mastercontroller 1.2.12 → 1.2.14

package/MasterHtml.js

@@ -1,4 +1,4 @@
-// version 0.0.23
+// version 0.0.25
 
 var master = require('./MasterControl');
 var fs = require('fs');
@@ -7,6 +7,14 @@ var toolClass =  require('./MasterTools');
 var temp = new tempClass();
 var tools = new toolClass();
 
+// Enhanced error handling
+const { handleTemplateError } = require('./error/MasterBackendErrorHandler');
+const { safeReadFile, safeFileExists } = require('./error/MasterErrorMiddleware');
+const { logger } = require('./error/MasterErrorLogger');
+
+// Security - Sanitization
+const { sanitizeTemplateHTML, sanitizeUserHTML, escapeHTML } = require('./security/MasterSanitizer');
+
 class html {
 
 	javaScriptSerializer(name, obj){
@@ -17,21 +25,41 @@ class html {
 
 	// render partial views
 	renderPartial(path, data){
-		
+		try {
+			var partialViewUrl = `/app/views/${path}`;
+			var fullPath = master.router.currentRoute.root + partialViewUrl;
+
+			const fileResult = safeReadFile(fs, fullPath);
+
+			if (!fileResult.success) {
+				logger.warn({
+					code: 'MC_ERR_VIEW_NOT_FOUND',
+					message: `Partial view not found: ${path}`,
+					file: fullPath
+				});
+				return `<!-- Partial view not found: ${path} -->`;
+			}
 
-		var partialViewUrl = `/app/views/${path}`;
-		var filepartialView = fs.readFileSync(master.router.currentRoute.root + partialViewUrl, 'utf8');
+			var partialView = null;
+			if(master.overwrite.isTemplate){
+				partialView = master.overwrite.templateRender(data, "renderPartialView");
+			}
+			else{
+				partialView =  temp.htmlBuilder(fileResult.content, data);
+			}
 
-		var partialView = null;
-		if(master.overwrite.isTemplate){
-			partialView = master.overwrite.templateRender(data, "renderPartialView");
-		}
-		else{
-			partialView =  temp.htmlBuilder(filepartialView, data);	
+			return partialView;
+		} catch (error) {
+			const mcError = handleTemplateError(error, path, data);
+			logger.error({
+				code: mcError.code,
+				message: mcError.message,
+				file: path,
+				originalError: error
+			});
+			return `<!-- Error rendering partial: ${path} -->`;
 		}
 
-		return partialView;
-
 	}
 
 	   // render all your link tags styles given the folder location
@@ -447,7 +475,7 @@ class html {
 		return rangeField;
 	}
 
-	   // allows you to add data object to params 
+	   // allows you to add data object to params
 	addDataToParams(data){
 
 		//loop through data and add it to new oobjects prototype
@@ -457,7 +485,66 @@ class html {
 			master.view.extend(newObj);
 		}
 	}
-	
+
+	// ==================== Security Methods ====================
+
+	/**
+	 * Sanitize user-generated HTML content
+	 * Use this for any HTML that comes from user input
+	 * @param {string} html - HTML content to sanitize
+	 * @returns {string} - Sanitized HTML
+	 */
+	sanitizeHTML(html) {
+		return sanitizeUserHTML(html);
+	}
+
+	/**
+	 * Escape HTML special characters
+	 * Use this to display user input as text (not HTML)
+	 * @param {string} text - Text to escape
+	 * @returns {string} - Escaped text safe for display
+	 */
+	escapeHTML(text) {
+		return escapeHTML(text);
+	}
+
+	/**
+	 * Render user content safely
+	 * Sanitizes HTML and wraps in container
+	 * @param {string} content - User-generated content
+	 * @param {string} containerTag - HTML tag to wrap content (default: div)
+	 * @param {object} attrs - Attributes for container
+	 * @returns {string} - Safe HTML
+	 */
+	renderUserContent(content, containerTag = 'div', attrs = {}) {
+		const sanitized = sanitizeUserHTML(content);
+
+		let attrStr = '';
+		for (const [key, value] of Object.entries(attrs)) {
+			attrStr += ` ${key}="${escapeHTML(String(value))}"`;
+		}
+
+		return `<${containerTag}${attrStr}>${sanitized}</${containerTag}>`;
+	}
+
+	/**
+	 * Create safe text node content
+	 * @param {string} text - Text content
+	 * @returns {string} - HTML-escaped text
+	 */
+	textNode(text) {
+		return escapeHTML(text);
+	}
+
+	/**
+	 * Create safe attribute value
+	 * @param {string} value - Attribute value
+	 * @returns {string} - Escaped and quoted value
+	 */
+	safeAttr(value) {
+		return `"${escapeHTML(String(value))}"`;
+	}
+
 }
 
