gina 0.6.33 → 0.7.0

package/framework/{v0.6.33 → v0.7.0}/core/plugins/lib/validator/src/form-validator.js

@@ -3029,29 +3029,39 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                     if ( typeof(local.errorLabels[v]) == 'undefined' ) {
                         local.errorLabels[v] = 'Condition not satisfied';
                     }
-                    // converting Buffer to string
-                    if ( isGFFCtx ) {
-                        //userValidatorError = String.fromCharCode.apply(null, new Uint16Array(gina.forms.validators[v].data));
-                        userValidator = bufferToString(gina.forms.validators[v].data); // ok
-                        var passedContext = 'var validationContext = this.getValidationContext(),isGFFCtx = validationContext.isGFFCtx,self = validationContext.self,local = validationContext.local,replace = validationContext.replace;';
-                        userValidator = userValidator.replace(/(\)\s+\{|\)\{){1}/, '$&\n\t'+ passedContext);
-
-                        //userValidator += '\n//#sourceURL='+ v +'.js';
-                    } else {
-                        userValidator = gina.forms.validators[v].toString();
-                    }
-
-                    // #M21c — Pattern B eval surface (trust-model invariant)
+                    // #M21c — Pattern B trust-model invariant, kept by #M21d
                     // Load-bearing: user-defined validator function bodies are registered on
                     // `gina.forms.validators` from disk-loaded `bundle/validators/<name>/main.js`
                     // files at framework boot. Trust assumption: the source of `userValidator`
                     // is always disk-sourced at boot — never request-time input (req.*, request.*,
-                    // form values, URL params). End-user data MUST NOT reach this eval.
+                    // form values, URL params). End-user data MUST NOT reach this compile step.
                     // Invariant pinned by test/lib/validator-scs1i.test.js (zero write sites for
                     // `gina.forms.validators` in framework source; zero request-time identifiers
                     // around the userValidator source chain).
-                    self[el][v] = eval('(' + userValidator + ')\n//# sourceURL='+ v +'.js');
-                    //self[el][v] = Function('errorMessage', 'errorStack', userValidator);
+                    if ( isGFFCtx ) {
+                        // converting Buffer to string
+                        userValidator = bufferToString(gina.forms.validators[v].data); // ok
+                        var passedContext = 'var validationContext = this.getValidationContext(),isGFFCtx = validationContext.isGFFCtx,self = validationContext.self,local = validationContext.local,replace = validationContext.replace;';
+                        userValidator = userValidator.replace(/(\)\s+\{|\)\{){1}/, '$&\n\t'+ passedContext);
+                        // #M21d — compiled by the browser as an inline <script>, the way the
+                        // bootstrap that delivered the source was; no dynamic-code call remains.
+                        // The prologue spliced above hands the body self/local/isGFFCtx/replace
+                        // through this.getValidationContext(), so the function needs no lexical
+                        // scope from this file. Compiled once per validator per page.
+                        self[el][v] = compileUserValidator(v, userValidator);
+                    } else if ( typeof(gina.forms.validators[v]) === 'function' ) {
+                        // A function registered on the context is used as it is: the former
+                        // source round-trip (toString, then a dynamic compile) produced an
+                        // equivalent function minus its closure.
+                        self[el][v] = gina.forms.validators[v];
+                    } else {
+                        // Custom validators run in the browser only: the server-side
+                        // registration path is not wired (`hasUserValidators()` reads
+                        // `getContext('gina').forms`, which nothing sets server-side), so a
+                        // source-shaped registration cannot be compiled here — stated instead
+                        // of a dead compile step.
+                        throw new Error('[UserFormValidator] custom validators run in the browser only — the server-side registration path is not wired (see the validation-rules reference, "Custom validators")');
+                    }
                 }
             } catch (userValidatorError) {
                 throw new Error('[UserFormValidator] Could not evaluate: `'+ filename +'`\n'+userValidatorError.stack);
@@ -3059,6 +3069,54 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         }
     } // EO addField(el, value)
 
