mastercontroller 1.3.2 → 1.3.3

package/.claude/settings.local.json

@@ -7,7 +7,10 @@
       "Bash(find:*)",
       "Bash(node -c:*)",
       "Bash(grep:*)",
-      "Bash(ls:*)"
+      "Bash(ls:*)",
+      "Bash(git checkout:*)",
+      "Bash(perl -i -pe:*)",
+      "Bash(node test-circular-dependency.js:*)"
     ],
     "deny": [],
     "ask": []

package/MasterAction.js

@@ -1,7 +1,6 @@
 
 // version 0.0.23
 
-var master = require('./MasterControl');
 var fileserver = require('fs');
 var toolClass =  require('./MasterTools');
 var tempClass =  require('./MasterTemplate');
@@ -26,9 +25,18 @@ const { validator, validateRequestBody, sanitizeObject } = require('./security/M
 const { sanitizeUserHTML, escapeHTML } = require('./security/MasterSanitizer');
 
 class MasterAction{
-	
+
+	// Lazy-load master to avoid circular dependency
+	// Static getter ensures single instance (Singleton pattern - Google style)
+	static get _master() {
+		if (!MasterAction.__masterCache) {
+			MasterAction.__masterCache = require('./MasterControl');
+		}
+		return MasterAction.__masterCache;
+	}
+
 	getView(location, data){
-		var actionUrl =  master.root + location;
+		var actionUrl =  MasterAction._master.root + location;
 		const fileResult = safeReadFile(fileserver, actionUrl);
 
 		if (!fileResult.success) {
@@ -598,5 +606,14 @@ class MasterAction{
 
 }
 
+// Export for MasterControl and register after event loop (prevents circular dependency)
+// This is the Lazy Registration pattern used by Spring Framework, Angular, Google Guice
+module.exports = MasterAction;
 
-master.extendController(MasterAction);
+// Use setImmediate to register after master is fully loaded
+setImmediate(() => {
+	const master = require('./MasterControl');
+	if (master && master.extendController) {
+		master.extendController(MasterAction);
+	}
+});

package/MasterActionFilters.js

@@ -1,9 +1,16 @@
 // version 2.0 - FIXED: Instance-level filters, async support, multiple filters
-var master = require('./MasterControl');
 const { logger } = require('./error/MasterErrorLogger');
 
 class MasterActionFilters {
 
+	// Lazy-load master to avoid circular dependency (Google-style Singleton pattern)
+	static get _master() {
+		if (!MasterActionFilters.__masterCache) {
+			MasterActionFilters.__masterCache = require('./MasterControl');
+		}
+		return MasterActionFilters.__masterCache;
+	}
+
 	constructor() {
 		// FIXED: Instance-level storage instead of module-level
 		// Each controller gets its own filter arrays
@@ -200,4 +207,12 @@ class MasterActionFilters {
 	}
 }
 
-master.extendController(MasterActionFilters);
+// Export and lazy register (prevents circular dependency - Spring/Angular pattern)
+module.exports = MasterActionFilters;
+
+setImmediate(() => {
+	const master = require('./MasterControl');
+	if (master && master.extendController) {
+		master.extendController(MasterActionFilters);
+	}
+});

package/MasterControl.js

@@ -319,21 +319,48 @@ class MasterControl {
                 'TemplateOverwrite': './TemplateOverwrite'
             };
 
-            for (const moduleName in internalModules) {
+            // Explicit module registration (prevents circular dependency issues)
+            // This is the Google-style dependency injection pattern
+            const moduleRegistry = {
+                'pipeline': { path: './MasterPipeline', exportName: 'MasterPipeline' },
+                'timeout': { path: './MasterTimeout', exportName: 'MasterTimeout' },
+                'errorRenderer': { path: './error/MasterErrorRenderer', exportName: 'MasterErrorRenderer' },
+                'error': { path: './error/MasterError', exportName: 'MasterError' },
+                'router': { path: './MasterRouter', exportName: 'MasterRouter' },
+                'request': { path: './MasterRequest', exportName: 'MasterRequest' },
+                'cors': { path: './MasterCors', exportName: 'MasterCors' },
+                'socket': { path: './MasterSocket', exportName: 'MasterSocket' },
+                'tempdata': { path: './MasterTemp', exportName: 'MasterTemp' },
+                'overwrite': { path: './TemplateOverwrite', exportName: 'TemplateOverwrite' },
+                'session': { path: './security/SessionSecurity', exportName: 'MasterSessionSecurity' }
+            };
+
+            for (const [name, config] of Object.entries(moduleRegistry)) {
                 try {
-                    const modulePath = internalModules[moduleName];
-                    const module = require(modulePath);
+                    const module = require(config.path);
+                    const ClassConstructor = module[config.exportName] || module;
 
