gina 0.6.0 → 0.6.1

package/framework/{v0.6.0 → v0.6.1}/core/connectors/postgresql/index.js

@@ -230,7 +230,15 @@ function Postgresql(conn, infos) {
         }
 
         if (!entities[entityName]) return;
-        if (typeof entities[entityName].prototype[name] !== 'undefined') return;
+        if (typeof entities[entityName].prototype[name] !== 'undefined') {
+            // Own property = user code in the entity .js wins (designed intent).
+            // Inherited name = the file is silently shadowed (e.g. gina's
+            // Object.prototype count()) — warn so the skip is diagnosable (#B173).
+            if ( !Object.prototype.hasOwnProperty.call(entities[entityName].prototype, name) ) {
+                console.warn('[postgresql] skipping query method \'' + name + '\' (' + source + '): the name is inherited on the ' + entityName + ' prototype chain (EventEmitter, entity base API, or gina\'s Object.prototype helpers like count()) — calls would run the inherited member instead. Rename the file, e.g. \'' + name + 'Rows.sql\'.');
+            }
+            return;
+        }
 
         // ── Parse the SQL file ────────────────────────────────────────────────
         var rawSource = fs.readFileSync(source).toString();

package/framework/{v0.6.0 → v0.6.1}/core/connectors/scylladb/index.js

@@ -157,7 +157,15 @@ function Scylladb(conn, infos) {
         }
 
         if (!entities[entityName]) return;
-        if (typeof entities[entityName].prototype[name] !== 'undefined') return;
+        if (typeof entities[entityName].prototype[name] !== 'undefined') {
+            // Own property = user code in the entity .js wins (designed intent).
+            // Inherited name = the file is silently shadowed (e.g. gina's
+            // Object.prototype count()) — warn so the skip is diagnosable (#B173).
+            if ( !Object.prototype.hasOwnProperty.call(entities[entityName].prototype, name) ) {
+                console.warn('[scylladb] skipping query method \'' + name + '\' (' + source + '): the name is inherited on the ' + entityName + ' prototype chain (EventEmitter, entity base API, or gina\'s Object.prototype helpers like count()) — calls would run the inherited member instead. Rename the file, e.g. \'' + name + 'Rows.sql\'.');
+            }
+            return;
+        }
 
         var rawSource = fs.readFileSync(source).toString();
 

package/framework/{v0.6.0 → v0.6.1}/core/connectors/sqlite/index.js

@@ -248,7 +248,15 @@ function Sqlite(conn, infos) {
         }
 
         if (!entities[entityName]) return; // entity not loaded — skip
-        if (typeof entities[entityName].prototype[name] !== 'undefined') return; // already defined
+        if (typeof entities[entityName].prototype[name] !== 'undefined') {
+            // Own property = user code in the entity .js wins (designed intent).
+            // Inherited name = the file is silently shadowed (e.g. gina's
+            // Object.prototype count()) — warn so the skip is diagnosable (#B173).
+            if ( !Object.prototype.hasOwnProperty.call(entities[entityName].prototype, name) ) {
+                console.warn('[sqlite] skipping query method \'' + name + '\' (' + source + '): the name is inherited on the ' + entityName + ' prototype chain (EventEmitter, entity base API, or gina\'s Object.prototype helpers like count()) — calls would run the inherited member instead. Rename the file, e.g. \'' + name + 'Rows.sql\'.');
+            }
+            return;
+        }
 
         // ── Parse the SQL file ────────────────────────────────────────────────
         var rawSource  = fs.readFileSync(source).toString();

package/framework/{v0.6.0 → v0.6.1}/core/connectors/sqlite/lib/connector.js

@@ -43,15 +43,13 @@ function SqliteConnector(conf) {
     var _err  = null;
 
