tina4ruby 3.13.149 → 3.13.151

data/lib/tina4/rack_app.rb

@@ -108,6 +108,8 @@ module Tina4
       # value. Cleared in `ensure`, exactly like the request id (an overlapping
       # request on another thread never shares it).
       Tina4::Csp.set_current_nonce(Tina4::Csp.generate_nonce)
+      # form_token() binds each token to this request's session (CSRF).
+      Tina4::Frond.request_env = env
 
       begin
         result = dispatch_pipeline(env)
@@ -121,6 +123,7 @@ module Tina4
         # nonce has the same lifetime.
         Tina4::Log.clear_request_id
         Tina4::Csp.clear_current_nonce
+        Tina4::Frond.request_env = nil
       end
     end
 
@@ -1247,7 +1250,7 @@ module Tina4
       # token in the body, auth token in the session) is still authenticated.
       candidates = []
       auth_header = env["HTTP_AUTHORIZATION"] || ""
-      candidates << [Regexp.last_match(1), :header] if auth_header =~ /\ABearer\s+(.+)\z/i
+      candidates << [Regexp.last_match(1), :header] if auth_header =~ /\ABearer\s++(.+)\z/i
       form_token = _extract_form_token(_read_rack_body(env), env)
       candidates << [form_token, :body] if form_token && !form_token.empty?
 

