tina4ruby 3.13.137 → 3.13.139

data/lib/tina4/xml_parser.rb

@@ -0,0 +1,268 @@
+# frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+
+require "strscan"
+
+module Tina4
+  class WSDL
+    # A small, strict XML parser for SOAP request bodies (replaces REXML).
+    #
+    # Ported from the stack-based parser in tina4-nodejs (packages/core/src/wsdl.ts)
+    # and made strict, because the Ruby WSDL server has always answered
+    # "Malformed XML" for a broken body (Python's ElementTree does the same):
+    # tags must nest, there is exactly one root, and only the five predefined
+    # entities plus character references are understood.
+    #
+    # Deliberately NOT supported, so the attack surface does not exist:
+    #   * DTDs. `<!DOCTYPE` and every other `<!` declaration is a ParseError, so
+    #     there is no entity expansion (billion laughs) and no external entity
+    #     (XXE). The WSDL server also rejects DOCTYPE before parsing.
+    #   * Any encoding but UTF-8. Any byte order mark (UTF-8 included), a NUL
+    #     byte, invalid UTF-8, or an XML declaration naming another encoding is a
+    #     ParseError. A UTF-16 body used to slip past the `<!DOCTYPE` regex guard,
+    #     because the guard read "<\0!\0D\0..." while REXML decoded the BOM and
+    #     parsed the DTD.
+    #
+    # Element#text follows ElementTree (the Python master): the character data
+    # before the first child element, entity- and CDATA-decoded; nil when there
+    # is none. Element#name is the local name (prefix stripped), as REXML gave.
+    module XmlParser
+      class ParseError < StandardError; end
+
+      class Element
+        attr_reader :name, :prefix, :attributes, :elements
+
+        def initialize(qualified_name, attributes)
+          @prefix, _, local = qualified_name.rpartition(":")
+          @prefix = nil if @prefix.empty?
+          @name = local
+          @attributes = attributes
+          @elements = []
+          @text = nil
+          @seen_child = false
+        end
+
+        # Character data before the first child element (ElementTree .text).
+        def text
+          @text
+        end
+
+        def each_element(&block)
+          @elements.each(&block)
+        end
+
+        def append_text(data) # :nodoc:
+          return if @seen_child || data.empty?
+
+          @text = @text ? @text + data : data.dup
+        end
+
+        def append_child(element) # :nodoc:
+          @seen_child = true
+          @elements << element
+        end
+      end
+
+      Document = Struct.new(:root)
+
+      PREDEFINED_ENTITIES = { "lt" => "<", "gt" => ">", "amp" => "&", "quot" => '"', "apos" => "'" }.freeze
+      NAME = /[A-Za-z_:\u00C0-\u{EFFFF}][A-Za-z0-9_:.\-\u00B7\u00C0-\u{EFFFF}]*/
+      # Every byte order mark, the UTF-8 one included (the shared SOAP body rule:
+      # a body is plain UTF-8, never a BOM, in all four frameworks).
+      BYTE_ORDER_MARKS = ["\xEF\xBB\xBF".b, "\xFE\xFF".b, "\xFF\xFE".b, "\x00\x00\xFE\xFF".b].freeze
+      DECLARED_ENCODING = /\A<\?xml\b[^>]*?\bencoding\s*=\s*["']([^"']*)["']/
+
+      module_function
+
+      # Parse +xml+ (a String of any encoding tag; its BYTES must be UTF-8).
+      # Returns a Document whose #root is the single root Element.
+      def parse(xml)
+        Reader.new(utf8_text(xml)).document
+      end
+
+      # The body as UTF-8 text, or a ParseError. Callers that must refuse BEFORE
+      # any parse (the WSDL server) call this first; #parse calls it too.
+      def utf8_text(xml)
+        bytes = xml.to_s.b
+        raise ParseError, "only UTF-8 XML without a byte order mark is accepted" if BYTE_ORDER_MARKS.any? { |bom| bytes.start_with?(bom) }
+        raise ParseError, "only UTF-8 XML is accepted (NUL byte, UTF-16/UTF-32 body)" if bytes.include?("\x00")
+
+        text = bytes.force_encoding(Encoding::UTF_8)
+        raise ParseError, "only UTF-8 XML is accepted (invalid UTF-8 bytes)" unless text.valid_encoding?
+
+        declared = text[DECLARED_ENCODING, 1]
+        if declared && !declared.casecmp?("UTF-8")
+          raise ParseError, "only UTF-8 XML is accepted (declared encoding #{declared.inspect})"
+        end
+
+        text
+      end
+
+      def decode_references(raw)
+        return raw unless raw.include?("&")
+
+        raw.gsub(/&([^;&\s]*);?/) do |match|
+          raise ParseError, "unterminated reference #{match[0, 20].inspect}" unless match.end_with?(";")
+
+          name = Regexp.last_match(1)
+          if (replacement = PREDEFINED_ENTITIES[name])
+            replacement
+          elsif name =~ /\A#x([0-9A-Fa-f]{1,6})\z/ || name =~ /\A#([0-9]{1,7})\z/
+            codepoint = name.start_with?("#x") ? Regexp.last_match(1).to_i(16) : Regexp.last_match(1).to_i
+            raise ParseError, "invalid character reference &#{name};" unless xml_char?(codepoint)
+
+            [codepoint].pack("U")
+          else
+            raise ParseError, "undefined entity &#{name}; (DTDs are not supported)"
+          end
+        end
+      end
+
+      def xml_char?(codepoint)
+        [0x9, 0xA, 0xD].include?(codepoint) ||
+          (0x20..0xD7FF).cover?(codepoint) ||
+          (0xE000..0xFFFD).cover?(codepoint) ||
+          (0x10000..0x10FFFF).cover?(codepoint)
