tina4-nodejs 3.13.149 → 3.13.151

package/packages/core/src/server.ts

@@ -7,13 +7,14 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
 import { createServer, IncomingMessage, ServerResponse } from "node:http";
+import { trimSlashes } from "./slashTrim.js";
 import { createTina4HttpServer, guardUnsafeHeaders, sendTransportRejection } from "./transport.js";
 import { randomBytes } from "node:crypto";
 import { resolve, dirname, join, relative } from "node:path";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { isatty } from "node:tty";
 import { fileURLToPath } from "node:url";
-import { execFileSync, exec } from "node:child_process";
+import { execFileSync, execFile } from "node:child_process";
 import cluster from "node:cluster";
 import os from "node:os";
 import type { Socket } from "node:net";
@@ -37,6 +38,7 @@ import {
   compressionEtagIntercept,
   sessionAutoStart,
 } from "./dispatchPipeline.js";
+import { runWithFormTokenSession, currentFormTokenSessionId } from "./session.js";
 import { createResponse, setDefaultTemplatesDir, wantsJson, negotiatedErrorBody } from "./response.js";
 import { MiddlewareChain, MiddlewareRunner, cors, requestLogger, isMiddlewareClass, attachCsrfFromEnv, SecurityHeadersMiddleware } from "./middleware.js";
 import { tryServeStatic } from "./static.js";
@@ -398,11 +400,24 @@ export function shouldOpenBrowser(isDevelopment: boolean, noBrowser = false): bo
  * Open the user's default browser after a short delay so the server is ready.
  */
 function openBrowser(url: string) {
-  // exec imported at top of file (ESM)
+  // Only ever hand a well-formed http(s) dev URL to the OS browser launcher.
+  // TINA4_HOST / HOST are operator configuration, not remote input, but a value
+  // carrying shell or URL metacharacters must never reach the launch argv — an
+  // unusual host means "do not auto-open", never "run this". Host is a bare
+  // hostname / IPv4 / bracketed IPv6 literal; port is digits only. This guard
+  // is what sanitizes the env-derived host (js/indirect-command-line-injection,
+  // js/shell-command-constructed-from-input).
+  if (!/^https?:\/\/([A-Za-z0-9.-]+|\[[0-9A-Fa-f:]+\])(:\d{1,5})?\/?$/.test(url)) return;
+  // No shell on any platform: each launcher is an explicit binary and the URL
+  // is a single argv entry, never interpreted by a command processor. Windows
+  // opens via rundll32's FileProtocolHandler, NOT `cmd /c start` — `cmd` is a
+  // shell, so routing a host-derived URL through it is a command-injection sink
+  // (js/indirect-command-line-injection, js/shell-command-constructed-from-input);
+  // rundll32 is not, and it also avoids `start`'s argument-quoting pitfalls.
   setTimeout(() => {
-    if (process.platform === "darwin") exec(`open ${url}`);
-    else if (process.platform === "win32") exec(`start "" "${url}"`);
-    else exec(`xdg-open ${url}`);
+    if (process.platform === "darwin") execFile("open", [url]);
+    else if (process.platform === "win32") execFile("rundll32", ["url.dll,FileProtocolHandler", url]);
+    else execFile("xdg-open", [url]);
   }, 2000);
 }
 
@@ -661,7 +676,7 @@ export function resetTemplateCache(): void {
 export function resolveTemplate(pathname: string, templatesDir: string): string | null {
   if (!templateAutoRoutingEnabled()) return null;
 
