gina 0.4.5 → 0.4.6

package/framework/{v0.4.5 → v0.4.6}/core/server.js

@@ -417,6 +417,33 @@ function Server(options) {
         // so bundle startup fails with a clear message rather than
         // deferring the failure to the first render attempt.
         nunjucksResolver.load(self.executionPath, _nunjucksSettings);
+
+        // #TPL1 — async template-loader extension point. When the bundle
+        // configures settings.template.nunjucks.loader, build + validate the
+        // loader at startup (fail-fast on bad config, same as the nunjucks
+        // load above) and stash it per-bundle keyed by the template root.
+        // controller.js routes such bundles to the async delegate
+        // (controller.render-nunjucks-async.js), which builds a PER-REQUEST
+        // nunjucks Environment over this loader. The default (no-loader) path
+        // is untouched — render-nunjucks.js's cached-Environment filesystem path.
+        var _loaderCfg = (
+            conf.content && conf.content.settings && conf.content.settings.template
+            && conf.content.settings.template.nunjucks && conf.content.settings.template.nunjucks.loader
+        ) || null;
+        if (_loaderCfg) {
+            // build() throws on a bad config; let it propagate so bundle startup
+            // fails with a clear message rather than 500-ing the first render.
+            // It does NOT reach the backend (no network probe at boot).
+            var _builtLoader = lib.templateLoaders.build(_loaderCfg, { bundle: self.appName });
+            if (_builtLoader && _builtLoader.async === true) {
+                if (!process.gina._nunjucksLoaders) { process.gina._nunjucksLoaders = Object.create(null); }
+                process.gina._nunjucksLoaders[conf.content.templates._common.html] = {
+                    loader:     _builtLoader,
+                    autoescape: (_nunjucksSettings.autoescape !== false),
+                    cache:      (_loaderCfg.cache === true)   // #TPL1 Tier-2 opt-in compiled-template cache
+                };
+            }
+        }
     };
 
     var initSwigEngine = function(conf) {
@@ -434,6 +461,13 @@ function Server(options) {
         var dir = conf.content.templates._common.html;
         var swigOptions = {
             autoescape: ( typeof(conf.autoescape) != 'undefined') ? conf.autoescape: false,
+            // #TPL2 — confined loader (swig-core basepath confinement, CVE-2023-25345).
+            // gina no longer resolves any template OUTSIDE the bundle templates root:
+            // the processed layout cache lives in-root (controller.render-swig.js
+            // .gina-layout-cache) and the dev inspector statusbar is inlined rather
+            // than {% include %}-d from the framework core dir. So the loader keeps
+            // swig-core's confinement (allowOutsideRoot defaults false) for every
+            // resolution, including untrusted nested {% include %} / {% import %}.
             loader: swig.loaders.fs(dir),
             cache: (conf.isCacheless) ? false : 'memory'
         };
@@ -458,6 +492,33 @@ function Server(options) {
         } catch (err) {
             throw err;
         }
+
+        // #TPL1 — async template-loader extension point. When the bundle
+        // configures settings.template.swig.loader, build + validate the loader
+        // at startup (fail-fast on bad config, mirroring initNunjucksEngine) and
+        // stash it per-bundle keyed by the template root. controller.js routes
+        // such bundles to the async delegate (controller.render-swig-async.js),
+        // which builds an ISOLATED per-bundle swig engine from this loader — the
+        // shared singleton's setDefaults loader above is unused for them. The
+        // default (no-loader) path is untouched: byte-identical to pre-#TPL1.
+        var _loaderCfg = (
+            conf.content && conf.content.settings && conf.content.settings.template
+            && conf.content.settings.template.swig && conf.content.settings.template.swig.loader
+        ) || null;
+        if (_loaderCfg) {
+            // build() throws on a bad config; we let it propagate so bundle
+            // startup fails with a clear message rather than 500-ing the first
+            // render. It does NOT reach the backend (no network probe at boot).
+            var _builtLoader = lib.templateLoaders.build(_loaderCfg, { bundle: self.appName });
+            if (_builtLoader && _builtLoader.async === true) {
+                if (!process.gina._swigLoaders) { process.gina._swigLoaders = Object.create(null); }
+                process.gina._swigLoaders[dir] = {
+                    loader:     _builtLoader,
+                    autoescape: swigOptions.autoescape,
+                    cache:      (_loaderCfg.cache === true)   // #TPL1 Tier-2 opt-in compiled-fn cache
+                };
+            }
+        }
     }
 
