gina 0.6.31 → 0.6.32

package/framework/{v0.6.31 → v0.6.32}/core/config.js

@@ -25,6 +25,7 @@ var Collection      = lib.Collection;
 var modelUtil       = new lib.Model();
 var secrets         = lib.secrets;
 var i18n            = lib.i18n;
+var sessionLifetime = lib.sessionLifetime;
 
 
 /**
@@ -1918,6 +1919,15 @@ function Config(opt, contextResetNeeded) {
         ;
         for (; c < cLen; ++c) {
             let jsonFile = null;
+            // #D45-overlay — the `<name>.<env>.json` content, STASHED here and folded in
+            // LAST (after the base file below) with lib/merge's `override` flag, so the
+            // environment overlay WINS on every key both files declare. It used to be
+            // merged in FIRST, target-wins, so the base file silently beat its own
+            // overlay on conflicting keys (env-only keys were added, overrides were
+            // dropped) since this loop's first cut in 2022 — while every reference page
+            // promised the opposite. Arrays: an env array REPLACES the base array
+            // (override semantics), it is not unioned into it.
+            let envJsonFile = null;
 
             fName = configFiles[c];
             fNameWithNoExt  = fName.replace(/.json/, '');
@@ -2005,13 +2015,9 @@ function Config(opt, contextResetNeeded) {
                 if (!exists) {
                     jsonFile = null;
                 } else {
-                    jsonFile = requireJSON(_(filename, true));
-
-                    if (Array.isArray(jsonFile) && !Array.isArray(fileContent) && !Object.keys(fileContent).length) {
-                        fileContent = []
-                    }
-                    // Fixed priority to env version and/or extended.description if found
-                    fileContent = merge(jsonFile, fileContent);
+                    jsonFile    = requireJSON(_(filename, true));
+                    // #D45-overlay — not merged here any more (see the fold after the base file)
+                    envJsonFile = jsonFile;
                 }
 
             } catch (_err) {
@@ -2068,6 +2074,14 @@ function Config(opt, contextResetNeeded) {
                 // Fixed priority to env version and/or extended.description if found
                 fileContent = merge(jsonFile, fileContent);
 
+                // #D45-overlay — now the environment version, and it wins (override).
+                if ( envJsonFile ) {
+                    if (Array.isArray(envJsonFile) && !Array.isArray(fileContent) && !Object.keys(fileContent).length) {
+                        fileContent = []
+                    }
+                    fileContent = merge(fileContent, envJsonFile, true);
+                }
+
 
             } catch (_err) {
 
@@ -3320,6 +3334,30 @@ function Config(opt, contextResetNeeded) {
             );
         }
 
+        // Per-bundle login session cookie lifetimes — `security.json >
+        // session.expires` / `session.remember`, derived once here and read by
+        // core/router.js at req.login(). `null` when the bundle declares neither,
+        // which is the case the router's band short-circuits on, so a bundle that
+        // never opted in costs nothing per request.
+        //
+        // Warned, never fatal — same disposition as the i18n block above and for
+        // the same reason: both keys were documented but uninterpreted before this
+        // release, so a value already sitting in one was never a statement about
+        // this contract. Refusing the boot would turn an upgrade into an outage
+        // for a key that did nothing yesterday; an unusable value is reported and
+        // the bundle keeps the cookie lifetime it already had.
+        try {
+            conf[bundle][env].sessionLifetime = sessionLifetime.fromConfig(
+                conf[bundle][env].content.security, bundle, env
+            );
+        } catch (sessionLifetimeErr) {
+            conf[bundle][env].sessionLifetime = null;
+            console.warn(
+                '[CONFIG][loadBundleConfig] login session lifetime skipped for `'
+                + bundle +'/'+ env +'`: '+ sessionLifetimeErr.message
+            );
+        }
+
         ++b;
         if (b < bundles.length) {
             loadBundleConfig(bundles, b, callback, reload, collectedRules)

