gina 0.3.7-alpha.5 → 0.3.7-alpha.6

package/.github/scripts/scan-vendored-cves.js

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+/*
+ * This file is part of the gina package.
+ * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/**
+ * OSV-based CVE scan for vendored deps.
+ *
+ * Walks every `package.json` under `framework/v*\/core/deps/`, extracts
+ * `(name, version)` pairs, queries `api.osv.dev`, and exits non-zero if
+ * any vulnerability is matched.
+ *
+ * Pinning convention (see .claude/architecture/vendored-deps.md): the
+ * vendored `package.json` stays byte-identical to upstream until
+ * patched; on patch, `version` is bumped to `<upstream>-rhinostone.N`
+ * (e.g. `1.6.0-rhinostone.1`). This script strips the
+ * `-rhinostone.N` suffix before querying so OSV still matches the base
+ * upstream version.
+ *
+ * Exit codes:
+ *   0 — clean, no CVEs matched
+ *   1 — at least one vulnerability matched (build fails)
+ *   2 — scan error (malformed package.json, network failure)
+ *
+ * @module .github/scripts/scan-vendored-cves
+ */
+
+'use strict';
+
+var fs    = require('fs');
+var path  = require('path');
+var https = require('https');
+
+var ROOT = path.resolve(__dirname, '..', '..');
+
+/**
+ * Walk every `framework/v*\/core/deps/<dep>/package.json` and return the
+ * list of absolute paths.
+ *
+ * @returns {string[]}
+ */
+function walkDepsPackageJsons() {
+    var frameworkDir = path.join(ROOT, 'framework');
+    if (!fs.existsSync(frameworkDir)) return [];
+    var results = [];
+    var fws = fs.readdirSync(frameworkDir);
+    for (var i = 0; i < fws.length; i++) {
+        var depsDir = path.join(frameworkDir, fws[i], 'core', 'deps');
+        if (!fs.existsSync(depsDir)) continue;
+        if (!fs.statSync(depsDir).isDirectory()) continue;
+        var deps = fs.readdirSync(depsDir);
+        for (var j = 0; j < deps.length; j++) {
+            var pkgPath = path.join(depsDir, deps[j], 'package.json');
+            if (fs.existsSync(pkgPath)) results.push(pkgPath);
+        }
+    }
+    return results;
+}
+
+/**
+ * Strip the local-patch suffix (`-rhinostone.N`) so OSV sees the base
+ * upstream version. If the version has no such suffix, returned as-is.
+ *
+ * @param {string} v
+ * @returns {string}
+ */
+function normalizeVersion(v) {
+    return String(v).replace(/-rhinostone\.\d+$/, '');
+}
+
+/**
+ * POST a single `(name, version)` query to api.osv.dev/v1/query.
+ * Resolves with the parsed JSON response (which may carry `{vulns: [...]}`
+ * or be empty `{}` on a clean match).
+ *
+ * @param {string} name
+ * @param {string} version
+ * @returns {Promise<object>}
+ */
+function queryOSV(name, version) {
+    return new Promise(function (resolve, reject) {
+        var body = JSON.stringify({
+            package: { name: name, ecosystem: 'npm' },
+            version: version
+        });
+        var req = https.request({
+            method:   'POST',
+            hostname: 'api.osv.dev',
+            path:     '/v1/query',
+            headers: {
+                'Content-Type':   'application/json',
+                'Content-Length': Buffer.byteLength(body)
+            }