-                    // Special handling for SessionSecurity to avoid circular dependency
-                    if (moduleName === 'SessionSecurity' && module.MasterSessionSecurity) {
-                        $that.session = new module.MasterSessionSecurity();
+                    if (ClassConstructor) {
+                        $that[name] = new ClassConstructor();
+                    } else {
+                        console.warn(`[MasterControl] Module ${name} does not export ${config.exportName}`);
                     }
-                    // Most modules auto-register via master.extend() at module load time
                 } catch (e) {
-                    console.error(`[MasterControl] Failed to load ${moduleName}:`, e && e.message);
+                    console.error(`[MasterControl] Failed to load ${name}:`, e.message);
                 }
             }
 
+            // Load view and controller extensions (these extend prototypes, not master instance)
+            try {
+                require('./MasterAction');
+                require('./MasterActionFilters');
+                require('./MasterHtml');
+                require('./MasterTemplate');
+                require('./MasterTools');
+            } catch (e) {
+                console.error('[MasterControl] Failed to load extensions:', e.message);
+            }
+
             // Initialize global error handlers
             setupGlobalErrorHandlers();
 

package/MasterCors.js

@@ -1,5 +1,4 @@
 // version 0.0.3 - robust origin handling (all envs), creds-safe reflection, function origins, extended Vary
-var master = require('./MasterControl');
 
 	// todo - res.setHeader('Access-Control-Request-Method', '*');
 class MasterCors{
@@ -198,4 +197,4 @@ class MasterCors{
 	}
 }
 
-master.extend("cors", MasterCors);
+module.exports = { MasterCors };

package/MasterHtml.js

@@ -1,6 +1,5 @@
 // version 0.0.25
 
-var master = require('./MasterControl');
 var fs = require('fs');
 var tempClass =  require('./MasterTemplate');
 var toolClass =  require('./MasterTools');
@@ -17,6 +16,14 @@ const { sanitizeTemplateHTML, sanitizeUserHTML, escapeHTML } = require('./securi
 
 class html {
 
+	// Lazy-load master to avoid circular dependency (Google-style lazy initialization)
+	get _master() {
+		if (!this.__masterCache) {
+			this.__masterCache = require('./MasterControl');
+		}
+		return this.__masterCache;
+	}
+
 	javaScriptSerializer(name, obj){
 		// SECURITY: Escape closing script tags and dangerous characters
 		const jsonStr = JSON.stringify(obj)
@@ -630,5 +637,13 @@ class html {
 
 }
 
-master.extendView("html", html);
+// Export and lazy register (prevents circular dependency - Spring/Angular pattern)
+module.exports = html;
+
+setImmediate(() => {
+	const master = require('./MasterControl');
+	if (master && master.extendView) {
+		master.extendView("html", html);
+	}
+});
 

package/MasterPipeline.js

@@ -1,7 +1,6 @@
 // MasterPipeline - Middleware Pipeline System
 // version 1.0
 
-var master = require('./MasterControl');
 const { logger } = require('./error/MasterErrorLogger');
 
 class MasterPipeline {
@@ -340,5 +339,5 @@ class MasterPipeline {
     }
 }
 
-// Register with master
-master.extend("pipeline", MasterPipeline);
+// Export for MasterControl to register (prevents circular dependency)
+module.exports = { MasterPipeline };

package/MasterRequest.js

@@ -1,7 +1,6 @@
 
 // version 0.0.2
 
-var master = require('./MasterControl');
 var url = require('url');
 const StringDecoder = require('string_decoder').StringDecoder;
 var qs = require('qs');
@@ -407,4 +406,4 @@ class MasterRequest{
     }
 }
 
-master.extend("request", MasterRequest);
+module.exports = { MasterRequest };

package/MasterRouter.js

@@ -1,6 +1,5 @@
 // version 0.0.250
 
-var master = require('./MasterControl');
 var toolClass =  require('./MasterTools');
 const EventEmitter = require("events");
 var path = require('path');
@@ -564,4 +563,4 @@ class MasterRouter {
     
