Major version update. Major bugfixes. Security vulnerabilites fixed

2026-10-14 03:02:07 +01:00
parent 4e47bd8ce0
commit 7c095f6f16
112 changed files with 2479 additions and 1219 deletions
@@ -1,60 +1,56 @@
+import { sqlIdent } from "./sql-safe";
 /**
 * # SQL Insert Generator
 */
 export default function sqlInsertGenerator({ tableName, data, dbFullName, }) {
-    const finalDbName = dbFullName ? `${dbFullName}.` : "";
-    try {
-        if (Array.isArray(data) && data?.[0]) {
-            let insertKeys = [];
-            data.forEach((dt) => {
-                const kys = Object.keys(dt);
-                kys.forEach((ky) => {
-                    if (!insertKeys.includes(ky)) {
-                        insertKeys.push(ky);
-                    }
-                });
+    const finalDbName = dbFullName
+        ? `${sqlIdent(dbFullName, "database name")}.`
+        : "";
+    if (Array.isArray(data) && data?.[0]) {
+        let insertKeys = [];
+        data.forEach((dt) => {
+            const kys = Object.keys(dt);
+            kys.forEach((ky) => {
+                if (!insertKeys.includes(ky)) {
+                    insertKeys.push(sqlIdent(ky, "column name"));
+                }
            });
-            let queryBatches = [];
-            let queryValues = [];
-            data.forEach((item) => {
-                queryBatches.push(`(${insertKeys
-                    .map((ky) => {
-                    const value = item[ky];
-                    const finalValue = typeof value == "string" ||
-                        typeof value == "number"
-                        ? value
-                        : typeof value == "function"
-                            ? value().value
-                            : value
-                                ? value
-                                : null;
-                    if (!finalValue &&
-                        typeof finalValue !== "number" &&
-                        typeof finalValue !== "string") {
-                        queryValues.push(null);
-                        return "?";
-                    }
-                    queryValues.push(finalValue);
-                    const placeholder = typeof value == "function"
-                        ? value().placeholder
-                        : "?";
-                    return placeholder;
-                })
-                    .filter((k) => Boolean(k))
-                    .join(",")})`);
-            });
-            let query = `INSERT INTO ${finalDbName}${tableName} (${insertKeys.join(",")}) VALUES ${queryBatches.join(",")}`;
-            return {
-                query: query,
-                values: queryValues,
-            };
-        }
-        else {
-            return undefined;
-        }
+        });
+        let queryBatches = [];
+        let queryValues = [];
+        data.forEach((item) => {
+            queryBatches.push(`(${insertKeys
+                .map((ky) => {
+                const value = item[ky];
+                if (typeof value == "function") {
+                    const fnValue = value();
+                    queryValues.push(fnValue.value ?? null);
+                    return fnValue.placeholder;
+                }
+                queryValues.push(sqlValue(value));
+                return "?";
+            })
+                .join(",")})`);
+        });
+        let query = `INSERT INTO ${finalDbName}${sqlIdent(tableName, "table name")} (${insertKeys.join(",")}) VALUES ${queryBatches.join(",")}`;
+        return {
+            query: query,
+            values: queryValues,
+        };
    }
-    catch ( /** @type {any} */error) {
-        console.log(`SQL insert gen ERROR: ${error.message}`);
+    else {
        return undefined;
    }
 }
+/**
+ * # Normalize a JS value for binding
+ * @description Keeps `0`, `""` and `false` (as `0`) instead of turning them
+ * into `NULL`
+ */
+export function sqlValue(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (typeof value == "boolean")
+        return value ? 1 : 0;
+    return value;
+}