@mlagie/sql-connector 1.4.9 → 2.0.0

package/src/models/ModelInstance.js

@@ -3,6 +3,8 @@ const { getConnexion } = require("../db/connexion");
 const formatObject = require("../utils/formatObject");
 const generateCondition = require("../utils/generateCondition");
 const util = require("util");
+const { serveur } = require("@mlagie/logger");
+const { getSafe, setSafe } = require("../utils/security/safe");
 
 /**
  * Represents an instance of a database model.
@@ -36,6 +38,34 @@ class ModelInstance {
                 enumerable: false
             }
         });
+        const row = this._getTargetRow();
+        if (row && typeof row === 'object') {
+            Object.keys(row).forEach(key => {
+                Object.defineProperty(this, key, {
+                    get: () => {
+                        const val = getSafe(row, key);
+                        if (typeof val === 'string' && val.trim().startsWith('{') && val.trim().endsWith('}')) {
+                            try { return JSON.parse(val); } catch (e) { return val; }
+                        }
+                        return val;
+                    },
+                    set: (newVal) => {
+                        setSafe(row, key, newVal);
+                    },
+                    enumerable: true,
+                    configurable: true
+                });
+            });
+        }
+    }
+
+    /**
+     * Extract the actual data row by managing the database driver's structure [rows, fields]
+     * @private
+     */
+    _getTargetRow() {
+        const rows = Array.isArray(this.data) && Array.isArray(this.data[0]) ? this.data[0] : this.data;
+        return Array.isArray(rows) ? rows[0] : rows;
     }
 
     getRecordData() {
@@ -60,35 +90,47 @@ class ModelInstance {
     async updateOne(model) {
         const setClause = generateCondition(formatObject(model), true);
 
-        // prefer primary key(s) in WHERE to avoid mismatches on nullable/text fields
         let whereClause;
         try {
-            const rec = this.getRecordData();
+            const recordsArray = this.getRecordData();
+
+            let rawRec = Array.isArray(recordsArray) ? recordsArray[0] : recordsArray;
+
+            if (typeof rawRec === 'string') {
+                try {
+                    rawRec = JSON.parse(rawRec);
+                } catch (e) {  }
+            }
+            const rec = rawRec;
+
             const schemaDict = this.schema && this.schema.schemaDict ? this.schema.schemaDict : null;
             if (schemaDict) {
                 const pkKeys = Object.entries(schemaDict).filter(([k, v]) => v && v.primary_key === true).map(([k]) => k);
                 if (pkKeys.length > 0) {
                     const pkObj = {};
                     for (const k of pkKeys) {
-                        if (rec && Object.prototype.hasOwnProperty.call(rec, k)) pkObj[k] = rec[k];
+                        if (rec && Object.prototype.hasOwnProperty.call(rec, k)) setSafe(pkObj, k, getSafe(rec, k));
                     }
                     if (Object.keys(pkObj).length > 0) whereClause = generateCondition(formatObject(pkObj), false, this.schema);
                 }
             }
             if (!whereClause) whereClause = generateCondition(formatObject(rec), false, this.schema);
         } catch (e) {
-            whereClause = generateCondition(formatObject(this.getRecordData()), false, this.schema);
+            let fallbackRec = this.getRecordData();
+            if (Array.isArray(fallbackRec)) fallbackRec = fallbackRec[0];
+            if (typeof fallbackRec === 'string') { try { fallbackRec = JSON.parse(fallbackRec); } catch (e) { } }
+            whereClause = generateCondition(formatObject(fallbackRec), false, this.schema);
         }
+
         const sql_request = `UPDATE ${this.name} SET ${setClause} WHERE ${whereClause}`;
 
         const [result] = await getConnexion().promise().query(sql_request).catch((err) => {
-            error(`Error executing query: ${err}`);
+            error(`Error executing query updateOne: ${err}`);
             throw err;
         });
 
         const affected = result && (result.affectedRows !== undefined ? result.affectedRows : 0);
 
