tina4ruby 3.13.137 → 3.13.139

data/lib/tina4/frond.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Tina4 Frond Engine -- Lexer, parser, and runtime.
 # Zero-dependency twig-like template engine.
@@ -8,13 +14,14 @@
 
 require "json"
 require "digest"
-require "base64"
-require "cgi"
+require_relative "base64"
+require "cgi/escape"
 require "erb"
 require "uri"
 require "date"
 require "time"
 require "securerandom"
+require_relative "parse_json"
 
 module Tina4
   # Marker class for strings that should not be auto-escaped in Frond.
@@ -484,6 +491,38 @@ module Tina4
     # The escaping decision has to ask this rather than read the filter name out
     # of the source: a denied `raw` that still marked its value safe made the
     # allow-list entry governing XSS escaping inert.
+    # Words in an expression that are not variable references.
+    SANDBOX_EXPR_KEYWORDS = %w[true false none null nil and or not in is loop
+                               if else empty starts ends with matches].freeze
+    SANDBOX_IDENT_RE  = /(?<![.\w'"])([A-Za-z_][A-Za-z0-9_]*)/
+    SANDBOX_STRING_RE = /'[^']*'|"[^"]*"/
+    # Methods that must never be invoked through {{ obj.method }} — reflection,
+    # metaprogramming and process control (F6/ADR-0077).
+    UNSAFE_METHODS = %w[send __send__ public_send instance_eval instance_exec
+                        eval class methods public_methods private_methods
+                        instance_variables instance_variable_get
+                        instance_variable_set define_singleton_method method
+                        tap then object_id __id__ system exec spawn binding
+                        singleton_class ancestors superclass constants
+                        const_get remove_method].to_set.freeze
+
+    # Sandbox gate for a WHOLE expression (F6/ADR-0077): refuse a dunder walk
+    # or a root variable outside the allow-list, in output, conditions, set
+    # right-hand sides and for iterables alike.
+    def sandbox_expr_ok?(expr)
+      return true unless @sandbox
+      return false if expr.include?("__")
+      return true unless @allowed_vars
+
+      stripped = expr.gsub(SANDBOX_STRING_RE, "")
+      stripped.scan(SANDBOX_IDENT_RE).each do |(ident)|
+        next if SANDBOX_EXPR_KEYWORDS.include?(ident.downcase)
+        next if @filters.key?(ident)
+        return false unless @allowed_vars.include?(ident)
+      end
+      true
+    end
+
     def filter_permitted?(name)
       return true unless @sandbox && @allowed_filters
 
@@ -506,6 +545,83 @@ module Tina4
       str.to_s.gsub(HTML_ESCAPE_RE, HTML_ESCAPE_MAP)
     end
 
+    # -- Escape strategies (ADR-0077) ------------------------------------
+    # Shared by js_escape and e(strategy); byte-identical to the Python
+    # master. Twig-compatible.
+    JS_SAFE_RE  = /[A-Za-z0-9,._]/
+    CSS_SAFE_RE = /[A-Za-z0-9]/
+    ATTR_SAFE_RE = /[A-Za-z0-9,.\-_]/
+
+    def self.js_escape_str(value)
+      out = +""
+      value.to_s.each_char do |ch|
+        if ch =~ JS_SAFE_RE
+          out << ch
+          next
+        end
+        code = ch.ord
+        if code < 0x80
+          out << format("\\x%02X", code)
+        elsif code <= 0xFFFF
+          out << format("\\u%04X", code)
+        else
+          code -= 0x10000
+          out << format("\\u%04X", 0xD800 + (code >> 10))
+          out << format("\\u%04X", 0xDC00 + (code & 0x3FF))
+        end
+      end
+      out
+    end
+
+    def self.css_escape(value)
+      out = +""
+      value.to_s.each_char do |ch|
+        out << (ch =~ CSS_SAFE_RE ? ch : format("\\%06X ", ch.ord))
+      end
+      out
+    end
+
+    def self.html_attr_escape(value)
+      out = +""
+      value.to_s.each_char do |ch|
+        out << (ch =~ ATTR_SAFE_RE ? ch : format("&#x%02X;", ch.ord))
+      end
+      out
+    end
+
+    # RFC-3986 rawurlencode: unreserved set stays, everything else percent-encoded.
+    def self.url_escape(value)
+      value.to_s.b.gsub(/[^A-Za-z0-9\-_.~]/) { |c| format("%%%02X", c.ord) }
+    end
+
+    # Dispatch e(strategy)/escape(strategy). An unknown strategy raises, so a
+    # typo can never silently pass the value through unescaped.
+    def self.escape_strategy(value, strategy = "html")
+      s = strategy.to_s.strip.gsub(/\A['"]|['"]\z/, "")
+      case s
+      when "", "html"
+        Tina4::SafeString.new(escape_html(value.to_s))
+      when "js"
+        Tina4::SafeString.new(js_escape_str(value))
+      when "url"
+        Tina4::SafeString.new(url_escape(value))
+      when "css"
+        Tina4::SafeString.new(css_escape(value))
+      when "html_attr", "attr"
+        Tina4::SafeString.new(html_attr_escape(value))
+      else
+        raise ArgumentError, "Unknown escape strategy: #{strategy}"
+      end
+    end
+
+    # Confine a client-supplied media type to a strict type/subtype grammar
+    # (F3/ADR-0077); anything malformed falls back to a safe default.
+    MEDIA_TYPE_RE = %r{\A[A-Za-z0-9][A-Za-z0-9!\#$&^_.+-]*/[A-Za-z0-9][A-Za-z0-9!\#$&^_.+-]*\z}
+    def self.sanitise_media_type(type)
+      t = type.to_s.strip
+      t =~ MEDIA_TYPE_RE ? t : "application/octet-stream"
+    end
+
     # Serializes a value to compact JSON text that is always valid JSON.
     #
     # Never raises and never returns an empty string: a non-finite float becomes
@@ -616,35 +732,54 @@ module Tina4
     # Tokenizer
     # -----------------------------------------------------------------------
 
