mastercontroller 1.3.21 → 1.3.23

package/MasterRouter.js

@@ -124,14 +124,18 @@ const ROUTER_CONFIG = {
         return paramValue;
     }
 
+    // Fast path: skip expensive regex checks for simple alphanumeric values
+    if (/^[a-zA-Z0-9_-]+$/.test(paramValue)) {
+        return paramValue;
+    }
+
     // Check for path traversal attempts
     const pathCheck = detectPathTraversal(paramValue);
     if (!pathCheck.safe) {
         logger.warn({
             code: 'MC_SECURITY_PATH_TRAVERSAL',
             message: 'Path traversal attempt detected in route parameter',
-            param: paramName,
-            value: paramValue
+            context: { param: paramName, value: paramValue }
         });
 
         // Remove dangerous content
@@ -144,8 +148,7 @@ const ROUTER_CONFIG = {
         logger.warn({
             code: 'MC_SECURITY_SQL_INJECTION',
             message: 'SQL injection attempt detected in route parameter',
-            param: paramName,
-            value: paramValue
+            context: { param: paramName, value: paramValue }
         });
 
         // Escape to prevent injection
@@ -158,8 +161,7 @@ const ROUTER_CONFIG = {
         logger.warn({
             code: 'MC_SECURITY_COMMAND_INJECTION',
             message: 'Command injection attempt detected in route parameter',
-            param: paramName,
-            value: paramValue
+            context: { param: paramName, value: paramValue }
         });
 
         // Remove dangerous characters
@@ -810,7 +812,7 @@ class MasterRouter {
              const control = new Control(requestObject);
              const _callEmit = new EventEmitter();
 
-             _callEmit.on(EVENT_NAMES.CONTROLLER, function(){
+             _callEmit.once(EVENT_NAMES.CONTROLLER, function(){
                 try {
                     control.next = function(){
                         control.__callAfterAction(control, requestObject);
@@ -961,6 +963,11 @@ class MasterRouter {
                 throw new TypeError('Request object must have a valid type (HTTP method)');
             }
 
+            // Skip route processing for OPTIONS requests already handled by CORS middleware
+            if (rr.type.toLowerCase() === 'options' && (rr.response.headersSent || rr.response._headerSent)) {
+                return;
+            }
+
             const $that = this;
             // FIX: Use direct reference instead of Object.create() to preserve request/response objects
             // Object.create() puts properties on prototype, causing undefined access issues

package/error/MasterErrorHandler.js

@@ -75,7 +75,8 @@ const ERROR_CODES = {
  * Levenshtein distance for "Did you mean?" suggestions
  */
 function levenshteinDistance(str1, str2) {
-  // Guard against extremely long strings (e.g. malicious bot requests)
+  // Guard against non-strings (objects, regex, undefined) and extremely long paths
+  if (typeof str1 !== 'string' || typeof str2 !== 'string') return Infinity;
   if (str1.length > 200 || str2.length > 200) return Infinity;
   const len1 = str1.length;
   const len2 = str2.length;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mastercontroller",
-  "version": "1.3.21",
+  "version": "1.3.23",
   "description": "Fortune 500 ready Node.js MVC framework with enterprise security, monitoring, and horizontal scaling",
   "main": "MasterControl.js",
   "license": "MIT",