     var init = function(conf) {
+        // Resolve the SQLite driver through the shared seam — node:sqlite on
+        // Node (>= 22.5.0), bun:sqlite behind an adapter on Bun. See lib/sqlite-driver.js.
         var DatabaseSync;
         try {
-            DatabaseSync = require('node:sqlite').DatabaseSync;
+            DatabaseSync = require('./../../../../lib/sqlite-driver').getDatabaseSync();
         } catch (e) {
-            _err = new Error(
-                '[SqliteConnector] node:sqlite requires Node.js >= 22.5.0. '
-                + 'Current: ' + process.version + '\n'
-                + e.message
-            );
+            _err = new Error('[SqliteConnector] ' + e.message);
             return;
         }
 

package/framework/{v0.6.0 → v0.6.1}/core/connectors/sqlite/lib/job-store.js

@@ -81,16 +81,14 @@ function noop() {}
 module.exports = function SqliteJobStore(connConf, bundle) {
     connConf = connConf || {};
 
-    // Require node:sqlite — available as a built-in since Node 22.5.0, zero npm deps.
+    // Resolve the SQLite driver through the shared seam — node:sqlite on
+    // Node (built-in since 22.5.0, zero npm deps), bun:sqlite behind an
+    // adapter on Bun. See lib/sqlite-driver.js.
     var DatabaseSync;
     try {
-        DatabaseSync = require('node:sqlite').DatabaseSync;
+        DatabaseSync = require('./../../../../lib/sqlite-driver').getDatabaseSync();
     } catch (e) {
-        throw new Error(
-            '[SqliteJobStore] node:sqlite requires Node.js >= 22.5.0. '
-            + 'Current: ' + process.version + '\n'
-            + e.message
-        );
+        throw new Error('[SqliteJobStore] ' + e.message);
     }
 
     // Resolve DB path: connectors.json `file` > default per-bundle file. The

package/framework/{v0.6.0 → v0.6.1}/core/connectors/sqlite/lib/session-store.js

@@ -91,16 +91,14 @@ module.exports = function(session, bundle) {
         var defaultDbPath = _(getPath('gina').home + '/sessions-' + bundle + '.db', true);
         var dbPath = options.database || connConf.database || defaultDbPath;
 
-        // Require node:sqlite — available as a built-in since Node 22.5.0, zero npm deps.
+        // Resolve the SQLite driver through the shared seam — node:sqlite on
+        // Node (built-in since 22.5.0, zero npm deps), bun:sqlite behind an
+        // adapter on Bun. See lib/sqlite-driver.js.
         var DatabaseSync;
         try {
-            DatabaseSync = require('node:sqlite').DatabaseSync;
+            DatabaseSync = require('./../../../../lib/sqlite-driver').getDatabaseSync();
         } catch(e) {
-            throw new Error(
-                '[SqliteStore] node:sqlite requires Node.js >= 22.5.0. '
-                + 'Current: ' + process.version + '\n'
-                + e.message
-            );
+            throw new Error('[SqliteStore] ' + e.message);
         }
 
         this.db = new DatabaseSync(dbPath);

package/framework/{v0.6.0 → v0.6.1}/core/controller/controller.render-json.js

@@ -197,8 +197,17 @@ module.exports = function renderJSON(jsonObj, deps) {
 
 
         //catching errors
+        // #B172 rider — the errno half carries the same statusCodes[...] guard as
+        // its render-swig/render-v1 siblings: an errno-only payload (no usable
+        // `status`) used to enter the branch and assign statusCode = undefined,
+        // which the HTTP/1.1 response.end() below rejects (the empty catch then
+        // swallows it — the response was never sent) and the HTTP/2 statusCode
+        // setter throws on. Guarded, such a payload is served as a normal 200
+        // with the payload in the body — measured wire-identical to dropping
+        // the errno clause on every input.
         if (
             typeof(jsonObj.errno) != 'undefined' && response.statusCode == 200
+                && typeof(local.options.conf.server.coreConfiguration.statusCodes[jsonObj.status]) != 'undefined'
             ||
             typeof(jsonObj.status) != 'undefined' && jsonObj.status != 200
                 && typeof(local.options.conf.server.coreConfiguration.statusCodes[jsonObj.status]) != 'undefined'
@@ -519,7 +528,14 @@ module.exports = function renderJSON(jsonObj, deps) {
             if (!stream.headersSent) {
                 var _streamHeaders = {
                     'content-type': local.options.conf.server.coreConfiguration.mime['json'] + '; charset='+ local.options.conf.encoding,
-                    ':status': 200
+                    // #B172 — honour the status resolved above (jsonObj.status →
+                    // response.statusCode). This frame is built for the raw
+                    // stream.respond(), which bypasses the compat layer, and the
+                    // pending-header merge below cannot supply `:status`
+                    // (setHeader(':status', …) throws ERR_HTTP2_PSEUDOHEADER_NOT_ALLOWED)
+                    // — so a literal here silently served every JSON error as 200.
+                    // Matches the HEAD branch above and the swig/nunjucks delegates.
+                    ':status': response.statusCode || 200
                 };
                 if (_cc) _streamHeaders['cache-control'] = _cc;
                 // Merge response headers pre-set earlier in the pipeline (e.g. CORS headers