package/framework/{v0.6.31 → v0.6.32}/core/connectors/couchbase/index.js

@@ -628,11 +628,17 @@ function Couchbase(conn, infos) {
                     // #B11 fix: recover the entity singleton when called via util.promisify
                     // without .bind(). In strict mode `this` is undefined when a prototype
                     // method is detached from its object. Fall back to the singleton stored
-                    // at EntitySuperClass[CapitalizedName].instance (set by entity.js:427).
+                    // at the entity registry (set by entity.js setListeners).
+                    // #B555 — the registry is keyed on (bundle, model, className), not on the
+                    // bare class name: two connectors of one bundle can declare the same class
+                    // name, and a bare key silently handed the second one the first's instance.
+                    // This method is detached (`this` is undefined), so the pair comes from the
+                    // connector's own `infos` rather than from the instance.
                     // This makes `util.promisify(entity.method)` work transparently without
                     // requiring callers to add .bind(entity) everywhere.
                     var _capitalizedName = entityName.substring(0,1).toUpperCase() + entityName.substring(1);
-                    var self = this || (EntitySuperClass[_capitalizedName] && EntitySuperClass[_capitalizedName].instance) || null;
+                    var _registryKey = EntitySuperClass.key(infos.bundle, infos.model, _capitalizedName);
+                    var self = this || (EntitySuperClass[_registryKey] && EntitySuperClass[_registryKey].instance) || null;
                     var key     = null
                         , index = null
                         , i     = null
@@ -641,7 +647,7 @@ function Couchbase(conn, infos) {
                         , _mainCallback = null;
 
                     if (!self) {
-                        var _ctxErr = new TypeError('[entity] ' + entityName + '#' + name + '() called without context: `this` is undefined and no singleton found at EntitySuperClass[' + _capitalizedName + '].instance');
+                        var _ctxErr = new TypeError('[entity] ' + entityName + '#' + name + '() called without context: `this` is undefined and no singleton found at EntitySuperClass[' + _registryKey + '].instance');
                         var _cbArg = (args.length > 0 && typeof args[args.length - 1] === 'function') ? args[args.length - 1] : null;
                         if (_cbArg) { return _cbArg(_ctxErr); }
                         throw _ctxErr;

package/framework/{v0.6.31 → v0.6.32}/core/controller/controller.js

@@ -48,6 +48,14 @@ const { Resolver } = require('node:dns').promises;
 
 var lib             = require('./../../lib') || require.cache[require.resolve('./../../lib')];
 
+// #B551 — relative require (not the bare `lib/inspector-redact` form the render
+// delegates use) so this module resolves without depending on the gna.js NODE_PATH
+// bootstrap, matching inspector-window-emit.js. Node caches by resolved path, so it
+// is the same module instance either way.
+var inspectorRedact = require('../../lib/inspector-redact');
+// Compiled once: the pattern set is a module constant.
+var _carryRedactPatterns = inspectorRedact.compile(inspectorRedact.DEFAULT_PATTERNS);
+
 /**
  * #A11Y3 — BCP-47 language tag for a framework-generated document.
  *
@@ -385,6 +393,39 @@ var _mintErrorRef = function(supplied) {
     return crypto.randomBytes(3).toString('hex').toUpperCase();
 };
 
