@openfn/language-mssql 6.0.6 → 7.0.0

package/ast.json

@@ -6,7 +6,7 @@
         "params"
       ],
       "docs": {
-        "description": "Execute an SQL statement",
+        "description": "Execute a raw SQL statement",
         "tags": [
           {
             "title": "public",
@@ -15,7 +15,7 @@
           },
           {
             "title": "example",
-            "description": "sql({ query, options })"
+            "description": "sql({\n  query: 'SELECT * FROM users WHERE id = @id',\n  options\n})"
           },
           {
             "title": "function",
@@ -24,13 +24,31 @@
           },
           {
             "title": "param",
-            "description": "Payload data for the message",
+            "description": "Payload data for the SQL query",
             "type": {
               "type": "NameExpression",
               "name": "object"
             },
             "name": "params"
           },
+          {
+            "title": "param",
+            "description": "The SQL query to execute",
+            "type": {
+              "type": "NameExpression",
+              "name": "string"
+            },
+            "name": "params.query"
+          },
+          {
+            "title": "param",
+            "description": "Optional query options",
+            "type": {
+              "type": "NameExpression",
+              "name": "object"
+            },
+            "name": "params.options"
+          },
           {
             "title": "returns",
             "description": null,
@@ -41,7 +59,7 @@
           }
         ]
       },
-      "valid": true
+      "valid": false
     },
     {
       "name": "findValue",

package/configuration-schema.json

@@ -57,9 +57,10 @@
     },
     "trustServerCertificate": {
       "type": "boolean",
-      "default": true,
+      "default": false,
+       "description": "Trust self-signed certificates (not recommended for production)",
       "examples": [
-        false
+        true
       ]
     }
   },

package/dist/index.cjs

@@ -86,15 +86,73 @@ var import_util = require("@openfn/language-common/util");
 // src/util.js
 var util_exports = {};
 __export(util_exports, {
-  escape: () => escape
+  escape: () => escape,
+  escapeIdentifier: () => escapeIdentifier,
+  escapeLike: () => escapeLike,
+  validateOperator: () => validateOperator
 });
 function escape(stringExp) {
   if (typeof stringExp === "object" && stringExp !== null) {
+    if (Array.isArray(stringExp)) {
+      return stringExp.map((x) => escape(x));
+    }
     return Object.values(stringExp).map((x) => escape(x));
-  } else if (typeof stringExp !== "string") {
+  }
+  if (stringExp === null || stringExp === void 0) {
     return stringExp;
   }
-  return stringExp.replace(/\'/g, "''");
+  if (typeof stringExp === "number" || typeof stringExp === "boolean") {
+    return String(stringExp);
+  }
+  if (typeof stringExp !== "string") {
+    throw new Error(`Unexpected type for SQL value: ${typeof stringExp}`);
+  }
+  return stringExp.replace(/'/g, "''");
+}
+function escapeLike(pattern) {
+  let escaped = escape(pattern);
+  escaped = escaped.replace(/\[/g, "[[[]");
+  escaped = escaped.replace(/%/g, "[%]");
+  escaped = escaped.replace(/_/g, "[_]");
+  return escaped;
+}
+function escapeIdentifier(identifier) {
+  if (typeof identifier !== "string" || identifier.length === 0) {
+    throw new Error("Identifier must be a non-empty string");
+  }
+  return `[${identifier.replace(/\]/g, "]]")}]`;
+}
+var ALLOWED_OPERATORS = [
+  "=",
+  "!=",
+  "<>",
+  "<",
+  ">",
+  "<=",
+  ">=",
+  "LIKE",
+  "NOT LIKE",
+  "IN",
+  "NOT IN",
+  "IS NULL",
+  "IS NOT NULL"
+];
+function validateOperator(operator) {
+  if (typeof operator !== "string") {
+    throw new Error("Operator must be a non-empty string");
+  }
+  const normalized = operator.trim().toUpperCase();
+  if (normalized.length === 0) {
+    throw new Error("Operator must be a non-empty string");
+  }
+  if (!ALLOWED_OPERATORS.includes(normalized)) {
+    throw new Error(
+      `Invalid SQL operator: "${operator}". Allowed operators: ${ALLOWED_OPERATORS.join(
+        ", "
+      )}`
+    );
+  }
+  return normalized;
 }
 
 // src/Adaptor.js
@@ -108,7 +166,7 @@ function createConnection(state) {
