gina 0.7.0 → 0.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -76,12 +76,12 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.7.0/core/gna",
+  "main": "./framework/v0.7.1/core/gna",
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
       "import": "./index.mjs",
-      "require": "./framework/v0.7.0/core/gna.js"
+      "require": "./framework/v0.7.1/core/gna.js"
     },
     "./gna": {
       "types": "./types/gna.d.ts",
@@ -99,7 +99,7 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-timeout=120000 $GINA_TEST_FLAGS test/core/*.test.js test/lib/*.test.js test/bin/*.test.js test/integration/helper.test.js test/integration/container-boot.test.js test/integration/container-boot-init-failure.test.js test/integration/container-boot-request-parsing.test.js test/integration/container-boot-route-method.test.js test/integration/container-boot-route-confusion.test.js test/integration/container-boot-route-candidates.test.js test/integration/container-boot-head-b675.test.js test/integration/container-boot-swig-autoescape.test.js test/integration/logger-log-integrity.test.js framework/v*/test/unit/*.test.js",
+    "test": "node --test --test-timeout=120000 $GINA_TEST_FLAGS test/core/*.test.js test/lib/*.test.js test/bin/*.test.js test/integration/helper.test.js test/integration/container-boot.test.js test/integration/container-boot-init-failure.test.js test/integration/container-boot-request-parsing.test.js test/integration/container-boot-route-method.test.js test/integration/container-boot-route-confusion.test.js test/integration/container-boot-route-candidates.test.js test/integration/container-boot-head-b675.test.js test/integration/container-boot-swig-autoescape.test.js test/integration/container-boot-admin-guard-b708.test.js test/integration/container-boot-storage-query-b710.test.js test/integration/container-boot-admin-proxy-b709.test.js test/integration/container-boot-maintenance-allowfrom-b711.test.js test/integration/container-boot-maintenance-left-to-server-b715.test.js test/integration/container-boot-gina-endpoints-query-head-b717.test.js test/integration/container-boot-gina-endpoints-query-anchor-b712.test.js test/integration/container-boot-sse-h2-b722.test.js test/integration/container-boot-routing-case-b707.test.js test/integration/logger-log-integrity.test.js framework/v*/test/unit/*.test.js",
     "test:coverage": "GINA_TEST_FLAGS=--experimental-test-coverage npm test",
     "pretest:e2e": "playwright install chromium",
     "test:e2e": "playwright test test/e2e",

package/schema/app.json

@@ -52,7 +52,7 @@
         },
         "allowFrom": {
           "type": "array",
-          "description": "IP allowlist for the metrics endpoint. Requests from any other source receive 403. Defaults to localhost only.",
+          "description": "IP allowlist for the metrics endpoint. Requests from any other source receive 403. Defaults to localhost only. Since 0.7.1 a loopback entry admits a scrape only when it connects directly — one relayed by a reverse proxy on the bundle's own host is refused, the same rule as `admin.allowFrom`.",
           "items": { "type": "string" },
           "default": ["127.0.0.1", "::1"]
         },
@@ -70,12 +70,12 @@
     },
     "admin": {
       "type": "object",
-      "description": "Admin-grade /_gina/* endpoint access control. Gates /_gina/info and /_gina/cache/stats on a per-bundle IP allowlist. Same shape as `metrics.allowFrom` but a separate axis — admin endpoints expose process state (memory, uptime, HTTP/2 session counters, cache contents) and are scope-separately from Prometheus scrapes.",
+      "description": "Admin-grade /_gina/* endpoint access control. Gates /_gina/info, /_gina/cache/stats, /_gina/cache/clear, /_gina/storage/*, /_gina/release/* and /_gina/maintenance on a per-bundle IP allowlist. Same shape as `metrics.allowFrom` but a separate axis — admin endpoints expose process state (memory, uptime, HTTP/2 session counters, cache contents) and are scope-separately from Prometheus scrapes.",
       "additionalProperties": false,
       "properties": {
         "allowFrom": {
           "type": "array",
-          "description": "IP allowlist for admin /_gina/* endpoints (/_gina/info, /_gina/cache/stats). Requests from any other source receive 403. Defaults to localhost only (127.0.0.1, ::1). Empty array `[]` denies everyone — explicit lockdown choice. Reads from req.socket.remoteAddress only — X-Forwarded-For is NOT trusted because reverse proxies could spoof it.",
+          "description": "IP allowlist for admin /_gina/* endpoints (/_gina/info, /_gina/cache/*, /_gina/storage/*, /_gina/release/*, /_gina/maintenance). Requests from any other source receive 403. Defaults to localhost only (127.0.0.1, ::1). Empty array `[]` denies everyone — explicit lockdown choice. Reads from req.socket.remoteAddress only — X-Forwarded-For is NOT trusted because reverse proxies could spoof it. Since 0.7.1 a loopback entry admits a caller only when it connects directly: a request from 127.0.0.1 or ::1 that carries a proxy signal (an X-Forwarded-* or Forwarded header, or a port-less Host unless server.proxy.requireForwardedHeaders is true) comes from a reverse proxy on the bundle's own host and is refused. List the address of a proxy running on another host to admit what it relays.",
           "items": { "type": "string" },
           "default": ["127.0.0.1", "::1"]
         }