+/**
+ * #B554 — HTML-escape a value before it is concatenated into an error page.
+ *
+ * The inline fallback error pages are built by string concatenation, and the
+ * values they carry are caller-supplied: `redirect()` hands a request-supplied
+ * `?error=<value>` straight to `throwError`, so a crafted link reflected markup
+ * into the 500 page and executed it in the application's origin. Escaping at
+ * the emission point closes that permanently, wherever the value came from.
+ *
+ * Three byte-identical local copies exist — one each in
+ * `core/controller/controller.js`, `core/server.js` and
+ * `core/controller/controller.render-nunjucks.js` — the same deliberate
+ * duplication as `_mintErrorRef`: controller.js is evicted from require.cache
+ * per request in dev, so a shared home would churn, and the helper is six
+ * lines. `test/core/throwerror-html-escape-b554.test.js` pins the three copies
+ * identical.
+ *
+ * @private
+ * @param {*} value - the text to escape (null/undefined become '')
+ * @returns {string} the value with HTML-significant characters replaced
+ *
+ * @example
+ * _escapeHtml('a<b & "c"'); // 'a&lt;b &amp; &quot;c&quot;'
+ */
+var _escapeHtml = function(value) {
+    return String(value == null ? '' : value)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+};
+
 /**
  * #CE1 — resolves the bundle's `server.transientErrors` block into its
  * effective values. Total: never throws, and tolerates any malformed shape
@@ -3537,11 +3578,35 @@ function SuperController(options) {
                 // backing up oldParams
                 var oldParams = local.req[originalMethod.toLowerCase()];
                 var requestParams = req[req.method.toLowerCase()] || {};
-                if ( typeof(requestParams) != 'undefined' && typeof(requestParams.error) != 'undefined' ) {
-                    var redirectError = requestParams.error;
-                    self.throwError(requestParams.error);
-                    return;
-                }
+                // #B559 — a request parameter must never steer control flow. This spot
+                // used to test the incoming params for a key named `error` and, when it
+                // was present, call throwError() with that raw client value and return
+                // instead of redirecting. `req[method]` is the CLIENT-populated
+                // container (server.js assigns `request.get = request.query`, and
+                // `request.post` from the parsed body), so ANY unauthenticated request
+                // to ANY route whose action redirects could force a 500 just by adding
+                // the key -- on both engines, with no route opt-in. An EMPTY value was
+                // worse: the empty string is falsy, so the #B44 late-call guard in
+                // throwError() mistook it for a call on an already-released response,
+                // logged "ignoring late error:" with nothing after the colon, and
+                // returned without writing anything -- leaving the request unanswered
+                // for as long as the client held the socket. Nothing reaps that:
+                // `server.timeout` defaults to 0, deliberately, so SSE and WebSockets
+                // are not killed by a whole-request clock.
+                //
+                // Deleted rather than hardened, because the key was never a supported
+                // convention: nothing in gina produces it, no test pinned it, and this
+                // method's own JSDoc never mentions it. The published guide teaches the
+                // OPPOSITE -- its canonical "carrying request data across the redirect"
+                // example assigns that key on the request and then redirects, which
+                // this gate turned into a 500. The line's own 2021 ancestor used this
+                // same condition to DELETE the key so it would not ride the target URL;
+                // the throw replaced the delete in 2022 inside an unrelated omnibus
+                // commit, with no comment and no mention in its message.
+                //
+                // With it gone the key is an ordinary parameter: it rides the redirect
+                // in `inheritedData` like every other one, which is what the guide
+                // documents. Nothing downstream treats it specially.
 
