@oino-ts/blob 1.0.5 → 1.0.7

package/dist/cjs/OINOBlob.js

@@ -10,6 +10,7 @@ const common_1 = require("@oino-ts/common");
 const BLOB_LIKE_ESCAPE_REGEX = /[.*+?^${}()|[\]\\]/g;
 const BLOB_LIKE_PERCENT_REGEX = /%/g;
 const BLOB_LIKE_UNDERSCORE_REGEX = /_/g;
+const BLOB_SANITIZE_DEFAULT_REGEX = /[\x00-\x1f\x7f]/g;
 /**
  * Abstract base class for blob storage backends.  Subclasses implement
  * the two core operations (`listEntries` and `fetchEntry`) for a specific
@@ -53,6 +54,20 @@ class OINOBlob extends common_1.OINODataSource {
         }
         return v;
     }
+    // ── Blob name sanitization ──────────────────────────────────────────────
+    /**
+     * Sanitize a blob name by replacing characters that are illegal or unsafe
+     * on this storage backend with `_`.
+     *
+     * The base implementation strips ASCII control characters (U+0000–U+001F
+     * and U+007F).  Subclasses should override to apply additional
+     * platform-specific rules.
+     *
+     * @param name raw blob name (path within the container)
+     */
+    sanitizeName(name) {
+        return name.replace(BLOB_SANITIZE_DEFAULT_REGEX, "_");
+    }
     // ── Blob-specific filter helper ───────────────────────────────────────
     /**
      * Test whether a blob entry matches an `OINOQueryFilter` predicate.

package/dist/cjs/OINOBlobApi.js

@@ -104,7 +104,7 @@ class OINOBlobApi extends common_1.OINOApi {
             else {
                 // ── Download blob ────────────────────────────────────────────
                 try {
-                    const name = decodeURIComponent(request.rowId);
+                    const name = this.blob.sanitizeName(decodeURIComponent(request.rowId));
                     const fetch_result = await this.blob.fetchEntry(name);
                     result.blobData = fetch_result.content;
                     result.blobDataType = fetch_result.contentType;
@@ -121,7 +121,7 @@ class OINOBlobApi extends common_1.OINOApi {
             }
             else {
                 try {
-                    const name = decodeURIComponent(request.rowId);
+                    const name = this.blob.sanitizeName(decodeURIComponent(request.rowId));
                     const content_type = request.headers.get("content-type") ?? "application/octet-stream";
                     const data = request.rowData;
                     const content = data instanceof Uint8Array ? data : request.bodyAsBuffer();
@@ -139,7 +139,7 @@ class OINOBlobApi extends common_1.OINOApi {
             }
             else {
                 try {
-                    const name = decodeURIComponent(request.rowId);
+                    const name = this.blob.sanitizeName(decodeURIComponent(request.rowId));
                     await this.blob.deleteEntry(name);
                 }
                 catch (e) {

package/dist/esm/OINOBlob.js

@@ -7,6 +7,7 @@ import { OINODataSource, OINOQueryBooleanOperation, OINOQueryComparison, OINOQue
 const BLOB_LIKE_ESCAPE_REGEX = /[.*+?^${}()|[\]\\]/g;
 const BLOB_LIKE_PERCENT_REGEX = /%/g;
 const BLOB_LIKE_UNDERSCORE_REGEX = /_/g;
+const BLOB_SANITIZE_DEFAULT_REGEX = /[\x00-\x1f\x7f]/g;
 /**
  * Abstract base class for blob storage backends.  Subclasses implement
  * the two core operations (`listEntries` and `fetchEntry`) for a specific
@@ -50,6 +51,20 @@ export class OINOBlob extends OINODataSource {
         }
         return v;
     }
+    // ── Blob name sanitization ──────────────────────────────────────────────
+    /**
+     * Sanitize a blob name by replacing characters that are illegal or unsafe
+     * on this storage backend with `_`.
+     *
+     * The base implementation strips ASCII control characters (U+0000–U+001F
+     * and U+007F).  Subclasses should override to apply additional
+     * platform-specific rules.
+     *
+     * @param name raw blob name (path within the container)
+     */
+    sanitizeName(name) {
+        return name.replace(BLOB_SANITIZE_DEFAULT_REGEX, "_");
+    }
     // ── Blob-specific filter helper ───────────────────────────────────────
     /**
      * Test whether a blob entry matches an `OINOQueryFilter` predicate.