+        }, function (res) {
+            var data = '';
+            res.on('data', function (chunk) { data += chunk; });
+            res.on('end', function () {
+                if (res.statusCode !== 200) {
+                    return reject(new Error('OSV HTTP ' + res.statusCode + ': ' + data));
+                }
+                try {
+                    resolve(JSON.parse(data));
+                } catch (e) {
+                    reject(e);
+                }
+            });
+        });
+        req.on('error', reject);
+        req.write(body);
+        req.end();
+    });
+}
+
+/**
+ * Scan driver. Walks the target package.jsons, queries OSV for each,
+ * prints a one-line status per dep, exits with the appropriate code.
+ *
+ * @returns {Promise<number>} exit code
+ */
+async function main() {
+    var pkgs = walkDepsPackageJsons();
+    if (pkgs.length === 0) {
+        console.log('[osv] no vendored package.json files found under framework/v*/core/deps/');
+        return 0;
+    }
+
+    var failures = 0;
+    var scanned  = 0;
+    for (var i = 0; i < pkgs.length; i++) {
+        var pkgPath = pkgs[i];
+        var rel     = path.relative(ROOT, pkgPath);
+        var pkg;
+        try {
+            pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+        } catch (e) {
+            console.error('[osv] ' + rel + ': cannot parse (' + e.message + ')');
+            return 2;
+        }
+        if (!pkg.name || !pkg.version) {
+            console.log('[osv] SKIP ' + rel + ': missing name or version');
+            continue;
+        }
+
+        var baseVersion = normalizeVersion(pkg.version);
+        var suffix      = (pkg.version !== baseVersion) ? ' (patched: ' + pkg.version + ')' : '';
+        var result;
+        try {
+            result = await queryOSV(pkg.name, baseVersion);
+        } catch (e) {
+            console.error('[osv] ' + rel + ': query failed — ' + e.message);
+            return 2;
+        }
+
+        scanned++;
+        var vulns = result.vulns || [];
+        if (vulns.length > 0) {
+            failures++;
+            console.error('[osv] VULNERABLE ' + pkg.name + '@' + baseVersion + suffix + ' (' + rel + ')');
+            for (var v = 0; v < vulns.length; v++) {
+                var entry   = vulns[v];
+                var aliases = (entry.aliases || []).join(', ');
+                var summary = (entry.summary || entry.details || '').replace(/\s+/g, ' ').slice(0, 140);
+                console.error('       ' + entry.id + (aliases ? ' (' + aliases + ')' : '') + ' — ' + summary);
+            }
+        } else {
+            console.log('[osv] OK ' + pkg.name + '@' + baseVersion + suffix + ' (' + rel + ')');
+        }
+    }
+
+    console.log('');
+    if (failures > 0) {
+        console.error('[osv] ' + failures + ' vendored dep(s) with matching CVEs — failing the build.');
+        return 1;
+    }
+    console.log('[osv] clean — no CVEs matched across ' + scanned + ' vendored dep(s).');
+    return 0;
+}
+
+main().then(function (code) {
+    process.exit(code);
+}).catch(function (err) {
+    console.error('[osv] uncaught:', err);
+    process.exit(2);
+});