+    /**
+     * Compiles one custom validator's source into a function by inserting it into the
+     * document as an inline `<script>` (#M21d) — the same channel that delivered the
+     * source to the page (`gina.forms` is parsed from the framework's inline bootstrap),
+     * so a page that renders at all can compile it: with no CSP, under `'unsafe-inline'`,
+     * or under a nonce policy (the script copies the nonce off an existing nonced script
+     * element). No `'unsafe-eval'` is needed, and no dynamic-code call remains in the
+     * bundle. The compiled function lands on `gina.forms.compiledValidators[name]`, a
+     * sibling of the source registry that stays read-only for the framework (#M21c).
+     * Browser-side only: the server branch above throws before reaching it.
+     *
+     * The script element executes synchronously on insertion and is removed right after,
+     * so nothing stays in the DOM. `//# sourceURL=<name>.js` keeps the validator visible
+     * in DevTools under its own name (the "Extra Scripts" affordance noted above).
+     *
+     * @param   {string} name   - Validator name (`gina.forms.validators` key).
+     * @param   {string} source - The function source, prologue already spliced in.
+     * @returns {function} The compiled validator.
+     * @throws  {Error} When the browser did not compile it — a SyntaxError in the file
+     *      (reported on the console by the browser, with the file's own name) or a CSP
+     *      that refuses inline scripts, in which case nothing gina renders runs either.
+     * @inner
+     *
+     * @example
+     * // a page seeded with gina.forms.validators.isSiren (a Buffer-shaped source)
+     * var fn = compileUserValidator('isSiren', 'function FormValidateIsSiren(errorMessage, errorStack) { ... }');
+     * typeof fn; // 'function'
+     * gina.forms.compiledValidators.isSiren === fn; // true — reused for every field on the page
+     */
+    function compileUserValidator(name, source) {
+        var registry = gina.forms.compiledValidators = gina.forms.compiledValidators || {};
+        if ( typeof(registry[name]) !== 'function' ) {
+            var doc     = document;
+            var script  = doc.createElement('script');
+            var nonced  = doc.querySelector('script[nonce]');
+            if ( nonced && nonced.nonce ) {
+                script.nonce = nonced.nonce;
+            }
+            script.text = 'gina.forms.compiledValidators[' + JSON.stringify(name) + '] = (' + source + ');\n//# sourceURL=' + name + '.js';
+            (doc.head || doc.documentElement).appendChild(script);
+            script.parentNode.removeChild(script);
+            if ( typeof(registry[name]) !== 'function' ) {
+                throw new Error('the browser did not compile it — look for a SyntaxError or a Content-Security-Policy report in the console');
+            }
+        }
+        return registry[name];
+    }
+
 
     for (let el in self) {
         // Adding fields & validators to context

package/framework/{v0.6.33 → v0.7.0}/core/server.express.js

@@ -52,6 +52,136 @@ const env                   = process.env.NODE_ENV
     , isProductionScope     = (/^true$/i.test(process.env.NODE_SCOPE_IS_PRODUCTION)) ? true : false
 ;
 