                 // #B353 — HEAD is a SAFE method: it is GET without a response body, so a
                 // redirect must treat it exactly as it treats GET. This gate exists to stop
@@ -3582,9 +3647,46 @@ function SuperController(options) {
                 if ( typeof(requestParams.session) != 'undefined' ) {
                     delete requestParams.session;
                 }
+                // #B551 — credentials must not ride the redirect. `requestParams` is the
+                // request's own parsed container (for a POST, `req.post` verbatim), and the
+                // merge above does NOT clone — lib/merge's clone block is commented out —
+                // so this is a LIVE reference to that container. Filtering it in place
+                // would strip fields the application's own action may still be reading, so
+                // build a filtered COPY and carry that instead.
+                //
+                // Measured before this guard existed: a login POST put
+                // {"email":..,"password":"<plaintext>"} into the session store, where it
+                // survived the consuming GET on the authenticated path and was copied on
+                // into the halted-request stash on the failed one. A session-less bundle
+                // put the same payload in the redirect URL instead, i.e. into access logs,
+                // proxy logs, browser history and Referer.
+                //
+                // The key list is lib/inspector-redact's — the same maintained, tokenising
+                // matcher the Inspector already uses to mask these very fields in its own
+                // pane, so `apiKey`/`api_key` are covered while metadata keys such as
+                // `passwordRules` are deliberately not. Dropped rather than masked: a
+                // literal '[redacted]' arriving at the target reads like a real value.
+                //
+                // Logged at debug, NOT warn: a login POST always carries a password, so a
+                // warn here would fire on the success path of the commonest flow in the
+                // framework — the #B552 mistake, which this must not repeat.
+                var _carriedParams = {};
+                var _droppedCarry  = [];
+                var _carryKeys     = Object.keys(requestParams);
+                for (var _ck = 0; _ck < _carryKeys.length; _ck++) {
+                    if ( inspectorRedact.keyMatches(_carryKeys[_ck], _carryRedactPatterns) ) {
+                        _droppedCarry.push(_carryKeys[_ck]);
+                        continue;
+                    }
+                    _carriedParams[ _carryKeys[_ck] ] = requestParams[ _carryKeys[_ck] ];
+                }
+                if ( _droppedCarry.length > 0 ) {
+                    // Names only, never values — not carrying them is the whole point.
+                    console.debug('[ Controller ] redirect(): credential-class field(s) not carried across the redirect: '+ _droppedCarry.join(', '));
+                }
+                requestParams = _carriedParams;
                 // #B546 — shadow-proof own-property count; see the note in setOptions().
                 if ( typeof(requestParams) != 'undefined' && ownCount(requestParams) > 0 ) {
-                    //if ( typeof(requestParams.error) != 'undefined' )
 
                     // #B75 — a session-less bundle (no Session plugin mounted) must
                     // not deref req.session.user here (an XHR redirect carrying
@@ -3638,6 +3740,15 @@ function SuperController(options) {
                         }
 
                         _applyNoStoreToRedirectJSON(); // #B75
+                        // #B550 — terminate through the compat response, as this method's
+                        // 303 exit already does (`res.writeHead` + `res.end` further down).
+                        // On HTTP/2 the JSON delegate would otherwise write straight to the
+                        // raw stream, calling neither, so a session rotated immediately
+                        // before the redirect never gets its new cookie to the client and
+                        // the client keeps presenting the old, already-replaced id. The
+                        // HTTP/1.1 path always took this branch, so this only makes the two
+                        // redirect exits agree.
+                        req._ginaForceCompatSend = true;
                         self.renderJSON(redirectObj);
                         return;
                     }
@@ -3656,6 +3767,8 @@ function SuperController(options) {
                 // Popin redirect
                 if ( isPopinContext ) {
                     _applyNoStoreToRedirectJSON(); // #B75
+                    // #B550 — same compat-path termination as the sibling XHR exit above.
+                    req._ginaForceCompatSend = true;
                     return self.renderJSON({
                         isXhrRedirect: true,
                         popin: {
@@ -8501,10 +8614,30 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
         // `res.stack` / `res.message` / `res.fallback` in the errorObject build
         // (every bundle crashes there). So a released response would crash
         // (uncaughtException → SIGTERM) instead of being ignored. Bail up-front
-        // with the same no-op contract as the #B31 guard. The 1-arg shapes keep
-        // a truthy `res` (the Error/errorObj) here, so they are unaffected and
-        // still reach the #B31 guard after `res` is reassigned to `local.res` at
-        // the end of the errorObject build.
+        // with the same no-op contract as the #B31 guard. A 1-arg shape reaches
+        // here with a truthy `res` — either the caller's own Error/errorObj, or
+        // the placeholder substituted just below when the payload was falsy
+        // (#B560) — so 1-arg calls are unaffected and still reach the #B31 guard
+        // after `res` is reassigned to `local.res` at the end of that build.
+        // #B560 — a 1-arg call whose PAYLOAD is falsy is NOT a late call. For the
+        // `throwError(err)` shape the `res` slot holds the caller's payload, not
+        // the response, so '', null, undefined, 0 and false all reached the bail
+        // below and were swallowed: the request was never answered, and the only
+        // trace was a warning claiming the response had been released — it had
+        // not — which then named no error at all, because its interpolation reads
+        // `msg`/`code` and never `res`. Normalise such a payload to a minimal
+        // errorObj so the build below has something to read and a 500 is actually
+        // egressed.
+        //
+        // Deliberately NOT written as `arguments.length !== 1` on the bail itself:
+        // the errorObject build dereferences `res.error` / `res.message` without
+        // guarding, so letting a null payload reach it would turn a silent hang
+        // into a TypeError crash. Genuine 2-arg/3-arg late calls — where `res` IS
+        // an already-released `local.res` — and 0-arg calls are untouched and
+        // still bail below.
+        if ( arguments.length === 1 && !res ) {
+            res = { status: 500 };
+        }
         if ( !res ) {
             self.isProcessingError = true;
             var _b44LateError = msg || code;
@@ -8982,15 +9115,21 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 if ( typeof(msg) == 'object' ) {
 