package/.github/workflows/vendored-cve.yml

@@ -0,0 +1,36 @@
+name: Vendored CVE Scan
+
+on:
+  push:
+    branches: [develop, master]
+  pull_request:
+    branches: [develop, master]
+  schedule:
+    # Weekly, Sunday 00:00 UTC — catches CVEs disclosed after the last push.
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+
+# Cancel any in-flight scan for the same ref when a newer one kicks off.
+concurrency:
+  group: vendored-cve-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: OSV scan on vendored deps
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Scan vendored package.jsons via api.osv.dev
+        run: node .github/scripts/scan-vendored-cves.js

package/ROADMAP.md

@@ -123,6 +123,16 @@ Four focused follow-up sessions to close the deferred gap left by the `0.3.7-alp
 | 📋 | **Static HTML cache parity** — Port the swig disk-write/serve cache path so `cache:` keys in `routing.json` actually produce cached HTML for nunjucks routes. | `0.3.7` | Q4 2026 |
 | 📋 | **Early Hints 103 auto-send for CSS/JS preloads** — Move the 103 path in `controller.js this.render()` to be engine-agnostic. Pure perf optimisation; manual `self.setEarlyHints(linkHeader)` already works. | `0.3.7` | Q4 2026 |
 
+### Eval safety
+
+Complete the removal of `eval` / `new Function` call sites from the published tarball. Four tranches shipped across `0.3.7-alpha.4` / `0.3.7-alpha.5` cleared 13 of 24 catalogued sites; 2 more were removed by deleting orphaned source during the toolbar cleanup (15 of 24 addressed). Three clusters remain, each needing a focused session.
+
+| Status | Feature | Version | Target |
+| --- | --- | --- | --- |
+| 📋 | **Validator structural refactor** — Refactor `makeObjectFromArgs` in the validator plugin to replace the string-accumulator path-build-then-`eval('root=value')` pattern with a segments-array threaded through recursion and a safe setter. Clears 3 eval sites. Test coverage for the validator plugin was bootstrapped in the prior tranche, so the refactor has a safety net. | `0.3.8` | Q1 2027 |
+| 📋 | **Feature-intrinsic eval design pass** — 6 sites eval user-supplied JS by design (user-defined form validators, HTML event callbacks on form data attributes). Decision pass: safe-eval sandbox via `vm.Script`, pre-parse to a restricted AST, or formalise "accept and document" with an explicit trust assumption. Outcome may include dropping unused placeholder features. | `0.3.8` | Q1 2027 |
+| 📋 | **Logger circular-require refactor** — 3 load-bearing `eval(fs.readFileSync(...))` fallbacks in the logger work around a circular `merge → helpers → logger` require chain. Restructure the chain so the fallback is no longer needed. Clears the final 3 sites of the campaign. Regression risk touches every logger-consuming test. | `0.3.8` | Q1 2027 |
+
 ---
 
 ## Connectors

package/framework/v0.3.7-alpha.6/VERSION

@@ -0,0 +1 @@
+0.3.7-alpha.6

package/framework/v0.3.7-alpha.6/core/asset/plugin/dist/vendor/gina/css/gina.min.css

@@ -0,0 +1 @@
+@font-face{font-family:"have_heart_oneregular";src:url(fonts/have_heart_one-webfont.woff2) format("woff2"),url(fonts/have_heart_one-webfont.woff) format("woff");font-weight:400;font-style:normal}.gina-popin-container{background:#fff}.gina-popins-overlay,div.gina-popin-container{visibility:hidden;opacity:0;z-index:1;transition:opacity .3s,visibility 0 .3s}.gina-popins-overlay.gina-popin-is-active,div.gina-popin-container.gina-popin-is-active{opacity:1;visibility:visible;transition-delay:0}dialog.gina-popin-container{padding:0;border:none;z-index:1}.gina-popins-overlay{position:fixed;left:0;top:0;display:grid;place-items:center;width:100%;height:100%;transition:opacity .3s,visibility .3s;overflow:auto;background:rgba(0,0,0,.75)}.gina-popins-overlay.gina-popin-is-active{backdrop-filter:blur(6px)}dialog::backdrop{background-color:rgba(0,0,0,.75);backdrop-filter:blur(6px)}

package/framework/{v0.3.7-alpha.5 → v0.3.7-alpha.6}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3000,7 +3000,41 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                                 .trim();
 
