@mikro-orm/entity-generator 7.1.9-dev.1 → 7.1.9-dev.11

package/EntityGenerator.js

@@ -1,7 +1,7 @@
 import { EntitySchema, ReferenceKind, types, Utils, } from '@mikro-orm/core';
 import { DatabaseSchema, } from '@mikro-orm/sql';
 import { fs } from '@mikro-orm/core/fs-utils';
-import { dirname, join } from 'node:path';
+import { dirname, join, relative, resolve } from 'node:path';
 import { writeFile } from 'node:fs/promises';
 import { DefineEntitySourceFile } from './DefineEntitySourceFile.js';
 import { EntitySchemaSourceFile } from './EntitySchemaSourceFile.js';
@@ -62,6 +62,15 @@ export class EntityGenerator {
         }
         const files = this.#sources.map(file => [file.getBaseName(), file.generate()]);
         if (options.save) {
+            // generated files may only land in the project folder, or under the configured path when
+            // that points elsewhere, so a file name can never reach an arbitrary filesystem location
+            const allowedRoots = [resolve(this.#config.get('baseDir')), resolve(baseDir)];
+            for (const [fileName] of files) {
+                const target = resolve(baseDir, fileName);
+                if (!allowedRoots.some(root => !relative(root, target).startsWith('..'))) {
+                    throw new Error(`Cannot generate '${fileName}', it resolves outside of the project folder`);
+                }
+            }
             fs.ensureDir(baseDir);
             const promises = [];
             for (const [fileName, data] of files) {

package/EntitySchemaSourceFile.js

@@ -64,7 +64,7 @@ export class EntitySchemaSourceFile extends SourceFile {
             }
         }
         if (primaryProps.length > 0) {
-            const primaryPropNames = primaryProps.map(prop => `'${prop.name}'`);
+            const primaryPropNames = primaryProps.map(prop => this.quoteKey(prop.name));
             if (primaryProps.length > 1) {
                 classBody += `${' '.repeat(2)}[${this.referenceCoreImport('PrimaryKeyProp')}]?: [${primaryPropNames.join(', ')}];\n`;
             }
@@ -73,7 +73,7 @@ export class EntitySchemaSourceFile extends SourceFile {
             }
         }
         if (eagerProperties.length > 0) {
-            const eagerPropertyNames = eagerProperties.map(prop => `'${prop.name}'`).sort();
+            const eagerPropertyNames = eagerProperties.map(prop => this.quoteKey(prop.name)).sort();
             classBody += `${' '.repeat(2)}[${this.referenceCoreImport('EagerProps')}]?: ${eagerPropertyNames.join(' | ')};\n`;
         }
         classBody += props.join('');

package/NativeEnumSourceFile.js

@@ -24,10 +24,10 @@ export class NativeEnumSourceFile extends SourceFile {
         for (const enumValue of enumValues) {
             const enumName = this.namingStrategy.enumValueToEnumProperty(enumValue, this.nativeEnum.name, '', this.nativeEnum.schema);
             if (enumMode === 'dictionary') {
-                ret += `${padding}${identifierRegex.test(enumName) ? enumName : this.quote(enumName)}: ${this.quote(enumValue)},\n`;
+                ret += `${padding}${identifierRegex.test(enumName) ? enumName : this.quoteKey(enumName)}: ${this.quote(enumValue)},\n`;
             }
             else {
-                ret += `${padding}${identifierRegex.test(enumName) ? enumName : this.quote(enumName)} = ${this.quote(enumValue)},\n`;
+                ret += `${padding}${identifierRegex.test(enumName) ? enumName : this.quoteKey(enumName)} = ${this.quote(enumValue)},\n`;
             }
         }
         if (enumMode === 'dictionary') {
@@ -42,6 +42,9 @@ export class NativeEnumSourceFile extends SourceFile {
         return ret;
     }
     getBaseName(extension = '.ts') {
-        return `${this.options.fileName(this.nativeEnum.name)}${extension}`;
+        // the enum name comes from the database and ends up in a path, so path separators
+        // (and anything else that cannot appear in a file name) collapse to `_`
+        const name = this.nativeEnum.name.replaceAll(/[^\p{L}\p{N}$_-]+/gu, '_');
+        return `${this.options.fileName(name)}${extension}`;
     }
 }

