@blamejs/blamejs-shop 0.3.11 → 0.3.13

package/lib/vendor/blamejs/lib/crypto-field.js

@@ -52,7 +52,7 @@ var compliance    = lazyRequire(function () { return require("./compliance"); })
 var db            = lazyRequire(function () { return require("./db"); });
 var audit         = lazyRequire(function () { return require("./audit"); });
 
-// F-POSTURE-1 cascade hook + F-RTBF-2 integration. Recording the
+// Posture cascade hook + erase-vacuum integration. Recording the
 // posture lets eraseRow call b.db.vacuumAfterErase({ mode: "full" })
 // automatically under postures whose POSTURE_DEFAULTS sets
 // requireVacuumAfterErase: true (gdpr / dpdp / pipl-cn / lgpd-br /
@@ -113,7 +113,7 @@ function getActivePosture() { return _activePosture; }
 // Per-table registry, populated by db.init()
 var schemas = Object.create(null);
 
-// F-CBT-1 — per-COLUMN data residency registry. Real GDPR / DPDP
+// Per-COLUMN data residency registry. Real GDPR / DPDP
 // deployments have row-level mixed residency: a `users.name` column
 // may be global, but `users.addressLine1` must stay in EU storage.
 // db.init({ schema }) carries the operator's residency declaration
@@ -123,7 +123,7 @@ var schemas = Object.create(null);
 //   { tableName: { columnName: "eu" | "us" | "global" | <tag> } }
 var columnResidency = Object.create(null);
 
-// F-RTBF-3 — per-row key declaration registry. For tables that opt
+// Per-row key declaration registry. For tables that opt
 // into per-row keying, b.subject.eraseHard deletes the wrapped K_row
 // from _blamejs_per_row_keys, leaving WAL/replica residual ciphertext
 // undecryptable.
@@ -152,7 +152,7 @@ var perRowKeyTables = Object.create(null);
  *                                          // b.vault.aad — AEAD-binds the ciphertext
  *                                          // to (table, rowIdField=primary key, column)
  *                                          // so a DB-write attacker can't copy a
- *                                          // sealed value between rows. CRYPTO-1.
+ *                                          // sealed value between rows.
  *   rowIdField:     string,                // when aad=true, the column name carrying
  *                                          // the row identity. Default "id". The row
  *                                          // passed to sealRow MUST already have this
@@ -173,7 +173,7 @@ var perRowKeyTables = Object.create(null);
  *   });
  *   b.cryptoField.getSealedFields("patients");   // → ["ssn", "diagnosis"]
  *
- *   // AAD-bound table (recommended for new schemas — CRYPTO-1).
+ *   // AAD-bound table (recommended for new schemas).
  *   b.cryptoField.registerTable("idempotency_keys", {
  *     sealedFields: ["headers", "body"],
  *     aad:          true,
@@ -185,16 +185,56 @@ function registerTable(name, opts) {
   var rowIdField = typeof opts.rowIdField === "string" && opts.rowIdField.length > 0
     ? opts.rowIdField : "id";
   var schemaVersion = opts.schemaVersion != null ? String(opts.schemaVersion) : "1";
+  var derivedHashMode = opts.derivedHashMode || "salted-sha3";
+  if (derivedHashMode !== "salted-sha3" && derivedHashMode !== "hmac-shake256") {
+    throw new Error("registerTable: derivedHashMode must be 'salted-sha3' (default) or " +
+      "'hmac-shake256', got " + JSON.stringify(derivedHashMode));
+  }
+  var derivedHashes = Object.assign({}, opts.derivedHashes || {});
+  for (var col in derivedHashes) {
+    if (!Object.prototype.hasOwnProperty.call(derivedHashes, col)) continue;
+    var colMode = derivedHashes[col] && derivedHashes[col].mode;
+    if (colMode !== undefined && colMode !== "salted-sha3" && colMode !== "hmac-shake256") {
+      throw new Error("registerTable: derivedHashes." + col + ".mode must be " +
+        "'salted-sha3' or 'hmac-shake256', got " + JSON.stringify(colMode));
+    }
+  }
   schemas[name] = {
-    sealedFields:   Array.isArray(opts.sealedFields)   ? opts.sealedFields.slice()   : [],
-    derivedHashes:  Object.assign({}, opts.derivedHashes || {}),
-    hashNamespaces: Object.assign({}, opts.hashNamespaces || {}),
-    aad:            aadOn,
-    rowIdField:     rowIdField,
-    schemaVersion:  schemaVersion,
+    sealedFields:    Array.isArray(opts.sealedFields)   ? opts.sealedFields.slice()   : [],
+    derivedHashes:   derivedHashes,
+    hashNamespaces:  Object.assign({}, opts.hashNamespaces || {}),
+    aad:             aadOn,
+    rowIdField:      rowIdField,
+    schemaVersion:   schemaVersion,
+    derivedHashMode: derivedHashMode,
   };
 }
 