                     if (msg.title) {
-                        msgString += '<pre class="'+ eCode +' title">'+ msg.title +'</pre>';
+                        // was: msgString += '<pre class="'+ eCode +' title">'+ msg.title +'</pre>';
+                        // #B554 — escape: this value is caller-supplied and reached the page as markup.
+                        msgString += '<pre class="'+ eCode +' title">'+ _escapeHtml(msg.title) +'</pre>';
                     }
 
                     if (msg.error) {
-                        msgString += '<pre class="'+ eCode +' message">'+ msg.error +'</pre>';
+                        // was: msgString += '<pre class="'+ eCode +' message">'+ msg.error +'</pre>';
+                        // #B554 — escape: this value is caller-supplied and reached the page as markup.
+                        msgString += '<pre class="'+ eCode +' message">'+ _escapeHtml(msg.error) +'</pre>';
                     }
 
                     if (msg.message) {
-                        msgString += '<pre class="'+ eCode +' message">'+ msg.message +'</pre>';
+                        // was: msgString += '<pre class="'+ eCode +' message">'+ msg.message +'</pre>';
+                        // #B554 — escape: this value is caller-supplied and reached the page as markup.
+                        msgString += '<pre class="'+ eCode +' message">'+ _escapeHtml(msg.message) +'</pre>';
                     }
 
                     // Fail-closed: render the stack frame only in local scope
@@ -9009,7 +9148,9 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                         }
 
                         msg.stack = msg.stack.replace('Error:', '').replace(' ', '');
-                        msgString += '<pre class="'+ eCode +' stack">'+ msg.stack +'</pre>';
+                        // was: msgString += '<pre class="'+ eCode +' stack">'+ msg.stack +'</pre>';
+                        // #B554 — escape: this value is caller-supplied and reached the page as markup.
+                        msgString += '<pre class="'+ eCode +' stack">'+ _escapeHtml(msg.stack) +'</pre>';
                     }
 
                 } else {
@@ -9031,15 +9172,21 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     }
 
                     if (title) {
-                        msgString += '<pre class="'+ eCode +' title">'+ title +'</pre>';
+                        // was: msgString += '<pre class="'+ eCode +' title">'+ title +'</pre>';
+                        // #B554 — escape: this value is caller-supplied and reached the page as markup.
+                        msgString += '<pre class="'+ eCode +' title">'+ _escapeHtml(title) +'</pre>';
                     }
                     if (message) {
-                        msgString += '<pre class="'+ eCode +' message">'+ message +'</pre>';
+                        // was: msgString += '<pre class="'+ eCode +' message">'+ message +'</pre>';
+                        // #B554 — escape: this value is caller-supplied and reached the page as markup.
+                        msgString += '<pre class="'+ eCode +' message">'+ _escapeHtml(message) +'</pre>';
                     }
                     // Fail-closed: local scope only — same gate shape as the
                     // msg-shape site above.
                     if (stack && _isLocalScope) {
-                        msgString += '<pre class="'+ eCode +' stack">'+ stack +'</pre>';
+                        // was: msgString += '<pre class="'+ eCode +' stack">'+ stack +'</pre>';
+                        // #B554 — escape: this value is caller-supplied and reached the page as markup.
+                        msgString += '<pre class="'+ eCode +' stack">'+ _escapeHtml(stack) +'</pre>';
                     }
                 }
                 res.writeHead(code, { 'content-type': bundleConf.server.coreConfiguration.mime[ext]+'; charset='+ bundleConf.encoding } );

