gina 0.3.7-alpha.4 → 0.3.7-alpha.6

package/.github/scripts/scan-vendored-cves.js

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+/*
+ * This file is part of the gina package.
+ * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/**
+ * OSV-based CVE scan for vendored deps.
+ *
+ * Walks every `package.json` under `framework/v*\/core/deps/`, extracts
+ * `(name, version)` pairs, queries `api.osv.dev`, and exits non-zero if
+ * any vulnerability is matched.
+ *
+ * Pinning convention (see .claude/architecture/vendored-deps.md): the
+ * vendored `package.json` stays byte-identical to upstream until
+ * patched; on patch, `version` is bumped to `<upstream>-rhinostone.N`
+ * (e.g. `1.6.0-rhinostone.1`). This script strips the
+ * `-rhinostone.N` suffix before querying so OSV still matches the base
+ * upstream version.
+ *
+ * Exit codes:
+ *   0 — clean, no CVEs matched
+ *   1 — at least one vulnerability matched (build fails)
+ *   2 — scan error (malformed package.json, network failure)
+ *
+ * @module .github/scripts/scan-vendored-cves
+ */
+
+'use strict';
+
+var fs    = require('fs');
+var path  = require('path');
+var https = require('https');
+
+var ROOT = path.resolve(__dirname, '..', '..');
+
+/**
+ * Walk every `framework/v*\/core/deps/<dep>/package.json` and return the
+ * list of absolute paths.
+ *
+ * @returns {string[]}
+ */
+function walkDepsPackageJsons() {
+    var frameworkDir = path.join(ROOT, 'framework');
+    if (!fs.existsSync(frameworkDir)) return [];
+    var results = [];
+    var fws = fs.readdirSync(frameworkDir);
+    for (var i = 0; i < fws.length; i++) {
+        var depsDir = path.join(frameworkDir, fws[i], 'core', 'deps');
+        if (!fs.existsSync(depsDir)) continue;
+        if (!fs.statSync(depsDir).isDirectory()) continue;
+        var deps = fs.readdirSync(depsDir);
+        for (var j = 0; j < deps.length; j++) {
+            var pkgPath = path.join(depsDir, deps[j], 'package.json');
+            if (fs.existsSync(pkgPath)) results.push(pkgPath);
+        }
+    }
+    return results;
+}
+
+/**
+ * Strip the local-patch suffix (`-rhinostone.N`) so OSV sees the base
+ * upstream version. If the version has no such suffix, returned as-is.
+ *
+ * @param {string} v
+ * @returns {string}
+ */
+function normalizeVersion(v) {
+    return String(v).replace(/-rhinostone\.\d+$/, '');
+}
+
+/**
+ * POST a single `(name, version)` query to api.osv.dev/v1/query.
+ * Resolves with the parsed JSON response (which may carry `{vulns: [...]}`
+ * or be empty `{}` on a clean match).
+ *
+ * @param {string} name
+ * @param {string} version
+ * @returns {Promise<object>}
+ */
+function queryOSV(name, version) {
+    return new Promise(function (resolve, reject) {
+        var body = JSON.stringify({
+            package: { name: name, ecosystem: 'npm' },
+            version: version
+        });
+        var req = https.request({
+            method:   'POST',
+            hostname: 'api.osv.dev',
+            path:     '/v1/query',
+            headers: {
+                'Content-Type':   'application/json',
+                'Content-Length': Buffer.byteLength(body)
+            }
