly
-    def execute(query, variables: {}, context: {}, operation_name: nil)
+    def execute(query, variables: {}, context: {}, operation_name: nil, allow_mutations: true)
       parser = GraphQLParser.new(query)
       document = parser.parse
-      @executor.execute(document, variables: variables, context: context, operation_name: operation_name)
+      @executor.execute(document, variables: variables, context: context,
+                        operation_name: operation_name, allow_mutations: allow_mutations)
     rescue GraphQLError => e
       { "data" => nil, "errors" => [{ "message" => e.message }] }
     rescue => e
@@ -1057,7 +1144,7 @@ module Tina4
 
     # Handle an HTTP request body (JSON string)
     def handle_request(body, context: {})
-      payload = JSON.parse(body)
+      payload = Tina4.parse_json(body)
       query = payload["query"] || ""
       variables = payload["variables"] || {}
       op_name = payload["operationName"]
@@ -1082,6 +1169,16 @@ module Tina4
 
       graphql = self
       Tina4.post path, auth: false do |request, response|
+        # F4 (CSRF): require an application/json content-type. A browser can
+        # only send a cross-site POST with text/plain, form-urlencoded or
+        # multipart bodies without a CORS preflight; demanding JSON forces the
+        # preflight (and its same-origin/allow-list check) for any cross-site
+        # caller, so a forged form cannot drive a mutation. Same-origin XHR/
+        # fetch and server clients set application/json and are unaffected.
+        unless request.content_type.to_s.downcase.include?("application/json")
+          next response.json({ "data" => nil, "errors" => [{ "message" =>
+            "GraphQL requires a Content-Type of application/json" }] }, 415)
+        end
         # handle_request expects the raw JSON text (it JSON.parses internally),
         # so read body_raw — request.body now returns the PARSED payload.
         body = request.body_raw
@@ -1089,13 +1186,15 @@ module Tina4
         response.json(result)
       end
 
-      # Optional: GET for GraphiQL/introspection
+      # Optional: GET for GraphiQL/introspection. Queries only — a mutation over
+      # GET is refused (F4), since a cross-site GET carries the victim's cookies.
       Tina4.get path, auth: false do |request, response|
         query = request.query["query"]
         if query
           variables = request.query["variables"]
-          variables = JSON.parse(variables) if variables.is_a?(String) && !variables.empty?
-          result = graphql.execute(query, variables: variables || {}, context: { request: request })
+          variables = Tina4.parse_json(variables) if variables.is_a?(String) && !variables.empty?
+          result = graphql.execute(query, variables: variables || {},
+                                   context: { request: request }, allow_mutations: false)
           response.json(result)
         else
           response.html(graphiql_html(path))

data/lib/tina4/health.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 

data/lib/tina4/html_element.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   # Marker for trusted, pre-sanitised HTML that must render UNESCAPED.