@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.210

package/src/server/form-data.ts

@@ -29,14 +29,21 @@ export function parseFormData(formData: FormData): Record<string, unknown> {
     // Skip React internal fields
     if (key.startsWith('$ACTION_')) continue;
 
+    // Skip prototype-pollution keys at the top level — assigning to
+    // `flat['__proto__']` invokes the prototype setter and can splice
+    // attacker-controlled data into `flat`'s prototype chain.
+    // The dot-path case is filtered separately in `expandDotPaths`.
+    if (DANGEROUS_KEYS.has(key)) continue;
+
     const values = formData.getAll(key);
     const processed = values.map(normalizeValue);
 
     if (processed.length === 1) {
       flat[key] = processed[0];
     } else {
-      // Filter out undefined entries from multi-value fields
-      flat[key] = processed.filter((v) => v !== undefined);
+      // Filter out undefined (empty Files) and empty strings from multi-value fields.
+      // Multi-value fields (e.g. tags=js&tags=&tags=ts) should not include blanks.
+      flat[key] = processed.filter((v) => v !== undefined && v !== '');
     }
   }
 
@@ -46,15 +53,13 @@ export function parseFormData(formData: FormData): Record<string, unknown> {
 
 /**
  * Normalize a single FormData entry value.
- * - Empty strings → undefined (enables .optional() semantics)
  * - Empty File objects (no selection) → undefined
+ * - Strings pass through as-is (empty strings stay as empty strings so
+ *   schema validators like `z.string().min(1, 'Required')` can produce
+ *   their custom error messages instead of a generic type mismatch)
  * - Everything else passes through as-is
  */
 function normalizeValue(value: FormDataEntryValue): unknown {
-  if (typeof value === 'string') {
-    return value === '' ? undefined : value;
-  }
-
   // File input with no selection: browsers submit a File with name="" and size=0
   if (value instanceof File && value.size === 0 && value.name === '') {
     return undefined;
@@ -82,18 +87,23 @@ function expandDotPaths(flat: Record<string, unknown>): Record<string, unknown>
     }
   }
 
-  // Fast path: no dot-notation keys, return as-is
+  // Fast path: no dot-notation keys, return as-is.
+  // Top-level dangerous keys are already filtered in `parseFormData` above.
   if (!hasDotPaths) return flat;
 
   for (const [key, value] of Object.entries(flat)) {
-    if (!key.includes('.')) {
-      result[key] = value;
+    // Reject any path that contains __proto__ / constructor / prototype.
+    // Without this, `__proto__.x=1` writes to Object.prototype because
+    // `result['__proto__']` resolves to the prototype object itself.
+    const parts = key.split('.');
+    if (parts.some((p) => DANGEROUS_KEYS.has(p))) continue;
+
+    if (parts.length === 1) {
+      result[parts[0]] = value;
       continue;
     }
 
-    const parts = key.split('.');
     let current: Record<string, unknown> = result;
-
     for (let i = 0; i < parts.length - 1; i++) {
       const part = parts[i];
       if (current[part] === undefined || current[part] === null) {
@@ -113,6 +123,15 @@ function expandDotPaths(flat: Record<string, unknown>): Record<string, unknown>
   return result;
 }
 
+// `__proto__` is the only key in this parser that escapes the dot-path
+// walk's `typeof !== 'object'` reset: accessing `obj['__proto__']` returns
+// `Object.prototype` (itself an object), so the walk steps into the global
+// prototype and the leaf write mutates it. `constructor` resolves to a
+// function (reset fires) and `prototype` is undefined on fresh objects
+// (reset fires), so neither escapes the walk — they parse as legit nested
+// keys and do not mutate anything global.
+const DANGEROUS_KEYS = new Set(['__proto__']);
+
 // ─── Coercion Helpers ────────────────────────────────────────────────────
 