             try {
-                localValue = eval('data.'+ localValue).replace(/^\"|\"$/g, '');
+                // #SCS1e (2026-04-24) — replaced `eval('data.' + localValue)` with a safe
+                // dot+bracket path walker. `localValue` is derived from `{{...}}` placeholders
+                // in error messages; the transforms at lines 152-158 produce
+                // `ident (. ident | ["quoted"])*`. The old eval executed anything that parsed
+                // as JS; a crafted placeholder like `{{constructor.constructor('return
+                // process.exit()')()}}` would reach eval unsanitised (the `[` → `["` / `]` →
+                // `"]` transforms don't neutralise dotted method access). The walker rejects
+                // any segment that isn't a bare identifier or a double-quoted bracket key.
+                // localValue = eval('data.'+ localValue).replace(/^\"|\"$/g, '');
+                let _scsRest = localValue;
+                let _scsSegments = [];
+                let _scsM = _scsRest.match(/^([A-Za-z_$][\w$]*)/);
+                if (!_scsM) { throw new Error('Invalid property path: `' + localValue + '`'); }
+                _scsSegments.push(_scsM[1]);
+                _scsRest = _scsRest.slice(_scsM[0].length);
+                while (_scsRest.length > 0) {
+                    _scsM = _scsRest.match(/^\.([A-Za-z_$][\w$]*)/);
+                    if (_scsM) {
+                        _scsSegments.push(_scsM[1]);
+                        _scsRest = _scsRest.slice(_scsM[0].length);
+                        continue;
+                    }
+                    _scsM = _scsRest.match(/^\["([^"\]]*)"\]/);
+                    if (_scsM) {
+                        _scsSegments.push(_scsM[1]);
+                        _scsRest = _scsRest.slice(_scsM[0].length);
+                        continue;
+                    }
+                    throw new Error('Invalid property path: `' + localValue + '`');
+                }
+                let _scsCur = data;
+                for (let _scsI = 0; _scsCur != null && _scsI < _scsSegments.length; _scsI++) {
+                    _scsCur = _scsCur[_scsSegments[_scsI]];
+                }
+                localValue = _scsCur.replace(/^\"|\"$/g, '');
                 error = error.replace( new RegExp( varArr[v].replace(/\{|\[|\]|\}/g, '\\$&') , 'g'), localValue);
             } catch(e) {}
         }
@@ -3731,10 +3765,59 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                         try {
                             // security checks
                             compiledCondition = compiledCondition.replace(/(\(|\)|return)/g, '');
+                            // #SCS1e (2026-04-24) — replaced the two `eval(...)` calls below with
+                            // auditable equivalents. After `$var` substitution (lines 910-920) and
+                            // paren/return strip above, `compiledCondition` is either:
+                            //   (a) a regex literal `/<body>/<flags>` (when `/^\//` matches), or
+                            //   (b) a binary comparison `<operand><op><operand>` where operand ∈
+                            //       {number, "string", true, false, null, undefined} and op ∈
+                            //       {===, !==, ==, !=, <, >, <=, >=}.
+                            // Old eval executed arbitrary JS; any value reaching `$var` substitution
+                            // that contained a quote (e.g. user input `bar"; process.exit();//`)
+                            // could escape the `"..."` wrapper at line 916 and reach eval as
+                            // arbitrary code. Grammar-locked replacements reject any input that
+                            // doesn't fit the two documented shapes.
+                            // if ( /^\//.test(compiledCondition) ) {
+                            //     isValid = eval(compiledCondition + '.test("' + this.value + '")')
+                            // } else {
+                            //     isValid = eval(compiledCondition)
+                            // }
                             if ( /^\//.test(compiledCondition) ) {
-                                isValid = eval(compiledCondition + '.test("' + this.value + '")')
+                                var _scsRegexMatch = compiledCondition.match(/^\/(.+)\/([a-z]*)$/);
+                                if (!_scsRegexMatch) {
+                                    throw new Error('Invalid regex literal: `' + compiledCondition + '`');
+                                }
+                                isValid = new RegExp(_scsRegexMatch[1], _scsRegexMatch[2]).test(this.value);
                             } else {
-                                isValid = eval(compiledCondition)
+                                var _SCS_BINARY_RE = /^\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;
+                                var _scsBinMatch = (typeof(compiledCondition) == 'string') ? compiledCondition.match(_SCS_BINARY_RE) : null;
+                                if (!_scsBinMatch) {
+                                    throw new Error('Could not evaluate condition `' + compiledCondition + '`.\n(grammar: <operand><op><operand>; operand ∈ number | "string" | true | false | null | undefined; op ∈ === !== == != < > <= >=)');
+                                }
+                                var _scsParseOperand = function(s) {
+                                    var _t = s.replace(/^\s+|\s+$/g, '');
+                                    if (_t === 'null')      return null;
+                                    if (_t === 'undefined') return undefined;
+                                    if (_t === 'true')      return true;
+                                    if (_t === 'false')     return false;
+                                    if (/^"[^"]*"$/.test(_t)) return _t.slice(1, -1);
+                                    var _n = Number(_t);
+                                    if (!isNaN(_n) && _t !== '') return _n;
+                                    throw new Error('Invalid operand: `' + s + '`');
+                                };
+                                var _scsLeft  = _scsParseOperand(_scsBinMatch[1]);
+                                var _scsOp    = _scsBinMatch[2];
+                                var _scsRight = _scsParseOperand(_scsBinMatch[3]);
+                                switch (_scsOp) {
+                                    case '===': isValid = _scsLeft === _scsRight; break;
+                                    case '!==': isValid = _scsLeft !== _scsRight; break;
+                                    case '==':  isValid = _scsLeft ==  _scsRight; break;
+                                    case '!=':  isValid = _scsLeft !=  _scsRight; break;
+                                    case '<':   isValid = _scsLeft <   _scsRight; break;
+                                    case '>':   isValid = _scsLeft >   _scsRight; break;
+                                    case '<=':  isValid = _scsLeft <=  _scsRight; break;
+                                    case '>=':  isValid = _scsLeft >=  _scsRight; break;
+                                }
                             }
 