 }
 
-master.extend("router", MasterRouter);
+module.exports = { MasterRouter };

package/MasterSocket.js

@@ -1,6 +1,5 @@
 // version 0.1.2
 
-var master = require('./MasterControl');
 const { Server } = require('socket.io');
 const fs = require('fs');
 const path = require('path');
@@ -139,7 +138,7 @@ class MasterSocket{
     }
 }
 
-master.extend("socket", MasterSocket);
+module.exports = { MasterSocket };
 
 // shallow+deep merge helper
 function isObject(item) {

package/MasterTemp.js

@@ -1,5 +1,4 @@
 // version 0.0.3
-var master = require('./MasterControl');
 
 class MasterTemp{
 
@@ -27,4 +26,4 @@ class MasterTemp{
 
 }
 
-master.extend("tempdata", MasterTemp);
+module.exports = { MasterTemp };

package/MasterTimeout.js

@@ -13,7 +13,6 @@
  * @version 1.0.0
  */
 
-var master = require('./MasterControl');
 const { logger } = require('./error/MasterErrorLogger');
 
 class MasterTimeout {
@@ -327,6 +326,5 @@ class MasterTimeout {
     }
 }
 
-master.extend("timeout", MasterTimeout);
-
-module.exports = MasterTimeout;
+// Export for MasterControl to register (prevents circular dependency)
+module.exports = { MasterTimeout };

package/TemplateOverwrite.js

@@ -30,4 +30,4 @@ class TemplateOverwrite{
 	}
 }
 
-master.extend("overwrite", TemplateOverwrite);
+module.exports = { TemplateOverwrite };

package/error/MasterError.js

@@ -1,6 +1,5 @@
 
 // version 1.0.21 - improved console/error logging with syntax error code frames
-var master = require('../MasterControl');
 var winston = require('winston');
 var fileserver = require('fs');
 const { request } = require('http');
@@ -174,7 +173,7 @@ class MasterError{
 	}
 }
 
-master.extend("error", MasterError);
+module.exports = { MasterError };
 
 // ================ CODES YOU CAN USE ================ //
 // ACCEPTED    202 Accepted

package/error/MasterErrorRenderer.js

@@ -14,7 +14,6 @@
  * @version 1.0.0
  */
 
-var master = require('../MasterControl');
 const fs = require('fs');
 const path = require('path');
 const { logger } = require('./MasterErrorLogger');
@@ -524,6 +523,6 @@ class MasterErrorRenderer {
     }
 }
 
-master.extend("errorRenderer", MasterErrorRenderer);
+module.exports = { MasterErrorRenderer };
 
 module.exports = MasterErrorRenderer;

package/package.json

@@ -18,5 +18,5 @@
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
   },
-  "version": "1.3.2"
+  "version": "1.3.3"
 }

package/security/SessionSecurity.js

@@ -407,9 +407,6 @@ const SESSION_BEST_PRACTICES = {
   }
 };
 
-// MasterController Integration
-const master = require('../MasterControl');
-
 // Create MasterController-compatible wrapper
 class MasterSessionSecurity {
   constructor() {
@@ -425,6 +422,9 @@ class MasterSessionSecurity {
     this._options = options;
     this._instance = new SessionSecurity(options);
 
+    // Lazy load master to avoid circular dependency
+    const master = require('../MasterControl');
+
     // Auto-register with pipeline if available
     if (master.pipeline) {
       master.pipeline.use(this._instance.middleware());