+      end
+
+      # Iterative (no recursion, so nesting depth cannot exhaust the stack).
+      class Reader
+        def initialize(text)
+          @scanner = StringScanner.new(text)
+          @stack = []        # open Elements, innermost last
+          @open_names = []   # their qualified names, for end-tag matching
+          @root = nil
+        end
+
+        def document
+          skip_xml_declaration
+          until @scanner.eos?
+            if @stack.empty?
+              read_outside_root
+            else
+              read_content
+            end
+          end
+          raise ParseError, "unclosed element <#{@stack.last.name}>" unless @stack.empty?
+          raise ParseError, "no root element" unless @root
+
+          Document.new(@root)
+        end
+
+        private
+
+        def skip_xml_declaration
+          return unless @scanner.check(/<\?xml[\s?]/)
+
+          @scanner.scan_until(/\?>/) or raise ParseError, "unterminated XML declaration"
+        end
+
+        # Between the prolog and the end: whitespace, comments, PIs, the root.
+        def read_outside_root
+          return if @scanner.skip(/\s+/)
+          return skip_comment if @scanner.check(/<!--/)
+          return skip_processing_instruction if @scanner.check(/<\?/)
+          raise ParseError, "DOCTYPE and other declarations are not supported" if @scanner.check(/<!/)
+          raise ParseError, "content after the root element" if @root
+          raise ParseError, "text outside the root element" unless @scanner.check(/</)
+
+          open_element
+        end
+
+        def read_content
+          if (data = @scanner.scan(/[^<]+/))
+            raise ParseError, "']]>' is not allowed in character data" if data.include?("]]>")
+
+            @stack.last.append_text(XmlParser.decode_references(data))
+          elsif @scanner.check(/<\//)
+            close_element
+          elsif @scanner.check(/<!--/)
+            skip_comment
+          elsif @scanner.skip(/<!\[CDATA\[/)
+            cdata = @scanner.scan_until(/\]\]>/) or raise ParseError, "unterminated CDATA section"
+            @stack.last.append_text(cdata[0...-3])
+          elsif @scanner.check(/<!/)
+            raise ParseError, "DOCTYPE and other declarations are not supported"
+          elsif @scanner.check(/<\?/)
+            skip_processing_instruction
+          else
+            open_element
+          end
+        end
+
+        def open_element
+          @scanner.skip(/</)
+          name = @scanner.scan(NAME) or raise ParseError, "invalid tag name at byte #{@scanner.pos}"
+          attributes = read_attributes
+          self_closing = !@scanner.skip(%r{/>}).nil?
+          raise ParseError, "unterminated tag <#{name}>" unless self_closing || @scanner.skip(/>/)
+
+          element = Element.new(name, attributes)
+          if @stack.empty?
+            @root = element
+          else
+            @stack.last.append_child(element)
+          end
+          return if self_closing
+
+          @stack.push(element)
+          @open_names.push(name)
+        end
+
+        def read_attributes
+          attributes = {}
+          loop do
+            had_space = @scanner.skip(/\s+/)
+            break if @scanner.check(%r{/?>})
+
+            raise ParseError, "attributes must be separated by whitespace" unless had_space
+
+            key = @scanner.scan(NAME) or raise ParseError, "invalid attribute at byte #{@scanner.pos}"
+            @scanner.skip(/\s*=\s*/) or raise ParseError, "attribute #{key} has no value"
+            quote = @scanner.getch
+            raise ParseError, "attribute #{key} value must be quoted" unless ['"', "'"].include?(quote)
+
+            value = @scanner.scan_until(/#{quote}/) or raise ParseError, "unterminated attribute #{key}"
+            value = value[0...-1]
+            raise ParseError, "'<' is not allowed in attribute #{key}" if value.include?("<")
+            raise ParseError, "duplicate attribute #{key}" if attributes.key?(key)
+
+            attributes[key] = XmlParser.decode_references(value)
+          end
+          attributes
+        end
+
+        def close_element
+          @scanner.skip(%r{</})
+          name = @scanner.scan(NAME) or raise ParseError, "invalid closing tag at byte #{@scanner.pos}"
+          @scanner.skip(/\s*/)
+          @scanner.skip(/>/) or raise ParseError, "unterminated closing tag </#{name}>"
+          expected = @open_names.last
+          raise ParseError, "unexpected closing tag </#{name}>" unless expected
+          raise ParseError, "mismatched tag: expected </#{expected}>, found </#{name}>" unless expected == name
+
+          @open_names.pop
+          @stack.pop
+        end
+
+        def skip_comment
+          @scanner.skip(/<!--/)
+          @scanner.skip_until(/-->/) or raise ParseError, "unterminated comment"
+        end
+
+        def skip_processing_instruction
+          @scanner.skip(/<\?/)
+          target = @scanner.check(NAME)
+          raise ParseError, "an XML declaration is only allowed at the very start" if target&.casecmp?("xml")
+
+          @scanner.skip_until(/\?>/) or raise ParseError, "unterminated processing instruction"
+        end
+      end
+    end
+  end
+end