data/lib/tina4/realtime/s3_client.rb

@@ -0,0 +1,240 @@
+# frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+require "net/http"
+require "uri"
+require "openssl"
+require "digest"
+require "time"
+
+module Tina4
+  module Realtime
+    # An S3 request returned a non-2xx status; +status+ holds the HTTP code.
+    class S3Error < StandardError
+      attr_reader :status
+      attr_accessor :retry_after
+
+      def initialize(status, message)
+        super(message)
+        @status = status
+        @retry_after = nil
+      end
+    end
+
+    # The client cannot sign a request: no access key or secret was given.
+    class S3ConfigError < StandardError; end
+
+    # Zero-dependency S3 client (AWS Signature Version 4) on the Ruby standard
+    # library. Covers exactly what the realtime {S3Storage} backend needs — PUT,
+    # GET, DELETE, HEAD, and a presigned GET URL — so the +s3+ backend no longer
+    # needs the aws-sdk-s3 gem.
+    #
+    # Path-style addressing (<endpoint>/<bucket>/<key>), which S3-compatible
+    # servers (MinIO, Garage) require and AWS accepts; with no endpoint it
+    # targets https://s3.<region>.amazonaws.com. SigV4 is HMAC-SHA256 canonical
+    # signing — the same primitive Tina4's JWT already uses (stdlib OpenSSL);
+    # nothing here is reinvented crypto. Mirrors the Python master, proven
+    # against AWS's published SigV4 test vector.
+    class S3Client
+      ALGORITHM = "AWS4-HMAC-SHA256"
+      SERVICE = "s3"
+      # Retry policy, as for the AI client (ADR-0053): HTTP 429, any 5xx (S3's
+      # SlowDown is a 503) and a dropped connection are sent again, a bounded
+      # number of times, honouring Retry-After. Every operation here is idempotent.
+      MAX_RETRIES = 2
+      BACKOFF_BASE = 0.5   # seconds; retry n waits up to base * 2**n, jittered
+      BACKOFF_CAP = 20.0
+      # A connection refused, reset, dropped or timed out: nothing was answered.
+      RETRYABLE_NETWORK = [
+        Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::EPIPE, EOFError,
+        SocketError, IOError, Net::OpenTimeout, Net::ReadTimeout, Timeout::Error
+      ].freeze
+
+      def initialize(endpoint: nil, access_key: "", secret_key: "", region: "us-east-1", timeout: 30)
+        @region = region && !region.empty? ? region : "us-east-1"
+        @access_key = access_key || ""
+        @secret_key = secret_key || ""
+        @timeout = timeout
+        base = endpoint && !endpoint.empty? ? endpoint : "https://s3.#{@region}.amazonaws.com"
+        base = base.delete_suffix("/") while base.end_with?("/") # strip trailing slashes without a regex
+        @scheme = base[%r{\A([a-z][a-z0-9+.\-]*)://}i, 1] || "https"
+        authority = base.sub(%r{\A[a-z][a-z0-9+.\-]*://}i, "")
+        # Split authority (host[:port], the Host header + signed `host:`) from a
+        # path an endpoint carries (https://host/s3 -> "/s3"), which is kept in
+        # front of every request path and in what is signed.
+        slash = authority.index("/")
+        @host = slash ? authority[0...slash] : authority
+        @prefix = slash ? authority[slash..].delete_suffix("/") : ""
+        @prefix = @prefix.delete_suffix("/") while @prefix.end_with?("/")
+      end
+
+      # -- public API (the subset S3Storage uses) ------------------------------
+
+      def put_object(bucket, key, data, content_type = "application/octet-stream")
+        request("PUT", canonical_uri(bucket, key), data, { "content-type" => content_type })
+      end
+
+      def get_object(bucket, key)
+        request("GET", canonical_uri(bucket, key), "")[1]
+      end
+
+      def delete_object(bucket, key)
+        request("DELETE", canonical_uri(bucket, key), "")
+        nil
+      end
+
+      def head_object(bucket, key)
+        request("HEAD", canonical_uri(bucket, key), "")
+        nil
+      end
+
+      # Create the bucket (path-style PUT /<bucket>); an already-owned bucket (409) is success.
+      def create_bucket(bucket)
+        request("PUT", "#{@prefix}/#{self.class.uri_encode(bucket, true)}", "")
+        nil
+      rescue S3Error => e
+        raise unless e.status == 409
+      end
+
+      # A URL that fetches the object directly, signed via SigV4 query params.
+      def presigned_get_url(bucket, key, expires: 3600)
+        require_credentials
+        now = Time.now.utc
+        amz_date = now.strftime("%Y%m%dT%H%M%SZ")
+        datestamp = now.strftime("%Y%m%d")
+        uri = canonical_uri(bucket, key)
+        scope = "#{datestamp}/#{@region}/#{SERVICE}/aws4_request"
+        query = {
+          "X-Amz-Algorithm" => ALGORITHM,
+          "X-Amz-Credential" => "#{@access_key}/#{scope}",
+          "X-Amz-Date" => amz_date,
+          "X-Amz-Expires" => expires.to_s,
+          "X-Amz-SignedHeaders" => "host"
+        }
+        canonical_qs = canonical_query(query)
+        canonical_request = ["GET", uri, canonical_qs, "host:#{@host}\n", "host", "UNSIGNED-PAYLOAD"].join("\n")
