Files
bun-mariadb/src/utils/trim-exports.ts
T
tbenandClaude Opus 5.5 b81b09324a Fix SQL injection, query value handling, and other security issues
- Quote all identifiers and validate operators, order strategies, join
  types, raw comparisons, and limit/offset/page in the query generator
- Treat 0 as a real query value; stop null from leaving unbound
  placeholders
- Return the WHERE clause and its values separately from sqlGenerator so
  delete/update no longer regex-parse generated SQL
- update(): target matched row ids, re-fetch reliably, and return
  success: false when no rows match
- Fix duplicated aliases, [object Object] select fields, AVERAGE -> AVG,
  escape GROUP_CONCAT separators
- Fix OFFSET without LIMIT and OFFSET on count queries
- Store boolean false as 0 on insert; call function values once
- Verify TLS certificates by default (new ssl_reject_unauthorized option)
- Confirm before importing an executable schema from an archive (--yes)
- Skip symlinks when reading extracted zip archives
- Only trim files matching the backup/export naming pattern
- Tighten default HTML sanitizer (no style/id attributes, no button)
- Stop typedef generation from mutating parent table schemas
- Pass config through DbSQL; handle BigInt values in results

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-14 02:10:35 +01:00

35 lines
1.1 KiB
TypeScript

import fs from "fs";
import path from "path";
import _ from "lodash";
import type { BunMariaDBConfig } from "../types";
import { AppData } from "../data/app-data";
import grabDBDir from "./grab-db-dir";
import grabSortedExports from "./grab-sorted-exports";
type Params = {
config: BunMariaDBConfig;
};
export default function trimExports({ config }: Params) {
const { export_dir } = grabDBDir({ config });
// Only consider archives written by `export` (`{db_name}-{timestamp}.tar.gz|zip`)
const exportNamePattern = new RegExp(
`^${_.escapeRegExp(config.db_name)}-\\d+\\.(tar\\.gz|zip)$`,
);
const exports = grabSortedExports({ config }).filter(
(name) =>
exportNamePattern.test(name) &&
fs.statSync(path.join(export_dir, name)).isFile(),
);
const max_exports = config.max_exports || AppData["MaxExports"];
for (let i = 0; i < exports.length; i++) {
const export_name = exports[i];
if (!export_name) continue;
if (i > max_exports - 1) {
fs.unlinkSync(path.join(export_dir, export_name));
}
}
}