data/lib/tina4.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # ── Core (always loaded) ──────────────────────────────────────────────
 require_relative "tina4/version"
@@ -144,6 +150,8 @@ module Tina4
 
   # ── Lazy-loaded: web server ───────────────────────────────────────────
   autoload :WebServer, File.expand_path("tina4/webserver", __dir__)
+  autoload :HttpServer, File.expand_path("tina4/http_server", __dir__)
+  autoload :FormParser, File.expand_path("tina4/form_parser", __dir__)
 
   # ── Lazy-loaded: optional modules ─────────────────────────────────────
   autoload :Swagger,             File.expand_path("tina4/swagger", __dir__)
@@ -151,6 +159,8 @@ module Tina4
   autoload :CRUD,                File.expand_path("tina4/crud", __dir__)
   autoload :API,                 File.expand_path("tina4/api", __dir__)
   autoload :APIResponse,         File.expand_path("tina4/api", __dir__)
+  autoload :Ssrf,                File.expand_path("tina4/ssrf", __dir__)
+  autoload :SsrfError,           File.expand_path("tina4/ssrf", __dir__)
   autoload :GraphQLType,         File.expand_path("tina4/graphql", __dir__)
   autoload :GraphQLSchema,       File.expand_path("tina4/graphql", __dir__)
   autoload :GraphQLParser,       File.expand_path("tina4/graphql", __dir__)
@@ -351,6 +361,13 @@ module Tina4
 /_/  /_/_/ /_/\__,_/  /_/
   BANNER
 
+  # Environment variables that mean "this is a CI run" - the ADR-0070 union
+  # across the four frameworks and the CLI. No one is there to see a tab.
+  CI_ENV_VARS = %w[CI CONTINUOUS_INTEGRATION GITHUB_ACTIONS GITLAB_CI BUILDKITE
+                   JENKINS_URL TF_BUILD TEAMCITY_VERSION].freeze
+  # A CI variable set to one of these does not mean CI (ADR-0070 ci_false).
+  CI_FALSE_VALUES = %w[false 0 no off].freeze
+
   class << self
     attr_accessor :root_dir
     attr_reader :database
@@ -404,18 +421,14 @@ module Tina4
       log_level = (ENV["TINA4_LOG_LEVEL"] || "ALL").upcase
       display = (host == "0.0.0.0" || host == "::") ? "localhost" : host
 