-    # Regex to extract {% raw %}...{% endraw %} blocks before tokenizing
-    RAW_BLOCK_RE = /\{%-?\s*raw\s*-?%\}(.*?)\{%-?\s*endraw\s*-?%\}/m
-
+    # Walk literal delimiters instead of retrying a whole-template regex at
+    # every unmatched opener. This also bounds parsing on Ruby versions that
+    # do not memoize regexp backtracking.
     def tokenize(source)
-      # 1. Extract raw blocks and replace with placeholders
       raw_blocks = []
-      source = source.gsub(RAW_BLOCK_RE) do
-        idx = raw_blocks.length
-        raw_blocks << Regexp.last_match(1)
-        "\x00RAW_#{idx}\x00"
+      chunks = []
+      copied = 0
+      cursor = 0
+      raw_start = nil
+      while (start = source.index("{%", cursor))
+        cursor = start + 2
+        match = /\G\{%-?\s*(raw|endraw)\s*-?%\}/.match(source, start)
+        next unless match
+        finish = match.end(0) - 2
+        tag = match[1]
+        if tag == "raw" && raw_start.nil?
+          raw_start = [start, finish + 2]
+        elsif tag == "endraw" && raw_start
+          chunks << source[copied...raw_start[0]]
+          chunks << "\x00RAW_#{raw_blocks.length}\x00"
+          raw_blocks << source[raw_start[1]...start]
+          copied = finish + 2
+          raw_start = nil
+        end
       end
+      chunks << source[copied..]
+      source = chunks.join
 
-      # 2. Normal tokenization
       tokens = []
       pos = 0
-      source.scan(TOKEN_RE) do
-        m = Regexp.last_match
-        start = m.begin(0)
-        tokens << [TEXT, source[pos...start]] if start > pos
-
-        raw = m[0]
-        if raw.start_with?("{#")
-          tokens << [COMMENT, raw]
-        elsif raw.start_with?("{{")
-          tokens << [VAR, raw]
-        elsif raw.start_with?("{%")
-          tokens << [BLOCK, raw]
+      cursor = 0
+      missing_close = {}
+      closers = { "{%" => "%}", "{{" => "}}", "{#" => "#}" }
+      while (match = /\{%|\{\{|\{#/.match(source, cursor))
+        start = match.begin(0)
+        opener = match[0]
+        cursor = start + 2
+        next if missing_close[opener]
+        finish = source.index(closers.fetch(opener), cursor)
+        unless finish
+          missing_close[opener] = true
+          next
         end
-        pos = m.end(0)
+        tokens << [TEXT, source[pos...start]] if start > pos
+        raw = source[start...(finish + 2)]
+        type = { "{#" => COMMENT, "{{" => VAR, "{%" => BLOCK }.fetch(opener)
+        tokens << [type, raw]
+        pos = cursor = finish + 2
       end
       tokens << [TEXT, source[pos..]] if pos < source.length
 
@@ -1155,6 +1290,10 @@ module Tina4
     end
 
     def eval_var_raw(expr, context)
+      # Sandbox: gate the whole condition/RHS (F6) so a comparison or iterable
+      # cannot leak a blocked variable.
+      return nil if @sandbox && !sandbox_expr_ok?(expr)
+
       var_name, filters = parse_filter_chain(expr)
       value = eval_expr(var_name, context)
       filters.each do |fname, args|
@@ -1232,16 +1371,8 @@ module Tina4
 
       var_name, filters = parse_filter_chain(expr)
 