+        signature = sign(canonical_request, amz_date, datestamp, scope)
+        "#{@scheme}://#{@host}#{uri}?#{canonical_qs}&X-Amz-Signature=#{signature}"
+      end
+
+      # SigV4 canonical encoding: keep the RFC 3986 unreserved set literal; keep
+      # "/" in a path, percent-encode it in a query; space -> %20.
+      def self.uri_encode(value, is_path)
+        value.to_s.b.each_byte.map do |byte|
+          ch = byte.chr
+          if ch.match?(/[A-Za-z0-9\-_.~]/) || (is_path && ch == "/")
+            ch
+          else
+            format("%%%02X", byte)
+          end
+        end.join
+      end
+
+      private
+
+      # Signing with an empty key only earns a 403 from the server, which says
+      # nothing about the cause. Name the settings instead, before sending.
+      def require_credentials
+        return unless @access_key.empty? || @secret_key.empty?
+
+        raise S3ConfigError, "S3 credentials are not set: set TINA4_STORAGE_KEY and TINA4_STORAGE_SECRET"
+      end
+
+      # Seconds from a Retry-After header in its delta-seconds form, else nil.
+      def retry_after_seconds(raw)
+        return nil if raw.nil?
+
+        value = Float(raw)
+        value.negative? ? 0.0 : value
+      rescue ArgumentError, TypeError
+        nil
+      end
+
+      def canonical_uri(bucket, key)
+        "#{@prefix}/#{self.class.uri_encode(bucket, true)}/#{self.class.uri_encode(key, true)}"
+      end
+
+      def canonical_query(query)
+        query.sort.map { |k, v| "#{self.class.uri_encode(k, false)}=#{self.class.uri_encode(v, false)}" }.join("&")
+      end
+
+      def signing_key(datestamp)
+        k_date = OpenSSL::HMAC.digest("SHA256", "AWS4#{@secret_key}", datestamp)
+        k_region = OpenSSL::HMAC.digest("SHA256", k_date, @region)
+        k_service = OpenSSL::HMAC.digest("SHA256", k_region, SERVICE)
+        OpenSSL::HMAC.digest("SHA256", k_service, "aws4_request")
+      end
+
+      def sign(canonical_request, amz_date, datestamp, scope)
+        string_to_sign = [ALGORITHM, amz_date, scope, Digest::SHA256.hexdigest(canonical_request)].join("\n")
+        OpenSSL::HMAC.hexdigest("SHA256", signing_key(datestamp), string_to_sign)
+      end
+
+      def request(method, canonical_uri, body, extra_headers = {})
+        require_credentials
+        attempt = 0
+        loop do
+          last = attempt == MAX_RETRIES
+          delay = nil
+          begin
+            # Signed afresh each attempt: x-amz-date moves on.
+            return send_once(method, canonical_uri, body, extra_headers)
+          rescue S3Error => e
+            raise if last || !(e.status == 429 || e.status >= 500)
+
+            delay = e.retry_after
+          rescue *RETRYABLE_NETWORK
+            raise if last
+          end
+          delay ||= rand * (BACKOFF_BASE * (2**attempt))
+          sleep([delay, BACKOFF_CAP].min)
+          attempt += 1
+        end
+      end
+
+      def send_once(method, canonical_uri, body, extra_headers = {})
+        now = Time.now.utc
+        amz_date = now.strftime("%Y%m%dT%H%M%SZ")
+        datestamp = now.strftime("%Y%m%d")
+        payload_hash = Digest::SHA256.hexdigest(body || "")
+
+        signed = { "host" => @host, "x-amz-content-sha256" => payload_hash, "x-amz-date" => amz_date }
+        canonical_headers = signed.sort.map { |k, v| "#{k}:#{v}\n" }.join
+        signed_headers = signed.keys.sort.join(";")
+        canonical_request = [method, canonical_uri, "", canonical_headers, signed_headers, payload_hash].join("\n")
+        scope = "#{datestamp}/#{@region}/#{SERVICE}/aws4_request"
+        signature = sign(canonical_request, amz_date, datestamp, scope)
+        authorization = "#{ALGORITHM} Credential=#{@access_key}/#{scope}, " \
+                        "SignedHeaders=#{signed_headers}, Signature=#{signature}"
+
+        uri = URI("#{@scheme}://#{@host}#{canonical_uri}")
+        klass = { "PUT" => Net::HTTP::Put, "GET" => Net::HTTP::Get,
+                  "DELETE" => Net::HTTP::Delete, "HEAD" => Net::HTTP::Head }.fetch(method)
+        req = klass.new(uri)
+        req["Authorization"] = authorization
+        req["x-amz-content-sha256"] = payload_hash
+        req["x-amz-date"] = amz_date
+        extra_headers.each { |name, value| req[name] = value }
+        req.body = body if %w[PUT POST].include?(method)
+
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == "https"
+        http.open_timeout = @timeout
+        http.read_timeout = @timeout
+        response = http.request(req)
+        status = response.code.to_i
+        if status < 200 || status >= 300
+          error = S3Error.new(status, "#{method} #{canonical_uri}: HTTP #{status}")
+          error.retry_after = retry_after_seconds(response["retry-after"])
+          raise error
+        end
+
+        [status, response.body || ""]
+      end
+    end
+  end
+end

