tina4-nodejs 3.13.150 → 3.13.151

package/packages/core/src/slashTrim.ts

@@ -0,0 +1,39 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
+// ReDoS-safe edge-character trimming, shared by core/orm/swagger.
+//
+// `/\/+$/` and `/^\/+|\/+$/g` (and the slug's `/^-+|-+$/g`) are polynomial on V8:
+// a long run of the character followed by a different tail makes the anchored
+// `+` backtrack O(n^2), so a crafted request path of ~80k slashes hangs the
+// event loop for seconds. These run on attacker-reachable paths (the router, the
+// server pathname), so the fix matters. A single character scan strips the same
+// run in one linear pass with no backtracking.
+
+const SLASH = 47; // '/'.charCodeAt(0)
+
+/** Strip the given char code from the end only (the `/\/+$/` replacement). */
+export function rtrimSlashes(s: string): string {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === SLASH) end--;
+  return end === s.length ? s : s.slice(0, end);
+}
+
+/** Strip the given char code from both ends (linear, no backtracking). */
+export function trimChar(s: string, code: number): string {
+  let start = 0;
+  let end = s.length;
+  while (start < end && s.charCodeAt(start) === code) start++;
+  while (end > start && s.charCodeAt(end - 1) === code) end--;
+  return start === 0 && end === s.length ? s : s.slice(start, end);
+}
+
+/** Strip leading AND trailing '/' (the ReDoS-safe `/^\/+|\/+$/g` replacement). */
+export function trimSlashes(s: string): string {
+  return trimChar(s, SLASH);
+}

package/packages/core/src/wsdl.ts

@@ -143,65 +143,83 @@ const ATTRIBUTE_VALUE = /=\s*(?:"([^"<]*)"|'([^'<]*)')/g;
 function parseXmlDocument(xml: string): XmlElement {
   const stack: XmlElement[] = [];
   let root: XmlElement | null = null;
-  let position = 0;
 
   const addText = (text: string): void => {
     const current = stack[stack.length - 1];
     if (current.children.length === 0) current.text += text;
   };
 
-  while (position < xml.length) {
-    const nextTag = xml.indexOf("<", position);
+  // One handler per markup construct. Each is entered at the "<" that opens the
+  // construct and returns the position just past it; they share stack/root/addText
+  // through this closure. Splitting the old six-arm if/else out of the scan loop
+  // keeps each rule small and named (cyclomatic complexity stays low per function).
+  const skipComment = (at: number): number => {
+    const close = xml.indexOf("-->", at + 4);
+    if (close === -1) malformed();
+    return close + 3;
+  };
+  const readCData = (at: number): number => {
+    const close = xml.indexOf("]]>", at + 9);
+    if (close === -1 || stack.length === 0) malformed();
+    addText(xml.slice(at + 9, close));
+    return close + 3;
+  };
+  const skipProcessingInstruction = (at: number): number => {
+    const close = xml.indexOf("?>", at + 2);
+    if (close === -1) malformed();
+    const target = xml.slice(at + 2, close).split(/\s/, 1)[0];
+    // The XML declaration is only legal as the very first thing in the document.
+    if (target.toLowerCase() === "xml" && at !== 0) malformed();
+    return close + 2;
+  };
+  const closeElement = (at: number): number => {
+    END_TAG.lastIndex = at;
+    const match = END_TAG.exec(xml);
+    const open = stack.pop();
+    if (!match || !open || open.qualifiedName !== match[1]) malformed();
+    return END_TAG.lastIndex;
+  };
+  const openElement = (at: number): number => {
+    START_TAG.lastIndex = at;
+    const match = START_TAG.exec(xml);
+    if (!match || (stack.length === 0 && root !== null)) malformed(); // bad tag, or a second root
+    for (const attribute of match[2].matchAll(ATTRIBUTE_VALUE)) decodeEntities(attribute[1] ?? attribute[2]);
+    const qualifiedName = match[1];
+    const element: XmlElement = {
+      name: qualifiedName.slice(qualifiedName.indexOf(":") + 1),
+      qualifiedName,
+      children: [],
+      text: "",
+    };
+    if (stack.length > 0) stack[stack.length - 1].children.push(element);
+    else root = element;
+    if (match[3] !== "/") stack.push(element);
+    return START_TAG.lastIndex;
+  };
+
+  // Consume the text run before the next "<" (entities decoded inside an element,
+  // only whitespace tolerated outside the root), then dispatch on the construct.
+  const readText = (at: number): number => {
+    const nextTag = xml.indexOf("<", at);
     const textEnd = nextTag === -1 ? xml.length : nextTag;
-    if (textEnd > position) {
-      const raw = xml.slice(position, textEnd);
+    if (textEnd > at) {
+      const raw = xml.slice(at, textEnd);
       if (stack.length > 0) addText(decodeEntities(raw));
       else if (raw.trim() !== "") malformed(); // text outside the root element
-      position = textEnd;
-      if (nextTag === -1) break;
     }
+    return textEnd;
+  };
 