     database,
     port = 1433,
     encrypt = true,
-    trustServerCertificate = true
+    trustServerCertificate = false
   } = state.configuration;
   if (!server) {
     throw new Error("server missing from configuration.");
@@ -160,9 +218,10 @@ function cleanupState(state) {
   state == null ? true : delete state.connection;
   return state;
 }
-function addRowsToRefs(state, rows) {
+function addRowsToRefs(state, rows, rowCount) {
   return {
     ...state,
+    rowCount,
     references: [rows, ...state.references]
   };
 }
@@ -209,7 +268,7 @@ function queryHandler(state, query, callback, options) {
         return;
       } else {
         console.log(`Finished: ${rowCount} row(s).`);
-        resolve(callback(state, rows));
+        resolve(callback(state, rows, rowCount));
       }
     });
     connection.execSql(request);
@@ -221,6 +280,20 @@ function sql(params) {
     try {
       const [resolvedParams] = (0, import_util.expandReferences)(state, params);
       const { query, options } = resolvedParams;
+      const dangerousPatterns = [
+        /;\s*DROP\s+TABLE/i,
+        /;\s*DELETE\s+FROM/i,
+        /;\s*TRUNCATE/i,
+        /--\s*$/m,
+        /\/\*.*\*\//
+      ];
+      dangerousPatterns.forEach((pattern) => {
+        if (pattern.test(query)) {
+          throw new Error(
+            "SQL query contains potentially dangerous pattern. Ensure this is intentional and from a trusted source."
+          );
+        }
+      });
       console.log(`Preparing to execute sql statement: ${query}`);
       return queryHandler(state, query, composeNextState, options);
     } catch (e) {
@@ -259,16 +332,21 @@ function findValue(filter) {
     const { connection } = state;
     const { uuid, relation, where, operator } = filter;
     const [whereData, operatorData] = (0, import_util.expandReferences)(state, where, operator);
+    const safeUuid = escapeIdentifier(uuid);
+    const safeRelation = escapeIdentifier(relation);
     let conditionsArray = [];
     for (let key in whereData) {
-      const escapedValue = escape(whereData[key]);
+      const safeColumnName = escapeIdentifier(key);
+      const validatedOperator = operatorData ? validateOperator(operatorData[key]) : "=";
+      const isLikeOperator = validatedOperator === "LIKE" || validatedOperator === "NOT LIKE";
+      const escapedValue = isLikeOperator ? escapeLike(whereData[key]) : escape(whereData[key]);
       conditionsArray.push(
-        `${key} ${operatorData ? operatorData[key] : "="} '${escapedValue}'`
+        `${safeColumnName} ${validatedOperator} '${escapedValue}'`
       );
     }
     const condition = conditionsArray.length > 0 ? `where ${conditionsArray.join(" and ")}` : "";
     try {
-      const body = `select ${uuid} from ${relation} ${condition}`;
+      const body = `select ${safeUuid} from ${safeRelation} ${condition}`;
       console.log("Preparing to execute sql statement");
       let returnValue = null;
       return new Promise((resolve, reject) => {
@@ -301,13 +379,17 @@ function insert(table, record, options) {
     const { connection } = state;
     try {
       const [recordData] = (0, import_util.expandReferences)(state, record);
+      const safeTable = escapeIdentifier(table);
       const columns = Object.keys(recordData).sort();
+      const safeColumns = columns.map((col) => escapeIdentifier(col));
       const values = columns.map((key) => escape(recordData[key])).join("', '");
       const query = handleValues(
-        `INSERT INTO ${table} (${columns.join(", ")}) VALUES ('${values}');`,
+        `INSERT INTO ${safeTable} (${safeColumns.join(
+          ", "
+        )}) VALUES ('${values}');`,
         handleOptions(options)
       );
-      const safeQuery = `INSERT INTO ${table} (${columns.join(
+      const safeQuery = `INSERT INTO ${safeTable} (${safeColumns.join(
         ", "
       )}) VALUES [--REDACTED--]];`;
       return new Promise((resolve) => {
@@ -326,17 +408,19 @@ function insertMany(table, records, options) {
     const { connection } = state;
     try {
       const [recordData] = (0, import_util.expandReferences)(state, records);
+      const safeTable = escapeIdentifier(table);
       const columns = Object.keys(recordData[0]);