-  const cleanPath = pathname.replace(/^\/+/, "").replace(/\/+$/, "") || "index";
+  const cleanPath = trimSlashes(pathname) || "index";
   const isDev = (process.env.TINA4_DEBUG ?? "false").toLowerCase() === "true";
 
   if (isDev) {
@@ -1078,7 +1093,10 @@ export function resolveHandlerArgs(
   routeParams: Record<string, unknown>,
 ): unknown[] {
   const fnStr = (handler as { toString(): string }).toString();
-  const argMatch = fnStr.match(/^(?:async\s*)?(?:function\s*\w*)?\s*\(([^)]*)\)/);
+  // ReDoS-safe: the old `(?:function\s*\w*)?\s*\(` had two `\s*` straddling `\w*`
+  // before `\(`, so whitespace could be split two ways (O(n^2)). A single
+  // optional name and one trailing `\s*` removes the ambiguity.
+  const argMatch = fnStr.match(/^(?:async\s*)?(?:function(?:\s+\w+)?\s*)?\(([^)]*)\)/);
   const argNames = argMatch?.[1]?.split(",").map((a: string) => a.trim().replace(/[:=].*/, "")) ?? [];
   const filteredArgs = argNames.filter((n: string) => n.length > 0);
   if (filteredArgs.length === 0) return [];
@@ -1705,8 +1723,9 @@ export async function buildDispatchContext(router: Router, base?: string): Promi
 
   let frondEngine: DispatchContext["frondEngine"] = null;
   try {
-    const { Frond, setCspNonceProvider } = await import("../../frond/src/engine.js");
+    const { Frond, setCspNonceProvider, setFormTokenSessionProvider } = await import("../../frond/src/engine.js");
     setCspNonceProvider(currentCspNonce);
+    setFormTokenSessionProvider(currentFormTokenSessionId);
     frondEngine = new Frond(templatesDir);
   } catch {
     // Frond not available — template-route fallback stays inert, same guard startServer() uses.
@@ -1918,7 +1937,9 @@ export async function runDispatch(
   // two requests interleaving on the one event loop never share it.
   const requestNonce = generateNonce();
   return Log.runWithRequestId(requestId, () =>
-    runWithCspNonce(requestNonce, () => dispatchInner(ctx, rawReq, rawRes, requestId)),
+    runWithCspNonce(requestNonce, () =>
+      runWithFormTokenSession(() => dispatchInner(ctx, rawReq, rawRes, requestId)),
+    ),
   );
 }
 
@@ -2156,8 +2177,9 @@ export async function startServer(config?: Tina4Config): Promise<{
   let frondEngine: any = null;
   setDefaultTemplatesDir(templatesDir);
   try {
-    const { Frond, setCspNonceProvider } = await import("../../frond/src/engine.js");
+    const { Frond, setCspNonceProvider, setFormTokenSessionProvider } = await import("../../frond/src/engine.js");
     setCspNonceProvider(currentCspNonce);
+    setFormTokenSessionProvider(currentFormTokenSessionId);
     frondEngine = new Frond(templatesDir);
 
     // Always-on Frond {% live %} refresh endpoint. Re-renders a server-rendered

package/packages/core/src/session.ts

@@ -32,6 +32,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  *   session.get("user");  // { name: "Alice" }
  *   session.destroy();
  */
+import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from "node:fs";
 import { join } from "node:path";
@@ -1060,3 +1061,46 @@ export function sessionCookieToSend(
   const socketEncrypted = (rawReq.socket as { encrypted?: boolean } | undefined)?.encrypted === true;
   return buildSessionCookie(newSid, ttl, undefined, forwardedProto, socketEncrypted);
 }
+
+// ── Form-token session (CSRF binding) ─────────────────────────────────
+/**
+ * The session of the request being dispatched, for CSRF form-token binding.
+ *
+ * Frond's form_token() reads it through the provider core registers
+ * (setFormTokenSessionProvider), so a token is bound to the session that
+ * rendered it. It lives in an AsyncLocalStorage, like the CSP nonce, so two
+ * requests interleaving on the one event loop never bind to each other's session.
+ */
+interface BindableSession {
+  getSessionId(): string | null;
+  isFresh(): boolean;
+  set(key: string, value: unknown): void;
+}
+
+const sessionStore = new AsyncLocalStorage<{ session: BindableSession | null }>();
+
+/** Run `fn` with a request scope the dispatcher publishes its session into. */
+export function runWithFormTokenSession<T>(fn: () => T): T {
+  return sessionStore.run({ session: null }, fn);
+}
+
+/** Publish the current request's session (no-op outside a request scope). */
+export function setFormTokenSession(session: BindableSession | null): void {
+  const store = sessionStore.getStore();
+  if (store) store.session = session;
+}
+
+/**
+ * The current request's session id, or "" outside a request.
+ *
+ * A session that holds nothing is sent no cookie, so the form's own POST would
+ * arrive under a newly minted id and fail its own token. Rendering a bound
+ * token therefore stores a marker, which makes the session persist.
+ */
+export function currentFormTokenSessionId(): string {
+  const session = sessionStore.getStore()?.session;
+  const sid = session?.getSessionId();
+  if (!session || !sid) return "";
+  if (session.isFresh()) session.set("_tina4_csrf", true);
+  return sid;
+}