     /**
@@ -1110,7 +1171,11 @@ function Server(options) {
     var getAssetFilenameFromUrl = function(bundleConf, url) {
 
         var staticsArr  = bundleConf.publicResources;
-        url = decodeURIComponent( url );
+        // #B30: reachable with an attacker-controlled URL (the HTTP/2 static path
+        // passes request-derived `pathname` here — server.js ~2500), so a malformed
+        // % escape would otherwise throw URIError, uncaught, and crash the bundle.
+        // was: url = decodeURIComponent( url );
+        url = safeDecodeURIComponent( url );
         var staticProps = {
             firstLevel  : '/'+ url.split(/\//g)[1] + '/',
             isFile      :  /^\/[A-Za-z0-9_-]+\.(.*)$/.test(url)
@@ -2215,7 +2280,11 @@ function Server(options) {
         }
 
 
-        filename = decodeURIComponent(filename);
+        // #B30: a static-asset request URL with a malformed % escape (e.g.
+        // GET /assets/%E0%.css) would otherwise throw URIError here, uncaught,
+        // and crash the bundle. Fall back to the raw filename on a bad escape.
+        // was: filename = decodeURIComponent(filename);
+        filename = safeDecodeURIComponent(filename);
         let filenameObj = new _(filename, true);
         filenameObj.exists(function onStaticExists(exists) {
         // fs.exists(filename, function onStaticExists(exists) {
@@ -3530,6 +3599,15 @@ function Server(options) {
                     });
 
                     request.on('end', function onEnd() {
+                        // Preserve the exact unparsed body BEFORE processRequestData mutates
+                        // request.body into the parsed object. Inbound webhooks that
+                        // authenticate via an HMAC computed over the raw request bytes need
+                        // the untouched body; by the time middlewares run, the stream is
+                        // drained and request.body is the parsed object. request.body is the
+                        // fully-accumulated string here ('' when the body was empty). This
+                        // is a reference assignment, not a copy. The multipart branch above
+                        // uses Busboy and never reaches here, so uploads are unaffected.
+                        request.rawBody = (typeof request.body === 'string') ? request.body : '';
                         processRequestData(request, response, next);
                     });
 
@@ -3591,52 +3669,80 @@ function Server(options) {
                     // get rid of encoding issues
                     try {
                         if ( !/multipart\/form-data;/.test(request.headers['content-type']) ) {
-                            if ( /application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) && /\+/.test(request.body) ) {
-                                request.body = request.body.replace(/\+/g, ' ');
-                            }
+                            if ( /application\/json/i.test(request.headers['content-type']) ) {
+                                // #B28 — application/json: parse the body verbatim. JSON already
+                                // carries real types, so do NOT url-decode (a %XX inside a string
+                                // value would be corrupted) and do NOT apply form-style
+                                // "true"/"false"/"on"/"null" coercion or bracket-key expansion —
+                                // those are urlencoded-form conventions, not JSON.
+                                try {
+                                    obj = JSON.parse(request.body);
+                                    request.post = obj;
+                                    isPostSet = true;
+                                } catch (err) {
+                                    // Tolerate a percent-encoded JSON body (e.g. an
+                                    // encodeURIComponent / RFC5987-encoded payload). A genuine
+                                    // raw-JSON body parses on the verbatim attempt above, so a
+                                    // legitimate %XX inside a string value is never double-decoded
+                                    // (preserves #B28 intent) — only a non-raw-JSON body reaches here.
+                                    try {
+                                        obj = JSON.parse(decodeURIComponent(request.body));
+                                        request.post = obj;
+                                        isPostSet = true;
+                                    } catch (err2) {
+                                        exception = new Error('Could not parse application/json POST body. '+ err.message);
+                                        throwError(response, 500, exception, next);
+                                        return;
+                                    }
+                                }
+                            } else {
+                                if ( /application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) && /\+/.test(request.body) ) {
+                                    request.body = request.body.replace(/\+/g, ' ');
+                                }
 
-                            if ( request.body.substring(0,1) == '?')
-                                request.body = request.body.substring(1);
+                                if ( request.body.substring(0,1) == '?')
+                                    request.body = request.body.substring(1);
 