+      const safeColumns = columns.map((col) => escapeIdentifier(col));
       const valueSets = recordData.map(
         (x) => `('${escape(Object.values(x)).join("', '")}')`
       );
       const query = handleValues(
-        `INSERT INTO ${table} (${columns.join(", ")}) VALUES ${valueSets.join(
+        `INSERT INTO ${safeTable} (${safeColumns.join(
           ", "
-        )};`,
+        )}) VALUES ${valueSets.join(", ")};`,
         handleOptions(options)
       );
-      const safeQuery = `INSERT INTO ${table} (${columns.join(
+      const safeQuery = `INSERT INTO ${safeTable} (${safeColumns.join(
         ", "
       )}) VALUES [--REDACTED--]];`;
       return new Promise((resolve) => {
@@ -355,21 +439,27 @@ function upsert(table, uuid, record, options) {
     const { connection } = state;
     try {
       const [recordData] = (0, import_util.expandReferences)(state, record);
+      const safeTable = escapeIdentifier(table);
       const columns = Object.keys(recordData).sort();
-      const selectValues = columns.map((key) => `'${escape(recordData[key])}' AS ${key}`).join(", ");
-      const updateValues = columns.map((key) => `[Target].${key}='${escape(recordData[key])}'`).join(", ");
-      const insertColumns = columns.join(", ");
-      const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
+      const safeColumns = columns.map((col) => escapeIdentifier(col));
+      const selectValues = columns.map((key, i) => `'${escape(recordData[key])}' AS ${safeColumns[i]}`).join(", ");
+      const updateValues = columns.map(
+        (key, i) => `[Target].${safeColumns[i]}='${escape(recordData[key])}'`
+      ).join(", ");
+      const insertColumns = safeColumns.join(", ");
+      const insertValues = safeColumns.map((col) => `[Source].${col}`).join(", ");
       const constraint = [];
       if (Array.isArray(uuid)) {
         uuid.forEach((key) => {
-          constraint.push(`[Target].${key} = [Source].${key}`);
+          const safeKey = escapeIdentifier(key);
+          constraint.push(`[Target].${safeKey} = [Source].${safeKey}`);
         });
       } else {
-        constraint.push(`[Target].${uuid} = [Source].${uuid}`);
+        const safeUuid = escapeIdentifier(uuid);
+        constraint.push(`[Target].${safeUuid} = [Source].${safeUuid}`);
       }
       const query = handleValues(
-        `MERGE ${table} AS [Target]
+        `MERGE ${safeTable} AS [Target]
         USING (SELECT ${selectValues}) AS [Source] 
         ON ${constraint.join(" AND ")}
         WHEN MATCHED THEN
@@ -378,7 +468,7 @@ function upsert(table, uuid, record, options) {
           INSERT (${insertColumns}) VALUES (${insertValues});`,
         handleOptions(options)
       );
-      const safeQuery = `MERGE ${table} AS [Target]
+      const safeQuery = `MERGE ${safeTable} AS [Target]
         USING (SELECT [--REDACTED--]) 
         ON [Target].[--VALUE--] = [Source].[--VALUE--]
         WHEN MATCHED THEN
@@ -458,23 +548,27 @@ function upsertMany(table, uuid, records, options) {
           console.log("No records provided; skipping upsert.");
           resolve(state);
         }
+        const safeTable = escapeIdentifier(table);
         const columns = Object.keys(recordData[0]);
+        const safeColumns = columns.map((col) => escapeIdentifier(col));
         const valueSets = recordData.map(
           (x) => `('${escape(Object.values(x)).join("', '")}')`
         );
-        const insertColumns = columns.join(", ");
-        const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
-        const updateValues = columns.map((key) => `[Target].${key}=[Source].${key}`).join(", ");
+        const insertColumns = safeColumns.join(", ");
+        const insertValues = safeColumns.map((col) => `[Source].${col}`).join(", ");
+        const updateValues = safeColumns.map((col) => `[Target].${col}=[Source].${col}`).join(", ");
         const constraint = [];
         if (Array.isArray(uuid)) {
           uuid.forEach((key) => {
-            constraint.push(`[Target].${key} = [Source].${key}`);
+            const safeKey = escapeIdentifier(key);
+            constraint.push(`[Target].${safeKey} = [Source].${safeKey}`);
           });
         } else {
-          constraint.push(`[Target].${uuid} = [Source].${uuid}`);