 master.extendView("html", html);

package/MasterRouter.js

@@ -1,4 +1,4 @@
-// version 0.0.248
+// version 0.0.250
 
 var master = require('./MasterControl');
 var toolClass =  require('./MasterTools');
@@ -7,6 +7,17 @@ var path = require('path');
 var currentRoute = {};
 var tools = new toolClass();
 
+// Enhanced error handling
+const { handleRoutingError, handleControllerError, sendErrorResponse } = require('./error/MasterBackendErrorHandler');
+const { logger } = require('./error/MasterErrorLogger');
+const { performanceTracker, errorHandlerMiddleware } = require('./error/MasterErrorMiddleware');
+
+// Security - Input validation and sanitization
+const { validator, detectPathTraversal, detectSQLInjection, detectCommandInjection } = require('./security/MasterValidator');
+const { escapeHTML } = require('./security/MasterSanitizer');
+
+const isDevelopment = process.env.NODE_ENV !== 'production' && process.env.master === 'development';
+
  var normalizePaths = function(requestPath, routePath, requestParams){
     var obj = {
         requestPath : "",
@@ -21,8 +32,14 @@ var tools = new toolClass();
         routeItem = routePathList[i];
         if(routeItem){
             if(routeItem.indexOf(":") > -1){
-                requestParams[routeItem.replace(":", "")] = requestItem;
-                routePathList[i] = requestItem;
+                const paramName = routeItem.replace(":", "");
+                const paramValue = requestItem;
+
+                // Security: Sanitize route parameter
+                const sanitizedValue = sanitizeRouteParam(paramName, paramValue);
+
+                requestParams[paramName] = sanitizedValue;
+                routePathList[i] = sanitizedValue;
             }
         }
     }
@@ -32,10 +49,66 @@ var tools = new toolClass();
     return obj;
  }
 
