Major version update. Major bugfixes. Security vulnerabilites fixed
This commit is contained in:
+73
-81
@@ -2,12 +2,11 @@ import { isUndefined } from "lodash";
|
||||
import sqlGenGrabConcatStr from "./sql-generator-grab-concat-str";
|
||||
import sqlGenGenJoinStr from "./sql-generator-gen-join-str";
|
||||
import sqlGenGrabSelectFieldSQL from "./sql-generator-grab-select-field-sql";
|
||||
import { sqlIdent, sqlJoinType, sqlOperator } from "./sql-safe";
|
||||
export default function sqlGenGenQueryStr(params) {
|
||||
let str = "SELECT";
|
||||
const genObject = params.genObject;
|
||||
const table_name = params.table_name;
|
||||
const full_text_match_str = params.full_text_match_str;
|
||||
const full_text_search_str = params.full_text_search_str;
|
||||
let sqlSearhValues = [];
|
||||
if (genObject?.select_sql) {
|
||||
str += ` ${genObject.select_sql}`;
|
||||
@@ -41,108 +40,102 @@ export default function sqlGenGenQueryStr(params) {
|
||||
const countSubQuery = genObject.countSubQueries[i];
|
||||
if (!countSubQuery)
|
||||
continue;
|
||||
const tableAlias = countSubQuery.table_alias;
|
||||
const countTable = sqlIdent(countSubQuery.table, "table name");
|
||||
const tableAlias = countSubQuery.table_alias
|
||||
? sqlIdent(countSubQuery.table_alias, "alias")
|
||||
: undefined;
|
||||
let subQStr = `(SELECT COUNT(*)`;
|
||||
subQStr += ` FROM ${countSubQuery.table}${tableAlias ? ` ${tableAlias}` : ""}`;
|
||||
subQStr += ` FROM ${countTable}${tableAlias ? ` ${tableAlias}` : ""}`;
|
||||
subQStr += ` WHERE (`;
|
||||
for (let j = 0; j < countSubQuery.srcTrgMap.length; j++) {
|
||||
const csqSrc = countSubQuery.srcTrgMap[j];
|
||||
if (!csqSrc)
|
||||
continue;
|
||||
subQStr += ` ${tableAlias || countSubQuery.table}.${csqSrc.src}`;
|
||||
subQStr += ` ${tableAlias || countTable}.${sqlIdent(csqSrc.src, "field name")}`;
|
||||
if (typeof csqSrc.trg == "string") {
|
||||
subQStr += ` = ?`;
|
||||
sqlSearhValues.push(csqSrc.trg);
|
||||
}
|
||||
else if (typeof csqSrc.trg == "object") {
|
||||
subQStr += ` = ${csqSrc.trg.table}.${csqSrc.trg.field}`;
|
||||
subQStr += ` = ${sqlIdent(csqSrc.trg.table, "table name")}.${sqlIdent(csqSrc.trg.field, "field name")}`;
|
||||
}
|
||||
if (j < countSubQuery.srcTrgMap.length - 1) {
|
||||
subQStr += ` AND `;
|
||||
}
|
||||
}
|
||||
subQStr += ` )) AS ${countSubQuery.alias}`;
|
||||
subQStr += ` )) AS ${sqlIdent(countSubQuery.alias, "alias")}`;
|
||||
countSqls.push(subQStr);
|
||||
}
|
||||
str += `, ${countSqls.join(",")}`;
|
||||
}
|
||||
if (genObject?.join) {
|
||||
const existingJoinTableNames = [table_name];
|
||||
str +=
|
||||
"," +
|
||||
genObject.join
|
||||
.flat()
|
||||
.filter((j) => !isUndefined(j))
|
||||
.map((joinObj) => {
|
||||
const joinTableName = joinObj.alias
|
||||
? joinObj.alias
|
||||
: joinObj.tableName;
|
||||
if (existingJoinTableNames.includes(joinTableName))
|
||||
return null;
|
||||
existingJoinTableNames.push(joinTableName);
|
||||
if (joinObj.group_concat) {
|
||||
const joinSelectStr = genObject.join
|
||||
.flat()
|
||||
.filter((j) => !isUndefined(j))
|
||||
.map((joinObj) => {
|
||||
const joinTableName = sqlIdent(joinObj.alias ? joinObj.alias : joinObj.tableName, "join table name");
|
||||
if (existingJoinTableNames.includes(joinTableName))
|
||||
return null;
|
||||
existingJoinTableNames.push(joinTableName);
|
||||
if (joinObj.group_concat) {
|
||||
return sqlGenGrabConcatStr({
|
||||
field: `${joinTableName}.${sqlIdent(joinObj.group_concat.field, "field name")}`,
|
||||
alias: joinObj.group_concat.alias,
|
||||
separator: joinObj.group_concat.separator,
|
||||
distinct: joinObj.group_concat.distinct,
|
||||
});
|
||||
}
|
||||
else if (joinObj.selectFields) {
|
||||
return joinObj.selectFields
|
||||
.map((selectField) => {
|
||||
if (typeof selectField != "object") {
|
||||
return `${joinTableName}.${sqlIdent(selectField, "field name")}`;
|
||||
}
|
||||
const field = `${joinTableName}.${sqlIdent(selectField.field, "field name")}`;
|
||||
if (selectField.group_concat &&
|
||||
selectField.alias) {
|
||||
return sqlGenGrabConcatStr({
|
||||
field: `${joinTableName}.${joinObj.group_concat.field}`,
|
||||
