@daloyjs/core 1.0.0-rc.5 → 1.0.0-rc.6

package/dist/tenancy.d.ts

@@ -32,6 +32,12 @@
  * (as the first group hook, or in `AppOptions.hooks`) so `ctx.state.tenant`
  * is populated by the time their `keyGenerator` / `scope` callbacks run.
  *
+ * `responseCache()` is a special case in two ways: it partitions on the resolved
+ * tenant **automatically** (no `keyGenerator` needed — see
+ * {@link TENANCY_RESOLVED_MARKER}), and because a mis-ordered cache is a silent
+ * cross-tenant disclosure rather than a merely wrong bucket, mounting it *ahead*
+ * of `tenancy()` refuses to boot in production instead of leaking.
+ *
  * ```ts
  * import { App, tenancy, tenantFromSubdomain, tenantScope, rateLimit } from "@daloyjs/core";
  *
@@ -161,6 +167,40 @@ export interface ClaimTenantOptions {
  */
 export declare function tenantFromClaim(claim: string, opts?: ClaimTenantOptions): TenantResolver;
 /** Status codes acceptable for an unresolved-tenant rejection. @since 0.42.0 */
+/**
+ * Marker stamped on the `Hooks` object returned by {@link tenancy}, so the `App`
+ * boot guard can verify that a `responseCache()` in the same chain is mounted
+ * *after* tenancy — i.e. that the tenant is in `ctx.state` by the time the cache
+ * key is built.
+ *
+ * @since 1.0.0
+ */
+export declare const TENANCY_HOOK_MARKER: unique symbol;
+/**
+ * `ctx.state` symbol under which {@link tenancy} records the tenant it resolved,
+ * independently of the configurable {@link TenancyOptions.stateKey}.
+ *
+ * Consumers that must partition shared state per tenant — notably
+ * `responseCache()`, which folds it into the cache key to prevent cross-tenant
+ * cached-response disclosure (CWE-524) — read this instead of guessing the
+ * `stateKey`. Kept in the global symbol registry so a consumer can re-derive it
+ * with `Symbol.for(...)` without importing this module.
+ *
+ * @since 1.0.0
+ */
+export declare const TENANCY_RESOLVED_MARKER: unique symbol;
+/**
+ * Value recorded under {@link TENANCY_RESOLVED_MARKER} when {@link tenancy} ran
+ * but resolved no tenant (only reachable with `tenancy({ require: false })`).
+ *
+ * Distinguishing "tenancy is active and resolved nothing" from "no tenancy at
+ * all" lets a consumer keep tenant-less traffic in its own partition rather than
+ * sharing the unpartitioned one. The leading space cannot occur in a normalized
+ * tenant id, so it can never collide with a real one.
+ *
+ * @since 1.0.0
+ */
+export declare const TENANT_UNRESOLVED = " unresolved";
 export type UnresolvedStatus = 400 | 401 | 403 | 404;
 /** Status codes acceptable for an unknown/disallowed-tenant rejection. @since 0.42.0 */
 export type InvalidStatus = 400 | 403 | 404;

package/dist/tenancy.js

@@ -32,6 +32,12 @@
  * (as the first group hook, or in `AppOptions.hooks`) so `ctx.state.tenant`
  * is populated by the time their `keyGenerator` / `scope` callbacks run.
  *
+ * `responseCache()` is a special case in two ways: it partitions on the resolved
+ * tenant **automatically** (no `keyGenerator` needed — see
+ * {@link TENANCY_RESOLVED_MARKER}), and because a mis-ordered cache is a silent
+ * cross-tenant disclosure rather than a merely wrong bucket, mounting it *ahead*
+ * of `tenancy()` refuses to boot in production instead of leaking.
+ *
  * ```ts
  * import { App, tenancy, tenantFromSubdomain, tenantScope, rateLimit } from "@daloyjs/core";
  *
@@ -48,7 +54,7 @@
  *
  * @since 0.42.0
  */
