Major version update. Major bugfixes. Security vulnerabilites fixed

dist/lib/sqlite/db-update.js

@@ -1,27 +1,24 @@
-import DbClient from ".";
+import dbHandler from "../db-handler";
 import _ from "lodash";
 import sqlGenerator from "../../utils/sql-generator";
-export default async function DbUpdate({ table, data, query, targetId, }) {
-    let sqlObj = { string: "", values: [] };
+import { sqlValue } from "../../utils/sql-insert-generator";
+import { sqlIdent } from "../../utils/sql-safe";
+export default async function DbUpdate({ table, data, query, targetId, config, }) {
+    let sqlObj = {
+        string: "",
+        values: [],
+    };
     try {
-        let finalQuery = query || {};
-        if (targetId) {
-            finalQuery = _.merge(finalQuery, {
-                query: {
-                    id: {
-                        value: String(targetId),
-                    },
-                },
-            });
-        }
+        const finalQuery = query || {};
         const sqlQueryObj = sqlGenerator({
             tableName: table,
-            genObject: finalQuery,
+            genObject: _.pick(finalQuery, ["query", "searchOperator"]),
+            targetId,
         });
         let values = [];
-        const whereClause = sqlQueryObj.string.match(/WHERE .*/)?.[0];
+        const whereClause = sqlQueryObj.where.string;
         if (whereClause) {
-            let sql = `UPDATE ${table} SET`;
+            let sql = `UPDATE ${sqlIdent(table, "table name")} SET`;
             const finalData = {
                 updated_at: Date.now(),
                 ...data,
@@ -32,26 +29,23 @@ export default async function DbUpdate({ table, data, query, targetId, }) {
                 if (!key)
                     continue;
                 const isLast = i == keys.length - 1;
-                sql += ` ${key}=?`;
-                const value = finalData[key];
-                values.push(typeof value == "number" || typeof value == "string"
-                    ? value
-                    : value || null);
+                sql += ` ${sqlIdent(key, "column name")}=?`;
+                values.push(sqlValue(finalData[key]));
                 if (!isLast) {
                     sql += `,`;
                 }
             }
             sql += ` ${whereClause}`;
-            values = [...values, ...sqlQueryObj.values];
+            values = [...values, ...sqlQueryObj.where.values];
             sqlObj.string = sql;
             sqlObj.values = values;
-            const res = DbClient.run(sql, values);
+            const res = dbHandler({ query: sql, values, config });
+            if (!res.success) {
+                return { ...res, debug: { sqlObj } };
+            }
             return {
-                success: Boolean(res.changes),
-                postInsertReturn: {
-                    affectedRows: res.changes,
-                    insertId: Number(res.lastInsertRowid),
-                },
+                success: Boolean(res.postInsertReturn?.affectedRows),
+                postInsertReturn: res.postInsertReturn,
                 debug: {
                     sqlObj,
                 },