tina4-python 0.2.194__tar.gz → 0.2.197__tar.gz

{tina4_python-0.2.194 → tina4_python-0.2.197}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 0.2.194
+Version: 0.2.197
 Summary: Tina4Python - This is not another framework for Python
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 Requires-Python: <4.0,>=3.12

{tina4_python-0.2.194 → tina4_python-0.2.197}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "0.2.194"
+version = "0.2.197"
 description = "Tina4Python - This is not another framework for Python"
 authors = [
     {name = "Andre van Zuydam",email = "andrevanzuydam@gmail.com"}
@@ -32,6 +32,7 @@ dev = [
     "pydoc-markdown>=4.8.2",
     "pytest>=8.3.5",
     "pytest-asyncio>=1.3.0",
+    "pytest-cov>=7.0.0",
     "python-keycloak>=5.8.1",
     "ruff>=0.11.9",
     "safety>=3.5.0",

{tina4_python-0.2.194 → tina4_python-0.2.197}/tina4_python/Response.py

@@ -124,7 +124,9 @@ class Response:
         :param redirect_url:
         :return:
         """
-        headers = {"Location": redirect_url}
+        # Strip CR/LF to prevent HTTP response splitting (header injection)
+        safe_url = redirect_url.replace("\r", "").replace("\n", "")
+        headers = {"Location": safe_url}
         from tina4_python import Messages
         return Response(Messages.MSG_REDIRECTING, http_code_in, Constant.TEXT_HTML, headers)
 
@@ -193,16 +195,21 @@ class Response:
     @staticmethod
     def add_header(key, value):
         """
-        Adds a header for the response (concurrency-safe via contextvars)
+        Adds a header for the response (concurrency-safe via contextvars).
+        CR/LF characters are stripped from both key and value to prevent
+        HTTP response splitting.
         :param key:
         :param value:
         :return:
         """
+        # Sanitise to prevent header injection
+        safe_key = str(key).replace("\r", "").replace("\n", "")
+        safe_value = str(value).replace("\r", "").replace("\n", "")
         h = _pending_headers.get()
         if h is None:
             h = {}
             _pending_headers.set(h)
-        h[key] = value
+        h[safe_key] = safe_value
 
     @staticmethod
     def wsdl(wsdl_instance):

{tina4_python-0.2.194 → tina4_python-0.2.197}/tina4_python/Router.py

@@ -373,6 +373,7 @@ class Router:
                 token = headers["authorization"].replace("Bearer", "").strip()
                 if tina4_python.tina4_auth.valid(token):
                     validated = True
+                    has_form_token = True
 
             if request["params"] is not None and "formToken" in request["params"]:
                 token = request["params"]["formToken"]
@@ -528,15 +529,17 @@ class Router:
                             result.headers["FreshToken"] = tina4_python.tina4_auth.get_token({"path": url})
                         if "cache" in route and route["cache"] is not None:
                             if not route["cache"]["cached"]:
-                                result.headers["Cache-Control"] = "max-age=1, must-revalidate"
+                                result.headers["Cache-Control"] = "no-store, no-cache, must-revalidate"
                                 result.headers["Pragma"] = "no-cache"
                             else:
                                 result.headers["Cache-Control"] = "max-age=" + str(
                                     route["cache"]["max_age"]) + ", must-revalidate"
                                 result.headers["Pragma"] = "cache"
                         else:
-                            result.headers["Cache-Control"] = "max-age=-1, must-revalidate"
-                            result.headers["Pragma"] = "cache"
+                            # Default: don't cache — prevents sensitive data leaking
+                            # via shared proxies or browser disk cache
+                            result.headers["Cache-Control"] = "no-store, no-cache, must-revalidate"
+                            result.headers["Pragma"] = "no-cache"
                 finally:
                     sys.stdout = old_stdout
 
@@ -572,7 +575,7 @@ class Router:
                                 )
 
                     twig_headers = {
-                        "Cache-Control": "max-age=-1, public",
+                        "Cache-Control": "no-store, no-cache, must-revalidate",
                         "Pragma": "no-cache"
                     }
                     if has_form_token:

{tina4_python-0.2.194 → tina4_python-0.2.197}/tina4_python/Session.py

@@ -745,10 +745,15 @@ class LazySession:
         self._activate().session_hash = value
 
     def start(self, session_hash=None):
-        return self._activate().start(session_hash)
+        result = self._activate().start(session_hash)
+        # Keep cookie dict in sync with the (possibly new) session hash
+        self._cookies[self._name] = result
+        return result
 
     def load(self, session_hash):
-        return self._activate().load(session_hash)
+        self._activate().load(session_hash)
+        # Keep cookie dict in sync with loaded session hash
+        self._cookies[self._name] = self._real.session_hash
 
     def set(self, key, value):
         return self._activate().set(key, value)

{tina4_python-0.2.194 → tina4_python-0.2.197}/tina4_python/Webserver.py

@@ -239,22 +239,33 @@ class Webserver:
 
     async def send_basic_headers(self, headers_list: list):
         """
-        Add permissive CORS and keep-alive headers (used for most responses).
+        Add CORS, keep-alive, and security headers (used for most responses).
 
         Args:
             headers_list (list): List to which headers are appended.
         """
-        self.send_header("Access-Control-Allow-Origin", "*", headers_list)
+        # CORS — reflect the request Origin when credentials are needed,
+        # otherwise fall back to * for simple cross-origin requests.
+        origin = self.lowercase_headers.get("origin", "")
+        if origin:
+            self.send_header("Access-Control-Allow-Origin", origin, headers_list)
+            self.send_header("Access-Control-Allow-Credentials", "true", headers_list)
+        else:
+            self.send_header("Access-Control-Allow-Origin", "*", headers_list)
+
         self.send_header(
             "Access-Control-Allow-Headers",
             "Origin, X-Requested-With, Content-Type, Accept, Authorization",
             headers_list,
         )
-        self.send_header("Access-Control-Allow-Credentials", "true", headers_list)
         self.send_header("Connection", "Keep-Alive", headers_list)
         self.send_header("Keep-Alive", "timeout=5, max=30", headers_list)
         self.send_header("Timing-Allow-Origin", "*", headers_list)
 
+        # Security headers
+        self.send_header("X-Content-Type-Options", "nosniff", headers_list)
+        self.send_header("X-Frame-Options", "SAMEORIGIN", headers_list)
+
     @staticmethod
     async def get_headers(header_lines: list, protocol: str, status_code: int) -> bytes:
         """
@@ -307,14 +318,19 @@ class Webserver:
         # ------------------------------------------------------------------
         if method == "OPTIONS":
             headers = []
-            self.send_header("Access-Control-Allow-Origin", "*", headers)
+            # Reflect Origin for credentialed preflight, otherwise wildcard
+            origin = self.lowercase_headers.get("origin", "")
+            if origin:
+                self.send_header("Access-Control-Allow-Origin", origin, headers)
+                self.send_header("Access-Control-Allow-Credentials", "true", headers)
+            else:
+                self.send_header("Access-Control-Allow-Origin", "*", headers)
             self.send_header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS", headers)
             self.send_header(
                 "Access-Control-Allow-Headers",
                 "Origin, X-Requested-With, Content-Type, Accept, Authorization",
                 headers,
             )
-            self.send_header("Access-Control-Allow-Credentials", "true", headers)
 
             headers_bytes = await self.get_headers(headers, self.response_protocol, HTTP_OK)
             class _Tina4Response:
@@ -434,11 +450,19 @@ class Webserver:
             self.send_header("Content-Type", response.content_type or "text/html", headers)
             await self.send_basic_headers(headers)
 
-            # Preserve session cookie (only if session was used)
-            session_name = os.getenv("TINA4_SESSION", "PY_SESS")
-            session_activated = not hasattr(self.session, 'activated') or self.session.activated
-            if session_activated and session_name in self.cookies:
-                self.send_header("Set-Cookie", f"{session_name}={self.cookies[session_name]}", headers)
+        # Preserve session cookie (only if session was used) — must be sent
+        # even on redirects so the browser keeps the session across the redirect
+        session_name = os.getenv("TINA4_SESSION", "PY_SESS")
+        session_activated = not hasattr(self.session, 'activated') or self.session.activated
+        if session_activated and session_name in self.cookies:
+            # Add Secure flag when behind TLS (reverse proxy or direct HTTPS)
+            proto = self.lowercase_headers.get("x-forwarded-proto", "http")
+            secure_flag = "; Secure" if proto == "https" else ""
+            self.send_header(
+                "Set-Cookie",
+                f"{session_name}={self.cookies[session_name]}; Path=/; HttpOnly; SameSite=Lax{secure_flag}",
+                headers,
+            )
 
         # Custom headers from route
         for name, value in response.headers.items():