package/framework/{v0.6.31 → v0.6.32}/core/controller/controller.render-json.js

@@ -176,7 +176,21 @@ module.exports = function renderJSON(jsonObj, deps) {
     var response    = local.res;
     var next        = local.next || null;
     var stream      = null;
-    if ( typeof(local.res.stream) != 'undefined') {
+    // #B550 — a caller may force the compat send path (the HTTP/1.1-shaped branch at the
+    // bottom of this file). On HTTP/2 the raw `stream.respond()` path never calls
+    // `res.writeHead` or `res.end`, so any middleware that installs itself by wrapping
+    // those response methods never runs: a session middleware that sets its cookie from an
+    // `on-headers` hook on `writeHead`, and persists from an `end` proxy, emits neither,
+    // and the `res.getHeaders()` fold further down then has no cookie to carry. Consumed
+    // once off the REQUEST (never the controller's closure — the redirect span it is
+    // set in is extracted and executed closure-free by its own tests), so only the
+    // flagged render is affected and every other
+    // HTTP/2 render stays byte-identical.
+    var _forceCompatSend = !!(local.req && local.req._ginaForceCompatSend === true);
+    if (_forceCompatSend) {
+        delete local.req._ginaForceCompatSend;
+    }
+    if ( typeof(local.res.stream) != 'undefined' && !_forceCompatSend ) {
         stream = local.res.stream
     }
     // #H10 — opt-in HTTP/2 response trailers (registered via self.sendTrailers()).
@@ -440,6 +454,8 @@ module.exports = function renderJSON(jsonObj, deps) {
         if ( /^HEAD$/i.test(request.method) ) {
             var headLen = Buffer.byteLength(data, 'utf8');
             if ( stream ) {
+                // #B562 — defer the raw send into the shim's base end() when one is installed
+                var __ginaSendHead = function() {
                 if ( !stream.headersSent ) {
                     var _headH = {
                         'content-type'   : local.options.conf.server.coreConfiguration.mime['json'] + '; charset='+ local.options.conf.encoding,
@@ -453,6 +469,14 @@ module.exports = function renderJSON(jsonObj, deps) {
                     stream.respond(_headH);
                 }
                 stream.end();
+                };
+                if (response._ginaSendShim) {
+                    response._ginaRawSend = __ginaSendHead;
+                    response.writeHead(response.statusCode || 200);
+                    response.end();
+                } else {
+                    __ginaSendHead();
+                }
             } else if ( !headersSent(response) ) {
                 response.setHeader('content-type', local.options.conf.server.coreConfiguration.mime['json'] + '; charset='+ local.options.conf.encoding);
                 response.setHeader('content-length', headLen);
@@ -539,6 +563,8 @@ module.exports = function renderJSON(jsonObj, deps) {
                 local.next = null;
                 return;
             }
+            // #B562 — defer the raw send into the shim's base end() when one is installed
+            var __ginaSendBody = function(data) {
             if (!stream.headersSent) {
                 var _streamHeaders = {
                     'content-type': local.options.conf.server.coreConfiguration.mime['json'] + '; charset='+ local.options.conf.encoding,
@@ -572,6 +598,14 @@ module.exports = function renderJSON(jsonObj, deps) {
 
 
             stream.end(data);
+            };
+            if (response._ginaSendShim) {
+                response._ginaRawSend = __ginaSendBody;
+                response.writeHead(response.statusCode || 200);
+                response.end(data);
+            } else {
+                __ginaSendBody(data);
+            }
             response.headersSent = true;
             local.req = null;
             local.res = null;

package/framework/{v0.6.31 → v0.6.32}/core/controller/controller.render-nunjucks-async.js