+          const safeUuid = escapeIdentifier(uuid);
+          constraint.push(`[Target].${safeUuid} = [Source].${safeUuid}`);
         }
         const query = handleValues(
-          `MERGE ${table} AS [Target]
+          `MERGE ${safeTable} AS [Target]
         USING (VALUES ${valueSets.join(", ")}) AS [Source] (${insertColumns})
         ON ${constraint.join(" AND ")}
         WHEN MATCHED THEN
@@ -483,7 +577,7 @@ function upsertMany(table, uuid, records, options) {
           INSERT (${insertColumns}) VALUES (${insertValues});`,
           handleOptions(options)
         );
-        const safeQuery = `MERGE ${table} AS [Target]
+        const safeQuery = `MERGE ${safeTable} AS [Target]
         USING (VALUES [--REDACTED--]) AS [SOURCE] (${insertColumns})
         ON [Target].[--VALUE--] = [Source].[--VALUE--]
         WHEN MATCHED THEN
@@ -528,10 +622,12 @@ function insertTable(tableName, columns, options) {
           resolve(state);
           return state;
         }
-        const structureData = data.map(
-          (x) => `${x.name} ${x.type} ${x.hasOwnProperty("default") ? x.type.includes("varchar") || x.type.includes("text") ? `DEFAULT '${x.default}'` : `DEFAULT ${x.default}` : ""} ${x.unique ? "UNIQUE" : ""} ${x.identity ? "PRIMARY KEY IDENTITY (1,1)" : ""} ${x.required ? "NOT NULL" : ""}`
-        ).join(", ");
-        const query = `CREATE TABLE ${tableName} (
+        const safeTableName = escapeIdentifier(tableName);
+        const structureData = data.map((x) => {
+          const safeColName = escapeIdentifier(x.name);
+          return `${safeColName} ${x.type} ${x.hasOwnProperty("default") ? x.type.includes("varchar") || x.type.includes("text") ? `DEFAULT '${escape(x.default)}'` : `DEFAULT ${x.default}` : ""} ${x.unique ? "UNIQUE" : ""} ${x.identity ? "PRIMARY KEY IDENTITY (1,1)" : ""} ${x.required ? "NOT NULL" : ""}`;
+        }).join(", ");
+        const query = `CREATE TABLE ${safeTableName} (
         ${structureData}
       );`;
         console.log("Preparing to create table via:", query);
@@ -554,10 +650,12 @@ function modifyTable(tableName, columns, options) {
           resolve(state);
           return state;
         }
-        const structureData = data.map(
-          (x) => `${x.name} ${x.type} ${x.hasOwnProperty("default") ? x.type.includes("varchar") || x.type.includes("text") ? `DEFAULT '${x.default}'` : `DEFAULT ${x.default}` : ""} ${x.unique ? "UNIQUE" : ""} ${x.identity ? "IDENTITY (1,1)" : ""} ${x.required ? "NOT NULL" : ""}`
-        ).join(", ");
-        const query = `ALTER TABLE ${tableName} ADD ${structureData};`;
+        const safeTableName = escapeIdentifier(tableName);
+        const structureData = data.map((x) => {
+          const safeColName = escapeIdentifier(x.name);
+          return `${safeColName} ${x.type} ${x.hasOwnProperty("default") ? x.type.includes("varchar") || x.type.includes("text") ? `DEFAULT '${escape(x.default)}'` : `DEFAULT ${x.default}` : ""} ${x.unique ? "UNIQUE" : ""} ${x.identity ? "IDENTITY (1,1)" : ""} ${x.required ? "NOT NULL" : ""}`;
+        }).join(", ");
+        const query = `ALTER TABLE ${safeTableName} ADD ${structureData};`;
         console.log("Preparing to modify table via:", query);
         resolve(queryHandler(state, query, flattenRows, options));
       });

package/dist/index.js

@@ -40,15 +40,73 @@ import { expandReferences } from "@openfn/language-common/util";
 // src/util.js
 var util_exports = {};
 __export(util_exports, {
-  escape: () => escape
+  escape: () => escape,
+  escapeIdentifier: () => escapeIdentifier,
+  escapeLike: () => escapeLike,
+  validateOperator: () => validateOperator
 });
 function escape(stringExp) {
   if (typeof stringExp === "object" && stringExp !== null) {
+    if (Array.isArray(stringExp)) {
+      return stringExp.map((x) => escape(x));
+    }
     return Object.values(stringExp).map((x) => escape(x));
-  } else if (typeof stringExp !== "string") {
+  }
+  if (stringExp === null || stringExp === void 0) {
     return stringExp;
   }
-  return stringExp.replace(/\'/g, "''");
+  if (typeof stringExp === "number" || typeof stringExp === "boolean") {
+    return String(stringExp);
+  }
+  if (typeof stringExp !== "string") {
