tina4-nodejs 3.13.150 → 3.13.151

package/packages/core/src/messenger.ts

@@ -371,6 +371,26 @@ function sendCommand(
 /**
  * Build an RFC 2822 MIME message.
  */
+// The text/html multipart-alternative body, identical in the with- and
+// without-attachments paths of buildMimeMessage.
+function pushAlternativeBody(lines: string[], altBoundary: string, text: string, body: string): void {
+  lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
+  lines.push("");
+  lines.push(`--${altBoundary}`);
+  lines.push("Content-Type: text/plain; charset=UTF-8");
+  lines.push("Content-Transfer-Encoding: 7bit");
+  lines.push("");
+  lines.push(text);
+  lines.push("");
+  lines.push(`--${altBoundary}`);
+  lines.push("Content-Type: text/html; charset=UTF-8");
+  lines.push("Content-Transfer-Encoding: 7bit");
+  lines.push("");
+  lines.push(body);
+  lines.push("");
+  lines.push(`--${altBoundary}--`);
+}
+
 function buildMimeMessage(options: {
   from: string;
   fromName?: string;
@@ -423,21 +443,7 @@ function buildMimeMessage(options: {
 
     // Body part (with optional text alternative)
     if (hasTextAlt) {
-      lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/plain; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.text!);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/html; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.body);
-      lines.push("");
-      lines.push(`--${altBoundary}--`);
+      pushAlternativeBody(lines, altBoundary, options.text!, options.body);
     } else {
       const contentType = options.html ? "text/html" : "text/plain";
       lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
@@ -469,21 +475,7 @@ function buildMimeMessage(options: {
     lines.push(`--${boundary}--`);
   } else if (hasTextAlt) {
     // Text alternative without attachments
-    lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/plain; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.text!);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/html; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.body);
-    lines.push("");
-    lines.push(`--${altBoundary}--`);
+    pushAlternativeBody(lines, altBoundary, options.text!, options.body);
   } else {
     // Simple message
     const contentType = options.html ? "text/html" : "text/plain";

package/packages/core/src/middleware.ts

@@ -931,6 +931,7 @@ export class RequestLogger {
  *   TINA4_CSP                 — Content-Security-Policy (default: "default-src 'self'")
  *   TINA4_REFERRER_POLICY     — Referrer-Policy (default: "strict-origin-when-cross-origin")
  *   TINA4_PERMISSIONS_POLICY  — Permissions-Policy (default: "camera=(), microphone=(), geolocation=()")
+ *   TINA4_COOP                — Cross-Origin-Opener-Policy (default: "same-origin-allow-popups")
  *
  * Usage:
  *   Router.use(SecurityHeadersMiddleware);
@@ -967,6 +968,7 @@ export class SecurityHeadersMiddleware {
       "Referrer-Policy": process.env.TINA4_REFERRER_POLICY ?? "strict-origin-when-cross-origin",
       "X-XSS-Protection": "0",
       "Permissions-Policy": process.env.TINA4_PERMISSIONS_POLICY ?? "camera=(), microphone=(), geolocation=()",
+      "Cross-Origin-Opener-Policy": process.env.TINA4_COOP ?? "same-origin-allow-popups",
     };
   }
 
@@ -996,7 +998,12 @@ export class SecurityHeadersMiddleware {
     // script-src (ADR-0088), already resolved in canonical, so the framework's
     // own inline <style>/<script> (and user templates using the Frond
     // csp_nonce() global) run under the strict policy without 'unsafe-inline'.
-    for (const name of ["Content-Security-Policy", "Referrer-Policy", "X-XSS-Protection", "Permissions-Policy"]) {
+    // Cross-Origin-Opener-Policy severs the window-reference link to a
+    // cross-origin opener (closing reverse-tab-nabbing + cross-window XS-Leaks
+    // that X-Frame-Options does not). Default same-origin-allow-popups keeps
+    // OAuth/payment popups working; TINA4_COOP=same-origin for full isolation,
+    // unsafe-none to opt out. Secure-context only (https + http://localhost).
+    for (const name of ["Content-Security-Policy", "Referrer-Policy", "X-XSS-Protection", "Permissions-Policy", "Cross-Origin-Opener-Policy"]) {
       res.header(name, canonical[name]);
     }
 

