tina4-nodejs 3.13.94 → 3.13.96

package/packages/core/src/request.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, IncomingHttpHeaders } from "node:http";
 import type { Tina4Request, UploadedFile } from "./types.js";
+import { resolveClientIp } from "./trustedProxy.js";
 
 /**
  * Wrap Node's `IncomingHttpHeaders` in a Proxy so mixed-case lookups
@@ -102,15 +103,11 @@ export function createRequest(req: IncomingMessage): Tina4Request {
   }
   tReq.cookies = cookies;
 
-  // Determine client IP with X-Forwarded-For support
-  const forwarded = req.headers["x-forwarded-for"];
-  if (typeof forwarded === "string") {
-    tReq.ip = forwarded.split(",")[0].trim();
-  } else if (Array.isArray(forwarded) && forwarded.length > 0) {
-    tReq.ip = forwarded[0].split(",")[0].trim();
-  } else {
-    tReq.ip = req.socket?.remoteAddress ?? "127.0.0.1";
-  }
+  // Raw socket peer — NEVER honours a forwarding header, so it can be trusted
+  // for security decisions. Resolved BEFORE .ip: the peer decides whether the
+  // forwarding headers may be believed at all (TINA4_TRUSTED_PROXIES, ADR-0019).
+  tReq.remoteIp = req.socket?.remoteAddress ?? "";
+  tReq.ip = resolveClientIp(req.headers, tReq.remoteIp) || "127.0.0.1";
 
   // Add convenience methods
   tReq.header = function (name: string): string | undefined {
@@ -163,19 +160,40 @@ async function parseBody(req: Tina4Request): Promise<void> {
   const chunks: Buffer[] = [];
 
   await new Promise<void>((resolve, reject) => {
-    req.on("data", (chunk: Buffer) => chunks.push(chunk));
-    req.on("end", resolve);
+    // A RUNNING cap, checked per chunk.
+    //
+    // The content-length check above only sees what the client DECLARES. A
+    // chunked request declares nothing, so declaredLength is 0 and it sails
+    // through. Without this counter the body is buffered in full and only
+    // then measured, which means the limit cannot prevent the thing it exists
+    // to prevent. Measured against a 1MB limit: a 40MB chunked POST with no
+    // content-length was accepted whole and grew the server's RSS by exactly
+    // 40.0MB before it was refused.
+    //
+    // Same defect as PHP's unbounded read buffer, and the same fix: stop at
+    // the limit instead of measuring the damage afterwards.
+    let received = 0;
+    let refused = false;
+    req.on("data", (chunk: Buffer) => {
+      if (refused) return;
+      received += chunk.length;
+      if (received > TINA4_MAX_UPLOAD_SIZE) {
+        refused = true;
+        chunks.length = 0; // drop what we have; the request is dead
+        reject(new PayloadTooLargeError(received, TINA4_MAX_UPLOAD_SIZE));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (!refused) resolve();
+    });
     req.on("error", reject);
   });
 
   const raw = Buffer.concat(chunks);
   if (raw.length === 0) return;
 
-  // Check actual body size against upload size limit
-  if (raw.length > TINA4_MAX_UPLOAD_SIZE) {
-    throw new PayloadTooLargeError(raw.length, TINA4_MAX_UPLOAD_SIZE);
-  }
-
   if (contentType.includes("multipart/form-data")) {
     const boundary = extractBoundary(contentType);
     if (boundary) {

package/packages/core/src/response.ts

@@ -293,11 +293,56 @@ export function createResponse(res: ServerResponse): Tina4Response {
     return response.json({ error: true, code, message, status: statusCode }, statusCode);
   };
 
-  response.file = function (filePath: string, options?: { download?: boolean; contentType?: string }): Tina4Response {
+  response.file = function (
+    filePath: string,
+    options?: { download?: boolean; contentType?: string; root?: string },
+  ): Tina4Response {
     if (res.headersSent) return response;
 