-      # Sandbox: check variable access
-      if @sandbox && @allowed_vars
-        root_var = @dotted_split_cache[var_name]
-        unless root_var
-          root_var = var_name.split(".")[0].split("[")[0].strip
-          cap_cache(@dotted_split_cache, MEMO_CACHE_MAX)
-          @dotted_split_cache[var_name] = root_var
-        end
-        return "" if !root_var.empty? && !@allowed_vars.include?(root_var) && root_var != "loop"
-      end
+      # Sandbox: gate the whole expression (allow-list + dunder block, F6)
+      return "" if @sandbox && !sandbox_expr_ok?(expr)
 
       value = eval_expr(var_name, context)
 
@@ -1283,7 +1414,7 @@ module Tina4
                   when "title"      then value.to_s.split.map(&:capitalize).join(" ")
                   when "string"     then value.to_s
                   when "int"        then value.to_i
-                  when "escape", "e" then Tina4::SafeString.new(Frond.escape_html(value.to_s))
+                  when "escape", "e" then Frond.escape_strategy(value, "html")
                   else value
                   end
           next
@@ -1296,9 +1427,17 @@ module Tina4
         end
       end
 
-      # Auto-escape HTML unless marked safe or SafeString
-      if @auto_escape && !is_safe && value.is_a?(String) && !value.is_a?(SafeString)
-        value = Frond.escape_html(value)
+      # Auto-escape HTML unless marked safe or SafeString. A plain string is
+      # escaped directly; an Array/Hash/object is escaped on its rendered
+      # string form (F4/ADR-0077) -- before this, only String values were
+      # escaped, so {{ items }} holding markup emitted it raw. nil, booleans
+      # and Numerics carry no HTML-special characters and are left untouched.
+      if @auto_escape && !is_safe && !value.is_a?(SafeString)
+        if value.is_a?(String)
+          value = Frond.escape_html(value)
+        elsif !value.nil? && value != true && value != false && !value.is_a?(Numeric)
+          value = Tina4::SafeString.new(Frond.escape_html(value.to_s))
+        end
       end
 
       value
@@ -2060,8 +2199,10 @@ module Tina4
                 end
           idx = idx.to_i if idx.is_a?(Numeric)
           value = idx.is_a?(Integer) ? value[idx] : nil
-        elsif value.respond_to?(part.to_sym)
-          value = value.send(part.to_sym)
+        elsif !UNSAFE_METHODS.include?(part) && value.respond_to?(part.to_sym)
+          # Only call a method the object publicly exposes, and never a
+          # reflection/metaprogramming method (F6/ADR-0077).
+          value = value.public_send(part.to_sym)
         else
           return nil
         end
@@ -2235,7 +2376,11 @@ module Tina4
         i += 1
       end
 
-      iterable = eval_expr(iterable_expr, context)
+      iterable = if @sandbox && !sandbox_expr_ok?(iterable_expr)
+                   nil
+                 else
+                   eval_expr(iterable_expr, context)
+                 end
 
       if iterable.nil? || (iterable.respond_to?(:empty?) && iterable.empty?)
         if else_tokens.any?
@@ -2852,25 +2997,25 @@ module Tina4
         "striptags"  => ->(v, *_a) { v.to_s.gsub(STRIPTAGS_RE, "") },
 