+// Derived-hash digest width for the keyed (hmac-shake256) mode: 32
+// bytes -> 64 hex chars.
+var DERIVED_HASH_BYTES = 32;
+
+// Compute the indexed-lookup digest for a derived-hash column.
+//   - "salted-sha3" (default): SHA3-512 over <per-deployment salt> + ns
+//     + value (128 hex). Deterministic per deployment.
+//   - "hmac-shake256": SHAKE256(<vault-sealed MAC key> || ns + value)
+//     truncated to 32 bytes (64 hex). The key is a vault-derived secret,
+//     NOT a static salt, so an attacker who recovers the salt alone
+//     can't correlate two low-entropy plaintexts; the sponge has no
+//     length-extension weakness. (b.crypto.hmacSha3 (HMAC-SHA3-512) was
+//     considered; SHAKE256(key||msg) is chosen for the fixed-width keyed
+//     digest with the same MAC-grade guarantee.) FIPS 202; NIST SP
+//     800-185; GDPR Art. 4(5) pseudonymisation; HIPAA 45 CFR 164.514(b).
+function _computeDerivedHash(spec, tableMode, ns, normalized) {
+  var mode = (spec && spec.mode) || tableMode || "salted-sha3";
+  if (mode === "hmac-shake256") {
+    var macKey = vault.getDerivedHashMacKey();
+    return kdf(Buffer.concat([macKey, Buffer.from(ns + normalized, "utf8")]),
+      DERIVED_HASH_BYTES).toString("hex");
+  }
+  return sha3Hash(vault.getDerivedHashSalt().toString("hex") + ns + normalized);
+}
+
 /**
  * @primitive b.cryptoField.getSchema
  * @signature b.cryptoField.getSchema(table)
@@ -308,8 +348,7 @@ function computeDerived(table, sourceField, sourceValue) {
     if (spec.from === sourceField) {
       var ns = namespaceFor(table, sourceField, s.hashNamespaces);
       var normalized = spec.normalize ? spec.normalize(sourceValue) : String(sourceValue);
-      var saltHex = vault.getDerivedHashSalt().toString("hex");
-      return { field: derivedField, value: sha3Hash(saltHex + ns + normalized) };
+      return { field: derivedField, value: _computeDerivedHash(spec, s.derivedHashMode, ns, normalized) };
     }
   }
   return null;
@@ -367,12 +406,11 @@ function sealRow(table, row) {
       }
       var ns = namespaceFor(table, spec.from, s.hashNamespaces);
       var normalized = spec.normalize ? spec.normalize(plain) : String(plain);
-      var saltHex2 = vault.getDerivedHashSalt().toString("hex");
-      out[derivedField] = sha3Hash(saltHex2 + ns + normalized);
+      out[derivedField] = _computeDerivedHash(spec, s.derivedHashMode, ns, normalized);
     }
   }
 
-  // CRYPTO-1 — AAD-bound table requires the row's identity column to
+  // AAD-bound table requires the row's identity column to
   // be populated BEFORE sealRow runs. Sealing under a placeholder /
   // missing rowId produces ciphertext that no later unseal can open
   // because the AAD on read is computed against the row's actual id.
@@ -390,7 +428,7 @@ function sealRow(table, row) {
   // Seal fields. Plain mode: vault.seal (idempotent — already-sealed
   // values pass through). AAD mode: vault.aad.seal binds the AEAD tag
   // to (table, rowId, column, schemaVersion) — cross-row copy of a
-  // ciphertext fails Poly1305 on read. CRYPTO-1.
+  // ciphertext fails Poly1305 on read.
   for (var i = 0; i < s.sealedFields.length; i++) {
     var field = s.sealedFields[i];
     if (out[field] !== undefined && out[field] !== null) {
@@ -573,7 +611,7 @@ function eraseRow(table, row) {
       out[derivedField] = null;
     }
   }
-  // F-RTBF-4 — `__erasedAt` was previously a plaintext UTC ms integer.
+  // `__erasedAt` was previously a plaintext UTC ms integer.
   // That value alone fingerprints the erasure event (audit-log
   // exfiltration + cross-tenant correlation: "this row was erased
   // 2.3s before that one"). Bucket the timestamp to a 1-day floor so
@@ -584,7 +622,7 @@ function eraseRow(table, row) {
   var dayMs = TIME.days(1);
   out.__erasedAt = Math.floor(Date.now() / dayMs) * dayMs;
 
