tina4-nodejs 3.13.91 → 3.13.94

package/packages/core/src/sessionHandlers/childError.ts

@@ -0,0 +1,72 @@
+/**
+ * Tina4 session handlers — turn a failed `execFileSync` child into a readable cause.
+ *
+ * The session-handler interface is synchronous but every backend client is async,
+ * so each command runs in a short-lived `node -e` child. When that child fails,
+ * `execFileSync` throws an error whose `.message` begins "Command failed:" and
+ * then embeds THE ENTIRE GENERATED SCRIPT — kilobytes of source with the real
+ * reason nowhere in it. Every handler used to throw exactly that, so an
+ * operator debugging a Redis outage got a wall of JavaScript instead of
+ * "connect ECONNREFUSED 127.0.0.1:6379".
+ *
+ * The children already write the real reason to stderr; `execFileSync` captures
+ * it on `err.stderr`. This module is the ONE place that prefers it, so the three
+ * call sites (respClient, mongoClient, redisHandler's npm path) cannot drift.
+ */
+
+/** Longest fallback we will pass through when there is no usable stderr. */
+const MAX_FALLBACK = 200;
+
+/**
+ * Extract the most useful one-line cause from a thrown `execFileSync` error.
+ *
+ * Order of preference:
+ *  1. the child's own stderr — what it actually reported;
+ *  2. a timeout, named as such (a SIGTERM kill leaves stderr empty, so without
+ *     this the caller would see the useless generic message);
+ *  3. a non-zero exit code with no output at all;
+ *  4. the error's own message, first line only and length-capped, so the
+ *     generated script can never be dumped into a log.
+ */
+export function childFailureReason(err: unknown): string {
+  const e = (err ?? {}) as {
+    stderr?: Buffer | string;
+    message?: string;
+    signal?: string | null;
+    status?: number | null;
+    code?: string;
+  };
+
+  const stderr = String(e.stderr ?? "").trim();
+  if (stderr !== "") {
+    return firstLine(stderr);
+  }
+
+  // execFileSync's `timeout` option kills the child with a signal, so it exits
+  // with NOTHING on stderr. Say "timed out" rather than "Command failed".
+  if (e.code === "ETIMEDOUT" || e.signal) {
+    return `timed out or was killed (${e.code ?? e.signal})`;
+  }
+
+  if (typeof e.status === "number" && e.status !== 0) {
+    return `child exited with code ${e.status} and no output`;
+  }
+
+  return firstLine(String(e.message ?? "unknown error"));
+}
+
+/** First line of `text`, capped at MAX_FALLBACK characters. */
+function firstLine(text: string): string {
+  const line = text.split("\n", 1)[0] ?? "";
+  return line.length > MAX_FALLBACK ? `${line.slice(0, MAX_FALLBACK)}...` : line;
+}
+
+/**
+ * Build the Error a session handler throws when its child command failed.
+ *
+ * `label` names the backend ("Redis", "Valkey", "MongoDB") so the message says
+ * which one broke; the wording is shared so all three read alike.
+ */
+export function childFailureError(label: string, err: unknown): Error {
+  return new Error(`${label} command failed: ${childFailureReason(err)}`);
+}

package/packages/core/src/sessionHandlers/mongoClient.ts

@@ -22,6 +22,7 @@
  * writes).
  */
 import { execFileSync } from "node:child_process";
+import { childFailureError } from "./childError.js";
 
 export interface MongoTarget {
   host: string;
@@ -90,8 +91,10 @@ export function mongoCommandSync(
           process.stdout.write(out, () => process.exit(0));
         } catch (err) {
           try { if (client) await client.close(); } catch (e) {}
-          process.stderr.write(String((err && err.message) || err));
-          process.exit(1);
+          // Exit from the write CALLBACK: stderr to a pipe is an async write and
+          // a bare process.exit() truncates it, which left the parent with an
+          // empty stderr and nothing but execFileSync's script-dump message.
+          process.stderr.write(String((err && err.message) || err), () => process.exit(1));
         }
       })();
     } else {
@@ -233,6 +236,9 @@ export function mongoCommandSync(
       stdio: ["pipe", "pipe", "pipe"],
     });
   } catch (err) {
-    throw new Error(`${label} command failed: ${(err as Error).message}`);
+    // The child's stderr carries the real reason (connection refused, auth
+    // failure, timeout); execFileSync's message carries the whole generated
+    // script. Prefer the former.
+    throw childFailureError(label, err);
   }
 }

