gina 0.6.22 → 0.6.23

package/framework/{v0.6.22 → v0.6.23}/core/controller/controller.js

@@ -1444,15 +1444,22 @@ function SuperController(options) {
     }
 
     /**
-     * Get node resources
+     * Get node resources — builds the `<link>` (css) / `<script>` (js) tag
+     * string for the view's declared assets.
      *
-     * @param {string} type
-     * @param {string} resStr
+     * #OW3 — when the bundle opted in via templates.json `"sriEnabled": true`,
+     * every same-origin asset that resolves to a readable file on disk gets an
+     * `integrity="sha384-..." crossorigin="anonymous"` attribute pair
+     * (computed by lib/sri, fail-open), and its HTTP/2 preload hint is
+     * suppressed (the hint carries no integrity metadata, so a hinted fetch
+     * could not be matched to the integrity-checked consumer).
+     *
+     * @param {string} type - `'css'` or `'js'`
      * @param {array} resArr
      * @param {boolean} useWebroot
      * @param {string} webrootStr - Webroot string prefix for startsWith check (#P1)
      *
-     * @returns {object} content
+     * @returns {string} tag string to inject into the layout
      *
      * @private
      * */
@@ -1488,6 +1495,13 @@ function SuperController(options) {
             hostname = local.options.conf.hostname
         }
 
+        // #OW3 — opt-in Subresource Integrity (templates.json `"sriEnabled": true`).
+        // Attribute computation is fully delegated to lib/sri, which is
+        // fail-open by design: an asset that cannot be honestly hashed
+        // (external URL, unresolvable path, unreadable file) simply gets no
+        // integrity attribute and loads exactly as before.
+        var sriEnabled = (local.options.template.sriEnabled) ? true : false;
+
 
         if (
             isProxyHost
@@ -1514,10 +1528,18 @@ function SuperController(options) {
                     if (useWebroot && !obj.url.startsWith(webrootStr) ) {
                         obj.url = local.options.conf.server.webroot + obj.url.substring(1);
                     }
+                    // #OW3 — SRI attribute pair for same-origin disk-resolvable
+                    // assets when the bundle opted in; '' otherwise (fail-open).
+                    var sriAttributes = (sriEnabled) ? lib.sri.getIntegrityAttributes(obj.url, local.options.conf, local.options.conf.server.webroot) : '';
                     // HTTP2 Push via Link
                     if (
                         /http\/2/.test(local.options.conf.server.protocol)
                         && !self.isCacheless()
+                        // #OW3 — no preload hint for an SRI'd asset: the hint
+                        // carries no integrity metadata, so a hinted fetch may
+                        // not match the integrity-checked consumer and would
+                        // then be a wasted double-fetch.
+                        && !sriAttributes
                     ) {
                         local.options.template.h2Links += '<'+ obj.url +'>; as=style; rel=preload,'
                     }
@@ -1528,9 +1550,9 @@ function SuperController(options) {
                     // }
 
                     if (obj.media) {
-                        str += '\n\t\t<link href="'+ obj.url +'" media="'+ obj.media +'" rel="'+ obj.rel +'" type="'+ obj.type +'">';
+                        str += '\n\t\t<link href="'+ obj.url +'" media="'+ obj.media +'" rel="'+ obj.rel +'" type="'+ obj.type +'"'+ sriAttributes +'>';
                     } else {
-                        str += '\n\t\t<link href="'+ obj.url +'" rel="'+ obj.rel +'" type="'+ obj.type +'">';
+                        str += '\n\t\t<link href="'+ obj.url +'" rel="'+ obj.rel +'" type="'+ obj.type +'"'+ sriAttributes +'>';
                     }
                 }
                 break;
@@ -1543,10 +1565,18 @@ function SuperController(options) {
                     if (useWebroot && !obj.url.startsWith(webrootStr) ) {
                         obj.url = local.options.conf.server.webroot + obj.url.substring(1);
                     }
+                    // #OW3 — SRI attribute pair for same-origin disk-resolvable
+                    // assets when the bundle opted in; '' otherwise (fail-open).
+                    var sriAttributes = (sriEnabled) ? lib.sri.getIntegrityAttributes(obj.url, local.options.conf, local.options.conf.server.webroot) : '';
                     // HTTP2 Push via Link
                     if (
                         /http\/2/.test(local.options.conf.server.protocol)
                         && !self.isCacheless()
+                        // #OW3 — no preload hint for an SRI'd asset: the hint
+                        // carries no integrity metadata, so a hinted fetch may
+                        // not match the integrity-checked consumer and would
+                        // then be a wasted double-fetch.
+                        && !sriAttributes
                     ) {
                         local.options.template.h2Links += '<'+ obj.url +'>; as=script; rel=preload,'
                     }
@@ -1564,11 +1594,11 @@ function SuperController(options) {
                     if (
                         obj.isExternalPlugin
                     ) {
-                        local.options.template.externalPlugins.splice(1, 0, '\n\t\t<script'+ deferMode +' type="'+ obj.type +'" src="'+ obj.url +'"></script>');
+                        local.options.template.externalPlugins.splice(1, 0, '\n\t\t<script'+ deferMode +' type="'+ obj.type +'" src="'+ obj.url +'"'+ sriAttributes +'></script>');
                     }
                     else {
                         // normal case
-                        str += '\n\t\t<script'+ deferMode +' type="'+ obj.type +'" src="'+ obj.url +'"></script>';
+                        str += '\n\t\t<script'+ deferMode +' type="'+ obj.type +'" src="'+ obj.url +'"'+ sriAttributes +'></script>';
                     }
                 }
                 break;

