tina4ruby 3.13.150 → 3.13.151

data/lib/tina4/template.rb

@@ -232,7 +232,10 @@ module Tina4
         "nl2br" => ->(v) { v.to_s.gsub("\n", "<br>") },
         "number_format" => ->(v, d) { format("%.#{d || 0}f", v.to_f) },
         "raw" => ->(v) { v },
-        "striptags" => ->(v) { v.to_s.gsub(/<[^>]+>/, "") },
+        # Fixed-point strip: a single gsub leaves a tag that only surfaces once the
+        # surrounding one is removed (`<scr<script>ipt>` -> `<script>`). Repeat
+        # until nothing more matches (incomplete multi-character sanitization).
+        "striptags" => ->(v) { s = v.to_s; loop { t = s.gsub(/<[^>]+>/, ""); break if t == s; s = t }; s },
         "sort" => ->(v) { v.respond_to?(:sort) ? v.sort : v },
         "keys" => ->(v) { v.respond_to?(:keys) ? v.keys : [] },
         "values" => ->(v) { v.respond_to?(:values) ? v.values : [v] },
@@ -272,8 +275,10 @@ module Tina4
         content = process_conditionals(content)
         content = process_set(content)
         content = process_expressions(content)
-        content = content.gsub(/\{%.*?%\}/m, "")
-        content = content.gsub(/\{#.*?#\}/m, "")
+        # ReDoS-safe: a tempered token ([^%] | % not before }) walks to the first
+        # %} in one pass — no lazy `.*?` re-scanning each `{%` start (that was O(n^2)).
+        content = content.gsub(/\{%(?:[^%]|%(?!\}))*%\}/m, "")
+        content = content.gsub(/\{#(?:[^#]|#(?!\}))*#\}/m, "")
         content
       end
 
@@ -295,7 +300,9 @@ module Tina4
       private
 
       def process_extends(content)
-        if content =~ /\{%\s*extends\s+["'](.+?)["']\s*%\}/
+        # ReDoS-safe: a negated class ([^"']*) for the quoted path can't backtrack
+        # across the closing quote the way a lazy (.+?) does.
+        if content =~ /\{%\s*extends\s+["']([^"']*)["']\s*%\}/
           parent_path = Regexp.last_match(1)
           full_parent = resolve_template(parent_path)
           if full_parent && File.exist?(full_parent)
@@ -358,7 +365,7 @@ module Tina4
       # grandparent, blocks are merged (child overrides parent) and the
       # chain is followed recursively.
       def render_with_blocks(parent_source, child_blocks)
-        extends_re = /\A\s*\{%\s*extends\s+["'](.+?)["']\s*%\}/
+        extends_re = /\A\s*\{%\s*extends\s+["']([^"']*)["']\s*%\}/
 
         # Multi-level: if the parent itself extends another template, recurse
         if parent_source =~ extends_re
@@ -375,7 +382,7 @@ module Tina4
 
             # Resolve nested blocks: if a block value contains {% block inner %}
             # tags, replace them with merged_blocks values too
-            block_re = /\{%[-\s]*block\s+(\w+)\s*-?%\}(.*?)\{%[-\s]*endblock\s*-?%\}/m
+            block_re = /\{%[-\s]*block\s+(\w+)\s*-?%\}((?:[^{]|\{(?!%[-\s]*endblock\s*-?%\}))*)\{%[-\s]*endblock\s*-?%\}/m
             changed = true
             while changed
               changed = false
@@ -398,7 +405,7 @@ module Tina4
         end
 
         # Leaf parent (no extends) — resolve blocks and render
-        parent_source.gsub(/\{%[-\s]*block\s+(\w+)\s*-?%\}(.*?)\{%[-\s]*endblock\s*-?%\}/m) do
+        parent_source.gsub(/\{%[-\s]*block\s+(\w+)\s*-?%\}((?:[^{]|\{(?!%[-\s]*endblock\s*-?%\}))*)\{%[-\s]*endblock\s*-?%\}/m) do
           name = Regexp.last_match(1)
           default_body = Regexp.last_match(2)
           child_blocks[name] || default_body
@@ -406,7 +413,7 @@ module Tina4
       end
 