@@ -275,6 +275,8 @@ function sendHtmlResponse(local, html, req, res) {
                 try { console.warn('[render-nunjucks-async] stream already destroyed on HEAD — client disconnected ('+ req.url +')'); } catch (e) {}
                 return;
             }
+            // #B562 — defer the raw send into the shim's base end() when one is installed
+            var __ginaSend1 = function() {
             if (!stream.headersSent) {
                 var _headH2 = {
                     'content-type':   res.getHeader('content-type'),
@@ -288,6 +290,14 @@ function sendHtmlResponse(local, html, req, res) {
                 stream.respond(_headH2);
             }
             stream.end();
+            };
+            if (res._ginaSendShim) {
+                res._ginaRawSend = __ginaSend1;
+                res.writeHead(res.statusCode || 200);
+                res.end();
+            } else {
+                __ginaSend1();
+            }
             res.headersSent = true;
         } else {
             // Case 2: HEAD + HTTP/1.1
@@ -304,6 +314,8 @@ function sendHtmlResponse(local, html, req, res) {
             try { console.warn('[render-nunjucks-async] stream already destroyed — client disconnected before response ('+ req.url +')'); } catch (e) {}
             return;
         }
+        // #B562 — defer the raw send into the shim's base end() when one is installed
+        var __ginaSend2 = function(html) {
         if (!stream.headersSent) {
             var _streamHeaders = {
                 'content-type': res.getHeader('content-type'),
@@ -321,6 +333,14 @@ function sendHtmlResponse(local, html, req, res) {
             stream.respond(_streamHeaders, _trailers ? { waitForTrailers: true } : undefined);
         }
         stream.end(html);
+        };
+        if (res._ginaSendShim) {
+            res._ginaRawSend = __ginaSend2;
+            res.writeHead(res.statusCode || 200);
+            res.end(html);
+        } else {
+            __ginaSend2(html);
+        }
         res.headersSent = true;
         return;
     }

package/framework/{v0.6.31 → v0.6.32}/core/controller/controller.render-nunjucks.js

@@ -128,6 +128,40 @@ var inspectorRedact = require('lib/inspector-redact');
 var emitInspectorWindowData = require('./inspector-window-emit');
 // #RWATCH S3 — stale-release banner injector (server-side inline; gated inert).
 var releaseBanner = require('./release-banner');
+
+/**
+ * #B554 — HTML-escape a value before it is concatenated into an error page.
+ *
+ * The inline fallback error pages are built by string concatenation, and the
+ * values they carry are caller-supplied: `redirect()` hands a request-supplied
+ * `?error=<value>` straight to `throwError`, so a crafted link reflected markup
+ * into the 500 page and executed it in the application's origin. Escaping at
+ * the emission point closes that permanently, wherever the value came from.
+ *
+ * Three byte-identical local copies exist — one each in
+ * `core/controller/controller.js`, `core/server.js` and
+ * `core/controller/controller.render-nunjucks.js` — the same deliberate
+ * duplication as `_mintErrorRef`: controller.js is evicted from require.cache
+ * per request in dev, so a shared home would churn, and the helper is six
+ * lines. `test/core/throwerror-html-escape-b554.test.js` pins the three copies
+ * identical.
+ *
+ * @private
+ * @param {*} value - the text to escape (null/undefined become '')
+ * @returns {string} the value with HTML-significant characters replaced
+ *
+ * @example
+ * _escapeHtml('a<b & "c"'); // 'a&lt;b &amp; &quot;c&quot;'
+ */
+var _escapeHtml = function(value) {
+    return String(value == null ? '' : value)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+};
+
 // Collection — small data-query helper used to filter the asset list when
 // rendering without a layout (mirrors render-swig.js:494-498). Fetched via
 // the lib registry so the dev-mode hot-reload evictions of `lib/index.js`
@@ -556,6 +590,8 @@ function sendHtmlResponse(local, html, req, res) {
                 try { console.warn('[render-nunjucks] stream already destroyed on HEAD — client disconnected ('+ req.url +')'); } catch (e) {}
                 return;
             }
+            // #B562 — defer the raw send into the shim's base end() when one is installed
+            var __ginaSend1 = function() {
             if (!stream.headersSent) {
                 var _headH2 = {
                     'content-type':   res.getHeader('content-type'),
@@ -569,6 +605,14 @@ function sendHtmlResponse(local, html, req, res) {
                 stream.respond(_headH2);
             }
             stream.end();
+            };
+            if (res._ginaSendShim) {
+                res._ginaRawSend = __ginaSend1;
+                res.writeHead(res.statusCode || 200);
+                res.end();
+            } else {
+                __ginaSend1();
+            }
             res.headersSent = true;
         } else {
             // Case 2: HEAD + HTTP/1.1
@@ -585,6 +629,8 @@ function sendHtmlResponse(local, html, req, res) {
             try { console.warn('[render-nunjucks] stream already destroyed — client disconnected before response ('+ req.url +')'); } catch (e) {}
             return;
         }
+        // #B562 — defer the raw send into the shim's base end() when one is installed
+        var __ginaSend2 = function(html) {
         if (!stream.headersSent) {
             var _streamHeaders = {
                 'content-type': res.getHeader('content-type'),
@@ -606,6 +652,14 @@ function sendHtmlResponse(local, html, req, res) {
             stream.respond(_streamHeaders, _trailers ? { waitForTrailers: true } : undefined);
         }
         stream.end(html);
+        };
+        if (res._ginaSendShim) {
+            res._ginaRawSend = __ginaSend2;
+            res.writeHead(res.statusCode || 200);
+            res.end(html);
+        } else {
+            __ginaSend2(html);
+        }
         res.headersSent = true;
         return;
     }
@@ -1248,25 +1302,34 @@ module.exports = async function renderNunjucks(userData, displayInspector, errOp
             : 'en';
 