+    throw new Error(`Unexpected type for SQL value: ${typeof stringExp}`);
+  }
+  return stringExp.replace(/'/g, "''");
+}
+function escapeLike(pattern) {
+  let escaped = escape(pattern);
+  escaped = escaped.replace(/\[/g, "[[[]");
+  escaped = escaped.replace(/%/g, "[%]");
+  escaped = escaped.replace(/_/g, "[_]");
+  return escaped;
+}
+function escapeIdentifier(identifier) {
+  if (typeof identifier !== "string" || identifier.length === 0) {
+    throw new Error("Identifier must be a non-empty string");
+  }
+  return `[${identifier.replace(/\]/g, "]]")}]`;
+}
+var ALLOWED_OPERATORS = [
+  "=",
+  "!=",
+  "<>",
+  "<",
+  ">",
+  "<=",
+  ">=",
+  "LIKE",
+  "NOT LIKE",
+  "IN",
+  "NOT IN",
+  "IS NULL",
+  "IS NOT NULL"
+];
+function validateOperator(operator) {
+  if (typeof operator !== "string") {
+    throw new Error("Operator must be a non-empty string");
+  }
+  const normalized = operator.trim().toUpperCase();
+  if (normalized.length === 0) {
+    throw new Error("Operator must be a non-empty string");
+  }
+  if (!ALLOWED_OPERATORS.includes(normalized)) {
+    throw new Error(
+      `Invalid SQL operator: "${operator}". Allowed operators: ${ALLOWED_OPERATORS.join(
+        ", "
+      )}`
+    );
+  }
+  return normalized;
 }
 
 // src/Adaptor.js
@@ -78,7 +136,7 @@ function createConnection(state) {
     database,
     port = 1433,
     encrypt = true,
-    trustServerCertificate = true
+    trustServerCertificate = false
   } = state.configuration;
   if (!server) {
     throw new Error("server missing from configuration.");
@@ -130,9 +188,10 @@ function cleanupState(state) {
   state == null ? true : delete state.connection;
   return state;
 }
-function addRowsToRefs(state, rows) {
+function addRowsToRefs(state, rows, rowCount) {
   return {
     ...state,
+    rowCount,
     references: [rows, ...state.references]
   };
 }
@@ -179,7 +238,7 @@ function queryHandler(state, query, callback, options) {
         return;
       } else {
         console.log(`Finished: ${rowCount} row(s).`);
-        resolve(callback(state, rows));
+        resolve(callback(state, rows, rowCount));
       }
     });
     connection.execSql(request);
@@ -191,6 +250,20 @@ function sql(params) {
     try {
       const [resolvedParams] = expandReferences(state, params);
       const { query, options } = resolvedParams;
+      const dangerousPatterns = [
+        /;\s*DROP\s+TABLE/i,
+        /;\s*DELETE\s+FROM/i,
+        /;\s*TRUNCATE/i,
+        /--\s*$/m,
+        /\/\*.*\*\//
+      ];
+      dangerousPatterns.forEach((pattern) => {
+        if (pattern.test(query)) {
+          throw new Error(
+            "SQL query contains potentially dangerous pattern. Ensure this is intentional and from a trusted source."
+          );
+        }
+      });
       console.log(`Preparing to execute sql statement: ${query}`);
       return queryHandler(state, query, composeNextState, options);
     } catch (e) {
@@ -229,16 +302,21 @@ function findValue(filter) {
     const { connection } = state;
     const { uuid, relation, where, operator } = filter;
     const [whereData, operatorData] = expandReferences(state, where, operator);
+    const safeUuid = escapeIdentifier(uuid);
+    const safeRelation = escapeIdentifier(relation);
     let conditionsArray = [];
     for (let key in whereData) {
-      const escapedValue = escape(whereData[key]);
+      const safeColumnName = escapeIdentifier(key);
+      const validatedOperator = operatorData ? validateOperator(operatorData[key]) : "=";
+      const isLikeOperator = validatedOperator === "LIKE" || validatedOperator === "NOT LIKE";
+      const escapedValue = isLikeOperator ? escapeLike(whereData[key]) : escape(whereData[key]);
       conditionsArray.push(
-        `${key} ${operatorData ? operatorData[key] : "="} '${escapedValue}'`
+        `${safeColumnName} ${validatedOperator} '${escapedValue}'`
       );
     }
     const condition = conditionsArray.length > 0 ? `where ${conditionsArray.join(" and ")}` : "";
     try {
-      const body = `select ${uuid} from ${relation} ${condition}`;
+      const body = `select ${safeUuid} from ${safeRelation} ${condition}`;
       console.log("Preparing to execute sql statement");