package/script/post_install.js

@@ -23,6 +23,22 @@ var runtime     = require(__dirname + '/../utils/runtime.js');
 var isWin32 = function() {
     return (process.platform === 'win32') ? true : false;
 };
+/**
+ * Escapes the regular-expression metacharacters of `s`, so an install prefix or a home
+ * directory is matched as the literal path it is (#B665): a path holding `+` or `[`
+ * threw, and its `.` matched any character. The same one-liner as
+ * `lib/cmd/bundle/inc/name-rewrite.js`'s `escapeRegex`, kept here because this script
+ * runs before a framework directory can be relied on.
+ *
+ * @param {string} s - A path
+ * @returns {string} `s` with every metacharacter backslash-escaped
+ *
+ * @example
+ *  new RegExp('^' + escapeRegex('/opt/c++/.npm-global')).test('/opt/c++/.npm-global/lib') // → true
+ */
+var escapeRegex = function(s) {
+    return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+};
 var isWritableSync = function(path) {
     var canWrite = false;
     if ( fs.accessSync && typeof(fs.accessSync) != 'undefined' ) {
@@ -331,7 +347,8 @@ function PostInstall() {
                 // OK ... found installed gina but on a different prefix
                 // In this case, let's assume that it is not really installed
                 console.info('A previous version of gina has been detected');
-                if ( !new RegExp('^'+ self.prefix).test(hasFoundGina.dependencies.gina.path) ) {
+                // was: if ( !new RegExp('^'+ self.prefix).test(hasFoundGina.dependencies.gina.path) ) {
+                if ( !new RegExp('^'+ escapeRegex(self.prefix)).test(hasFoundGina.dependencies.gina.path) ) {
                     self.isGinaInstalled = false;
                     console.info('Ignoring previous because of a mismatching install prefix');
                 }
@@ -775,7 +792,8 @@ function PostInstall() {
         }
 
         var inFile = null;
-        var patt = _(self.prefix.replace( new RegExp( '^' +getUserHome() ), '(.*)[$]HOME') + '/bin', true);
+        // was: var patt = _(self.prefix.replace( new RegExp( '^' +getUserHome() ), '(.*)[$]HOME') + '/bin', true);
+        var patt = _(self.prefix.replace( new RegExp( '^' + escapeRegex(getUserHome()) ), '(.*)[$]HOME') + '/bin', true);
         try {
             inFile = execSync("cat ~/.profile | grep -Eo '" + patt +"'", {shell: "/bin/bash"}).toString();
         } catch (err) {

package/script/pre_install.js

@@ -247,7 +247,8 @@ function PreInstall() {
 
                 // OK ... found installed gina but on a different prefix
                 // In this case, let's assume that it is not really installed
-                if ( !new RegExp('^'+ self.prefix).test(hasFoundGina.dependencies.gina.path) ) {
+                // was: if ( !new RegExp('^'+ self.prefix).test(hasFoundGina.dependencies.gina.path) ) {
+                if ( !new RegExp('^'+ escapeRegex(self.prefix)).test(hasFoundGina.dependencies.gina.path) ) {
                     self.isGinaInstalled = false;
                 }
             }
@@ -597,6 +598,24 @@ function PreInstall() {
         return (process.platform === 'win32') ? true : false;
     };
 