package/packages/core/src/sessionHandlers/redisHandler.ts

@@ -17,6 +17,7 @@
  *   TINA4_SESSION_REDIS_DB       (default: 0)
  */
 import { execFileSync } from "node:child_process";
+import { childFailureError } from "./childError.js";
 import { createRequire } from "node:module";
 import type { SessionHandler } from "../session.js";
 import { respCommandSync } from "./respClient.js";
@@ -142,9 +143,17 @@ export class RedisNpmSessionHandler implements SessionHandler {
       (async () => {
         try {
           const redis = require("redis");
+          // reconnectStrategy: false — this child runs ONE command and exits, so
+          // retrying inside it is pointless: the handler is called again on the
+          // next request anyway. With the driver's default strategy a refused
+          // connection never rejects, the child hangs until execFileSync's 5s
+          // timeout kills it, and the caller is told "timed out" when the truth
+          // is "connection refused". Off, connect() rejects in ~5ms with the real
+          // reason -- a better message AND no 5s stall per request when Redis is
+          // down.
           const clientOpts = useUrl
-            ? { url }
-            : { socket: { host, port }, password: password || undefined, database: db };
+            ? { url, socket: { reconnectStrategy: false } }
+            : { socket: { host, port, reconnectStrategy: false }, password: password || undefined, database: db };
           const client = redis.createClient(clientOpts);
           client.on("error", () => {});
           await client.connect();
@@ -158,8 +167,10 @@ export class RedisNpmSessionHandler implements SessionHandler {
           const out = (result === null || result === undefined) ? "__NULL__" : String(result);
           process.stdout.write(out, () => process.exit(0));
         } catch (err) {
-          process.stderr.write(String((err && err.message) || err));
-          process.exit(1);
+          // Exit from the write CALLBACK: stderr to a pipe is an async write and
+          // a bare process.exit() truncates it, which left the parent with an
+          // empty stderr and nothing but execFileSync's script-dump message.
+          process.stderr.write(String((err && err.message) || err), () => process.exit(1));
         }
       })();
     `;
@@ -171,7 +182,9 @@ export class RedisNpmSessionHandler implements SessionHandler {
         stdio: ["pipe", "pipe", "pipe"],
       });
     } catch (err) {
-      throw new Error(`Redis command failed: ${(err as Error).message}`);
+      // The child's stderr carries the driver's real reason; execFileSync's
+      // message carries the whole generated script. Prefer the former.
+      throw childFailureError("Redis", err);
     }
     if (result === "__NULL__") return "";       // genuine key miss
     return result;

package/packages/core/src/sessionHandlers/respClient.ts

@@ -16,6 +16,7 @@
  * then returns the LAST (command) reply.
  */
 import { execFileSync } from "node:child_process";
+import { childFailureError } from "./childError.js";
 
 export interface RespTarget {
   host: string;
@@ -161,7 +162,10 @@ export function respCommandSync(target: RespTarget, args: string[], label = "Red
     // Non-zero exit = socket error / timeout / closed connection: a transport
     // FAILURE, not a key miss. Surface it so the Session boundary logs + degrades
     // (or re-throws under strict mode).
-    throw new Error(`${label} command failed: ${(err as Error).message}`);
+    //
+    // Report the CHILD's stderr, not execFileSync's message -- that message
+    // embeds the whole generated script and buries the actual reason.
+    throw childFailureError(label, err);
   }
   if (result === "__NULL__") return "";       // genuine key miss
   if (result.startsWith("__ERR__")) {

