@opengis/fastify-table 1.0.17 → 1.0.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.eslintrc.cjs +42 -42
- package/Changelog.md +5 -0
- package/README.md +26 -26
- package/config.js +11 -11
- package/crud/controllers/deleteCrud.js +14 -14
- package/crud/controllers/insert.js +29 -29
- package/crud/controllers/update.js +31 -31
- package/crud/controllers/utils/checkXSS.js +45 -45
- package/crud/controllers/utils/xssInjection.js +72 -72
- package/crud/funcs/dataDelete.js +15 -15
- package/crud/funcs/dataInsert.js +24 -24
- package/crud/funcs/dataUpdate.js +20 -20
- package/crud/funcs/getToken.js +27 -27
- package/crud/funcs/isFileExists.js +13 -13
- package/crud/funcs/setToken.js +53 -53
- package/crud/index.js +29 -29
- package/helper.js +28 -28
- package/index.js +4 -0
- package/notification/controllers/userNotifications.js +19 -0
- package/notification/funcs/addNotification.js +8 -0
- package/notification/index.js +19 -0
- package/package.json +1 -1
- package/pg/index.js +35 -35
- package/server/migrations/crm.sql +55 -0
- package/server/migrations/log.sql +40 -0
- package/server/migrations/notifications.sql +14 -0
- package/server/templates/select/test.storage.data.json +3 -0
- package/server/templates/select/test.storage.data.sql +1 -0
- package/server/templates/table/test.dataset.table.json +25 -0
- package/server.js +14 -14
- package/table/controllers/search.js +41 -0
- package/table/index.js +13 -0
- package/test/api/crud.test.js +50 -50
- package/test/api/crud.xss.test.js +68 -68
- package/test/api/notification.test.js +37 -0
- package/test/api/table.test.js +12 -4
- package/test/api/widget.test.js +39 -0
- package/test/config.example +18 -18
- package/test/funcs/crud.test.js +76 -76
- package/test/funcs/notification.test.js +31 -0
- package/test/funcs/pg.test.js +34 -34
- package/test/funcs/redis.test.js +19 -19
- package/test/templates/cls/test.json +9 -9
- package/test/templates/form/cp_building.form.json +32 -32
- package/test/templates/select/account_id.json +3 -3
- package/test/templates/select/storage.data.json +2 -2
- package/test/templates/table/gis.dataset.table.json +20 -20
- package/test/widget.test.js +39 -0
- package/widget/controllers/utils/obj2db.js +13 -0
- package/widget/controllers/widget.del.js +42 -0
- package/widget/controllers/widget.get.js +145 -0
- package/widget/controllers/widget.set.js +49 -0
- package/widget/index.js +29 -0
package/.eslintrc.cjs
CHANGED
|
@@ -1,42 +1,42 @@
|
|
|
1
|
-
/* eslint-env node */
|
|
2
|
-
|
|
3
|
-
module.exports = {
|
|
4
|
-
env: {
|
|
5
|
-
node: true,
|
|
6
|
-
},
|
|
7
|
-
root: true,
|
|
8
|
-
extends: [
|
|
9
|
-
'eslint:recommended',
|
|
10
|
-
'airbnb-base',
|
|
11
|
-
|
|
12
|
-
],
|
|
13
|
-
rules: {
|
|
14
|
-
'brace-style': [2, 'stroustrup', { allowSingleLine: true }],
|
|
15
|
-
'vue/max-attributes-per-line': 0,
|
|
16
|
-
'vue/valid-v-for': 0,
|
|
17
|
-
|
|
18
|
-
// allow async-await
|
|
19
|
-
'generator-star-spacing': 'off',
