tina4-nodejs 3.13.97 → 3.13.99

package/packages/core/src/websocket.ts

@@ -676,13 +676,13 @@ export class WebSocketServer {
       const backlog = client.socket.writableLength ?? 0;
       const maxBacklog = parseInt(process.env.TINA4_WS_MAX_BACKLOG ?? "1048576", 10);
       if (maxBacklog > 0 && backlog > maxBacklog) {
-        Log.warn(`WebSocket client ${client.id} backlog ${backlog}B exceeds limit, dropping slow client`);
+        Log.warning(`WebSocket client ${client.id} backlog ${backlog}B exceeds limit, dropping slow client`);
         this.pruneClient(client);
         return false;
       }
       return true;
     } catch (err) {
-      Log.warn(`WebSocket send to ${client.id} failed, pruning: ${(err as Error).message}`);
+      Log.warning(`WebSocket send to ${client.id} failed, pruning: ${(err as Error).message}`);
       this.pruneClient(client);
       return false;
     }

package/packages/core/src/websocketBackplane.ts

@@ -348,7 +348,7 @@ export class WsBackplaneManager {
     // publish() is async; we fire-and-forget but still catch a rejection so a
     // dead bus can't produce an unhandled rejection that crashes the worker.
     Promise.resolve(this.backplane.publish(this.channel, JSON.stringify(envelope))).catch(
-      (err) => log?.warn(`WebSocket backplane publish failed: ${(err as Error).message}`),
+      (err) => log?.warning(`WebSocket backplane publish failed: ${(err as Error).message}`),
     );
   }
 
@@ -366,7 +366,7 @@ export class WsBackplaneManager {
 /** Minimal logger shape so the manager doesn't import the logger module. */
 export interface WsBackplaneLogger {
   info(message: string): void;
-  warn(message: string): void;
+  warning(message: string): void;
   error(message: string): void;
 }
 

package/packages/frond/dist/index.js

@@ -1,7 +1,7 @@
 // src/engine.ts
 import { createHash, createHmac, randomBytes } from "node:crypto";
-import { readFileSync, existsSync, statSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { readFileSync, existsSync, statSync, realpathSync } from "node:fs";
+import { join, resolve, isAbsolute, sep } from "node:path";
 var SafeString = class {
   constructor(value) {
     this.value = value;
@@ -441,15 +441,15 @@ function findOutsideQuotes(expr, needle) {
   }
   return -1;
 }
-function splitOutsideQuotes(expr, sep) {
-  if (!expr.includes(sep)) return [expr];
+function splitOutsideQuotes(expr, sep2) {
+  if (!expr.includes(sep2)) return [expr];
   const parts = [];
   let currentStart = 0;
   let inQuote = null;
   let depth = 0;
   let bracketDepth = 0;
   let i = 0;
-  const sepLen = sep.length;
+  const sepLen = sep2.length;
   const lastStart = expr.length - sepLen;
   while (i <= lastStart) {
     const ch = expr[i];
@@ -470,7 +470,7 @@ function splitOutsideQuotes(expr, sep) {
     else if (ch === ")") depth--;
     else if (ch === "[") bracketDepth++;
     else if (ch === "]") bracketDepth--;
-    if (depth === 0 && bracketDepth === 0 && expr.startsWith(sep, i)) {
+    if (depth === 0 && bracketDepth === 0 && expr.startsWith(sep2, i)) {
       parts.push(expr.slice(currentStart, i));
       i += sepLen;
       currentStart = i;
@@ -1101,8 +1101,8 @@ var BUILTIN_FILTERS = {
   },
   first: (v) => Array.isArray(v) ? v[0] ?? null : null,
   last: (v) => Array.isArray(v) ? v[v.length - 1] ?? null : null,
-  join: (v, sep) => Array.isArray(v) ? v.map(String).join(sep !== void 0 ? String(sep) : ", ") : String(v),
-  split: (v, sep) => String(v).split(sep !== void 0 ? String(sep) : " "),
+  join: (v, sep2) => Array.isArray(v) ? v.map(String).join(sep2 !== void 0 ? String(sep2) : ", ") : String(v),
+  split: (v, sep2) => String(v).split(sep2 !== void 0 ? String(sep2) : " "),
   replace: (v, from, to) => {
     const s = String(v);
     if (from !== void 0 && typeof from === "object" && from !== null && !Array.isArray(from)) {
@@ -1290,7 +1290,7 @@ function _b64url(data) {
 }
 var _formTokenSessionId = "";
 function _buildFormTokenJwt(descriptor = "") {
-  const secret = process.env.TINA4_SECRET || "tina4-default-secret";
+  const secret = process.env.TINA4_SECRET ?? "";
   const ttlMinutes = parseInt(process.env.TINA4_TOKEN_LIMIT || "60", 10);
   const header = { alg: "HS256", typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
@@ -1537,12 +1537,30 @@ var Frond = class _Frond {
   renderDump(value) {
     return renderDump(value).toString();
   }
+  /**
+   * Load a template's source, CONFINED under the templates directory.
+   *
+   * Every path-taking tag ({% include %}, {% extends %}, {% import %},
+   * {% from ... import %}) funnels through this one loader, so this single guard
+   * confines them all (TAG-DEC-01): a name that is absolute, climbs out with a
+   * `..` up-level segment, or resolves through a symlink to a location OUTSIDE
+   * the templates root is REFUSED -- the outside file is never read. Template
+   * -side analogue of the static-asset confinement (feature 41 / ADR-0050).
+   */
   load(name) {
+    if (isAbsolute(name) || name.split(/[\\/]/).includes("..")) {
+      throw new Error(`Template path escapes the templates directory: ${name}`);
+    }
     const filePath = join(this.templateDir, name);
-    if (!existsSync(filePath)) {
+    if (!existsSync(filePath) || !statSync(filePath).isFile()) {
       throw new Error(`Template not found: ${filePath}`);
     }
-    return readFileSync(filePath, "utf-8");
+    const root = realpathSync(this.templateDir);
+    const real = realpathSync(filePath);
+    if (real !== root && !real.startsWith(root + sep)) {
+      throw new Error(`Template path escapes the templates directory: ${name}`);
+    }
+    return readFileSync(real, "utf-8");
   }
   /** Execute pre-tokenized template against context. */
   executeCached(tokens, context) {
@@ -2309,9 +2327,9 @@ var Frond = class _Frond {
     let source;
     try {
       source = this.load(filename);
-    } catch {
+    } catch (err) {
       if (ignoreMissing) return "";
-      throw new Error(`Template not found: ${join(this.templateDir, filename)}`);
+      throw err;
     }
     const incContext = { ...context };
     if (withExpr) {