+    /**
+     * Escapes the regular-expression metacharacters of `s`, so an install prefix is
+     * matched as the literal path it is (#B665): a prefix holding `+` or `[` threw and
+     * failed the install, and its `.` matched any character. The same one-liner as
+     * `lib/cmd/bundle/inc/name-rewrite.js`'s `escapeRegex`, kept here because this script
+     * runs before a framework directory can be relied on.
+     *
+     * @inner
+     * @param {string} s - A path
+     * @returns {string} `s` with every metacharacter backslash-escaped
+     *
+     * @example
+     *  new RegExp('^' + escapeRegex('/opt/c++/.npm-global')).test('/opt/c++/.npm-global/var') // → true
+     */
+    var escapeRegex = function(s) {
+        return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    };
+
     var existsSync = function(path) {
         if ( fs.accessSync && typeof(fs.accessSync) != 'undefined' ) {
             try {
@@ -644,7 +663,9 @@ function PreInstall() {
         // Means `/usr/local/var/lock` or `/usr/local/var/run` by default.
         var runDir = (isWin32()) ? getUserHome() + '\\.gina\\run' : prefix+'/var/lock';
 
-        if ( !isWin32() && new RegExp('^'+ prefix).test(runDir) && !isWritableSync(prefix) ) {
+        // #B665 — the prefix is matched literally (see escapeRegex): a `c++` prefix threw here.
+        // was: if ( !isWin32() && new RegExp('^'+ prefix).test(runDir) && !isWritableSync(prefix) ) {
+        if ( !isWin32() && new RegExp('^'+ escapeRegex(prefix)).test(runDir) && !isWritableSync(prefix) ) {
             runDir = getUserHome() +'/.gina/run';
             if ( !existsSync(runDir) ) {
                 fs.mkdirSync(runDir)
@@ -717,14 +738,16 @@ function PreInstall() {
                     prefix+'/var/tmp'
                 ;
 
-                if ( new RegExp('^'+ prefix).test(tmpDir) && !isWritableSync(prefix) ) {
+                // was: if ( new RegExp('^'+ prefix).test(tmpDir) && !isWritableSync(prefix) ) {
+                if ( new RegExp('^'+ escapeRegex(prefix)).test(tmpDir) && !isWritableSync(prefix) ) {
                     tmpDir = getUserHome() +'/.gina/tmp';
                     if ( !existsSync(tmpDir) ) {
                         fs.mkdirSync(tmpDir)
                     }
                 }
 
-                if ( new RegExp('^'+ prefix +'/var').test(tmpDir) && !existsSync(prefix+'/var') ) {
+                // was: if ( new RegExp('^'+ prefix +'/var').test(tmpDir) && !existsSync(prefix+'/var') ) {
+                if ( new RegExp('^'+ escapeRegex(prefix +'/var')).test(tmpDir) && !existsSync(prefix+'/var') ) {
                     fs.mkdirSync(prefix+'/var');
                 }
             }
@@ -775,7 +798,8 @@ function PreInstall() {
                 prefix+'/var/log'
             ;
 
-            if ( new RegExp('^'+ prefix).test(logDir) && !isWritableSync(prefix) ) {
+            // was: if ( new RegExp('^'+ prefix).test(logDir) && !isWritableSync(prefix) ) {
+            if ( new RegExp('^'+ escapeRegex(prefix)).test(logDir) && !isWritableSync(prefix) ) {
                 logDir = getUserHome() +'/.gina/log';
                 if ( !existsSync(logDir) ) {
                     fs.mkdirSync(logDir)
@@ -784,7 +808,8 @@ function PreInstall() {
                 return logDir
             }
 
-            if ( new RegExp('^'+ prefix +'/var').test(logDir) && !existsSync(prefix+'/var') ) {
+            // was: if ( new RegExp('^'+ prefix +'/var').test(logDir) && !existsSync(prefix+'/var') ) {
+            if ( new RegExp('^'+ escapeRegex(prefix +'/var')).test(logDir) && !existsSync(prefix+'/var') ) {
                 fs.mkdirSync(prefix+'/var');
             }
 

package/utils/helper.js

@@ -1,6 +1,9 @@
 var fs = require('fs');
 var os = require('os');
-var { execSync } = require('child_process');
+// #B665 S2 (2026-09-27) — npm runs from an argument vector, the form #B663 gave the install
+// scripts: `$(which npm)` split an npm installed under a path holding a space.
+// var { execSync } = require('child_process');
+var { execFileSync } = require('child_process');
 
 var lib         = null;
 var console     = null;
@@ -39,7 +42,8 @@ function MainHelper(opt) {
 