package/SECURITY-FIXES-v1.3.2.md

@@ -1,614 +0,0 @@
-## MasterController v1.3.2 - Security Fixes
-
-**Release Date:** 2026-01-11
-**Security Level:** ⚠️ CRITICAL - Immediate upgrade recommended
-
----
-
-## Executive Summary
-
-This release fixes **5 critical security vulnerabilities** and brings MasterController to industry-standard security levels matching Rails, ASP.NET Core, and Django.
-
-### Critical Fixes
-
-1. **XSS in ALL Form Helpers** - Now escaped by default
-2. **Single Global Filter Bug** - Now supports multiple filters per controller
-3. **Open Redirect in requireHTTPS** - Now uses configured hostname
-4. **Path Traversal Vulnerabilities** - All file operations now validated
-5. **Synchronous File I/O** - Proper error handling added
-
-### New Feature: Automatic Security Enforcement
-
-Security is now **enforced by default** with opt-in configuration:
-- ✅ Auto-CSRF validation on POST/PUT/DELETE
-- ✅ Auto-input sanitization
-- ✅ Auto-HTTPS enforcement (production)
-- ✅ Auto-security headers
-
----
-
-## What's Fixed
-
-### 1. XSS Protection in Form Helpers (CRITICAL)
-
-**Before (v1.3.1):**
-```javascript
-// ❌ VULNERABLE - No escaping
-this.html.linkTo('<script>alert("XSS")</script>', '/page');
-// Output: <a href=/page><script>alert("XSS")</script></a>
-// XSS EXECUTED!
-```
-
-**After (v1.3.2):**
-```javascript
-// ✅ SAFE - Auto-escaped
-this.html.linkTo('<script>alert("XSS")</script>', '/page');
-// Output: <a href="/page">&lt;script&gt;alert("XSS")&lt;/script&gt;</a>
-// Safe to display!
-```
-
-**Fixed Methods:**
-- ✅ `linkTo()` - Escapes name and URL
-- ✅ `imgTag()` - Escapes alt and src
-- ✅ `textFieldTag()` - Escapes all attributes
-- ✅ `passwordFieldTag()` - Escapes all attributes
-- ✅ `hiddenFieldTag()` - Escapes value and attributes
-- ✅ `textAreaTag()` - Escapes content and attributes
-- ✅ `submitButton()` - Escapes name and attributes
-- ✅ All 15+ input field helpers
-- ✅ `javaScriptSerializer()` - Escapes `</script>` tags
-
-**Impact:** Prevents stored XSS, reflected XSS, DOM-based XSS attacks.
-
----
-
-### 2. Action Filter Architecture Fix (CRITICAL)
-
-**Problem:** Only ONE filter could exist globally. Each new filter overwrote the previous one.
-
-**Before (v1.3.1):**
-```javascript
-// UserController.js
-class UserController {
-    constructor() {
-        // Register filter
-        this.beforeAction(['show'], () => {
-            console.log('User filter');
-        });
-    }
-}
-
-// AdminController.js
-class AdminController {
-    constructor() {
-        // ❌ BUG: This OVERWRITES UserController's filter!
-        this.beforeAction(['dashboard'], () => {
-            console.log('Admin filter');
-        });
-    }
-}
-
-// Result: UserController has NO filter anymore!
-```
-
-**After (v1.3.2):**
-```javascript
-// ✅ FIXED: Each controller has independent filters
-class UserController {
-    constructor() {
-        this.beforeAction(['show'], () => console.log('User filter 1'));
-        this.beforeAction(['show'], () => console.log('User filter 2'));
-        this.beforeAction(['edit'], () => console.log('Edit filter'));
-        // All 3 filters coexist!
-    }
-}
-
-class AdminController {
-    constructor() {
-        this.beforeAction(['dashboard'], () => console.log('Admin filter'));
-        // Independent from UserController
-    }
-}
-```
-
-**New Features:**
-- ✅ Instance-level filters (not global)
-- ✅ Multiple filters per controller
-- ✅ Async/await support
-- ✅ Error handling with try/catch
-- ✅ Timeout protection (5 seconds default)
-- ✅ No variable shadowing bugs
-- ✅ No race conditions
-
----
-
-### 3. Open Redirect Fix (CRITICAL)
-
-**Problem:** `requireHTTPS()` used unvalidated `Host` header, allowing phishing attacks.
-
-**Before (v1.3.1):**
-```javascript
-// ❌ VULNERABLE
-requireHTTPS() {
-    const httpsUrl = `https://${this.__requestObject.request.headers.host}${this.__requestObject.pathName}`;