alias: joinObj.group_concat.alias,
|
||||
separator: joinObj.group_concat.separator,
|
||||
field,
|
||||
alias: selectField.alias,
|
||||
separator: selectField.group_concat.separator,
|
||||
distinct: selectField.group_concat.distinct,
|
||||
});
|
||||
}
|
||||
else if (joinObj.selectFields) {
|
||||
return joinObj.selectFields
|
||||
.map((selectField) => {
|
||||
if (typeof selectField == "string") {
|
||||
return `${joinTableName}.${selectField}`;
|
||||
}
|
||||
else if (typeof selectField == "object") {
|
||||
let aliasSelectField = `${joinTableName}.${selectField.field}`;
|
||||
if (selectField.count) {
|
||||
aliasSelectField = `COUNT(${joinTableName}.${selectField.field})`;
|
||||
}
|
||||
else if (selectField.sum) {
|
||||
aliasSelectField = `SUM(${selectField.distinct ? "DISTINCT " : ""}${joinTableName}.${selectField.field})`;
|
||||
}
|
||||
else if (selectField.average) {
|
||||
aliasSelectField = `AVERAGE(${joinTableName}.${selectField.field})`;
|
||||
}
|
||||
else if (selectField.max) {
|
||||
aliasSelectField = `MAX(${joinTableName}.${selectField.field})`;
|
||||
}
|
||||
else if (selectField.min) {
|
||||
aliasSelectField = `MIN(${joinTableName}.${selectField.field})`;
|
||||
}
|
||||
else if (selectField.group_concat &&
|
||||
selectField.alias) {
|
||||
return sqlGenGrabConcatStr({
|
||||
field: `${joinTableName}.${selectField.field}`,
|
||||
alias: selectField.alias,
|
||||
separator: selectField.group_concat
|
||||
.separator,
|
||||
distinct: selectField.group_concat
|
||||
.distinct,
|
||||
});
|
||||
}
|
||||
else if (selectField.distinct) {
|
||||
aliasSelectField = `DISTINCT ${joinTableName}.${selectField.field}`;
|
||||
}
|
||||
if (selectField.alias)
|
||||
aliasSelectField += ` AS ${selectField.alias}`;
|
||||
return aliasSelectField;
|
||||
}
|
||||
})
|
||||
.join(",");
|
||||
let aliasSelectField = field;
|
||||
if (selectField.count) {
|
||||
aliasSelectField = `COUNT(${field})`;
|
||||
}
|
||||
else {
|
||||
return `${joinTableName}.*`;
|
||||
else if (selectField.sum) {
|
||||
aliasSelectField = `SUM(${selectField.distinct ? "DISTINCT " : ""}${field})`;
|
||||
}
|
||||
else if (selectField.average) {
|
||||
aliasSelectField = `AVG(${field})`;
|
||||
}
|
||||
else if (selectField.max) {
|
||||
aliasSelectField = `MAX(${field})`;
|
||||
}
|
||||
else if (selectField.min) {
|
||||
aliasSelectField = `MIN(${field})`;
|
||||
}
|
||||
else if (selectField.distinct) {
|
||||
aliasSelectField = `DISTINCT ${field}`;
|
||||
}
|
||||
if (selectField.alias)
|
||||
aliasSelectField += ` AS ${sqlIdent(selectField.alias, "alias")}`;
|
||||
return aliasSelectField;
|
||||
})
|
||||
.filter((_) => Boolean(_))
|
||||
.join(",");
|
||||
}
|
||||
if (genObject?.fullTextSearch &&
|
||||
full_text_match_str &&
|
||||
full_text_search_str) {
|
||||
str += `, ${full_text_match_str} AS ${genObject.fullTextSearch.scoreAlias}`;
|
||||
sqlSearhValues.push(full_text_search_str);
|
||||
}
|
||||
else {
|
||||
return `${joinTableName}.*`;
|
||||
}
|
||||
})
|
||||
.filter((_) => Boolean(_))
|
||||
.join(",");
|
||||
if (joinSelectStr) {
|
||||
str += "," + joinSelectStr;
|
||||
}
|
||||
}
|
||||
str += ` FROM ${table_name}`;
|
||||
if (genObject?.join) {
|
||||
@@ -152,11 +145,12 @@ export default function sqlGenGenQueryStr(params) {
|
||||
.flat()
|
||||
.filter((j) => !isUndefined(j))
|
||||
.map((join) => {
|
||||
return (join.joinType +
|
||||
const joinTable = sqlIdent(join.tableName, "table name");
|
||||
return (sqlJoinType(join.joinType) +
|
||||
" " +
|
||||
(join.alias
|
||||
? `${join.tableName}` + " " + join.alias
|
||||
: `${join.tableName}`) +
|
||||
? `${joinTable} ${sqlIdent(join.alias, "alias")}`
|
||||
: joinTable) +
|
||||
" ON " +
|
||||
(() => {
|
||||
if (Array.isArray(join.match)) {
|
||||
@@ -171,9 +165,7 @@ export default function sqlGenGenQueryStr(params) {
|
||||
sqlSearhValues.push(...values);
|
||||
return str;
|
||||
})
|
||||
.join(join.operator
|
||||
? ` ${join.operator} `
|
||||
: " AND ") +
|
||||
.join(` ${sqlOperator(join.operator)} `) +
|
||||
")");
|
||||
}
|
||||
else if (typeof join.match == "object") {
|
||||
|
||||
Reference in New Issue
Block a user