data/lib/tina4/realtime/s3_storage.rb

@@ -8,55 +8,42 @@
 
 module Tina4
   module Realtime
-    # S3-compatible store (AWS S3, MinIO, ...). Opt-in; needs the aws-sdk-s3 gem.
+    # S3-compatible store (AWS S3, MinIO, Garage, ...). Opt-in, zero dependencies.
     #
-    # Presigned GET URLs let clients fetch large blobs straight from object
-    # storage instead of streaming through the app.
+    # Talks to S3 through Tina4's own stdlib SigV4 client ({S3Client}) — no
+    # aws-sdk-s3 gem. Presigned GET URLs let clients fetch large blobs straight
+    # from object storage instead of streaming through the app.
     class S3Storage < StorageBackend
       def initialize(endpoint: nil, key: nil, secret: nil, bucket: nil, region: nil)
         super()
-        begin
-          require "aws-sdk-s3" # optional dependency, loaded lazily
-        rescue LoadError
-          # Storage.select rescues this and falls back to local; its warning
-          # carries this message, so the remedy reaches the operator.
-          raise LoadError,
-                "The 'aws-sdk-s3' gem is required for S3Storage. Install it with: " \
-                "bundle add aws-sdk-s3 (or add gem \"aws-sdk-s3\" to your Gemfile)"
-        end
-
         @bucket = bucket || ENV["TINA4_STORAGE_BUCKET"]
         raise ArgumentError, "S3Storage requires TINA4_STORAGE_BUCKET" if @bucket.nil? || @bucket.empty?
 
-        opts = {
-          access_key_id: key || ENV["TINA4_STORAGE_KEY"],
-          secret_access_key: secret || ENV["TINA4_STORAGE_SECRET"],
-          region: region || ENV["TINA4_STORAGE_REGION"] || "us-east-1",
-          force_path_style: true
-        }
-        ep = endpoint || ENV["TINA4_STORAGE_URL"]
-        opts[:endpoint] = ep if ep && !ep.empty?
-        @client = Aws::S3::Client.new(**opts)
+        @client = S3Client.new(
+          endpoint: endpoint || ENV["TINA4_STORAGE_URL"],
+          access_key: key || ENV["TINA4_STORAGE_KEY"] || "",
+          secret_key: secret || ENV["TINA4_STORAGE_SECRET"] || "",
+          region: region || ENV["TINA4_STORAGE_REGION"] || "us-east-1"
+        )
       end
 
       def put(key, data, mime = "application/octet-stream")
-        @client.put_object(bucket: @bucket, key: key, body: data, content_type: mime)
+        @client.put_object(@bucket, key, data, mime)
         nil
       end
 
       def get(key)
-        @client.get_object(bucket: @bucket, key: key).body.read
+        @client.get_object(@bucket, key)
       rescue StandardError
         nil
       end
 
       def url(key, ttl = 3600)
-        Aws::S3::Presigner.new(client: @client)
-                          .presigned_url(:get_object, bucket: @bucket, key: key, expires_in: ttl)
+        @client.presigned_get_url(@bucket, key, expires: ttl)
       end
 
       def delete(key)
-        @client.delete_object(bucket: @bucket, key: key)
+        @client.delete_object(@bucket, key)
         nil
       rescue StandardError => e
         Tina4::Log.error("S3Storage delete failed for #{key}: #{e.message}")
@@ -64,7 +51,7 @@ module Tina4
       end
 
       def exists?(key)
-        @client.head_object(bucket: @bucket, key: key)
+        @client.head_object(@bucket, key)
         true
       rescue StandardError
         false

data/lib/tina4/realtime/storage.rb

@@ -39,11 +39,10 @@ module Tina4
         if name == "s3"
           begin
             return S3Storage.new
-          # LoadError (missing aws-sdk-s3 gem) is a ScriptError, NOT a
-          # StandardError, so it must be rescued explicitly or the "graceful
-          # fallback when the driver is absent" contract breaks (the whole mount
-          # would crash instead of degrading to local).
-          rescue StandardError, LoadError => e
+          # S3Storage is zero-dependency now (Tina4's own SigV4 client, no gem),
+          # so the only construction failure is an incomplete config, e.g. a
+          # missing bucket (ArgumentError) — degrade to local rather than crash.
+          rescue StandardError => e
             Tina4::Log.warning(
               "realtime files: S3 storage unavailable (#{e.message}); " \
               "falling back to local filesystem storage."

