tbenandClaude Opus 5.5
ddf431e866
- Add bun test suite: SQL generator and value unit tests, plus MariaDB integration tests gated on BUN_MARIADB_TEST_DB - schema: add --dry-run and require confirmation (or --yes) before dropping tables/columns; block unapproved destructive statements - Always AND targetId with the query, regardless of searchOperator - Initialize lazily on first call; init throws instead of exiting - Generate IN (?, ?, ...) lists for IN / NOT IN - Share value binding between insert and update (booleans, embeddings, function values, "" -> NULL for non-text columns) - Keep Buffers and convert BigInt/Date without a JSON round-trip - DbSQL: report success for empty SELECT results - Run update() in a transaction with row locking - Key the client cache on the full connection config - Consolidate identifier quoting, drop dead code, merge column lookup - Read CLI version from package.json, pin @types/bun, chmod CLI on compile - Rebuild dist Co-Authored-By: Claude Opus 5.5 <[email protected]>
50 lines
1.7 KiB
JavaScript
50 lines
1.7 KiB
JavaScript
import sanitizeHtml from "sanitize-html";
|
|
import getSanitizeHtmlOptions from "./sanitize-html-options";
|
|
import grabTableFields from "./grab-table-fields";
|
|
/**
|
|
* Only fields with an explicit `html: true` flag are sanitized.
|
|
* Missing / falsy / non-true values are never sanitized.
|
|
*/
|
|
function isExplicitHtmlField(field) {
|
|
return field?.html === true;
|
|
}
|
|
function sanitizeValue(value, config) {
|
|
if (typeof value !== "string") {
|
|
return value;
|
|
}
|
|
return sanitizeHtml(value, getSanitizeHtmlOptions(config));
|
|
}
|
|
/**
|
|
* Sanitize string values ONLY for schema fields with explicit `html: true`.
|
|
* Other fields (including plain text that happens to contain HTML) are left untouched.
|
|
*/
|
|
export default function sanitizeHtmlFields({ table, data, config, }) {
|
|
const fields = grabTableFields(table);
|
|
if (fields.length === 0) {
|
|
return data;
|
|
}
|
|
const htmlFieldNames = new Set(fields
|
|
.filter(isExplicitHtmlField)
|
|
.map((f) => f.fieldName)
|
|
.filter((name) => Boolean(name)));
|
|
// No explicitly marked html fields on this table — skip entirely
|
|
if (htmlFieldNames.size === 0) {
|
|
return data;
|
|
}
|
|
const sanitized = { ...data };
|
|
const resolvedConfig = config || global.CONFIG;
|
|
for (const key of Object.keys(sanitized)) {
|
|
// Only sanitize keys that map to fields with html: true
|
|
if (!htmlFieldNames.has(key))
|
|
continue;
|
|
sanitized[key] = sanitizeValue(sanitized[key], resolvedConfig);
|
|
}
|
|
return sanitized;
|
|
}
|
|
/**
|
|
* Sanitize an array of row objects for insert.
|
|
*/
|
|
export function sanitizeHtmlFieldsBatch({ table, data, config, }) {
|
|
return data.map((row) => sanitizeHtmlFields({ table, data: row, config }));
|
|
}
|