-                            try {
-                                bodyStr = decodeURIComponent(request.body); // it is already a string for sure
-                            } catch (err) {
-                                bodyStr = request.body;
-                            }
+                                try {
+                                    bodyStr = decodeURIComponent(request.body); // it is already a string for sure
+                                } catch (err) {
+                                    bodyStr = request.body;
+                                }
 
-                            // false & true case
-                            if ( /(\"false\"|\"true\"|\"on\")/.test(bodyStr) )
-                                bodyStr = bodyStr.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
-                            if ( /(\"null\")/i.test(bodyStr) )
-                                bodyStr = bodyStr.replace(/\"null\"/ig, null);
+                                // false & true case
+                                if ( /(\"false\"|\"true\"|\"on\")/.test(bodyStr) )
+                                    bodyStr = bodyStr.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
+                                if ( /(\"null\")/i.test(bodyStr) )
+                                    bodyStr = bodyStr.replace(/\"null\"/ig, null);
 
-                            try {
-                                // obj = parseBody(bodyStr);
-                                obj = formatDataFromString(bodyStr);
-                                if ( !obj) {
-                                    exception = new Error('Could not convert POST::BODY_STRING to POST::OBJECT. Possible JSON error in `bodyStr`');
-                                    throwError(response, 500, exception, next);
-                                    return;
-                                }
-                                request.post = obj;
-                                isPostSet = true;
-                            } catch (err) {
-                                // ignore this one
-                                msg = '[ Could properly evaluate POST ] '+ request.url +'\n'+  err.stack;
-                                console.warn(msg);
-                            }
-                            if (!isPostSet) {
                                 try {
-                                    if (obj.count() == 0 && bodyStr.length > 1) {
-                                        request.post = obj;
-                                    } else {
-                                        request.post = JSON.parse(bodyStr)
+                                    // obj = parseBody(bodyStr);
+                                    obj = formatDataFromString(bodyStr);
+                                    if ( !obj) {
+                                        exception = new Error('Could not convert POST::BODY_STRING to POST::OBJECT. Possible JSON error in `bodyStr`');
+                                        throwError(response, 500, exception, next);
+                                        return;
                                     }
-
+                                    request.post = obj;
+                                    isPostSet = true;
                                 } catch (err) {
-                                    msg = '[ Exception found for POST ] '+ request.url +'\n'+  err.stack;
+                                    // ignore this one
+                                    msg = '[ Could properly evaluate POST ] '+ request.url +'\n'+  err.stack;
                                     console.warn(msg);
                                 }
+                                if (!isPostSet) {
+                                    try {
+                                        if (obj.count() == 0 && bodyStr.length > 1) {
+                                            request.post = obj;
+                                        } else {
+                                            request.post = JSON.parse(bodyStr)
+                                        }
+
+                                    } catch (err) {
+                                        msg = '[ Exception found for POST ] '+ request.url +'\n'+  err.stack;
+                                        console.warn(msg);
+                                    }
+                                }
                             }
                         }
 
@@ -3701,7 +3807,17 @@ function Server(options) {
 
 
                         if ( typeof(request.query.inheritedData) == 'string' ) {
-                            inheritedDataObj = formatDataFromString(decodeURIComponent(request.query.inheritedData));
+                            // #B30: request.query.inheritedData is ALREADY percent-decoded once by
+                            // the engine query parser (server.isaac.js / express qs), and
+                            // formatDataFromString performs its OWN guarded internal decode. The
+                            // explicit decodeURIComponent here was a redundant SECOND decode whose
+                            // only effects were (a) a URIError crash on a literal '%' surviving the
+                            // first decode — e.g. inheritedData carrying {"x":"50%off"} → "%of" is a
+                            // malformed escape → the bundle dies (URIError → proc.js uncaughtException → SIGTERM) — and
+                            // (b) extra silent double-decode corruption. Dropped: formatDataFromString
+                            // supplies the single guarded decode.
+                            // was: inheritedDataObj = formatDataFromString(decodeURIComponent(request.query.inheritedData));
+                            inheritedDataObj = formatDataFromString(request.query.inheritedData);
                         } else {
                             inheritedDataObj = JSON.clone(request.query.inheritedData);
                         }
@@ -3718,7 +3834,11 @@ function Server(options) {
                         bodyStr = bodyStr.replace(/\"null\"/ig, null);
 