package/framework/{v0.6.0 → v0.6.1}/core/model/entity.js

@@ -451,9 +451,14 @@ function EntitySuper(conn, caller, injected) {
     }
 
     var setListener = function() {
-        arguments = arguments[0];
-
-        var args = Array.prototype.slice.call(arguments);
+        // Bun/JSC rejects assigning to `arguments` outright ("Invalid assignment
+        // target"), where V8 permits it in sloppy mode. `_args` carries what the
+        // reassignment used to put in `arguments` — but ONLY this scope's own reads
+        // are rewritten: the `arguments` inside the nested `.on(evt, function(){...})`
+        // callbacks below refer to each CALLBACK's own arguments and must stay as-is.
+        var _args = arguments[0];
+
+        var args = Array.prototype.slice.call(_args);
         var trigger = args.splice(0, 1)[0];
 
         if ( !/\#/.test(trigger) ) {

package/framework/{v0.6.0 → v0.6.1}/core/model/template/index.js

@@ -75,7 +75,7 @@ Model = function(namespace){
                 //console.log("CONF READY ", model, conf.path/** conf*/);
                 //TODO - More tries & catches...
                 //Getting Entities Manager.
-                var entitiesManager = new require(conf.path)();
+                var entitiesManager = require(conf.path)();
                 //var Entities = entitiesManager[model];
 
                 //For now, I just need the F..ing entity name.

package/framework/{v0.6.0 → v0.6.1}/core/plugins/lib/validator/src/form-validator.js