|
|
20
|
-
|
|
21
|
-
// allow paren-less arrow functions
|
|
22
|
-
'arrow-parens': 0,
|
|
23
|
-
'one-var': 0,
|
|
24
|
-
'max-len': 0,
|
|
25
|
-
'import/first': 0,
|
|
26
|
-
'import/named': 2,
|
|
27
|
-
'import/namespace': 2,
|
|
28
|
-
'import/default': 2,
|
|
29
|
-
'import/export': 2,
|
|
30
|
-
'import/extensions': 0,
|
|
31
|
-
'no-console': ['warn', { allow: ['warn', 'error'] }],
|
|
32
|
-
'import/no-unresolved': 0,
|
|
33
|
-
'import/no-extraneous-dependencies': 0,
|
|
34
|
-
'linebreak-style': ['error', 'unix'],
|
|
35
|
-
// allow debugger during development
|
|
36
|
-
'no-debugger': process.env.NODE_ENV === 'production' ? 2 : 0,
|
|
37
|
-
},
|
|
38
|
-
|
|
39
|
-
parserOptions: {
|
|
40
|
-
ecmaVersion: 'latest',
|
|
41
|
-
},
|
|
42
|
-
};
|
|
1
|
+
/* eslint-env node */
|
|
2
|
+
|
|
3
|
+
module.exports = {
|
|
4
|
+
env: {
|
|
5
|
+
node: true,
|
|
6
|
+
},
|
|
7
|
+
root: true,
|
|
8
|
+
extends: [
|
|
9
|
+
'eslint:recommended',
|
|
10
|
+
'airbnb-base',
|
|
11
|
+
|
|
12
|
+
],
|
|
13
|
+
rules: {
|
|
14
|
+
'brace-style': [2, 'stroustrup', { allowSingleLine: true }],
|
|
15
|
+
'vue/max-attributes-per-line': 0,
|
|
16
|
+
'vue/valid-v-for': 0,
|
|
17
|
+
|
|
18
|
+
// allow async-await
|
|
19
|
+
'generator-star-spacing': 'off',
|
|
20
|
+
|
|
21
|
+
// allow paren-less arrow functions
|
|
22
|
+
'arrow-parens': 0,
|
|
23
|
+
'one-var': 0,
|
|
24
|
+
'max-len': 0,
|
|
25
|
+
'import/first': 0,
|
|
26
|
+
'import/named': 2,
|
|
27
|
+
'import/namespace': 2,
|
|
28
|
+
'import/default': 2,
|
|
29
|
+
'import/export': 2,
|
|
30
|
+
'import/extensions': 0,
|
|
31
|
+
'no-console': ['warn', { allow: ['warn', 'error'] }],
|
|
32
|
+
'import/no-unresolved': 0,
|
|
33
|
+
'import/no-extraneous-dependencies': 0,
|
|
34
|
+
'linebreak-style': ['error', 'unix'],
|
|
35
|
+
// allow debugger during development
|
|
36
|
+
'no-debugger': process.env.NODE_ENV === 'production' ? 2 : 0,
|
|
37
|
+
},
|
|
38
|
+
|
|
39
|
+
parserOptions: {
|
|
40
|
+
ecmaVersion: 'latest',
|
|
41
|
+
},
|
|
42
|
+
};
|
package/Changelog.md
CHANGED
package/README.md
CHANGED
|
@@ -1,26 +1,26 @@
|
|
|
1
|
-
# fastify-table
|
|
2
|
-
|
|
3
|
-
[](https://www.npmjs.com/package/@opengis/fastify-table)
|
|
4
|
-
[](http://standardjs.com/)
|
|
5
|
-
|
|
6
|
-
It standardizes the entire form building process, while taking care of everything from rendering to validation and processing:
|
|
7
|
-
|
|
8
|
-
- pg
|
|
9
|
-
- redis
|
|
10
|
-
- crud
|
|
11
|
-
|
|
12
|
-
## Install
|
|
13
|
-
|
|
14
|
-
```bash
|
|
15
|
-
npm i @opengis/fastify-table
|
|
16
|
-
```
|
|
17
|
-
|
|
18
|
-
## Usage
|
|
19
|
-
|
|
20
|
-
```js
|
|
21
|
-
fastify.register(import('@opengis/fastify-table'), config);
|
|
22
|
-
```
|
|
23
|
-
|
|
24
|
-
## Documenation
|
|
25
|
-
|
|
26
|
-
For a detailed understanding fastify-table, its features, and how to use them, refer to our [Documentation](https://apidocs.softpro.ua/gis.storage/).