-import { BadRequestError, ForbiddenError, NotFoundError, UnauthorizedError, } from "./errors.js";
+import { BadRequestError, ForbiddenError, NotFoundError, UnauthorizedError } from "./errors.js";
 import { subdomains } from "./subdomains.js";
 /**
  * Conservative default tenant-id grammar: a DNS-label-like token, lowercase
@@ -181,6 +187,41 @@ export function tenantFromClaim(claim, opts = {}) {
         return undefined;
     };
 }
+/** Status codes acceptable for an unresolved-tenant rejection. @since 0.42.0 */
+/**
+ * Marker stamped on the `Hooks` object returned by {@link tenancy}, so the `App`
+ * boot guard can verify that a `responseCache()` in the same chain is mounted
+ * *after* tenancy — i.e. that the tenant is in `ctx.state` by the time the cache
+ * key is built.
+ *
+ * @since 1.0.0
+ */
+export const TENANCY_HOOK_MARKER = Symbol.for("daloyjs.tenancy.hook");
+/**
+ * `ctx.state` symbol under which {@link tenancy} records the tenant it resolved,
+ * independently of the configurable {@link TenancyOptions.stateKey}.
+ *
+ * Consumers that must partition shared state per tenant — notably
+ * `responseCache()`, which folds it into the cache key to prevent cross-tenant
+ * cached-response disclosure (CWE-524) — read this instead of guessing the
+ * `stateKey`. Kept in the global symbol registry so a consumer can re-derive it
+ * with `Symbol.for(...)` without importing this module.
+ *
+ * @since 1.0.0
+ */
+export const TENANCY_RESOLVED_MARKER = Symbol.for("daloyjs.tenancy.resolved");
+/**
+ * Value recorded under {@link TENANCY_RESOLVED_MARKER} when {@link tenancy} ran
+ * but resolved no tenant (only reachable with `tenancy({ require: false })`).
+ *
+ * Distinguishing "tenancy is active and resolved nothing" from "no tenancy at
+ * all" lets a consumer keep tenant-less traffic in its own partition rather than
+ * sharing the unpartitioned one. The leading space cannot occur in a normalized
+ * tenant id, so it can never collide with a real one.
+ *
+ * @since 1.0.0
+ */
+export const TENANT_UNRESOLVED = " unresolved";
 /** Build the right `HttpError` for a configured status. */
 function rejection(status, detail) {
     switch (status) {
@@ -233,8 +274,13 @@ export function tenancy(opts) {
     else if (typeof opts.allow === "function") {
         allowFn = opts.allow;
     }
-    return {
+    const hooks = {
         async beforeHandle(ctx) {
+            const state = ctx.state;
+            // Record "tenancy ran" up front, so a tenant-less request is partitioned
+            // as such by downstream consumers instead of falling into the shared,
+            // unpartitioned bucket alongside resolved tenants.
+            state[TENANCY_RESOLVED_MARKER] = TENANT_UNRESOLVED;
             let raw;
             for (const resolve of resolvers) {
                 raw = await resolve(ctx);
@@ -259,9 +305,14 @@ export function tenancy(opts) {
             if (allowFn && !(await allowFn(id, ctx))) {
                 throw rejection(invalidStatus, "Unknown tenant.");
             }
-            ctx.state[stateKey] = id;
+            state[stateKey] = id;
+            state[TENANCY_RESOLVED_MARKER] = id;
         },
     };
+    // Let the App boot guard see tenancy's position in the hook chain relative to
+    // any responseCache() that must partition on the tenant it resolves.
+    hooks[TENANCY_HOOK_MARKER] = true;
+    return hooks;
 }
 /**
  * Build a `(ctx) => string` key function that reads the resolved tenant and