 
-                    obj = formatDataFromString(decodeURIComponent(bodyStr));
+                    // #B30: redundant second decode dropped (see the GET inheritedData note
+                    // above) — request.query values are already engine-decoded and
+                    // formatDataFromString self-guards its own decode.
+                    // was: obj = formatDataFromString(decodeURIComponent(bodyStr));
+                    obj = formatDataFromString(bodyStr);
 
                     request.query = merge(obj, inheritedDataObj);
                     // delete obj;
@@ -3743,34 +3863,54 @@ function Server(options) {
                     // get rid of encoding issues
                     try {
                         if ( !/multipart\/form-data;/.test(request.headers['content-type']) ) {
-                            if ( /application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) ) {
-                                request.body = request.body.replace(/\+/g, ' ');
-                            }
+                            if ( /application\/json/i.test(request.headers['content-type']) ) {
+                                // #B28 — application/json: parse the body verbatim. JSON already
+                                // carries real types, so do NOT url-decode (a %XX inside a string
+                                // value would be corrupted) and do NOT apply form-style
+                                // "true"/"false"/"on"/"null" coercion or bracket-key expansion —
+                                // those are urlencoded-form conventions, not JSON.
+                                try {
+                                    obj = JSON.parse(request.body);
+                                } catch (err) {
+                                    // Tolerate a percent-encoded JSON body (see the POST branch).
+                                    // The verbatim attempt above wins for genuine raw JSON, so
+                                    // #B28 intent holds and only an encoded body reaches here.
+                                    try {
+                                        obj = JSON.parse(decodeURIComponent(request.body));
+                                    } catch (err2) {
+                                        console.warn('[ Could not parse application/json PUT body ] '+ request.url +'\n'+ err.stack);
+                                    }
+                                }
+                            } else {
+                                if ( /application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) ) {
+                                    request.body = request.body.replace(/\+/g, ' ');
+                                }
 
-                            if ( request.body.substring(0,1) == '?')
-                                request.body = request.body.substring(1);
+                                if ( request.body.substring(0,1) == '?')
+                                    request.body = request.body.substring(1);
 
-                            // false & true case
-                            try {
-                                bodyStr = decodeURIComponent(request.body); // it is already a string for sure
-                            } catch (err) {
-                                bodyStr = request.body;
-                            }
+                                // false & true case
+                                try {
+                                    bodyStr = decodeURIComponent(request.body); // it is already a string for sure
+                                } catch (err) {
+                                    bodyStr = request.body;
+                                }
 
-                            // false & true case
-                            if ( /(\"false\"|\"true\"|\"on\")/.test(bodyStr) )
-                                bodyStr = bodyStr.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
-                            if ( /(\"null\")/i.test(bodyStr) )
-                                bodyStr = bodyStr.replace(/\"null\"/ig, null);
+                                // false & true case
+                                if ( /(\"false\"|\"true\"|\"on\")/.test(bodyStr) )
+                                    bodyStr = bodyStr.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
+                                if ( /(\"null\")/i.test(bodyStr) )
+                                    bodyStr = bodyStr.replace(/\"null\"/ig, null);
 
-                            obj = formatDataFromString(bodyStr);
+                                obj = formatDataFromString(bodyStr);
 
