gina 0.3.7-alpha.3 → 0.3.7-alpha.5

package/CHANGELOG.md

@@ -6,6 +6,22 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.3.7-alpha.5 - 2026-04-23 (npm only — no git tag)
+### Changed
+* Extracted `DRIVER_MAP` + `AI_DRIVER_MAP` into a new `lib/connector-registry/` module — single source of truth for the connector driver → npm package + semver range mapping. Previously duplicated inline in `lib/cmd/connector/add.js` and `lib/cmd/connector/list.js` and kept in sync by hand; the two copies had already drifted (list.js knew about `mongodb` and `scylladb`, add.js did not). Both cmd handlers now read from `lib.connectorRegistry.getDriver(type)` / `.getAIDriver(scheme)` / `.getDriverTypes()` / `.getAISchemes()`, so adding a new connector upstream means editing one table instead of three (root `package.json` `peerDependencies` was the third, removed in the previous commit). Public CLI behaviour is unchanged — the registry exposes the same tables, the install hint and `--install` resolution use the same ranges. 28 new source-inspection + behavioural tests in `test/lib/connector-registry.test.js`; the inline-map tests in `test/lib/connector-add.test.js` and `test/lib/connector-list.test.js` now assert registry consumption instead.
+### Security
+* Replaced the two eval-based sites in `lib/collection/src/main.js` with a safe expression parser and a dot-path walker (#SCS1d). The `tryEval` function — called from four internal sites (lines 310, 314, 406, 411) when a filter contains `<`, `>`, or `=` — used to `eval(_content + filter)`. The line-411 variant had no quote-wrapping, so a filter value like `{'rating.score': '> 0; throw new Error()'}` reached eval unsanitised and executed. The body is now a regex-based evaluator over the closed grammar `<operand><op><operand>` where operand is a number literal, a `"string literal"`, or a `new Date("...")` expression, and op is one of `=== !== == != < > <= >=`. Anything else throws `Could not evaluate condition`. The sibling `eval('_content.' + f)` inside `searchThroughProp` used to eval a user-controlled property path (the filter-object key), which accepted arbitrary JS — a key like `constructor.constructor('return ...')()` would fire on lookup. It is now a dot-path walker that rejects any non-identifier character. The `skipEval: true` bypass path is untouched (it was already eval-free). No public API change; the 15 pre-existing Collection tests pass unmodified; 7 new tests lock the guarantee (source-inspection, date-compare coverage fill, injection rejection). The browser bundle picks the fix up on next `core/asset/plugin/build` rebuild because `core/asset/plugin/src/vendor/gina/build.json:21` aliases `lib/collection` to the same server-side source.
+* Removed optional connector drivers from the root `package.json` `peerDependencies` block (couchbase, mongodb, mysql2, pg, ioredis, `@scylladb/scylla-driver`, openai, `@anthropic-ai/sdk`). These were declared with `peerDependenciesMeta.optional = true` but supply-chain analyzers (Socket.dev, npm audit, Dependabot) were still aggregating them into gina's dependency graph — surfacing 7 extra packages as gina's supply-chain surface even though gina never loads any of them by default. The version ranges are still authoritative in the `DRIVER_MAP` / `AI_DRIVER_MAP` tables in `lib/cmd/connector/add.js` and `lib/cmd/connector/list.js`, which is where `connector:add --install` has been reading them all along. No runtime behaviour change — when a bundle requires an uninstalled driver, `require('<driver>')` throws the same `MODULE_NOT_FOUND` it always did. Users who want a given connector install the driver in their own project via `gina connector:add <name> @<project> --install` or by hand.