             try {
                 pkg = packObj;
-                self.defaultPrefix = ( typeof(packObj.config) != 'undefined' && typeof(packObj.config.prefix) != 'undefined' ) ? packObj.config.prefix : execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+                // was: self.defaultPrefix = ( typeof(packObj.config) != 'undefined' && typeof(packObj.config.prefix) != 'undefined' ) ? packObj.config.prefix : execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+                self.defaultPrefix = ( typeof(packObj.config) != 'undefined' && typeof(packObj.config.prefix) != 'undefined' ) ? packObj.config.prefix : execFileSync('npm', ['config', 'get', 'prefix', '--quiet']).toString().replace(/\n$/g, '');
                 self.defaultPrefix = self.defaultPrefix.replace(/^\~/, getUserHome());
                 prefix = getEnvVar('GINA_PREFIX') || self.defaultPrefix;
                 self.optionalPrefix = pkg.config.optionalPrefix.replace(/^\~/, getUserHome());
@@ -47,13 +51,18 @@ function MainHelper(opt) {
                 console.warn('MainHelper::Init() Execption: '+ err.stack);
                 console.debug('Trying alternative config');
                 try {
-                    self.defaultPrefix = execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+                    // was: self.defaultPrefix = execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+                    self.defaultPrefix = execFileSync('npm', ['config', 'get', 'prefix', '--quiet']).toString().replace(/\n$/g, '');
                     prefix = getEnvVar('GINA_PREFIX') || self.defaultPrefix;
-                    cmd = 'npm list gina --long --json --prefix='+ prefix;
+                    // #B665 S2 (2026-09-27) — an argument vector: the prefix reaches npm whole.
+                    // was: cmd = 'npm list gina --long --json --prefix='+ prefix;
+                    cmd = ['list', 'gina', '--long', '--json', '--prefix='+ prefix];
                     if (self.isGlobalInstall) {
-                        cmd += ' -g';
+                        // was: cmd += ' -g';
+                        cmd.push('-g');
                     }
-                    pkg = execSync(cmd).toString().replace(/\n$/g, '');
+                    // was: pkg = execSync(cmd).toString().replace(/\n$/g, '');
+                    pkg = execFileSync('npm', cmd).toString().replace(/\n$/g, '');
                     self.optionalPrefix = JSON.parse(pkg).dependencies.gina.config.optionalPrefix.replace(/^\~/, getUserHome());
                 } catch (_err) {
                     throw new Error(_err.stack +'\n'+ err.stack)
@@ -245,7 +254,8 @@ function MainHelper(opt) {
             return logDir
         }
 
-        var prefix = getEnvVar('GINA_PREFIX') || self.prefix || self.defaultPrefix || execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+        // was: var prefix = getEnvVar('GINA_PREFIX') || self.prefix || self.defaultPrefix || execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+        var prefix = getEnvVar('GINA_PREFIX') || self.prefix || self.defaultPrefix || execFileSync('npm', ['config', 'get', 'prefix', '--quiet']).toString().replace(/\n$/g, '');
 
         if ( isWin32() ) {
             logDir = process.env.LOG ||
@@ -321,7 +331,8 @@ function MainHelper(opt) {
             return runDir
         }
 
-        var prefix = getEnvVar('GINA_PREFIX') || self.prefix || self.defaultPrefix || execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+        // was: var prefix = getEnvVar('GINA_PREFIX') || self.prefix || self.defaultPrefix || execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+        var prefix = getEnvVar('GINA_PREFIX') || self.prefix || self.defaultPrefix || execFileSync('npm', ['config', 'get', 'prefix', '--quiet']).toString().replace(/\n$/g, '');
 
         runDir = (isWin32()) ? getUserHome() + '\\.gina\\run' : prefix + '/var/lock';
 
@@ -386,7 +397,8 @@ function MainHelper(opt) {
             return dir
         }
 
-        var prefix = getEnvVar('GINA_PREFIX') || self.prefix  || self.defaultPrefix || execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+        // was: var prefix = getEnvVar('GINA_PREFIX') || self.prefix  || self.defaultPrefix || execSync('$(which npm) config get prefix --quiet').toString().replace(/\n$/g, '');
+        var prefix = getEnvVar('GINA_PREFIX') || self.prefix  || self.defaultPrefix || execFileSync('npm', ['config', 'get', 'prefix', '--quiet']).toString().replace(/\n$/g, '');
 