+        }, function (res) {
+            var data = '';
+            res.on('data', function (chunk) { data += chunk; });
+            res.on('end', function () {
+                if (res.statusCode !== 200) {
+                    return reject(new Error('OSV HTTP ' + res.statusCode + ': ' + data));
+                }
+                try {
+                    resolve(JSON.parse(data));
+                } catch (e) {
+                    reject(e);
+                }
+            });
+        });
+        req.on('error', reject);
+        req.write(body);
+        req.end();
+    });
+}
+
+/**
+ * Scan driver. Walks the target package.jsons, queries OSV for each,
+ * prints a one-line status per dep, exits with the appropriate code.
+ *
+ * @returns {Promise<number>} exit code
+ */
+async function main() {
+    var pkgs = walkDepsPackageJsons();
+    if (pkgs.length === 0) {
+        console.log('[osv] no vendored package.json files found under framework/v*/core/deps/');
+        return 0;
+    }
+
+    var failures = 0;
+    var scanned  = 0;
+    for (var i = 0; i < pkgs.length; i++) {
+        var pkgPath = pkgs[i];
+        var rel     = path.relative(ROOT, pkgPath);
+        var pkg;
+        try {
+            pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+        } catch (e) {
+            console.error('[osv] ' + rel + ': cannot parse (' + e.message + ')');
+            return 2;
+        }
+        if (!pkg.name || !pkg.version) {
+            console.log('[osv] SKIP ' + rel + ': missing name or version');
+            continue;
+        }
+
+        var baseVersion = normalizeVersion(pkg.version);
+        var suffix      = (pkg.version !== baseVersion) ? ' (patched: ' + pkg.version + ')' : '';
+        var result;
+        try {
+            result = await queryOSV(pkg.name, baseVersion);
+        } catch (e) {
+            console.error('[osv] ' + rel + ': query failed — ' + e.message);
+            return 2;
+        }
+
+        scanned++;
+        var vulns = result.vulns || [];
+        if (vulns.length > 0) {
+            failures++;
+            console.error('[osv] VULNERABLE ' + pkg.name + '@' + baseVersion + suffix + ' (' + rel + ')');
+            for (var v = 0; v < vulns.length; v++) {
+                var entry   = vulns[v];
+                var aliases = (entry.aliases || []).join(', ');
+                var summary = (entry.summary || entry.details || '').replace(/\s+/g, ' ').slice(0, 140);
+                console.error('       ' + entry.id + (aliases ? ' (' + aliases + ')' : '') + ' — ' + summary);
+            }
+        } else {
+            console.log('[osv] OK ' + pkg.name + '@' + baseVersion + suffix + ' (' + rel + ')');
+        }
+    }
+
+    console.log('');
+    if (failures > 0) {
+        console.error('[osv] ' + failures + ' vendored dep(s) with matching CVEs — failing the build.');
+        return 1;
+    }
+    console.log('[osv] clean — no CVEs matched across ' + scanned + ' vendored dep(s).');
+    return 0;
+}
+
+main().then(function (code) {
+    process.exit(code);
+}).catch(function (err) {
+    console.error('[osv] uncaught:', err);
+    process.exit(2);
+});