package/packages/core/src/optionalPackage.ts

@@ -11,8 +11,8 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  * APPLICATION installs, never the framework (ADR-0067).
  *
  * tina4-nodejs installs as exactly one package. `pg`, `mongodb`, `redis` and
- * the `@aws-sdk` S3 client are optional peerDependencies, which npm does not
- * install, so for most apps "missing" is the normal state. Every feature that
+ * the SQL drivers are optional peerDependencies, which npm does not install, so
+ * for most apps "missing" is the normal state. Every feature that
  * reaches for one must therefore fail at the point of use with the exact
  * command that fixes it - never a bare MODULE_NOT_FOUND, never a silent no-op.
  */

package/packages/core/src/plan.ts

@@ -18,6 +18,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
 import * as fs from "node:fs";
+import { trimChar } from "./slashTrim.js";
 import * as path from "node:path";
 
 const PLAN_DIR = "plan";
@@ -90,9 +91,8 @@ function archiveDir(): string {
 }
 
 function slugify(title: string): string {
-  const slug = (title || "").trim().toLowerCase()
-    .replace(/[^A-Za-z0-9_-]+/g, "-")
-    .replace(/^-+|-+$/g, "");
+  const dashed = (title || "").trim().toLowerCase().replace(/[^A-Za-z0-9_-]+/g, "-");
+  const slug = trimChar(dashed, 45); // ReDoS-safe edge-dash strip (45 = '-')
   return slug.slice(0, 80) || `plan-${Math.floor(Date.now() / 1000)}`;
 }
 

package/packages/core/src/push.ts

@@ -70,7 +70,7 @@ function encodeBase64Url(value: Uint8Array): string {
   return Buffer.from(value).toString("base64")
     .replace(/\+/g, "-")
     .replace(/\//g, "_")
-    .replace(/=+$/g, "");
+    .replace(/={1,2}$/, "");
 }
 
 function decodeBase64Url(value: string, name: string): Buffer {

package/packages/core/src/request.ts

@@ -7,7 +7,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
 import type { IncomingMessage, IncomingHttpHeaders } from "node:http";
-import { mkdirSync, realpathSync, writeFileSync } from "node:fs";
+import { closeSync, constants, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import type { Tina4Request, UploadedFile } from "./types.js";
 import { resolveClientIp, isTrustedProxy } from "./trustedProxy.js";
@@ -84,7 +84,12 @@ export function createRequest(req: IncomingMessage): Tina4Request {
   try {
     const url = new URL(req.url ?? "/", `${proto}://${host}`);
     for (const [key, value] of url.searchParams) {
-      query[key] = value;
+      if (isUnsafeFieldName(key)) continue;
+      // Reflect.set, not query[key]=value: the key is already filtered
+      // (isUnsafeFieldName drops __proto__/constructor/prototype), and the
+      // reflective write keeps that guarantee legible to static analysis
+      // (js/remote-property-injection).
+      Reflect.set(query, key, value);
     }
     path = url.pathname;
     queryString = url.search.replace(/^\?/, "");
@@ -96,7 +101,8 @@ export function createRequest(req: IncomingMessage): Tina4Request {
     queryString = questionIdx >= 0 ? rawTarget.slice(questionIdx + 1) : "";
     try {
       for (const [key, value] of new URLSearchParams(queryString)) {
-        query[key] = value;
+        if (isUnsafeFieldName(key)) continue;
+        Reflect.set(query, key, value);  // filtered key; reflective write (see above)
       }
     } catch { /* unparseable query — leave query empty, still route the path */ }
     fullUrl = `${proto}://${host}${rawTarget}`;
@@ -121,7 +127,9 @@ export function createRequest(req: IncomingMessage): Tina4Request {
   if (cookieHeader) {
     for (const pair of cookieHeader.split(";")) {
       const [k, ...v] = pair.trim().split("=");
-      if (k) cookies[k.trim()] = v.join("=").trim();
+      const name = k ? k.trim() : "";
+      // Reflective write of an already-filtered cookie name (js/remote-property-injection).
+      if (name && !isUnsafeFieldName(name)) Reflect.set(cookies, name, v.join("=").trim());
     }
   }
   w.cookies = cookies;
@@ -273,13 +281,7 @@ async function parseBody(req: Tina4Request): Promise<void> {
       req.body = str;
     }
   } else if (contentType.includes("application/x-www-form-urlencoded")) {
-    const str = raw.toString("utf-8");
-    const params = new URLSearchParams(str);
-    const obj: Record<string, string> = {};
-    for (const [key, value] of params) {
-      obj[key] = value;
-    }
-    req.body = obj;
+    req.body = nestFormFields([...new URLSearchParams(raw.toString("utf-8"))]);
   } else {
     req.body = raw.toString("utf-8");
   }
@@ -300,8 +302,8 @@ function extractBoundary(contentType: string): string | null {
 export function parseMultipart(
   body: Buffer,
   boundary: string,
-): { fields: Record<string, string>; files: Record<string, UploadedFile | UploadedFile[]> } {
-  const fields: Record<string, string> = {};
+): { fields: Record<string, FormValue>; files: Record<string, UploadedFile | UploadedFile[]> } {
+  const pairs: Array<[string, string]> = [];
   const files: Record<string, UploadedFile | UploadedFile[]> = {};
 
