@budibase/server 1.0.80 → 1.0.81-alpha.2

package/dist/threads/query.js

@@ -12,8 +12,9 @@ const threadUtils = require("./utils");
 threadUtils.threadSetup();
 const ScriptRunner = require("../utilities/scriptRunner");
 const { integrations } = require("../integrations");
-const { processStringSync } = require("@budibase/string-templates");
+const { processStringSync, findHBSBlocks, } = require("@budibase/string-templates");
 const { doInAppContext, getAppDB } = require("@budibase/backend-core/context");
+const { isSQL } = require("../integrations/utils");
 class QueryRunner {
     constructor(input, flags = { noRecursiveQuery: false }) {
         this.datasource = input.datasource;
@@ -31,21 +32,45 @@ class QueryRunner {
         this.queryResponse = {};
         this.hasRerun = false;
     }
+    interpolateSQL(fields, parameters, integration) {
+        let sql = fields.sql;
+        if (!sql) {
+            return fields;
+        }
+        const bindings = findHBSBlocks(sql);
+        let variables = [];
+        for (let binding of bindings) {
+            let variable = integration.getBindingIdentifier();
+            variables.push(binding);
+            sql = sql.replace(binding, variable);
+        }
+        // replicate the knex structure
+        fields.sql = sql;
+        fields.bindings = this.enrichQueryFields(variables, parameters);
+        return fields;
+    }
     execute() {
         return __awaiter(this, void 0, void 0, function* () {
             let { datasource, fields, queryVerb, transformer } = this;
+            const Integration = integrations[datasource.source];
+            if (!Integration) {
+                throw "Integration type does not exist.";
+            }
+            const integration = new Integration(datasource.config);
             // pre-query, make sure datasource variables are added to parameters
             const parameters = yield this.addDatasourceVariables();
-            let query = this.enrichQueryFields(fields, parameters);
+            let query;
+            // handle SQL injections by interpolating the variables
+            if (isSQL(datasource)) {
+                query = this.interpolateSQL(fields, parameters, integration);
+            }
+            else {
+                query = this.enrichQueryFields(fields, parameters);
+            }
             // Add pagination values for REST queries
             if (this.pagination) {
                 query.paginationValues = this.pagination;
             }
-            const Integration = integrations[datasource.source];
-            if (!Integration) {
-                throw "Integration type does not exist.";
-            }
-            const integration = new Integration(datasource.config);
             let output = threadUtils.formatResponse(yield integration[queryVerb](query));
             let rows = output, info = undefined, extra = undefined, pagination = undefined;
             if (threadUtils.hasExtraData(output)) {
@@ -168,7 +193,7 @@ class QueryRunner {
         });
     }
     enrichQueryFields(fields, parameters = {}) {
-        const enrichedQuery = {};
+        const enrichedQuery = Array.isArray(fields) ? [] : {};
         // enrich the fields with dynamic parameters
         for (let key of Object.keys(fields)) {
             if (fields[key] == null) {