package/packages/frond/src/engine.ts

@@ -5,8 +5,8 @@
  * extends/block, include, macro, set, comments, whitespace control, tests.
  */
 import { createHash, createHmac, randomBytes } from "node:crypto";
-import { readFileSync, existsSync, statSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { readFileSync, existsSync, statSync, realpathSync } from "node:fs";
+import { join, resolve, isAbsolute, sep } from "node:path";
 
 // ── Types ──────────────────────────────────────────────────────
 
@@ -1587,7 +1587,14 @@ export function setFormTokenSessionId(sessionId: string): void {
 }
 
 function _buildFormTokenJwt(descriptor: string = ""): string {
-  const secret = process.env.TINA4_SECRET || "tina4-default-secret";
+  // Fail-closed, IDENTICAL to the validator (auth.ts validToken:
+  // `secret ?? process.env.TINA4_SECRET ?? ""`). With TINA4_SECRET unset the
+  // signing secret resolves to BLANK — there is NO built-in default. Signing
+  // with the retired public 'tina4-default-secret' made the generator disagree
+  // with the fail-closed validator: a legitimately-rendered token was rejected
+  // AND a ''-forged token was accepted (CSRF-NODE-SECRET-SPLIT, feature 37).
+  // The generator and the validator MUST resolve the same secret.
+  const secret = process.env.TINA4_SECRET ?? "";
   const ttlMinutes = parseInt(process.env.TINA4_TOKEN_LIMIT || "60", 10);
 
   const header = { alg: "HS256", typ: "JWT" };
@@ -1889,12 +1896,34 @@ export class Frond {
     return renderDump(value).toString();
   }
 
+  /**
+   * Load a template's source, CONFINED under the templates directory.
+   *
+   * Every path-taking tag ({% include %}, {% extends %}, {% import %},
+   * {% from ... import %}) funnels through this one loader, so this single guard
+   * confines them all (TAG-DEC-01): a name that is absolute, climbs out with a
+   * `..` up-level segment, or resolves through a symlink to a location OUTSIDE
+   * the templates root is REFUSED -- the outside file is never read. Template
+   * -side analogue of the static-asset confinement (feature 41 / ADR-0050).
+   */
   private load(name: string): string {
+    // Lexical belt: refuse an absolute path or a `..` up-level segment before
+    // touching the filesystem (defense in depth in front of the realpath check).
+    if (isAbsolute(name) || name.split(/[\\/]/).includes("..")) {
+      throw new Error(`Template path escapes the templates directory: ${name}`);
+    }
     const filePath = join(this.templateDir, name);
-    if (!existsSync(filePath)) {
+    if (!existsSync(filePath) || !statSync(filePath).isFile()) {
       throw new Error(`Template not found: ${filePath}`);
     }
-    return readFileSync(filePath, "utf-8");
+    // Realpath containment: a symlink INSIDE the templates dir whose target
+    // resolves OUTSIDE it is refused (the lexical belt cannot see a symlink).
+    const root = realpathSync(this.templateDir);
+    const real = realpathSync(filePath);
+    if (real !== root && !real.startsWith(root + sep)) {
+      throw new Error(`Template path escapes the templates directory: ${name}`);
+    }
+    return readFileSync(real, "utf-8");
   }
 
   /** Execute pre-tokenized template against context. */
@@ -2784,9 +2813,12 @@ export class Frond {
     let source: string;
     try {
       source = this.load(filename);
-    } catch {
+    } catch (err) {
+      // A genuinely missing optional include is silenced; an escape/other error
+      // is re-thrown with its own message (so a confinement refusal is loud, not
+      // masked as "not found").
       if (ignoreMissing) return "";
-      throw new Error(`Template not found: ${join(this.templateDir, filename)}`);
+      throw err;
     }
 
     const incContext = { ...context };