   const delimiter = Buffer.from(`--${boundary}`);
@@ -313,7 +315,7 @@ export function parseMultipart(
 
   // Find first delimiter
   const firstIdx = bufferIndexOf(body, delimiter, offset);
-  if (firstIdx === -1) return { fields, files };
+  if (firstIdx === -1) return { fields: {}, files };
   offset = firstIdx + delimiter.length;
 
   // Skip CRLF after delimiter
@@ -350,16 +352,21 @@ export function parseMultipart(
         content: Buffer.from(content),
         size: content.length,
       };
-      // Dict keyed by field name — multiple files under same name become array
-      if (files[disposition.name]) {
+      // Dict keyed by field name — multiple files under same name become array.
+      // A file field named __proto__/constructor/prototype is never legitimate
+      // and is dropped (js/remote-property-injection).
+      if (isUnsafeFieldName(disposition.name)) {
+        // skip
+      } else if (files[disposition.name]) {
         const existing = files[disposition.name];
-        files[disposition.name] = Array.isArray(existing) ? [...existing, file] : [existing, file];
+        // Reflective write of an already-filtered file-field name (js/remote-property-injection).
+        Reflect.set(files, disposition.name, Array.isArray(existing) ? [...existing, file] : [existing, file]);
       } else {
-        files[disposition.name] = file;
+        Reflect.set(files, disposition.name, file);
       }
     } else if (disposition.name) {
-      // Regular field
-      fields[disposition.name] = content.toString("utf-8");
+      // Regular field, nested once every part is read
+      pairs.push([disposition.name, content.toString("utf-8")]);
     }
 
     // Move past the delimiter
@@ -377,7 +384,7 @@ export function parseMultipart(
     }
   }
 
-  return { fields, files };
+  return { fields: nestFormFields(pairs), files };
 }
 
 /**
@@ -406,13 +413,34 @@ export function saveUpload(file: UploadedFile, targetDir: string, filename?: str
   mkdirSync(targetDir, { recursive: true });
   const dest = join(targetDir, base);
   // Defence in depth: the resolved parent of the destination must be exactly
-  // the resolved target dir (guards a pre-existing symlink at target/base).
+  // the resolved target dir.
   const realDir = realpathSync(targetDir);
   const realParent = realpathSync(dirname(dest));
   if (realParent !== realDir) {
     throw new Error(`refusing to write outside ${targetDir}: ${JSON.stringify(raw)}`);
   }
-  writeFileSync(dest, file.content);
+  // Never write THROUGH a link already at target/base: a symlink (even a
+  // dangling one) leads out of targetDir, and a hard link shares its bytes
+  // with a file elsewhere. Such an entry is removed so the upload gets a file
+  // of its own; a plain file is rewritten in place and keeps its mode.
+  if (lstatSync(dest, { throwIfNoEntry: false })?.isSymbolicLink()) unlinkSync(dest);
+  const flags = constants.O_WRONLY | constants.O_CREAT | (constants.O_NOFOLLOW ?? 0);
+  // 0o600: a newly created upload is owner-only, never group/other readable or
+  // writable (CWE-732). The mode applies only when O_CREAT makes the file; a
+  // plain file rewritten in place keeps its own mode, per the note above.
+  let fd = openSync(dest, flags, 0o600);
+  try {
+    if (fstatSync(fd).nlink > 1) {
+      closeSync(fd);
+      fd = -1;
+      unlinkSync(dest);
+      fd = openSync(dest, flags | constants.O_EXCL, 0o600);
+    }
+    ftruncateSync(fd, 0);
+    writeFileSync(fd, file.content);
+  } finally {
+    if (fd >= 0) closeSync(fd);
+  }
   return dest;
 }
 