-    if (xml.startsWith("<!--", position)) {
-      const close = xml.indexOf("-->", position + 4);
-      if (close === -1) malformed();
-      position = close + 3;
-    } else if (xml.startsWith("<![CDATA[", position)) {
-      const close = xml.indexOf("]]>", position + 9);
-      if (close === -1 || stack.length === 0) malformed();
-      addText(xml.slice(position + 9, close));
-      position = close + 3;
-    } else if (xml.startsWith("<?", position)) {
-      const close = xml.indexOf("?>", position + 2);
-      if (close === -1) malformed();
-      const target = xml.slice(position + 2, close).split(/\s/, 1)[0];
-      // The XML declaration is only legal as the very first thing in the document.
-      if (target.toLowerCase() === "xml" && position !== 0) malformed();
-      position = close + 2;
-    } else if (xml.startsWith("<!", position)) {
-      malformed(); // any other declaration; DOCTYPE was refused before parsing
-    } else if (xml.startsWith("</", position)) {
-      END_TAG.lastIndex = position;
-      const match = END_TAG.exec(xml);
-      const open = stack.pop();
-      if (!match || !open || open.qualifiedName !== match[1]) malformed();
-      position = END_TAG.lastIndex;
-    } else {
-      START_TAG.lastIndex = position;
-      const match = START_TAG.exec(xml);
-      if (!match || (stack.length === 0 && root !== null)) malformed(); // bad tag, or a second root
-      for (const attribute of match[2].matchAll(ATTRIBUTE_VALUE)) decodeEntities(attribute[1] ?? attribute[2]);
-      const qualifiedName = match[1];
-      const element: XmlElement = {
-        name: qualifiedName.slice(qualifiedName.indexOf(":") + 1),
-        qualifiedName,
-        children: [],
-        text: "",
-      };
-      if (stack.length > 0) stack[stack.length - 1].children.push(element);
-      else root = element;
-      if (match[3] !== "/") stack.push(element);
-      position = START_TAG.lastIndex;
-    }
+  let position = 0;
+  while (position < xml.length) {
+    position = readText(position);
+    if (position >= xml.length) break;
+    if (xml.startsWith("<!--", position)) position = skipComment(position);
+    else if (xml.startsWith("<![CDATA[", position)) position = readCData(position);
+    else if (xml.startsWith("<?", position)) position = skipProcessingInstruction(position);
+    else if (xml.startsWith("<!", position)) malformed(); // any other declaration; DOCTYPE refused before parsing
+    else if (xml.startsWith("</", position)) position = closeElement(position);
+    else position = openElement(position);
   }
 
   if (root === null || stack.length > 0) malformed();

package/packages/core/templates/crud/form.twig

@@ -3,23 +3,23 @@
 
   Override: drop your own src/templates/crud/form.twig to change how inputs render.
 
-  fields - one per input: { id, name, label, value, placeholder, required_attr,
+  fields - one per input: { id, name, label, value, placeholder, required (bool),
            and exactly ONE control flag: input (with type) | textarea | checkbox
-           (checked_attr) | select (options_html) }.
-  wrap        - render the <form> wrapper; form_id_attr/action/form_method set it
+           (checked bool) | select (options_html) }.
+  wrap        - render the <form> wrapper; form_id/action/form_method set it
   edit        - add the hidden primary-key input (edit modal)
   modal_footer- render the Cancel/Save modal buttons; submit_button - a plain Submit
 
   No inline styles or on*= handlers: the modal buttons carry data-crud-action and
   are wired by the page script's delegated listener (ADR-0088).
 #}
-{% if wrap %}<form{{ form_id_attr|raw }} action="{{ action }}" method="{{ form_method }}" class="needs-validation" data-crud-form="1">{% endif %}
+{% if wrap %}<form{% if form_id %} id="{{ form_id }}"{% endif %} action="{{ action }}" method="{{ form_method }}" class="needs-validation" data-crud-form="1">{% endif %}
 {% if method_override %}<input type="hidden" name="_method" value="{{ method_override }}">{% endif %}
 {% if edit %}<input type="hidden" id="{{ mode }}-pk-value" name="{{ pk }}">{% endif %}
 {% if modal_footer %}<div class="crud-errors" data-crud-errors hidden></div>{% endif %}
 {% for field in fields %}<div class="mb-3">
 <label for="{{ field.id }}" class="form-label">{{ field.label }}</label>
-{% if field.textarea %}<textarea class="form-control" id="{{ field.id }}" name="{{ field.name }}"{{ field.required_attr|raw }}>{{ field.value }}</textarea>{% endif %}{% if field.checkbox %}<div class="form-check"><input class="form-check-input" type="checkbox" id="{{ field.id }}" name="{{ field.name }}"{{ field.checked_attr|raw }}></div>{% endif %}{% if field.select %}<select class="form-select" id="{{ field.id }}" name="{{ field.name }}"{{ field.required_attr|raw }}>{{ field.options_html|raw }}</select>{% endif %}{% if field.input %}<input type="{{ field.type }}" class="form-control" id="{{ field.id }}" name="{{ field.name }}" value="{{ field.value }}" placeholder="{{ field.placeholder }}"{{ field.required_attr|raw }}>{% endif %}
+{% if field.textarea %}<textarea class="form-control" id="{{ field.id }}" name="{{ field.name }}"{% if field.required %} required{% endif %}>{{ field.value }}</textarea>{% endif %}{% if field.checkbox %}<div class="form-check"><input class="form-check-input" type="checkbox" id="{{ field.id }}" name="{{ field.name }}"{% if field.checked %} checked{% endif %}></div>{% endif %}{% if field.select %}<select class="form-select" id="{{ field.id }}" name="{{ field.name }}"{% if field.required %} required{% endif %}>{{ field.options_html|raw }}</select>{% endif %}{% if field.input %}<input type="{{ field.type }}" class="form-control" id="{{ field.id }}" name="{{ field.name }}" value="{{ field.value }}" placeholder="{{ field.placeholder }}"{% if field.required %} required{% endif %}>{% endif %}
 </div>
 {% endfor %}
 {% if modal_footer %}<div class="modal-footer"><button type="button" class="btn btn-secondary" data-crud-action="close" data-crud-modal="{{ mode }}">Cancel</button><button type="button" class="btn btn-primary" data-crud-action="save" data-crud-mode="{{ mode }}">Save</button></div>{% endif %}{% if submit_button %}<button type="submit" class="btn btn-primary">Submit</button>{% endif %}