       let returnValue = null;
       return new Promise((resolve, reject) => {
@@ -271,13 +349,17 @@ function insert(table, record, options) {
     const { connection } = state;
     try {
       const [recordData] = expandReferences(state, record);
+      const safeTable = escapeIdentifier(table);
       const columns = Object.keys(recordData).sort();
+      const safeColumns = columns.map((col) => escapeIdentifier(col));
       const values = columns.map((key) => escape(recordData[key])).join("', '");
       const query = handleValues(
-        `INSERT INTO ${table} (${columns.join(", ")}) VALUES ('${values}');`,
+        `INSERT INTO ${safeTable} (${safeColumns.join(
+          ", "
+        )}) VALUES ('${values}');`,
         handleOptions(options)
       );
-      const safeQuery = `INSERT INTO ${table} (${columns.join(
+      const safeQuery = `INSERT INTO ${safeTable} (${safeColumns.join(
         ", "
       )}) VALUES [--REDACTED--]];`;
       return new Promise((resolve) => {
@@ -296,17 +378,19 @@ function insertMany(table, records, options) {
     const { connection } = state;
     try {
       const [recordData] = expandReferences(state, records);
+      const safeTable = escapeIdentifier(table);
       const columns = Object.keys(recordData[0]);
+      const safeColumns = columns.map((col) => escapeIdentifier(col));
       const valueSets = recordData.map(
         (x) => `('${escape(Object.values(x)).join("', '")}')`
       );
       const query = handleValues(
-        `INSERT INTO ${table} (${columns.join(", ")}) VALUES ${valueSets.join(
+        `INSERT INTO ${safeTable} (${safeColumns.join(
           ", "
-        )};`,
+        )}) VALUES ${valueSets.join(", ")};`,
         handleOptions(options)
       );
-      const safeQuery = `INSERT INTO ${table} (${columns.join(
+      const safeQuery = `INSERT INTO ${safeTable} (${safeColumns.join(
         ", "
       )}) VALUES [--REDACTED--]];`;
       return new Promise((resolve) => {
@@ -325,21 +409,27 @@ function upsert(table, uuid, record, options) {
     const { connection } = state;
     try {
       const [recordData] = expandReferences(state, record);
+      const safeTable = escapeIdentifier(table);
       const columns = Object.keys(recordData).sort();
-      const selectValues = columns.map((key) => `'${escape(recordData[key])}' AS ${key}`).join(", ");
-      const updateValues = columns.map((key) => `[Target].${key}='${escape(recordData[key])}'`).join(", ");
-      const insertColumns = columns.join(", ");
-      const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
+      const safeColumns = columns.map((col) => escapeIdentifier(col));
+      const selectValues = columns.map((key, i) => `'${escape(recordData[key])}' AS ${safeColumns[i]}`).join(", ");
+      const updateValues = columns.map(
+        (key, i) => `[Target].${safeColumns[i]}='${escape(recordData[key])}'`
+      ).join(", ");
+      const insertColumns = safeColumns.join(", ");
+      const insertValues = safeColumns.map((col) => `[Source].${col}`).join(", ");
       const constraint = [];
       if (Array.isArray(uuid)) {
         uuid.forEach((key) => {
-          constraint.push(`[Target].${key} = [Source].${key}`);
+          const safeKey = escapeIdentifier(key);
+          constraint.push(`[Target].${safeKey} = [Source].${safeKey}`);
         });
       } else {
-        constraint.push(`[Target].${uuid} = [Source].${uuid}`);
+        const safeUuid = escapeIdentifier(uuid);
+        constraint.push(`[Target].${safeUuid} = [Source].${safeUuid}`);
       }
       const query = handleValues(
-        `MERGE ${table} AS [Target]
+        `MERGE ${safeTable} AS [Target]
         USING (SELECT ${selectValues}) AS [Source] 
         ON ${constraint.join(" AND ")}
         WHEN MATCHED THEN
@@ -348,7 +438,7 @@ function upsert(table, uuid, record, options) {
           INSERT (${insertColumns}) VALUES (${insertValues});`,
         handleOptions(options)
       );
-      const safeQuery = `MERGE ${table} AS [Target]
+      const safeQuery = `MERGE ${safeTable} AS [Target]
         USING (SELECT [--REDACTED--]) 
         ON [Target].[--VALUE--] = [Source].[--VALUE--]
         WHEN MATCHED THEN
@@ -428,23 +518,27 @@ function upsertMany(table, uuid, records, options) {