       def process_blocks(content)
-        content.gsub(/\{%\s*block\s+(\w+)\s*%\}(.*?)\{%\s*endblock\s*%\}/m) do
+        content.gsub(/\{%\s*block\s+(\w+)\s*%\}((?:[^{]|\{(?!%\s*endblock\s*%\}))*)\{%\s*endblock\s*%\}/m) do
           name = Regexp.last_match(1)
           default_body = Regexp.last_match(2)
           @blocks[name] || default_body
@@ -414,7 +421,9 @@ module Tina4
       end
 
       def process_includes(content)
-        content.gsub(/\{%\s*include\s+["'](.+?)["'](?:\s+with\s+(.+?))?\s*%\}/) do
+        # ReDoS-safe: negated class for the quoted path, and the (unused) `with`
+        # clause is consumed by a tempered token instead of a lazy (.+?)\s* pair.
+        content.gsub(/\{%\s*include\s+["']([^"']*)["'](?:\s+with\s++(?:[^%]|%(?!\}))*+)?\s*+%\}/) do
           inc_path = Regexp.last_match(1)
           full_path = resolve_template(inc_path)
           if full_path && File.exist?(full_path)
@@ -430,10 +439,10 @@ module Tina4
         max_depth = 10
         depth = 0
         while content =~ /\{%\s*for\s+/ && depth < max_depth
-          content = content.gsub(/\{%\s*for\s+(\w+)(?:\s*,\s*(\w+))?\s+in\s+(.+?)\s*%\}(.*?)\{%\s*endfor\s*%\}/m) do
+          content = content.gsub(/\{%\s*for\s+(\w+)(?:\s*,\s*(\w+))?\s+in\s++((?:[^%]|%(?!\}))++)%\}((?:[^{]|\{(?!%\s*endfor\s*%\}))*+)\{%\s*endfor\s*%\}/m) do
             key_or_val = Regexp.last_match(1)
             val_name = Regexp.last_match(2)
-            collection_expr = Regexp.last_match(3)
+            collection_expr = Regexp.last_match(3).strip
             body = Regexp.last_match(4)
             collection = evaluate_expression(collection_expr)
             output = +""
@@ -475,9 +484,11 @@ module Tina4
         depth = 0
         while content =~ /\{%\s*if\s+/ && depth < max_depth
           content = content.gsub(
-            /\{%\s*if\s+(.+?)\s*%\}(.*?)(?:\{%\s*else\s*%\}(.*?))?\{%\s*endif\s*%\}/m
+            # ReDoS-safe: tempered tokens — condition walks to %}, bodies stop at
+            # the first else/endif, so no lazy (.+?)/\s* overlap to backtrack on.
+            /\{%\s*if\s++((?:[^%]|%(?!\}))++)%\}((?:[^{]|\{(?!%\s*(?:else|endif)\s*%\}))*+)(?:\{%\s*else\s*%\}((?:[^{]|\{(?!%\s*endif\s*%\}))*+))?\{%\s*endif\s*%\}/m
           ) do
-            condition = Regexp.last_match(1)
+            condition = Regexp.last_match(1).strip
             true_body = Regexp.last_match(2)
             false_body = Regexp.last_match(3) || ""
 
@@ -511,17 +522,21 @@ module Tina4
       end
 
       def process_set(content)
-        content.gsub(/\{%\s*set\s+(\w+)\s*=\s*(.+?)\s*%\}/) do
+        content.gsub(/\{%\s*set\s+(\w+)\s*=((?:[^%]|%(?!\}))+)%\}/) do
           var_name = Regexp.last_match(1)
-          expr = Regexp.last_match(2)
+          expr = Regexp.last_match(2).strip
           @context[var_name] = evaluate_expression(expr)
           ""
         end
       end
 
       def process_expressions(content)
-        content.gsub(/\{\{\s*(.+?)\s*\}\}/) do
-          expr = Regexp.last_match(1)
+        # ReDoS-safe: the old /\{\{\s*(.+?)\s*\}\}/ let the surrounding \s* AND the
+        # lazy (.+?) both match spaces — two ways to assign the whitespace, so
+        # polynomial backtracking. A tempered token ([^}] | } not before }) walks
+        # to the first }} in one deterministic pass; strip the whitespace in code.
+        content.gsub(/\{\{((?:[^}]|\}(?!\}))++)\}\}/) do
+          expr = Regexp.last_match(1).strip
           evaluate_piped_expression(expr).to_s
         end
       end

data/lib/tina4/templates/crud/form.twig

@@ -3,23 +3,23 @@
 
   Override: drop your own templates/crud/form.twig to change how inputs render.
 
