mastercontroller 1.3.24 → 1.3.26

package/MasterControl.js

@@ -146,25 +146,10 @@ class MasterControl {
         // Only freeze in production to allow for easier debugging in development
         const isProduction = process.env.NODE_ENV === 'production';
 
-        if (isProduction) {
-            // Freeze prototypes to prevent prototype pollution attacks
-            try {
-                Object.freeze(Object.prototype);
-                Object.freeze(Array.prototype);
-                Object.freeze(Function.prototype);
-
-                logger.info({
-                    code: 'MC_SECURITY_PROTOTYPE_FROZEN',
-                    message: 'Prototypes frozen in production mode for security'
-                });
-            } catch (err) {
-                logger.warn({
-                    code: 'MC_SECURITY_FREEZE_FAILED',
-                    message: 'Failed to freeze prototypes',
-                    error: err.message
-                });
-            }
-        }
+        // NOTE: Prototype freezing was removed. Freezing Object.prototype/Array.prototype/
+        // Function.prototype breaks third-party libraries (e.g., long, mysql2) that define
+        // properties on their prototypes after framework init. Prototype pollution protection
+        // is handled via input validation in MasterValidator.js instead.
 
         // Add prototype pollution detection utility
         this._detectPrototypePollution = (obj) => {
@@ -490,7 +475,7 @@ class MasterControl {
             if(type === "http"){
                 $that.serverProtocol = "http";
                 const server = http.createServer(async function(req, res) {
-                    $that.serverRun(req, res);
+                    await $that.serverRun(req, res);
                 });
                 // Set server immediately so config can access it
                 $that.server = server;
@@ -534,7 +519,7 @@ class MasterControl {
                     if(credentials.honorCipherOrder === undefined){ credentials.honorCipherOrder = true; }
                     if(!credentials.ALPNProtocols){ credentials.ALPNProtocols = ['h2', 'http/1.1']; }
                     const server = https.createServer(credentials, async function(req, res) {
-                        $that.serverRun(req, res);
+                        await $that.serverRun(req, res);
                     });
                     // Set server immediately so config can access it
                     $that.server = server;
@@ -1006,25 +991,23 @@ class MasterControl {
         const $that = this;
         console.log("path", `${req.method} ${req.url}`);
 
-        // Create request context for middleware pipeline
-        const parsedUrl = url.parse(req.url);
-        const pathname = parsedUrl.pathname;
-        const ext = path.parse(pathname).ext;
-
-        const context = {
-            request: req,
-            response: res,
-            requrl: url.parse(req.url, true),
-            pathName: pathname.replace(/^\/|\/$/g, '').toLowerCase(),
-            type: req.method.toLowerCase(),
-            params: {},
-            state: {},       // User-defined state shared across middleware
-            master: $that,   // Access to framework instance
-            isStatic: ext !== '' // Is this a static file request?
-        };
-
-        // Execute middleware pipeline
         try {
+            const parsedUrl = url.parse(req.url);
+            const pathname = parsedUrl.pathname;
+            const ext = path.parse(pathname).ext;
+
+            const context = {
+                request: req,
+                response: res,
+                requrl: url.parse(req.url, true),
+                pathName: pathname.replace(/^\/|\/$/g, '').toLowerCase(),
+                type: req.method.toLowerCase(),
+                params: {},
+                state: {},
+                master: $that,
+                isStatic: ext !== ''
+            };
+
             await $that.pipeline.execute(context);
         } catch (error) {
             console.error('Pipeline execution failed:', error);

package/MasterCors.js

@@ -235,6 +235,7 @@ class MasterCors{
 			// Handle preflight OPTIONS request
 			if (ctx.type === 'options') {
 				$that.load({ request: ctx.request, response: ctx.response });
+				ctx.request.resume();
 				ctx.response.statusCode = 204;
 				ctx.response.end();
 				return; // Terminal - don't call next()

package/MasterRouter.js

@@ -805,11 +805,12 @@ class MasterRouter {
 
              tools.combineObjectPrototype(Control, this._master.controllerList);
              Control.prototype.__namespace = Control.name;
-             Control.prototype.__requestObject = requestObject;
-             Control.prototype.__currentRoute = currentRoute;
-             Control.prototype.__response = requestObject.response;
-             Control.prototype.__request = requestObject.request;
              const control = new Control(requestObject);
+             // Set request-specific state on INSTANCE (not prototype) for concurrency safety
+             control.__requestObject = requestObject;
+             control.__currentRoute = currentRoute;
+             control.__response = requestObject.response;
+             control.__request = requestObject.request;
              const _callEmit = new EventEmitter();
 
              _callEmit.once(EVENT_NAMES.CONTROLLER, function(){
@@ -837,7 +838,16 @@ class MasterRouter {
                             // and no response was sent yet (e.g., overridden returnJson pattern)
                             if (returnValue !== undefined && returnValue !== null
                                 && !requestObject.response.headersSent && !requestObject.response._headerSent) {
-                                const json = JSON.stringify(returnValue);
+                                const seen = new WeakSet();
+                                const json = JSON.stringify(returnValue, (key, value) => {
+                                    if (typeof value === 'object' && value !== null) {
+                                        if (seen.has(value)) {
+                                            return '[Circular Reference]';
+                                        }
+                                        seen.add(value);
+                                    }
+                                    return value;
+                                });
                                 requestObject.response.writeHead(200, {
                                     'Content-Type': 'application/json',
                                     'Content-Length': Buffer.byteLength(json, 'utf8')
@@ -880,7 +890,21 @@ class MasterRouter {
 
              // check if before function is avaliable and wait for it to return
              if(control.__hasBeforeAction(control, requestObject)){
-                 control.__callBeforeAction(control, requestObject, _callEmit);
+                 control.__callBeforeAction(control, requestObject, _callEmit)
+                     .catch((error) => {
+                         if (!requestObject.response.headersSent && !requestObject.response._headerSent) {
+                             const mcError = handleControllerError(
+                                 error,
+                                 requestObject.toController,
+                                 requestObject.toAction,
+                                 requestObject.pathName,
+                                 currentRoute.routeDef
+                             );
+                             sendErrorResponse(requestObject.response, mcError, requestObject.pathName);
+                         }
+                         performanceTracker.end(requestId);
+                         _callEmit.removeAllListeners();
+                     });
              }else{
                 _callEmit.emit("controller");
              }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mastercontroller",
-  "version": "1.3.24",
+  "version": "1.3.26",
   "description": "Fortune 500 ready Node.js MVC framework with enterprise security, monitoring, and horizontal scaling",
   "main": "MasterControl.js",
   "license": "MIT",