 
-                            if ( typeof(obj) != 'undefined' && obj.count() == 0 && bodyStr.length > 1 ) {
-                                try {
-                                    request.put = merge(request.put, obj);
-                                } catch (err) {
-                                    console.log('Case `put` #0 [ merge error ]: ' + (err.stack||err.message))
+                                if ( typeof(obj) != 'undefined' && obj.count() == 0 && bodyStr.length > 1 ) {
+                                    try {
+                                        request.put = merge(request.put, obj);
+                                    } catch (err) {
+                                        console.log('Case `put` #0 [ merge error ]: ' + (err.stack||err.message))
+                                    }
                                 }
                             }
                         }
@@ -3833,40 +3973,66 @@ function Server(options) {
                 if ( typeof(request.body) == 'string' ) {
                     try {
                         if ( !/multipart\/form-data;/.test(request.headers['content-type']) ) {
-                            if ( /application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) && /\+/.test(request.body) ) {
-                                request.body = request.body.replace(/\+/g, ' ');
-                            }
-                            if ( request.body.substring(0,1) == '?' )
-                                request.body = request.body.substring(1);
-                            try {
-                                bodyStr = decodeURIComponent(request.body);
-                            } catch (err) {
-                                bodyStr = request.body;
-                            }
-                            if ( /(\"false\"|\"true\"|\"on\")/.test(bodyStr) )
-                                bodyStr = bodyStr.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
-                            if ( /(\"null\")/i.test(bodyStr) )
-                                bodyStr = bodyStr.replace(/\"null\"/ig, null);
-                            try {
-                                obj = formatDataFromString(bodyStr);
-                                if ( !obj ) {
-                                    exception = new Error('Could not convert PATCH::BODY_STRING to PATCH::OBJECT. Possible JSON error in `bodyStr`');
-                                    throwError(response, 500, exception, next);
-                                    return;
+                            if ( /application\/json/i.test(request.headers['content-type']) ) {
+                                // #B28 — application/json: parse the body verbatim. JSON already
+                                // carries real types, so do NOT url-decode (a %XX inside a string
+                                // value would be corrupted) and do NOT apply form-style
+                                // "true"/"false"/"on"/"null" coercion or bracket-key expansion —
+                                // those are urlencoded-form conventions, not JSON.
+                                try {
+                                    obj = JSON.parse(request.body);
+                                    request.patch = obj;
+                                    isPatchSet = true;
+                                } catch (err) {
+                                    // Tolerate a percent-encoded JSON body (see the POST branch).
+                                    // The verbatim attempt above wins for genuine raw JSON, so
+                                    // #B28 intent holds and only an encoded body reaches here.
+                                    try {
+                                        obj = JSON.parse(decodeURIComponent(request.body));
+                                        request.patch = obj;
+                                        isPatchSet = true;
+                                    } catch (err2) {
+                                        exception = new Error('Could not parse application/json PATCH body. '+ err.message);
+                                        throwError(response, 500, exception, next);
+                                        return;
+                                    }
                                 }
-                                request.patch = obj;
-                                isPatchSet = true;
-                            } catch (err) {
-                                msg = '[ Could not properly evaluate PATCH ] '+ request.url +'\n'+ err.stack;
-                                console.warn(msg);
-                            }
-                            if (!isPatchSet) {
+                            } else {
+                                if ( /application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) && /\+/.test(request.body) ) {
+                                    request.body = request.body.replace(/\+/g, ' ');
+                                }
+                                if ( request.body.substring(0,1) == '?' )
+                                    request.body = request.body.substring(1);
+                                try {
+                                    bodyStr = decodeURIComponent(request.body);
+                                } catch (err) {
+                                    bodyStr = request.body;
+                                }
+                                if ( /(\"false\"|\"true\"|\"on\")/.test(bodyStr) )
+                                    bodyStr = bodyStr.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
+                                if ( /(\"null\")/i.test(bodyStr) )
+                                    bodyStr = bodyStr.replace(/\"null\"/ig, null);
                                 try {