                         } catch (err) {
@@ -11931,8 +12014,27 @@ function ValidatorPlugin(rules, data, formId) {
                         if (customRule) {
                             customRule = customRule.replace(/\-|\//g, '.');
                             if ( typeof(rules) != 'undefined' ) {
-                                instance.$forms[id].rules[customRule] = instance.rules[customRule] = local.rules[customRule] = merge(JSON.clone( eval('gina.forms.rules.'+ customRule)), instance.rules[customRule]);
+                                // #SCS1e (2026-04-24) — replaced `eval('gina.forms.rules.' + customRule)`
+                                // with a safe dot-path walker. `customRule` is user-controlled (read
+                                // from the `data-gina-form-rule` HTML attribute); after the replace at
+                                // line 2601 it is a pure dot-path like `account.signin_scope`. The old
+                                // eval executed anything that parsed as JS — a crafted rule name such
+                                // as `constructor.constructor("return process.exit()")()` would fire on
+                                // lookup. The walker rejects any non-identifier character and returns
+                                // undefined on missing path (the `typeof(local.rules[customRule]) ==
+                                // 'undefined'` check at line 2606 then produces the usual user-facing
+                                // "no rule found" error).
+                                // instance.$forms[id].rules[customRule] = instance.rules[customRule] = local.rules[customRule] = merge(JSON.clone( eval('gina.forms.rules.'+ customRule)), instance.rules[customRule]);
                                 // instance.$forms[id].rules[customRule] = instance.rules[customRule] = local.rules[customRule] = merge(eval('gina.forms.rules.'+ customRule), instance.rules[customRule]);
+                                if (!/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/.test(customRule)) {
+                                    throw new Error('Invalid form rule path: `' + customRule + '`');
+                                }
+                                var _scsSegments = customRule.split('.');
+                                var _scsCur      = gina.forms.rules;
+                                for (var _scsI = 0; _scsCur != null && _scsI < _scsSegments.length; _scsI++) {
+                                    _scsCur = _scsCur[_scsSegments[_scsI]];
+                                }
+                                instance.$forms[id].rules[customRule] = instance.rules[customRule] = local.rules[customRule] = merge(JSON.clone(_scsCur), instance.rules[customRule]);
                             }
                             if ( typeof(local.rules[customRule]) == 'undefined' ) {
                                 throw new Error('['+id+'] no rule found with key: `'+customRule+'`. Please check if json is not malformed @ /forms/rules/' + customRule.replace(/\./g, '/') +'.json');