tina4ruby 3.13.138 → 3.13.139

data/lib/tina4/websocket.rb

@@ -113,7 +113,10 @@ module Tina4
     return [nil, false] unless token
 
     payload = Tina4::Auth.valid_token(token)
-    [payload, !payload.nil?]
+    # A form token is not an identity (ADR-0079 s1).
+    return [nil, false] unless Tina4::Auth.identity_payload?(payload)
+
+    [payload, true]
   end
 
   # Whether the client offered the "bearer" subprotocol — in which case the
@@ -199,6 +202,17 @@ module Tina4
       @connections
     end
 
+    # Seconds a client may take to send its upgrade request (Python uses 10).
+    HANDSHAKE_TIMEOUT = 10
+    # Upper bound on the request head; a longer one is not a WebSocket upgrade.
+    MAX_REQUEST_HEAD = 16_384
+
+    # Run a standalone WebSocket server. port: 0 picks a free port (see #port).
+    #
+    # Each accepted socket gets its own thread that reads the HTTP request head,
+    # builds the Rack-style env handle_upgrade expects, and upgrades. This loop
+    # used to hand handle_upgrade an EMPTY env, so no Sec-WebSocket-Key was ever
+    # seen and no handshake could complete (the socket was left open, too).
     def start(host: "0.0.0.0", port: 7147)
       require "socket"
       @server_socket = TCPServer.new(host, port)
@@ -207,9 +221,8 @@ module Tina4
         while @running
           begin
             client = @server_socket.accept
-            env = {}
-            handle_upgrade(env, client)
-          rescue => e
+            Thread.new(client) { |socket| serve_standalone(socket) }
+          rescue StandardError
             break unless @running
           end
         end
@@ -217,6 +230,53 @@ module Tina4
       self
     end
 
+    # The port the standalone server is listening on (useful with port: 0).
+    def port
+      @server_socket&.local_address&.ip_port
+    end
+
+    # Read one upgrade request from +socket+ and hand it to handle_upgrade; a
+    # request that is not a WebSocket upgrade gets a 400 and is closed.
+    def serve_standalone(socket)
+      env = read_upgrade_request(socket)
+      unless env && env["HTTP_SEC_WEBSOCKET_KEY"] && upgrade?(env)
+        socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n") rescue nil
+        socket.close rescue nil
+        return
+      end
+      handle_upgrade(env, socket)
+    rescue StandardError => e
+      Tina4::Log.warning("WebSocket standalone upgrade failed: #{e.message}") if defined?(Tina4::Log)
+      socket.close rescue nil
+    end
+
+    # The request head as a Rack-style env (REQUEST_PATH, QUERY_STRING and
+    # HTTP_* headers), or nil when it does not arrive in time or is too long.
+    # Read a byte at a time so nothing after the head is consumed.
+    def read_upgrade_request(socket)
+      head = +""
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + HANDSHAKE_TIMEOUT
+      until head.end_with?("\r\n\r\n")
+        remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        return nil if remaining <= 0 || head.bytesize > MAX_REQUEST_HEAD || !socket.wait_readable(remaining)
+
+        head << socket.readpartial(1)
+      end
+      request_line, *header_lines = head.split("\r\n")
+      method, target, = request_line.to_s.split(" ")
+      path, _, query = target.to_s.partition("?")
+      env = { "REQUEST_METHOD" => method.to_s, "REQUEST_PATH" => path, "PATH_INFO" => path, "QUERY_STRING" => query }
+      header_lines.each do |line|
+        name, value = line.split(":", 2)
+        next if value.nil?
+
+        env["HTTP_#{name.strip.upcase.tr("-", "_")}"] = value.strip
+      end
+      env
+    rescue IOError, SystemCallError
+      nil
+    end
+
     def stop
       @running = false
       @server_socket&.close rescue nil
@@ -739,13 +799,14 @@ module Tina4
 
     def send(message)
       data = message.is_a?(String) ? message : message.to_s
-      # Text frames must be valid UTF-8; binary payloads are sent verbatim.
-      data = data.encode("UTF-8") if data.encoding != Encoding::ASCII_8BIT
-      frame = build_frame(0x1, data)
-      @socket.write(frame)
-    rescue IOError
-      # Connection closed — mark dead so the broadcast path prunes it.
-      @closed = true
+      # A binary (ASCII-8BIT) payload goes out as a BINARY frame, verbatim. It
+      # used to go out as a TEXT frame, which is invalid UTF-8 on the wire and
+      # makes a browser fail the connection. Text frames must be valid UTF-8.
+      if data.encoding == Encoding::ASCII_8BIT
+        write_frame(build_frame(0x2, data))
+      else
+        write_frame(build_frame(0x1, data.encode("UTF-8")))
+      end
     end
 