package/dist/esm/OINOBlobApi.js

@@ -100,7 +100,7 @@ export class OINOBlobApi extends OINOApi {
             else {
                 // ── Download blob ────────────────────────────────────────────
                 try {
-                    const name = decodeURIComponent(request.rowId);
+                    const name = this.blob.sanitizeName(decodeURIComponent(request.rowId));
                     const fetch_result = await this.blob.fetchEntry(name);
                     result.blobData = fetch_result.content;
                     result.blobDataType = fetch_result.contentType;
@@ -117,7 +117,7 @@ export class OINOBlobApi extends OINOApi {
             }
             else {
                 try {
-                    const name = decodeURIComponent(request.rowId);
+                    const name = this.blob.sanitizeName(decodeURIComponent(request.rowId));
                     const content_type = request.headers.get("content-type") ?? "application/octet-stream";
                     const data = request.rowData;
                     const content = data instanceof Uint8Array ? data : request.bodyAsBuffer();
@@ -135,7 +135,7 @@ export class OINOBlobApi extends OINOApi {
             }
             else {
                 try {
-                    const name = decodeURIComponent(request.rowId);
+                    const name = this.blob.sanitizeName(decodeURIComponent(request.rowId));
                     await this.blob.deleteEntry(name);
                 }
                 catch (e) {

package/dist/types/OINOBlob.d.ts

@@ -22,6 +22,17 @@ export declare abstract class OINOBlob extends OINODataSource {
     printCellAsValue(cellValue: OINODataCell, _sqlType: string): string;
     printStringValue(s: string): string;
     parseValueAsCell(v: OINODataCell, nativeType: string): OINODataCell;
+    /**
+     * Sanitize a blob name by replacing characters that are illegal or unsafe
+     * on this storage backend with `_`.
+     *
+     * The base implementation strips ASCII control characters (U+0000–U+001F
+     * and U+007F).  Subclasses should override to apply additional
+     * platform-specific rules.
+     *
+     * @param name raw blob name (path within the container)
+     */
+    sanitizeName(name: string): string;
     /**
      * Test whether a blob entry matches an `OINOQueryFilter` predicate.
      * Used for in-memory (result) filtering when the storage backend cannot

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oino-ts/blob",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "OINO TS library package for publishing blob storage as a REST API.",
   "author": "Matias Kiviniemi (pragmatta)",
   "license": "MPL-2.0",
@@ -19,13 +19,13 @@
   "module": "./dist/esm/index.js",
   "types": "./dist/types/index.d.ts",
   "dependencies": {
-    "@oino-ts/common": "1.0.5",
+    "@oino-ts/common": "1.0.7",
     "oino-ts": "file:.."
   },
   "devDependencies": {
-    "@oino-ts/types": "1.0.5",
+    "@oino-ts/types": "1.0.7",
     "@types/bun": "^1.1.14",
-    "@types/node": "^21.0.50",
+    "@types/node": "^21.0.70",
     "typescript": "~5.9.0"
   },
   "files": [

package/src/OINOBlob.ts

@@ -11,6 +11,8 @@ const BLOB_LIKE_ESCAPE_REGEX = /[.*+?^${}()|[\]\\]/g
 const BLOB_LIKE_PERCENT_REGEX = /%/g
 const BLOB_LIKE_UNDERSCORE_REGEX = /_/g
 
+const BLOB_SANITIZE_DEFAULT_REGEX = /[\x00-\x1f\x7f]/g
+
 /**
  * Abstract base class for blob storage backends.  Subclasses implement
  * the two core operations (`listEntries` and `fetchEntry`) for a specific
@@ -62,6 +64,22 @@ export abstract class OINOBlob extends OINODataSource {
         return v
     }
 
+    // ── Blob name sanitization ──────────────────────────────────────────────
+
+    /**
+     * Sanitize a blob name by replacing characters that are illegal or unsafe
+     * on this storage backend with `_`.
+     *
+     * The base implementation strips ASCII control characters (U+0000–U+001F
+     * and U+007F).  Subclasses should override to apply additional
+     * platform-specific rules.
+     *
+     * @param name raw blob name (path within the container)
+     */
+    sanitizeName(name: string): string {
+        return name.replace(BLOB_SANITIZE_DEFAULT_REGEX, "_")
+    }
+
     // ── Blob-specific filter helper ───────────────────────────────────────
 