package/.github/workflows/vendored-cve.yml

@@ -0,0 +1,36 @@
+name: Vendored CVE Scan
+
+on:
+  push:
+    branches: [develop, master]
+  pull_request:
+    branches: [develop, master]
+  schedule:
+    # Weekly, Sunday 00:00 UTC — catches CVEs disclosed after the last push.
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+
+# Cancel any in-flight scan for the same ref when a newer one kicks off.
+concurrency:
+  group: vendored-cve-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: OSV scan on vendored deps
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Scan vendored package.jsons via api.osv.dev
+        run: node .github/scripts/scan-vendored-cves.js

package/CHANGELOG.md

@@ -6,6 +6,14 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.3.7-alpha.5 - 2026-04-23 (npm only — no git tag)
+### Changed
+* Extracted `DRIVER_MAP` + `AI_DRIVER_MAP` into a new `lib/connector-registry/` module — single source of truth for the connector driver → npm package + semver range mapping. Previously duplicated inline in `lib/cmd/connector/add.js` and `lib/cmd/connector/list.js` and kept in sync by hand; the two copies had already drifted (list.js knew about `mongodb` and `scylladb`, add.js did not). Both cmd handlers now read from `lib.connectorRegistry.getDriver(type)` / `.getAIDriver(scheme)` / `.getDriverTypes()` / `.getAISchemes()`, so adding a new connector upstream means editing one table instead of three (root `package.json` `peerDependencies` was the third, removed in the previous commit). Public CLI behaviour is unchanged — the registry exposes the same tables, the install hint and `--install` resolution use the same ranges. 28 new source-inspection + behavioural tests in `test/lib/connector-registry.test.js`; the inline-map tests in `test/lib/connector-add.test.js` and `test/lib/connector-list.test.js` now assert registry consumption instead.
+### Security
+* Replaced the two eval-based sites in `lib/collection/src/main.js` with a safe expression parser and a dot-path walker (#SCS1d). The `tryEval` function — called from four internal sites (lines 310, 314, 406, 411) when a filter contains `<`, `>`, or `=` — used to `eval(_content + filter)`. The line-411 variant had no quote-wrapping, so a filter value like `{'rating.score': '> 0; throw new Error()'}` reached eval unsanitised and executed. The body is now a regex-based evaluator over the closed grammar `<operand><op><operand>` where operand is a number literal, a `"string literal"`, or a `new Date("...")` expression, and op is one of `=== !== == != < > <= >=`. Anything else throws `Could not evaluate condition`. The sibling `eval('_content.' + f)` inside `searchThroughProp` used to eval a user-controlled property path (the filter-object key), which accepted arbitrary JS — a key like `constructor.constructor('return ...')()` would fire on lookup. It is now a dot-path walker that rejects any non-identifier character. The `skipEval: true` bypass path is untouched (it was already eval-free). No public API change; the 15 pre-existing Collection tests pass unmodified; 7 new tests lock the guarantee (source-inspection, date-compare coverage fill, injection rejection). The browser bundle picks the fix up on next `core/asset/plugin/build` rebuild because `core/asset/plugin/src/vendor/gina/build.json:21` aliases `lib/collection` to the same server-side source.
+* Removed optional connector drivers from the root `package.json` `peerDependencies` block (couchbase, mongodb, mysql2, pg, ioredis, `@scylladb/scylla-driver`, openai, `@anthropic-ai/sdk`). These were declared with `peerDependenciesMeta.optional = true` but supply-chain analyzers (Socket.dev, npm audit, Dependabot) were still aggregating them into gina's dependency graph — surfacing 7 extra packages as gina's supply-chain surface even though gina never loads any of them by default. The version ranges are still authoritative in the `DRIVER_MAP` / `AI_DRIVER_MAP` tables in `lib/cmd/connector/add.js` and `lib/cmd/connector/list.js`, which is where `connector:add --install` has been reading them all along. No runtime behaviour change — when a bundle requires an uninstalled driver, `require('<driver>')` throws the same `MODULE_NOT_FOUND` it always did. Users who want a given connector install the driver in their own project via `gina connector:add <name> @<project> --install` or by hand.
+* Stripped `dependencies`, `devDependencies`, and `scripts` from the vendored `core/deps/busboy-1.6.0/package.json` (and `devDependencies` + `scripts` from `core/deps/streamsearch-1.1.0/package.json`). busboy is vendored and finds streamsearch via a relative path (`require('../../../streamsearch-1.1.0')`), so the declared `"streamsearch": "^1.1.0"` dependency was cosmetic and never consumed at runtime — but supply-chain analyzers walk sub-`package.json` files inside the published tarball and were surfacing streamsearch as a top-level gina dep. The `devDependencies` and `scripts` blocks are dead in a vendored context (no `npm install` runs against them; no `npm test` either). No runtime impact — both modules still load via the same relative paths they did before.
+
 ## 0.3.7-alpha.4 - 2026-04-23 (npm only — no git tag)
 ### Added
 * Static HTML cache writes on the nunjucks render path (#NJ3) — bundles running `render.engine: "nunjucks"` now get the same `memory`/`fs` cache behaviour swig has shipped for years. A route declaring `"cache": { "type": "memory", "ttl": 300 }` (or the `"fs"` variant) is served from the shared server store on subsequent hits without re-entering the controller; the same `static:<bundle>:<url>` key-space + visibility/sliding-window/invalidateOnEvents controls apply. Cache writes run after asset + Inspector injection so the bytes on disk/in memory match what the client sees; the miss-path `Cache-Control: private, max-age=N` header is committed on the same response. Opt-in via your routing rule — there is no new setting to toggle.