-                                    request.patch = ( obj.count() == 0 && bodyStr.length > 1 ) ? obj : JSON.parse(bodyStr);
+                                    obj = formatDataFromString(bodyStr);
+                                    if ( !obj ) {
+                                        exception = new Error('Could not convert PATCH::BODY_STRING to PATCH::OBJECT. Possible JSON error in `bodyStr`');
+                                        throwError(response, 500, exception, next);
+                                        return;
+                                    }
+                                    request.patch = obj;
+                                    isPatchSet = true;
                                 } catch (err) {
-                                    msg = '[ Exception found for PATCH ] '+ request.url +'\n'+ err.stack;
+                                    msg = '[ Could not properly evaluate PATCH ] '+ request.url +'\n'+ err.stack;
                                     console.warn(msg);
                                 }
+                                if (!isPatchSet) {
+                                    try {
+                                        request.patch = ( obj.count() == 0 && bodyStr.length > 1 ) ? obj : JSON.parse(bodyStr);
+                                    } catch (err) {
+                                        msg = '[ Exception found for PATCH ] '+ request.url +'\n'+ err.stack;
+                                        console.warn(msg);
+                                    }
+                                }
                             }
                         }
                     } catch (err) {
@@ -3916,7 +4082,9 @@ function Server(options) {
                     var headInheritedDataObj = {};
                     if ( typeof(request.query.inheritedData) != 'undefined' ) {
                         if ( typeof(request.query.inheritedData) == 'string' ) {
-                            headInheritedDataObj = formatDataFromString(decodeURIComponent(request.query.inheritedData));
+                            // #B30: redundant second decode dropped (see the GET inheritedData note).
+                            // was: headInheritedDataObj = formatDataFromString(decodeURIComponent(request.query.inheritedData));
+                            headInheritedDataObj = formatDataFromString(request.query.inheritedData);
                         } else {
                             headInheritedDataObj = JSON.clone(request.query.inheritedData);
                         }
@@ -3927,7 +4095,9 @@ function Server(options) {
                         bodyStr = bodyStr.replace(/\"false\"/ig, false).replace(/\"true\"/ig, true).replace(/\"on\"/ig, true);
                     if ( /(\"null\")/i.test(bodyStr) )
                         bodyStr = bodyStr.replace(/\"null\"/ig, null);
-                    obj = formatDataFromString(decodeURIComponent(bodyStr));
+                    // #B30: redundant second decode dropped (see the GET inheritedData note).
+                    // was: obj = formatDataFromString(decodeURIComponent(bodyStr));
+                    obj = formatDataFromString(bodyStr);
                     request.query = merge(obj, headInheritedDataObj);
                     obj = null;
                     headInheritedDataObj = null;
@@ -4373,7 +4543,7 @@ function Server(options) {
         // lookupTrie returns null when no trie is available → linear scan runs normally.
         var _trieCandidateSet = null;
         if (!hasCachedRoute) {
-            var _trieHits = routingLib.lookupTrie(decodeURI(pathname), bundle);
+            var _trieHits = routingLib.lookupTrie(safeDecodeURI(pathname), bundle); // #B30: malformed-%-safe — a bad escape here would otherwise reject the async dispatch promise → hung request
             if (_trieHits !== null && _trieHits.length > 0) {
                 _trieCandidateSet = new Set(_trieHits);
             }
@@ -4463,7 +4633,7 @@ function Server(options) {
                     control             : routing[name].param.control,
                     requirements        : routing[name].requirements,
                     namespace           : routing[name].namespace || undefined,
-                    url                 : decodeURI(pathname), /// avoid %20
+                    url                 : safeDecodeURI(pathname), /// avoid %20 — #B30 malformed-%-safe
                     rule                : routing[name].originalRule || name,
                     cache               : routing[name].cache || null,
                     queryTimeout        : parseTimeout(routing[name].queryTimeout) || null,
@@ -4763,7 +4933,13 @@ function Server(options) {
                 // console.error(local.request.method +' [ '+code+' ] '+ local.request.url);
                 console.error('[ BUNDLE ][ '+self.appName+' ] '+ local.request.method +' [ '+code+' ] \n'+ msg);
                 // intercept none HTML mime types
-                var url                     = decodeURI(local.request.url) /// avoid %20
+                // #B30: throwError is the central error responder, reached synchronously from many
+                // request callbacks; an unguarded decodeURI of a malformed-% URL here throws URIError →
+                // proc.js uncaughtException handler (proc.js:319) → emerg + SIGTERM → the bundle dies
+                // (it even turns a would-be graceful 404 on a malformed-% URL into a crash).
+                // safeDecodeURI falls back to the raw URL.
+                // was: var url = decodeURI(local.request.url) /// avoid %20
+                var url                     = safeDecodeURI(local.request.url) /// avoid %20
                     , ext                   = null
                     , isHtmlContent         = false
                     , hasCustomErrorFile    = false