@@ -440,6 +468,138 @@ function parseDisposition(headers: string): { name: string; filename?: string }
 }
 
 function parsePartContentType(headers: string): string | null {
-  const match = headers.match(/Content-Type:\s*(.+?)(?:\r?\n|$)/i);
-  return match?.[1]?.trim() ?? null;
+  // ReDoS-safe: a single negated class captures the rest of the line (it stops
+  // at CR/LF on its own, so no terminator alternation and no leading [ \t]* to
+  // overlap). Trim the surrounding whitespace in code.
+  const match = headers.match(/Content-Type:([^\r\n]*)/i);
+  const value = match?.[1]?.trim();
+  return value ? value : null;
+}
+
+/** A form field's value once its name is nested: `tags[]` a list, `user[name]` an object. */
+export type FormValue = string | FormValue[] | { [key: string]: FormValue };
+
+/** A field name nested this deep or deeper keeps its flat key. Rack's param_depth_limit. */
+const FORM_DEPTH_LIMIT = 32;
+
+/** A form with more fields than this is not nested at all. Rack's params_limit. */
+const FORM_FIELD_LIMIT = 4096;
+
+/** A field name longer than this keeps its flat key. */
+const FORM_NAME_LIMIT = 1024;
+
+/**
+ * The three keys that reach the prototype chain. A query param, cookie or file
+ * field literally named one of these is never legitimate, so the flat maps
+ * (query / cookies / files) drop it. The nested body builder does NOT drop
+ * `constructor`/`prototype` - a form MAY carry `user[constructor][name]` as
+ * data - and stays safe a different way: its containers are prototype-less
+ * (`Object.create(null)` in node() below), so assigning any of these as an own
+ * key cannot pollute a prototype. `__proto__` segments are dropped outright
+ * (the kept filter). Together these make prototype pollution structurally
+ * impossible, not merely filtered (js/prototype-polluting-assignment,
+ * js/remote-property-injection).
+ */
+const isUnsafeFieldName = (key: string): boolean =>
+  key === "__proto__" || key === "constructor" || key === "prototype";
+
+/**
+ * Nest form fields the way PHP and Rack (tina4-ruby) nest a form: `tags[]`
+ * collects an array, `user[name]` builds an object, `a[][x]` an array of
+ * objects, and a repeated plain name keeps its last value. Used for urlencoded
+ * and multipart bodies alike, so a form arrives in one shape however it was
+ * encoded. A field that cannot nest - its name conflicts with an earlier one
+ * (`a=1` then `a[b]=2`), nests too deep or is longer than FORM_NAME_LIMIT -
+ * keeps its flat key; the rest still nest. A later plain name replaces an
+ * earlier nested value of that name, as Rack and parse_str do. A field with a `__proto__` segment anywhere in its name is dropped.
+ */
+function nestFormFields(pairs: Array<[string, string]>): Record<string, FormValue> {
+  const kept = pairs.filter(([name]) => !/(^|[[\]])__proto__([[\]]|$)/.test(name));
+  if (kept.length > FORM_FIELD_LIMIT) return Object.fromEntries(kept);
+  const nested = new WeakSet<object>();
+  // Prototype-less: assigning any user key (including `constructor`/`prototype`)
+  // as an own property on these containers cannot reach or mutate a prototype,
+  // so the nested body is safe by construction (js/prototype-polluting-assignment).
+  const node = (): Record<string, FormValue> => {
+    const created: Record<string, FormValue> = Object.create(null);
+    nested.add(created);
+    return created;
+  };
+  const isNode = (value: unknown): value is Record<string, FormValue> =>
+    typeof value === "object" && value !== null && nested.has(value);
+  const own = (params: Record<string, FormValue>, key: string): FormValue | undefined =>
+    Object.prototype.hasOwnProperty.call(params, key) ? params[key] : undefined;