-  fields - one per input: { id, name, label, value, placeholder, required_attr,
+  fields - one per input: { id, name, label, value, placeholder, required (bool),
            and exactly ONE control flag: input (with type) | textarea | checkbox
-           (checked_attr) | select (options_html) }.
-  wrap        - render the <form> wrapper; form_id_attr/action/form_method set it
+           (checked bool) | select (options_html) }.
+  wrap        - render the <form> wrapper; form_id/action/form_method set it
   edit        - add the hidden primary-key input (edit modal)
   modal_footer- render the Cancel/Save modal buttons; submit_button - a plain Submit
 
   No inline styles or on*= handlers: the modal buttons carry data-crud-action and
   are wired by the page script's delegated listener (ADR-0088).
 #}
-{% if wrap %}<form{{ form_id_attr|raw }} action="{{ action }}" method="{{ form_method }}" class="needs-validation" data-crud-form="1">{% endif %}
+{% if wrap %}<form{% if form_id %} id="{{ form_id }}"{% endif %} action="{{ action }}" method="{{ form_method }}" class="needs-validation" data-crud-form="1">{% endif %}
 {% if method_override %}<input type="hidden" name="_method" value="{{ method_override }}">{% endif %}
 {% if edit %}<input type="hidden" id="{{ mode }}-pk-value" name="{{ pk }}">{% endif %}
 {% if modal_footer %}<div class="crud-errors" data-crud-errors hidden></div>{% endif %}
 {% for field in fields %}<div class="mb-3">
 <label for="{{ field.id }}" class="form-label">{{ field.label }}</label>
-{% if field.textarea %}<textarea class="form-control" id="{{ field.id }}" name="{{ field.name }}"{{ field.required_attr|raw }}>{{ field.value }}</textarea>{% endif %}{% if field.checkbox %}<div class="form-check"><input class="form-check-input" type="checkbox" id="{{ field.id }}" name="{{ field.name }}"{{ field.checked_attr|raw }}></div>{% endif %}{% if field.select %}<select class="form-select" id="{{ field.id }}" name="{{ field.name }}"{{ field.required_attr|raw }}>{{ field.options_html|raw }}</select>{% endif %}{% if field.input %}<input type="{{ field.type }}" class="form-control" id="{{ field.id }}" name="{{ field.name }}" value="{{ field.value }}" placeholder="{{ field.placeholder }}"{{ field.required_attr|raw }}>{% endif %}
+{% if field.textarea %}<textarea class="form-control" id="{{ field.id }}" name="{{ field.name }}"{% if field.required %} required{% endif %}>{{ field.value }}</textarea>{% endif %}{% if field.checkbox %}<div class="form-check"><input class="form-check-input" type="checkbox" id="{{ field.id }}" name="{{ field.name }}"{% if field.checked %} checked{% endif %}></div>{% endif %}{% if field.select %}<select class="form-select" id="{{ field.id }}" name="{{ field.name }}"{% if field.required %} required{% endif %}>{{ field.options_html|raw }}</select>{% endif %}{% if field.input %}<input type="{{ field.type }}" class="form-control" id="{{ field.id }}" name="{{ field.name }}" value="{{ field.value }}" placeholder="{{ field.placeholder }}"{% if field.required %} required{% endif %}>{% endif %}
 </div>
 {% endfor %}
 {% if modal_footer %}<div class="modal-footer"><button type="button" class="btn btn-secondary" data-crud-action="close" data-crud-modal="{{ mode }}">Cancel</button><button type="button" class="btn btn-primary" data-crud-action="save" data-crud-mode="{{ mode }}">Save</button></div>{% endif %}{% if submit_button %}<button type="submit" class="btn btn-primary">Submit</button>{% endif %}

data/lib/tina4/templates/crud/table.twig

@@ -11,7 +11,7 @@
     empty    - true when there are no rows
     colspan  - column count + 1 (for the empty row)
     editable - inline-edit table (Save/Delete); readonly - view table (Edit/Delete)
-    table_name, table_id_attr, inline_script
+    table_name, table_id, inline_script
 