           console.log("No records provided; skipping upsert.");
           resolve(state);
         }
+        const safeTable = escapeIdentifier(table);
         const columns = Object.keys(recordData[0]);
+        const safeColumns = columns.map((col) => escapeIdentifier(col));
         const valueSets = recordData.map(
           (x) => `('${escape(Object.values(x)).join("', '")}')`
         );
-        const insertColumns = columns.join(", ");
-        const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
-        const updateValues = columns.map((key) => `[Target].${key}=[Source].${key}`).join(", ");
+        const insertColumns = safeColumns.join(", ");
+        const insertValues = safeColumns.map((col) => `[Source].${col}`).join(", ");
+        const updateValues = safeColumns.map((col) => `[Target].${col}=[Source].${col}`).join(", ");
         const constraint = [];
         if (Array.isArray(uuid)) {
           uuid.forEach((key) => {
-            constraint.push(`[Target].${key} = [Source].${key}`);
+            const safeKey = escapeIdentifier(key);
+            constraint.push(`[Target].${safeKey} = [Source].${safeKey}`);
           });
         } else {
-          constraint.push(`[Target].${uuid} = [Source].${uuid}`);
+          const safeUuid = escapeIdentifier(uuid);
+          constraint.push(`[Target].${safeUuid} = [Source].${safeUuid}`);
         }
         const query = handleValues(
-          `MERGE ${table} AS [Target]
+          `MERGE ${safeTable} AS [Target]
         USING (VALUES ${valueSets.join(", ")}) AS [Source] (${insertColumns})
         ON ${constraint.join(" AND ")}
         WHEN MATCHED THEN
@@ -453,7 +547,7 @@ function upsertMany(table, uuid, records, options) {
           INSERT (${insertColumns}) VALUES (${insertValues});`,
           handleOptions(options)
         );
-        const safeQuery = `MERGE ${table} AS [Target]
+        const safeQuery = `MERGE ${safeTable} AS [Target]
         USING (VALUES [--REDACTED--]) AS [SOURCE] (${insertColumns})
         ON [Target].[--VALUE--] = [Source].[--VALUE--]
         WHEN MATCHED THEN
@@ -498,10 +592,12 @@ function insertTable(tableName, columns, options) {
           resolve(state);
           return state;
         }
-        const structureData = data.map(
-          (x) => `${x.name} ${x.type} ${x.hasOwnProperty("default") ? x.type.includes("varchar") || x.type.includes("text") ? `DEFAULT '${x.default}'` : `DEFAULT ${x.default}` : ""} ${x.unique ? "UNIQUE" : ""} ${x.identity ? "PRIMARY KEY IDENTITY (1,1)" : ""} ${x.required ? "NOT NULL" : ""}`
-        ).join(", ");
-        const query = `CREATE TABLE ${tableName} (
+        const safeTableName = escapeIdentifier(tableName);
+        const structureData = data.map((x) => {
+          const safeColName = escapeIdentifier(x.name);
+          return `${safeColName} ${x.type} ${x.hasOwnProperty("default") ? x.type.includes("varchar") || x.type.includes("text") ? `DEFAULT '${escape(x.default)}'` : `DEFAULT ${x.default}` : ""} ${x.unique ? "UNIQUE" : ""} ${x.identity ? "PRIMARY KEY IDENTITY (1,1)" : ""} ${x.required ? "NOT NULL" : ""}`;
+        }).join(", ");
+        const query = `CREATE TABLE ${safeTableName} (
         ${structureData}
       );`;
         console.log("Preparing to create table via:", query);
@@ -524,10 +620,12 @@ function modifyTable(tableName, columns, options) {
           resolve(state);
           return state;
         }
-        const structureData = data.map(
-          (x) => `${x.name} ${x.type} ${x.hasOwnProperty("default") ? x.type.includes("varchar") || x.type.includes("text") ? `DEFAULT '${x.default}'` : `DEFAULT ${x.default}` : ""} ${x.unique ? "UNIQUE" : ""} ${x.identity ? "IDENTITY (1,1)" : ""} ${x.required ? "NOT NULL" : ""}`
-        ).join(", ");
-        const query = `ALTER TABLE ${tableName} ADD ${structureData};`;
+        const safeTableName = escapeIdentifier(tableName);
+        const structureData = data.map((x) => {
+          const safeColName = escapeIdentifier(x.name);
+          return `${safeColName} ${x.type} ${x.hasOwnProperty("default") ? x.type.includes("varchar") || x.type.includes("text") ? `DEFAULT '${escape(x.default)}'` : `DEFAULT ${x.default}` : ""} ${x.unique ? "UNIQUE" : ""} ${x.identity ? "IDENTITY (1,1)" : ""} ${x.required ? "NOT NULL" : ""}`;