-        // Update in-memory data if DB was modified
         if (affected > 0) {
             const record = this.getRecordData();
             if (Array.isArray(this.data)) {
@@ -117,7 +159,7 @@ class ModelInstance {
 
                 resolve(1);
             }).catch((err) => {
-                error(`Error executing query: ${err}`);
+                error(`Error executing query delete: ${err}`);
                 return 0;
             });
         });
@@ -137,7 +179,7 @@ class ModelInstance {
 
                 resolve(1);
             }).catch((err) => {
-                error(`Error executing query: ${err}`);
+                error(`Error executing query deleteOne: ${err}`);
                 return 0;
             });
         });
@@ -154,7 +196,7 @@ class ModelInstance {
             await getConnexion().promise().query(custom).then((rows) => {
                 if (rows.length == 0) return resolve(0);
 
-                resolve(new ModelInstance(this.name, rows[0], this.schema));
+                resolve(new ModelInstance(this.name, rows, this.schema)).data;
             }).catch((err) => {
                 error(`Error executing query: ${err}`);
                 return;
@@ -163,4 +205,4 @@ class ModelInstance {
     }
 }
 
-module.exports = {ModelInstance}
+module.exports = { ModelInstance }

package/src/utils/buildQuery.js

@@ -0,0 +1,72 @@
+const formatObject = require("./formatObject");
+const generateCondition = require("./generateCondition");
+
+function buildField(field) {
+    if (typeof field === 'string') {
+        return field;
+    }
+
+    let sql = '';
+
+    if (field.sum)
+        sql = `SUM(${field.sum})`;
+    else if (field.dateFormat) {
+        const [col, format] = field.dateFormat;
+        sql = `DATE_FORMAT(${col}, '${format}')`;
+    }
+    else if (field.col)
+        sql = field.col;
+
+    if (field.as)
+        sql += ` AS ${field.as}`;
+    else if (field.sum)
+        sql += ` AS ${field.sum}`;
+    return sql;
+}
+
+function buildSelect(select = []) {
+    if (!select || select.length === 0) {
+        return '*';
+    }
+
+    return select
+        .map(field => buildField(field))
+        .join(',\n');
+}
+
+function buildQueryParts(options) {
+    const parts = [];
+
+    if (options.where) {
+        if (typeof options.where === 'string') {
+            parts.push(`WHERE ${options.where}`);
+        } else {
+            parts.push(`WHERE ${generateCondition(formatObject(options.where))}`);
+        }
+    }
+
+    if (options.groupBy) {
+        parts.push(`GROUP BY ${options.groupBy.join(', ')}`);
+    }
+
+    if (options.having) {
+        parts.push(`HAVING ${options.having}`);
+    }
+
+    if (options.orderBy) {
+        const order = options.orderBy.map(o =>
+            typeof o === 'string'
+                ? o
+                : `${o.field} ${o.direction || 'ASC'}`
+        );
+        parts.push(`ORDER BY ${order.join(', ')}`);
+    }
+
+    if (options.limit) {
+        parts.push(`LIMIT ${options.limit}`);
+    }
+
+    return parts.join('\n\n');
+}
+
+module.exports = { buildQueryParts, buildSelect }

package/src/utils/formatObject.js

@@ -1,10 +1,12 @@
+const { getSafe, setSafe } = require("./security/safe");
+
 module.exports = function (obj) {
     for (const key in obj) {
         if (obj.hasOwnProperty(key)) {
-            const value = obj[key];
+            const value = getSafe(obj, key);
             if (value instanceof Date) {
                 // convert Date to MySQL DATETIME (no timezone)
-                obj[key] = value.toISOString().slice(0, 19).replace('T', ' ');
+                setSafe(obj, key, value.toISOString().slice(0, 19).replace('T', ' '));
                 continue;
             }
 