   Alignment: each header/cell carries a tina4-css class (text-start for text,
   text-end for numbers). Actions is always text-end. No inline styles (ADR-0088).
@@ -20,7 +20,7 @@
   re-renders <tbody data-crud-body> over fetch() as the user searches/sorts/pages.
 #}
 <div class="table-responsive">
-<table class="table table-striped table-hover"{{ table_id_attr|raw }}>
+<table class="table table-striped table-hover"{% if table_id %} id="{{ table_id }}"{% endif %}>
 <thead class="table-dark"><tr>
 {% for header in headers %}{% if header.sortable %}<th class="{{ header.align }}"><a class="sort-link" href="{{ header.url }}" data-crud-sort="{{ header.col }}" data-crud-dir="{{ header.next_dir }}">{{ header.label }}{{ header.indicator|raw }}</a></th>{% endif %}{% if header.plain %}<th class="{{ header.align }}">{{ header.label }}</th>{% endif %}{% endfor %}<th class="text-end">Actions</th>
 </tr></thead>

data/lib/tina4/templates/errors/302.twig

@@ -1,14 +1,15 @@
 {% extends "errors/base.twig" %}
 {% block title %}Redirecting…{% endblock %}
-{% block meta %}<meta http-equiv="refresh" content="0;url={{ redirect_url }}">{% endblock %}
+{% block meta %}{% set p1 = redirect_url|slice(0,1) %}{% set p2 = redirect_url|slice(0,2) %}{% set p7 = redirect_url|slice(0,7) %}{% set p8 = redirect_url|slice(0,8) %}{% set rel = (p1 == '/') ? ((p2 == '//') ? 'no' : 'yes') : 'no' %}{% set safe_redirect_url = (rel == 'yes' or p7 == 'http://' or p8 == 'https://') ? redirect_url : '/' %}<meta http-equiv="refresh" content="0;url={{ safe_redirect_url }}">{% endblock %}
 {% block extra_styles %}
 .spinner { display: inline-block; width: 1.5rem; height: 1.5rem; border: 3px solid var(--border); border-top-color: var(--primary); border-radius: 50%; animation: spin 0.8s linear infinite; margin-bottom: 1rem; }
 @keyframes spin { to { transform: rotate(360deg); } }
 {% endblock %}
 {% block content %}
+    {% set p1 = redirect_url|slice(0,1) %}{% set p2 = redirect_url|slice(0,2) %}{% set p7 = redirect_url|slice(0,7) %}{% set p8 = redirect_url|slice(0,8) %}{% set rel = (p1 == '/') ? ((p2 == '//') ? 'no' : 'yes') : 'no' %}{% set safe_redirect_url = (rel == 'yes' or p7 == 'http://' or p8 == 'https://') ? redirect_url : '/' %}
     <div class="spinner"></div>
     <div class="error-title">Redirecting…</div>
     <div class="error-msg">You are being redirected to a new location.</div>
-    <div class="error-path c-primary">{{ redirect_url }}</div>
-    <a href="{{ redirect_url }}" class="error-home">Click here if not redirected</a>
+    <div class="error-path c-primary">{{ safe_redirect_url }}</div>
+    <a href="{{ safe_redirect_url }}" class="error-home">Click here if not redirected</a>
 {% endblock %}

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.150"
+  VERSION = "3.13.151"
 end

data/lib/tina4/webserver.rb

@@ -199,7 +199,7 @@ module Tina4
     # @param host [String] the host the main socket binds
     # @return [Array<String>] extra bind addresses (possibly empty)
     def self.loopback_bind_hosts(host)
-      normalized = host.to_s.strip.downcase.gsub(/\A\[+|\]+\z/, "")
+      normalized = host.to_s.strip.downcase.gsub(/\A\[++|\]++\z/, "")
       case normalized
       when "localhost"            then ["127.0.0.1", "::1"]
       when "127.0.0.1", "0.0.0.0" then ["::1"]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.150
+  version: 3.13.151
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-11 00:00:00.000000000 Z
+date: 2026-10-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3
@@ -322,6 +322,7 @@ files:
 - lib/tina4/realtime/channel_member.rb
 - lib/tina4/realtime/local_storage.rb
 - lib/tina4/realtime/message.rb
+- lib/tina4/realtime/s3_client.rb
 - lib/tina4/realtime/s3_storage.rb
 - lib/tina4/realtime/storage.rb
 - lib/tina4/realtime/storage_backend.rb