package/ROADMAP.md

@@ -123,6 +123,16 @@ Four focused follow-up sessions to close the deferred gap left by the `0.3.7-alp
 | 📋 | **Static HTML cache parity** — Port the swig disk-write/serve cache path so `cache:` keys in `routing.json` actually produce cached HTML for nunjucks routes. | `0.3.7` | Q4 2026 |
 | 📋 | **Early Hints 103 auto-send for CSS/JS preloads** — Move the 103 path in `controller.js this.render()` to be engine-agnostic. Pure perf optimisation; manual `self.setEarlyHints(linkHeader)` already works. | `0.3.7` | Q4 2026 |
 
+### Eval safety
+
+Complete the removal of `eval` / `new Function` call sites from the published tarball. Four tranches shipped across `0.3.7-alpha.4` / `0.3.7-alpha.5` cleared 13 of 24 catalogued sites; 2 more were removed by deleting orphaned source during the toolbar cleanup (15 of 24 addressed). Three clusters remain, each needing a focused session.
+
+| Status | Feature | Version | Target |
+| --- | --- | --- | --- |
+| 📋 | **Validator structural refactor** — Refactor `makeObjectFromArgs` in the validator plugin to replace the string-accumulator path-build-then-`eval('root=value')` pattern with a segments-array threaded through recursion and a safe setter. Clears 3 eval sites. Test coverage for the validator plugin was bootstrapped in the prior tranche, so the refactor has a safety net. | `0.3.8` | Q1 2027 |
+| 📋 | **Feature-intrinsic eval design pass** — 6 sites eval user-supplied JS by design (user-defined form validators, HTML event callbacks on form data attributes). Decision pass: safe-eval sandbox via `vm.Script`, pre-parse to a restricted AST, or formalise "accept and document" with an explicit trust assumption. Outcome may include dropping unused placeholder features. | `0.3.8` | Q1 2027 |
+| 📋 | **Logger circular-require refactor** — 3 load-bearing `eval(fs.readFileSync(...))` fallbacks in the logger work around a circular `merge → helpers → logger` require chain. Restructure the chain so the fallback is no longer needed. Clears the final 3 sites of the campaign. Regression risk touches every logger-consuming test. | `0.3.8` | Q1 2027 |
+
 ---
 
 ## Connectors

package/framework/v0.3.7-alpha.6/VERSION

@@ -0,0 +1 @@
+0.3.7-alpha.6

package/framework/v0.3.7-alpha.6/core/asset/plugin/dist/vendor/gina/css/gina.min.css

@@ -0,0 +1 @@
+@font-face{font-family:"have_heart_oneregular";src:url(fonts/have_heart_one-webfont.woff2) format("woff2"),url(fonts/have_heart_one-webfont.woff) format("woff");font-weight:400;font-style:normal}.gina-popin-container{background:#fff}.gina-popins-overlay,div.gina-popin-container{visibility:hidden;opacity:0;z-index:1;transition:opacity .3s,visibility 0 .3s}.gina-popins-overlay.gina-popin-is-active,div.gina-popin-container.gina-popin-is-active{opacity:1;visibility:visible;transition-delay:0}dialog.gina-popin-container{padding:0;border:none;z-index:1}.gina-popins-overlay{position:fixed;left:0;top:0;display:grid;place-items:center;width:100%;height:100%;transition:opacity .3s,visibility .3s;overflow:auto;background:rgba(0,0,0,.75)}.gina-popins-overlay.gina-popin-is-active{backdrop-filter:blur(6px)}dialog::backdrop{background-color:rgba(0,0,0,.75);backdrop-filter:blur(6px)}

package/framework/{v0.3.7-alpha.4 → v0.3.7-alpha.6}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3000,7 +3000,41 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                                 .trim();
 