+ /**
+  * Sanitize route parameter to prevent injection attacks
+  */
+ var sanitizeRouteParam = function(paramName, paramValue) {
+    if (!paramValue || typeof paramValue !== 'string') {
+        return paramValue;
+    }
+
+    // Check for path traversal attempts
+    const pathCheck = detectPathTraversal(paramValue);
+    if (!pathCheck.safe) {
+        logger.warn({
+            code: 'MC_SECURITY_PATH_TRAVERSAL',
+            message: 'Path traversal attempt detected in route parameter',
+            param: paramName,
+            value: paramValue
+        });
+
+        // Remove dangerous content
+        return paramValue.replace(/\.\./g, '').replace(/\.\//g, '');
+    }
+
+    // Check for SQL injection attempts
+    const sqlCheck = detectSQLInjection(paramValue);
+    if (!sqlCheck.safe) {
+        logger.warn({
+            code: 'MC_SECURITY_SQL_INJECTION',
+            message: 'SQL injection attempt detected in route parameter',
+            param: paramName,
+            value: paramValue
+        });
+
+        // Escape to prevent injection
+        return escapeHTML(paramValue);
+    }
+
+    // Check for command injection attempts
+    const cmdCheck = detectCommandInjection(paramValue);
+    if (!cmdCheck.safe) {
+        logger.warn({
+            code: 'MC_SECURITY_COMMAND_INJECTION',
+            message: 'Command injection attempt detected in route parameter',
+            param: paramName,
+            value: paramValue
+        });
+
+        // Remove dangerous characters
+        return paramValue.replace(/[;&|`$()]/g, '');
+    }
+
+    // Basic sanitization for all params
+    return escapeHTML(paramValue);
+ }
+
  var processRoutes = function(requestObject, emitter, routeObject){
     var routeList = routeObject.routes;
     var root = routeObject.root;
     var isComponent = routeObject.isComponent;
+    var currentRouteBeingProcessed = null; // Track current route for better error messages
+
     try{
             // Ensure routes is an array
             if(!Array.isArray(routeList)){
@@ -51,56 +124,117 @@ var tools = new toolClass();
             if(routeList.length > 0){
                 // loop through routes
                 for(var item in routeList){
+                    // Store current route for error handling
+                    currentRouteBeingProcessed = {
+                        path: routeList[item].path,
+                        toController: routeList[item].toController,
+                        toAction: routeList[item].toAction,
+                        type: routeList[item].type
+                    };
+
+                    try {
+                        requestObject.toController = routeList[item].toController;
+                        requestObject.toAction = routeList[item].toAction;
+
+                        // FIX: Create a clean copy of params for each route test to prevent parameter pollution
+                        // This prevents parameters from non-matching routes from accumulating in requestObject.params
+                        var testParams = Object.assign({}, requestObject.params);
+                        var pathObj = normalizePaths(requestObject.pathName, routeList[item].path, testParams);
+
+                        // if we find the route that matches the request
+                        if(pathObj.requestPath === pathObj.routePath && routeList[item].type === requestObject.type){
+                            // Only commit the extracted params if this route actually matches
+                            requestObject.params = testParams;
+
+                            // call Constraint
+                            if(typeof routeList[item].constraint === "function"){
+
+                                var newObj = {};
+                                //tools.combineObjects(newObj, master.controllerList);
+                                newObj.next = function(){
+                                    currentRoute.root = root;
+                                    currentRoute.pathName = requestObject.pathName;
+                                    currentRoute.toAction = requestObject.toAction;
+                                    currentRoute.toController = requestObject.toController;
+                                    currentRoute.response = requestObject.response;
+                                    currentRoute.isComponent = isComponent;
+                                    currentRoute.routeDef = currentRouteBeingProcessed; // Add route definition
+                                    emitter.emit("routeConstraintGood", requestObject);
+                                };
+
+                                // Wrap constraint execution with error handling
+                                try {
+                                    routeList[item].constraint.call(newObj, requestObject);