package/RoutineSourceFile.js

@@ -20,7 +20,9 @@ function quoteMultiline(val) {
 }
 function toPascalCase(name) {
     const pascal = name
-        .split(/[_\s-]+/)
+        // anything that cannot appear in an identifier acts as a word separator, which keeps
+        // path separators out of both the emitted const name and the generated file name
+        .split(/[^\p{L}\p{N}$]+/u)
         .filter(Boolean)
         .map(part => part.charAt(0).toUpperCase() + part.slice(1))
         .join('');

package/SourceFile.d.ts

@@ -25,6 +25,8 @@ export declare class SourceFile {
     protected getEntityClass(classBody: string): string;
     getBaseName(extension?: string): string;
     protected quote(val: string): string;
+    /** For positions that reject a template literal: object keys, import bindings/specifiers, string literal types. */
+    protected quoteKey(val: string): string;
     protected getPropertyDefinition(prop: EntityProperty, padLeft: number): string;
     protected getEnumClassDefinition(prop: EntityProperty, padLeft: number): string;
     protected serializeObject(options: {}, wordwrap?: number, spaces?: number, level?: number): string;

package/SourceFile.js

@@ -79,7 +79,7 @@ export class SourceFile {
             }
         });
         if (primaryProps.length > 0) {
-            const primaryPropNames = primaryProps.map(prop => `'${prop.name}'`);
+            const primaryPropNames = primaryProps.map(prop => this.quoteKey(prop.name));
             if (primaryProps.length > 1) {
                 classHead += `\n${' '.repeat(2)}[${this.referenceCoreImport('PrimaryKeyProp')}]?: [${primaryPropNames.join(', ')}];\n`;
             }
@@ -88,7 +88,7 @@ export class SourceFile {
             }
         }
         if (eagerProperties.length > 0) {
-            const eagerPropertyNames = eagerProperties.map(prop => `'${prop.name}'`).sort();
+            const eagerPropertyNames = eagerProperties.map(prop => this.quoteKey(prop.name)).sort();
             classHead += `\n${' '.repeat(2)}[${this.referenceCoreImport('EagerProps')}]?: ${eagerPropertyNames.join(' | ')};\n`;
         }
         ret += this.getEntityClass(classBody ? `${classHead}\n${classBody}` : classHead);
@@ -242,22 +242,22 @@ export class SourceFile {
                 if (file.name === '') {
                     continue;
                 }
-                importMap.set(file.path, `import ${this.quote(file.name)};`);
+                importMap.set(file.path, `import ${this.quoteKey(file.name)};`);
                 continue;
             }
             if (file.name === '') {
-                importMap.set(file.path, `import * as ${entity} from ${this.quote(file.path)};`);
+                importMap.set(file.path, `import * as ${entity} from ${this.quoteKey(file.path)};`);
                 continue;
             }
             if (file.name === 'default') {
-                importMap.set(file.path, `import ${entity} from ${this.quote(file.path)};`);
+                importMap.set(file.path, `import ${entity} from ${this.quoteKey(file.path)};`);
                 continue;
             }
             if (file.name === entity) {
-                importMap.set(file.path, `import { ${entity} } from ${this.quote(file.path)};`);
+                importMap.set(file.path, `import { ${entity} } from ${this.quoteKey(file.path)};`);
                 continue;
             }
-            importMap.set(file.path, `import { ${identifierRegex.test(file.name) ? file.name : this.quote(file.name)} as ${entity} } from ${this.quote(file.path)};`);
+            importMap.set(file.path, `import { ${identifierRegex.test(file.name) ? file.name : this.quoteKey(file.name)} as ${entity} } from ${this.quoteKey(file.path)};`);
         }
         if (this.enumImports.size) {
             for (const [name, exports] of this.enumImports.entries()) {
@@ -265,7 +265,7 @@ export class SourceFile {
                     path: `${basePath}/${this.options.fileName(name)}${extension}`,
                     name,
                 };
-                importMap.set(file.path, `import { ${exports.join(', ')} } from ${this.quote(file.path)};`);
+                importMap.set(file.path, `import { ${exports.join(', ')} } from ${this.quoteKey(file.path)};`);
             }
         }
         for (const key of [...importMap.keys()].sort()) {
@@ -294,12 +294,26 @@ export class SourceFile {
     }
     quote(val) {