@@ -166,6 +166,42 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
      * @type {Object.<string, boolean>}
      */
     var _labelWarnings = {};
+    /**
+     * #B178 — errors-key / label-key alias fill for app-supplied labels.
+     *
+     * Four rule families consult a SPECIFIC label key while writing the error
+     * under a GENERIC one (the NaN branch of the float coercion, and the
+     * min/max variants of the three Length families), so the key an app can
+     * OBSERVE in a field's `errors` object is not the key the catalog is
+     * consulted under — translating the observable key was a silent no-op.
+     * This copies each app-supplied generic onto the specifics the app did
+     * not supply itself. English defaults are never touched here; an
+     * app-supplied specific key always wins over its generic.
+     * @inner
+     * @param {object} labels - app-supplied label map (extended in place)
+     * @returns {object} the same map, alias keys filled
+     */
+    var _labelAliasFill = function(labels) {
+        // consulted (specific) key <- supplied (observable/generic) key
+        var aliasMap = {
+            'toFloatNAN'         : 'toFloat',
+            'isNumberMinLength'  : 'isNumberLength',
+            'isNumberMaxLength'  : 'isNumberLength',
+            'isIntegerMinLength' : 'isIntegerLength',
+            'isIntegerMaxLength' : 'isIntegerLength',
+            'isStringMinLength'  : 'isStringLength',
+            'isStringMaxLength'  : 'isStringLength'
+        };
+        for (var specific in aliasMap) {
+            if (
+                typeof(labels[specific]) == 'undefined'
+                && typeof(labels[aliasMap[specific]]) != 'undefined'
+            ) {
+                labels[specific] = labels[aliasMap[specific]];
+            }
+        }
+        return labels;
+    };
     local.errorLabels = _defaultErrorLabels;
     // #i18n (server) — resolve built-in rule labels from the bundle catalog's
     // `_validator.<rule>` namespace for the negotiated `culture`. Mirrors the client
@@ -184,7 +220,11 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                     if (_vFound && typeof(_vFound) === 'object') { _vNode = _vFound; break; }
                 }
             }
-            if (_vNode) { local.errorLabels = merge(JSON.clone(_vNode), _defaultErrorLabels); }
+            if (_vNode) {
+                // #B178 — fill consulted-key aliases from the app's observable keys first
+                _vNode = _labelAliasFill(JSON.clone(_vNode));
+                local.errorLabels = merge(JSON.clone(_vNode), _defaultErrorLabels);
+            }
         }
     }
     // #i18n (client) — overlay built-in rule labels for the negotiated culture.
@@ -217,9 +257,12 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         }
         // apply lowest-precedence layer first, then let each higher layer win per key
         if (_catalogLabels) {
+            // #B178 — alias fill on a copy, so the whispered config object is never mutated
+            _catalogLabels = _labelAliasFill(JSON.clone(_catalogLabels));
             local.errorLabels = merge(JSON.clone(_catalogLabels), local.errorLabels);
         }
         if (_cultureLabels) {
+            _cultureLabels = _labelAliasFill(JSON.clone(_cultureLabels));
             local.errorLabels = merge(JSON.clone(_cultureLabels), local.errorLabels);
         }
     }
@@ -1265,7 +1308,9 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             }
 
             if (!isValid) {
-                errors[alias] = replace(this.error || errorMessage || local.errorLabels[alias], this, alias);
+                // #B178 — numbered aliases (is1, is2, ...) have no per-alias default
+                // label: fall back to the shared base label instead of an empty message
+                errors[alias] = replace(this.error || errorMessage || local.errorLabels[alias] || local.errorLabels['is'], this, alias);
                 if ( typeof(errorStack) != 'undefined' )
                     errors['stack'] = errorStack;
             }
@@ -2182,8 +2227,13 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             try {
                 for (let v in gina.forms.validators) {
                     filename = '/validators/'+ v + '/main.js';
-                    // setting default local error
-                    local.errorLabels[v] = 'Condition not satisfied';
+                    // setting default local error — #B178: only when the app has not
+                    // already supplied one (catalog or setErrorLabels); the former
+                    // unconditional assignment clobbered app translations for every
+                    // user-validator key
+                    if ( typeof(local.errorLabels[v]) == 'undefined' ) {
+                        local.errorLabels[v] = 'Condition not satisfied';
+                    }
                     // converting Buffer to string
                     if ( isGFFCtx ) {
                         //userValidatorError = String.fromCharCode.apply(null, new Uint16Array(gina.forms.validators[v].data));
@@ -2404,8 +2454,25 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         return target
     }
 
+    /**
+     * Override error labels per rule key — an app-supplied key wins over the
+     * culture catalog and the English defaults for this validator instance.
+     *
+     * #B178 — the supplied map is alias-filled first, so translating an
+     * OBSERVABLE errors key (e.g. the float coercion's key, or a Length
+     * family's generic key) also covers the specific label keys the engine
+     * actually consults (its NaN variant, the min/max variants). A supplied
+     * specific key still wins over its generic. Note the passed object is
+     * extended in place (it already was, via the merge).
+     *
+     * @param {Object.<string, string>} errorLabels - rule key to label text
+     * @returns {void}
+     * @example
+     * validator.setErrorLabels({ toFloat: 'Doit etre un nombre valide' });
+     */
     self['setErrorLabels'] = function (errorLabels) {
         if ( typeof(errorLabels) != 'undefined') {
+            _labelAliasFill(errorLabels);
             local.errorLabels = merge(errorLabels, local.errorLabels)
         }
     }