|
|
1
|
+
# fastify-table
|
|
2
|
+
|
|
3
|
+
[](https://www.npmjs.com/package/@opengis/fastify-table)
|
|
4
|
+
[](http://standardjs.com/)
|
|
5
|
+
|
|
6
|
+
It standardizes the entire form building process, while taking care of everything from rendering to validation and processing:
|
|
7
|
+
|
|
8
|
+
- pg
|
|
9
|
+
- redis
|
|
10
|
+
- crud
|
|
11
|
+
|
|
12
|
+
## Install
|
|
13
|
+
|
|
14
|
+
```bash
|
|
15
|
+
npm i @opengis/fastify-table
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
## Usage
|
|
19
|
+
|
|
20
|
+
```js
|
|
21
|
+
fastify.register(import('@opengis/fastify-table'), config);
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
## Documenation
|
|
25
|
+
|
|
26
|
+
For a detailed understanding fastify-table, its features, and how to use them, refer to our [Documentation](https://apidocs.softpro.ua/gis.storage/).
|
package/config.js
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
|
-
import fs from 'fs';
|
|
2
|
-
|
|
3
|
-
const config = fs.existsSync('config.json')
|
|
4
|
-
? JSON.parse(fs.readFileSync('config.json'))
|
|
5
|
-
: {};
|
|
6
|
-
|
|
7
|
-
Object.assign(config, {
|
|
8
|
-
allTemplates: config?.allTemplates || {},
|
|
9
|
-
});
|
|
10
|
-
|
|
11
|
-
export default config;
|
|
1
|
+
import fs from 'fs';
|
|
2
|
+
|
|
3
|
+
const config = fs.existsSync('config.json')
|
|
4
|
+
? JSON.parse(fs.readFileSync('config.json'))
|
|
5
|
+
: {};
|
|
6
|
+
|
|
7
|
+
Object.assign(config, {
|
|
8
|
+
allTemplates: config?.allTemplates || {},
|
|
9
|
+
});
|
|
10
|
+
|
|
11
|
+
export default config;
|
|
@@ -1,14 +1,14 @@
|
|
|
1
|
-
import dataDelete from '../funcs/dataDelete.js';
|
|
2
|
-
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
3
|
-
|
|
4
|
-
export default async function deleteCrud(req) {
|
|
5
|
-
const loadTemplate = await getTemplate('table', req.params.table);
|
|
6
|
-
const { table } = loadTemplate || req.params || {};
|
|
7
|
-
const { id } = req.params || {};
|
|
8
|
-
|
|
9
|
-
if (!table) return { status: 404, message: 'table is required' };
|
|
10
|
-
|
|
11
|
-
const data = await dataDelete({ table, id });
|
|
12
|
-
|
|
13
|
-
return { rowCount: data.rowCount, msg: !data.rowCount ? data : null };
|
|
14
|
-
}
|
|
1
|
+
import dataDelete from '../funcs/dataDelete.js';
|
|
2
|
+
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
3
|
+
|
|
4
|
+
export default async function deleteCrud(req) {
|
|
5
|
+
const loadTemplate = await getTemplate('table', req.params.table);
|
|
6
|
+
const { table } = loadTemplate || req.params || {};
|
|
7
|
+
const { id } = req.params || {};
|
|
8
|
+
|
|
9
|
+
if (!table) return { status: 404, message: 'table is required' };
|
|
10
|
+
|
|
11
|
+
const data = await dataDelete({ table, id });
|
|
12
|
+
|
|
13
|
+
return { rowCount: data.rowCount, msg: !data.rowCount ? data : null };
|
|
14
|
+
}
|
|
@@ -1,29 +1,29 @@
|
|
|
1
|
-
import dataInsert from '../funcs/dataInsert.js';
|
|
2
|
-
import getToken from '../funcs/getToken.js';
|
|
3
|
-
import checkXSS from './utils/checkXSS.js';
|
|
4
|
-
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
5
|
-
|
|
6
|
-
export default async function insert(req) {
|
|
7
|
-
const loadTemplate = await getTemplate('table', req.params.table);
|
|
8
|
-
