@saltcorn/server 1.6.0-beta.5 → 1.6.0-beta.6

package/routes/sync.js

@@ -82,8 +82,12 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
     ownerFieldName = ownerField.name;
   }
 
-  const maxLoadedId = Number(syncInfo.maxLoadedId);
-  if (!Number.isInteger(maxLoadedId)) throw new Error("Invalid maxLoadedId");
+  // Time-based composite cursor: (lastModifiedAt ms, lastRef string).
+  // Works for both integer and UUID primary keys.
+  const lastModifiedAt = Number(syncInfo.lastModifiedAt ?? 0);
+  if (!Number.isInteger(lastModifiedAt) || lastModifiedAt < 0)
+    throw new Error("Invalid lastModifiedAt");
+  const lastRef = String(syncInfo.lastRef ?? "");
 
   const syncUntilMs = new Date(syncUntil).valueOf();
   if (!Number.isFinite(syncUntilMs)) throw new Error("Invalid syncUntil");
@@ -94,28 +98,31 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
 
   const schema = db.getTenantSchemaPrefix();
   if (!syncInfo.syncFrom) {
-    const params = [maxLoadedId];
+    // First sync: all non-deleted rows after the cursor, ordered by
+    // (last_modified, ref) so pagination is stable across PK types.
+    const params = [lastModifiedAt / 1000.0, lastRef];
     const ownerClause = ownerFieldName
-      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $2`
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $3`
       : "";
     if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
       `select
-         info_tbl.ref "_sync_info_tbl_ref_",
+         COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text) "_sync_info_tbl_ref_",
          info_tbl.last_modified "_sync_info_tbl_last_modified_",
-         info_tbl.deleted "_sync_info_tbl_deleted_",
+         COALESCE(info_tbl.deleted, false) "_sync_info_tbl_deleted_",
          data_tbl.*
-       from ${schema}"${db.sqlsanitize(
-        tblName
-      )}_sync_info" "info_tbl" right join "${db.sqlsanitize(
-        tblName
-      )}" "data_tbl"
-      on info_tbl.ref = data_tbl."${db.sqlsanitize(
-        pkName
-      )}" and info_tbl.deleted = false
-      where data_tbl."${db.sqlsanitize(pkName)}" > $1
-      ${ownerClause}
-      order by data_tbl."${db.sqlsanitize(pkName)}"`,
+       from ${schema}"${db.sqlsanitize(tblName)}_sync_info" "info_tbl"
+       right join "${db.sqlsanitize(tblName)}" "data_tbl"
+         on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"::text
+         and info_tbl.deleted = false
+       where (
+           COALESCE(info_tbl.last_modified, to_timestamp(0)),
+           COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text)
+         ) > (to_timestamp($1), $2)
+       ${ownerClause}
+       order by
+         COALESCE(info_tbl.last_modified, to_timestamp(0)),
+         COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text)`,
       params
     );
     for (const row of rows) {
@@ -132,9 +139,16 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
     const syncFromMs = new Date(syncInfo.syncFrom).valueOf();
     if (!Number.isFinite(syncFromMs)) throw new Error("Invalid syncFrom");
 
-    const params = [syncFromMs / 1000.0, syncUntilMs / 1000.0, maxLoadedId];
+    // Incremental sync: rows changed in the time window, paged by
+    // (last_modified, ref) within the window.
+    const params = [
+      syncFromMs / 1000.0,
+      syncUntilMs / 1000.0,
+      lastModifiedAt / 1000.0,
+      lastRef,
+    ];
     const ownerClause = ownerFieldName
-      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $4`
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $5`
       : "";
     if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
@@ -143,18 +157,15 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
          info_tbl.last_modified "_sync_info_tbl_last_modified_",
          info_tbl.deleted "_sync_info_tbl_deleted_",
          data_tbl.*
-       from ${schema}"${db.sqlsanitize(
-        tblName
-      )}_sync_info" "info_tbl" join ${schema}"${db.sqlsanitize(
-        tblName
-      )}" "data_tbl"
-      on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"
-      where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp($1)
-      and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp($2)
-      and info_tbl.deleted = false
-      and info_tbl.ref > $3
-      ${ownerClause}
-      order by info_tbl.ref`,
+       from ${schema}"${db.sqlsanitize(tblName)}_sync_info" "info_tbl"
+       join ${schema}"${db.sqlsanitize(tblName)}" "data_tbl"
+         on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"::text
+       where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp($1)
+         and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp($2)
+         and info_tbl.deleted = false
+         and (info_tbl.last_modified, info_tbl.ref) > (to_timestamp($3), $4)
+       ${ownerClause}
+       order by info_tbl.last_modified, info_tbl.ref`,
       params
     );
     for (const row of rows) {
@@ -215,9 +226,11 @@ router.post(
             rows.splice(rowLimit);
           }
           rowLimit -= rows.length;
+          const lastRow = rows.length > 0 ? rows[rows.length - 1] : null;
           result[tblName] = {
             rows,
-            maxLoadedId: rows.length > 0 ? rows[rows.length - 1][pkName] : 0,
+            maxModifiedAt: lastRow ? lastRow._sync_info_tbl_last_modified_ : 0,
+            maxRef: lastRow ? String(lastRow._sync_info_tbl_ref_ ?? "") : "",
           };
         }
         return result;