             try {
-                localValue = eval('data.'+ localValue).replace(/^\"|\"$/g, '');
+                // #SCS1e (2026-04-24) — replaced `eval('data.' + localValue)` with a safe
+                // dot+bracket path walker. `localValue` is derived from `{{...}}` placeholders
+                // in error messages; the transforms at lines 152-158 produce
+                // `ident (. ident | ["quoted"])*`. The old eval executed anything that parsed
+                // as JS; a crafted placeholder like `{{constructor.constructor('return
+                // process.exit()')()}}` would reach eval unsanitised (the `[` → `["` / `]` →
+                // `"]` transforms don't neutralise dotted method access). The walker rejects
+                // any segment that isn't a bare identifier or a double-quoted bracket key.
+                // localValue = eval('data.'+ localValue).replace(/^\"|\"$/g, '');
+                let _scsRest = localValue;
+                let _scsSegments = [];
+                let _scsM = _scsRest.match(/^([A-Za-z_$][\w$]*)/);
+                if (!_scsM) { throw new Error('Invalid property path: `' + localValue + '`'); }
+                _scsSegments.push(_scsM[1]);
+                _scsRest = _scsRest.slice(_scsM[0].length);
+                while (_scsRest.length > 0) {
+                    _scsM = _scsRest.match(/^\.([A-Za-z_$][\w$]*)/);
+                    if (_scsM) {
+                        _scsSegments.push(_scsM[1]);
+                        _scsRest = _scsRest.slice(_scsM[0].length);
+                        continue;
+                    }
+                    _scsM = _scsRest.match(/^\["([^"\]]*)"\]/);
+                    if (_scsM) {
+                        _scsSegments.push(_scsM[1]);
+                        _scsRest = _scsRest.slice(_scsM[0].length);
+                        continue;
+                    }
+                    throw new Error('Invalid property path: `' + localValue + '`');
+                }
+                let _scsCur = data;
+                for (let _scsI = 0; _scsCur != null && _scsI < _scsSegments.length; _scsI++) {
+                    _scsCur = _scsCur[_scsSegments[_scsI]];
+                }
+                localValue = _scsCur.replace(/^\"|\"$/g, '');
                 error = error.replace( new RegExp( varArr[v].replace(/\{|\[|\]|\}/g, '\\$&') , 'g'), localValue);
             } catch(e) {}
         }
@@ -3731,10 +3765,59 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                         try {
                             // security checks
                             compiledCondition = compiledCondition.replace(/(\(|\)|return)/g, '');
+                            // #SCS1e (2026-04-24) — replaced the two `eval(...)` calls below with
+                            // auditable equivalents. After `$var` substitution (lines 910-920) and
+                            // paren/return strip above, `compiledCondition` is either:
+                            //   (a) a regex literal `/<body>/<flags>` (when `/^\//` matches), or
+                            //   (b) a binary comparison `<operand><op><operand>` where operand ∈
+                            //       {number, "string", true, false, null, undefined} and op ∈
+                            //       {===, !==, ==, !=, <, >, <=, >=}.
+                            // Old eval executed arbitrary JS; any value reaching `$var` substitution
+                            // that contained a quote (e.g. user input `bar"; process.exit();//`)
+                            // could escape the `"..."` wrapper at line 916 and reach eval as
+                            // arbitrary code. Grammar-locked replacements reject any input that
+                            // doesn't fit the two documented shapes.
+                            // if ( /^\//.test(compiledCondition) ) {
+                            //     isValid = eval(compiledCondition + '.test("' + this.value + '")')
+                            // } else {
+                            //     isValid = eval(compiledCondition)
+                            // }
                             if ( /^\//.test(compiledCondition) ) {
-                                isValid = eval(compiledCondition + '.test("' + this.value + '")')
+                                var _scsRegexMatch = compiledCondition.match(/^\/(.+)\/([a-z]*)$/);
+                                if (!_scsRegexMatch) {
+                                    throw new Error('Invalid regex literal: `' + compiledCondition + '`');
+                                }
+                                isValid = new RegExp(_scsRegexMatch[1], _scsRegexMatch[2]).test(this.value);
                             } else {
-                                isValid = eval(compiledCondition)
+                                var _SCS_BINARY_RE = /^\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;
+                                var _scsBinMatch = (typeof(compiledCondition) == 'string') ? compiledCondition.match(_SCS_BINARY_RE) : null;
+                                if (!_scsBinMatch) {
+                                    throw new Error('Could not evaluate condition `' + compiledCondition + '`.\n(grammar: <operand><op><operand>; operand ∈ number | "string" | true | false | null | undefined; op ∈ === !== == != < > <= >=)');
+                                }
+                                var _scsParseOperand = function(s) {
+                                    var _t = s.replace(/^\s+|\s+$/g, '');
+                                    if (_t === 'null')      return null;
+                                    if (_t === 'undefined') return undefined;
+                                    if (_t === 'true')      return true;
+                                    if (_t === 'false')     return false;
+                                    if (/^"[^"]*"$/.test(_t)) return _t.slice(1, -1);
+                                    var _n = Number(_t);
+                                    if (!isNaN(_n) && _t !== '') return _n;
+                                    throw new Error('Invalid operand: `' + s + '`');
+                                };
+                                var _scsLeft  = _scsParseOperand(_scsBinMatch[1]);
+                                var _scsOp    = _scsBinMatch[2];
+                                var _scsRight = _scsParseOperand(_scsBinMatch[3]);
+                                switch (_scsOp) {
+                                    case '===': isValid = _scsLeft === _scsRight; break;
+                                    case '!==': isValid = _scsLeft !== _scsRight; break;
+                                    case '==':  isValid = _scsLeft ==  _scsRight; break;
+                                    case '!=':  isValid = _scsLeft !=  _scsRight; break;
+                                    case '<':   isValid = _scsLeft <   _scsRight; break;
+                                    case '>':   isValid = _scsLeft >   _scsRight; break;
+                                    case '<=':  isValid = _scsLeft <=  _scsRight; break;
+                                    case '>=':  isValid = _scsLeft >=  _scsRight; break;
+                                }
                             }
 