         if (!_absErrTemplate || !fs.existsSync(_absErrTemplate)) {
-            html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _errStatusCode + '</title></head>'
+            // was: html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _errStatusCode + '</title></head>'
+            // #B554 — the status and the message text are both escaped in all three of these
+            // fallback documents: the status may be a caller-supplied value (#B466), and the
+            // texts carry a config path and a nunjucks render error that can quote template or
+            // request content. The two comments below are kept to ONE line each on purpose —
+            // `render-engine-dispatch.test.js` pins each message literal within a fixed number
+            // of characters of its anchor, and a longer note here pushes it out of that window.
+            html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _escapeHtml(_errStatusCode) + '</title></head>'
                  + '<body><pre>[render-nunjucks] error template not found: '
-                 + (_absErrTemplate || '(unset)') + '</pre></body></html>';
+                 + _escapeHtml(_absErrTemplate || '(unset)') + '</pre></body></html>';
         } else {
             var _errSource = null;
             try {
                 _errSource = fs.readFileSync(_absErrTemplate, 'utf8');
             } catch (readErr) {
-                html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _errStatusCode + '</title></head>'
+                // was: the same raw title + raw text — #B554, both escaped below.
+                html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _escapeHtml(_errStatusCode) + '</title></head>'
                      + '<body><pre>[render-nunjucks] failed to read error template: '
-                     + (readErr.message || readErr) + '</pre></body></html>';
+                     + _escapeHtml(readErr.message || readErr) + '</pre></body></html>';
             }
             if (typeof _errSource === 'string') {
                 try {
                     html = env.renderString(_errSource, data);
                 } catch (renderErr) {
-                    html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _errStatusCode + '</title></head>'
+                    // was: the same raw title + raw text — #B554, both escaped below.
+                    html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _escapeHtml(_errStatusCode) + '</title></head>'
                          + '<body><pre>[render-nunjucks] error template render failed: '
-                         + (renderErr.message || renderErr) + '</pre></body></html>';
+                         + _escapeHtml(renderErr.message || renderErr) + '</pre></body></html>';
                 }
             }
         }