package/framework/{v0.6.0 → v0.6.1}/core/plugins/lib/validator/src/main.js

@@ -163,7 +163,10 @@ function ValidatorPlugin(rules, data, formId, culture) {
     /**
      * XML Request - isGFFCtx only
      * */
-    var xhr         = null;
+    // #B175: no module-scope XHR anymore — send() creates a fresh LOCAL XHR
+    // per submit (see send()). The shared instance was the stale-handler
+    // replay vector: re-open()ing it fired the previous submit's handler.
+    // was: var xhr         = null;
     var xhrOptions  = {
         'url'               : '',
         'method'            : 'GET',
@@ -621,6 +624,29 @@ function ValidatorPlugin(rules, data, formId, culture) {
         return _live;
     };
 
+    /**
+     * #B178 — announcement text for a field's error container.
+     * The container renders one `<p>` per rule message; visually they stack as
+     * blocks, but `textContent` concatenates them with NO separator, so an
+     * aria-live announcement read multiple messages as one run-on string.
+     * Joins the per-message texts with '. ' instead; falls back to the raw
+     * `textContent` when the container has no `<p>` children.
+     * @inner
+     * @param {object} $err - the error-message container element
+     * @returns {string} announcement text
+     */
+    var getA11yAnnounceText = function($err) {
+        var $msgs = $err.getElementsByTagName('p');
+        if ( !$msgs.length ) {
+            return $err.textContent;
+        }
+        var parts = [];
+        for (var m = 0, mLen = $msgs.length; m < mLen; ++m) {
+            parts.push($msgs[m].textContent);
+        }
+        return parts.join('. ');
+    };
+
     /**
      * handleErrorsDisplay
      * Attention: if you are going to handle errors display by hand, set data to `null` to prevent Toolbar refresh with empty data
@@ -798,9 +824,14 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 }
 
                 // injecting error messages
+                // #B178 — two rules can carry byte-identical message text (e.g. a
+                // coercion paired with its validator); render each distinct text once.
+                // Dev bookkeeping below still records every key.
+                var _renderedMsgs = {};
                 for (var e in errors[name]) {
 
-                    if (e != 'stack') { // ignore stack for display
+                    if (e != 'stack' && typeof(_renderedMsgs[ errors[name][e] ]) == 'undefined') { // ignore stack for display
+                        _renderedMsgs[ errors[name][e] ] = true;
                         $msg = document.createElement('p');
                         $msg.appendChild( document.createTextNode(errors[name][e]) );
                         $err.appendChild($msg);
@@ -838,7 +869,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     && $err
                     && $el !== document.activeElement
                 ) {
-                    announceA11yError($form, $err.textContent);
+                    announceA11yError($form, getA11yAnnounceText($err));
                 }
 
             } else if (
@@ -931,8 +962,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         //         rule: errorMsg
                         //     }
                         // }
+                        // #B178 — distinct-text dedup, parity with the first-error branch
+                        var _renderedMsgs = {};
                         for (var e in errors[name]) {
-                            if (e != 'stack') { // ignore stack for display (parity with the first-error branch, #B89)
+                            if (e != 'stack' && typeof(_renderedMsgs[ errors[name][e] ]) == 'undefined') { // ignore stack for display (parity with the first-error branch, #B89)
+                                _renderedMsgs[ errors[name][e] ] = true;
                                 $msg = document.createElement('p');
                                 $msg.appendChild( document.createTextNode(errors[name][e]) );
                                 $err.appendChild($msg);
@@ -973,7 +1007,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     && $err
                     && $el !== document.activeElement
                 ) {
-                    announceA11yError($form, $err.textContent);
+                    announceA11yError($form, getA11yAnnounceText($err));
                 }
             }
 
@@ -1330,9 +1364,22 @@ function ValidatorPlugin(rules, data, formId, culture) {
         options.method  = method;
         options.url     = url;
 