@@ -17,13 +19,13 @@ module.exports = function (obj) {
                 }
                 // unescape common escaped quotes
                 v = v.replace(/\\"/g, '"').replace(/\\'/g, "'");
-                obj[key] = v;
+                setSafe(obj, key, v);
                 continue;
             }
 
             if (typeof value === "object") {
                 // stringify objects and escape single quotes for SQL safety
-                obj[key] = JSON.stringify(value).replace(/'/g, "\\'");
+                setSafe(obj, key, JSON.stringify(value).replace(/'/g, "\\'"));
             }
         }
     }

package/src/utils/generateCondition.js

@@ -1,3 +1,5 @@
+const { getSafe } = require("./security/safe");
+
 /**
  * Generates an SQL_request condition from a filter object.
  * 
@@ -19,17 +21,17 @@ module.exports = function (filter, isUpdate = false, schema = null) {
     const keys = Object.keys(filter);
     const values = Object.values(filter);
 
-    const filteredKeys = isUpdate ? keys.filter(key => filter[key] !== undefined) : keys;
-    const filteredValues = isUpdate ? filteredKeys.map(key => filter[key]) : values;
+    const filteredKeys = isUpdate ? keys.filter(key => getSafe(filter, key) !== undefined) : keys;
+    const filteredValues = isUpdate ? filteredKeys.map(key => getSafe(filter, key)) : values;
 
     if (!isUpdate && schema && schema.schemaDict) {
         const uniqueKeys = filteredKeys.filter(key => {
-            const field = schema.schemaDict[key];
+            const field = getSafe(schema.schemaDict, key);
             return field && field.unique === true;
         });
         if (uniqueKeys.length > 0) {
             return uniqueKeys.map(key => {
-                let value = filter[key];
+                let value = getSafe(filter, key);
                 // normalize strings that may contain surrounding quotes or escaped quotes
                 if (typeof value === 'string') {
                     value = value.trim();
@@ -58,7 +60,8 @@ module.exports = function (filter, isUpdate = false, schema = null) {
 
     // Comportement par défaut
     const conditions = filteredKeys.map((key, index) => {
-        let value = filteredValues[index];
+        let value = getSafe(filteredValues, index);
+
         if (typeof value === 'string') {
             value = value.trim();
             if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
@@ -81,7 +84,7 @@ module.exports = function (filter, isUpdate = false, schema = null) {
         if ((value === null || value === "null") && isUpdate == false) return `${key} IS NULL`;
 
         // handle date-like strings when schema tells us the field is temporal
-        const fieldDef = schema && schema.schemaDict ? schema.schemaDict[key] : null;
+        const fieldDef = schema && schema.schemaDict ? getSafe(schema.schemaDict, key) : null;
         let fieldType = null;
         if (fieldDef) {
             if (fieldDef.type && fieldDef.type.name !== undefined) fieldType = fieldDef.type.name;

package/src/utils/security/safe.js

@@ -0,0 +1,35 @@
+/**
+ * Blacklist of prohibited keys to prevent prototype pollution.
+ */
+const BLACKLIST = new Set(['__proto__', 'constructor', 'prototype']);
+
+/**
+ * Extracts a value in a secure manner from an object.
+ * @param {Object} obj - The target object
+ * @param {string} key - The key or property to read
+ * @returns {*} The value or undefined if not found / prohibited
+ */
+function getSafe(obj, key) {
+    if (!obj || BLACKLIST.has(key)) {
+        return undefined;
+    }
+    
+    return Reflect.get(obj, key);
+}
+
+/**
+ * Sets a value in a secure manner within an object.
+ * @param {Object} obj - The target object
+ * @param {string} key - The key or property to write
+ * @param {*} value - The value to assign
+ * @returns {boolean} True if the operation was successful, false otherwise
+ */
+function setSafe(obj, key, value) {
+    if (!obj || BLACKLIST.has(key)) {
+        return false;
+    }
+    
+    return Reflect.set(obj, key, value);
+}
+
+module.exports = { getSafe, setSafe };