Major version update. Major bugfixes. Security vulnerabilites fixed

dist/lib/grab-duplicate-safe-insert-sql.js

@@ -1,22 +1,35 @@
 import init from "../functions/init";
+import { sqlIdent, sqlQuoteIdent } from "../utils/sql-safe";
 export default async function ({ sql: passed_sql, table, data }) {
     let sql = passed_sql;
-    const { dbSchema } = await init();
+    const { dbSchema } = init();
     const table_schema = dbSchema.tables.find((t) => t.tableName == table);
     const now = Date.now();
     if (table_schema?.tableName) {
-        const set_sql_arr = Object.keys(Array.isArray(data) ? data[0] : data).map((field) => `${field} = excluded.${field}`);
+        const set_sql_arr = Object.keys(Array.isArray(data) ? data[0] : data)
+            .filter((field) => field !== "updated_at")
+            .map((field) => {
+            const column = sqlIdent(field, "column name");
+            return `${column} = excluded.${column}`;
+        });
         set_sql_arr.push(`updated_at = ${now}`);
         const set_sql = set_sql_arr.join(", ");
         const unique_fields = table_schema.fields.filter((f) => f.unique);
         for (let i = 0; i < unique_fields.length; i++) {
             const field = unique_fields[i];
-            sql += ` ON CONFLICT(${field?.fieldName}) DO UPDATE SET ${set_sql}`;
+            if (!field?.fieldName)
+                continue;
+            sql += ` ON CONFLICT(${sqlQuoteIdent(field.fieldName)}) DO UPDATE SET ${set_sql}`;
         }
         if (table_schema.uniqueConstraints?.[0]) {
             for (let i = 0; i < table_schema.uniqueConstraints.length; i++) {
                 const constraint = table_schema.uniqueConstraints[i];
-                sql += ` ON CONFLICT(${constraint?.constraintTableFields?.map((c) => c.value)?.join(", ")}) DO UPDATE SET ${set_sql}`;
+                const columns = constraint?.constraintTableFields
+                    ?.map((c) => sqlQuoteIdent(String(c.value)))
+                    ?.join(", ");
+                if (!columns)
+                    continue;
+                sql += ` ON CONFLICT(${columns}) DO UPDATE SET ${set_sql}`;
             }
         }
     }