+    // SECURITY: confine the read. The natural spelling of a download route,
+    //
+    //     response.file("downloads/" + name)   // name = "../secret.env"
+    //
+    // served any file the process could read - measured over real HTTP at 200
+    // with the contents of a .env one directory above the intended one.
+    //
+    // TWO checks. Containment ALONE does not close it: that payload resolves to
+    // <project>/secret.env, which IS inside the project root, and the project
+    // root is exactly where .env lives. Rejecting ".." on the way in is the
+    // check that closes it; containment then catches absolute paths and
+    // symlinks, neither of which carries a ".." segment. Same shape as
+    // static.ts's startsWith guard, which this function never had.
+    // Containment ONLY when a root is declared. Defaulting to cwd broke every
+    // legitimate absolute path.
+    const base = options?.root ? nodePath.resolve(options.root) : null;
+    let forbidden = filePath.split(/[\\/]/).includes("..");
+
+    if (!forbidden) {
+      const candidate = (base === null || nodePath.isAbsolute(filePath)) ? filePath : nodePath.join(base, filePath);
+      let resolved = candidate;
+      try {
+        resolved = fs.realpathSync(candidate);
+      } catch {
+        /* missing file: fall through to the 404 below with the joined path */
+      }
+      if (base !== null && base !== nodePath.sep && resolved !== base && !resolved.startsWith(base + nodePath.sep)) {
+        forbidden = true;
+      } else {
+        filePath = resolved;
+      }
+    }
+
+    if (forbidden) {
+      // Refuse BEFORE reading: never load bytes we will not send.
+      res.statusCode = 403;
+      safeSetHeader("Content-Type", "text/plain");
+      safeEnd("Forbidden");
+      return response;
+    }
+
     if (!fs.existsSync(filePath)) {
       res.statusCode = 404;
+      safeSetHeader("Content-Type", "text/plain");
       safeEnd("File not found");
       return response;
     }

package/packages/core/src/router.ts

@@ -1,5 +1,6 @@
 import type { RouteHandler, RouteDefinition, RouteMeta, Middleware, MiddlewareSpec, Tina4Request, Tina4Response, WebSocketRouteHandler, WebSocketRouteDefinition } from "./types.js";
 import { isTruthy } from "./dotenv.js";
+import { MiddlewareRunner, isMiddlewareClass } from "./middleware.js";
 
 /**
  * Whether `TINA4_TRAILING_SLASH_REDIRECT` is enabled.
@@ -821,16 +822,29 @@ export async function resolveStringMiddleware(spec: string): Promise<Middleware>
 /**
  * Resolve a single route-middleware spec to a middleware function. Functions
  * pass through unchanged; strings are resolved via resolveStringMiddleware.
+ * A middleware CLASS never reaches here — runRouteMiddlewares runs it through
+ * the MiddlewareRunner instead.
  */
 async function resolveMiddlewareSpec(spec: MiddlewareSpec): Promise<Middleware> {
-  return typeof spec === "string" ? resolveStringMiddleware(spec) : spec;
+  return typeof spec === "string" ? resolveStringMiddleware(spec) : spec as Middleware;
 }
 
 /**
- * Run per-route middleware chain, then call the handler.
+ * Run the per-route middleware chain. Returns false when it short-circuited
+ * and the handler must be skipped.
  *
- * Accepts middleware functions and/or string specs (e.g. "ResponseCache:300").
- * Each spec is resolved to a middleware function just before it runs.
+ * Accepts middleware functions, middleware CLASSES, and string specs
+ * (e.g. "ResponseCache:300"). A function or string spec is resolved and
+ * invoked as `mw(req, res, next)` exactly as before.
+ *
+ * A CLASS runs its beforeX hooks through the SAME `MiddlewareRunner.runBefore`
+ * and the SAME return-value table as global middleware — no parallel runner.
+ * Its afterX hooks run with the global after pass once the handler is done
+ * (server.ts / testClient.ts append the route's classes to that list), because
+ * "after" means after the handler, not after this function. Every spec used to
+ * be invoked as `mw(req, res, next)`, which for a class throws "Class
+ * constructor cannot be invoked without 'new'", so a class attached per-route
+ * was inert. Python and PHP both ran per-route class hooks already.
  */
 export async function runRouteMiddlewares(
   middlewares: MiddlewareSpec[],
@@ -838,6 +852,17 @@ export async function runRouteMiddlewares(
   res: Tina4Response,
 ): Promise<boolean> {
   for (const spec of middlewares) {
+    if (isMiddlewareClass(spec)) {
+      // tina4: a class hook that returns a DIFFERENT [req, res] pair cannot be
+      // rebound here — this returns a bool and is public API (four of this
+      // repo's own test files import it). Node's req/res are per-request
+      // singletons, so every built-in returns the same pair back; widen the
+      // return type if that ever stops being true.
+      const [, , proceed] = await MiddlewareRunner.runBefore([spec], req, res);
+      if (!proceed || res.raw.writableEnded) return false;
+      continue;
+    }
+
     const mw = await resolveMiddlewareSpec(spec);
     let nextCalled = false;
     await mw(req, res, () => {