package/framework/{v0.6.22 → v0.6.23}/core/controller/controller.render-nunjucks.js

@@ -122,6 +122,7 @@
 
 var fs              = require('fs');
 var nodePath        = require('path');
+var inlineScript      = require('./inline-script');
 var inspectorRedact = require('lib/inspector-redact');
 // #INS10 follow-up — prod-window HTML egress (no-HTML, render-json-style emit).
 var emitInspectorWindowData = require('./inspector-window-emit');
@@ -450,16 +451,16 @@ function injectInspectorScripts(html, data, self, local, displayInspector) {
     // `</script>` and `<!--` must be escaped inside JSON-serialised script
     // content so the browser's HTML parser doesn't terminate the tag early
     // or start an HTML comment. Matches render-swig.js:1096-1097.
-    var _safeJson = JSON.stringify(__gdPayload)
-        .replace(/<\/script>/gi, '<\\/script>')
-        .replace(/<!--/g, '<\\!--');
+    // #B451 - see controller.render-swig.js: the blocklist this replaces was
+    // bypassable by a trailing space or slash after the script tag name.
+    var _safeJson = inlineScript.safeInlineJson(__gdPayload);
 
     var __gdScript   = '<script' + _cspNonceAttr + '>window.__ginaData = ' + _safeJson + ';</script>\n';
     var _bundleName  = (__gdUser.environment && __gdUser.environment.bundle) || '';
     var __logsScript = '<script' + _cspNonceAttr + '>'
         + 'window.__ginaLogs = window.__ginaLogs || [];'
         + '(function(w){'
-        + 'var _c=w.console,_l=w.__ginaLogs,_b=' + JSON.stringify(_bundleName) + ';'
+        + 'var _c=w.console,_l=w.__ginaLogs,_b=' + inlineScript.safeInlineString(_bundleName) + ';'
         + '["log","info","warn","error","debug"].forEach(function(lvl){'
         + 'var orig=_c[lvl].bind(_c);'
         + '_c[lvl]=function(){'
@@ -1437,7 +1438,7 @@ module.exports = async function renderNunjucks(userData, displayInspector, errOp
                 ? Date.now() - local._timeline.requestStart
                 : null;
             var _njFlowPatch = (_njLateEntries.length > 0)
-                ? 'if(u&&u.flow){var _e=u.flow.entries,_p=' + JSON.stringify(_njLateEntries) + ';for(var _i=0;_i<_p.length;_i++){_e.push(_p[_i])}}'
+                ? 'if(u&&u.flow){var _e=u.flow.entries,_p=' + inlineScript.safeInlineJson(_njLateEntries) + ';for(var _i=0;_i<_p.length;_i++){_e.push(_p[_i])}}'
                 : '';
             var _njPatchScript = '<script' + _cspNonceAttr + '>(function(d){'
                 + 'var u=d&&d.user,g=d&&d.gina;'