 /**
@@ -129,6 +148,23 @@ function expandDotPaths(flat: Record<string, unknown>): Record<string, unknown>
  * ```
  */
 export const coerce = {
+  /**
+   * Coerce an empty string to undefined for optional text fields.
+   * Use with `.optional()` schemas where an empty input means "not provided".
+   *
+   * ```ts
+   * // Zod
+   * z.unknown().transform(coerce.text).pipe(z.string().optional())
+   * // Valibot
+   * v.pipe(v.unknown(), v.transform(coerce.text), v.optional(v.string()))
+   * ```
+   */
+  text(value: unknown): string | undefined {
+    if (value === undefined || value === null || value === '') return undefined;
+    if (typeof value === 'string') return value;
+    return undefined;
+  },
+
   /**
    * Coerce a string to a number.
    * - `"42"` → `42`
@@ -173,4 +209,80 @@ export const coerce = {
       return undefined;
     }
   },
+
+  /**
+   * Coerce a date string to a Date object.
+   * Handles `<input type="date">` (`"2024-01-15"`), `<input type="datetime-local">`
+   * (`"2024-01-15T10:30"`), and full ISO 8601 strings.
+   * - Valid date string → `Date`
+   * - `""` / `undefined` / `null` → `undefined`
+   * - Invalid date strings → `undefined` (schema validation will catch this)
+   * - Impossible dates that `new Date()` silently normalizes (e.g. Feb 31) → `undefined`
+   */
+  date(value: unknown): Date | undefined {
+    if (value === undefined || value === null || value === '') return undefined;
+    if (value instanceof Date) return value;
+    if (typeof value !== 'string') return undefined;
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime())) return undefined;
+
+    // Overflow detection: extract Y/M/D from the input string and verify
+    // they match the parsed Date components. new Date('2024-02-31') silently
+    // normalizes to March 2nd — we reject such inputs.
+    const ymdMatch = value.match(/^(\d{4})-(\d{2})-(\d{2})/);
+    if (ymdMatch) {
+      const inputYear = Number(ymdMatch[1]);
+      const inputMonth = Number(ymdMatch[2]);
+      const inputDay = Number(ymdMatch[3]);
+
+      // Use UTC methods for date-only and Z-suffixed strings to avoid
+      // timezone offset shifting the day. For datetime-local (no Z suffix),
+      // the Date constructor parses in local time, so use local methods.
+      const isUTC = value.length === 10 || value.endsWith('Z');
+      const parsedYear = isUTC ? date.getUTCFullYear() : date.getFullYear();
+      const parsedMonth = isUTC ? date.getUTCMonth() + 1 : date.getMonth() + 1;
+      const parsedDay = isUTC ? date.getUTCDate() : date.getDate();
+
+      if (inputYear !== parsedYear || inputMonth !== parsedMonth || inputDay !== parsedDay) {
+        return undefined;
+      }
+    }
+
+    return date;
+  },
+
+  /**
+   * Create a File coercion function with optional size and mime type validation.
+   * Returns the File if valid, `undefined` otherwise.
+   *
+   * ```ts
+   * // Basic — just checks it's a real File
+   * z.preprocess(coerce.file(), z.instanceof(File))
+   *
+   * // With constraints
+   * z.preprocess(
+   *   coerce.file({ maxSize: 5 * 1024 * 1024, accept: ['image/png', 'image/jpeg'] }),
+   *   z.instanceof(File)
+   * )
+   * ```
+   */
+  file(options?: { maxSize?: number; accept?: string[] }): (value: unknown) => File | undefined {
+    return (value: unknown): File | undefined => {
+      if (value === undefined || value === null || value === '') return undefined;
+      if (!(value instanceof File)) return undefined;
+
+      // Empty file input (no selection): browsers submit File with name="" and size=0
+      if (value.size === 0 && value.name === '') return undefined;
+
+      if (options?.maxSize !== undefined && value.size > options.maxSize) {
+        return undefined;
+      }
+
+      if (options?.accept !== undefined && !options.accept.includes(value.type)) {
+        return undefined;
+      }
+
+      return value;
+    };
+  },
 };

package/src/server/form-flash.ts

@@ -11,11 +11,11 @@
  *
  * The flash data is server-side only — never serialized to cookies or headers.
  *
- * See design/08-forms-and-actions.md §"No-JS Error Round-Trip"
+ * See design/08-forms-and-actions.md §"No-JS Result Round-Trip"
  */
 
-import type { ValidationErrors } from './action-client.js';
-import { formFlashAls } from './als-registry.js';
+import type { ValidationErrors } from './action-client.ts';
+import { formFlashAls } from './als-registry.ts';
 
 // ─── Types ───────────────────────────────────────────────────────────────
 

package/src/server/head-response.ts

@@ -0,0 +1,54 @@
+/**
+ * HEAD body stripping — RFC 9110 §9.3.2.
+ *
+ * "The HEAD method is identical to GET except that the server MUST NOT send
+ * content in the response." The headers, however, must be the ones the
+ * corresponding GET would have produced — which is why timber renders the
+ * route in full and discards the body here rather than short-circuiting the
+ * render. Content-Type, Content-Length, Set-Cookie, cache directives and
+ * everything else ride through untouched.
+ *
+ * Node's `ServerResponse` happens to discard writes for HEAD, so the wire is
+ * usually correct even without this. That is a property of one adapter, not of
+ * the `Response` object: static generation, the Cloudflare and Nitro adapters,
+ * tests, and anything calling the pipeline handler as a function all observe
+ * the `Response` directly and saw the full body before TIM-1324.
+ *
+ * The pipeline applies this at its single exit so every response shape is
+ * covered — page render, API route, metadata route, deny page, error page,
+ * proxy short-circuit. The unit-level producer that is also reachable as a
+ * standalone function (`handleRouteRequest`) calls it too, so it honours HEAD
+ * on its own; it shares this implementation rather than repeating it, and
+ * applying it twice is a no-op.
+ */
+
+/**
+ * Return a bodyless copy of `response` when `method` is HEAD.
+ *
+ * A no-op for every other method and for responses that already carry no body
+ * (204, 304, redirects), so callers do not need to pre-check either.
+ *
+ * The discarded stream is cancelled: an SSR render that reached this point has
+ * a live producer attached, and dropping the reference without cancelling
+ * leaks it for the lifetime of the render (design/13-security.md A4).
+ */
+export function stripHeadBody(response: Response, method: string): Response {
+  if (method.toUpperCase() !== 'HEAD') return response;
+  const body = response.body;
+  if (body === null) return response;
+
+  // `cancel()` rejects if the stream is already errored and throws
+  // synchronously if it is locked — neither is actionable here, the body is
+  // being discarded either way.
+  try {
+    body.cancel().catch(() => {});
+  } catch {
+    /* stream already locked or disturbed */
+  }
+
+  return new Response(null, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}