+/**
+ * Returns the engine-parsed query as a plain object (#B666).
+ *
+ * Express 5's default `simple` query parser is `querystring.parse`, whose result
+ * has a `null` prototype. The framework's request bags are plain objects: the
+ * `count()` helper installed on `Object.prototype` iterates `this.hasOwnProperty`,
+ * and a controller reads `req.get.count()` / `req.delete.count()` as documented.
+ * A null-prototype bag would make that count read 0 for every key it holds.
+ *
+ * The copy is built with `Object.defineProperty`, so a client-chosen key such as
+ * `__proto__` becomes an own data property of the copy and never reaches the
+ * `__proto__` setter. An `extended` (qs) parse or a custom parser already returns
+ * an ordinary object and is handed back untouched; anything that is not an object
+ * becomes an empty bag.
+ *
+ * @inner
+ * @private
+ * @param {*} parsed - What the engine's `query parser` returned
+ * @returns {object} A plain object carrying the same own keys and values
+ *
+ * @example
+ * toPlainQuery(require('querystring').parse('a=1&b=2'));   // { a: '1', b: '2' } — plain, count() → 2
+ * toPlainQuery({ a: '1' });                                 // the same object
+ * toPlainQuery(undefined);                                  // {}
+ */
+function toPlainQuery(parsed) {
+    if ( parsed === null || typeof parsed !== 'object' ) {
+        return {};
+    }
+    if ( Object.getPrototypeOf(parsed) !== null ) {
+        return parsed;
+    }
+    var plain = {};
+    Object.keys(parsed).forEach(function (key) {
+        Object.defineProperty(plain, key, {
+            value: parsed[key],
+            writable: true,
+            configurable: true,
+            enumerable: true
+        });
+    });
+    return plain;
+}
+
+/**
+ * Builds the accessor descriptor gina installs over `query` on the per-app
+ * request prototype (`app.request`) — the #B211 shadow, completed by #B666.
+ *
+ * Express 5 defines `req.query` as a prototype GETTER (its `lib/request.js`);
+ * the framework's request pipeline (core/server.js) ASSIGNS `request.query`
+ * under 'use strict', which throws through a getter-only property. #B211 shadowed
+ * the getter with a writable own data property holding `undefined`, which kept
+ * the assignments alive but left EVERY request's `request.query` undefined until
+ * the pipeline assigned it — and it assigns it only on its GET and HEAD branches.
+ * Its DELETE branch and the empty-body fallback of the POST, PUT and PATCH
+ * branches read `request.query` raw through `ownCount()`, which re-raises the
+ * shorthand's TypeError on `undefined` by design (#B546): on Express 5 one
+ * DELETE, or one POST/PUT/PATCH without a body, threw inside the request's `end`
+ * handler, took the `uncaughtException` path and killed the bundle —
+ * unauthenticated, on any URL, before routing. Express 4 never hit this: its
+ * auto-mounted query middleware assigns `req.query` as an own property on every
+ * request before any other layer runs.
+ *
+ * The accessor replaces the data property. Its getter runs on the first read of a
+ * request that nothing assigned yet: it calls the engine's own getter beneath the
+ * shadow — so the app's `query parser` setting is honoured at read time (`simple`
+ * by default on 5, `extended` or a custom function when the app sets one, an
+ * empty bag when parsing is disabled) — copies the result to a plain object and
+ * materialises it as a writable own property of the request. Its setter stores an
+ * assigned value the same way, so every `request.query =` site in the pipeline
+ * keeps working under strict mode. Where the prototype chain carries no `query`
+ * getter (Express 4) the getter answers `undefined` and materialises nothing, and
+ * the setter stores — byte-for-byte the #B211 data property's behaviour, so
+ * Express 4's own query middleware (`if (!req.query) req.query = parse(...)`)
+ * runs exactly as before. Reading `query` on the prototype itself never
+ * materialises anything on it. Installing the accessor creates no Express router
+ * and registers no layer, so a consumer's `app.set(...)` in `onInitialize` is
+ * honoured as it always was.
+ *
+ * The framework's first read of `request.query` on this engine happens inside its
+ * catch-all layer (core/server.js, #B668), so a `query parser` that throws is
+ * answered by Express's own layer catch with a 500 — never by a process exit.
+ *
+ * @inner
+ * @private
+ * @param {object} appRequest - The per-app request prototype (`app.request`)
+ * @returns {PropertyDescriptor} `{ configurable, enumerable, get, set }` for `Object.defineProperty`
+ *
+ * @example
+ * Object.defineProperty(app.request, 'query', queryAccessorDescriptor(app.request));
+ * // Express 5: GET /path?x=1  → req.query is { x: '1' } (plain, own, assignable) from the first read on
+ * // Express 4: req.query reads undefined until the query middleware assigns it → as before
+ */
+function queryAccessorDescriptor(appRequest) {
+    var nativeGetter = null;
+    var proto = Object.getPrototypeOf(appRequest);
+    while ( proto && proto !== Object.prototype ) {
+        var descriptor = Object.getOwnPropertyDescriptor(proto, 'query');
+        if ( descriptor ) {
+            if ( typeof descriptor.get === 'function' ) {
+                nativeGetter = descriptor.get;
+            }
+            break;
+        }
+        proto = Object.getPrototypeOf(proto);
+    }
+    var materialise = function (req, query) {
+        Object.defineProperty(req, 'query', {
+            value: query,
+            writable: true,
+            configurable: true,
+            enumerable: true
+        });
+        return query;
+    };
+    return {
+        configurable: true,
+        enumerable: false,
+        get: function () {
+            if ( !nativeGetter || this === appRequest ) {
+                return undefined;
+            }
+            return materialise(this, toPlainQuery(nativeGetter.call(this)));
+        },
+        set: function (value) {
+            materialise(this, value);
+        }
+    };
+}
+
 function ServerEngineClass(options) {
 