-    this.redirectTo(httpsUrl);
-}
-
-// Attack:
-// HTTP Request with: Host: evil.com
-// Redirects to: https://evil.com/login
-// User enters credentials on attacker's phishing site!
-```
-
-**After (v1.3.2):**
-```javascript
-// ✅ FIXED - Uses configured hostname
-requireHTTPS() {
-    const configuredHost = master.env.server.hostname; // From config
-    const httpsUrl = `https://${configuredHost}${this.__requestObject.pathName}`;
-    this.redirectTo(httpsUrl);
-}
-
-// Attack fails:
-// HTTP Request with: Host: evil.com
-// Redirects to: https://legitimate.com/login (from config)
-// User goes to correct site!
-```
-
-**Configuration Required:**
-```javascript
-// config/environments/env.production.json
-{
-    "server": {
-        "hostname": "yourapp.com",
-        "httpsPort": 443
-    }
-}
-```
-
----
-
-### 4. Path Traversal Protection (HIGH)
-
-**Fixed Methods:**
-- ✅ `returnPartialView()` - Validates path, prevents `../`
-- ✅ `returnViewWithoutEngine()` - Validates path
-- ✅ `renderPartial()` - Validates path
-- ✅ `renderStyles()` - Validates folder name
-- ✅ `renderScripts()` - Validates folder name
-
-**Before (v1.3.1):**
-```javascript
-// ❌ VULNERABLE
-this.returnPartialView('../../../../etc/passwd');
-// Reads /app/root/../../../../etc/passwd
-// System file exposed!
-```
-
-**After (v1.3.2):**
-```javascript
-// ✅ PROTECTED
-this.returnPartialView('../../../../etc/passwd');
-// Blocked! Returns error
-// Logs security warning
-```
-
----
-
-### 5. Other Fixes
-
-**Undefined Variables:**
-- ✅ Fixed `redirectToAction()` - `resp` and `req` now properly defined
-
-**Error Handling:**
-- ✅ `returnJson()` - Try/catch added, checks both `_headerSent` and `headersSent`
-- ✅ `returnPartialView()` - Try/catch for file operations
-- ✅ `returnViewWithoutEngine()` - Try/catch for file operations
-
-**JSON Serialization:**
-- ✅ `javaScriptSerializer()` - Escapes `</script>`, `<`, `>`, `&` characters
-
----
-
-## New Feature: Automatic Security Enforcement
-
-### What is Security Enforcement?
-
-Instead of developers manually calling security methods, MasterController now **automatically enforces security** for all requests.
-
-### Enable Security Enforcement
-
-**Step 1: Edit `config/initializers/config.js`:**
-
-```javascript
-const SecurityEnforcement = require('mastercontroller/security/SecurityEnforcement');
-
-// Initialize security enforcement
-const securityConfig = SecurityEnforcement.init({
-    csrf: true,               // Auto-validate CSRF on POST/PUT/DELETE
-    sanitizeInputs: true,     // Auto-sanitize all inputs
-    httpsOnly: true,          // Require HTTPS in production
-    autoEscape: true,         // Auto-escape template output (future)
-    csrfExcludePaths: [       // Paths that don't need CSRF (webhooks)
-        '/api/webhook'
-    ]
-});
-
-// Register enforcement middleware (IMPORTANT!)
-master.pipeline.use(SecurityEnforcement.middleware(securityConfig));
-```
-
-### What It Does Automatically
-
-#### 1. CSRF Protection
-
-**Automatic CSRF validation on all POST/PUT/DELETE/PATCH requests:**
-
-```javascript
-// NO CODE CHANGES NEEDED IN CONTROLLERS!
-
-// Before (required manual check):
-class UsersController {
-    create(obj) {
-        // ❌ Developer must remember to check CSRF
-        if (!this.validateCSRF()) {
-            return this.returnError(403, 'CSRF invalid');
-        }
-        // ... create user
-    }
-}
-
-// After (automatic):
-class UsersController {
-    create(obj) {
-        // ✅ CSRF already validated by middleware!
-        // Just handle the request
-        const user = this.userContext.create(obj.params.formData);
-        this.json({ user });
-    }
-}
-```
-
-**How to Include CSRF Token in Forms:**
-
-```html
-<!-- HTML Form -->
-<form method="POST" action="/users">
-    <input type="hidden" name="_csrf" value="<%= this.generateCSRFToken() %>">