         # -- Encoding --
-        "escape"        => ->(v, *_a) { Tina4::SafeString.new(Frond.escape_html(v.to_s)) },
-        "e"             => ->(v, *_a) { Tina4::SafeString.new(Frond.escape_html(v.to_s)) },
+        "escape"        => ->(v, *a) { Frond.escape_strategy(v, a[0] || "html") },
+        "e"             => ->(v, *a) { Frond.escape_strategy(v, a[0] || "html") },
         "raw"           => ->(v, *_a) { v },
         "safe"          => ->(v, *_a) { v },
         # Frond.json_safe, never a bare JSON.generate: generate RAISES on an
         # Infinity/NaN float, and the old `rescue v.to_s` answered that raise with
         # Ruby inspect output that no JSON.parse will read. See Frond.json_safe.
         "json_encode"   => ->(v, *_a) { Frond.json_safe(v) },
-        "json_decode"   => ->(v, *_a) { v.is_a?(String) ? (JSON.parse(v) rescue v) : v },
-        "base64_encode" => ->(v, *_a) { Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
-        "base64encode"  => ->(v, *_a) { Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
-        "base64_decode" => ->(v, *_a) { Base64.decode64(v.to_s) },
-        "base64decode"  => ->(v, *_a) { Base64.decode64(v.to_s) },
+        "json_decode"   => ->(v, *_a) { v.is_a?(String) ? (Tina4.parse_json(v) rescue v) : v },
+        "base64_encode" => ->(v, *_a) { Tina4::Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
+        "base64encode"  => ->(v, *_a) { Tina4::Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
+        "base64_decode" => ->(v, *_a) { Tina4::Base64.decode64(v.to_s) },
+        "base64decode"  => ->(v, *_a) { Tina4::Base64.decode64(v.to_s) },
         "data_uri" => ->(v, *_a) {
           if v.is_a?(Hash)
-            ct = v[:type] || v["type"] || "application/octet-stream"
+            ct = Frond.sanitise_media_type(v[:type] || v["type"] || "application/octet-stream")
             raw = v[:content] || v["content"] || ""
             raw = raw.respond_to?(:read) ? raw.read : raw
-            "data:#{ct};base64,#{Base64.strict_encode64(raw.to_s)}"
+            Tina4::SafeString.new("data:#{ct};base64,#{Tina4::Base64.strict_encode64(raw.to_s)}")
           else
             v.to_s
           end
@@ -2884,12 +3029,7 @@ module Tina4
         # broke byte-parity for the one filter whose whole job is a wire format.
         "to_json" => ->(v, *_a) { Frond.json_safe(v) },
         "tojson"  => ->(v, *_a) { Frond.json_safe(v) },
-        "js_escape" => ->(v, *_a) {
-          Tina4::SafeString.new(
-            v.to_s.gsub("\\", "\\\\").gsub("'", "\\'").gsub('"', '\\"')
-                  .gsub("\n", "\\n").gsub("\r", "\\r").gsub("\t", "\\t")
-          )
-        },
+        "js_escape" => ->(v, *_a) { Tina4::SafeString.new(Frond.js_escape_str(v)) },
 
         # -- Hashing --
         "md5"    => ->(v, *_a) { Digest::MD5.hexdigest(v.to_s) },
@@ -3118,9 +3258,11 @@ module Tina4
       sid = form_token_session_id.to_s
       payload["session_id"] = sid unless sid.empty?
 
+      # get_token's expires_in is MINUTES, like every framework's. This used to
+      # pass minutes * 60, so a form token lived 60 hours, not 60 minutes
+      # (ADR-0079 s5).
       ttl_minutes = (ENV["TINA4_TOKEN_LIMIT"] || "60").to_i
-      expires_in = ttl_minutes * 60
-      Tina4::Auth.create_token(payload, expires_in: expires_in)
+      Tina4::Auth.create_token(payload, expires_in: ttl_minutes)
     end
 
     def self.generate_form_token(descriptor = "")

data/lib/tina4/gallery/auth/src/routes/api/gallery_auth.rb

@@ -1,3 +1,9 @@
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 # Gallery: Auth — JWT login with a visual demo page.
 
 Tina4::Router.get("/gallery/auth") do |request, response|

data/lib/tina4/gallery/database/src/routes/api/gallery_db.rb

@@ -1,3 +1,9 @@
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 # Gallery: Database — raw SQL query demo.
 
 Tina4::Router.get("/api/gallery/db/tables") do |request, response|

data/lib/tina4/gallery/error-overlay/src/routes/api/gallery_crash.rb

@@ -1,3 +1,9 @@
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 # Gallery: Error Overlay — deliberately crash to demo the debug overlay.
 #
 # This route deliberately raises an error to showcase the error overlay.

data/lib/tina4/gallery/orm/src/routes/api/gallery_products.rb

@@ -1,3 +1,9 @@
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 # Gallery: ORM — Product CRUD endpoints.
 
 Tina4::Router.get("/api/gallery/products") do |request, response|

data/lib/tina4/gallery/queue/src/routes/api/gallery_queue.rb

@@ -1,3 +1,9 @@
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 # Gallery: Queue — interactive queue demo with visual web UI.
 #
 # Uses a SQLite database directly for the demo queue table,

data/lib/tina4/gallery/rest-api/src/routes/api/gallery_hello.rb

@@ -1,3 +1,9 @@
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 # Gallery: REST API — simple JSON endpoints.
 
 Tina4::Router.get("/api/gallery/hello") do |request, response|

data/lib/tina4/gallery/templates/src/routes/gallery_page.rb

@@ -1,3 +1,9 @@
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 # Gallery: Templates — render an HTML page with dynamic data via template.
 
 Tina4::Router.get "/gallery/page", template: "gallery_page.twig" do |request, response|

data/lib/tina4/graph.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "uri"