     /**

package/src/OINOBlobApi.test.ts

@@ -15,6 +15,15 @@ import { OINOBlob, OINOBlobApi, OINOBlobApiResult, OINOBlobFactory, type OINOBlo
 const OINOCLOUD_TEST_BLOB_AZURE_CONSTR = process.env.OINOCLOUD_TEST_BLOB_AZURE_CONSTR || console.error("OINOCLOUD_TEST_BLOB_AZURE_CONSTR not set") || ""
 const OINOCLOUD_TEST_BLOB_S3_CONSTR = process.env.OINOCLOUD_TEST_BLOB_S3_CONSTR || console.error("OINOCLOUD_TEST_BLOB_S3_CONSTR not set") || ""
 
+type OINOBlobSanitizeTestCase = {
+    /** Human-readable description of what is being tested */
+    description: string
+    /** Input blob name possibly containing illegal or unsafe characters */
+    input: string
+    /** Expected output after sanitization */
+    expected: string
+}
+
 type OINOBlobStorageParams = {
     /** Connection params passed to OINOBlobFactory.createBlob */
     blobParams: OINOBlobParams
@@ -22,6 +31,8 @@ type OINOBlobStorageParams = {
     apiName: string
     /** Blob name prefix / folder used as tableName in the API */
     prefix: string
+    /** Platform-specific sanitization test cases */
+    sanitizeTests: OINOBlobSanitizeTestCase[]
 }
 
 type OINOBlobTestParams = {
@@ -48,7 +59,16 @@ const BLOB_STORAGES: OINOBlobStorageParams[] = [
             }
         },
         apiName: "azure-northwind",
-        prefix: "northwind-azure/"
+        prefix: "northwind-azure/",
+        sanitizeTests: [
+            { description: "backslash replaced with underscore",                  input: "foo\\bar",          expected: "foo_bar"          },
+            { description: "null byte replaced with underscore",                  input: "foo\x00bar",        expected: "foo_bar"          },
+            { description: "unit-separator control char replaced with underscore", input: "foo\x1fbar",        expected: "foo_bar"          },
+            { description: "DEL char replaced with underscore",                   input: "foo\x7fbar",        expected: "foo_bar"          },
+            { description: "multiple illegal chars replaced",                     input: "foo\\bar\x00baz",   expected: "foo_bar_baz"      },
+            { description: "forward slash preserved",                             input: "path/to/file.txt", expected: "path/to/file.txt" },
+            { description: "valid safe chars unchanged",                          input: "file-name_1.2~3",  expected: "file-name_1.2~3"  }
+        ]
     },
     {
         blobParams: {
@@ -57,7 +77,22 @@ const BLOB_STORAGES: OINOBlobStorageParams[] = [
             credentials: JSON.parse(OINOCLOUD_TEST_BLOB_S3_CONSTR)
         },
         apiName: "s3-northwind",
-        prefix: "northwind-s3/"
+        prefix: "northwind-s3/",
+        sanitizeTests: [
+            { description: "backslash replaced with underscore",         input: "foo\\bar",                        expected: "foo_bar"            },
+            { description: "null byte replaced with underscore",         input: "foo\x00bar",                      expected: "foo_bar"            },
+            { description: "DEL char replaced with underscore",          input: "foo\x7fbar",                      expected: "foo_bar"            },
+            { description: "curly braces replaced with underscores",     input: "foo{bar}baz",                     expected: "foo_bar_baz"        },
+            { description: "square brackets replaced with underscores",  input: "foo[bar]baz",                     expected: "foo_bar_baz"        },
+            { description: "caret replaced with underscore",             input: "foo^bar",                         expected: "foo_bar"            },
+            { description: "backtick replaced with underscore",          input: "foo`bar",                         expected: "foo_bar"            },
+            { description: "pipe replaced with underscore",              input: "foo|bar",                         expected: "foo_bar"            },
+            { description: "angle brackets replaced with underscores",   input: "foo<bar>baz",                     expected: "foo_bar_baz"        },
+            { description: "hash and percent replaced with underscores", input: "foo#bar%baz",                     expected: "foo_bar_baz"        },
+            { description: "forward slash preserved",                    input: "path/to/file.txt",               expected: "path/to/file.txt"   },
+            { description: "valid safe chars unchanged",                 input: "file-name_1.2~3",                expected: "file-name_1.2~3"   },
+            { description: "mixed illegal chars all replaced",           input: "foo\\{bar}[baz]^`|<>#%qux",      expected: "foo__bar__baz________qux" }
+        ]
     }
 ]
 