data/lib/tina4/realtime.rb

@@ -18,6 +18,7 @@ require_relative "realtime/message"
 require_relative "realtime/attachment"
 require_relative "realtime/storage_backend"
 require_relative "realtime/local_storage"
+require_relative "realtime/s3_client"
 require_relative "realtime/s3_storage"
 require_relative "realtime/storage"
 require_relative "parse_json"
@@ -80,7 +81,7 @@ module Tina4
     # @param features  [Array<String>] any of "calls", "chat", "files"
     def mount(prefix: "", authorize: nil, storage: nil, features: nil)
       features = features || ["calls"]
-      p = prefix.to_s.gsub(%r{\A/+|/+\z}, "")
+      p = prefix.to_s.gsub(%r{\A/++|/++\z}, "")
       p = p.empty? ? "" : "/#{p}"
       @authorize = authorize
       @storage = storage

data/lib/tina4/request.rb

@@ -205,7 +205,7 @@ module Tina4
       FileUtils.mkdir_p(target_dir)
       dest = File.join(target_dir, base)
       # Defence in depth: the resolved parent of the destination must be exactly
-      # the resolved target dir (guards a pre-existing symlink at target/base).
+      # the resolved target dir.
       real_dir = File.realpath(target_dir)
       real_parent = File.realpath(File.dirname(dest))
       unless real_parent == real_dir
@@ -213,10 +213,35 @@ module Tina4
       end
 
       content = file["content"] || file[:content] || ""
-      File.binwrite(dest, content)
+      write_upload(dest, content)
       dest
     end
 
+    # Never write THROUGH a link already at target/base: a symlink (even a
+    # dangling one) leads out of target_dir, and a hard link shares its bytes
+    # with a file elsewhere. Such an entry is removed so the upload gets a file
+    # of its own; a plain file is rewritten in place and keeps its mode.
+    def self.write_upload(dest, content)
+      File.unlink(dest) if File.symlink?(dest)
+      flags = File::WRONLY | File::CREAT | File::BINARY | (defined?(File::NOFOLLOW) ? File::NOFOLLOW : 0)
+      # 0o600: a newly created upload is owner-only, never group/other readable
+      # or writable (CWE-732). The mode applies only when CREAT makes the file;
+      # a plain file rewritten in place keeps its own mode, per the note above.
+      io = File.open(dest, flags, 0o600)
+      if io.stat.nlink > 1
+        io.close
+        File.unlink(dest)
+        io = File.open(dest, flags | File::EXCL, 0o600)
+      end
+      begin
+        io.truncate(0)
+        io.write(content)
+      ensure
+        io.close
+      end
+    end
+    private_class_method :write_upload
+
     def initialize(env, path_params = {})
       @env = env
       @method = env["REQUEST_METHOD"]
@@ -563,7 +588,7 @@ module Tina4
           body_raw
         end
       elsif @content_type.include?("application/x-www-form-urlencoded")
-        parse_query_to_hash(body_raw)
+        parse_form_body(body_raw)
       elsif @content_type.include?("multipart/form-data")
         # Form fields from the parsed multipart body (Tina4::FormParser).
         # Files are handled separately by extract_files.
@@ -594,6 +619,19 @@ module Tina4
       result
     end
 
+    # An urlencoded body, nested the way a multipart form is
+    # (`tags[]=a&tags[]=b` -> {"tags" => ["a", "b"]}), so a form arrives in one
+    # shape however it was encoded. A field whose name conflicts with an earlier
+    # one (`a=1&a[b]=2`) keeps its flat key. The query string stays flat:
+    # AutoCrud reads `filter[...]` keys from it.
+    def parse_form_body(body)
+      pairs = body.split("&").map do |pair|
+        key, value = pair.split("=", 2)
+        [URI.decode_www_form_component(key.to_s), URI.decode_www_form_component(value.to_s)]
+      end
+      Tina4::FormParser.nest(pairs, lenient: true)
+    end
+
     def extract_files
       result = {}
       return result unless @content_type.include?("multipart/form-data")