package/dist/waf.js

@@ -45,12 +45,7 @@ import { ForbiddenError } from "./errors.js";
 import { hasMongoOperatorKeys } from "./security.js";
 import { readRemoteAddress } from "./conn-info.js";
 /** The four built-in rule categories, in stable order. */
-const ALL_RULE_IDS = Object.freeze([
-    "sqli",
-    "xss",
-    "nosqli",
-    "cmdi",
-]);
+const ALL_RULE_IDS = Object.freeze(["sqli", "xss", "nosqli", "cmdi"]);
 /** Default anomaly score contributed by each rule when it matches. */
 const DEFAULT_RULE_SCORE = 5;
 /** Default total anomaly score at which a request is blocked / reported. */
@@ -69,6 +64,13 @@ const SQLI_SIGNATURES = Object.freeze([
     /\bUNION\b[\s\S]{0,40}?\bSELECT\b/i,
     /\b(?:OR|AND)\b\s+['"]?\d+['"]?\s*=\s*['"]?\d+/i,
     /'\s*(?:OR|AND)\s+'?[\w]+'?\s*=\s*'?[\w]+/i,
+    // Parenthesized subquery behind a boolean operator — `1 OR (SELECT 1)`. The
+    // tautology patterns above anchor on `= <digit>`, so a subquery carrying no
+    // comparison slipped through. Paired with the comment-stripped inspection
+    // variant this also catches `1/**/OR/**/(SELECT/**/1)`. High confidence:
+    // prose query values virtually never contain `OR (` immediately followed by
+    // the SELECT keyword.
+    /\b(?:OR|AND)\s*\(\s*SELECT\b/i,
     /;\s*(?:DROP|DELETE|INSERT|UPDATE|TRUNCATE|ALTER|CREATE)\b/i,
     /\b(?:SLEEP|BENCHMARK|PG_SLEEP)\s*\(/i,
     /\bWAITFOR\s+DELAY\b/i,
@@ -171,13 +173,30 @@ function safeDecode(value) {
  * deliver query/path values.
  */
 const MAX_DECODE_PASSES = 2;
+/**
+ * Control characters that are NOT matched by JS `\s`, used to split keywords
+ * past whitespace-anchored signatures (e.g. `1'%00OR%001=1`).
+ *
+ * U+0009-U+000D (\t \n \v \f \r) are deliberately absent: `\s` already
+ * matches them and every signature separates tokens with `\s`, `\b`, or
+ * `[\s\S]`, so normalizing them would only duplicate an existing variant.
+ *
+ * Hoisted to module scope so the hot path neither re-creates the RegExp object
+ * nor pays literal-evaluation overhead per inspected value. The probe is
+ * non-global (stateless `test()`); the replace copy is global and `replace()`
+ * resets `lastIndex`, so neither carries state between calls.
+ */
+const CONTROL_CHAR_PROBE = /[\u0000-\u0008\u000e-\u001f\u007f]/;
+const CONTROL_CHAR_GLOBAL = /[\u0000-\u0008\u000e-\u001f\u007f]/g;
 /**
  * Expand a single inbound string into the variants the WAF should scan.
  *
  * Includes the raw value, up to {@link MAX_DECODE_PASSES} percent-decodes,
- * a `+`→space form (URLSearchParams parity), and a SQL-comment-stripped
+ * a `+`→space form (URLSearchParams parity), a SQL-comment-stripped
  * form so comment-split keywords (e.g. OR wrapped in block comments) score
- * the same as the whitespace-separated form.
+ * the same as the whitespace-separated form, and a control-character→space
+ * form so embedded NUL / escape bytes cannot split keywords past the
+ * whitespace-anchored signatures (e.g. `1'%00OR%001=1` → `1' OR 1=1`).
  *
  * Scanning variants is pure defense-in-depth: the handler still receives
  * whatever the framework's single-decode path produced. Each variant is
@@ -214,6 +233,19 @@ function inspectionVariants(value, maxValueLength) {
             push(v.replace(/\+/g, " "));
         if (v.includes("/*"))
             push(v.replace(/\/\*[\s\S]*?\*\//g, " "));
+        // Control characters (notably NUL) are not `\s`, so `1'%00OR%001=1` split
+        // `OR` from `1=1` and walked past the whitespace-anchored signatures. Scan
+        // a control-char→space form; benign traffic carries almost no C0 bytes, so
+        // the false-positive surface is negligible.
+        //
+        // The class deliberately excludes U+0009-U+000D (\t \n \v \f \r): JS `\s`
+        // already matches those, and every signature separates tokens with `\s`,
+        // `\b`, or `[\s\S]`, so normalizing them only ever yields a variant that
+        // scores identically to one already in the set. Including them cost ~13%
+        // on every request carrying a multi-line body or query value.
+        if (CONTROL_CHAR_PROBE.test(v)) {
+            push(v.replace(CONTROL_CHAR_GLOBAL, " "));
+        }
     }
     return out;
 }