package/packages/core/src/slashTrim.ts

@@ -0,0 +1,39 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
+// ReDoS-safe edge-character trimming, shared by core/orm/swagger.
+//
+// `/\/+$/` and `/^\/+|\/+$/g` (and the slug's `/^-+|-+$/g`) are polynomial on V8:
+// a long run of the character followed by a different tail makes the anchored
+// `+` backtrack O(n^2), so a crafted request path of ~80k slashes hangs the
+// event loop for seconds. These run on attacker-reachable paths (the router, the
+// server pathname), so the fix matters. A single character scan strips the same
+// run in one linear pass with no backtracking.
+
+const SLASH = 47; // '/'.charCodeAt(0)
+
+/** Strip the given char code from the end only (the `/\/+$/` replacement). */
+export function rtrimSlashes(s: string): string {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === SLASH) end--;
+  return end === s.length ? s : s.slice(0, end);
+}
+
+/** Strip the given char code from both ends (linear, no backtracking). */
+export function trimChar(s: string, code: number): string {
+  let start = 0;
+  let end = s.length;
+  while (start < end && s.charCodeAt(start) === code) start++;
+  while (end > start && s.charCodeAt(end - 1) === code) end--;
+  return start === 0 && end === s.length ? s : s.slice(start, end);
+}
+
+/** Strip leading AND trailing '/' (the ReDoS-safe `/^\/+|\/+$/g` replacement). */
+export function trimSlashes(s: string): string {
+  return trimChar(s, SLASH);
+}

package/packages/core/src/wsdl.ts

@@ -143,65 +143,83 @@ const ATTRIBUTE_VALUE = /=\s*(?:"([^"<]*)"|'([^'<]*)')/g;
 function parseXmlDocument(xml: string): XmlElement {
   const stack: XmlElement[] = [];
   let root: XmlElement | null = null;
-  let position = 0;
 
   const addText = (text: string): void => {
     const current = stack[stack.length - 1];
     if (current.children.length === 0) current.text += text;
   };
 
