tina4-nodejs 3.13.94 → 3.13.95

package/packages/core/src/response.ts

@@ -293,11 +293,56 @@ export function createResponse(res: ServerResponse): Tina4Response {
     return response.json({ error: true, code, message, status: statusCode }, statusCode);
   };
 
-  response.file = function (filePath: string, options?: { download?: boolean; contentType?: string }): Tina4Response {
+  response.file = function (
+    filePath: string,
+    options?: { download?: boolean; contentType?: string; root?: string },
+  ): Tina4Response {
     if (res.headersSent) return response;
 
+    // SECURITY: confine the read. The natural spelling of a download route,
+    //
+    //     response.file("downloads/" + name)   // name = "../secret.env"
+    //
+    // served any file the process could read - measured over real HTTP at 200
+    // with the contents of a .env one directory above the intended one.
+    //
+    // TWO checks. Containment ALONE does not close it: that payload resolves to
+    // <project>/secret.env, which IS inside the project root, and the project
+    // root is exactly where .env lives. Rejecting ".." on the way in is the
+    // check that closes it; containment then catches absolute paths and
+    // symlinks, neither of which carries a ".." segment. Same shape as
+    // static.ts's startsWith guard, which this function never had.
+    // Containment ONLY when a root is declared. Defaulting to cwd broke every
+    // legitimate absolute path.
+    const base = options?.root ? nodePath.resolve(options.root) : null;
+    let forbidden = filePath.split(/[\\/]/).includes("..");
+
+    if (!forbidden) {
+      const candidate = (base === null || nodePath.isAbsolute(filePath)) ? filePath : nodePath.join(base, filePath);
+      let resolved = candidate;
+      try {
+        resolved = fs.realpathSync(candidate);
+      } catch {
+        /* missing file: fall through to the 404 below with the joined path */
+      }
+      if (base !== null && base !== nodePath.sep && resolved !== base && !resolved.startsWith(base + nodePath.sep)) {
+        forbidden = true;
+      } else {
+        filePath = resolved;
+      }
+    }
+
+    if (forbidden) {
+      // Refuse BEFORE reading: never load bytes we will not send.
+      res.statusCode = 403;
+      safeSetHeader("Content-Type", "text/plain");
+      safeEnd("Forbidden");
+      return response;
+    }
+
     if (!fs.existsSync(filePath)) {
       res.statusCode = 404;
+      safeSetHeader("Content-Type", "text/plain");
       safeEnd("File not found");
       return response;
     }

package/packages/core/src/router.ts

@@ -1,5 +1,6 @@
 import type { RouteHandler, RouteDefinition, RouteMeta, Middleware, MiddlewareSpec, Tina4Request, Tina4Response, WebSocketRouteHandler, WebSocketRouteDefinition } from "./types.js";
 import { isTruthy } from "./dotenv.js";
+import { MiddlewareRunner, isMiddlewareClass } from "./middleware.js";
 
 /**
  * Whether `TINA4_TRAILING_SLASH_REDIRECT` is enabled.
@@ -821,16 +822,29 @@ export async function resolveStringMiddleware(spec: string): Promise<Middleware>
 /**
  * Resolve a single route-middleware spec to a middleware function. Functions
  * pass through unchanged; strings are resolved via resolveStringMiddleware.
+ * A middleware CLASS never reaches here — runRouteMiddlewares runs it through
+ * the MiddlewareRunner instead.
  */
 async function resolveMiddlewareSpec(spec: MiddlewareSpec): Promise<Middleware> {
-  return typeof spec === "string" ? resolveStringMiddleware(spec) : spec;
+  return typeof spec === "string" ? resolveStringMiddleware(spec) : spec as Middleware;
 }
 
 /**
- * Run per-route middleware chain, then call the handler.
+ * Run the per-route middleware chain. Returns false when it short-circuited
+ * and the handler must be skipped.
  *
- * Accepts middleware functions and/or string specs (e.g. "ResponseCache:300").
- * Each spec is resolved to a middleware function just before it runs.
+ * Accepts middleware functions, middleware CLASSES, and string specs
+ * (e.g. "ResponseCache:300"). A function or string spec is resolved and
+ * invoked as `mw(req, res, next)` exactly as before.
+ *
+ * A CLASS runs its beforeX hooks through the SAME `MiddlewareRunner.runBefore`
+ * and the SAME return-value table as global middleware — no parallel runner.
+ * Its afterX hooks run with the global after pass once the handler is done
+ * (server.ts / testClient.ts append the route's classes to that list), because
+ * "after" means after the handler, not after this function. Every spec used to
+ * be invoked as `mw(req, res, next)`, which for a class throws "Class
+ * constructor cannot be invoked without 'new'", so a class attached per-route
+ * was inert. Python and PHP both ran per-route class hooks already.
  */
 export async function runRouteMiddlewares(
   middlewares: MiddlewareSpec[],
@@ -838,6 +852,17 @@ export async function runRouteMiddlewares(
   res: Tina4Response,
 ): Promise<boolean> {
   for (const spec of middlewares) {
+    if (isMiddlewareClass(spec)) {
+      // tina4: a class hook that returns a DIFFERENT [req, res] pair cannot be
+      // rebound here — this returns a bool and is public API (four of this
+      // repo's own test files import it). Node's req/res are per-request
+      // singletons, so every built-in returns the same pair back; widen the
+      // return type if that ever stops being true.
+      const [, , proceed] = await MiddlewareRunner.runBefore([spec], req, res);
+      if (!proceed || res.raw.writableEnded) return false;
+      continue;
+    }
+
     const mw = await resolveMiddlewareSpec(spec);
     let nextCalled = false;
     await mw(req, res, () => {