         const backtick = val.startsWith(`'`) || val.includes('\n');
-        /* v8 ignore next */
-        return backtick ? `\`${val.replaceAll('`', '\\``')}\`` : `'${val.replaceAll(`'`, `\\'`)}'`;
+        // Backslashes first, so the escapes added below don't get neutralized by a preceding `\`.
+        // A raw `\r` is a syntax error in a string literal and silently normalizes to `\n` in a template one.
+        const escaped = val.replaceAll('\\', '\\\\').replaceAll('\r', '\\r');
+        return backtick
+            ? `\`${escaped.replaceAll('`', '\\`').replaceAll('${', '\\${')}\``
+            : `'${escaped.replaceAll(`'`, `\\'`)}'`;
+    }
+    /** For positions that reject a template literal: object keys, import bindings/specifiers, string literal types. */
+    quoteKey(val) {
+        const escaped = val
+            .replaceAll('\\', '\\\\')
+            .replaceAll('\r', '\\r')
+            .replaceAll('\n', '\\n')
+            .replaceAll('\t', '\\t')
+            .replaceAll(`'`, `\\'`);
+        return `'${escaped}'`;
     }
     getPropertyDefinition(prop, padLeft) {
         const padding = ' '.repeat(padLeft);
-        const propName = identifierRegex.test(prop.name) ? prop.name : this.quote(prop.name);
+        const propName = identifierRegex.test(prop.name) ? prop.name : this.quoteKey(prop.name);
         const enumMode = this.options.enumMode;
         let hiddenType = '';
         if (prop.hidden) {
@@ -419,10 +433,10 @@ export class SourceFile {
         for (const enumValue of enumValues) {
             const enumName = this.namingStrategy.enumValueToEnumProperty(enumValue, prop.fieldNames[0], this.meta.collection, this.meta.schema);
             if (enumMode === 'dictionary') {
-                ret += `${padding}${identifierRegex.test(enumName) ? enumName : this.quote(enumName)}: ${formatValue(enumValue)},\n`;
+                ret += `${padding}${identifierRegex.test(enumName) ? enumName : this.quoteKey(enumName)}: ${formatValue(enumValue)},\n`;
             }
             else {
-                ret += `${padding}${identifierRegex.test(enumName) ? enumName : this.quote(enumName)} = ${formatValue(enumValue)},\n`;
+                ret += `${padding}${identifierRegex.test(enumName) ? enumName : this.quoteKey(enumName)} = ${formatValue(enumValue)},\n`;
             }
         }
         if (enumMode === 'dictionary') {
@@ -452,7 +466,7 @@ export class SourceFile {
         const entries = Object.entries(options);
         return `{${doIndent ? `\n${' '.repeat(spaces)}` : ' '}${entries
             .map(([opt, val]) => {
-            const key = identifierRegex.test(opt) ? opt : this.quote(opt);
+            const key = identifierRegex.test(opt) ? opt : this.quoteKey(opt);
             return `${doIndent ? ' '.repeat(level * 2 + (spaces + 2)) : ''}${key}: ${this.serializeValue(val, typeof nextWordwrap === 'number' ? nextWordwrap - key.length - 2 /* ': '.length*/ : undefined, doIndent ? spaces : undefined, level + 1)}`;
         })
             .join(sep)}${doIndent ? `${entries.length > 0 ? ',\n' : ''}${' '.repeat(spaces + level * 2)}` : ' '}}`;
@@ -673,7 +687,8 @@ export class SourceFile {
                 prop.defaultRaw !== 'null' &&
                 prop.defaultRaw !== '' &&
                 prop.defaultRaw !== (typeof prop.default === 'string' ? this.quote(prop.default) : `${prop.default}`)) {
-                options.defaultRaw = `\`${prop.defaultRaw}\``;
+                // kept as a template literal for readability, but raw SQL may contain `${`, which would otherwise interpolate
+                options.defaultRaw = `\`${prop.defaultRaw.replaceAll('\\', '\\\\').replaceAll('`', '\\`').replaceAll('${', '\\${')}\``;
             }
             else if (!(typeof prop.default === 'undefined' || prop.default === null) &&
                 (prop.ref ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/entity-generator",
-  "version": "7.1.9-dev.1",
+  "version": "7.1.9-dev.11",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",
@@ -47,13 +47,13 @@
     "copy": "node ../../scripts/copy.mjs"
   },
   "dependencies": {
-    "@mikro-orm/sql": "7.1.9-dev.1"
+    "@mikro-orm/sql": "7.1.9-dev.11"
   },
   "devDependencies": {
     "@mikro-orm/core": "^7.1.8"
   },
   "peerDependencies": {
-    "@mikro-orm/core": "7.1.9-dev.1"
+    "@mikro-orm/core": "7.1.9-dev.11"
   },
   "engines": {
     "node": ">= 22.17.0"