     alias_method :send_text, :send
@@ -757,16 +818,48 @@ module Tina4
     end
 
     def send_pong(data)
-      frame = build_frame(0xA, data || "")
-      @socket.write(frame)
-    rescue IOError
-      @closed = true
+      write_frame(build_frame(0xA, data || ""))
     end
 
     def close(code: 1000, reason: "")
       payload = [code].pack("n") + reason
       frame = build_frame(0x8, payload)
-      @socket.write(frame) rescue nil
+      # Best effort and never blocking: a peer that stopped reading must not
+      # hold up the reaper or a shutdown. The close frame only goes out when no
+      # earlier frame is still queued, so it can never land mid-frame.
+      write_lock.synchronize do
+        @socket.write_nonblock(frame, exception: false) if pending.empty?
+      end
+    rescue IOError, SystemCallError
+      nil
+    ensure
+      @closed = true
+      @socket.close rescue nil
+    end
+
+    # Hand a frame to the socket WITHOUT blocking the caller. What the kernel
+    # cannot take yet waits in a per-connection queue that a flusher thread
+    # drains as the peer reads. A peer whose queue passes TINA4_WS_MAX_BACKLOG
+    # bytes (default 1 MiB, 0 = unbounded; the same setting as tina4-nodejs) is
+    # hopelessly behind or never reads, so it is closed. A blocking write here
+    # used to stall every broadcast forever on one client that stopped reading.
+    def write_frame(frame)
+      return if @closed
+
+      write_lock.synchronize do
+        pending << frame.b
+        flush_pending
+        limit = max_backlog
+        if limit.positive? && pending.bytesize > limit
+          backlog = pending.bytesize
+          drop_slow_client("backlog #{backlog} bytes exceeds TINA4_WS_MAX_BACKLOG (#{limit})")
+        elsif !pending.empty?
+          start_flusher
+        end
+      end
+    rescue IOError, SystemCallError
+      # Broken pipe / reset / closed socket: mark dead so the broadcast path prunes it.
+      @closed = true
       @socket.close rescue nil
     end
 
@@ -802,6 +895,57 @@ module Tina4
     def build_frame(opcode, data)
       Tina4.build_frame(opcode, data)
     end
+
+    private
+
+    def write_lock
+      @write_lock ||= Mutex.new
+    end
+
+    def pending
+      @pending ||= +"".b
+    end
+
+    def max_backlog
+      Integer(ENV["TINA4_WS_MAX_BACKLOG"] || "1048576")
+    rescue ArgumentError, TypeError
+      1_048_576
+    end
+
+    # Write as much of the queue as the kernel takes right now. Caller holds the lock.
+    def flush_pending
+      until pending.empty?
+        written = @socket.write_nonblock(pending, exception: false)
+        break if written == :wait_writable
+
+        @pending = pending.byteslice(written..)
+      end
+    end
+
+    # One background drainer per connection while bytes are queued.
+    def start_flusher
+      return if @flusher&.alive?
+
+      @flusher = Thread.new do
+        until @closed
+          done = write_lock.synchronize { pending.empty? }
+          break if done
+
+          @socket.wait_writable(1)
+          write_lock.synchronize { flush_pending }
+        end
+      rescue IOError, SystemCallError
+        @closed = true
+        @socket.close rescue nil
+      end
+    end
+
+    def drop_slow_client(reason)
+      Tina4::Log.warning("WebSocket client #{@id} dropped as too slow: #{reason}") if defined?(Tina4::Log)
+      @pending = +"".b
+      @closed = true
+      @socket.close rescue nil
+    end
   end
 
   # Shared, process-wide manager for the dev-reload channel (/__dev_reload).

data/lib/tina4/websocket_backplane.rb

@@ -115,6 +115,12 @@ module Tina4
             block.call(msg) if @running
           end
         end
+      rescue StandardError => e
+        # A refused login or a dropped connection ends this listener for good.
+        # Say so in the framework log: before, the thread died with only a raw
+        # stack trace on stderr while "backplane active" stood as the last word.
+        # The redis client's messages carry the URL without its userinfo.
+        Tina4::Log.error("WebSocket backplane subscriber stopped on '#{channel}': #{e.message}") if @running && defined?(Tina4::Log)
       end
     end
 

data/lib/tina4/wsdl.rb

@@ -279,6 +279,14 @@ module Tina4
     def process_soap(xml_body)
       on_request(@request)
 
