Fix SQL injection, schema-sync data loss, and backup safety
Security: - select: bind parameters instead of mysql.format (backslash escaping allowed injection on SQLite); drop the mysql dependency - validate all interpolated identifiers, limit/offset/page, order strategy, operators, join types and raw equalities (new sql-safe.ts) - quote identifiers and bind values in schema manager DDL/queries Data loss: - schema sync runs with foreign keys off inside a transaction, with foreign_key_check before commit (DROP TABLE no longer cascades) - parentTableName tables: stop mutating the parent schema and copy inherited columns on rebuild - keep column data on type changes (match columns by name) - backups and schema snapshots use VACUUM INTO (includes WAL data); restore closes the DB, clears -wal/-shm, and swaps atomically - backup listing/trimming only touches <db_name>-<timestamp> files Correctness: - update/delete use the generator's WHERE clause instead of a regex - keep 0/""/false values; booleans stored as 0/1 - IN/NOT IN and BETWEEN arrays, NOT LIKE wrapping, AVG, select aliases - OFFSET without LIMIT, count ignores pagination - MATCH emits `field MATCH fn(?)` for sqlite-vec - sql() returns rows for any row-producing statement - targetId no longer mutates the caller's query - init throws instead of process.exit; CLI reports errors Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Claude Opus 5.5
+111
-101
@@ -5,6 +5,13 @@ import type {
|
||||
} from "../types";
|
||||
import sqlGenGenSearchStr from "./sql-generator-gen-search-str";
|
||||
import sqlGenGenQueryStr from "./sql-generator-gen-query-str";
|
||||
import {
|
||||
sqlField,
|
||||
sqlIdent,
|
||||
sqlInt,
|
||||
sqlOperator,
|
||||
sqlOrderStrategy,
|
||||
} from "./sql-safe";
|
||||
|
||||
type Param<T extends { [key: string]: any } = { [key: string]: any }> = {
|
||||
genObject?: ServerQueryParam<T>;
|
||||
@@ -16,41 +23,41 @@ type Param<T extends { [key: string]: any } = { [key: string]: any }> = {
|
||||
type Return = {
|
||||
string: string;
|
||||
values: SQLInsertGenValueType[];
|
||||
/**
|
||||
* Just the `WHERE ...` clause (empty if there are no conditions) and its
|
||||
* bound values. Used by UPDATE and DELETE.
|
||||
*/
|
||||
where: {
|
||||
string: string;
|
||||
values: SQLInsertGenValueType[];
|
||||
};
|
||||
};
|
||||
|
||||
/**
|
||||
* # SQL Query Generator
|
||||
* @description Generates an SQL Query for node module `mysql` or `serverless-mysql`
|
||||
* @description Generates a parameterized SQLite SELECT query. All values are
|
||||
* returned in `values` to be bound; identifiers are validated.
|
||||
*/
|
||||
export default function sqlGenerator<
|
||||
T extends { [key: string]: any } = { [key: string]: any },
|
||||
>({ tableName, genObject, dbFullName, count }: Param<T>): Return {
|
||||
>({ tableName: passedTableName, genObject, count }: Param<T>): Return {
|
||||
const tableName = sqlIdent(passedTableName, "table name");
|
||||
const finalQuery = genObject?.query ? genObject.query : undefined;
|
||||
|
||||
const queryKeys = finalQuery ? Object.keys(finalQuery) : undefined;
|
||||
|
||||
const sqlSearhValues: SQLInsertGenValueType[] = [];
|
||||
const whereValues: SQLInsertGenValueType[] = [];
|
||||
|
||||
let fullTextMatchStr = genObject?.fullTextSearch
|
||||
? ` MATCH(${genObject.fullTextSearch.fields
|
||||
.map((f) =>
|
||||
genObject.join ? `${tableName}.${String(f)}` : `${String(f)}`,
|
||||
)
|
||||
.join(",")}) AGAINST (? IN BOOLEAN MODE)`
|
||||
: undefined;
|
||||
|
||||
const fullTextSearchStr = genObject?.fullTextSearch
|
||||
? genObject.fullTextSearch.searchTerm
|
||||
.split(` `)
|
||||
.map((t) => `${t}`)
|
||||
.join(" ")
|
||||
: undefined;
|
||||
if (genObject?.fullTextSearch) {
|
||||
throw new Error(
|
||||
"`fullTextSearch` is not supported by SQLite. Use an FTS5 table and the `MATCH` equality instead.",
|
||||
);
|
||||
}
|
||||
|
||||
let { str: queryString, values } = sqlGenGenQueryStr<T>({
|
||||
table_name: tableName,
|
||||
append_table_names: true,
|
||||
full_text_match_str: fullTextMatchStr,
|
||||
full_text_search_str: fullTextSearchStr,
|
||||
genObject,
|
||||
});
|
||||
|
||||
@@ -64,26 +71,30 @@ export default function sqlGenerator<
|
||||