     const credentials = {
@@ -274,16 +404,19 @@ function ServerEngineClass(options) {
     // request pipeline (core/server.js) computes and ASSIGNS `request.query`
     // itself under 'use strict', which throws
     //   TypeError: Cannot set property query ... which has only a getter
-    // on every request under Express 5. Shadowing the getter with a writable
-    // own DATA property on the per-app request prototype restores gina's
-    // owns-the-query-parse contract; on Express 4 the property does not exist
-    // on the prototype chain as a getter, so this is a measured no-op there.
-    Object.defineProperty(app.request, 'query', {
-        value: undefined,
-        writable: true,
-        configurable: true,
-        enumerable: false
-    });
+    // on every request under Express 5. #B211 shadowed the getter with a
+    // writable own DATA property holding `undefined` — which kept the
+    // assignments alive but left every request's `request.query` undefined on
+    // Express 5 until the pipeline assigned it (its GET/HEAD branches only), so
+    // the branches that count it raw killed the bundle (#B666).
+    // #B666 — the shadow is now an ACCESSOR (queryAccessorDescriptor above): the
+    // getter materialises the engine's own parse as a plain, writable own
+    // property on the first read, the setter keeps `request.query =` working
+    // under strict mode; on Express 4 it reads undefined and stores, exactly as
+    // the data property did. No layer is registered and no router is created
+    // here, so a consumer's `app.set(...)` in onInitialize is honoured as before.
+    // was: Object.defineProperty(app.request, 'query', { value: undefined, writable: true, configurable: true, enumerable: false });
+    Object.defineProperty(app.request, 'query', queryAccessorDescriptor(app.request));
 
     return {
         instance: app,

package/framework/{v0.6.33 → v0.7.0}/core/server.isaac.js

@@ -2354,7 +2354,6 @@ function ServerEngineClass(options) {
             // never set, controller falls back to bundle's internal webroot).
             if (request.headers['x-forwarded-prefix']) {
                 var _xfp = String(request.headers['x-forwarded-prefix']).trim();
-                _xfp = _xfp.replace(/\/+$/, '');
                 if (_xfp.length > 0 && _xfp.charAt(0) !== '/') {
                     _xfp = '/' + _xfp;
                 }
@@ -2366,6 +2365,12 @@ function ServerEngineClass(options) {
                 if ( _xfp.length > 255 || !/^[A-Za-z0-9._~\/%-]*$/.test(_xfp) ) {
                     _xfp = '';
                 }
+                // #B679 — the length+charset gate above runs BEFORE this trim: `/\/+$/` backtracks
+                // quadratically on a long run of slashes (measured on a booted bundle: a 15 KB
+                // header ~100–170 ms of CPU per request; the regex alone ~8 s at the 64 KB the
+                // HTTP/2 header-list cap admits), and this block runs on every request — so a
+                // >255 value is zeroed above, before the regex ever sees it.
+                _xfp = _xfp.replace(/\/+$/, '');
                 if (_xfp.length > 0) {
                     request._ginaProxyPrefix = _xfp;
                 }