+      # The shared body rule, before anything reads the bytes: UTF-8 only, no
+      # byte order mark, no NUL byte, no other declared encoding.
+      begin
+        xml_body = XmlParser.utf8_text(xml_body)
+      rescue XmlParser::ParseError
+        return soap_fault("Client", "Malformed XML")
+      end
+
       # SOAP 1.1 (§3) forbids a Document Type Declaration in a SOAP message, so
       # reject any DOCTYPE up front with the same Client fault as the other three
       # frameworks. The parser has no DTD support at all (no entity expansion, no
@@ -499,14 +507,27 @@ module Tina4
       end
 
       def handle_soap_request(xml_body)
+        # Malformed XML is the CLIENT's fault, as in Python and WSDL#process_soap.
+        # Both refusals below used to fall into the operation catch-all at the end
+        # of this method and answer "Internal server error" (a soap:Server fault).
+        begin
+          xml_body = XmlParser.utf8_text(xml_body) # the shared body encoding rule
+        rescue XmlParser::ParseError
+          return _soap_fault("Malformed XML", code: "Client")
+        end
+
         # SOAP 1.1 (§3) forbids a DOCTYPE/DTD. Reject before parsing; the parser
         # itself has no DTD support and accepts UTF-8 only. Mirrors the
         # class-based process_soap path.
-        if xml_body.to_s.b.match?(/<!DOCTYPE/in)
+        if xml_body.b.match?(/<!DOCTYPE/in)
           return _soap_fault("DOCTYPE declarations are not allowed in SOAP messages")
         end
 
-        doc = XmlParser.parse(xml_body)
+        begin
+          doc = XmlParser.parse(xml_body)
+        rescue XmlParser::ParseError
+          return _soap_fault("Malformed XML", code: "Client")
+        end
 
         # Find Body element (namespace-agnostic)
         body_el = _find_child(doc.root, "Body")
@@ -590,11 +611,11 @@ module Tina4
         xml
       end
 
-      def _soap_fault(message)
+      def _soap_fault(message, code: "soap:Server")
         '<?xml version="1.0" encoding="UTF-8"?>' \
         '<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">' \
         "<soap:Body><soap:Fault>" \
-        "<faultcode>soap:Server</faultcode>" \
+        "<faultcode>#{code}</faultcode>" \
         "<faultstring>#{_escape_xml(message)}</faultstring>" \
         "</soap:Fault></soap:Body></soap:Envelope>"
       end

data/lib/tina4/xml_parser.rb

@@ -22,10 +22,11 @@ module Tina4
     #   * DTDs. `<!DOCTYPE` and every other `<!` declaration is a ParseError, so
     #     there is no entity expansion (billion laughs) and no external entity
     #     (XXE). The WSDL server also rejects DOCTYPE before parsing.
-    #   * Any encoding but UTF-8. A UTF-16/UTF-32 body (BOM or NUL bytes) or
-    #     invalid UTF-8 is a ParseError. A UTF-16 body used to slip past the
-    #     `<!DOCTYPE` regex guard, because the guard read "<\0!\0D\0..." while
-    #     REXML decoded the BOM and parsed the DTD. A UTF-8 BOM is skipped.
+    #   * Any encoding but UTF-8. Any byte order mark (UTF-8 included), a NUL
+    #     byte, invalid UTF-8, or an XML declaration naming another encoding is a
+    #     ParseError. A UTF-16 body used to slip past the `<!DOCTYPE` regex guard,
+    #     because the guard read "<\0!\0D\0..." while REXML decoded the BOM and
+    #     parsed the DTD.
     #
     # Element#text follows ElementTree (the Python master): the character data
     # before the first child element, entity- and CDATA-decoded; nil when there
@@ -71,7 +72,10 @@ module Tina4
 