         // support for node 0.10.x & 0.11.x
         var tmp = (os.tmpdir) ? os.tmpdir : function() {

package/framework/v0.7.0/VERSION

@@ -1 +0,0 @@
-0.7.0

package/framework/v0.7.0/lib/admin/src/main.js

@@ -1,217 +0,0 @@
-/*
- * This file is part of the gina package.
- * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-/**
- * @module gina/lib/admin
- *
- * Admin /_gina/* IP-allowlist gate (#S7). Single source of truth for the
- * access check on the admin-grade /_gina/* endpoints (`/_gina/info`,
- * `/_gina/cache/stats`). Both server engines (`server.js` and
- * `server.isaac.js`) previously carried a byte-identical copy of this
- * helper; this module is now the single source and both engines call
- * `lib.admin.isClientAllowed(req)`.
- *
- * The allowlist is resolved from `process.gina._adminAllowList`, which
- * `gna.js` populates at bundle init from `app.json` `admin.allowFrom`
- * (defaults to loopback `['127.0.0.1', '::1']`). Sibling of
- * `lib.metrics.isClientAllowed` on a separate axis — admin endpoints expose
- * process state (memory, uptime, HTTP/2 session counters, cache contents)
- * and are gated separately from Prometheus scrapes.
- *
- * Also the home of the cross-origin WRITE guard (#B384) that fronts the same
- * family. The two are complementary and neither subsumes the other: the IP
- * allowlist answers "may this address talk to admin endpoints at all", while
- * {@link isCrossOriginWrite} answers "did this state-changing request actually
- * originate from the operator, or from a page that merely borrowed their
- * browser's ambient IP". Kept as a SEPARATE function rather than folded into
- * `isClientAllowed` so the six admin GET endpoints keep their existing
- * semantics and the name never over-promises.
- *
- * Registered as a PLAIN `require` in `lib/index.js` (not `_require`): a
- * stateless pure-function leaf with no instance/singleton state to
- * hot-reload — same #B32-residual precedent as merge / uuid / Collection.
- *
- * @example
- * // from an engine handler (lib is the framework lib registry)
- * if (!lib.admin.isClientAllowed(request)) {
- *     response.statusCode = 403;
- *     return response.end(JSON.stringify({ error: 'forbidden' }));
- * }
- */
-
-/**
- * Default allowlist used when `admin.allowFrom` is unset — loopback only.
- * @constant {string[]}
- */
-var DEFAULT_ALLOW_LIST = ['127.0.0.1', '::1'];
-
-/**
- * Decide whether a request's client IP is in an explicit allowlist. Inner
- * seam exposed for branch testing without mutating `process.gina` state.
- *
- * Reads the client IP from `req.socket.remoteAddress` only — never trusts
- * `X-Forwarded-For` (reverse proxies could spoof it). Normalises
- * `::ffff:IPv4` (IPv6-mapped IPv4) → `IPv4` so listing `127.0.0.1` matches
- * both forms. An empty list (`[]`) denies everyone (explicit lockdown).
- *
- * @inner
- * @param {http.IncomingMessage|http2.Http2ServerRequest} req
- * @param {string[]} list the allowlist to test against
- * @returns {boolean} true if the client IP is in `list`
- * @example
- * _isAllowedWithList({ socket: { remoteAddress: '127.0.0.1' } }, ['127.0.0.1']); // true
- * _isAllowedWithList({ socket: { remoteAddress: '10.0.0.1' } }, []);             // false
- */
-function _isAllowedWithList(req, list) {
-    if (list.length === 0) return false;
-    var ip = (req.socket && req.socket.remoteAddress)
-          || (req.connection && req.connection.remoteAddress)
-          || '';
-    if (ip.indexOf('::ffff:') === 0) ip = ip.slice(7);
-    return list.indexOf(ip) >= 0;
-}
-
-/**
- * IP-allowlist check for the admin-grade /_gina/* endpoints.
- *
- * Resolves the allowlist from `process.gina._adminAllowList` (set by
- * `gna.js` from `app.json` admin.allowFrom), falling back to loopback-only
- * when the global is missing (init not yet fired — the safest default).
- *
- * @param {http.IncomingMessage|http2.Http2ServerRequest} req
- * @returns {boolean} true if the client IP is allowed, false otherwise
- * @example
- * if (!lib.admin.isClientAllowed(request)) { return self.throwError(403); }
- */
-function isClientAllowed(req) {
-    var list = (typeof process.gina === 'object' && process.gina && Array.isArray(process.gina._adminAllowList))
-        ? process.gina._adminAllowList
-        : DEFAULT_ALLOW_LIST;
-    return _isAllowedWithList(req, list);
-}
-
-/**
- * Request methods that cannot mutate state (RFC 9110 §9.2.1). Mirrors the set
- * in `core/controller/controller.js` — a cross-origin GET is not a CSRF vector,
- * and refusing one would break the Inspector's deliberately cross-origin
- * GET/SSE channels (`/_gina/agent`, `/_gina/logs`, `/_gina/indexes`), where
- * `core/server.js` documents that "cross-origin is the norm here".
- * @constant {Object.<string, boolean>}
- */
-var SAFE_HTTP_METHODS = { GET: true, HEAD: true, OPTIONS: true, TRACE: true };
-
-/**
- * Decide whether a request method is SAFE (non-mutating).
- *
- * @param {string} method - the HTTP method
- * @returns {boolean} true when the method cannot mutate state
- * @example
- * isSafeMethod('get');   // true
- * isSafeMethod('POST');  // false
- * isSafeMethod(null);    // false