-        if (!xhr) {
-            xhr = setupXhr(options);
-        }
+        // #B175: one XHR per send. The module-scope XHR (created once at
+        // validator init) was reused for every submit, and re-open()ing a
+        // completed XHR synchronously replays the PREVIOUS submit's
+        // still-assigned `onreadystatechange` handler (readyState 4 → 1):
+        // that stale closure re-disabled the PREVIOUS form's submit trigger
+        // and re-stamped its `data-gina-form-loading`, with no release path
+        // (its readyState-4 release never comes — the handler is replaced
+        // right below). A fresh LOCAL XHR per send makes handler, state and
+        // lifecycle per-submit; nested handlers close over this local, never
+        // the module var (the file-removal path already does exactly this
+        // with `let xhr = setupXhr(...)`).
+        // was:
+        // if (!xhr) {
+        //     xhr = setupXhr(options);
+        // }
+        var xhr = setupXhr();
 
         // to upload, use `multipart/form-data` for `enctype`
         var enctype = $target.getAttribute('enctype') || options.headers['Content-Type'];
@@ -1395,6 +1442,26 @@ function ValidatorPlugin(rules, data, formId, culture) {
         }
 
         if (xhr) {
+            // #B175 fail-safe release: `loadend` fires on success, error,
+            // timeout and abort alike — the lock armed below (submit trigger
+            // disabled + `data-gina-form-loading`) must never outlive its
+            // request. Idempotent with the readyState-4 release; one listener
+            // per XHR (fresh per send), so nothing accumulates.
+            if ( typeof(xhr.addEventListener) == 'function' ) {
+                xhr.addEventListener('loadend', function onSendSettled() {
+                    $form.isSending = false;
+                    $form.sent = false;
+                    if ($submitTrigger) {
+                        // For A tag: aria-disabled=true
+                        if ( /^A$/i.test($submitTrigger.tagName) ) {
+                            $submitTrigger.removeAttribute('aria-disabled');
+                        } else {
+                            $submitTrigger.removeAttribute('disabled');
+                        }
+                    }
+                    $form.target.removeAttribute('data-gina-form-loading');
+                });
+            }
             // catching ready state cb
             // Data loading ...
             if ( /^(1|3)$/.test(xhr.readyState) ) {
@@ -1411,7 +1478,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
             //handleXhrResponse(xhr, $target, id, $form, hFormIsRequired);
             xhr.onreadystatechange = function onValidationCallback(event) {
                 $form.isSubmitting = false;
-                $form.isSending = false;
+                // #B175: `isSending` is no longer cleared here — this handler
+                // first fires at readyState 1 (synchronously at open()), so an
+                // early clear made the flag false for almost the whole request
+                // while its name promises "a request is in flight". It now
+                // spans send() → settled: cleared in the readyState-4 release
+                // below and in the `loadend` fail-safe above.
+                // was: $form.isSending = false;
 
                 // limit send trigger to 1 sec to prevent from double clicks
                 // setTimeout( function onSent() {
@@ -1445,6 +1518,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 if (xhr.readyState == 4) {
 
                     $form.sent = false;
+                    $form.isSending = false; // #B175 — see the note at the handler top
                     if ($submitTrigger) {
                         // For A tag: aria-disabled=true
                         if ( /^A$/i.test($submitTrigger.tagName) ) {
@@ -2048,7 +2122,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
                 $form.eventData.ontimeout = result;
 
-                $form.target.setAttribute('data-gina-form-loading', false);
+                // #B175: remove the attribute — `setAttribute(..., false)`
+                // wrote the string "false", which is attribute-PRESENT and
+                // truthy for any presence or non-empty-string check.
+                // was: $form.target.setAttribute('data-gina-form-loading', false);
+                $form.target.removeAttribute('data-gina-form-loading');
 
                 // intercept upload
                 if ( /^gina\-upload/i.test(id) ) {
@@ -3624,19 +3702,24 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 }
 