-  // F-RTBF-2 — under regulatory postures whose POSTURE_DEFAULTS sets
+  // Under regulatory postures whose POSTURE_DEFAULTS sets
   // requireVacuumAfterErase: true (gdpr / dpdp / pipl-cn / lgpd-br /
   // hipaa), the B-tree index pages freed by the upcoming UPDATE/DELETE
   // would otherwise linger with sealed-column ciphertext readable
@@ -662,8 +700,7 @@ function lookupHash(table, field, value) {
     if (spec.from === field) {
       var ns = namespaceFor(table, field, s.hashNamespaces);
       var normalized = spec.normalize ? spec.normalize(value) : String(value);
-      var saltHex = vault.getDerivedHashSalt().toString("hex");
-      return { field: derivedField, value: sha3Hash(saltHex + ns + normalized) };
+      return { field: derivedField, value: _computeDerivedHash(spec, s.derivedHashMode, ns, normalized) };
     }
   }
   return null;

package/lib/vendor/blamejs/lib/crypto.js

@@ -168,7 +168,7 @@ function hashFile(filePath, algorithm) {
 // `algorithms` entry. Used by hashFilesParallel below; not exported
 // directly because the common case is the parallel-many shape.
 //
-// CRYPTO-5 hardening (v0.9.58):
+// Hardening (v0.9.58):
 //   - lstat-then-stat so symlinks are detected before open; refused
 //     unless opts.followSymlinks === true (default false — a symlink-
 //     in-input-list attack lets a write-restricted caller hash files
@@ -269,9 +269,8 @@ function _hashFileMulti(filePath, algorithms, opts) {
  * SBOM regeneration / vendor-data integrity sweeps / release-asset
  * bundling — situations where N files each need both SHA-256 (legacy
  * compat) and SHA-3-512 (PQC-first) digests and rolling a worker
- * pool by hand has cost a downstream consumer (`hermitstash-sync`
- * 2026-05-13) the same two-loop, capture-N-promises, settle-Q boilerplate
- * every release.
+ * pool by hand means the same two-loop, capture-N-promises, settle-Q
+ * boilerplate every release.
  *
  * @opts
  *   algorithms?:     string[], // default ["sha256", "sha3-512"]; any node:crypto-known digest
@@ -333,7 +332,7 @@ function hashFilesParallel(filePaths, opts) {
       "crypto.hashFilesParallel: opts.onProgress must be a function when supplied"
     ));
   }
-  // CRYPTO-5 — DoS cap. Default 1 GiB per file; operators with larger
+  // DoS cap. Default 1 GiB per file; operators with larger
   // legitimate hashing workloads (firmware images, vendor packs)
   // override per-call.
   var maxBytesPerFile = opts.maxBytesPerFile !== undefined
@@ -1202,7 +1201,7 @@ function decrypt(ciphertext, privateKeys, opts) {
     }
     // Audit-emit every legacy decrypt so the migration window is
     // visible. Emit success ONLY on actual decrypt success; emit
-    // failure on throw. Codex P2 PR #74 — pre-fix the audit fired
+    // failure on throw. Before this fix, the audit fired
     // before decryptEnvelope() ran, so corrupted 0xE1 blobs / wrong
     // private keys / unsupported KEMs got logged as successful legacy
     // decrypts when the call actually threw, inflating real success

package/lib/vendor/blamejs/lib/db-query.js

@@ -33,6 +33,7 @@ var { generateToken } = require("./crypto");
 var safeJson = require("./safe-json");
 var safeJsonPath = require("./safe-jsonpath");
 var safeSql = require("./safe-sql");
+var audit = require("./audit");
 