package/packages/frond/dist/index.js

@@ -41,6 +41,29 @@ var TERMINATOR_TAGS = /* @__PURE__ */ new Set([
   "endset",
   "endspaceless"
 ]);
+var GATEABLE_TAGS = /* @__PURE__ */ new Set([
+  "autoescape",
+  "cache",
+  "for",
+  "from",
+  "if",
+  "import",
+  "include",
+  "live",
+  "macro",
+  "set",
+  "spaceless"
+]);
+var BLOCK_TAG_ENDS = {
+  autoescape: "endautoescape",
+  cache: "endcache",
+  for: "endfor",
+  if: "endif",
+  live: "endlive",
+  macro: "endmacro",
+  set: "endset",
+  spaceless: "endspaceless"
+};
 function jsonText(value) {
   try {
     const text = JSON.stringify(value);
@@ -1680,42 +1703,27 @@ var Frond = class _Frond {
         if (stripA && i + 1 < tokens.length && tokens[i + 1][0] === "TEXT") {
           tokens[i + 1] = ["TEXT", tokens[i + 1][1].replace(LEADING_WS_RE, "")];
         }
-        if (tag === "if") {
-          if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("if")) {
-            const skip = this.skipBlock(tokens, i, "if", "endif");
-            i = skip;
-          } else {
-            const [result, skip] = this.handleIf(tokens, i, context);
-            output.push(result);
-            i = skip;
-          }
+        if (!this.tagPermitted(tag)) {
+          i = this.skipDeniedTag(tokens, i, tag, content);
+        } else if (tag === "if") {
+          const [result, skip] = this.handleIf(tokens, i, context);
+          output.push(result);
+          i = skip;
         } else if (tag === "for") {
-          if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("for")) {
-            const skip = this.skipBlock(tokens, i, "for", "endfor");
-            i = skip;
-          } else {
-            const [result, skip] = this.handleFor(tokens, i, context);
-            output.push(result);
-            i = skip;
-          }
+          const [result, skip] = this.handleFor(tokens, i, context);
+          output.push(result);
+          i = skip;
         } else if (tag === "set") {
-          const isBlockSet = !content.includes("=");
-          if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("set")) {
-            i = isBlockSet ? this.skipBlock(tokens, i, "set", "endset") : i + 1;
-          } else if (isBlockSet) {
+          if (!content.includes("=")) {
             i = this.handleSetBlock(tokens, i, context);
           } else {
             this.handleSet(content, context);
             i++;
           }
         } else if (tag === "include") {
-          if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("include")) {
-            i++;
-          } else {
-            const result = this.handleInclude(content, context);
-            output.push(result);
-            i++;
-          }
+          const result = this.handleInclude(content, context);
+          output.push(result);
+          i++;
         } else if (tag === "macro") {
           const skip = this.handleMacro(tokens, i, context);
           i = skip;
@@ -1760,6 +1768,41 @@ var Frond = class _Frond {
     }
     return output.join("");
   }
+  /**
+   * May this filter RUN under the current sandbox?
+   *
+   * The escaping decision has to ask this rather than read the filter name out of
+   * the source. Node carries safety as a FLAG rather than as a value-level marker
+   * (Python and Ruby return a SafeString, PHP prepends a RAW_MARKER -- all three
+   * produced only by actually running the filter), so here the name alone was
+   * enough to suppress auto-escaping even when the filter was denied and skipped.
+   */
+  filterPermitted(name) {
+    if (!this._sandbox || this._allowedFilters === null) return true;
+    return this._allowedFilters.has(name);
+  }
+  /**
+   * May this tag run under the current sandbox?
+   *
+   * One gate for every tag, so the allow-list governs the whole tag vocabulary
+   * instead of the four names that happened to be checked individually.
+   */
+  tagPermitted(tag) {
+    if (!this._sandbox || this._allowedTags === null) return true;
+    if (!GATEABLE_TAGS.has(tag)) return true;
+    return this._allowedTags.has(tag);
+  }
+  /**
+   * Consume a denied tag WITHOUT running it, returning the index past its body.
+   *
+   * Advancing a single token past a body-owning tag would leave the body's tokens
+   * to render at the TOP level, leaking exactly the content the sandbox denied.
+   */
+  skipDeniedTag(tokens, start, tag, content) {
+    const closeTag = BLOCK_TAG_ENDS[tag];
+    if (closeTag === void 0 || tag === "set" && content.includes("=")) return start + 1;
+    return this.skipBlock(tokens, start, tag, closeTag);
+  }
   skipBlock(tokens, start, openTag, closeTag) {
     let depth = 0;
     let i = start + 1;
@@ -1767,7 +1810,7 @@ var Frond = class _Frond {
       if (tokens[i][0] === "BLOCK") {
         const [content] = stripTag(tokens[i][1]);
         const tag = content.split(/\s+/)[0] || "";
-        if (tag === openTag) depth++;
+        if (tag === openTag && !(openTag === "set" && content.includes("="))) depth++;
         else if (tag === closeTag) {
           if (depth === 0) return i + 1;
           depth--;
@@ -1952,11 +1995,11 @@ var Frond = class _Frond {
     for (const [fname, rawArgs] of filters) {
       const args = rawArgs.map((a) => a instanceof VarRef ? evalExpr(a.name, context) : a);
       if (fname === "raw" || fname === "safe") {
-        isSafe = true;
+        if (this.filterPermitted(fname)) isSafe = true;
         continue;
       }
       if (fname === "escape" || fname === "e") {
-        isSafe = true;
+        if (this.filterPermitted(fname)) isSafe = true;
       }
       if (this._sandbox && this._allowedFilters !== null) {
         if (!this._allowedFilters.has(fname)) {