-      # Auto-detect server name if not provided
+      # Auto-detect server name if not provided: Puma only when production
+      # would actually pick it (ADR-0067), otherwise Tina4's own server.
       if server_name.nil?
-        if is_debug
-          server_name = "WEBrick"
-        else
-          begin
-            require "puma"
-            server_name = "puma"
-          rescue LoadError
-            server_name = "WEBrick"
-          end
-        end
+        server_name = if !is_debug && !builtin_webserver_pinned? && puma_available?
+                        "puma"
+                      else
+                        Tina4::HttpServer::SOFTWARE
+                      end
       end
 
       puts "#{color}#{BANNER}#{reset}"
@@ -438,8 +451,10 @@ module Tina4
     def initialize!(root_dir = Dir.pwd)
       @root_dir = root_dir
 
-      # Print banner
-      print_banner
+      # No banner here. The server start prints it (start_puma_server,
+      # WebServer#start) once the bind host and port are resolved; printed from
+      # here it named print_banner's defaults, localhost:7147, whatever the
+      # server really bound. Python prints it from run() for the same reason.
 
       # Load environment. Precedence: real-env > .env.local > .env
       # (.env.local loads first, both first-wins, so a real env var always wins).
@@ -466,8 +481,15 @@ module Tina4
       # boot after env load, before any auth use. Never crashes boot.
       Tina4::Auth.ensure_dev_secret(root_dir)
 
-      # Setup auth keys
-      Tina4::Auth.setup(root_dir)
+      # Point RS256 at <root>/.keys without creating anything: an
+      # operator-provisioned key pair keeps working, and a blank secret no
+      # longer mints one implicitly (ADR-0079 s2).
+      Tina4::Auth.keys_root = root_dir
+
+      # Refuse to serve with a secret anyone can reproduce: blank outside dev,
+      # or set but shorter than 32 bytes in any mode (ADR-0079 s2). Raises
+      # Tina4::Auth::InsecureSecretError naming TINA4_SECRET.
+      Tina4::Auth.require_boot_secret!
 
       # Auto-attach CSRF protection when TINA4_CSRF is enabled (OFF by default).
       # Mirrors the Python master's attach_csrf_from_env -- the env flag is the
@@ -530,14 +552,48 @@ module Tina4
       start
     end
 
-    def open_browser(url)
+    # Open the app in a browser only when ALL of these hold (ADR-0070):
+    #   * development: TINA4_DEBUG is truthy - never production or Puma
+    #   * TINA4_NO_BROWSER is not truthy (true/1/yes/on, trimmed, any case)
+    #   * --no-browser was not passed, and no_browser: true was not given
+    #   * no CI variable vetoes (see ci_run?)
+    # open_browser used to check none of it, so every app.rb booted through
+    # run! - and every spec that did so - popped a real tab.
+    def browser_launch_allowed?(argv: ARGV, no_browser: false)
+      return false if no_browser
+      return false unless Tina4::Env.is_truthy(ENV["TINA4_DEBUG"])
+      return false if Tina4::Env.is_truthy(ENV["TINA4_NO_BROWSER"])
+      return false if argv.include?("--no-browser")
+
+      !ci_run?
+    end
+
+    # A CI variable vetoes when it is set to a non-empty value (after
+    # trimming) that is not one of CI_FALSE_VALUES, case-insensitively - so
+    # CI=woodpecker vetoes and CI=false does not (ADR-0070).
+    def ci_run?
+      CI_ENV_VARS.any? do |name|
+        value = ENV[name].to_s.strip.downcase
+        !value.empty? && !CI_FALSE_VALUES.include?(value)
+      end
+    end
+
+    # TINA4_BROWSER_COMMAND names the launcher to run instead of the OS default
+    # (open / start / xdg-open); it receives the URL as its only argument.
+    def open_browser(url, no_browser: false)
+      return unless browser_launch_allowed?(no_browser: no_browser)
+
       require "rbconfig"
+      command = ENV["TINA4_BROWSER_COMMAND"].to_s.strip
       Thread.new do
         sleep 2
-        case RbConfig::CONFIG["host_os"]
-        when /darwin/i then system("open", url)
-        when /mswin|mingw/i then system("start", url)
-        else system("xdg-open", url)
+        if !command.empty? then system(command, url)
+        else
+          case RbConfig::CONFIG["host_os"]
+          when /darwin/i then system("open", url)
+          when /mswin|mingw/i then system("start", url)
+          else system("xdg-open", url)
+          end
         end
       end
     end
@@ -550,18 +606,25 @@ module Tina4
       Tina4::Frond.register_live_endpoint!
     end
 