const { table } = loadTemplate || req.params || {};
|
|
9
|
-
if (!table) return { status: 404, message: 'table is required' };
|
|
10
|
-
|
|
11
|
-
const { funcs, session, params } = req;
|
|
12
|
-
const tokenDataString = await getToken({
|
|
13
|
-
funcs, session, token: params.table, mode: 'a', json: 0,
|
|
14
|
-
});
|
|
15
|
-
|
|
16
|
-
const { form, add } = JSON.parse(tokenDataString || '{}');
|
|
17
|
-
|
|
18
|
-
const formData = form ? await getTemplate('form', form) : {};
|
|
19
|
-
|
|
20
|
-
const xssCheck = checkXSS({ body: req.body, schema: formData?.schema });
|
|
21
|
-
|
|
22
|
-
if (xssCheck.error && formData?.xssCheck !== false) {
|
|
23
|
-
req.log.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
|
|
24
|
-
return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
|
|
25
|
-
}
|
|
26
|
-
|
|
27
|
-
const res = await dataInsert({ table: add || table, data: req.body });
|
|
28
|
-
return { rows: res.rows };
|
|
29
|
-
}
|
|
1
|
+
import dataInsert from '../funcs/dataInsert.js';
|
|
2
|
+
import getToken from '../funcs/getToken.js';
|
|
3
|
+
import checkXSS from './utils/checkXSS.js';
|
|
4
|
+
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
5
|
+
|
|
6
|
+
export default async function insert(req) {
|
|
7
|
+
const loadTemplate = await getTemplate('table', req.params.table);
|
|
8
|
+
const { table } = loadTemplate || req.params || {};
|
|
9
|
+
if (!table) return { status: 404, message: 'table is required' };
|
|
10
|
+
|
|
11
|
+
const { funcs, session, params } = req;
|
|
12
|
+
const tokenDataString = await getToken({
|
|
13
|
+
funcs, session, token: params.table, mode: 'a', json: 0,
|
|
14
|
+
});
|
|
15
|
+
|
|
16
|
+
const { form, add } = JSON.parse(tokenDataString || '{}');
|
|
17
|
+
|
|
18
|
+
const formData = form ? await getTemplate('form', form) : {};
|
|
19
|
+
|
|
20
|
+
const xssCheck = checkXSS({ body: req.body, schema: formData?.schema });
|
|
21
|
+
|
|
22
|
+
if (xssCheck.error && formData?.xssCheck !== false) {
|
|
23
|
+
req.log.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
|
|
24
|
+
return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
|
|
25
|
+
}
|
|
26
|
+
|
|
27
|
+
const res = await dataInsert({ table: add || table, data: req.body });
|
|
28
|
+
return { rows: res.rows };
|
|
29
|
+
}
|
|
@@ -1,31 +1,31 @@
|
|
|
1
|
-
import dataUpdate from '../funcs/dataUpdate.js';
|
|
2
|
-
import getToken from '../funcs/getToken.js';
|
|
3
|
-
import checkXSS from './utils/checkXSS.js';
|
|
4
|
-
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
5
|
-
|
|
6
|
-
export default async function update(req) {
|
|
7
|
-
const loadTemplate = await getTemplate('table', req.params.table);
|
|
8
|
-
const { table } = loadTemplate || req.params || {};
|
|
9
|
-
const { id } = req.params || {};
|
|
10
|
-
if (!req.params?.table) return { message: 'table is required', status: 404 };
|
|
11
|
-
if (!id) return { message: 'id is required', status: 404 };
|
|
12
|
-
|
|
13
|
-
const { funcs, session, params } = req;
|
|
14
|
-
const tokenDataString = await getToken({
|
|
15
|
-
funcs, session, token: params.table, mode: 'w', json: 0,
|
|
16
|
-
});
|
|
17
|
-
|
|
18
|
-
const tokenData = JSON.parse(tokenDataString || '{}');
|
|
19
|
-
|
|
20
|
-