+* Stripped `dependencies`, `devDependencies`, and `scripts` from the vendored `core/deps/busboy-1.6.0/package.json` (and `devDependencies` + `scripts` from `core/deps/streamsearch-1.1.0/package.json`). busboy is vendored and finds streamsearch via a relative path (`require('../../../streamsearch-1.1.0')`), so the declared `"streamsearch": "^1.1.0"` dependency was cosmetic and never consumed at runtime — but supply-chain analyzers walk sub-`package.json` files inside the published tarball and were surfacing streamsearch as a top-level gina dep. The `devDependencies` and `scripts` blocks are dead in a vendored context (no `npm install` runs against them; no `npm test` either). No runtime impact — both modules still load via the same relative paths they did before.
+
+## 0.3.7-alpha.4 - 2026-04-23 (npm only — no git tag)
+### Added
+* Static HTML cache writes on the nunjucks render path (#NJ3) — bundles running `render.engine: "nunjucks"` now get the same `memory`/`fs` cache behaviour swig has shipped for years. A route declaring `"cache": { "type": "memory", "ttl": 300 }` (or the `"fs"` variant) is served from the shared server store on subsequent hits without re-entering the controller; the same `static:<bundle>:<url>` key-space + visibility/sliding-window/invalidateOnEvents controls apply. Cache writes run after asset + Inspector injection so the bytes on disk/in memory match what the client sees; the miss-path `Cache-Control: private, max-age=N` header is committed on the same response. Opt-in via your routing rule — there is no new setting to toggle.
+* 103 Early Hints auto-send now works for bundles running `render.engine: "nunjucks"` (#NJ4). HTTP/2 non-dev requests to nunjucks bundles get automatic `Link: ...; rel=preload` hints for the bundle's CSS and JS assets, delivered as a 103 Early Hints informational response before the HTML body. Identical behaviour to swig — the firing point in `controller.js this.render()` is engine-agnostic and the data-feed was closed by #NJ2 (`deps.setResources` runs on both delegates, populating `h2Links` via the same `getNodeRes` path). Closes the final item in the four-session nunjucks parity track (#NJ1 filters / #NJ2 setResources & assets / #NJ3 static HTML cache / #NJ4 Early Hints) — nunjucks bundles now have full feature parity with swig.
+### Security
+* Removed three server-side `eval` / `new Function` call sites (#SCS1). `core/server.js` built a static-path regex via `eval('/^…/')` and now uses `new RegExp`. `lib/logger/src/main.js` generated per-level logger methods via `new Function(...)` string concatenation and now uses a closure factory. `lib/math/index.js` `operate()` wrapped `new Function('return '+ expr)()` and is now a shunting-yard evaluator supporting `+ - * / %`, parentheses, decimals, and unary sign; any non-arithmetic character throws. Public contract unchanged — the expressions `math.operate` accepts are the same as before, but it now rejects arbitrary JS beyond pure arithmetic instead of silently executing it.
+* Replaced the four `eval('async function on<Name>...')` async-chain scaffolding sites (#SCS1b) with direct `promisify` + `try`/`await`/`catch` IIFEs. Affected files: `lib/cmd/framework/build.js`, `lib/cmd/framework/init.js`, `script/pre_install.js`, `script/post_install.js`. Semantics unchanged — each step is still promisified, awaited, and error-exits via `console.error` + `process.exit(1)` before recursing to the next step. Old eval lines kept as comments with the `#SCS1b` tag per the replace-don't-delete convention.
+
 ## 0.3.7-alpha.3 - 2026-04-23 (npm only — no git tag)
 ### Added
 * The nunjucks render path now registers Gina's built-in filter registry automatically. Bundles with `render.engine: "nunjucks"` get the same 7 filters as the swig path — `getUrl`, `getWebroot`, `length`, `nl2br`, `addHours`, `addDays`, `addYears` — with no manual `env.addFilter()` calls needed. Templates can use `{{ 'home' | getUrl }}`, `{{ body | nl2br | safe }}`, or date helpers out of the box. User-registered filters on top (`env.addFilter('upper', fn)`) coexist with the built-in registry. Closes the most user-visible gap left by the 0.3.7-alpha.2 nunjucks MVP.