                         } catch (err) {
@@ -11931,8 +12014,27 @@ function ValidatorPlugin(rules, data, formId) {
                         if (customRule) {
                             customRule = customRule.replace(/\-|\//g, '.');
                             if ( typeof(rules) != 'undefined' ) {
-                                instance.$forms[id].rules[customRule] = instance.rules[customRule] = local.rules[customRule] = merge(JSON.clone( eval('gina.forms.rules.'+ customRule)), instance.rules[customRule]);
+                                // #SCS1e (2026-04-24) — replaced `eval('gina.forms.rules.' + customRule)`
+                                // with a safe dot-path walker. `customRule` is user-controlled (read
+                                // from the `data-gina-form-rule` HTML attribute); after the replace at
+                                // line 2601 it is a pure dot-path like `account.signin_scope`. The old
+                                // eval executed anything that parsed as JS — a crafted rule name such
+                                // as `constructor.constructor("return process.exit()")()` would fire on
+                                // lookup. The walker rejects any non-identifier character and returns
+                                // undefined on missing path (the `typeof(local.rules[customRule]) ==
+                                // 'undefined'` check at line 2606 then produces the usual user-facing
+                                // "no rule found" error).
+                                // instance.$forms[id].rules[customRule] = instance.rules[customRule] = local.rules[customRule] = merge(JSON.clone( eval('gina.forms.rules.'+ customRule)), instance.rules[customRule]);
                                 // instance.$forms[id].rules[customRule] = instance.rules[customRule] = local.rules[customRule] = merge(eval('gina.forms.rules.'+ customRule), instance.rules[customRule]);
+                                if (!/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/.test(customRule)) {
+                                    throw new Error('Invalid form rule path: `' + customRule + '`');
+                                }
+                                var _scsSegments = customRule.split('.');
+                                var _scsCur      = gina.forms.rules;
+                                for (var _scsI = 0; _scsCur != null && _scsI < _scsSegments.length; _scsI++) {
+                                    _scsCur = _scsCur[_scsSegments[_scsI]];
+                                }
+                                instance.$forms[id].rules[customRule] = instance.rules[customRule] = local.rules[customRule] = merge(JSON.clone(_scsCur), instance.rules[customRule]);
                             }
                             if ( typeof(local.rules[customRule]) == 'undefined' ) {
                                 throw new Error('['+id+'] no rule found with key: `'+customRule+'`. Please check if json is not malformed @ /forms/rules/' + customRule.replace(/\./g, '/') +'.json');
@@ -19292,9 +19394,57 @@ function Collection(content, options) {
     options = (typeof(options) == 'object') ? merge(options, defaultOptions) : defaultOptions;
 