+  const list = (params: Record<string, FormValue>, key: string): FormValue[] => {
+    let current = own(params, key);
+    if (current === undefined) { current = []; Reflect.set(params, key, current); }
+    if (!Array.isArray(current)) throw new RangeError(`expected an array for '${key}'`);
+    return current;
+  };
+  const object = (params: Record<string, FormValue>, key: string): Record<string, FormValue> => {
+    let current = own(params, key);
+    if (current === undefined) { current = node(); Reflect.set(params, key, current); }
+    if (!isNode(current)) throw new RangeError(`expected an object for '${key}'`);
+    return current;
+  };
+  const hasKey = (params: Record<string, FormValue>, key: string): boolean => {
+    if (key.includes("[]")) return false;
+    let level: FormValue | undefined = params;
+    for (const part of key.split(/[[\]]+/).filter(Boolean)) {
+      if (!isNode(level) || own(level, part) === undefined) return false;
+      level = level[part];
+    }
+    return true;
+  };
+  const splitName = (name: string, depth: number): [string, string] => {
+    if (depth === 0) {
+      const start = name.indexOf("[", 1);
+      return start === -1 ? [name, ""] : [name.slice(0, start), name.slice(start)];
+    }
+    if (name.startsWith("[]")) return ["[]", name.slice(2)];
+    const close = name.indexOf("]", 1);
+    return name.startsWith("[") && close !== -1 ? [name.slice(1, close), name.slice(close + 1)] : [name, ""];
+  };
+  // `a[][x]`: fill the last record unless it already has `x`, else start one.
+  const putListItem = (items: FormValue[], after: string, value: string, depth: number): void => {
+    let childKey = after[2] === "[" && after.endsWith("]") ? after.slice(3, -1) : "";
+    if (childKey === "" || childKey.includes("[") || childKey.includes("]")) childKey = after.slice(2);
+    const last = items[items.length - 1];
+    if (isNode(last) && !hasKey(last, childKey)) put(last, childKey, value, depth + 1);
+    else items.push(put(node(), childKey, value, depth + 1) as FormValue);
+  };
+  // Rack::QueryParser#normalize_params, ported from tina4-ruby's form parser.
+  const put = (params: Record<string, FormValue>, name: string, value: string, depth: number): FormValue | undefined => {
+    const [key, after] = splitName(name, depth);
+    if (key === "") return undefined;
+    if (after === "" && key === "[]" && depth !== 0) return [value];
+    // Reflective writes into prototype-less `node()` containers (js/remote-property-injection).
+    if (after === "") Reflect.set(params, key, value);
+    else if (after === "[") Reflect.set(params, name, value);
+    else if (after === "[]") list(params, key).push(value);
+    else if (after.startsWith("[]")) putListItem(list(params, key), after, value, depth);
+    else put(object(params, key), after, value, depth + 1);
+    return params;
+  };
+  // Counts brackets only up to the limit, so a name of millions of them costs nothing.
+  const tooDeep = (name: string): boolean => {
+    let count = 0;
+    for (let at = name.indexOf("["); at !== -1; at = name.indexOf("[", at + 1)) {
+      if (++count >= FORM_DEPTH_LIMIT) return true;
+    }
+    return false;
+  };
+  const fields = node();
+  for (const [name, value] of kept) {
+    if (name.length > FORM_NAME_LIMIT || tooDeep(name)) {
+      Reflect.set(fields, name, value);  // prototype-less container (js/remote-property-injection)
+      continue;
+    }
+    try {
+      put(fields, name, value, 0);
+    } catch (error) {
+      if (!(error instanceof RangeError)) throw error;
+      Reflect.set(fields, name, value);  // prototype-less container (js/remote-property-injection)
+    }
+  }
+  return fields;
 }