data/lib/tina4/response_cache.rb

@@ -502,7 +502,8 @@ module Tina4
     #     Authorization, and Tina4's own session mechanism IS a cookie. Because
     #     the key is method + URL, storing such a response replays one signed-in
     #     user's page to whoever asks for that URL next; a response that installs
-    #     a session (Set-Cookie) is per-user by construction for the same reason.
+    #     a session (Set-Cookie, or a session about to add one) is per-user by
+    #     construction for the same reason.
     #
     # Both cookie cases stay cacheable when the response opts in explicitly with
     # a shared-cache directive, which is how a genuinely public page served to
@@ -517,6 +518,13 @@ module Tina4
       return shared_cache_allowed?(response) unless header_value(request, "Authorization").nil?
       return shared_cache_allowed?(response) unless header_value(request, "Cookie").nil?
       return shared_cache_allowed?(response) unless header_value(response, "Set-Cookie").nil?
+      # The session cookie is added after this check, so a response that is
+      # about to install one carries no Set-Cookie yet: a request that came
+      # without a cookie and leaves its session holding data (a form token
+      # bound to it marks it) is that case. Read the session only if the
+      # request already opened one; asking for it would open one.
+      session = request.instance_variable_get(:@session) if request.instance_variable_defined?(:@session)
+      return shared_cache_allowed?(response) if session.respond_to?(:fresh?) && !session.fresh?
 
       true
     end

data/lib/tina4/router.rb

@@ -724,7 +724,7 @@ module Tina4
       # trailing slash on a prefix could leave "/api//users").
       def join_group_path(prefix, path)
         full = "#{prefix}/#{path.sub(%r{\A/+}, '')}"
-        full = "/#{full.gsub(%r{\A/+|/+\z}, '')}"
+        full = "/#{full.gsub(%r{\A/++|/++\z}, '')}"
         full.gsub(%r{/+}, "/")
       end
 

data/lib/tina4/sql_translator.rb

@@ -316,11 +316,11 @@ module Tina4
           sql
             .gsub(/\bBIGINT\s+PRIMARY\s+KEY\s+AUTOINCREMENT\b/i, "BIGSERIAL PRIMARY KEY")
             .gsub(/\bINTEGER\s+PRIMARY\s+KEY\s+AUTOINCREMENT\b/i, "SERIAL PRIMARY KEY")
-            .gsub(/\s*\bAUTOINCREMENT\b/i, "")
+            .gsub(/\s*+\bAUTOINCREMENT\b/i, "")
         when "mssql"
           sql.gsub(/AUTOINCREMENT/i, "IDENTITY(1,1)")
         when "firebird"
-          sql.gsub(/\s*AUTOINCREMENT\b/i, "")
+          sql.gsub(/\s*+AUTOINCREMENT\b/i, "")
         else
           sql
         end
@@ -490,7 +490,9 @@ module Tina4
       "mariadb" => "mysql"
     }.freeze
 
-    INSERT_VALUES = /\A\s*INSERT\s+INTO\s+.+?\s+VALUES\s*\(([^()]*)\)\s*\z/im
+    # ReDoS-safe: the table ref is bounded by non-space at both ends (\S(?:.*?\S)?)
+    # so the `\s+` before VALUES can't overlap it the way `.+?\s+` did.
+    INSERT_VALUES = /\A\s*INSERT\s+INTO\s+\S(?:.*?\S)?\s+VALUES\s*\(([^()]*)\)\s*\z/im
 
     # Engines whose last_insert_id reports the FIRST generated id of a multi-row
     # INSERT rather than the last. Verified live against MySQL.