-    <input type="text" name="username">
-    <button type="submit">Create</button>
-</form>
-
-<!-- AJAX Request -->
-<script>
-fetch('/users', {
-    method: 'POST',
-    headers: {
-        'Content-Type': 'application/json',
-        'X-CSRF-Token': '<%= this.generateCSRFToken() %>'
-    },
-    body: JSON.stringify({ username: 'john' })
-});
-</script>
-```
-
-#### 2. Input Sanitization
-
-**All inputs automatically sanitized to prevent XSS:**
-
-```javascript
-// Before:
-class PostsController {
-    create(obj) {
-        // ❌ Must manually sanitize
-        const title = this.sanitizeInput(obj.params.formData.title);
-        const body = this.sanitizeInput(obj.params.formData.body);
-        // ... create post
-    }
-}
-
-// After:
-class PostsController {
-    create(obj) {
-        // ✅ Already sanitized!
-        const title = obj.params.formData.title; // Safe
-        const body = obj.params.formData.body;   // Safe
-        // ... create post
-    }
-}
-```
-
-#### 3. HTTPS Enforcement (Production)
-
-**Automatic HTTPS redirect in production:**
-
-```javascript
-// NO CODE CHANGES NEEDED!
-
-// Before:
-class AdminController {
-    dashboard(obj) {
-        // ❌ Must manually check HTTPS
-        if (!this.requireHTTPS()) return;
-        // ... render dashboard
-    }
-}
-
-// After:
-class AdminController {
-    dashboard(obj) {
-        // ✅ Already on HTTPS! (auto-redirected)
-        // ... render dashboard
-    }
-}
-```
-
-#### 4. Security Headers
-
-**Automatic security headers on all responses:**
-
-Headers applied automatically:
-- ✅ `X-XSS-Protection: 1; mode=block`
-- ✅ `X-Frame-Options: SAMEORIGIN` (clickjacking protection)
-- ✅ `X-Content-Type-Options: nosniff` (MIME sniffing protection)
-- ✅ `Referrer-Policy: strict-origin-when-cross-origin`
-- ✅ `Content-Security-Policy: default-src 'self'`
-- ✅ `Permissions-Policy: geolocation=(), microphone=(), camera=()`
-
----
-
-## Migration Guide
-
-### For v1.3.1 Users
-
-**Good News:** Most changes are backward compatible!
-
-#### Required Changes
-
-**1. Configure Hostname (for requireHTTPS):**
-
-```json
-// config/environments/env.production.json
-{
-    "server": {
-        "hostname": "yourapp.com",
-        "httpsPort": 443
-    }
-}
-```
-
-**2. Enable Security Enforcement (Recommended):**
-
-```javascript
-// config/initializers/config.js
-const SecurityEnforcement = require('mastercontroller/security/SecurityEnforcement');
-
-const securityConfig = SecurityEnforcement.init({
-    csrf: true,
-    sanitizeInputs: true,
-    httpsOnly: true
-});
-
-master.pipeline.use(SecurityEnforcement.middleware(securityConfig));
-```
-
-#### Optional Changes
-
-**Remove Manual Security Checks:**
-
-You can now remove manual security checks since they're automatic:
-
-```javascript
-// Before (manual):
-class UsersController {
-    create(obj) {
-        // Can remove these now:
-        if (!this.validateCSRF()) return this.returnError(403, 'CSRF invalid');
-        obj.params.formData = this.sanitizeInput(obj.params.formData);
-        if (!this.requireHTTPS()) return;
-
-        // ... business logic
-    }
-}
-
-// After (automatic):
-class UsersController {
-    create(obj) {
-        // All security checks done by middleware!
-        // ... business logic
-    }
-}
-```
-
----
-
-## Testing Your Upgrade
-
-### 1. XSS Protection Test
-
-```javascript
-// Test that XSS is blocked
-const html = master.viewList.html;
-const result = html.linkTo('<script>alert("XSS")</script>', '/test');
-
-console.log(result);
-// Should output: <a href="/test">&lt;script&gt;alert("XSS")&lt;/script&gt;</a>
-// NOT: <a href=/test><script>alert("XSS")</script></a>
-```
-
-### 2. Action Filter Test
-
-```javascript
-// Test multiple filters
-class TestController {
-    constructor() {
-        this.beforeAction(['show'], () => console.log('Filter 1'));