 // "@>" / "?" / "?|" / "?&" are JSONB containment + key-existence
 // operators. Routed through safeJsonPath validation before binding so
@@ -46,7 +47,7 @@ var JSONB_CONTAINMENT_OPS = new Set(["@>"]);
 var JSONB_KEY_OPS         = new Set(["?", "?|", "?&"]);
 
 class Query {
-  constructor(database, tableName) {
+  constructor(database, tableName, opts) {
     // Identifier safety: tableName flows into SQL via interpolation
     // (parameter placeholders only bind values, not names). Validate at
     // construction so an attacker-controlled name with embedded `"` or
@@ -84,6 +85,62 @@ class Query {
     this._orderBy       = null;
     this._limit         = null;
     this._offset        = null;
+
+    // Column-membership gate. `db.from()` passes the table's
+    // declared columns + the configured gate mode so an operator-
+    // supplied column name that isn't a real column of the table is
+    // refused before it interpolates into SQL as an identifier
+    // (ORDER-BY / sealed-column-disclosure injection — CWE-89 /
+    // CWE-1336). A bare `new Query(db, name)` with no opts leaves the
+    // gate disabled (declaredColumns null), so direct/internal
+    // construction is unaffected.
+    opts = opts || {};
+    this._declaredColumns = (opts.declaredColumns instanceof Set) ? opts.declaredColumns
+      : (Array.isArray(opts.declaredColumns) ? new Set(opts.declaredColumns) : null);
+    this._columnGateMode  = opts.columnGateMode || "reject";
+    this._allowedColumns  = null;
+  }
+
+  // Restrict the operator-allowable columns to an explicit subset
+  // (tighter than the schema-declared set). Use when a query is built
+  // from request input and must only ever touch a known-safe list.
+  // Throws on a non-array or an invalid identifier.
+  allowedColumns(cols) {
+    if (!Array.isArray(cols) || cols.length === 0) {
+      throw new TypeError("allowedColumns(cols): expected a non-empty array of column names");
+    }
+    cols.forEach(_validateField);
+    this._allowedColumns = new Set(cols);
+    return this;
+  }
+
+  // Assert `field` is a member of the allowed/declared column set
+  // before it is interpolated into SQL as an identifier. The operator
+  // `allowedColumns()` set (when present) is ALWAYS enforced; the
+  // schema gate respects the configured mode ("reject" default
+  // throws | "warn" drop-silent audits + allows | "off" / no declared
+  // set skips).
+  _assertColumnMember(field, where) {
+    if (this._allowedColumns && !this._allowedColumns.has(field)) {
+      throw new Error("column '" + field + "' is not in the allowedColumns() set" +
+        (where ? " (" + where + ")" : ""));
+    }
+    if (this._declaredColumns === null || this._columnGateMode === "off") return;
+    if (this._declaredColumns.has(field)) return;
+    if (this._columnGateMode === "warn") {
+      try {
+        audit.safeEmit({
+          action:   "db.query.unknown_column",
+          outcome:  "failure",
+          metadata: { table: this._qualifiedKey, column: field, where: where || null },
+        });
+      } catch (_e) { /* drop-silent — observability sink, by design */ }
+      return;
+    }
+    throw new Error("column '" + field + "' is not a declared column of '" +
+      this._qualifiedKey + "'" + (where ? " (" + where + ")" : "") +
+      ". Declared columns: " + Array.from(this._declaredColumns).join(", ") +
+      ". Use .allowedColumns([...]) or db.init({ columnGate: 'off' }) to bypass.");
   }
 