- */
-function isSafeMethod(method) {
-    return SAFE_HTTP_METHODS[ String(method || '').toUpperCase() ] === true;
-}
-
-/**
- * Detect a browser-driven CROSS-ORIGIN WRITE to the `/_gina/*` control family
- * (#B384).
- *
- * These endpoints authenticate with an AMBIENT credential — the client's IP,
- * via {@link isClientAllowed} — and a browser attaches that automatically to
- * every request a page makes. That is precisely the precondition for CSRF: an
- * operator browsing from an allowlisted address (loopback by DEFAULT, i.e. the
- * machine running the bundle) can be lured to a page that silently writes to
- * `/_gina/storage/gc`, `/_gina/cache/clear`, `/_gina/release/rebuild` or
- * `/_gina/maintenance`. The first three take their entire input from the QUERY
- * STRING and read no body at all, so the attack needs no `fetch` and no CORS
- * reasoning — a plain auto-submitting `<form>` suffices, and browsers have
- * always permitted a form to POST cross-origin.
- *
- * Two signals, in order of trustworthiness:
- *
- *  1. `Sec-Fetch-Site` — computed by the browser and a FORBIDDEN header name,
- *     so page script cannot forge it. It is also independent of how a reverse
- *     proxy rewrites `Host`, which is why it is preferred. `same-origin`
- *     passes; `none` passes (a user-initiated navigation — typed URL or
- *     bookmark — is not a forged request); `same-site` and `cross-site` are
- *     REFUSED, since a sibling subdomain is still a different origin and can
- *     still forge.
- *  2. `Origin` compared against the authority the client actually connected
- *     to — the fallback for browsers predating Fetch Metadata. Built from
- *     `:authority` (HTTP/2) or `Host` (HTTP/1.1) ONLY, NEVER from
- *     `X-Forwarded-Host` or any other forwarded header: #B367 established
- *     those are attacker-controlled, and a guard comparing against a value the
- *     attacker supplies is no guard. `Origin: null` (sandboxed iframe,
- *     `file://` page) is refused — the #CSRF3 precedent.
- *
- * NO browser signal at all ⇒ ALLOWED. CSRF attacks ambient browser
- * credentials; a client sending neither header is not a browser (curl, the
- * gina CLI's own probes, a deploy script), so refusing it would break every
- * documented operator workflow while stopping nothing.
- *
- * ⚠️ Residual, deliberately pinned: a browser old enough to send NEITHER
- * `Sec-Fetch-Site` NOR `Origin` on a POST would pass. Every current browser
- * sends `Origin` on cross-origin POSTs, so this is a legacy-only gap — and a
- * narrower one than the IP allowlist already fronting these endpoints.
- *
- * ⚠️ Second residual: a reverse proxy that REWRITES `Host` to an internal
- * upstream name desynchronises the fallback comparison, which would refuse a
- * legitimate same-origin write from a pre-Fetch-Metadata browser. Modern
- * browsers are unaffected (signal 1 never consults `Host`), and these
- * endpoints are IP-gated on `req.socket.remoteAddress`, which behind a proxy
- * is the PROXY's address — so the deployment must already have opted in by
- * listing it.
- *
- * @param {http.IncomingMessage|http2.Http2ServerRequest} req
- * @returns {boolean} true when the request is a browser-driven cross-origin
- *                    write and must be refused
- * @example
- * isCrossOriginWrite({ headers: { 'sec-fetch-site': 'same-origin' } });          // false
- * isCrossOriginWrite({ headers: { 'sec-fetch-site': 'cross-site' } });           // true
- * isCrossOriginWrite({ headers: {} });                                           // false (curl)
- * isCrossOriginWrite({ headers: { origin: 'http://evil.tld', host: 'app.tld' } }); // true
- * isCrossOriginWrite({ headers: { origin: 'http://app.tld', host: 'app.tld' } }); // false
- */
-function isCrossOriginWrite(req) {
-    if ( typeof(req) != 'object' || req === null ) {
-        return true; // malformed ⇒ fail CLOSED
-    }
-    var headers = req.headers || {};
-
-    var site = headers['sec-fetch-site'];
-    if ( typeof(site) == 'string' && site.trim() !== '' ) {
-        site = site.trim().toLowerCase();
-        return !( site === 'same-origin' || site === 'none' );
-    }
-
-    var origin = headers['origin'];
-    if ( typeof(origin) != 'string' || origin.trim() === '' ) {
-        return false; // no browser signal ⇒ not a browser ⇒ not CSRF
-    }
-    origin = origin.trim();
-    if ( origin.toLowerCase() === 'null' ) {
-        return true; // sandboxed iframe / file:// — #CSRF3 precedent
-    }
-    var authority = headers[':authority'] || headers['host'] || '';
-    if ( typeof(authority) != 'string' || authority === '' ) {
-        return true; // nothing trustworthy to compare against ⇒ fail CLOSED
-    }
-    var originHost = origin.replace(/^[a-z0-9+.\-]+:\/\//i, '');
-    return ( originHost.toLowerCase() !== authority.toLowerCase() );
-}
-
-module.exports = {
-    isClientAllowed    : isClientAllowed,
-    isCrossOriginWrite : isCrossOriginWrite,
-    isSafeMethod       : isSafeMethod,
-    _isAllowedWithList : _isAllowedWithList,
-    DEFAULT_ALLOW_LIST : DEFAULT_ALLOW_LIST,
-    SAFE_HTTP_METHODS  : SAFE_HTTP_METHODS
-};