+        }).join(", ");
+        const query = `ALTER TABLE ${safeTableName} ADD ${structureData};`;
         console.log("Preparing to modify table via:", query);
         resolve(queryHandler(state, query, flattenRows, options));
       });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@openfn/language-mssql",
   "label": "MSSQL",
-  "version": "6.0.6",
+  "version": "7.0.0",
   "description": "A Microsoft SQL language pack for OpenFn",
   "exports": {
     ".": {
@@ -26,7 +26,7 @@
   ],
   "dependencies": {
     "tedious": "18.6.1",
-    "@openfn/language-common": "3.2.0"
+    "@openfn/language-common": "3.2.1"
   },
   "devDependencies": {
     "assertion-error": "2.0.0",

package/types/Adaptor.d.ts

@@ -12,15 +12,23 @@
  */
 export function execute(...operations: Operations): Operation;
 /**
- * Execute an SQL statement
+ * Execute a raw SQL statement
  * @public
  * @example
- * sql({ query, options })
+ * sql({
+ *   query: 'SELECT * FROM users WHERE id = @id',
+ *   options
+ * })
  * @function
- * @param {object} params - Payload data for the message
+ * @param {object} params - Payload data for the SQL query
+ * @param {string} params.query - The SQL query to execute
+ * @param {object} params.options - Optional query options
  * @returns {Operation}
  */
-export function sql(params: object): Operation;
+export function sql(params: {
+    query: string;
+    options: object;
+}): Operation;
 /**
  * Fetch a uuid key given a condition
  * @public

package/types/util.d.ts

@@ -6,8 +6,49 @@
  * util.escape('string with "quotes"') // 'string with "quotes"'
  * util.escape('') // ''
  * util.escape(null) // null
+ * util.escape(123) // '123'
+ * util.escape(true) // 'true'
  * util.escape("'; DROP TABLE users; --") // "''; DROP TABLE users; --"
- * @param {string} stringExp - The string to escape.
- * @returns {string} The escaped string.
+ * @param {string|number|boolean|null|undefined} stringExp - The value to escape.
+ * @returns {string|null|undefined} The escaped string, or null/undefined if input was null/undefined.
+ * @throws {Error} If the value is an unexpected type (object, array, function, etc.).
  */
-export function escape(stringExp: string): string;
+export function escape(stringExp: string | number | boolean | null | undefined): string | null | undefined;
+/**
+ * Escapes a string for use in SQL LIKE patterns, preventing wildcard injection.
+ * This should be used when the operator is LIKE or NOT LIKE.
+ * @example <caption>Examples</caption>
+ * util.escapeLike('test') // 'test'
+ * util.escapeLike('100%') // '100[%]'
+ * util.escapeLike('test_value') // 'test[_]value'
+ * util.escapeLike('[admin]') // '[[[]admin]'
+ * util.escapeLike("O'Connor%") // "O''Connor[%]"
+ * @param {string} pattern - The pattern to escape.
+ * @returns {string} The escaped pattern safe for use in LIKE clauses.
+ */
+export function escapeLike(pattern: string): string;
+/**
+ * Escapes an SQL identifier (table or column name) to prevent SQL injection.
+ * Uses bracket notation for SQL Server which is safer than validating patterns.
+ * @example <caption>Examples</caption>
+ * util.escapeIdentifier('users') // '[users]'
+ * util.escapeIdentifier('first_name') // '[first_name]'
+ * util.escapeIdentifier('user]table') // '[user]]table]'
+ * util.escapeIdentifier('my.table') // '[my.table]'
+ * @param {string} identifier - The identifier to escape.
+ * @returns {string} The escaped identifier wrapped in brackets.
+ * @throws {Error} If the identifier is not a string or is empty.
+ */
+export function escapeIdentifier(identifier: string): string;
+/**
+ * Validates and normalizes SQL operators to prevent SQL injection.
+ * @example <caption>Examples</caption>
+ * util.validateOperator('=') // '='
+ * util.validateOperator('like') // 'LIKE'
+ * util.validateOperator('>=') // '>='
+ * util.validateOperator("' OR '1'='1") // throws Error
+ * @param {string} operator - The operator to validate.
+ * @returns {string} The validated and normalized operator.
+ * @throws {Error} If the operator is not in the allowed list.
+ */
+export function validateOperator(operator: string): string;