package/routes/utils.js

@@ -420,7 +420,10 @@ const normalize_relative_url = (url) => {
 };
 
 const safe_redirect = (res, url, default_url) => {
-  if (!url) res.redirect(default_url);
+  if (!url) {
+    res.redirect(default_url);
+    return;
+  }
   const dest = normalize_relative_url(url);
   if (dest !== null) res.redirect(dest);
   else res.redirect(default_url);

package/serve.js

@@ -851,16 +851,18 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
 
   // dynamic updates emitter (for run_js_actions)
   getState().setDynamicUpdateEmitter((tenant, data, userIds) => {
-    if (userIds) {
+    if (userIds === null) {
+      // explicit public-only; data may carry page_load_tag for client-side filtering
+      io.of("/").to(`_${tenant}_public_dynamic_update_room`).emit("dynamic_update", data);
+    } else if (userIds) {
       for (const userId of userIds) {
         io.of("/")
           .to(`_${tenant}:${userId}_dynamic_update_room`)
           .emit("dynamic_update", data);
       }
     } else {
-      io.of("/")
-        .to(`_${tenant}_dynamic_update_room`)
-        .emit("dynamic_update", data);
+      // undefined: broadcast to authenticated users only
+      io.of("/").to(`_${tenant}_dynamic_update_room`).emit("dynamic_update", data);
     }
   });
 
@@ -961,9 +963,12 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
           const enabled = getState().getConfig("enable_dynamic_updates", true);
           if (!enabled) throw new Error("Dynamic updates are not enabled");
           const user = socket.request.user;
-          if (!user) throw new Error("Not authorized");
-          socket.join(`_${tenant}_dynamic_update_room`);
-          socket.join(`_${tenant}:${user.id}_dynamic_update_room`);
+          if (user) {
+            socket.join(`_${tenant}_dynamic_update_room`);
+            socket.join(`_${tenant}:${user.id}_dynamic_update_room`);
+          } else {
+            socket.join(`_${tenant}_public_dynamic_update_room`);
+          }
           const socketIds = await getState().getConfig(
             "joined_dynamic_update_socket_ids",
             []

package/tests/admin.test.js

@@ -25,7 +25,7 @@ const {
   auto_backup_now,
 } = require("@saltcorn/admin-models/models/backup");
 
-jest.setTimeout(30000);
+jest.setTimeout(30000000);
 
 beforeAll(async () => {
   await resetToFixtures();
@@ -387,7 +387,7 @@ describe("actions", () => {
       .send("table_id=2")
       .send("name=mynewaction")
       .send("when_trigger=Insert")
-      .expect(toRedirect("/actions/configure/8"));
+      .expect(toRedirect("/actions/configure/9"));
   });
   it("show edit", async () => {
     const app = await getApp({ disableCsrf: true });
@@ -451,9 +451,9 @@ describe("actions", () => {
       .send("action=run_js_code")
       .send("when_trigger=API+call")
       .send("min_role=1")
-      .expect(toRedirect("/actions/configure/9"));
+      .expect(toRedirect("/actions/configure/10"));
     await request(app)
-      .post("/actions/configure/9")
+      .post("/actions/configure/10")
       .set("Cookie", loginCookie)
       .send("code=return 27")
       .expect(toRedirect("/actions/"));
@@ -461,7 +461,7 @@ describe("actions", () => {
       .post("/api/action/myact")
       .set("Cookie", loginCookie)
       .expect(
-        respondJsonWith(200, ({ success, data }) => success && data === 27)
+        respondJsonWith(200, ({ success, data }) => success === true && data === 27)
       );
   });
   it("deletes trigger", async () => {