package/framework/v0.7.0/lib/cmd/project/restart.js

@@ -1,85 +0,0 @@
-var exec        = require('child_process').exec;
-
-var CmdHelper   = require('./../helper');
-var console     = lib.logger;
-/**
- * @module gina/lib/cmd/project/restart
- */
-/**
- * Restarts all bundles in a project.
- * Delegates to `gina bundle:restart @<project>` (bulk mode).
- *
- * Usage:
- *  gina project:restart @<project_name>
- *
- * @class Restart
- * @constructor
- * @param {object} opt - Parsed command-line options
- * @param {object} opt.client - Socket client or process.stdout for terminal output
- * @param {string[]} opt.argv - Full argv array
- * @param {number} [opt.debugPort] - Node.js inspector port
- * @param {boolean} [opt.debugBrkEnabled] - True when --inspect-brk is active
- * @param {object} cmd - The cmd dispatcher object (lib/cmd/index.js)
- */
-function Restart(opt, cmd) {
-
-    var self = {};
-
-    var init = function(opt, cmd) {
-        // import CMD helpers
-        new CmdHelper(self, opt.client, { port: opt.debugPort, brkEnabled: opt.debugBrkEnabled });
-
-        // check CMD configuration
-        if (!isCmdConfigured()) return false;
-
-        self.cmdStr = process.argv.splice(0, 2).join(' ');
-
-        // collect --flags to forward
-        self.inheritedArgv = [];
-        for (var i = 0, len = process.argv.length; i < len; i++) {
-            if ( /^\-\-/.test(process.argv[i]) ) {
-                self.inheritedArgv.push(process.argv[i])
-            }
-        }
-        self.inheritedArgv = self.inheritedArgv.join(' ');
-
-        restart(opt, cmd);
-    }
-
-    var restart = function(opt, cmd) {
-
-        var _cmd = '$gina bundle:restart @' + self.projectName;
-        if (self.inheritedArgv != '') {
-            _cmd += ' ' + self.inheritedArgv;
-        }
-        if (opt.debugPort) {
-            _cmd += ' --inspect';
-            if (opt.debugBrkEnabled) {
-                _cmd += '-brk'
-            }
-            _cmd += '=' + opt.debugPort;
-        }
-        _cmd = _cmd.replace(/\$(gina)/g, self.cmdStr);
-
-        console.info('Restarting all bundles in @' + self.projectName + ' ...');
-        console.debug('Executing: ' + _cmd);
-
-        // Re-export the home: the bootstrap env sweep strips GINA_* from
-        // process.env, so the delegated bundle command would otherwise act
-        // on the default home (see linkGina in project/add.js).
-        exec(_cmd, { maxBuffer: 1024 * 500, env: Object.assign({}, process.env, { GINA_HOMEDIR: GINA_HOMEDIR }) }, function(err, stdout, stderr) {
-            if (stdout) {
-                console.log(stdout.replace(/\n\rTrying to.*/gm, ''));
-            }
-            if (err) {
-                console.error(err.toString());
-                return process.exit(1);
-            }
-            process.exit(0);
-        });
-    }
-
-    init(opt, cmd);
-}
-
-module.exports = Restart