package/framework/{v0.6.22 → v0.6.23}/core/controller/controller.render-swig.js

@@ -12,6 +12,7 @@ const cache           = new lib.Cache();
 const renderCache     = new lib.RenderCache();
 var statusCodes       = requireJSON( _( getPath('gina').core + '/status.codes') );
 // Inspector secret redaction (dev-mode only — never touches the actual response body)
+var inlineScript      = require('./inline-script');
 var inspectorRedact   = require('lib/inspector-redact');
 // #INS10 follow-up — prod-window HTML egress (no-HTML, render-json-style emit).
 var emitInspectorWindowData = require('./inspector-window-emit');
@@ -1157,7 +1158,7 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                         var _cacheWeightBytes = Buffer.byteLength(htmlContent, 'utf8');
                         var _cacheServerMsFinal = _cacheRespEnd - local._timeline.requestStart;
                         var _cacheFlowPatch = (_cacheLateEntries.length > 0)
-                            ? 'if(u&&u.flow){var _e=u.flow.entries,_p=' + JSON.stringify(_cacheLateEntries) + ';for(var _i=0;_i<_p.length;_i++){_e.push(_p[_i])}}'
+                            ? 'if(u&&u.flow){var _e=u.flow.entries,_p=' + inlineScript.safeInlineJson(_cacheLateEntries) + ';for(var _i=0;_i<_p.length;_i++){_e.push(_p[_i])}}'
                             : '';
                         var _cachePatchScript = '<script' + _cspNonceAttr + '>(function(d){'
                             + 'var u=d&&d.user,g=d&&d.gina;'
@@ -1510,9 +1511,12 @@ module.exports = async function render(userData, displayInspector, errOptions, d
             });
 
             var __gdScript = '<script' + _cspNonceTplAttr + '>window.__ginaData = '
-                + JSON.stringify(__gdPayload)
-                    .replace(/<\/script>/gi, '<\\/script>')
-                    .replace(/<!--/g, '<\\!--')
+                // #B451 - the previous blocklist here matched only the literal
+                // '</' + 'script>' and '<!--'. It was bypassable: a trailing space
+                // or slash after the tag name also closes the block per the HTML5
+                // script-data-end-tag-name state, and both injected when measured.
+                // The helper escapes '<' itself, so no terminator spelling survives.
+                + inlineScript.safeInlineJson(__gdPayload)
                 + ';</script>\n';
 
             // Expose last snapshot for engine.io push and /_gina/agent SSE
@@ -1528,7 +1532,7 @@ module.exports = async function render(userData, displayInspector, errOptions, d
             var __logsScript = '<script' + _cspNonceTplAttr + '>'
                 + 'window.__ginaLogs = window.__ginaLogs || [];'
                 + '(function(w){'
-                + 'var _c=w.console,_l=w.__ginaLogs,_b="' + (__gdUser.environment && __gdUser.environment.bundle || '') + '";'
+                + 'var _c=w.console,_l=w.__ginaLogs,_b=' + inlineScript.safeInlineString(__gdUser.environment && __gdUser.environment.bundle || '') + ';'
                 + '["log","info","warn","error","debug"].forEach(function(lvl){'
                 + 'var orig=_c[lvl].bind(_c);'
                 + '_c[lvl]=function(){'
@@ -1980,7 +1984,7 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                         var _weightBytesFinal = Buffer.byteLength(htmlContent, 'utf8');
                         var _serverMsFinal    = _respEnd - local._timeline.requestStart;
                         var _flowPatch = (_lateEntries.length > 0)
-                            ? 'if(u&&u.flow){var _e=u.flow.entries,_p=' + JSON.stringify(_lateEntries) + ';for(var _i=0;_i<_p.length;_i++){_e.push(_p[_i])}}'
+                            ? 'if(u&&u.flow){var _e=u.flow.entries,_p=' + inlineScript.safeInlineJson(_lateEntries) + ';for(var _i=0;_i<_p.length;_i++){_e.push(_p[_i])}}'
                             : '';
                         var _patchScript = '<script' + _cspNonceAttr + '>(function(d){'
                             + 'var u=d&&d.user,g=d&&d.gina;'

