Major version update. Major bugfixes. Security vulnerabilites fixed

This commit is contained in:
2026-10-14 03:02:07 +01:00
parent 4e47bd8ce0
commit 7c095f6f16
112 changed files with 2479 additions and 1219 deletions
+63 -103
View File
@@ -1,133 +1,93 @@
import sqlEqualityParser from "./sql-equality-parser";
import { sqlIdent } from "./sql-safe";
/**
* # SQL Gen Operator Gen
* @description Generates an SQL operator for node module `mysql` or `serverless-mysql`
* @description Generates an SQL condition for a single field. Literal values
* are always returned in `params` to be bound, never inlined.
*/
export default function sqlGenOperatorGen({ fieldName, value, equality, queryObj, isValueFieldValue, }) {
if (queryObj.nullValue) {
return { str: `${fieldName} IS NULL` };
if (queryObj.nullValue || equality == "IS NULL") {
return { str: `${fieldName} IS NULL`, params: [] };
}
if (queryObj.notNullValue) {
return { str: `${fieldName} IS NOT NULL` };
if (queryObj.notNullValue || equality == "IS NOT NULL") {
return { str: `${fieldName} IS NOT NULL`, params: [] };
}
if (value) {
const finalValue = isValueFieldValue ? value : "?";
const finalParams = isValueFieldValue ? undefined : value;
if (equality == "MATCH") {
return {
str: `MATCH(${fieldName}) AGAINST(${finalValue} IN NATURAL LANGUAGE MODE)`,
param: finalParams,
};
const finalValue = isValueFieldValue ? String(value) : "?";
const params = isValueFieldValue
? []
: [value ?? ""];
const wrappedValue = isValueFieldValue ? `'%' || ${value} || '%'` : "?";
const wrappedParams = isValueFieldValue
? []
: [`%${value ?? ""}%`];
switch (equality) {
case "MATCH":
case "MATCH_BOOLEAN":
case "FULLTEXT": {
const matchValue = queryObj.vectorFunction && !isValueFieldValue
? `${sqlIdent(queryObj.vectorFunction, "vector function")}(?)`
: finalValue;
return { str: `${fieldName} MATCH ${matchValue}`, params };
}
else if (equality == "MATCH_BOOLEAN") {
case "LIKE_LOWER":
return {
str: `MATCH(${fieldName}) AGAINST(${finalValue} IN BOOLEAN MODE)`,
param: finalParams,
str: `LOWER(${fieldName}) LIKE LOWER(${wrappedValue})`,
params: wrappedParams,
};
}
else if (equality == "LIKE_LOWER") {
case "LIKE_LOWER_RAW":
return {
str: `LOWER(${fieldName}) LIKE LOWER(${finalValue})`,
param: `%${finalParams}%`,
params,
};
}
else if (equality == "LIKE_LOWER_RAW") {
case "LIKE":
return {
str: `LOWER(${fieldName}) LIKE LOWER(${finalValue})`,
param: finalParams,
str: `${fieldName} LIKE ${wrappedValue}`,
params: wrappedParams,
};
}
else if (equality == "LIKE") {
case "LIKE_RAW":
return { str: `${fieldName} LIKE ${finalValue}`, params };
case "NOT_LIKE_LOWER":
return {
str: `${fieldName} LIKE ${finalValue}`,
param: `%${finalParams}%`,
str: `LOWER(${fieldName}) NOT LIKE LOWER(${wrappedValue})`,
params: wrappedParams,
};
}
else if (equality == "LIKE_RAW") {
return {
str: `${fieldName} LIKE ${finalValue}`,
param: finalParams,
};
}
else if (equality == "NOT_LIKE_LOWER") {
case "NOT_LIKE_LOWER_RAW":
return {
str: `LOWER(${fieldName}) NOT LIKE LOWER(${finalValue})`,
param: `%${finalParams}%`,
params,
};
}
else if (equality == "NOT_LIKE_LOWER_RAW") {
case "NOT LIKE":
return {
str: `LOWER(${fieldName}) NOT LIKE LOWER(${finalValue})`,
param: finalParams,
str: `${fieldName} NOT LIKE ${wrappedValue}`,
params: wrappedParams,
};
}
else if (equality == "NOT LIKE") {
return {
str: `${fieldName} NOT LIKE ${finalValue}`,
param: finalParams,
};
}
else if (equality == "NOT LIKE_RAW") {
return {
str: `${fieldName} NOT LIKE ${finalValue}`,
param: finalParams,
};
}
else if (equality == "REGEXP") {
case "NOT LIKE_RAW":
return { str: `${fieldName} NOT LIKE ${finalValue}`, params };
case "REGEXP":
/**
* SQLite has no built-in REGEXP function. This only works when
* an extension providing `regexp()` is loaded.
*/
return {
str: `LOWER(${fieldName}) REGEXP LOWER(${finalValue})`,
param: finalParams,
params,
};
}
else if (equality == "FULLTEXT") {
return {
str: `MATCH(${fieldName}) AGAINST(${finalValue} IN BOOLEAN MODE)`,
param: finalParams,
};
}
else if (equality == "NOT EQUAL") {
return {
str: `${fieldName} != ${finalValue}`,
param: finalParams,
};
}
else if (equality == "IS NOT") {
return {
str: `${fieldName} IS NOT ${finalValue}`,
param: finalParams,
};
}
else if (equality) {
case "NOT EQUAL":
return { str: `${fieldName} != ${finalValue}`, params };
case "IS NOT":
return { str: `${fieldName} IS NOT ${finalValue}`, params };
case "IN":
case "NOT IN":
return { str: `${fieldName} ${equality} (${finalValue})`, params };
case "BETWEEN":
case "NOT BETWEEN":
throw new Error(`\`${equality}\` on \`${fieldName}\` requires an array of two values`);
case undefined:
return { str: `${fieldName} = ${finalValue}`, params };
default:
return {
str: `${fieldName} ${sqlEqualityParser(equality)} ${finalValue}`,
param: finalParams,
params,
};
}
else {
return {
str: `${fieldName} = ${finalValue}`,
param: finalParams,
};
}
}
else {
if (equality == "IS NULL") {
return { str: `${fieldName} IS NULL` };
}
else if (equality == "IS NOT NULL") {
return { str: `${fieldName} IS NOT NULL` };
}
else if (equality) {
return {
str: `${fieldName} ${sqlEqualityParser(equality)} ?`,
param: value,
};
}
else {
return {
str: `${fieldName} = ?`,
param: value,
};
}
}
}