package/tests/api.test.js

@@ -1150,4 +1150,78 @@ describe("API cross-table sub-select access control", () => {
     const rows2 = resp2.body.success || [];
     expect(rows1.length).toBe(rows2.length);
   });
+
+  it("should not allow probing restricted tables via _relation_path_ parameter", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The _relation_path_ query parameter accepts JSON that specifies a
+    // relation path through arbitrary tables. handleRelationPath() constructs
+    // an inSelectWithLevels subquery with NO authorization checks.
+    //
+    // Attack: query the public books table with a _relation_path_ that
+    // traverses the restricted patients table (min_role_read=40):
+    //   ?_relation_path_={"relation":".books.patients$name","srcId":"Kirk Douglas"}
+    // This generates:
+    //   WHERE id IN (SELECT id FROM patients WHERE name = 'Kirk Douglas')
+    // A public user can determine whether a patient with a given name exists
+    // by observing which books are returned.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    // srcId matching an existing patient name
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        _relation_path_: JSON.stringify({
+          relation: ".books.patients$name",
+          srcId: "Kirk Douglas",
+        }),
+      })
+      .expect(200);
+
+    // srcId with a non-existent patient name
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        _relation_path_: JSON.stringify({
+          relation: ".books.patients$name",
+          srcId: "ZZZNONEXISTENT",
+        }),
+      })
+      .expect(200);
+
+    // If the relation_path is allowed without authorization, resp1 returns
+    // book id=1 (because patient "Kirk Douglas" has id=1) while resp2
+    // returns nothing. The difference reveals that "Kirk Douglas" exists
+    // in the restricted patients table.
+    //
+    // Secure behavior: both queries return the same results (the subquery
+    // against the restricted table is blocked or ignored), OR the query
+    // is rejected.
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via dot-prefix relation path", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The dot-prefix syntax (e.g. ?.books.patients$name=value) is another
+    // way to invoke handleRelationPath, which has no authorization checks.
+    // This constructs the same inSelectWithLevels subquery.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({ ".books.patients$name": "Kirk Douglas" })
+      .expect(200);
+
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({ ".books.patients$name": "ZZZNONEXISTENT" })
+      .expect(200);
+
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
 });

package/tests/files.test.js

@@ -107,6 +107,13 @@ beforeAll(async () => {
     "console.log('I am a script');",
     1
   );
+  await createTestFile(
+    "/",
+    "malicious.svg",
+    "image/svg+xml",
+    `<svg xmlns="http://www.w3.org/2000/svg"><script>alert('XSS')</script><circle cx="50" cy="50" r="40"/></svg>`,
+    100
+  );
 });
 afterAll(db.close);
 
@@ -163,6 +170,16 @@ describe("files admin", () => {
         toSucceedWithImage({ lengthIs: (bs) => bs < 100000 && bs > 2000 })
       );
   });
+  it("sanitize SVG served via /files/resize (XSS bypass)", async () => {
+    const app = await getApp({ disableCsrf: true });
+    const res = await request(app).get("/files/resize/0/0/malicious.svg");
+    expect(res.status).toBe(200);
+    const body = res.text || Buffer.from(res.body).toString();
+    // The resize endpoint must also sanitize SVG files, just like /files/serve does.
+    // Without this, an attacker can bypass DOMPurify by requesting an SVG via
+    // /files/resize/0/0/path.svg (width=0 makes it serve the original file).
+    expect(body).not.toContain("<script>");
+  });
   it("serve resized file without height", async () => {
     const app = await getApp({ disableCsrf: true });
     await request(app)
@@ -538,4 +555,26 @@ describe("visible_entries test", () => {
     expect(body.files.length).toBe(0);
     expect(body.directories.length).toBe(0);
   });
+
+  it("should not crash on regex special characters in file_exts (CVE: regex injection)", async () => {
+    // The file_exts parameter is passed directly to new RegExp() without escaping.
+    // Regex metacharacters like ( [ cause SyntaxError → 500 Internal Server Error.
+    // This also enables ReDoS: patterns like (a+)+b cause exponential CPU usage.
+    // Confirmed: a file with 30 repeated chars + backtracking regex → 3.6s,
+    //            35 chars → 112s. The endpoint should escape regex metacharacters
+    //            or use literal string matching, not raw user input in new RegExp().
+    const app = await getApp({ disableCsrf: true });
+    const adminCookie = await getAdminLoginCookie();
+    await getState().setConfig("min_role_edit_files", 1);
+    const resp = await request(app)
+      .get(
+        "/files/visible_entries?dir=_sc_test_subfolder_one&file_exts=" +
+          encodeURIComponent("([")
+      )
+      .set("Cookie", adminCookie);
+    // Should return 200 with valid JSON, not crash with 500
+    expect(resp.statusCode).toBe(200);
+    expect(resp.body).toBeDefined();
+    expect(resp.body.files).toBeDefined();
+  });
 });