package/framework/v0.7.0/lib/cmd/project/start.js

@@ -1,85 +0,0 @@
-var exec        = require('child_process').exec;
-
-var CmdHelper   = require('./../helper');
-var console     = lib.logger;
-/**
- * @module gina/lib/cmd/project/start
- */
-/**
- * Starts all bundles in a project.
- * Delegates to `gina bundle:start @<project>` (bulk mode).
- *
- * Usage:
- *  gina project:start @<project_name> [ --env=dev, --scope=local, --inspect-brk=5000 ]
- *
- * @class Start
- * @constructor
- * @param {object} opt - Parsed command-line options
- * @param {object} opt.client - Socket client or process.stdout for terminal output
- * @param {string[]} opt.argv - Full argv array
- * @param {number} [opt.debugPort] - Node.js inspector port
- * @param {boolean} [opt.debugBrkEnabled] - True when --inspect-brk is active
- * @param {object} cmd - The cmd dispatcher object (lib/cmd/index.js)
- */
-function Start(opt, cmd) {
-
-    var self = {};
-
-    var init = function(opt, cmd) {
-        // import CMD helpers
-        new CmdHelper(self, opt.client, { port: opt.debugPort, brkEnabled: opt.debugBrkEnabled });
-
-        // check CMD configuration
-        if (!isCmdConfigured()) return false;
-
-        self.cmdStr = process.argv.splice(0, 2).join(' ');
-
-        // collect --flags to forward
-        self.inheritedArgv = [];
-        for (var i = 0, len = process.argv.length; i < len; i++) {
-            if ( /^\-\-/.test(process.argv[i]) ) {
-                self.inheritedArgv.push(process.argv[i])
-            }
-        }
-        self.inheritedArgv = self.inheritedArgv.join(' ');
-
-        start(opt, cmd);
-    }
-
-    var start = function(opt, cmd) {
-
-        var _cmd = '$gina bundle:start @' + self.projectName;
-        if (self.inheritedArgv != '') {
-            _cmd += ' ' + self.inheritedArgv;
-        }
-        if (opt.debugPort) {
-            _cmd += ' --inspect';
-            if (opt.debugBrkEnabled) {
-                _cmd += '-brk'
-            }
-            _cmd += '=' + opt.debugPort;
-        }
-        _cmd = _cmd.replace(/\$(gina)/g, self.cmdStr);
-
-        console.info('Starting all bundles in @' + self.projectName + ' ...');
-        console.debug('Executing: ' + _cmd);
-
-        // Re-export the home: the bootstrap env sweep strips GINA_* from
-        // process.env, so the delegated bundle command would otherwise act
-        // on the default home (see linkGina in project/add.js).
-        exec(_cmd, { maxBuffer: 1024 * 500, env: Object.assign({}, process.env, { GINA_HOMEDIR: GINA_HOMEDIR }) }, function(err, stdout, stderr) {
-            if (stdout) {
-                console.log(stdout);
-            }
-            if (err) {
-                console.error(err.toString());
-                return process.exit(1);
-            }
-            process.exit(0);
-        });
-    }
-
-    init(opt, cmd);
-}
-
-module.exports = Start