-  while (position < xml.length) {
-    const nextTag = xml.indexOf("<", position);
+  // One handler per markup construct. Each is entered at the "<" that opens the
+  // construct and returns the position just past it; they share stack/root/addText
+  // through this closure. Splitting the old six-arm if/else out of the scan loop
+  // keeps each rule small and named (cyclomatic complexity stays low per function).
+  const skipComment = (at: number): number => {
+    const close = xml.indexOf("-->", at + 4);
+    if (close === -1) malformed();
+    return close + 3;
+  };
+  const readCData = (at: number): number => {
+    const close = xml.indexOf("]]>", at + 9);
+    if (close === -1 || stack.length === 0) malformed();
+    addText(xml.slice(at + 9, close));
+    return close + 3;
+  };
+  const skipProcessingInstruction = (at: number): number => {
+    const close = xml.indexOf("?>", at + 2);
+    if (close === -1) malformed();
+    const target = xml.slice(at + 2, close).split(/\s/, 1)[0];
+    // The XML declaration is only legal as the very first thing in the document.
+    if (target.toLowerCase() === "xml" && at !== 0) malformed();
+    return close + 2;
+  };
+  const closeElement = (at: number): number => {
+    END_TAG.lastIndex = at;
+    const match = END_TAG.exec(xml);
+    const open = stack.pop();
+    if (!match || !open || open.qualifiedName !== match[1]) malformed();
+    return END_TAG.lastIndex;
+  };
+  const openElement = (at: number): number => {
+    START_TAG.lastIndex = at;
+    const match = START_TAG.exec(xml);
+    if (!match || (stack.length === 0 && root !== null)) malformed(); // bad tag, or a second root
+    for (const attribute of match[2].matchAll(ATTRIBUTE_VALUE)) decodeEntities(attribute[1] ?? attribute[2]);
+    const qualifiedName = match[1];
+    const element: XmlElement = {
+      name: qualifiedName.slice(qualifiedName.indexOf(":") + 1),
+      qualifiedName,
+      children: [],
+      text: "",
+    };
+    if (stack.length > 0) stack[stack.length - 1].children.push(element);
+    else root = element;
+    if (match[3] !== "/") stack.push(element);
+    return START_TAG.lastIndex;
+  };
+
+  // Consume the text run before the next "<" (entities decoded inside an element,
+  // only whitespace tolerated outside the root), then dispatch on the construct.
+  const readText = (at: number): number => {
+    const nextTag = xml.indexOf("<", at);
     const textEnd = nextTag === -1 ? xml.length : nextTag;
-    if (textEnd > position) {
-      const raw = xml.slice(position, textEnd);
+    if (textEnd > at) {
+      const raw = xml.slice(at, textEnd);
       if (stack.length > 0) addText(decodeEntities(raw));
       else if (raw.trim() !== "") malformed(); // text outside the root element
-      position = textEnd;
-      if (nextTag === -1) break;
     }
+    return textEnd;
+  };
 
-    if (xml.startsWith("<!--", position)) {
-      const close = xml.indexOf("-->", position + 4);
-      if (close === -1) malformed();
-      position = close + 3;
-    } else if (xml.startsWith("<![CDATA[", position)) {
-      const close = xml.indexOf("]]>", position + 9);
-      if (close === -1 || stack.length === 0) malformed();
-      addText(xml.slice(position + 9, close));
-      position = close + 3;
-    } else if (xml.startsWith("<?", position)) {
-      const close = xml.indexOf("?>", position + 2);
-      if (close === -1) malformed();
-      const target = xml.slice(position + 2, close).split(/\s/, 1)[0];
-      // The XML declaration is only legal as the very first thing in the document.
-      if (target.toLowerCase() === "xml" && position !== 0) malformed();
-      position = close + 2;
-    } else if (xml.startsWith("<!", position)) {
-      malformed(); // any other declaration; DOCTYPE was refused before parsing
-    } else if (xml.startsWith("</", position)) {
-      END_TAG.lastIndex = position;
-      const match = END_TAG.exec(xml);
-      const open = stack.pop();
-      if (!match || !open || open.qualifiedName !== match[1]) malformed();
-      position = END_TAG.lastIndex;
-    } else {
-      START_TAG.lastIndex = position;
-      const match = START_TAG.exec(xml);
-      if (!match || (stack.length === 0 && root !== null)) malformed(); // bad tag, or a second root
-      for (const attribute of match[2].matchAll(ATTRIBUTE_VALUE)) decodeEntities(attribute[1] ?? attribute[2]);
-      const qualifiedName = match[1];
-      const element: XmlElement = {
-        name: qualifiedName.slice(qualifiedName.indexOf(":") + 1),
-        qualifiedName,
-        children: [],
-        text: "",
-      };
-      if (stack.length > 0) stack[stack.length - 1].children.push(element);
-      else root = element;
-      if (match[3] !== "/") stack.push(element);
-      position = START_TAG.lastIndex;
-    }
+  let position = 0;
+  while (position < xml.length) {
+    position = readText(position);
+    if (position >= xml.length) break;
+    if (xml.startsWith("<!--", position)) position = skipComment(position);
+    else if (xml.startsWith("<![CDATA[", position)) position = readCData(position);
+    else if (xml.startsWith("<?", position)) position = skipProcessingInstruction(position);
+    else if (xml.startsWith("<!", position)) malformed(); // any other declaration; DOCTYPE refused before parsing
+    else if (xml.startsWith("</", position)) position = closeElement(position);
+    else position = openElement(position);
   }
 