package/framework/v0.6.23/core/controller/inline-script.js

@@ -0,0 +1,108 @@
+/**
+ * Safe serialisation of server-side data into an inline `<script>` block.
+ *
+ * ## Why this module exists
+ *
+ * A value serialised into an inline script is not in HTML text context — it is in
+ * *script data* context, where the HTML tokenizer scans for a script-data end tag
+ * and hands everything before it to the JS parser. HTML-escaping is therefore the
+ * WRONG tool (it would corrupt the JSON); the right one is to make the `<`
+ * character incapable of starting any tag-like sequence at all.
+ *
+ * ## Why `<` rather than a `</script>` blocklist
+ *
+ * The previous guard was two `.replace()` calls matching the literal `</script>`
+ * and `<!--`. That is a blocklist, and it was incomplete: per the HTML5
+ * *script data end tag name state*, the tag name may be followed by TAB, LF, FF,
+ * SPACE or `/` as well as `>`. Measured with a spec-compliant parser, both
+ * `</script >` and `</script/>` terminated the block and injected, while the
+ * blocklist let them through untouched — including at the one site that was
+ * considered protected.
+ *
+ * Escaping `<` itself is allowlist-shaped: it neutralises `</script` in every
+ * spelling, `<!--`, and a nested `<script` opener in one step, and cannot be
+ * defeated by a terminator variant nobody enumerated. `<` is a valid JSON
+ * escape, so the emitted text still `JSON.parse`s back to a byte-identical value
+ * (measured across every payload shape in the regression suite).
+ *
+ * U+2028 / U+2029 are additionally escaped: they are legal inside a JSON string
+ * but were line terminators to the JS parser before ES2019, so an unescaped one
+ * turns a valid payload into a `SyntaxError`. (This is not theoretical — a literal
+ * U+2028 in the probe written to verify this module crashed the parser reading it.)
+ *
+ * @module core/controller/inline-script
+ */
+'use strict';
+
+/**
+ * U+2028 LINE SEPARATOR / U+2029 PARAGRAPH SEPARATOR.
+ * Built with `RegExp` + `String.fromCharCode` rather than regex literals so that
+ * this source file never contains the raw characters — a literal one here would
+ * be a line terminator to some parsers reading this very file.
+ *
+ * @constant {RegExp}
+ * @private
+ */
+var RE_LINE_SEPARATOR      = new RegExp(String.fromCharCode(0x2028), 'g');
+/** @constant {RegExp} @private */
+var RE_PARAGRAPH_SEPARATOR = new RegExp(String.fromCharCode(0x2029), 'g');
+/** @constant {RegExp} @private */
+var RE_LT                  = /</g;
+
+/**
+ * Escape an already-serialised JS/JSON string literal so it is safe to emit inside
+ * an inline `<script>` block. Operates on TEXT, not on a value — use
+ * {@link safeInlineJson} unless you have already stringified.
+ *
+ * @param {string} text - serialised JS source text (typically `JSON.stringify` output)
+ * @returns {string} the same text with `<` and the JS line separators escaped
+ *
+ * @example
+ * escapeForInlineScript('{"a":"x</script >y"}');
+ * // => '{"a":"x\\u003c/script >y"}'
+ */
+function escapeForInlineScript(text) {
+    return String(text)
+        .replace(RE_LT, '\\u003c')
+        .replace(RE_LINE_SEPARATOR, '\\u2028')
+        .replace(RE_PARAGRAPH_SEPARATOR, '\\u2029');
+}
+
+/**
+ * Serialise a value to JSON that is safe to embed in an inline `<script>`.
+ * This is the function every emission site should use.
+ *
+ * @param {*} value - any JSON-serialisable value
+ * @returns {string} JSON text that cannot break out of a script block
+ *
+ * @example
+ * var payload = { client: { fullname: 'Zed</script ><img src=y onerror=1>' } };
+ * '<script>window.__ginaData = ' + safeInlineJson(payload) + ';</script>';
+ * // the injected markup is inert, and JSON.parse returns the original string
+ */
+function safeInlineJson(value) {
+    return escapeForInlineScript(JSON.stringify(value));
+}
+
+/**
+ * Serialise a single string as a safe JS string LITERAL (quotes included) for
+ * interpolation into inline script source.
+ *
+ * Use this instead of hand-writing `'"' + str + '"'`: that form breaks on an
+ * embedded quote or backslash regardless of any script-terminator concern.
+ *
+ * @param {string} str - the string to embed
+ * @returns {string} a quoted, escaped JS string literal
+ *
+ * @example
+ * 'var _b=' + safeInlineString(bundleName) + ';'
+ */
+function safeInlineString(str) {
+    return escapeForInlineScript(JSON.stringify(String(str == null ? '' : str)));
+}
+
+module.exports = {
+    escapeForInlineScript : escapeForInlineScript,
+    safeInlineJson        : safeInlineJson,
+    safeInlineString      : safeInlineString
+};