package/framework/{v0.4.5 → v0.4.6}/helpers/data/package.json

@@ -12,9 +12,6 @@
     "node": ">=0.10.22"
   },
   "main": "src/main",
-  "scripts": {
-    "test": "nodeunit test"
-  },
   "license": "MIT",
   "readmeFilename": "README.md"
 }

package/framework/{v0.4.5 → v0.4.6}/helpers/data/src/main.js

@@ -49,6 +49,56 @@ function DataHelper(){
             replace(/%(?:7C|60|5E)/g, unescape);
     };
 
+    /**
+     * Percent-decodes a string, returning the input UNCHANGED when it is not a
+     * valid URI component. `decodeURIComponent` throws `URIError` on a malformed
+     * escape (a bare `%`, `%zz`, or a truncated `%E0%A`). On the server request
+     * path an attacker-controlled malformed `%` in a URL / query string would
+     * otherwise reach an unguarded `decodeURIComponent`, throw, and — since the
+     * framework runs no `uncaughtException` handler — take the whole bundle down
+     * (#B30). Use this at every server-side decode of attacker-controllable
+     * input where the decode is the genuine (first) decode and cannot simply be
+     * dropped; it mirrors the try/decode/fallback-to-raw idiom already used in
+     * the POST/PUT/PATCH body branches of `processRequestData`.
+     *
+     * @param {string} str - the value to decode
+     * @returns {string} the decoded value, or the original string on URIError
+     * @example
+     *   safeDecodeURIComponent('a%20b'); // 'a b'
+     *   safeDecodeURIComponent('100%');  // '100%'  (decodeURIComponent would throw URIError)
+     */
+    safeDecodeURIComponent = function(str) {
+        try {
+            return decodeURIComponent(str);
+        } catch (err) {
+            return str;
+        }
+    };
+
+    /**
+     * Like {@link safeDecodeURIComponent} but for whole-URI decoding: wraps
+     * `decodeURI` (which leaves URI-reserved characters such as `/ ? #` intact —
+     * used across the routing and error-handler paths to turn `%20` back into a
+     * space without touching path separators). `decodeURI` throws the SAME
+     * `URIError` as `decodeURIComponent` on a malformed escape, so an unguarded
+     * call on the request URL / pathname crashes the bundle the same way (#B30) —
+     * including from inside `throwError`, which would turn a graceful error into a
+     * crash. Returns the input unchanged on a malformed escape.
+     *
+     * @param {string} str - the value to decode
+     * @returns {string} the decoded value, or the original string on URIError
+     * @example
+     *   safeDecodeURI('/a%20b');  // '/a b'
+     *   safeDecodeURI('/a%E0%A'); // '/a%E0%A'  (decodeURI would throw URIError)
+     */
+    safeDecodeURI = function(str) {
+        try {
+            return decodeURI(str);
+        } catch (err) {
+            return str;
+        }
+    };
+
     /**
      * Convert JSON string with structured keys to object
      *
@@ -153,7 +203,11 @@ function DataHelper(){
             for (var i = 0, len = arr.length; i < len; ++i) {
                 if (!arr[i]) continue;
 
-                arr[i] = decodeURIComponent(arr[i]);
+                // #B30: tolerate a malformed `%` escape (fall back to the raw
+                // segment) instead of letting decodeURIComponent throw URIError —
+                // an unguarded throw here propagates to processRequestData with no
+                // uncaughtException handler and crashes the bundle.
+                arr[i] = safeDecodeURIComponent(arr[i]);
 
                 if ( /^\{/.test(arr[i]) || /\=\{/.test(arr[i]) || /\=\[/.test(arr[i]) ) {
                     try {
@@ -182,8 +236,9 @@ function DataHelper(){
 
                     if ( typeof(el[1]) == 'string' && !/\[object /.test(el[1])) {
                         key     = null;
-                        el[0]   = decodeURIComponent(el[0]);
-                        el[1]   = decodeURIComponent(el[1]);
+                        // #B30: malformed-%-safe decode (see the arr[] loop above).
+                        el[0]   = safeDecodeURIComponent(el[0]);
+                        el[1]   = safeDecodeURIComponent(el[1]);
 
                         if ( /^(.*)\[(.*)\]/.test(el[0]) ) { // some[field] ?
                             key = el[0].replace(/\]/g, '').split(/\[/g);

package/framework/{v0.4.5 → v0.4.6}/helpers/json/package.json

@@ -12,9 +12,6 @@
     "node": ">=0.10.22"
   },
   "main": "src/main",
-  "scripts": {
-    "test": "nodeunit test"
-  },
   "license": "MIT",
   "readmeFilename": "README.md"
 }

package/framework/{v0.4.5 → v0.4.6}/helpers/plugins/package.json

@@ -12,9 +12,6 @@
     "node": ">=0.10.22"
   },
   "main": "src/main",
-  "scripts": {
-    "test": "nodeunit test"
-  },
   "license": "MIT",
   "readmeFilename": "README.md"
 }

package/framework/{v0.4.5 → v0.4.6}/lib/archiver/package.json

@@ -12,9 +12,6 @@
     "node": ">=0.10.22"
   },
   "main": "src/main",
-  "scripts": {
-    "test": "nodeunit test"
-  },
   "license": "MIT",
   "readmeFilename": "README.md"
 }