   // Quoted SQL form: `"schema"."table"` if schema-qualified, else `"table"`.
@@ -114,7 +171,7 @@ class Query {
     if (!ALLOWED_OPS.has(op)) {
       throw new Error("invalid where operator: " + op);
     }
-    // D-M4 — JSONB / JSON-path injection guard. Routes operator-
+    // JSONB / JSON-path injection guard. Routes operator-
     // supplied JSONB containment + key-existence values through
     // safe-jsonpath before they reach the engine. Bound via `?`
     // placeholder so the value still doesn't interpolate; this is
@@ -171,6 +228,10 @@ class Query {
       value = lookup.value;
     }
     cryptoField && _validateField(field);
+    // Gate the post-sealed-rewrite physical column (derived-hash
+    // columns are declared physical columns, so the rewrite target
+    // passes membership).
+    this._assertColumnMember(field, "where");
     if (op === "IN") {
       // node:sqlite ? does not support array-binding. Pre-v0.8.18
       // `where(field, "IN", [1,2,3])` silently bound the entire
@@ -228,10 +289,11 @@ class Query {
   // text used to build expressions the chainable .where() can't express
   // (compound OR, row-value comparison for cursor pagination, etc.).
   // Placeholder count must match params.length.
-  whereRaw(sql, params) {
+  whereRaw(sql, params, opts) {
     if (typeof sql !== "string" || sql.length === 0) {
       throw new Error("whereRaw: sql must be a non-empty string");
     }
+    if (!(opts && opts.allowLiterals === true)) _assertRawNoStringLiteral(sql, "whereRaw");
     var p = Array.isArray(params) ? params : (params == null ? [] : [params]);
     // Count `?` placeholders, but skip occurrences inside string
     // literals ('...'  or "..."), line comments (-- to EOL), and
@@ -255,12 +317,15 @@ class Query {
       throw new Error("select() expects an array of column names");
     }
     columns.forEach(_validateField);
+    var self = this;
+    columns.forEach(function (c) { self._assertColumnMember(c, "select"); });
     this._select = columns.slice();
     return this;
   }
 
   orderBy(field, direction) {
     _validateField(field);
+    this._assertColumnMember(field, "orderBy");
     direction = (direction || "asc").toLowerCase();
     if (direction !== "asc" && direction !== "desc") {
       throw new Error("orderBy direction must be 'asc' or 'desc'");
@@ -348,7 +413,7 @@ class Query {
   // the bound table's sealedFields registration before it lands in the
   // operator's pipeline. For large result sets (audit exports, backup
   // table dumps) this avoids materializing the full rowset in memory.
-  // D-M5 — streamLimit ceiling enforced from the module-level db
+  // StreamLimit ceiling enforced from the module-level db
   // config; per-call opts.streamLimit overrides for one-off bumps.
   stream(opts) {
     var sql = "SELECT " + this._projection() + " FROM " + this._quotedTable() +
@@ -455,6 +520,8 @@ class Query {
       throw new Error("update changes object is empty");
     }
     setKeys.forEach(_validateField);
+    var selfUpd = this;
+    setKeys.forEach(function (k) { selfUpd._assertColumnMember(k, "update"); });
     var setClause = setKeys.map(function (k) { return '"' + k + '" = ?'; }).join(", ");
     var setValues = setKeys.map(function (k) { return sealed[k]; });
 