     var keywords    = ['not null']; // TODO - null, exists (`true` if property is defined)
+    // #SCS1d (2026-04-23) — replaced `eval(condition)` with a safe binary-compare evaluator.
+    // The conditions tryEval() receives are all constructed internally as `<left><op><right>`
+    // where left/right ∈ {number literal, "string literal", new Date("...")} and op ∈
+    // {===, !==, ==, !=, <, >, <=, >=}. User-controlled filter strings flowed into eval via
+    // `_content + filter` concat (line 293) and the datetime-wrapped variant (line 310) —
+    // any filter containing `<`|`>`|`=` reached eval unsanitised (RCE vector). Preserves
+    // error behaviour: throws on any unparseable input (callers at 310/314/406/411 do not
+    // catch — it bubbles).
+    // var tryEval     = function(condition) {
+    //     try {
+    //         return eval(condition);
+    //     } catch(err) {
+    //         throw new Error('Could not evaluate condition `'+ condition +'`.\n' + err.stack );
+    //     }
+    // }
+    var CONDITION_RE = /^\s*(new\s+Date\("[^"]*"\)|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(new\s+Date\("[^"]*"\)|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;
+    var parseOperand = function(s) {
+        var m = s.match(/^\s*new\s+Date\("([^"]*)"\)\s*$/);
+        if (m) return new Date(m[1]);
+        var t = s.replace(/^\s+|\s+$/g, '');
+        if (/^"[^"]*"$/.test(t)) return t.slice(1, -1);
+        var n = Number(t);
+        if (!isNaN(n) && t !== '') return n;
+        throw new Error('Invalid operand: `'+ s +'`');
+    };
     var tryEval     = function(condition) {
+        var m = (typeof(condition) == 'string') ? condition.match(CONDITION_RE) : null;
+        if (!m) {
+            throw new Error('Could not evaluate condition `'+ condition +'`.\n(grammar: <operand><op><operand>; operand ∈ number | "string" | new Date("..."); op ∈ === !== == != < > <= >=)');
+        }
         try {
-            return eval(condition);
+            var left  = parseOperand(m[1]);
+            var op    = m[2];
+            var right = parseOperand(m[3]);
+            // Match eval's Date semantics: only arithmetic ops coerce Date to valueOf()
+            // (timestamp); `==`/`!=`/`===`/`!==` between two Date objects are reference
+            // compares and always false (two fresh `new Date(x)` are different objects).
+            if ( op === '<' || op === '>' || op === '<=' || op === '>=' ) {
+                if (left  instanceof Date) left  = left.getTime();
+                if (right instanceof Date) right = right.getTime();
+            }
+            switch (op) {
+                case '===': return left === right;
+                case '!==': return left !== right;
+                case '==':  return left == right;
+                case '!=':  return left != right;
+                case '<':   return left <  right;
+                case '>':   return left >  right;
+                case '<=':  return left <= right;
+                case '>=':  return left >= right;
+            }
         } catch(err) {
             throw new Error('Could not evaluate condition `'+ condition +'`.\n' + err.stack );
         }
@@ -19585,9 +19735,32 @@ function Collection(content, options) {
 
                 var value = null;
 
+                // #SCS1d (2026-04-23) — replaced `eval('_content.' + f)` with a safe dot-path
+                // walker. `f` arrives here as a dot-separated path like `"ratings.Cleanliness"`
+                // (the `[*]` bracket-star variant is already stripped by searchWithin before
+                // this function is called — see split at line 438). User-controlled filter
+                // keys flowed through this without sanitisation; the old eval executed
+                // anything that parsed as JS, e.g. a key like
+                // `"constructor.constructor('return process.exit()')()"` would fire on lookup.
+                // try {
+                //     if ( _content )
+                //         value = eval('_content.'+f);
+                // } catch (err) {
+                //     // Nothing to do
+                //     // means that the field is not available in the collection
+                // }
                 try {
-                    if ( _content )
-                        value = eval('_content.'+f);
+                    if ( _content ) {
+                        if (!/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/.test(f)) {
+                            throw new Error('Invalid property path: `'+ f +'`');
+                        }
+                        var _segments = f.split('.');
+                        var _cur = _content;
+                        for (var _si = 0; _cur != null && _si < _segments.length; _si++) {
+                            _cur = _cur[_segments[_si]];
+                        }
+                        value = _cur;
+                    }
                 } catch (err) {
                     // Nothing to do
                     // means that the field is not available in the collection