Fix SQL injection, query value handling, and other security issues

- Quote all identifiers and validate operators, order strategies, join
  types, raw comparisons, and limit/offset/page in the query generator
- Treat 0 as a real query value; stop null from leaving unbound
  placeholders
- Return the WHERE clause and its values separately from sqlGenerator so
  delete/update no longer regex-parse generated SQL
- update(): target matched row ids, re-fetch reliably, and return
  success: false when no rows match
- Fix duplicated aliases, [object Object] select fields, AVERAGE -> AVG,
  escape GROUP_CONCAT separators
- Fix OFFSET without LIMIT and OFFSET on count queries
- Store boolean false as 0 on insert; call function values once
- Verify TLS certificates by default (new ssl_reject_unauthorized option)
- Confirm before importing an executable schema from an archive (--yes)
- Skip symlinks when reading extracted zip archives
- Only trim files matching the backup/export naming pattern
- Tighten default HTML sanitizer (no style/id attributes, no button)
- Stop typedef generation from mutating parent table schemas
- Pass config through DbSQL; handle BigInt values in results

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/lib/mariadb/db-update.ts

@@ -8,6 +8,7 @@ import type {
 } from "../../types";
 import sqlGenerator from "../../utils/sql-generator";
 import sanitizeHtmlFields from "../../utils/sanitize-html-fields";
+import { quoteIdentifier } from "../../utils/sql-identifier";
 
 type Params<
     Schema extends { [k: string]: any } = { [k: string]: any },
@@ -20,10 +21,6 @@ type Params<
     config?: BunMariaDBConfig;
 };
 
-function quoteIdentifier(identifier: string): string {
-    return `\`${identifier.replace(/`/g, "``")}\``;
-}
-
 export default async function DbUpdate<
     Schema extends { [k: string]: any } = { [k: string]: any },
     Table extends string = string,
@@ -34,7 +31,12 @@ export default async function DbUpdate<
     targetId,
     config,
 }: Params<Schema, Table>): Promise<DBResponseObject> {
-    let sqlObj: ReturnType<typeof sqlGenerator> = { string: "", values: [] };
+    let sqlObj: ReturnType<typeof sqlGenerator> = {
+        string: "",
+        values: [],
+        where: "",
+        whereValues: [],
+    };
 
     try {
         let finalQuery = query || {};
@@ -53,11 +55,11 @@ export default async function DbUpdate<
         }
 
         const sqlQueryObj = sqlGenerator({
-            tableName: quoteIdentifier(table),
+            tableName: table,
             genObject: finalQuery,
         });
 
-        const whereClause = sqlQueryObj.string.match(/WHERE .*/)?.[0];
+        const whereClause = sqlQueryObj.where;
 
         if (!whereClause) {
             return {
@@ -66,6 +68,38 @@ export default async function DbUpdate<
             };
         }
 
+        /**
+         * Capture the matching row ids first, so the updated rows can be
+         * re-fetched even if the update changes a column used in the WHERE
+         * clause.
+         */
+        const matched_res = await dbHandler<{ id: number }>({
+            query: `SELECT id FROM ${quoteIdentifier(table)} ${whereClause}`,
+            values: sqlQueryObj.whereValues as any,
+            config,
+        });
+
+        if (!matched_res.success) {
+            return {
+                ...matched_res,
+                success: false,
+                debug: { sqlObj: sqlQueryObj },
+            };
+        }
+
+        const matched_ids = (matched_res.payload || [])
+            .map((row) => row.id)
+            .filter((id) => id !== undefined && id !== null);
+
+        if (matched_ids.length === 0) {
+            return {
+                success: false,
+                msg: "No rows matched the update query",
+                payload: [],
+                debug: { sqlObj: sqlQueryObj },
+            };
+        }
+
         let values: SQLInsertGenValueType[] = [];
         let sql = ``;
         sql += `UPDATE ${quoteIdentifier(table)} SET`;
@@ -97,8 +131,10 @@ export default async function DbUpdate<
             }
         }
 
-        sql += ` ${whereClause}`;
-        values = [...values, ...sqlQueryObj.values];
+        const idPlaceholders = matched_ids.map(() => "?").join(",");
+
+        sql += ` WHERE id IN (${idPlaceholders})`;
+        values = [...values, ...matched_ids];
 
         const res = await dbHandler({
             query: sql,
@@ -106,22 +142,16 @@ export default async function DbUpdate<
             config,
         });
 
-        if (res.error) {
-            return res;
-        }
-
         sqlObj.string = sql;
         sqlObj.values = values as any[];
 
-        let updated_sql = ``;
-        let updated_sql_values: any[] = [];
-
-        updated_sql += `SELECT * FROM ${quoteIdentifier(table)} ${whereClause}`;
-        updated_sql_values = [...sqlQueryObj.values];
+        if (res.error) {
+            return { ...res, debug: { sqlObj } };
+        }
 
         const updated_res = await dbHandler({
-            query: updated_sql,
-            values: updated_sql_values,
+            query: `SELECT * FROM ${quoteIdentifier(table)} WHERE id IN (${idPlaceholders})`,
+            values: matched_ids,
             config,
         });