@@ -498,6 +565,7 @@ class Query {
       throw new Error("increment(column, delta): column must be a non-empty string");
     }
     _validateField(column);
+    this._assertColumnMember(column, "increment");
     if (delta === undefined) delta = 1;
     if (typeof delta !== "number" || !Number.isFinite(delta) || !Number.isInteger(delta)) {
       throw new Error("increment(column, delta): delta must be a finite integer (default 1)");
@@ -532,7 +600,7 @@ class Query {
     if (typeof closure !== "function") {
       throw new Error("whereGroup(closure): expected function (qb) => ...");
     }
-    var sub = new WhereBuilder();
+    var sub = new WhereBuilder(this);
     closure(sub);
     var built = sub.build();
     if (!built.sql) return this;
@@ -551,7 +619,7 @@ class Query {
       throw new Error("orWhere(...): no prior where(...) — start the chain with where(...)");
     }
     if (typeof fieldOrObjOrFn === "function") {
-      var sub = new WhereBuilder();
+      var sub = new WhereBuilder(this);
       fieldOrObjOrFn(sub);
       var built = sub.build();
       if (!built.sql) return this;
@@ -562,7 +630,7 @@ class Query {
     }
     // For non-closure shapes, build a transient single-leaf Query and
     // splice it. We compile to a `WhereBuilder` for symmetry.
-    var sub2 = new WhereBuilder();
+    var sub2 = new WhereBuilder(this);
     if (fieldOrObjOrFn !== null && typeof fieldOrObjOrFn === "object" && !Array.isArray(fieldOrObjOrFn)) {
       Object.keys(fieldOrObjOrFn).forEach(function (k) { sub2.eq(k, fieldOrObjOrFn[k]); });
     } else if (op === undefined) {
@@ -592,6 +660,8 @@ class Query {
       throw new Error("search(fields, term): fields must be a non-empty array of column names");
     }
     fields.forEach(_validateField);
+    var selfS = this;
+    fields.forEach(function (f) { selfS._assertColumnMember(f, "search"); });
     if (term === undefined || term === null) return this;
     if (typeof term !== "string") {
       throw new Error("search(fields, term): term must be a string");
@@ -684,14 +754,18 @@ class Query {
 // `.build()` returns `{ sql, params }`. Empty builder → `{ sql: "",
 // params: [] }`.
 class WhereBuilder {
-  constructor() {
+  constructor(gate) {
     this._parts = [];   // [{ joiner: "AND"|"OR", sql: "...", params: [...] }]
+    // The owning Query, so grouped/OR sub-expressions enforce the
+    // same column-membership gate as the top-level chain.
+    this._gate = gate || null;
   }
   _push(joiner, field, op, value) {
     if (typeof field !== "string" || field.length === 0) {
       throw new Error("WhereBuilder: field must be a non-empty string");
     }
     _validateField(field);
+    if (this._gate) this._gate._assertColumnMember(field, "whereGroup");
     var qf = '"' + field + '"';
     if (op === "IN" || op === "NOT IN") {
       if (!Array.isArray(value) || value.length === 0) {
@@ -723,10 +797,11 @@ class WhereBuilder {
   orLte(f, v)  { return this._push("OR", f, "<=", v); }
   orIn(f, vs)  { return this._push("OR", f, "IN", vs); }
   orLike(f, v) { return this._push("OR", f, "LIKE", v); }
-  raw(sql, params) {
+  raw(sql, params, opts) {
     if (typeof sql !== "string" || sql.length === 0) {
       throw new Error("WhereBuilder.raw: sql must be a non-empty string");
     }
+    if (!(opts && opts.allowLiterals === true)) _assertRawNoStringLiteral(sql, "WhereBuilder.raw");
     var p = Array.isArray(params) ? params : (params == null ? [] : [params]);
     if (_countPlaceholders(sql) !== p.length) {
       throw new Error("WhereBuilder.raw: placeholder count mismatch");
@@ -752,6 +827,53 @@ class WhereBuilder {
 // Tracks SQL single-quoted, double-quoted, line-comment, and block-
 // comment state to avoid counting `?` characters that are part of
 // literal text the SQL engine never interprets as a binding marker.
+// Refuse raw SQL fragments that embed a single-quoted string
+// literal. A whereRaw / WhereBuilder.raw fragment is meant to be a
+// STATIC template whose every value is bound through a `?` placeholder;
+// an embedded `'...'` literal is the signature of operator input
+// concatenated into the query (CWE-89 / CWE-564 — concat into a
+// query builder). Double-quoted identifiers (`"col"`), line comments,
+// and block comments are skipped. Operators with a deliberate static
+// literal pass `{ allowLiterals: true }`. Shares the quote/comment
+// scanning shape with _countPlaceholders.
+function _assertRawNoStringLiteral(sql, where) {
+  var i = 0;
+  var len = sql.length;
+  while (i < len) {
+    var ch = sql.charAt(i);
+    var next = i + 1 < len ? sql.charAt(i + 1) : "";
+    if (ch === '"') {
+      i += 1;
+      while (i < len) {
+        if (sql.charAt(i) === '"') {
+          if (sql.charAt(i + 1) === '"') { i += 2; continue; }
+          i += 1; break;
+        }
+        i += 1;
+      }
+      continue;
+    }
+    if (ch === "-" && next === "-") {
+      while (i < len && sql.charAt(i) !== "\n") i += 1;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < len && !(sql.charAt(i) === "*" && sql.charAt(i + 1) === "/")) i += 1;
+      i += 2;
+      continue;
+    }
+    if (ch === "'") {
+      throw new safeSql.SafeSqlError(
+        where + ": raw SQL must not contain a string literal ('...') — bind every " +
+        "value with a ? placeholder, or pass { allowLiterals: true } when the literal " +
+        "is static and operator-controlled.",
+        "sql/raw-literal");
+    }
+    i += 1;
+  }
+}
+
 function _countPlaceholders(sql) {
   var count = 0;
   var i = 0;