-        this.beforeAction(['show'], () => console.log('Filter 2'));
-        this.beforeAction(['edit'], () => console.log('Filter 3'));
-    }
-}
-
-const controller = new TestController();
-console.log(controller._beforeActionFilters.length);
-// Should output: 3 (all filters registered)
-```
-
-### 3. Path Traversal Test
-
-```javascript
-// Test path traversal protection
-const result = this.returnPartialView('../../../../etc/passwd', {});
-// Should return error, NOT read file
-```
-
-### 4. Open Redirect Test
-
-```http
-GET / HTTP/1.1
-Host: evil.com
-
-# Should redirect to configured hostname, not evil.com
-```
-
-### 5. CSRF Test
-
-```bash
-# Without CSRF token (should fail)
-curl -X POST http://localhost:3000/users \
-  -H "Content-Type: application/json" \
-  -d '{"username":"test"}'
-
-# Should return: 403 Forbidden
-
-# With CSRF token (should succeed)
-curl -X POST http://localhost:3000/users \
-  -H "Content-Type: application/json" \
-  -H "X-CSRF-Token: <valid-token>" \
-  -d '{"username":"test"}'
-
-# Should return: 200 OK
-```
-
----
-
-## Security Comparison: Before vs After
-
-### XSS Protection
-
-| Feature | v1.3.1 | v1.3.2 |
-|---------|--------|--------|
-| Auto-escape form helpers | ❌ No | ✅ Yes |
-| Attribute quoting | ❌ No | ✅ Yes |
-| Script tag escape in JSON | ❌ No | ✅ Yes |
-| Auto-sanitize inputs | ❌ Manual | ✅ Automatic (opt-in) |
-
-### CSRF Protection
-
-| Feature | v1.3.1 | v1.3.2 |
-|---------|--------|--------|
-| Token generation | ✅ Yes | ✅ Yes |
-| Auto-validation | ❌ Manual | ✅ Automatic (opt-in) |
-| Exclude paths | ❌ No | ✅ Yes |
-
-### Action Filters
-
-| Feature | v1.3.1 | v1.3.2 |
-|---------|--------|--------|
-| Multiple filters | ❌ No (1 only) | ✅ Yes (unlimited) |
-| Instance-level | ❌ No (global) | ✅ Yes |
-| Async support | ❌ No | ✅ Yes |
-| Error handling | ❌ No | ✅ Yes |
-| Timeout protection | ❌ No | ✅ Yes |
-
-### Path Security
-
-| Feature | v1.3.1 | v1.3.2 |
-|---------|--------|--------|
-| Path traversal protection | ❌ No | ✅ Yes |
-| Path validation | ❌ No | ✅ Yes |
-| Dotfile blocking | ❌ No | ✅ Yes |
-
-### HTTPS
-
-| Feature | v1.3.1 | v1.3.2 |
-|---------|--------|--------|
-| HTTPS redirect | ⚠️ Vulnerable | ✅ Secure |
-| Uses Host header | ❌ Yes | ✅ No |
-| Uses config hostname | ❌ No | ✅ Yes |
-| Auto-enforcement | ❌ No | ✅ Yes (opt-in) |
-
----
-
-## Industry Standards Compliance
-
-### ✅ Now Matches Rails
-
-- ✅ Auto-escape output
-- ✅ CSRF protection built-in
-- ✅ Multiple filter chains
-- ✅ Path security
-- ✅ XSS protection
-
-### ✅ Now Matches ASP.NET Core
-
-- ✅ Auto-HTML encoding
-- ✅ Anti-forgery tokens
-- ✅ Multiple filter attributes
-- ✅ Async filters
-- ✅ HTTPS enforcement
-
-### ✅ Now Matches Django
-
-- ✅ Auto-escaping templates
-- ✅ CSRF middleware
-- ✅ Multiple decorators
-- ✅ Input validation
-- ✅ XSS protection
-
----
-
-## Breaking Changes
-
-### None!
-
-All changes are backward compatible. Existing code will continue to work.
-
-**Recommendations:**
-1. Enable security enforcement for new protection
-2. Configure hostname for requireHTTPS
-3. Remove manual security checks (now redundant)
-
----
-
-## Performance Impact
-
-**Minimal:** <1ms per request
-
-- Form helpers: Same performance (now safer)
-- Filters: Slightly faster (better architecture)
-- Security enforcement: ~0.5ms overhead
-- Path validation: <0.1ms overhead
-
----
-
-## Credits
-
-Security audit and fixes by Claude Code, based on industry standards from:
-- Ruby on Rails (ActionView, ActionController)
-- ASP.NET Core (Razor, MVC)
-- Django (Templates, Middleware)
-- OWASP Top 10 (2021)
-
----
-
-## Support
-
-**Issues:** https://github.com/alexanderrich/MasterController/issues
-**Documentation:** See README.md
-**Security:** Report security issues to security@mastercontroller.com
-
----
-
-**Upgrade Now:** `npm install mastercontroller@latest`
-
-**MasterController v1.3.2 - Production-Ready Security**