package/packages/core/templates/crud/table.twig

@@ -11,7 +11,7 @@
     empty    - true when there are no rows
     colspan  - column count + 1 (for the empty row)
     editable - inline-edit table (Save/Delete); readonly - view table (Edit/Delete)
-    table_name, table_id_attr, inline_script
+    table_name, table_id, inline_script
 
   Alignment: each header/cell carries a tina4-css class (text-start for text,
   text-end for numbers). Actions is always text-end. No inline styles (ADR-0088).
@@ -20,7 +20,7 @@
   re-renders <tbody data-crud-body> over fetch() as the user searches/sorts/pages.
 #}
 <div class="table-responsive">
-<table class="table table-striped table-hover"{{ table_id_attr|raw }}>
+<table class="table table-striped table-hover"{% if table_id %} id="{{ table_id }}"{% endif %}>
 <thead class="table-dark"><tr>
 {% for header in headers %}{% if header.sortable %}<th class="{{ header.align }}"><a class="sort-link" href="{{ header.url }}" data-crud-sort="{{ header.col }}" data-crud-dir="{{ header.next_dir }}">{{ header.label }}{{ header.indicator|raw }}</a></th>{% endif %}{% if header.plain %}<th class="{{ header.align }}">{{ header.label }}</th>{% endif %}{% endfor %}<th class="text-end">Actions</th>
 </tr></thead>

package/packages/core/templates/errors/302.twig

@@ -8,15 +8,16 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 {% extends "errors/base.twig" %}
 {% block title %}Redirecting…{% endblock %}
-{% block meta %}<meta http-equiv="refresh" content="0;url={{ redirect_url }}">{% endblock %}
+{% block meta %}{% set p1 = redirect_url|slice(0,1) %}{% set p2 = redirect_url|slice(0,2) %}{% set p7 = redirect_url|slice(0,7) %}{% set p8 = redirect_url|slice(0,8) %}{% set rel = (p1 == '/') ? ((p2 == '//') ? 'no' : 'yes') : 'no' %}{% set safe_redirect_url = (rel == 'yes' or p7 == 'http://' or p8 == 'https://') ? redirect_url : '/' %}<meta http-equiv="refresh" content="0;url={{ safe_redirect_url }}">{% endblock %}
 {% block extra_styles %}
 .spinner { display: inline-block; width: 1.5rem; height: 1.5rem; border: 3px solid var(--border); border-top-color: var(--primary); border-radius: 50%; animation: spin 0.8s linear infinite; margin-bottom: 1rem; }
 @keyframes spin { to { transform: rotate(360deg); } }
 {% endblock %}
 {% block content %}
+    {% set p1 = redirect_url|slice(0,1) %}{% set p2 = redirect_url|slice(0,2) %}{% set p7 = redirect_url|slice(0,7) %}{% set p8 = redirect_url|slice(0,8) %}{% set rel = (p1 == '/') ? ((p2 == '//') ? 'no' : 'yes') : 'no' %}{% set safe_redirect_url = (rel == 'yes' or p7 == 'http://' or p8 == 'https://') ? redirect_url : '/' %}
     <div class="spinner"></div>
     <div class="error-title">Redirecting…</div>
     <div class="error-msg">You are being redirected to a new location.</div>
-    <div class="error-path c-primary">{{ redirect_url }}</div>
-    <a href="{{ redirect_url }}" class="error-home">Click here if not redirected</a>
+    <div class="error-path c-primary">{{ safe_redirect_url }}</div>
+    <a href="{{ safe_redirect_url }}" class="error-home">Click here if not redirected</a>
 {% endblock %}