       PREDEFINED_ENTITIES = { "lt" => "<", "gt" => ">", "amp" => "&", "quot" => '"', "apos" => "'" }.freeze
       NAME = /[A-Za-z_:\u00C0-\u{EFFFF}][A-Za-z0-9_:.\-\u00B7\u00C0-\u{EFFFF}]*/
-      UTF16_OR_32_BOMS = ["\xFE\xFF".b, "\xFF\xFE".b, "\x00\x00\xFE\xFF".b].freeze
+      # Every byte order mark, the UTF-8 one included (the shared SOAP body rule:
+      # a body is plain UTF-8, never a BOM, in all four frameworks).
+      BYTE_ORDER_MARKS = ["\xEF\xBB\xBF".b, "\xFE\xFF".b, "\xFF\xFE".b, "\x00\x00\xFE\xFF".b].freeze
+      DECLARED_ENCODING = /\A<\?xml\b[^>]*?\bencoding\s*=\s*["']([^"']*)["']/
 
       module_function
 
@@ -81,16 +85,21 @@ module Tina4
         Reader.new(utf8_text(xml)).document
       end
 
+      # The body as UTF-8 text, or a ParseError. Callers that must refuse BEFORE
+      # any parse (the WSDL server) call this first; #parse calls it too.
       def utf8_text(xml)
         bytes = xml.to_s.b
-        if UTF16_OR_32_BOMS.any? { |bom| bytes.start_with?(bom) } || bytes.include?("\x00")
-          raise ParseError, "only UTF-8 XML is accepted (UTF-16/UTF-32 body)"
-        end
+        raise ParseError, "only UTF-8 XML without a byte order mark is accepted" if BYTE_ORDER_MARKS.any? { |bom| bytes.start_with?(bom) }
+        raise ParseError, "only UTF-8 XML is accepted (NUL byte, UTF-16/UTF-32 body)" if bytes.include?("\x00")
 
-        bytes = bytes.byteslice(3..) if bytes.start_with?("\xEF\xBB\xBF".b)
         text = bytes.force_encoding(Encoding::UTF_8)
         raise ParseError, "only UTF-8 XML is accepted (invalid UTF-8 bytes)" unless text.valid_encoding?
 
+        declared = text[DECLARED_ENCODING, 1]
+        if declared && !declared.casecmp?("UTF-8")
+          raise ParseError, "only UTF-8 XML is accepted (declared encoding #{declared.inspect})"
+        end
+
         text
       end
 

data/lib/tina4.rb

@@ -159,6 +159,8 @@ module Tina4
   autoload :CRUD,                File.expand_path("tina4/crud", __dir__)
   autoload :API,                 File.expand_path("tina4/api", __dir__)
   autoload :APIResponse,         File.expand_path("tina4/api", __dir__)
+  autoload :Ssrf,                File.expand_path("tina4/ssrf", __dir__)
+  autoload :SsrfError,           File.expand_path("tina4/ssrf", __dir__)
   autoload :GraphQLType,         File.expand_path("tina4/graphql", __dir__)
   autoload :GraphQLSchema,       File.expand_path("tina4/graphql", __dir__)
   autoload :GraphQLParser,       File.expand_path("tina4/graphql", __dir__)
@@ -479,8 +481,15 @@ module Tina4
       # boot after env load, before any auth use. Never crashes boot.
       Tina4::Auth.ensure_dev_secret(root_dir)
 
-      # Setup auth keys
-      Tina4::Auth.setup(root_dir)
+      # Point RS256 at <root>/.keys without creating anything: an
+      # operator-provisioned key pair keeps working, and a blank secret no
+      # longer mints one implicitly (ADR-0079 s2).
+      Tina4::Auth.keys_root = root_dir
+
+      # Refuse to serve with a secret anyone can reproduce: blank outside dev,
+      # or set but shorter than 32 bytes in any mode (ADR-0079 s2). Raises
+      # Tina4::Auth::InsecureSecretError naming TINA4_SECRET.
+      Tina4::Auth.require_boot_secret!
 
       # Auto-attach CSRF protection when TINA4_CSRF is enabled (OFF by default).
       # Mirrors the Python master's attach_csrf_from_env -- the env flag is the

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.138
+  version: 3.13.139
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-24 00:00:00.000000000 Z
+date: 2026-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3
@@ -345,6 +345,7 @@ files:
 - lib/tina4/sql_translator.rb
 - lib/tina4/sqlite3_gem.rb
 - lib/tina4/sso.rb
+- lib/tina4/ssrf.rb
 - lib/tina4/swagger.rb
 - lib/tina4/template.rb
 - lib/tina4/templates/base.twig