tbenandClaude Opus 5.5
66f73c4228
Security: - select: bind parameters instead of mysql.format (backslash escaping allowed injection on SQLite); drop the mysql dependency - validate all interpolated identifiers, limit/offset/page, order strategy, operators, join types and raw equalities (new sql-safe.ts) - quote identifiers and bind values in schema manager DDL/queries Data loss: - schema sync runs with foreign keys off inside a transaction, with foreign_key_check before commit (DROP TABLE no longer cascades) - parentTableName tables: stop mutating the parent schema and copy inherited columns on rebuild - keep column data on type changes (match columns by name) - backups and schema snapshots use VACUUM INTO (includes WAL data); restore closes the DB, clears -wal/-shm, and swaps atomically - backup listing/trimming only touches <db_name>-<timestamp> files Correctness: - update/delete use the generator's WHERE clause instead of a regex - keep 0/""/false values; booleans stored as 0/1 - IN/NOT IN and BETWEEN arrays, NOT LIKE wrapping, AVG, select aliases - OFFSET without LIMIT, count ignores pagination - MATCH emits `field MATCH fn(?)` for sqlite-vec - sql() returns rows for any row-producing statement - targetId no longer mutates the caller's query - init throws instead of process.exit; CLI reports errors Co-Authored-By: Claude Opus 5.5 <[email protected]>
33 lines
565 B
TypeScript
33 lines
565 B
TypeScript
import { sqlField, sqlIdent, sqlStringLiteral } from "./sql-safe";
|
|
|
|
type Param = {
|
|
field: string;
|
|
alias: string;
|
|
separator?: string;
|
|
distinct?: boolean;
|
|
};
|
|
|
|
export default function sqlGenGrabConcatStr({
|
|
alias,
|
|
field,
|
|
separator = ",",
|
|
distinct,
|
|
}: Param) {
|
|
let gc = `GROUP_CONCAT(`;
|
|
|
|
if (distinct) {
|
|
gc += `DISTINCT `;
|
|
}
|
|
|
|
gc += sqlField(field);
|
|
|
|
if (!distinct) {
|
|
gc += `, ${sqlStringLiteral(String(separator))}`;
|
|
}
|
|
|
|
gc += `)`;
|
|
gc += ` AS ${sqlIdent(alias, "alias")}`;
|
|
|
|
return gc;
|
|
}
|