package/framework/v0.3.7-alpha.5/VERSION

@@ -0,0 +1 @@
+0.3.7-alpha.5

package/framework/{v0.3.7-alpha.3 → v0.3.7-alpha.5}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -19292,9 +19292,57 @@ function Collection(content, options) {
     options = (typeof(options) == 'object') ? merge(options, defaultOptions) : defaultOptions;
 
     var keywords    = ['not null']; // TODO - null, exists (`true` if property is defined)
+    // #SCS1d (2026-04-23) — replaced `eval(condition)` with a safe binary-compare evaluator.
+    // The conditions tryEval() receives are all constructed internally as `<left><op><right>`
+    // where left/right ∈ {number literal, "string literal", new Date("...")} and op ∈
+    // {===, !==, ==, !=, <, >, <=, >=}. User-controlled filter strings flowed into eval via
+    // `_content + filter` concat (line 293) and the datetime-wrapped variant (line 310) —
+    // any filter containing `<`|`>`|`=` reached eval unsanitised (RCE vector). Preserves
+    // error behaviour: throws on any unparseable input (callers at 310/314/406/411 do not
+    // catch — it bubbles).
+    // var tryEval     = function(condition) {
+    //     try {
+    //         return eval(condition);
+    //     } catch(err) {
+    //         throw new Error('Could not evaluate condition `'+ condition +'`.\n' + err.stack );
+    //     }
+    // }
+    var CONDITION_RE = /^\s*(new\s+Date\("[^"]*"\)|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(new\s+Date\("[^"]*"\)|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;
+    var parseOperand = function(s) {
+        var m = s.match(/^\s*new\s+Date\("([^"]*)"\)\s*$/);
+        if (m) return new Date(m[1]);
+        var t = s.replace(/^\s+|\s+$/g, '');
+        if (/^"[^"]*"$/.test(t)) return t.slice(1, -1);
+        var n = Number(t);
+        if (!isNaN(n) && t !== '') return n;
+        throw new Error('Invalid operand: `'+ s +'`');
+    };
     var tryEval     = function(condition) {
+        var m = (typeof(condition) == 'string') ? condition.match(CONDITION_RE) : null;
+        if (!m) {
+            throw new Error('Could not evaluate condition `'+ condition +'`.\n(grammar: <operand><op><operand>; operand ∈ number | "string" | new Date("..."); op ∈ === !== == != < > <= >=)');
+        }
         try {
-            return eval(condition);
+            var left  = parseOperand(m[1]);
+            var op    = m[2];
+            var right = parseOperand(m[3]);
+            // Match eval's Date semantics: only arithmetic ops coerce Date to valueOf()
+            // (timestamp); `==`/`!=`/`===`/`!==` between two Date objects are reference
+            // compares and always false (two fresh `new Date(x)` are different objects).
+            if ( op === '<' || op === '>' || op === '<=' || op === '>=' ) {
+                if (left  instanceof Date) left  = left.getTime();
+                if (right instanceof Date) right = right.getTime();
+            }
+            switch (op) {
+                case '===': return left === right;
+                case '!==': return left !== right;
+                case '==':  return left == right;
+                case '!=':  return left != right;
+                case '<':   return left <  right;
+                case '>':   return left >  right;
+                case '<=':  return left <= right;
+                case '>=':  return left >= right;
+            }
         } catch(err) {
             throw new Error('Could not evaluate condition `'+ condition +'`.\n' + err.stack );
         }
@@ -19585,9 +19633,32 @@ function Collection(content, options) {
 
                 var value = null;
 
+                // #SCS1d (2026-04-23) — replaced `eval('_content.' + f)` with a safe dot-path
+                // walker. `f` arrives here as a dot-separated path like `"ratings.Cleanliness"`
+                // (the `[*]` bracket-star variant is already stripped by searchWithin before
+                // this function is called — see split at line 438). User-controlled filter
+                // keys flowed through this without sanitisation; the old eval executed
+                // anything that parsed as JS, e.g. a key like
+                // `"constructor.constructor('return process.exit()')()"` would fire on lookup.
+                // try {
+                //     if ( _content )
+                //         value = eval('_content.'+f);
+                // } catch (err) {
+                //     // Nothing to do
+                //     // means that the field is not available in the collection
+                // }
                 try {
-                    if ( _content )
-                        value = eval('_content.'+f);
+                    if ( _content ) {
+                        if (!/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/.test(f)) {
+                            throw new Error('Invalid property path: `'+ f +'`');
+                        }
+                        var _segments = f.split('.');
+                        var _cur = _content;
+                        for (var _si = 0; _cur != null && _si < _segments.length; _si++) {
+                            _cur = _cur[_segments[_si]];
+                        }
+                        value = _cur;
+                    }
                 } catch (err) {
                     // Nothing to do
                     // means that the field is not available in the collection