package/packages/core/src/router.ts

@@ -7,6 +7,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
 import type { RouteHandler, RouteDefinition, RouteMeta, Middleware, MiddlewareSpec, Tina4Request, Tina4Response, WebSocketRouteHandler, WebSocketRouteDefinition } from "./types.js";
+import { trimSlashes, rtrimSlashes } from "./slashTrim.js";
 import { isTruthy } from "./dotenv.js";
 import { MiddlewareRunner, isMiddlewareClass } from "./middleware.js";
 
@@ -63,7 +64,7 @@ function coerceParam(raw: string, type: string | undefined): string | number {
  */
 function joinGroupPath(prefix: string, path: string): string {
   const full = `${prefix}/${path.replace(/^\/+/, "")}`;
-  const trimmed = `/${full.replace(/^\/+|\/+$/g, "")}`;
+  const trimmed = `/${trimSlashes(full)}`;
   return trimmed.replace(/\/+/g, "/");
 }
 
@@ -369,7 +370,7 @@ export class Router {
         path.length > 1 &&
         path.endsWith("/")
       ) {
-        const stripped = path.replace(/\/+$/, "");
+        const stripped = rtrimSlashes(path);
         if (stripped.length > 0) {
           const retry = this.matchRoute(routes, stripped);
           if (retry) return retry;

package/packages/core/src/server.ts

@@ -7,13 +7,14 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
 import { createServer, IncomingMessage, ServerResponse } from "node:http";
+import { trimSlashes } from "./slashTrim.js";
 import { createTina4HttpServer, guardUnsafeHeaders, sendTransportRejection } from "./transport.js";
 import { randomBytes } from "node:crypto";
 import { resolve, dirname, join, relative } from "node:path";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { isatty } from "node:tty";
 import { fileURLToPath } from "node:url";
-import { execFileSync, exec } from "node:child_process";
+import { execFileSync, execFile } from "node:child_process";
 import cluster from "node:cluster";
 import os from "node:os";
 import type { Socket } from "node:net";
@@ -37,6 +38,7 @@ import {
   compressionEtagIntercept,
   sessionAutoStart,
 } from "./dispatchPipeline.js";
+import { runWithFormTokenSession, currentFormTokenSessionId } from "./session.js";
 import { createResponse, setDefaultTemplatesDir, wantsJson, negotiatedErrorBody } from "./response.js";
 import { MiddlewareChain, MiddlewareRunner, cors, requestLogger, isMiddlewareClass, attachCsrfFromEnv, SecurityHeadersMiddleware } from "./middleware.js";
 import { tryServeStatic } from "./static.js";
@@ -398,11 +400,24 @@ export function shouldOpenBrowser(isDevelopment: boolean, noBrowser = false): bo
  * Open the user's default browser after a short delay so the server is ready.
  */
 function openBrowser(url: string) {
-  // exec imported at top of file (ESM)
+  // Only ever hand a well-formed http(s) dev URL to the OS browser launcher.
+  // TINA4_HOST / HOST are operator configuration, not remote input, but a value
+  // carrying shell or URL metacharacters must never reach the launch argv — an
+  // unusual host means "do not auto-open", never "run this". Host is a bare
+  // hostname / IPv4 / bracketed IPv6 literal; port is digits only. This guard
+  // is what sanitizes the env-derived host (js/indirect-command-line-injection,
+  // js/shell-command-constructed-from-input).
+  if (!/^https?:\/\/([A-Za-z0-9.-]+|\[[0-9A-Fa-f:]+\])(:\d{1,5})?\/?$/.test(url)) return;
+  // No shell on any platform: each launcher is an explicit binary and the URL
+  // is a single argv entry, never interpreted by a command processor. Windows
+  // opens via rundll32's FileProtocolHandler, NOT `cmd /c start` — `cmd` is a
+  // shell, so routing a host-derived URL through it is a command-injection sink
+  // (js/indirect-command-line-injection, js/shell-command-constructed-from-input);
+  // rundll32 is not, and it also avoids `start`'s argument-quoting pitfalls.
   setTimeout(() => {
-    if (process.platform === "darwin") exec(`open ${url}`);
-    else if (process.platform === "win32") exec(`start "" "${url}"`);
-    else exec(`xdg-open ${url}`);
+    if (process.platform === "darwin") execFile("open", [url]);
+    else if (process.platform === "win32") execFile("rundll32", ["url.dll,FileProtocolHandler", url]);
+    else execFile("xdg-open", [url]);
   }, 2000);
 }
 
@@ -661,7 +676,7 @@ export function resetTemplateCache(): void {
 export function resolveTemplate(pathname: string, templatesDir: string): string | null {
   if (!templateAutoRoutingEnabled()) return null;
 
-  const cleanPath = pathname.replace(/^\/+/, "").replace(/\/+$/, "") || "index";
+  const cleanPath = trimSlashes(pathname) || "index";
   const isDev = (process.env.TINA4_DEBUG ?? "false").toLowerCase() === "true";
 
   if (isDev) {
@@ -1078,7 +1093,10 @@ export function resolveHandlerArgs(
   routeParams: Record<string, unknown>,
 ): unknown[] {
   const fnStr = (handler as { toString(): string }).toString();
-  const argMatch = fnStr.match(/^(?:async\s*)?(?:function\s*\w*)?\s*\(([^)]*)\)/);
+  // ReDoS-safe: the old `(?:function\s*\w*)?\s*\(` had two `\s*` straddling `\w*`
+  // before `\(`, so whitespace could be split two ways (O(n^2)). A single
+  // optional name and one trailing `\s*` removes the ambiguity.
+  const argMatch = fnStr.match(/^(?:async\s*)?(?:function(?:\s+\w+)?\s*)?\(([^)]*)\)/);
   const argNames = argMatch?.[1]?.split(",").map((a: string) => a.trim().replace(/[:=].*/, "")) ?? [];
   const filteredArgs = argNames.filter((n: string) => n.length > 0);
   if (filteredArgs.length === 0) return [];
@@ -1705,8 +1723,9 @@ export async function buildDispatchContext(router: Router, base?: string): Promi
 