package/dist/webhook-delivery.js

@@ -256,11 +256,25 @@ export function createWebhookSender(options) {
                 lastError = undefined;
                 if (response.ok) {
                     options.onAttempt?.({ id, attempt, status: response.status, willRetry: false });
-                    return { ok: true, id, eventType: event.eventType, attempts: attempt, status: response.status, response, deadLettered: false };
+                    return {
+                        ok: true,
+                        id,
+                        eventType: event.eventType,
+                        attempts: attempt,
+                        status: response.status,
+                        response,
+                        deadLettered: false,
+                    };
                 }
                 const retryable = retryStatuses.has(response.status) && attempt < maxAttempts;
                 const delayMs = retryable ? backoffFor(attempt, response) : undefined;
-                options.onAttempt?.({ id, attempt, status: response.status, willRetry: retryable, delayMs });
+                options.onAttempt?.({
+                    id,
+                    attempt,
+                    status: response.status,
+                    willRetry: retryable,
+                    delayMs,
+                });
                 if (!retryable)
                     break;
                 await sleep(delayMs);
@@ -291,7 +305,9 @@ export function createWebhookSender(options) {
                 contentType,
                 attempts: madeAttempts,
                 ...(lastStatus !== undefined ? { lastStatus } : {}),
-                ...(lastError !== undefined ? { lastError: lastError instanceof Error ? lastError.message : String(lastError) } : {}),
+                ...(lastError !== undefined
+                    ? { lastError: lastError instanceof Error ? lastError.message : String(lastError) }
+                    : {}),
                 timestamp,
                 failedAt: now(),
             });

package/dist/websocket.d.ts

@@ -445,14 +445,22 @@ export declare const FRAME_INCOMPLETE: unique symbol;
  * @param buf - Buffered socket bytes beginning at a frame boundary.
  * @param opts - `requireMask: true` enforces the RFC 6455 rule that
  *   client-to-server frames are masked. Defaults to `{}` (not enforced).
+ *   `maxPayload` rejects data frames whose **declared** payload length
+ *   exceeds the limit as soon as the header is parsed, before the payload
+ *   bytes have arrived — this keeps a slow-or-stalled sender from making
+ *   the caller buffer an oversized incomplete frame. Control frames are
+ *   already capped at 125 bytes and are not affected.
  * @returns The decoded {@link ParsedFrame}, or {@link FRAME_INCOMPLETE}
  *   when more bytes are needed.
  * @throws WebSocketProtocolError on RSV bits, unknown opcodes, fragmented
  *   or oversized control frames, unmasked client frames, or payload lengths
  *   above `Number.MAX_SAFE_INTEGER`.
+ * @throws WebSocketPayloadTooLargeError when `maxPayload` is set and a data
+ *   frame declares a payload length above it.
  */
 export declare function parseFrame(buf: Uint8Array, opts?: {
     requireMask?: boolean;
+    maxPayload?: number;
 }): ParsedFrame | typeof FRAME_INCOMPLETE;
 /**
  * Encode a single frame. By default the frame is emitted unmasked (server