package/framework/{v0.6.22 → v0.6.23}/core/server.isaac.js

@@ -1049,6 +1049,19 @@ function ServerEngineClass(options) {
             if (!options.hidePoweredBy) {
                 headers['X-Powered-By'] = 'Gina/' + GINA_VERSION;
             }
+            // #OW1 — engine-agnostic security headers (OWASP A02), applied at the
+            // SAME writeHead sites this helper already backs. writeHead commits
+            // headers directly, bypassing setHeader, so the core/server.js twin
+            // cannot reach them — this is the isaac half of ONE shared emitter
+            // (lib/security-headers-emitter), not a drifting copy.
+            // Every call site of this helper is a /_gina/* endpoint (measured
+            // 29/29), and those are deliberately cross-origin — the metrics /
+            // health / SSE handlers emit `access-control-allow-origin: *` and the
+            // Inspector's cross-origin GET/SSE channels are a documented design —
+            // so the cross-origin-isolating headers (coop/corp) are exempted here
+            // unconditionally. Signature deliberately unchanged: no call site
+            // needs editing.
+            headers = lib.securityHeadersEmitter.applyToGinaEndpointHeaders(options.securityHeaders, headers);
             return headers;
         };
 

package/framework/{v0.6.22 → v0.6.23}/core/server.js

@@ -119,6 +119,49 @@ var _mintErrorRef = function(supplied) {
 // the logger's own failure modes — which also means it bypasses log redaction
 // (#B433): keep messages free of URLs and credentials. Format changes must
 // preserve `] [debug  ][gina:` — test/core/debug-log.test.js pins the contract.
+/**
+ * #OW2 — parse a byte-size setting (`"64MB"`, `"512KB"`, `"2048B"`) into bytes.
+ *
+ * Deliberately SEPARATE from the multipart `parseSize` helper inside the upload
+ * branch, which this arc does not touch: that helper sits on the upload path and
+ * carries its own source pins, and refactoring a working path as a side-effect of
+ * adding a body cap is the "while I'm here" shape that produced the #B446
+ * follow-up regression. The two agree by construction on every unit and are pinned
+ * against each other in `test/core/body-size-cap.test.js` so they cannot drift;
+ * unifying them belongs to a future upload/merge arc (#B457).
+ *
+ * Bare numbers are MB for back-compat with the multipart convention.
+ *
+ * @param {string|number} value - e.g. `"64MB"`, `"512KB"`, `2` (= 2MB)
+ * @returns {number} bytes, or NaN when unparseable
+ * @private
+ * @example
+ * parseByteSize('64MB');  // 67108864
+ * parseByteSize('512KB'); // 524288
+ * parseByteSize(2);       // 2097152
+ */
+var parseByteSize = function(value) {
+    if ( typeof(value) == 'number' ) { return value * 1024 * 1024; } // bare number = MB
+    if ( typeof(value) != 'string' ) { return NaN; }
+    var m = value.trim().match(/^([0-9]*\.?[0-9]+)\s*(b|kb|k|mb|m|gb|g)?$/i);
+    if ( !m ) { return NaN; }
+    var n = parseFloat(m[1]);
+    switch ( (m[2] || 'mb').toLowerCase() ) {
+        case 'b':
+            return n;
+        case 'k':
+        case 'kb':
+            return n * 1024;
+        case 'g':
+        case 'gb':
+            return n * 1024 * 1024 * 1024;
+        case 'm':
+        case 'mb':
+        default:
+            return n * 1024 * 1024;
+    }
+};
+
 var _isDebugLog = function() {
     return process.env.LOG_LEVEL === 'debug' || process.env.LOG_LEVEL === 'trace';
 };
@@ -4380,6 +4423,23 @@ function Server(options) {
                 response.setHeader('X-Powered-By', 'Gina/'+ GINA_VERSION );
             }
 
+            // #OW1 — engine-agnostic security headers (OWASP A02). Placed beside
+            // the hidePoweredBy gate because it needs the SAME coverage: routed
+            // responses, static-asset serves, static/traversal 404s and framework
+            // error pages, none of which traverse the express middleware chain —
+            // and on the default isaac engine NOTHING traverses it (measured: the
+            // only consumer of server._expressMiddlewares is the WS session
+            // binder, name-filtered, against an inert response). The isaac
+            // writeHead sites are covered by the twin call inside
+            // _setPoweredByHeader(). First-writer-wins inside the emitter, so an
+            // explicitly mounted #HDR plugin or an env.json
+            // `server.response.header` entry always wins.
+            lib.securityHeadersEmitter.applyToResponse(
+                self.conf[self.appName][self.env].server.securityHeaders,
+                request,
+                response
+            );
+
             // MS1 — echo the always-on correlation id on every response so a
             // caller / LB / APM can read it back (the read-side of X-Request-Id
             // propagation). Ungated (independent of log format) and guarded
@@ -6246,7 +6306,58 @@ function Server(options) {
                 } else {
 