data/lib/tina4/template.rb

@@ -232,7 +232,10 @@ module Tina4
         "nl2br" => ->(v) { v.to_s.gsub("\n", "<br>") },
         "number_format" => ->(v, d) { format("%.#{d || 0}f", v.to_f) },
         "raw" => ->(v) { v },
-        "striptags" => ->(v) { v.to_s.gsub(/<[^>]+>/, "") },
+        # Fixed-point strip: a single gsub leaves a tag that only surfaces once the
+        # surrounding one is removed (`<scr<script>ipt>` -> `<script>`). Repeat
+        # until nothing more matches (incomplete multi-character sanitization).
+        "striptags" => ->(v) { s = v.to_s; loop { t = s.gsub(/<[^>]+>/, ""); break if t == s; s = t }; s },
         "sort" => ->(v) { v.respond_to?(:sort) ? v.sort : v },
         "keys" => ->(v) { v.respond_to?(:keys) ? v.keys : [] },
         "values" => ->(v) { v.respond_to?(:values) ? v.values : [v] },
@@ -272,8 +275,10 @@ module Tina4
         content = process_conditionals(content)
         content = process_set(content)
         content = process_expressions(content)
-        content = content.gsub(/\{%.*?%\}/m, "")
-        content = content.gsub(/\{#.*?#\}/m, "")
+        # ReDoS-safe: a tempered token ([^%] | % not before }) walks to the first
+        # %} in one pass — no lazy `.*?` re-scanning each `{%` start (that was O(n^2)).
+        content = content.gsub(/\{%(?:[^%]|%(?!\}))*%\}/m, "")
+        content = content.gsub(/\{#(?:[^#]|#(?!\}))*#\}/m, "")
         content
       end
 
@@ -295,7 +300,9 @@ module Tina4
       private
 
       def process_extends(content)
-        if content =~ /\{%\s*extends\s+["'](.+?)["']\s*%\}/
+        # ReDoS-safe: a negated class ([^"']*) for the quoted path can't backtrack
+        # across the closing quote the way a lazy (.+?) does.
+        if content =~ /\{%\s*extends\s+["']([^"']*)["']\s*%\}/
           parent_path = Regexp.last_match(1)
           full_parent = resolve_template(parent_path)
           if full_parent && File.exist?(full_parent)
@@ -358,7 +365,7 @@ module Tina4
       # grandparent, blocks are merged (child overrides parent) and the
       # chain is followed recursively.
       def render_with_blocks(parent_source, child_blocks)
-        extends_re = /\A\s*\{%\s*extends\s+["'](.+?)["']\s*%\}/
+        extends_re = /\A\s*\{%\s*extends\s+["']([^"']*)["']\s*%\}/
 
         # Multi-level: if the parent itself extends another template, recurse
         if parent_source =~ extends_re
@@ -375,7 +382,7 @@ module Tina4
 
             # Resolve nested blocks: if a block value contains {% block inner %}
             # tags, replace them with merged_blocks values too
-            block_re = /\{%[-\s]*block\s+(\w+)\s*-?%\}(.*?)\{%[-\s]*endblock\s*-?%\}/m
+            block_re = /\{%[-\s]*block\s+(\w+)\s*-?%\}((?:[^{]|\{(?!%[-\s]*endblock\s*-?%\}))*)\{%[-\s]*endblock\s*-?%\}/m
             changed = true
             while changed
               changed = false
@@ -398,7 +405,7 @@ module Tina4
         end
 
         # Leaf parent (no extends) — resolve blocks and render
-        parent_source.gsub(/\{%[-\s]*block\s+(\w+)\s*-?%\}(.*?)\{%[-\s]*endblock\s*-?%\}/m) do
+        parent_source.gsub(/\{%[-\s]*block\s+(\w+)\s*-?%\}((?:[^{]|\{(?!%[-\s]*endblock\s*-?%\}))*)\{%[-\s]*endblock\s*-?%\}/m) do
           name = Regexp.last_match(1)
           default_body = Regexp.last_match(2)
           child_blocks[name] || default_body
@@ -406,7 +413,7 @@ module Tina4
       end
 
       def process_blocks(content)
-        content.gsub(/\{%\s*block\s+(\w+)\s*%\}(.*?)\{%\s*endblock\s*%\}/m) do
+        content.gsub(/\{%\s*block\s+(\w+)\s*%\}((?:[^{]|\{(?!%\s*endblock\s*%\}))*)\{%\s*endblock\s*%\}/m) do
           name = Regexp.last_match(1)
           default_body = Regexp.last_match(2)
           @blocks[name] || default_body
@@ -414,7 +421,9 @@ module Tina4
       end
 
