@blogic-cz/agent-tools 0.1.0

package/src/db-tool/security.ts

@@ -0,0 +1,116 @@
+import type { SchemaErrorInfo } from "./types";
+
+const MUTATION_PATTERNS = [
+  /^\s*UPDATE\s+/i,
+  /^\s*INSERT\s+/i,
+  /^\s*DELETE\s+/i,
+  /^\s*TRUNCATE\s+/i,
+  /^\s*DROP\s+/i,
+  /^\s*ALTER\s+/i,
+  /^\s*CREATE\s+/i,
+];
+
+const TABLE_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+
+/**
+ * Strip SQL comments (block and line) while preserving string literals.
+ * This prevents bypass via inline comment masking before DELETE statements.
+ */
+export function stripSqlComments(sql: string): string {
+  let result = "";
+  let i = 0;
+  const len = sql.length;
+
+  while (i < len) {
+    const ch = sql[i];
+    const next = i + 1 < len ? sql[i + 1] : "";
+
+    // Single-quoted string literal — skip through
+    if (ch === "'") {
+      result += ch;
+      i++;
+      while (i < len) {
+        if (sql[i] === "'" && i + 1 < len && sql[i + 1] === "'") {
+          result += "''";
+          i += 2;
+        } else if (sql[i] === "'") {
+          result += "'";
+          i++;
+          break;
+        } else {
+          result += sql[i];
+          i++;
+        }
+      }
+      continue;
+    }
+
+    // Block comment /* ... */
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i + 1 < len && !(sql[i] === "*" && sql[i + 1] === "/")) {
+        i++;
+      }
+      i += 2; // skip closing */
+      result += " "; // replace comment with space
+      continue;
+    }
+
+    // Line comment -- ...
+    if (ch === "-" && next === "-") {
+      i += 2;
+      while (i < len && sql[i] !== "\n") {
+        i++;
+      }
+      result += " ";
+      continue;
+    }
+
+    result += ch;
+    i++;
+  }
+
+  return result;
+}
+
+export function isMutationQuery(sql: string): boolean {
+  const stripped = stripSqlComments(sql);
+  return MUTATION_PATTERNS.some((pattern) => pattern.test(stripped));
+}
+
+export function isValidTableName(tableName: string): boolean {
+  return TABLE_NAME_PATTERN.test(tableName);
+}
+
+export function detectSchemaError(stderr: string, sql: string): SchemaErrorInfo {
+  const trimmedError = stderr.trim();
+
+  if (!trimmedError.includes("does not exist")) {
+    return {
+      type: null,
+      missingName: null,
+      tableName: null,
+    };
+  }
+
+  const relationMatch = trimmedError.match(/relation "([^"]+)" does not exist/);
+  if (relationMatch) {
+    return {
+      type: "table_not_found",
+      missingName: relationMatch[1],
+      tableName: null,
+    };
+  }
+
+  const columnMatch = trimmedError.match(/column "([^"]+)" does not exist/);
+  if (columnMatch) {
+    const tableFromSql = sql.match(/FROM\s+["']?(\w+)["']?/i);
+    return {
+      type: "column_not_found",
+      missingName: columnMatch[1],
+      tableName: tableFromSql?.[1] ?? null,
+    };
+  }
+
+  return { type: null, missingName: null, tableName: null };
+}