const subQueryGroup = queryObj.__query;
|
||||
|
||||
const subSearchKeys = Object.keys(subQueryGroup);
|
||||
const subSearchString = subSearchKeys.map((_field) => {
|
||||
const newSubQueryObj = subQueryGroup?.[_field];
|
||||
const subSearchString = subSearchKeys
|
||||
.map((_field) => {
|
||||
const newSubQueryObj = subQueryGroup?.[_field];
|
||||
|
||||
if (newSubQueryObj) {
|
||||
const { str, values } = sqlGenGenSearchStr({
|
||||
queryObj: newSubQueryObj,
|
||||
field: newSubQueryObj.fieldName || _field,
|
||||
join: genObject?.join,
|
||||
table_name: tableName,
|
||||
});
|
||||
if (newSubQueryObj) {
|
||||
const { str, values } = sqlGenGenSearchStr({
|
||||
queryObj: newSubQueryObj,
|
||||
field: newSubQueryObj.fieldName || _field,
|
||||
join: genObject?.join,
|
||||
table_name: tableName,
|
||||
});
|
||||
|
||||
sqlSearhValues.push(...values);
|
||||
whereValues.push(...values);
|
||||
|
||||
return str;
|
||||
}
|
||||
});
|
||||
return str;
|
||||
}
|
||||
})
|
||||
.filter((str) => typeof str == "string");
|
||||
|
||||
if (!subSearchString.length) return;
|
||||
|
||||
return (
|
||||
"(" +
|
||||
subSearchString.join(` ${queryObj.operator || "AND"} `) +
|
||||
subSearchString.join(` ${sqlOperator(queryObj.operator)} `) +
|
||||
")"
|
||||
);
|
||||
}
|
||||
@@ -95,7 +106,7 @@ export default function sqlGenerator<
|
||||
table_name: tableName,
|
||||
});
|
||||
|
||||
sqlSearhValues.push(...values);
|
||||
whereValues.push(...values);
|
||||
|
||||
return str;
|
||||
});
|
||||
@@ -104,103 +115,102 @@ export default function sqlGenerator<
|
||||
(str) => typeof str == "string",
|
||||
);
|
||||
|
||||
const isSearchStr =
|
||||
cleanedUpSearchStr?.[0] && cleanedUpSearchStr.find((str) => str);
|
||||
let whereString = "";
|
||||
|
||||
if (isSearchStr) {
|
||||
const stringOperator = genObject?.searchOperator || "AND";
|
||||
queryString += ` WHERE ${cleanedUpSearchStr.join(
|
||||
` ${stringOperator} `,
|
||||
)}`;
|
||||
}
|
||||
|
||||
if (genObject?.fullTextSearch && fullTextSearchStr && fullTextMatchStr) {
|
||||
queryString += `${isSearchStr ? " AND" : " WHERE"} ${fullTextMatchStr}`;
|
||||
sqlSearhValues.push(fullTextSearchStr);
|
||||
if (cleanedUpSearchStr?.[0]) {
|
||||
const stringOperator = sqlOperator(genObject?.searchOperator);
|
||||
whereString = `WHERE ${cleanedUpSearchStr.join(` ${stringOperator} `)}`;
|
||||
queryString += ` ${whereString}`;
|
||||
sqlSearhValues.push(...whereValues);
|
||||
}
|
||||
|
||||
if (genObject?.group) {
|
||||
let group_by_txt = ``;
|
||||
|
||||
if (typeof genObject.group == "string") {
|
||||
group_by_txt = genObject.group;
|
||||
} else if (Array.isArray(genObject.group)) {
|
||||
for (let i = 0; i < genObject.group.length; i++) {
|
||||
const group = genObject.group[i];
|
||||
|
||||
if (typeof group == "string") {
|
||||
group_by_txt += `\`${group.toString()}\``;
|
||||
} else if (typeof group == "object" && group.table) {
|
||||
group_by_txt += `${group.table}.${String(group.field)}`;
|
||||
} else if (typeof group == "object") {
|
||||
group_by_txt += `${String(group.field)}`;
|
||||
}
|
||||
|
||||
if (i < genObject.group.length - 1) {
|
||||
group_by_txt += ",";
|
||||
}
|
||||
const grabGroupStr = (
|
||||
group: string | number | symbol | { field: unknown; table?: string },
|
||||
) => {
|
||||
if (typeof group == "object") {
|
||||
return group.table
|
||||
? `${sqlIdent(group.table, "table name")}.${sqlIdent(group.field, "field name")}`
|
||||
: sqlField(group.field);
|
||||
}
|
||||
} else if (typeof genObject.group == "object") {
|
||||
if (genObject.group.table) {
|
||||
group_by_txt = `${genObject.group.table}.${String(genObject.group.field)}`;
|
||||
} else {
|
||||
group_by_txt = `${String(genObject.group.field)}`;
|
||||
}
|
||||
}
|
||||
|
||||
return sqlField(group);
|
||||
};
|
||||
|
||||
const group_by_txt = Array.isArray(genObject.group)
|
||||
? genObject.group.map(grabGroupStr).join(",")
|
||||
: grabGroupStr(genObject.group);
|
||||
|
||||
queryString += ` GROUP BY ${group_by_txt}`;
|
||||
}
|
||||
|
||||
function grabOrderString(order: ServerQueryParamOrder<T>) {
|
||||
let orderFields = [];
|
||||
let orderSrt = ``;
|
||||
const field =
|
||||
genObject?.join && !String(order.field).includes(".")