   let frondEngine: DispatchContext["frondEngine"] = null;
   try {
-    const { Frond, setCspNonceProvider } = await import("../../frond/src/engine.js");
+    const { Frond, setCspNonceProvider, setFormTokenSessionProvider } = await import("../../frond/src/engine.js");
     setCspNonceProvider(currentCspNonce);
+    setFormTokenSessionProvider(currentFormTokenSessionId);
     frondEngine = new Frond(templatesDir);
   } catch {
     // Frond not available — template-route fallback stays inert, same guard startServer() uses.
@@ -1918,7 +1937,9 @@ export async function runDispatch(
   // two requests interleaving on the one event loop never share it.
   const requestNonce = generateNonce();
   return Log.runWithRequestId(requestId, () =>
-    runWithCspNonce(requestNonce, () => dispatchInner(ctx, rawReq, rawRes, requestId)),
+    runWithCspNonce(requestNonce, () =>
+      runWithFormTokenSession(() => dispatchInner(ctx, rawReq, rawRes, requestId)),
+    ),
   );
 }
 
@@ -2156,8 +2177,9 @@ export async function startServer(config?: Tina4Config): Promise<{
   let frondEngine: any = null;
   setDefaultTemplatesDir(templatesDir);
   try {
-    const { Frond, setCspNonceProvider } = await import("../../frond/src/engine.js");
+    const { Frond, setCspNonceProvider, setFormTokenSessionProvider } = await import("../../frond/src/engine.js");
     setCspNonceProvider(currentCspNonce);
+    setFormTokenSessionProvider(currentFormTokenSessionId);
     frondEngine = new Frond(templatesDir);
 
     // Always-on Frond {% live %} refresh endpoint. Re-renders a server-rendered

package/packages/core/src/session.ts

@@ -32,6 +32,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  *   session.get("user");  // { name: "Alice" }
  *   session.destroy();
  */
+import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from "node:fs";
 import { join } from "node:path";
@@ -1060,3 +1061,46 @@ export function sessionCookieToSend(
   const socketEncrypted = (rawReq.socket as { encrypted?: boolean } | undefined)?.encrypted === true;
   return buildSessionCookie(newSid, ttl, undefined, forwardedProto, socketEncrypted);
 }
+
+// ── Form-token session (CSRF binding) ─────────────────────────────────
+/**
+ * The session of the request being dispatched, for CSRF form-token binding.
+ *
+ * Frond's form_token() reads it through the provider core registers
+ * (setFormTokenSessionProvider), so a token is bound to the session that
+ * rendered it. It lives in an AsyncLocalStorage, like the CSP nonce, so two
+ * requests interleaving on the one event loop never bind to each other's session.
+ */
+interface BindableSession {
+  getSessionId(): string | null;
+  isFresh(): boolean;
+  set(key: string, value: unknown): void;
+}
+
+const sessionStore = new AsyncLocalStorage<{ session: BindableSession | null }>();
+
+/** Run `fn` with a request scope the dispatcher publishes its session into. */
+export function runWithFormTokenSession<T>(fn: () => T): T {
+  return sessionStore.run({ session: null }, fn);
+}
+
+/** Publish the current request's session (no-op outside a request scope). */
+export function setFormTokenSession(session: BindableSession | null): void {
+  const store = sessionStore.getStore();
+  if (store) store.session = session;
+}
+
+/**
+ * The current request's session id, or "" outside a request.
+ *
+ * A session that holds nothing is sent no cookie, so the form's own POST would
+ * arrive under a newly minted id and fail its own token. Rendering a bound
+ * token therefore stores a marker, which makes the session persist.
+ */
+export function currentFormTokenSessionId(): string {
+  const session = sessionStore.getStore()?.session;
+  const sid = session?.getSessionId();
+  if (!session || !sid) return "";
+  if (session.isFresh()) session.set("_tina4_csrf", true);
+  return sid;
+}