-    def run!(root_dir = nil, port: nil, host: nil, debug: nil)
+    # no_browser: true keeps the browser shut (Python run(no_browser=True));
+    # false never forces one open (ADR-0070).
+    def run!(root_dir = nil, port: nil, host: nil, debug: nil, no_browser: false)
       # Handle legacy call: run!(port: 7147) where root_dir receives the hash
       if root_dir.is_a?(Hash)
         port ||= root_dir[:port]
         host ||= root_dir[:host]
         debug = root_dir[:debug] if debug.nil? && root_dir.key?(:debug)
+        no_browser ||= root_dir[:no_browser]
         root_dir = nil
       end
       root_dir ||= Dir.pwd
 
-      ENV["PORT"] = port.to_s if port
-      ENV["HOST"] = host.to_s if host
+      # An explicit argument beats the environment (ADR-0041), so it goes into
+      # the framework's own variables, which outrank everything else. Written
+      # into the bare PORT/HOST it lost to TINA4_PORT/TINA4_HOST and warned the
+      # app about a deprecated variable it never set.
+      ENV["TINA4_PORT"] = port.to_s if port
+      ENV["TINA4_HOST"] = host.to_s if host
       ENV["TINA4_DEBUG"] = debug.to_s unless debug.nil?
 
       initialize!(root_dir) unless @root_dir
@@ -603,22 +666,21 @@ module Tina4
       app = Tina4::RackApp.new(root_dir: root_dir)
       is_debug = Tina4::Env.is_truthy(ENV["TINA4_DEBUG"])
 
-      # Try Puma first (production-grade), fall back to WEBrick
+      # Puma when the APPLICATION bundles it (ADR-0067), otherwise the
+      # built-in server - in development AND production, as in Python.
       if !is_debug && !builtin_webserver_pinned? && puma_available?
-        open_browser(url)
         start_puma_server(app, host: host, port: port)
         return
       end
 
-      Tina4::Log.info("Development server: WEBrick")
-      open_browser(url)
+      open_browser(url, no_browser: no_browser)
       server = Tina4::WebServer.new(app, host: host, port: port)
       server.start
     end
 
-    # TINA4_DEFAULT_WEBSERVER=TRUE pins Tina4's BUILT-IN server (WEBrick) even
-    # in production, where Puma would otherwise be chosen. Unset/FALSE keeps
-    # today's behaviour, so this is non-breaking.
+    # TINA4_DEFAULT_WEBSERVER=TRUE pins Tina4's BUILT-IN server even when the
+    # application bundles Puma, which production would otherwise pick
+    # (ADR-0067). Unset/FALSE: Puma if it is loadable, else the built-in server.
     #
     # This is NOT the remedy for a production shutdown problem - an operator
     # must never have to give up Puma to get their database connections closed.
@@ -628,8 +690,10 @@ module Tina4
       Tina4::Env.is_truthy(ENV["TINA4_DEFAULT_WEBSERVER"])
     end
 
-    # Is Puma loadable? Separate from start_puma_server so the caller can fall
-    # back to WEBrick BEFORE any side effect (opening a browser) happens.
+    # Is Puma loadable? Puma is NOT a Tina4 dependency (ADR-0067): it is used
+    # only when the application installs it (under Bundler, when its Gemfile
+    # lists it). Separate from start_puma_server so the caller can fall back to
+    # the built-in server BEFORE any side effect (opening a browser) happens.
     def puma_available?
       require "puma"
       require "puma/configuration"
@@ -674,6 +738,7 @@ module Tina4
         user_config.raise_exception_on_sigterm false
       end
 
+      print_banner(host: host, port: port, server_name: "puma")
       Tina4::Log.info("Production server: puma (TINA4_SHUTDOWN_TIMEOUT=#{shutdown_timeout}s)")
       begin
         Puma::Launcher.new(config).run
@@ -916,7 +981,7 @@ module Tina4
       if db_url && !db_url.empty?
         begin
           bind_database(Tina4::Database.new(db_url))
-          Tina4::Log.info("Database connected: #{db_url.sub(/:[^:@]+@/, ':***@')}")
+          Tina4::Log.info("Database connected: #{Tina4::DatabaseUrl.redact(db_url)}")
         rescue => e
           Tina4::Log.error("Database connection failed: #{e.message}")
         end

data/lib/tina4ruby.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Alias: `require "tina4ruby"` loads the same code as `require "tina4"`
 require_relative "tina4"