   if (root === null || stack.length > 0) malformed();

package/packages/core/templates/crud/form.twig

@@ -3,23 +3,23 @@
 
   Override: drop your own src/templates/crud/form.twig to change how inputs render.
 
-  fields - one per input: { id, name, label, value, placeholder, required_attr,
+  fields - one per input: { id, name, label, value, placeholder, required (bool),
            and exactly ONE control flag: input (with type) | textarea | checkbox
-           (checked_attr) | select (options_html) }.
-  wrap        - render the <form> wrapper; form_id_attr/action/form_method set it
+           (checked bool) | select (options_html) }.
+  wrap        - render the <form> wrapper; form_id/action/form_method set it
   edit        - add the hidden primary-key input (edit modal)
   modal_footer- render the Cancel/Save modal buttons; submit_button - a plain Submit
 
   No inline styles or on*= handlers: the modal buttons carry data-crud-action and
   are wired by the page script's delegated listener (ADR-0088).
 #}
-{% if wrap %}<form{{ form_id_attr|raw }} action="{{ action }}" method="{{ form_method }}" class="needs-validation" data-crud-form="1">{% endif %}
+{% if wrap %}<form{% if form_id %} id="{{ form_id }}"{% endif %} action="{{ action }}" method="{{ form_method }}" class="needs-validation" data-crud-form="1">{% endif %}
 {% if method_override %}<input type="hidden" name="_method" value="{{ method_override }}">{% endif %}
 {% if edit %}<input type="hidden" id="{{ mode }}-pk-value" name="{{ pk }}">{% endif %}
 {% if modal_footer %}<div class="crud-errors" data-crud-errors hidden></div>{% endif %}
 {% for field in fields %}<div class="mb-3">
 <label for="{{ field.id }}" class="form-label">{{ field.label }}</label>
-{% if field.textarea %}<textarea class="form-control" id="{{ field.id }}" name="{{ field.name }}"{{ field.required_attr|raw }}>{{ field.value }}</textarea>{% endif %}{% if field.checkbox %}<div class="form-check"><input class="form-check-input" type="checkbox" id="{{ field.id }}" name="{{ field.name }}"{{ field.checked_attr|raw }}></div>{% endif %}{% if field.select %}<select class="form-select" id="{{ field.id }}" name="{{ field.name }}"{{ field.required_attr|raw }}>{{ field.options_html|raw }}</select>{% endif %}{% if field.input %}<input type="{{ field.type }}" class="form-control" id="{{ field.id }}" name="{{ field.name }}" value="{{ field.value }}" placeholder="{{ field.placeholder }}"{{ field.required_attr|raw }}>{% endif %}
+{% if field.textarea %}<textarea class="form-control" id="{{ field.id }}" name="{{ field.name }}"{% if field.required %} required{% endif %}>{{ field.value }}</textarea>{% endif %}{% if field.checkbox %}<div class="form-check"><input class="form-check-input" type="checkbox" id="{{ field.id }}" name="{{ field.name }}"{% if field.checked %} checked{% endif %}></div>{% endif %}{% if field.select %}<select class="form-select" id="{{ field.id }}" name="{{ field.name }}"{% if field.required %} required{% endif %}>{{ field.options_html|raw }}</select>{% endif %}{% if field.input %}<input type="{{ field.type }}" class="form-control" id="{{ field.id }}" name="{{ field.name }}" value="{{ field.value }}" placeholder="{{ field.placeholder }}"{% if field.required %} required{% endif %}>{% endif %}
 </div>
 {% endfor %}
 {% if modal_footer %}<div class="modal-footer"><button type="button" class="btn btn-secondary" data-crud-action="close" data-crud-modal="{{ mode }}">Cancel</button><button type="button" class="btn btn-primary" data-crud-action="save" data-crud-mode="{{ mode }}">Save</button></div>{% endif %}{% if submit_button %}<button type="submit" class="btn btn-primary">Submit</button>{% endif %}