package/dist/websocket.js

@@ -92,7 +92,8 @@ function assertWebSocketOriginPolicy(policy) {
     }
 }
 function schemaToJson(schema) {
-    const converter = schema?.toJSONSchema;
+    const converter = schema
+        ?.toJSONSchema;
     if (typeof converter !== "function")
         return undefined;
     try {
@@ -501,11 +502,18 @@ export const FRAME_INCOMPLETE = Symbol("daloy.ws.frameIncomplete");
  * @param buf - Buffered socket bytes beginning at a frame boundary.
  * @param opts - `requireMask: true` enforces the RFC 6455 rule that
  *   client-to-server frames are masked. Defaults to `{}` (not enforced).
+ *   `maxPayload` rejects data frames whose **declared** payload length
+ *   exceeds the limit as soon as the header is parsed, before the payload
+ *   bytes have arrived — this keeps a slow-or-stalled sender from making
+ *   the caller buffer an oversized incomplete frame. Control frames are
+ *   already capped at 125 bytes and are not affected.
  * @returns The decoded {@link ParsedFrame}, or {@link FRAME_INCOMPLETE}
  *   when more bytes are needed.
  * @throws WebSocketProtocolError on RSV bits, unknown opcodes, fragmented
  *   or oversized control frames, unmasked client frames, or payload lengths
  *   above `Number.MAX_SAFE_INTEGER`.
+ * @throws WebSocketPayloadTooLargeError when `maxPayload` is set and a data
+ *   frame declares a payload length above it.
  */
 export function parseFrame(buf, opts = {}) {
     if (buf.length < 2)
@@ -525,9 +533,7 @@ export function parseFrame(buf, opts = {}) {
             throw new WebSocketProtocolError("Control frames must not be fragmented");
         if (payloadLen > WS_MAX_CONTROL_PAYLOAD)
             throw new WebSocketProtocolError("Control frame payload exceeds 125 bytes");
-        if (opcode !== WS_OPCODE.CLOSE &&
-            opcode !== WS_OPCODE.PING &&
-            opcode !== WS_OPCODE.PONG)
+        if (opcode !== WS_OPCODE.CLOSE && opcode !== WS_OPCODE.PING && opcode !== WS_OPCODE.PONG)
             throw new WebSocketProtocolError(`Unknown control opcode 0x${opcode.toString(16)}`);
     }
     else if (opcode !== WS_OPCODE.CONTINUATION &&
@@ -558,6 +564,14 @@ export function parseFrame(buf, opts = {}) {
         payloadLen = hi * 2 ** 32 + lo;
         offset += 8;
     }
+    // Reject oversized declared lengths as soon as the header is complete —
+    // before waiting on mask or payload bytes — so an attacker cannot make the
+    // caller buffer an unbounded incomplete frame by trickling payload bytes.
+    // Cumulative accounting across fragments stays with the caller; a declared
+    // length above the limit always implies the assembled message exceeds it.
+    if ((opcode & 0x8) === 0 && opts.maxPayload !== undefined && payloadLen > opts.maxPayload) {
+        throw new WebSocketPayloadTooLargeError(opts.maxPayload, payloadLen);
+    }
     if (opts.requireMask && !masked) {
         throw new WebSocketProtocolError("Client frames must be masked");
     }
@@ -745,6 +759,7 @@ export class FrameSink {
             while (this.buffer.length > 0) {
                 const frame = parseFrame(this.buffer, {
                     requireMask: this.opts.requireMask,
+                    maxPayload: this.opts.maxPayloadLength,
                 });
                 if (frame === FRAME_INCOMPLETE)
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-rc.5",
+  "version": "1.0.0-rc.6",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -254,7 +254,7 @@
     "bench:json-e2e": "node --import tsx bench/json-body-e2e.bench.ts",
     "bench:ablation": "pnpm build && node --import tsx bench/ablation.bench.ts",
     "test": "node --import tsx --test tests/**/*.test.ts",
-    "test:red-team": "node --import tsx --test tests/red-team-attacks.test.ts tests/red-team-attacks-2.test.ts tests/red-team-attacks-3.test.ts tests/red-team-attacks-4.test.ts tests/red-team-attacks-5.test.ts tests/red-team-attacks-6.test.ts tests/red-team-attacks-7.test.ts tests/red-team-attacks-8.test.ts tests/red-team-attacks-9.test.ts tests/red-team-attacks-10.test.ts",
+    "test:red-team": "node --import tsx --test tests/red-team-attacks.test.ts tests/red-team-attacks-2.test.ts tests/red-team-attacks-3.test.ts tests/red-team-attacks-4.test.ts tests/red-team-attacks-5.test.ts tests/red-team-attacks-6.test.ts tests/red-team-attacks-7.test.ts tests/red-team-attacks-8.test.ts tests/red-team-attacks-9.test.ts tests/red-team-attacks-10.test.ts tests/red-team-attacks-11.test.ts",
     "red-team:live": "node --import tsx red-team-live/run.ts",
     "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
     "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",