 
-                // setting up AJAX
-                if (window.XMLHttpRequest) { // Mozilla, Safari, ...
-                    xhr = new XMLHttpRequest();
-                } else if (window.ActiveXObject) { // IE
-                    try {
-                        xhr = new ActiveXObject("Msxml2.XMLHTTP");
-                    } catch (e) {
-                        try {
-                            xhr = new ActiveXObject("Microsoft.XMLHTTP");
-                        }
-                        catch (e) {}
-                    }
-                }
+                // #B175: no init-time XHR — send() creates a fresh local XHR
+                // per submit (setupXhr() carries the same browser fallbacks).
+                // This block was the source of the shared instance every
+                // submit then reused.
+                // was:
+                // // setting up AJAX
+                // if (window.XMLHttpRequest) { // Mozilla, Safari, ...
+                //     xhr = new XMLHttpRequest();
+                // } else if (window.ActiveXObject) { // IE
+                //     try {
+                //         xhr = new ActiveXObject("Msxml2.XMLHTTP");
+                //     } catch (e) {
+                //         try {
+                //             xhr = new ActiveXObject("Microsoft.XMLHTTP");
+                //         }
+                //         catch (e) {}
+                //     }
+                // }
 
 
 
@@ -6168,8 +6251,19 @@ function ValidatorPlugin(rules, data, formId, culture) {
         var updateSelect = function($el, $form) {
             $el.setAttribute('data-value', $el.value);
             // If Live check enabled, proceed to silent validation
+            // #B176: the `&&` used to sit INSIDE test() — an explicit
+            // `data-gina-form-live-check-enabled="false"` (a truthy string)
+            // short-circuited to the rules-count boolean, which stringifies
+            // to "true" and matched, so THIS gate ignored the opt-out.
+            // Scope (measured at the fix's parent): only this gate and the
+            // bindForm silent-validation gate were defective. The three
+            // registerForLiveChecking sites already tested the attribute
+            // alone, so an opted-out form never got text as-you-type — the
+            // pre-fix behaviour was an incoherent middle, not a wholesale
+            // ignore. Do not restate this as "the opt-out did nothing".
+            // was: /^(true)$/i.test($form.target.dataset.ginaFormLiveCheckEnabled && $form.rules.count() > 0)
             if (
-                /^(true)$/i.test($form.target.dataset.ginaFormLiveCheckEnabled && $form.rules.count() > 0)
+                /^(true)$/i.test($form.target.dataset.ginaFormLiveCheckEnabled) && $form.rules.count() > 0
                 // && typeof($form.isBeingReseted) == 'undefined'
             ) {
                 var localField = {}, $localField = {}, $localForm = null;
@@ -7471,7 +7565,16 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
         instance.$forms[_id]['binded']  = true;
         // If Live check enabled, proceed to silent validation
-        if ( /^(true)$/i.test($form.target.dataset.ginaFormLiveCheckEnabled && $form.rules.count() > 0) ) {
+        // #B176: same inside-test() `&&` defect as the change-handler gate —
+        // an explicit "false" opt-out still ran THIS bind-time silent
+        // validation pass (it did NOT enable text as-you-type; the three
+        // registerForLiveChecking sites were already strict). Note this gate
+        // also swallowed the `else if` below, which exists precisely to serve
+        // the opted-out case: the trigger still ended enabled either way,
+        // because updateSubmitTriggerState forces its show branch when
+        // live-check is off. See the scope note at the sibling site.
+        // was: if ( /^(true)$/i.test($form.target.dataset.ginaFormLiveCheckEnabled && $form.rules.count() > 0) ) {
+        if ( /^(true)$/i.test($form.target.dataset.ginaFormLiveCheckEnabled) && $form.rules.count() > 0 ) {
             console.debug('silent validation mode on');
             var validationInfo  = getFormValidationInfos($form.target, $form.rules);
             var fields          = validationInfo.fields;
@@ -7504,7 +7607,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
     var updateSubmitTriggerState = function($formInstanceOrTarget, isFormValid) {
         //console.debug('submitTrigger[isFormValid='+ isFormValid +']: ', $formInstance.submitTrigger)
-        $formInstance = null;
+        var $formInstance = null; // #B176: was an implicit global (undeclared assignment)
         if ( $formInstanceOrTarget instanceof HTMLFormElement ) { //  is target DOMobject
             var id = $formInstanceOrTarget.getAttribute('id');
             $formInstance =  instance.$forms[id];