 
+                    // #OW2 — bound the non-multipart body accumulation (OWASP A10).
+                    // The accumulator below is the ONLY unbounded growth on the request
+                    // path: multipart is capped by busboy + maxFieldsSize, but a plain
+                    // JSON/urlencoded body grew until the process died. Counting the RAW
+                    // chunk bytes (not the decoded string length) is what a cap has to
+                    // measure — a multi-byte UTF-8 body is larger on the wire than its
+                    // string length suggests.
+                    //
+                    // Two thresholds, deliberately:
+                    //  - `server.maxBodySize` ENFORCES (413 + destroy). Defaults to a
+                    //    permissive 64MB: the ceiling exists to stop unbounded growth,
+                    //    not to police payload shapes, and the framework's OWN
+                    //    inter-bundle `self.query()` hop posts through this same pipeline
+                    //    with no size contract — a tight enforced default would break
+                    //    gina with gina, in a shape that reads as a consumer bug.
+                    //  - `server.maxBodySizeWarn` only WARNS (default 2MB), so every
+                    //    consumer measures their real distribution from their own logs
+                    //    before a stricter ceiling is ever considered. Precedent: the
+                    //    #B238 warn-not-flip disclosure gate.
+                    // `0` / unset / unparseable disables either threshold (the
+                    // maxFieldsSize convention — an invalid cap must not reject
+                    // everything).
+                    var _bodySrv      = ( self.conf[self.appName][self.env].server || {} );
+                    var _maxBody      = parseByteSize(_bodySrv.maxBodySize);
+                    var _maxBodyWarn  = parseByteSize(_bodySrv.maxBodySizeWarn);
+                    var _bodyBytes    = 0;
+                    var _bodyWarned   = false;
+                    var _bodyRejected = false;
+
                     request.on('data', function(chunk){ // for this to work, don't forget the name attr for you form elements
+                        if ( _bodyRejected ) { return }
+
+                        _bodyBytes += chunk.length;
+
+                        if ( _maxBodyWarn > 0 && !_bodyWarned && _bodyBytes > _maxBodyWarn ) {
+                            _bodyWarned = true;
+                            // No URL, no body content — #B433 keeps log lines free of
+                            // request data; the method + byte count is the actionable part.
+                            console.warn('[ SERVER ] Request body exceeded server.maxBodySizeWarn ('
+                                + _bodySrv.maxBodySizeWarn + ') — '+ request.method +' body is over '
+                                + _maxBodyWarn +' bytes and still accumulating. Not rejected.');
+                        }
+
+                        if ( _maxBody > 0 && _bodyBytes > _maxBody ) {
+                            _bodyRejected = true;
+                            request.body  = '';
+                            throwError(response, 413, 'Request body exceeded maximum size [ '+ _bodySrv.maxBodySize +' ]', next);
+                            // Stop the peer streaming into a request nobody will read.
+                            try { request.destroy() } catch (destroyErr) {}
+                            return
+                        }
+
                         if ( typeof(request.body) == 'object') {
                             request.body = '';
                         }
@@ -6254,6 +6365,13 @@ function Server(options) {
                     });
 
                     request.on('end', function onEnd() {
+                        // #OW2 — a rejected body already answered 413 and destroyed the
+                        // stream; dispatching here would double-respond (and parse a body
+                        // we deliberately discarded). `destroy()` normally prevents 'end'
+                        // from firing at all, but that is a race against already-buffered
+                        // chunks, not a guarantee — the flag is the guarantee.
+                        if ( _bodyRejected ) { return }
+
                         // Preserve the exact unparsed body BEFORE processRequestData mutates
                         // request.body into the parsed object. Inbound webhooks that
                         // authenticate via an HMAC computed over the raw request bytes need
@@ -6277,7 +6395,17 @@ function Server(options) {
 