+                                } catch(constraintError) {
+                                    const routeError = handleRoutingError(
+                                        requestObject.pathName,
+                                        [],
+                                        {
+                                            type: 'CONSTRAINT_ERROR',
+                                            route: currentRouteBeingProcessed,
+                                            error: constraintError
+                                        }
+                                    );
+                                    logger.error({
+                                        code: 'MC_ERR_ROUTE_CONSTRAINT',
+                                        message: `Route constraint failed for ${currentRouteBeingProcessed.path}`,
+                                        route: currentRouteBeingProcessed,
+                                        error: constraintError.message,
+                                        stack: constraintError.stack
+                                    });
+                                    throw constraintError;
+                                }
+
+                                return true;
+                            }else{
 
-                    requestObject.toController = routeList[item].toController;
-                    requestObject.toAction = routeList[item].toAction;
-                    var pathObj = normalizePaths(requestObject.pathName, routeList[item].path, requestObject.params);
-                    // if we find the route that matches the request
-                    if(pathObj.requestPath === pathObj.routePath && routeList[item].type === requestObject.type){
-
-                        // call Constraint
-                        if(typeof routeList[item].constraint === "function"){
-                            
-                            var newObj = {};
-                            //tools.combineObjects(newObj, master.controllerList);
-                            newObj.next = function(){
                                 currentRoute.root = root;
                                 currentRoute.pathName = requestObject.pathName;
                                 currentRoute.toAction = requestObject.toAction;
                                 currentRoute.toController = requestObject.toController;
                                 currentRoute.response = requestObject.response;
                                 currentRoute.isComponent = isComponent;
+                                currentRoute.routeDef = currentRouteBeingProcessed; // Add route definition
                                 emitter.emit("routeConstraintGood", requestObject);
-                            };
-                            routeList[item].constraint.call(newObj, requestObject);
-                            return true;
-                        }else{
-
-                            currentRoute.root = root;
-                            currentRoute.pathName = requestObject.pathName;
-                            currentRoute.toAction = requestObject.toAction;
-                            currentRoute.toController = requestObject.toController;
-                            currentRoute.response = requestObject.response;
-                            currentRoute.isComponent = isComponent;
-                            emitter.emit("routeConstraintGood", requestObject);
+                                return true;
+                            }
+
+                        }
+
+                        if(pathObj.requestPath === pathObj.routePath && "options" ===requestObject.type.toLowerCase()){
+                            // this means that the request is correct but its an options request means its the browser checking to see if the request is allowed
+                            // Commit the params for OPTIONS requests too
+                            requestObject.params = testParams;
+                            requestObject.response.writeHead(200, {'Content-Type': 'application/json'});
+                            requestObject.response.end(JSON.stringify({"done": "true"}));
                             return true;
                         }
-                        
-                    }
+                    } catch(routeProcessError) {
+                        // Log the specific route that failed
+                        logger.error({
+                            code: 'MC_ERR_ROUTE_PROCESS',
+                            message: `Failed to process route: ${currentRouteBeingProcessed.path}`,
+                            route: currentRouteBeingProcessed,
+                            requestPath: requestObject.pathName,
+                            error: routeProcessError.message,
+                            stack: routeProcessError.stack
+                        });
 
