bosia 0.1.5 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bosia",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
   "keywords": [

package/src/core/cookies.ts

@@ -1,10 +1,16 @@
 import type { Cookies, CookieOptions } from "./hooks.ts";
 
-// ─── Cookie Validation ───────────────────────────────────
+// ─── Cookie Validation (RFC 6265) ────────────────────────
 /** Rejects characters that could inject into Set-Cookie headers. */
 const UNSAFE_COOKIE_VALUE = /[;\r\n]/;
 const VALID_SAMESITE = new Set(["Strict", "Lax", "None"]);
 
+/**
+ * RFC 6265 §4.1.1: cookie-name is an HTTP token (RFC 2616 §2.2).
+ * Must be 1+ chars of ASCII 33-126, excluding separators: ( ) < > @ , ; : \ " / [ ] ? = { }
+ */
+const VALID_COOKIE_NAME = /^[!#$%&'*+\-.0-9A-Z^_`a-z|~]+$/;
+
 // ─── Cookie Helpers ──────────────────────────────────────
 
 function parseCookies(header: string): Record<string, string> {
@@ -39,7 +45,8 @@ export class CookieJar implements Cookies {
     }
 
     set(name: string, value: string, options?: CookieOptions): void {
-        let header = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+        if (!VALID_COOKIE_NAME.test(name)) throw new Error(`Invalid cookie name: ${name}`);
+        let header = `${name}=${encodeURIComponent(value)}`;
         const path = options?.path ?? "/";
         if (UNSAFE_COOKIE_VALUE.test(path)) throw new Error(`Invalid cookie path: ${path}`);
         header += `; Path=${path}`;

package/src/core/env.ts

@@ -21,24 +21,54 @@ const FRAMEWORK_VARS = new Set([
 
 // ─── .env File Parser ────────────────────────────────────
 
+/** Valid JS/TS identifier: starts with letter/underscore, then alphanumeric/underscore. */
+const VALID_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+/** Process escape sequences in double-quoted values. */
+function processEscapes(raw: string): string {
+    return raw.replace(/\\(.)/g, (_, ch) => {
+        switch (ch) {
+            case "n": return "\n";
+            case "r": return "\r";
+            case "t": return "\t";
+            case "\\": return "\\";
+            case '"': return '"';
+            default: return `\\${ch}`; // preserve unknown escapes
+        }
+    });
+}
+
 /** Parse a .env file content into key/value pairs. Skips comments and empty lines. */
-function parseEnvFile(content: string): Record<string, string> {
+function parseEnvFile(content: string, filename?: string): Record<string, string> {
     const result: Record<string, string> = {};
-    for (const line of content.split("\n")) {
-        const trimmed = line.trim();
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
         if (!trimmed || trimmed.startsWith("#")) continue;
         const eqIdx = trimmed.indexOf("=");
         if (eqIdx === -1) continue;
         const key = trimmed.slice(0, eqIdx).trim();
+        if (!key) continue;
+
+        // Validate key is a valid identifier (required for codegen)
+        if (!VALID_ENV_NAME.test(key)) {
+            const loc = filename ? ` in ${filename}` : "";
+            throw new Error(
+                `Invalid env variable name "${key}"${loc} (line ${i + 1}). ` +
+                `Names must start with a letter or underscore and contain only [A-Za-z0-9_].`
+            );
+        }
+
         let value = trimmed.slice(eqIdx + 1).trim();
-        // Strip surrounding quotes (single or double)
-        if (
-            (value.startsWith('"') && value.endsWith('"')) ||
-            (value.startsWith("'") && value.endsWith("'"))
-        ) {
+        // Double-quoted: process escape sequences
+        if (value.startsWith('"') && value.endsWith('"')) {
+            value = processEscapes(value.slice(1, -1));
+        }
+        // Single-quoted: literal (no escape processing)
+        else if (value.startsWith("'") && value.endsWith("'")) {
             value = value.slice(1, -1);
         }
-        if (key) result[key] = value;
+        result[key] = value;
     }
     return result;
 }
@@ -75,7 +105,7 @@ export function loadEnv(mode: string, dir?: string): Record<string, string> {
         const filepath = join(root, filename);
         if (!existsSync(filepath)) continue;
         const content = readFileSync(filepath, "utf-8");
-        const parsed = parseEnvFile(content);
+        const parsed = parseEnvFile(content, filename);
         merged = { ...merged, ...parsed };
         loaded.push(filename);
     }