 
         // Timeout in milliseconds - e.g.: (1000x60)x2 => 2 min
-        self.instance.timeout = 0; // zero for unlimited
+        // #OW2 — configurable via `settings.json > server.timeout`; DEFAULT 0
+        // (unlimited) is deliberate and must stay the default: gina serves SSE
+        // (`text/event-stream`) and WebSockets, and a finite whole-request clock
+        // kills both. The slow-body case a finite value would cover is already
+        // closed by `server.maxBodySize` (the accumulator hits its ceiling
+        // regardless of drip rate); connection-level bounds come from
+        // keepAliveTimeout / headersTimeout and node's own defaults.
+        // An unparseable value falls back to 0 rather than to something arbitrary.
+        var _srvTimeoutCfg = self.conf[self.appName][self.env].server.timeout;
+        var _srvTimeout    = ( typeof(_srvTimeoutCfg) == 'undefined' ) ? 0 : parseTimeout(_srvTimeoutCfg);
+        self.instance.timeout = ( typeof(_srvTimeout) == 'number' && _srvTimeout >= 0 ) ? _srvTimeout : 0;
         // Port by default would be 3100
         // '::' as the binding address (ipv4 & ipv6)
         // To check: netstat -tuln

package/framework/{v0.6.22 → v0.6.23}/core/template/boilerplate/bundle/config/templates.json

@@ -17,6 +17,9 @@
             }
         ],
         "javascriptsDeferEnabled": true,
+        // opt-in Subresource Integrity: adds integrity= + crossorigin= to same-origin
+        // <script>/<link> tags whose files resolve on disk (fail-open otherwise)
+        //"sriEnabled": true,
         "javascripts": [
             // "/js/vendor/jquery/jquery-3.1.0.min.js",
             // "/js/vendor/modernizr-2.8.3.min.js",

package/framework/{v0.6.22 → v0.6.23}/core/template/conf/settings.json

@@ -1,6 +1,34 @@
 {
   "server": {
     "engine": "isaac",
+    // #OW2 (OWASP A10) — bound the NON-MULTIPART request body. Multipart uploads
+    // are capped separately by busboy + `upload.maxFieldsSize`; a plain JSON or
+    // urlencoded body previously accumulated with no ceiling at all, so a single
+    // large request was an unbounded-memory exposure.
+    //
+    // `maxBodySize` ENFORCES: a body exceeding it is answered 413 and the stream
+    // is destroyed. The 64MB default is deliberately permissive — the ceiling
+    // exists to stop unbounded growth, not to police payload shapes, and gina's
+    // OWN inter-bundle `self.query()` hop posts through this same pipeline with
+    // no size contract, so a tight enforced default would break gina with gina.
+    //
+    // `maxBodySizeWarn` only LOGS (no rejection), so you can measure your real
+    // body-size distribution from your own logs before choosing a stricter
+    // ceiling. Accepts B/KB/MB/GB (case-insensitive); a BARE NUMBER means MB.
+    // `0` (or an unparseable value) disables that threshold — an invalid cap
+    // must never reject everything.
+    "maxBodySize": "64MB",
+    "maxBodySizeWarn": "2MB",
+    // #OW2 — whole-request socket timeout, in ms or with a unit suffix ("5m").
+    // DEFAULT 0 = unlimited, and that default is deliberate, not an oversight:
+    // gina serves Server-Sent Events (`text/event-stream`) and WebSockets, both
+    // of which are long-lived by design and would be killed by a finite
+    // whole-request clock. The slow-body attack this would otherwise mitigate is
+    // already closed by `maxBodySize` above (the accumulator hits its ceiling
+    // regardless of how slowly the peer drips), and connection-level bounds come
+    // from `keepAliveTimeout` / `headersTimeout` below plus node's own defaults.
+    // Set a finite value only if you serve no streaming endpoints.
+    "timeout": 0,
     // #HDR8 Phase 2 — framework-wide X-Powered-By suppression, BOTH engines. When
     // `true`, the framework skips its X-Powered-By emission everywhere it
     // originates: the engine-agnostic per-request `setHeader` in
@@ -12,8 +40,41 @@
     // writeHead emit site (plus the routing.json asset `setHeader` site).
     // gina.plugins.HidePoweredBy() remains available as a middleware-shaped
     // remover for routed responses.
-    // Default `false` preserves shipped behaviour; opt-in by setting to `true`.
-    "hidePoweredBy": false,
+    // #OW1 (OWASP A02) — DEFAULT FLIPPED TO `true` in 0.6.23. The framework no
+    // longer discloses its name and exact version on every response by default;
+    // a version banner is free reconnaissance and buys the operator nothing.
+    // Set `false` to restore the pre-0.6.23 emission.
+    // NOTE: with the render/output cache enabled and `server.cache.name` unset,
+    // `true` raises the documented #B238 boot warn — the cache still names the
+    // framework on the wire via `Cache-Status`; set any token to close that too.
+    "hidePoweredBy": true,
+    // #OW1 (OWASP A02) — framework-level, ENGINE-AGNOSTIC security headers, new
+    // in 0.6.23. This is deliberately NOT the top-level `securityHeaders` block
+    // below: that one configures the #HDR1-14 PLUGINS when a bundle mounts them.
+    // This one is emitted by the framework itself, because the plugins are
+    // express middleware and the DEFAULT `isaac` engine never runs the express
+    // chain for HTTP responses — a mounted orchestrator emits nothing there.
+    //
+    // Precedence is FIRST-WRITER-WINS: any header already set by a mounted
+    // plugin, by `env.json > server.response.header`, or by an upstream proxy is
+    // left untouched. Set `"enabled": false` to restore pre-0.6.23 behaviour.
+    //
+    // ON by default (cannot break a working application):
+    //   x-content-type-options: nosniff · x-download-options: noopen
+    //   x-permitted-cross-domain-policies: none · x-xss-protection: 0
+    //   referrer-policy: strict-origin-when-cross-origin
+    //   x-dns-prefetch-control: off · origin-agent-cluster: ?1
+    //
+    // OPT-IN (each breaks a legitimate deployment shape — set to `true`):
+    //   "xFrameOptions" — SAMEORIGIN; breaks embedding your app cross-origin.
+    //   "coop"          — severs `window.opener`; breaks OAuth/payment popups.
+    //   "corp"          — blocks cross-origin loading of your assets.
+    //   "hsts"          — 180-day https commitment; emitted over http too.
+    // `coop`/`corp` are never applied to `/_gina/*`, which is deliberately
+    // cross-origin (metrics/health/SSE emit `access-control-allow-origin: *`).
+    "securityHeaders": {
+      "enabled": true
+    },
     // #H11 — opt-in Alt-Svc HTTP/3-advertisement header. When `true`, every
     // routed (user-facing) response carries `Alt-Svc: h3=":443"; ma=86400`,
     // advertising HTTP/3 (QUIC) availability so QUIC-capable clients upgrade