       def process_includes(content)
-        content.gsub(/\{%\s*include\s+["'](.+?)["'](?:\s+with\s+(.+?))?\s*%\}/) do
+        # ReDoS-safe: negated class for the quoted path, and the (unused) `with`
+        # clause is consumed by a tempered token instead of a lazy (.+?)\s* pair.
+        content.gsub(/\{%\s*include\s+["']([^"']*)["'](?:\s+with\s++(?:[^%]|%(?!\}))*+)?\s*+%\}/) do
           inc_path = Regexp.last_match(1)
           full_path = resolve_template(inc_path)
           if full_path && File.exist?(full_path)
@@ -430,10 +439,10 @@ module Tina4
         max_depth = 10
         depth = 0
         while content =~ /\{%\s*for\s+/ && depth < max_depth
-          content = content.gsub(/\{%\s*for\s+(\w+)(?:\s*,\s*(\w+))?\s+in\s+(.+?)\s*%\}(.*?)\{%\s*endfor\s*%\}/m) do
+          content = content.gsub(/\{%\s*for\s+(\w+)(?:\s*,\s*(\w+))?\s+in\s++((?:[^%]|%(?!\}))++)%\}((?:[^{]|\{(?!%\s*endfor\s*%\}))*+)\{%\s*endfor\s*%\}/m) do
             key_or_val = Regexp.last_match(1)
             val_name = Regexp.last_match(2)
-            collection_expr = Regexp.last_match(3)
+            collection_expr = Regexp.last_match(3).strip
             body = Regexp.last_match(4)
             collection = evaluate_expression(collection_expr)
             output = +""
@@ -475,9 +484,11 @@ module Tina4
         depth = 0
         while content =~ /\{%\s*if\s+/ && depth < max_depth
           content = content.gsub(
-            /\{%\s*if\s+(.+?)\s*%\}(.*?)(?:\{%\s*else\s*%\}(.*?))?\{%\s*endif\s*%\}/m
+            # ReDoS-safe: tempered tokens — condition walks to %}, bodies stop at
+            # the first else/endif, so no lazy (.+?)/\s* overlap to backtrack on.
+            /\{%\s*if\s++((?:[^%]|%(?!\}))++)%\}((?:[^{]|\{(?!%\s*(?:else|endif)\s*%\}))*+)(?:\{%\s*else\s*%\}((?:[^{]|\{(?!%\s*endif\s*%\}))*+))?\{%\s*endif\s*%\}/m
           ) do
-            condition = Regexp.last_match(1)
+            condition = Regexp.last_match(1).strip
             true_body = Regexp.last_match(2)
             false_body = Regexp.last_match(3) || ""
 
@@ -511,17 +522,21 @@ module Tina4
       end
 
       def process_set(content)
-        content.gsub(/\{%\s*set\s+(\w+)\s*=\s*(.+?)\s*%\}/) do
+        content.gsub(/\{%\s*set\s+(\w+)\s*=((?:[^%]|%(?!\}))+)%\}/) do
           var_name = Regexp.last_match(1)
-          expr = Regexp.last_match(2)
+          expr = Regexp.last_match(2).strip
           @context[var_name] = evaluate_expression(expr)
           ""
         end
       end
 
       def process_expressions(content)
-        content.gsub(/\{\{\s*(.+?)\s*\}\}/) do
-          expr = Regexp.last_match(1)
+        # ReDoS-safe: the old /\{\{\s*(.+?)\s*\}\}/ let the surrounding \s* AND the
+        # lazy (.+?) both match spaces — two ways to assign the whitespace, so
+        # polynomial backtracking. A tempered token ([^}] | } not before }) walks
+        # to the first }} in one deterministic pass; strip the whitespace in code.
+        content.gsub(/\{\{((?:[^}]|\}(?!\}))++)\}\}/) do
+          expr = Regexp.last_match(1).strip
           evaluate_piped_expression(expr).to_s
         end
       end