package/packages/frond/src/engine.ts

@@ -59,6 +59,35 @@ const TERMINATOR_TAGS = new Set([
   "endif", "endlive", "endmacro", "endraw", "endset", "endspaceless",
 ]);
 
+/**
+ * Author-written tags the sandbox allow-list governs. Mirrors Python's
+ * _GATEABLE_TAGS, PHP's GATEABLE_TAGS and Ruby's GATEABLE_TAGS. A tag absent from
+ * this set is structural, not an author capability, and is never gated -- `block`
+ * and `extends` are template inheritance, and `raw` is consumed by the tokenizer.
+ * Both spellings of set ({% set x = 1 %} and {% set x %}...{% endset %}) dispatch
+ * under "set", so one entry covers the pair.
+ */
+const GATEABLE_TAGS = new Set([
+  "autoescape", "cache", "for", "from", "if", "import", "include", "live",
+  "macro", "set", "spaceless",
+]);
+
+/**
+ * Gateable tags that OWN A BODY, mapped to the terminator closing it. A denied tag
+ * has to consume its body or the body's tokens render at the top level, leaking
+ * exactly the content the sandbox denied.
+ */
+const BLOCK_TAG_ENDS: Record<string, string> = {
+  autoescape: "endautoescape",
+  cache: "endcache",
+  for: "endfor",
+  if: "endif",
+  live: "endlive",
+  macro: "endmacro",
+  set: "endset",
+  spaceless: "endspaceless",
+};
+
 /**
  * Serialize a value to compact JSON text that is always valid JSON.
  *
@@ -2082,48 +2111,36 @@ export class Frond {
           tokens[i + 1] = ["TEXT", tokens[i + 1][1].replace(LEADING_WS_RE, "")];
         }
 
-        if (tag === "if") {
-          // Sandbox check
-          if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("if")) {
-            const skip = this.skipBlock(tokens, i, "if", "endif");
-            i = skip;
-          } else {
-            const [result, skip] = this.handleIf(tokens, i, context);
-            output.push(result);
-            i = skip;
-          }
+        if (!this.tagPermitted(tag)) {
+          // ONE sandbox gate for the whole tag vocabulary. Previously only if, for,
+          // set and include were checked, so every other tag ignored the allow-list
+          // -- {% autoescape false %} could switch escaping off from inside a
+          // sandbox whose tags were restricted to something else entirely.
+          i = this.skipDeniedTag(tokens, i, tag, content);
+        } else if (tag === "if") {
+          const [result, skip] = this.handleIf(tokens, i, context);
+          output.push(result);
+          i = skip;
         } else if (tag === "for") {
-          if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("for")) {
-            const skip = this.skipBlock(tokens, i, "for", "endfor");
-            i = skip;
-          } else {
-            const [result, skip] = this.handleFor(tokens, i, context);
-            output.push(result);
-            i = skip;
-          }
+          const [result, skip] = this.handleFor(tokens, i, context);
+          output.push(result);
+          i = skip;
         } else if (tag === "set") {
           // An assignment has an "="; without one this is the BLOCK form,
           // {% set name %}...{% endset %}, which captures its rendered body. A
           // bare includes() is exact here, not a shortcut: the block form's tag
           // content is only ever "set <name>", so an "=" anywhere -- even inside
           // a quoted value like {% set m = "a = b" %} -- means assignment.
-          const isBlockSet = !content.includes("=");
-          if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("set")) {
-            i = isBlockSet ? this.skipBlock(tokens, i, "set", "endset") : i + 1;
-          } else if (isBlockSet) {
+          if (!content.includes("=")) {
             i = this.handleSetBlock(tokens, i, context);
           } else {
             this.handleSet(content, context);
             i++;
           }
         } else if (tag === "include") {
-          if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("include")) {
-            i++;
-          } else {
-            const result = this.handleInclude(content, context);
-            output.push(result);
-            i++;
-          }
+          const result = this.handleInclude(content, context);
+          output.push(result);
+          i++;
         } else if (tag === "macro") {
           const skip = this.handleMacro(tokens, i, context);
           i = skip;
@@ -2176,6 +2193,46 @@ export class Frond {
     return output.join("");
   }
 