package/tests/plugin_install.test.js

@@ -9,6 +9,7 @@ const {
 } = require("@saltcorn/admin-models/models/tenant");
 const { resetToFixtures } = require("../auth/testhelp");
 const db = require("@saltcorn/data/db");
+const { get_store_items } = require("../routes/plugins");
 
 beforeAll(async () => {
   if (!db.isSQLite) await db.query(`drop schema if exists test101 CASCADE `);
@@ -87,6 +88,64 @@ describe("Tenant cannot install unsafe plugins", () => {
         expect(dbPlugin).toBe(null);
       });
     });
+    it("cannot install git plugins on tenant when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
+
+        await install_pack(
+          plugin_pack({
+            name: "some-git-plugin",
+            source: "git",
+            location: "https://github.com/example/some-git-plugin",
+          }),
+          "Some git plugin",
+          loadAndSaveNewPlugin
+        );
+        const dbPlugin = await Plugin.findOne({ name: "some-git-plugin" });
+        expect(dbPlugin).toBe(null);
+      });
+    });
+    it("cannot install github plugins on tenant when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
+
+        await install_pack(
+          plugin_pack({
+            name: "some-github-plugin",
+            source: "github",
+            location: "example/some-github-plugin",
+          }),
+          "Some github plugin",
+          loadAndSaveNewPlugin
+        );
+        const dbPlugin = await Plugin.findOne({ name: "some-github-plugin" });
+        expect(dbPlugin).toBe(null);
+      });
+    });
+    it("loadPlugin skips git plugin on tenant when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const result = await Plugin.loadPlugin(
+          new Plugin({
+            name: "some-git-plugin",
+            source: "git",
+            location: "https://github.com/example/some-git-plugin",
+          })
+        );
+        expect(result).toBeUndefined();
+      });
+    });
+    it("loadPlugin skips github plugin on tenant when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const result = await Plugin.loadPlugin(
+          new Plugin({
+            name: "some-github-plugin",
+            source: "github",
+            location: "example/some-github-plugin",
+          })
+        );
+        expect(result).toBeUndefined();
+      });
+    });
     it("can install unsafe plugins on tenant when permitted", async () => {
       await getState().setConfig("tenants_unsafe_plugins", true);
       await db.runWithTenant("test101", async () => {
@@ -346,3 +405,64 @@ describe("Stable versioning upgrade", () => {
     expect(newPlugin.version).toBe("0.1.0");
   });
 });
+
+describe("Tenant git plugin store filtering", () => {
+  const mockReq = { flash: () => {}, __: (s) => s };
+
+  if (!db.isSQLite) {
+    it("git plugin is excluded from installed list when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const gitPlugin = new Plugin({
+          name: "test-git-plugin",
+          source: "git",
+          location: "https://github.com/example/test-git-plugin",
+        });
+        await gitPlugin.upsert();
+
+        const items = await get_store_items(mockReq);
+        const names = items.map((i) => i.name);
+        expect(names).not.toContain("test-git-plugin");
+
+        await db.deleteWhere("_sc_plugins", { name: "test-git-plugin" });
+      });
+    });
+
+    it("github plugin is excluded from installed list when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const githubPlugin = new Plugin({
+          name: "test-github-plugin",
+          source: "github",
+          location: "example/test-github-plugin",
+        });
+        await githubPlugin.upsert();
+
+        const items = await get_store_items(mockReq);
+        const names = items.map((i) => i.name);
+        expect(names).not.toContain("test-github-plugin");
+
+        await db.deleteWhere("_sc_plugins", { name: "test-github-plugin" });
+      });
+    });
+
+    it("git plugin does not appear as installed in set=all when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const gitPlugin = new Plugin({
+          name: "test-git-plugin",
+          source: "git",
+          location: "https://github.com/example/test-git-plugin",
+        });
+        await gitPlugin.upsert();
+
+        const items = await get_store_items(mockReq);
+        const match = items.find((i) => i.name === "test-git-plugin");
+        expect(match).toBeUndefined();
+
+        await db.deleteWhere("_sc_plugins", { name: "test-git-plugin" });
+      });
+    });
+  } else {
+    it("does not support tenants on SQLite", async () => {
+      expect(db.isSQLite).toBe(true);
+    });
+  }
+});