@@ -115,6 +150,18 @@ OINOBenchmark.reset()
 OINOBlobFactory.registerBlob("OINOBlobAzure", OINOBlobAzure)
 OINOBlobFactory.registerBlob("OINOBlobAwsS3", OINOBlobAwsS3)
 
+// ── SANITIZE UNIT TESTS ───────────────────────────────────────────────────────
+// These do not connect to any storage backend.
+
+for (const storage of BLOB_STORAGES) {
+    const blob = await OINOBlobFactory.createBlob(storage.blobParams, false, false)
+    for (const tc of storage.sanitizeTests) {
+        test("[SANITIZE][" + storage.blobParams.type + "] " + tc.description, () => {
+            expect(blob.sanitizeName(tc.input)).toBe(tc.expected)
+        })
+    }
+}
+
 function encodeResult(o: unknown): string {
     return JSON.stringify(o ?? {}, null, 3)
         .replaceAll(/`/g, "'")
@@ -286,6 +333,7 @@ export async function OINOTestBlob(storageParams: OINOBlobStorageParams, testPar
         expect(verify_result.success).toBe(true)
         expect(verify_result.blobData).toBeDefined()
         expect(new TextDecoder().decode(verify_result.blobData)).toBe(new TextDecoder().decode(testParams.uploadContent))
+        expect(verify_result.blobDataType).toBe(testParams.uploadContentType)
     })
 
     // ── UPDATE (PUT) ──────────────────────────────────────────────────────
@@ -326,6 +374,7 @@ export async function OINOTestBlob(storageParams: OINOBlobStorageParams, testPar
         const verify_result: OINOBlobApiResult = await api.doApiRequest(verify_request)
         expect(verify_result.success).toBe(true)
         expect(new TextDecoder().decode(verify_result.blobData)).toBe(new TextDecoder().decode(testParams.updateContent))
+        expect(verify_result.blobDataType).toBe(testParams.uploadContentType)
     })
 
     // ── DELETE ────────────────────────────────────────────────────────────

package/src/OINOBlobApi.ts

@@ -126,7 +126,7 @@ export class OINOBlobApi extends OINOApi {
             } else {
                 // ── Download blob ────────────────────────────────────────────
                 try {
-                    const name = decodeURIComponent(request.rowId)
+                    const name = this.blob.sanitizeName(decodeURIComponent(request.rowId))
                     const fetch_result = await this.blob.fetchEntry(name)
                     result.blobData = fetch_result.content
                     result.blobDataType = fetch_result.contentType
@@ -142,7 +142,7 @@ export class OINOBlobApi extends OINOApi {
                 result.setError(400, "HTTP " + request.method + " method requires an URL ID (blob name)!", "DoRequest")
             } else {
                 try {
-                    const name = decodeURIComponent(request.rowId)
+                    const name = this.blob.sanitizeName(decodeURIComponent(request.rowId))
                     const content_type = request.headers.get("content-type") ?? "application/octet-stream"
                     const data = request.rowData
                     const content: Uint8Array = data instanceof Uint8Array ? data : request.bodyAsBuffer()
@@ -159,7 +159,7 @@ export class OINOBlobApi extends OINOApi {
                 result.setError(400, "HTTP DELETE method requires an URL ID (blob name)!", "DoRequest")
             } else {
                 try {
-                    const name = decodeURIComponent(request.rowId)
+                    const name = this.blob.sanitizeName(decodeURIComponent(request.rowId))
                     await this.blob.deleteEntry(name)
                 } catch (e: any) {
                     result.setError(500, "Error deleting blob: " + e.message, "DoDelete")