-                    if(pathObj.requestPath === pathObj.routePath && "options" ===requestObject.type.toLowerCase()){
-                        // this means that the request is correct but its an options request means its the browser checking to see if the request is allowed
-                        requestObject.response.writeHead(200, {'Content-Type': 'application/json'});
-			            requestObject.response.end(JSON.stringify({"done": "true"}));
-                        return true;
+                        // Re-throw to be caught by outer try-catch
+                        throw routeProcessError;
                     }
-                   
+
                 };
                 return -1;
             }
         }
         catch(e){
-            throw new Error("Error processing routes: " + e.stack); 
+            // Enhanced error message with route context
+            const errorDetails = currentRouteBeingProcessed
+                ? `\n\nFailing Route:\n  Path: ${currentRouteBeingProcessed.path}\n  Controller: ${currentRouteBeingProcessed.toController}#${currentRouteBeingProcessed.toAction}\n  Method: ${currentRouteBeingProcessed.type.toUpperCase()}\n\nRequest:\n  Path: ${requestObject.pathName}\n  Method: ${requestObject.type.toUpperCase()}`
+                : '';
+
+            throw new Error(`Error processing routes: ${e.message}${errorDetails}\n\nOriginal Stack:\n${e.stack}`);
         }
 };
 
@@ -257,40 +391,113 @@ class MasterRouter {
 
     _call(requestObject){
 
+         // Start performance tracking
+         const requestId = `${Date.now()}-${Math.random()}`;
+         performanceTracker.start(requestId, requestObject);
+
          tools.combineObjects(master.requestList, requestObject);
          requestObject = master.requestList;
          var Control = null;
+
          try{
-             Control = require(path.join(currentRoute.root, 'app', 'controllers', `${tools.firstLetterlowercase(requestObject.toController)}Controller`));
-         }catch(e){
+             // Try to load controller
              try{
-                 Control = require(path.join(currentRoute.root, 'app', 'controllers', `${tools.firstLetterUppercase(requestObject.toController)}Controller`));
-             }catch(e2){
-                 console.log(`Cannot find controller name - ${requestObject.toController}`);
+                 Control = require(path.join(currentRoute.root, 'app', 'controllers', `${tools.firstLetterlowercase(requestObject.toController)}Controller`));
+             }catch(e){
+                 try{
+                     Control = require(path.join(currentRoute.root, 'app', 'controllers', `${tools.firstLetterUppercase(requestObject.toController)}Controller`));
+                 }catch(e2){
+                     // Controller not found - handle error
+                     const error = handleControllerError(
+                         new Error(`Controller not found: ${requestObject.toController}Controller`),
+                         requestObject.toController,
+                         requestObject.toAction,
+                         requestObject.pathName,
+                         currentRoute.routeDef // Pass route definition
+                     );
+
+                     sendErrorResponse(requestObject.response, error, requestObject.pathName);
+                     performanceTracker.end(requestId);
+                     return;
+                 }
              }
-         }
-         tools.combineObjectPrototype(Control, master.controllerList);
-         Control.prototype.__namespace = Control.name;
-         Control.prototype.__requestObject = requestObject;
-         Control.prototype.__currentRoute = currentRoute;
-         Control.prototype.__response = requestObject.response;
-         Control.prototype.__request = requestObject.request;
-         var control = new Control(requestObject);
-         var _callEmit = new EventEmitter();
-         
-         _callEmit.on("controller", function(){
-            control.next = function(){
-                control.__callAfterAction(control, requestObject);
-            }
-            // 
-            control[requestObject.toAction](requestObject);
-         });
-        
-         // check if before function is avaliable and wait for it to return
-         if(control.__hasBeforeAction(control, requestObject)){
-             control.__callBeforeAction(control, requestObject, _callEmit);
-         }else{
-            _callEmit.emit("controller");
+
+             tools.combineObjectPrototype(Control, master.controllerList);
+             Control.prototype.__namespace = Control.name;
+             Control.prototype.__requestObject = requestObject;
+             Control.prototype.__currentRoute = currentRoute;
+             Control.prototype.__response = requestObject.response;
+             Control.prototype.__request = requestObject.request;
+             var control = new Control(requestObject);
+             var _callEmit = new EventEmitter();
+
+             _callEmit.on("controller", function(){
+                try {
+                    control.next = function(){
+                        control.__callAfterAction(control, requestObject);
+                    }
+
+                    // Check if action exists
+                    if (typeof control[requestObject.toAction] !== 'function') {
+                        throw new Error(`Action '${requestObject.toAction}' not found in controller ${requestObject.toController}`);
+                    }
+
+                    // Wrap action with error handling
+                    const wrappedAction = errorHandlerMiddleware(
+                        control[requestObject.toAction],
+                        requestObject.toController,
+                        requestObject.toAction
+                    );
+
+                    // Execute action
+                    Promise.resolve(wrappedAction.call(control, requestObject))
+                        .then(() => {
+                            performanceTracker.end(requestId);
+                        })
+                        .catch((error) => {
+                            const mcError = handleControllerError(
+                                error,
+                                requestObject.toController,
+                                requestObject.toAction,
+                                requestObject.pathName,
+                                currentRoute.routeDef // Pass route definition
+                            );
+                            sendErrorResponse(requestObject.response, mcError, requestObject.pathName);
+                            performanceTracker.end(requestId);
+                        });
+
+                } catch (error) {
+                    // Action execution error
+                    const mcError = handleControllerError(
+                        error,
+                        requestObject.toController,
+                        requestObject.toAction,
+                        requestObject.pathName,
+                        currentRoute.routeDef // Pass route definition
+                    );
+                    sendErrorResponse(requestObject.response, mcError, requestObject.pathName);
+                    performanceTracker.end(requestId);
+                }
+             });
+
+             // check if before function is avaliable and wait for it to return
+             if(control.__hasBeforeAction(control, requestObject)){
+                 control.__callBeforeAction(control, requestObject, _callEmit);
+             }else{
+                _callEmit.emit("controller");
+             }
+
+         } catch (error) {
+             // General error
+             const mcError = handleControllerError(
+                 error,
+                 requestObject.toController,
+                 requestObject.toAction,
+                 requestObject.pathName,
+                 currentRoute.routeDef // Pass route definition
+             );
+             sendErrorResponse(requestObject.response, mcError, requestObject.pathName);
+             performanceTracker.end(requestId);
          }
 
     }
@@ -319,8 +526,16 @@ class MasterRouter {
             }
 
             if(routeFound === false){
-                master.error.log(`Cannot find route for path ${requestObject.pathName}`, "warn");
-                master.error.callHttpStatus(404, requestObject.response);
+                // Enhanced 404 handling
+                const allRoutes = [];
+                for (const route of routes) {
+                    if (this._routes[route] && this._routes[route].routes) {
+                        allRoutes.push(...this._routes[route].routes);
+                    }
+                }
+
+                const mcError = handleRoutingError(requestObject.pathName, allRoutes);
+                sendErrorResponse(requestObject.response, mcError, requestObject.pathName);
             }            
 
     }