|
||||
? `${tableName}.${sqlIdent(order.field, "order field")}`
|
||||
: sqlField(order.field, "order field");
|
||||
|
||||
if (genObject?.fullTextSearch && genObject.fullTextSearch.scoreAlias) {
|
||||
orderFields.push(genObject.fullTextSearch.scoreAlias);
|
||||
} else if (genObject?.join) {
|
||||
orderFields.push(`${tableName}.${String(order.field)}`);
|
||||
} else {
|
||||
orderFields.push(order.field);
|
||||
}
|
||||
|
||||
orderSrt += ` ${orderFields.join(", ")} ${order.strategy}`;
|
||||
|
||||
return orderSrt;
|
||||
return ` ${field} ${sqlOrderStrategy(order.strategy)}`;
|
||||
}
|
||||
|
||||
if (genObject?.order) {
|
||||
let orderSrt = ` ORDER BY`;
|
||||
|
||||
if (Array.isArray(genObject.order)) {
|
||||
for (let i = 0; i < genObject.order.length; i++) {
|
||||
const order = genObject.order[i];
|
||||
if (order) {
|
||||
orderSrt +=
|
||||
grabOrderString(order) +
|
||||
(i < genObject.order.length - 1 ? `,` : "");
|
||||
}
|
||||
}
|
||||
} else {
|
||||
orderSrt += grabOrderString(genObject.order);
|
||||
}
|
||||
const orders = (
|
||||
Array.isArray(genObject.order) ? genObject.order : [genObject.order]
|
||||
).filter(Boolean);
|
||||
|
||||
orderSrt += orders.map(grabOrderString).join(",");
|
||||
|
||||
queryString += ` ${orderSrt}`;
|
||||
}
|
||||
|
||||
if (genObject?.limit && !count) queryString += ` LIMIT ${genObject.limit}`;
|
||||
/**
|
||||
* Pagination is skipped for count queries so the count covers every
|
||||
* matching row
|
||||
*/
|
||||
if (!count) {
|
||||
const { limit: rawLimit, offset: rawOffset, page } = genObject || {};
|
||||
|
||||
if (genObject?.offset) {
|
||||
queryString += ` OFFSET ${genObject.offset}`;
|
||||
} else if (genObject?.page && genObject.limit && !count) {
|
||||
queryString += ` OFFSET ${(genObject.page - 1) * genObject.limit}`;
|
||||
/**
|
||||
* `limit: 0` has always meant "no limit"
|
||||
*/
|
||||
const limit = rawLimit ? sqlInt(rawLimit, "limit") : undefined;
|
||||
|
||||
const offset = isSet(rawOffset)
|
||||
? sqlInt(rawOffset, "offset")
|
||||
: isSet(page) && limit !== undefined
|
||||
? Math.max(sqlInt(page, "page") - 1, 0) * limit
|
||||
: undefined;
|
||||
|
||||
if (limit !== undefined) {
|
||||
queryString += ` LIMIT ${limit}`;
|
||||
} else if (offset) {
|
||||
/**
|
||||
* SQLite doesn't allow OFFSET without LIMIT
|
||||
*/
|
||||
queryString += ` LIMIT -1`;
|
||||
}
|
||||
|
||||
if (offset) {
|
||||
queryString += ` OFFSET ${offset}`;
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
string: queryString,
|
||||
values: sqlSearhValues,
|
||||
where: {
|
||||
string: whereString,
|
||||
values: whereString ? whereValues : [],
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function isSet<V>(val: V): val is NonNullable<V> {
|
||||
return val !== undefined && val !== null;
|
||||
}
|
||||
|
||||
// let queryString = (() => {
|
||||
// let str = "SELECT";
|
||||
|
||||
|
||||
Reference in New Issue
Block a user