@mikro-orm/entity-generator 7.1.9-dev.5 → 7.1.9-dev.7

package/EntityGenerator.js

@@ -1,7 +1,7 @@
 import { EntitySchema, ReferenceKind, types, Utils, } from '@mikro-orm/core';
 import { DatabaseSchema, } from '@mikro-orm/sql';
 import { fs } from '@mikro-orm/core/fs-utils';
-import { dirname, join } from 'node:path';
+import { dirname, join, relative, resolve } from 'node:path';
 import { writeFile } from 'node:fs/promises';
 import { DefineEntitySourceFile } from './DefineEntitySourceFile.js';
 import { EntitySchemaSourceFile } from './EntitySchemaSourceFile.js';
@@ -62,6 +62,15 @@ export class EntityGenerator {
         }
         const files = this.#sources.map(file => [file.getBaseName(), file.generate()]);
         if (options.save) {
+            // generated files may only land in the project folder, or under the configured path when
+            // that points elsewhere, so a file name can never reach an arbitrary filesystem location
+            const allowedRoots = [resolve(this.#config.get('baseDir')), resolve(baseDir)];
+            for (const [fileName] of files) {
+                const target = resolve(baseDir, fileName);
+                if (!allowedRoots.some(root => !relative(root, target).startsWith('..'))) {
+                    throw new Error(`Cannot generate '${fileName}', it resolves outside of the project folder`);
+                }
+            }
             fs.ensureDir(baseDir);
             const promises = [];
             for (const [fileName, data] of files) {

package/NativeEnumSourceFile.js

@@ -42,6 +42,9 @@ export class NativeEnumSourceFile extends SourceFile {
         return ret;
     }
     getBaseName(extension = '.ts') {
-        return `${this.options.fileName(this.nativeEnum.name)}${extension}`;
+        // the enum name comes from the database and ends up in a path, so path separators
+        // (and anything else that cannot appear in a file name) collapse to `_`
+        const name = this.nativeEnum.name.replaceAll(/[^\p{L}\p{N}$_-]+/gu, '_');
+        return `${this.options.fileName(name)}${extension}`;
     }
 }

package/RoutineSourceFile.js

@@ -20,7 +20,9 @@ function quoteMultiline(val) {
 }
 function toPascalCase(name) {
     const pascal = name
-        .split(/[_\s-]+/)
+        // anything that cannot appear in an identifier acts as a word separator, which keeps
+        // path separators out of both the emitted const name and the generated file name
+        .split(/[^\p{L}\p{N}$]+/u)
         .filter(Boolean)
         .map(part => part.charAt(0).toUpperCase() + part.slice(1))
         .join('');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/entity-generator",
-  "version": "7.1.9-dev.5",
+  "version": "7.1.9-dev.7",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",
@@ -47,13 +47,13 @@
     "copy": "node ../../scripts/copy.mjs"
   },
   "dependencies": {
-    "@mikro-orm/sql": "7.1.9-dev.5"
+    "@mikro-orm/sql": "7.1.9-dev.7"
   },
   "devDependencies": {
     "@mikro-orm/core": "^7.1.8"
   },
   "peerDependencies": {
-    "@mikro-orm/core": "7.1.9-dev.5"
+    "@mikro-orm/core": "7.1.9-dev.7"
   },
   "engines": {
     "node": ">= 22.17.0"