+  /**
+   * May this filter RUN under the current sandbox?
+   *
+   * The escaping decision has to ask this rather than read the filter name out of
+   * the source. Node carries safety as a FLAG rather than as a value-level marker
+   * (Python and Ruby return a SafeString, PHP prepends a RAW_MARKER -- all three
+   * produced only by actually running the filter), so here the name alone was
+   * enough to suppress auto-escaping even when the filter was denied and skipped.
+   */
+  private filterPermitted(name: string): boolean {
+    if (!this._sandbox || this._allowedFilters === null) return true;
+    return this._allowedFilters.has(name);
+  }
+
+  /**
+   * May this tag run under the current sandbox?
+   *
+   * One gate for every tag, so the allow-list governs the whole tag vocabulary
+   * instead of the four names that happened to be checked individually.
+   */
+  private tagPermitted(tag: string): boolean {
+    if (!this._sandbox || this._allowedTags === null) return true;
+    if (!GATEABLE_TAGS.has(tag)) return true; // structural, not an author capability
+    return this._allowedTags.has(tag);
+  }
+
+  /**
+   * Consume a denied tag WITHOUT running it, returning the index past its body.
+   *
+   * Advancing a single token past a body-owning tag would leave the body's tokens
+   * to render at the TOP level, leaking exactly the content the sandbox denied.
+   */
+  private skipDeniedTag(tokens: Token[], start: number, tag: string, content: string): number {
+    const closeTag = BLOCK_TAG_ENDS[tag];
+    // {% set x = 1 %} is an assignment and owns no body; {% set x %}...{% endset %}
+    // captures one. Same exact-"=" test the dispatch uses.
+    if (closeTag === undefined || (tag === "set" && content.includes("="))) return start + 1;
+    return this.skipBlock(tokens, start, tag, closeTag);
+  }
+
   private skipBlock(tokens: Token[], start: number, openTag: string, closeTag: string): number {
     let depth = 0;
     let i = start + 1;
@@ -2183,7 +2240,9 @@ export class Frond {
       if (tokens[i][0] === "BLOCK") {
         const [content] = stripTag(tokens[i][1]);
         const tag = content.split(/\s+/)[0] || "";
-        if (tag === openTag) depth++;
+        // A nested assignment-form set opens no body, so it must not nest -- counting
+        // it would consume past the real {% endset %} and swallow trailing content.
+        if (tag === openTag && !(openTag === "set" && content.includes("="))) depth++;
         else if (tag === closeTag) {
           if (depth === 0) return i + 1;
           depth--;
@@ -2388,12 +2447,19 @@ export class Frond {
     for (const [fname, rawArgs] of filters) {
       const args = rawArgs.map((a) => (a instanceof VarRef ? evalExpr(a.name, context) : a));
       if (fname === "raw" || fname === "safe") {
-        isSafe = true;
+        // Decide from what was permitted to RUN, not from what the source asked
+        // for. Marking the value safe here regardless meant a DENIED raw produced
+        // byte-identical output to an allowed one -- the allow-list entry that
+        // governs XSS escaping did nothing at all.
+        if (this.filterPermitted(fname)) isSafe = true;
         continue;
       }
-      // escape/e filter marks output as safe (already escaped)
+      // escape/e filter marks output as safe (already escaped) -- but ONLY when it
+      // is permitted to run. Node's escape returns a plain string, so this flag is
+      // what suppresses auto-escaping; setting it for a DENIED escape emitted the
+      // value unescaped, having never escaped it.
       if (fname === "escape" || fname === "e") {
-        isSafe = true;
+        if (this.filterPermitted(fname)) isSafe = true;
       }
 
       // Sandbox: check filter access