package/packages/core/templates/crud/table.twig

@@ -11,7 +11,7 @@
     empty    - true when there are no rows
     colspan  - column count + 1 (for the empty row)
     editable - inline-edit table (Save/Delete); readonly - view table (Edit/Delete)
-    table_name, table_id_attr, inline_script
+    table_name, table_id, inline_script
 
   Alignment: each header/cell carries a tina4-css class (text-start for text,
   text-end for numbers). Actions is always text-end. No inline styles (ADR-0088).
@@ -20,7 +20,7 @@
   re-renders <tbody data-crud-body> over fetch() as the user searches/sorts/pages.
 #}
 <div class="table-responsive">
-<table class="table table-striped table-hover"{{ table_id_attr|raw }}>
+<table class="table table-striped table-hover"{% if table_id %} id="{{ table_id }}"{% endif %}>
 <thead class="table-dark"><tr>
 {% for header in headers %}{% if header.sortable %}<th class="{{ header.align }}"><a class="sort-link" href="{{ header.url }}" data-crud-sort="{{ header.col }}" data-crud-dir="{{ header.next_dir }}">{{ header.label }}{{ header.indicator|raw }}</a></th>{% endif %}{% if header.plain %}<th class="{{ header.align }}">{{ header.label }}</th>{% endif %}{% endfor %}<th class="text-end">Actions</th>
 </tr></thead>

package/packages/core/templates/errors/302.twig

@@ -8,15 +8,16 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 {% extends "errors/base.twig" %}
 {% block title %}Redirecting…{% endblock %}
-{% block meta %}<meta http-equiv="refresh" content="0;url={{ redirect_url }}">{% endblock %}
+{% block meta %}{% set p1 = redirect_url|slice(0,1) %}{% set p2 = redirect_url|slice(0,2) %}{% set p7 = redirect_url|slice(0,7) %}{% set p8 = redirect_url|slice(0,8) %}{% set rel = (p1 == '/') ? ((p2 == '//') ? 'no' : 'yes') : 'no' %}{% set safe_redirect_url = (rel == 'yes' or p7 == 'http://' or p8 == 'https://') ? redirect_url : '/' %}<meta http-equiv="refresh" content="0;url={{ safe_redirect_url }}">{% endblock %}
 {% block extra_styles %}
 .spinner { display: inline-block; width: 1.5rem; height: 1.5rem; border: 3px solid var(--border); border-top-color: var(--primary); border-radius: 50%; animation: spin 0.8s linear infinite; margin-bottom: 1rem; }
 @keyframes spin { to { transform: rotate(360deg); } }
 {% endblock %}
 {% block content %}
+    {% set p1 = redirect_url|slice(0,1) %}{% set p2 = redirect_url|slice(0,2) %}{% set p7 = redirect_url|slice(0,7) %}{% set p8 = redirect_url|slice(0,8) %}{% set rel = (p1 == '/') ? ((p2 == '//') ? 'no' : 'yes') : 'no' %}{% set safe_redirect_url = (rel == 'yes' or p7 == 'http://' or p8 == 'https://') ? redirect_url : '/' %}
     <div class="spinner"></div>
     <div class="error-title">Redirecting…</div>
     <div class="error-msg">You are being redirected to a new location.</div>
-    <div class="error-path c-primary">{{ redirect_url }}</div>
-    <a href="{{ redirect_url }}" class="error-home">Click here if not redirected</a>
+    <div class="error-path c-primary">{{ safe_redirect_url }}</div>
+    <a href="{{ safe_redirect_url }}" class="error-home">Click here if not redirected</a>
 {% endblock %}