package/framework/{v0.6.22 → v0.6.23}/core/template/conf/templates.json

@@ -26,6 +26,7 @@
       }
     ],
     "javascriptsDeferEnabled": true, // will place scripts in defer mode in the head by default. If false, will place in the footer
+    "sriEnabled": false, // opt-in Subresource Integrity: adds integrity= + crossorigin= to same-origin <script>/<link> tags whose files resolve on disk; external URLs and unresolvable paths are skipped (fail-open)
     "javascripts": [
       {
         "name"      : "gina",

package/framework/{v0.6.22 → v0.6.23}/lib/index.js

@@ -146,6 +146,23 @@ function Lib() {
         // security-bearing, which keeps it out of the hot-reload path entirely
         // (the lib/authn precedent).
         maintenance     : require('./maintenance'),
+        // #OW1 — engine-agnostic security-header emission (OWASP A02). The
+        // #HDR1-14 plugins are express middleware, and the DEFAULT engine
+        // (isaac) never runs the express chain for HTTP responses, so a mounted
+        // orchestrator emits nothing there; this is the framework-side twin, in
+        // the same shape as the #HDR8 hidePoweredBy gate.
+        // PLAIN require (NOT _require) for the same reason as admin/maintenance
+        // above: a stateless pure-function leaf with no state to hot-reload, and
+        // security-bearing, which keeps it out of the hot-reload path entirely.
+        securityHeadersEmitter : require('./security-headers-emitter'),
+        // #OW3 — Subresource Integrity attribute computation (OWASP A08),
+        // consumed by the controller's resource builder when a bundle opts in
+        // via templates.json `"sriEnabled": true`. PLAIN require (NOT _require):
+        // security-bearing like the emitter/authn precedent above, and it holds
+        // a module-scope stat-validated hash cache that a per-request re-require
+        // would pointlessly discard (the cache can never go stale — every
+        // lookup re-stats the file — so surviving reloads costs nothing).
+        sri             : require('./sri'),
         // #AI6 — Async-job primitive. Holds an in-memory job registry, a
         // concurrency-limited worker, and a self-contained unref'd setInterval
         // sweep timer at module scope. Like State / logger below, it MUST use a