package/framework/{v0.6.0 → v0.6.1}/core/server.isaac.js

@@ -4,6 +4,7 @@
  */
 const fs                    = require('fs');
 const crypto                = require('crypto');
+const nodePath              = require('path'); // #B179: used for path-traversal boundary enforcement
 const { execSync, exec }    = require('child_process');
 const {EventEmitter}        = require('events');
 // #B10 fix: engine.io is only needed when options.ioServer is configured (WebSocket support).
@@ -163,6 +164,43 @@ function _readInstrumentBody(req, cb) {
     req.on('error', function(e) { _finish(e); });
 }
 
+/**
+ * Confines a resolved filename to its intended base directory, rejecting
+ * path-traversal escapes (`../`) that would otherwise canonicalise outside it.
+ * Both paths are normalised with `path.resolve`, then a separator-aware
+ * containment check is applied so a base of `/srv/app/lib` cannot be bypassed
+ * by a sibling such as `/srv/app/lib-secrets`. Purely lexical (no symlink
+ * following).
+ *
+ * Engine-local mirror of the canonical `confineToBase` in `core/server.js`
+ * (declared inside `Server()`, so it is not reachable from this module). Keep
+ * the two behaviourally identical — `test/core/server-static-traversal.test.js`
+ * extracts the server.js copy by its declaration string and drives it directly,
+ * and `test/core/inspector-traversal.test.js` does the same for this one.
+ *
+ * @inner
+ * @private
+ * @memberof module:gina/core/server.isaac
+ * @param {string} filename - The concatenated candidate filesystem path
+ * @param {string} base     - The intended base directory
+ * @returns {string|null} The canonical in-base path, or `null` when it escapes `base`
+ * @example
+ * confineToBase('/srv/app/js/lib/../../../config/secret.json', '/srv/app/js/lib'); // → null
+ * confineToBase('/srv/app/js/lib/app.js', '/srv/app/js/lib');                      // → '/srv/app/js/lib/app.js'
+ */
+var confineToBase = function(filename, base) {
+    if ( typeof(filename) != 'string' || typeof(base) != 'string' || base.length === 0 ) {
+        return null;
+    }
+    var _resolvedBase = nodePath.resolve(base);
+    var _resolvedFile = nodePath.resolve(filename);
+    // separator-aware containment: identical to base, or a proper child of it
+    if ( _resolvedFile === _resolvedBase || _resolvedFile.indexOf(_resolvedBase + nodePath.sep) === 0 ) {
+        return _resolvedFile;
+    }
+    return null;
+}
+
 /**
  * Reloads all core and lib modules from disk by replacing their require.cache
  * entries with fresh exports. Excludes gna.js itself. Also refreshes the
@@ -1624,7 +1662,15 @@ function ServerEngineClass(options) {
                 var _inspExt  = _inspPath.split('.').pop();
                 var _inspFile = _(_inspBase + '/' + _inspPath, true);
 
-                if (fs.existsSync(_inspFile)) {
+                // #B179 — reject any path that canonicalises outside the Inspector
+                // asset root, BEFORE any fs access. `_inspPath` is taken straight
+                // off `request.url` with no `..` handling, and `_()` NORMALISES
+                // traversal (helpers/path.js:87) rather than rejecting it — so a
+                // request-target carrying a literal `..` otherwise resolves to any
+                // absolute path the bundle process can read. Falls through to the
+                // same 404 as a missing file — no distinct signal. Mirrors the #B64
+                // static-resolver guard in server.js.
+                if (confineToBase(_inspFile, _inspBase) !== null && fs.existsSync(_inspFile)) {
                     var _inspBinary = /^(woff2?|png|ico|gif|jpe?g)$/.test(_inspExt);
                     var _inspHeaders = _setPoweredByHeader({
                         'content-type': _inspMime[_inspExt] || 'application/octet-stream',