gina 0.4.5 → 0.4.6

package/framework/{v0.4.5 → v0.4.6}/core/controller/controller.js

@@ -770,6 +770,13 @@ function SuperController(options) {
                 cache       : false
             };
             if (dir) {
+                // #TPL2 — confined loader (mirrors core/server.js initSwigEngine).
+                // gina's processed layout cache is now in-root (.gina-layout-cache
+                // under the templates root) and the dev statusbar is inlined, so no
+                // template resolves outside the bundle templates root. swig-core's
+                // basepath confinement (CVE-2023-25345, allowOutsideRoot defaults
+                // false) therefore guards every resolution, including untrusted
+                // nested {% include %} / {% import %}.
                 swigOptions.loader = swig.loaders.fs(dir);
             }
             if ( typeof(local._swigOptions) == 'undefined' ) {
@@ -1192,9 +1199,44 @@ function SuperController(options) {
             }
         } catch (e) { /* fall back to default 'swig' */ }
 
-        var _delegate = (_engine === 'nunjucks')
-            ? '/controller.render-nunjucks'
-            : '/controller.render-swig';
+        var _delegate;
+        if (_engine === 'nunjucks') {
+            // #TPL1 — a nunjucks bundle with a configured async loader renders
+            // through a per-request Environment in controller.render-nunjucks-async.js;
+            // every other nunjucks bundle keeps the cached-Environment filesystem
+            // path. The dispatch key is the same expression initNunjucksEngine
+            // stashed under (conf.content.templates._common.html).
+            var _njAsync = false;
+            try {
+                var _njRoot = local.options && local.options.conf && local.options.conf.content
+                    && local.options.conf.content.templates && local.options.conf.content.templates._common
+                    && local.options.conf.content.templates._common.html;
+                _njAsync = !!(
+                    _njRoot && process.gina._nunjucksLoaders && process.gina._nunjucksLoaders[_njRoot]
+                    && process.gina._nunjucksLoaders[_njRoot].loader
+                    && process.gina._nunjucksLoaders[_njRoot].loader.async === true
+                );
+            } catch (e) { /* fall back to the cached-env render-nunjucks path */ }
+            _delegate = _njAsync ? '/controller.render-nunjucks-async' : '/controller.render-nunjucks';
+        } else {
+            // #TPL1 — a swig bundle with a configured async loader renders through
+            // the isolated per-bundle engine in controller.render-swig-async.js;
+            // every other swig bundle keeps the byte-identical filesystem path.
+            // The dispatch key is the same expression initSwigEngine stashed under
+            // (conf.content.templates._common.html).
+            var _swigAsync = false;
+            try {
+                var _troot = local.options && local.options.conf && local.options.conf.content
+                    && local.options.conf.content.templates && local.options.conf.content.templates._common
+                    && local.options.conf.content.templates._common.html;
+                _swigAsync = !!(
+                    _troot && process.gina._swigLoaders && process.gina._swigLoaders[_troot]
+                    && process.gina._swigLoaders[_troot].loader
+                    && process.gina._swigLoaders[_troot].loader.async === true
+                );
+            } catch (e) { /* fall back to the filesystem render-swig path */ }
+            _delegate = _swigAsync ? '/controller.render-swig-async' : '/controller.render-swig';
+        }
 
         if  (this.isCacheless() ) {
             delete require.cache[require.resolve( _(__dirname + '/controller.render-v1', true))];
@@ -1202,6 +1244,12 @@ function SuperController(options) {
             try {
                 delete require.cache[require.resolve( _(__dirname + '/controller.render-nunjucks', true))];
             } catch (e) { /* nunjucks delegate may not exist on older framework dirs */ }
+            try {
+                delete require.cache[require.resolve( _(__dirname + '/controller.render-swig-async', true))];
+            } catch (e) { /* async delegate may not exist on older framework dirs */ }
+            try {
+                delete require.cache[require.resolve( _(__dirname + '/controller.render-nunjucks-async', true))];
+            } catch (e) { /* async delegate may not exist on older framework dirs */ }
         }
 
         return require( _(__dirname + _delegate, true) )(userData, displayInspector, errOptions, {
@@ -2872,8 +2920,13 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             queryData = '?';
             // TODO - if 'application/json' && method == (put|post)
             if ( ['put', 'post'].indexOf(options.method.toLowerCase()) >-1 && /(text\/plain|application\/json|application\/x\-www\-form)/i.test(options.headers['content-type']) ) {
-                // replacing
-                queryData = encodeRFC5987ValueChars(JSON.stringify(data))
+                // Send the body as raw JSON. The wire content-type is forced to
+                // application/json below, and the receiving parser (server.js
+                // processRequestData) reads application/json verbatim — so the body must
+                // NOT be percent-encoded. RFC5987 value-encoding is defined for HTTP
+                // header values (e.g. filename*=), not request bodies; applying it here
+                // produced a body the framework's own parser rejected.
+                queryData = JSON.stringify(data)
             } else {
                 //Sample request.
                 //options.path = '/updater/start?release={"version":"0.0.5-dev","url":"http://10.1.0.1:8080/project/bundle/repository/archive?ref=0.0.5-dev","date":1383669077141}&pid=46493';
@@ -5423,7 +5476,10 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 }
 
                  // intercept none HTML mime types
-                 var url                     = decodeURI(local.req.url) /// avoid %20
+                 // #B30: controller-side error-path mirror of server.js:4936 — safeDecodeURI so a
+                 // malformed-% URL cannot crash the bundle from inside the error handler.
+                 // was: var url = decodeURI(local.req.url) /// avoid %20
+                 var url                     = safeDecodeURI(local.req.url) /// avoid %20
                     , ext                   = null
                     , isHtmlContent         = false
                     , hasCustomErrorFile    = false