const formData = tokenData?.form ? await getTemplate('form', tokenData.form) : {};
|
|
21
|
-
|
|
22
|
-
const xssCheck = checkXSS({ body: req.body, schema: formData?.schema });
|
|
23
|
-
|
|
24
|
-
if (xssCheck.error && formData?.xssCheck !== false) {
|
|
25
|
-
req.log.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
|
|
26
|
-
return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
|
|
27
|
-
}
|
|
28
|
-
|
|
29
|
-
const res = await dataUpdate({ table: tokenData?.table || table, id: tokenData?.id || id, data: req.body });
|
|
30
|
-
return res;
|
|
31
|
-
}
|
|
1
|
+
import dataUpdate from '../funcs/dataUpdate.js';
|
|
2
|
+
import getToken from '../funcs/getToken.js';
|
|
3
|
+
import checkXSS from './utils/checkXSS.js';
|
|
4
|
+
import getTemplate from '../../table/controllers/utils/getTemplate.js';
|
|
5
|
+
|
|
6
|
+
export default async function update(req) {
|
|
7
|
+
const loadTemplate = await getTemplate('table', req.params.table);
|
|
8
|
+
const { table } = loadTemplate || req.params || {};
|
|
9
|
+
const { id } = req.params || {};
|
|
10
|
+
if (!req.params?.table) return { message: 'table is required', status: 404 };
|
|
11
|
+
if (!id) return { message: 'id is required', status: 404 };
|
|
12
|
+
|
|
13
|
+
const { funcs, session, params } = req;
|
|
14
|
+
const tokenDataString = await getToken({
|
|
15
|
+
funcs, session, token: params.table, mode: 'w', json: 0,
|
|
16
|
+
});
|
|
17
|
+
|
|
18
|
+
const tokenData = JSON.parse(tokenDataString || '{}');
|
|
19
|
+
|
|
20
|
+
const formData = tokenData?.form ? await getTemplate('form', tokenData.form) : {};
|
|
21
|
+
|
|
22
|
+
const xssCheck = checkXSS({ body: req.body, schema: formData?.schema });
|
|
23
|
+
|
|
24
|
+
if (xssCheck.error && formData?.xssCheck !== false) {
|
|
25
|
+
req.log.warn({ name: 'injection/xss', msg: xssCheck.error, table }, req);
|
|
26
|
+
return { message: 'Дані містять заборонені символи. Приберіть їх та спробуйте ще раз', status: 409 };
|
|
27
|
+
}
|
|
28
|
+
|
|
29
|
+
const res = await dataUpdate({ table: tokenData?.table || table, id: tokenData?.id || id, data: req.body });
|
|
30
|
+
return res;
|
|
31
|
+
}
|
|
@@ -1,45 +1,45 @@
|
|
|
1
|
-
/* import sqlInjection from '../../../policy/funcs/sqlInjection.js'; */
|
|
2
|
-
import xssInjection from './xssInjection.js';
|
|
3
|
-
|
|
4
|
-
/* const checkList = xssInjection.concat(sqlInjection); */
|
|
5
|
-
|
|
6
|
-
// RTE - rich text editor
|
|
7
|
-
|
|
8
|
-
function checkXSS({ body, schema = {} }) {
|
|
9
|
-
const data = typeof body === 'string' ? body : JSON.stringify(body);
|
|
10
|
-
const stopWords = xssInjection.filter((el) => data.toLowerCase().includes(el));
|
|
11
|
-
|
|
12
|
-
// check sql injection
|
|
13
|
-
const stopSpecialSymbols = data.match(/\p{S}OR\p{S}|\p{P}OR\p{P}| OR |\+OR\+/gi);
|
|
14
|
-
if (stopSpecialSymbols?.length) stopSpecialSymbols?.forEach((el) => stopWords.push(el));
|
|
15
|
-
|
|
16
|
-
// escape arrows on non-RTE
|
|
17
|
-
Object.keys(body)
|
|
18
|
-
.filter((key) => ['<', '>'].find((el) => body[key]?.includes?.(el))
|
|
19
|
-
&& !['Summernote', 'Tiny', 'Ace'].includes(schema[key]?.type))
|
|
20
|
-
?.forEach((key) => {
|
|
21
|
-
Object.assign(body, { [key]: body[key].replace(/</g, '<').replace(/>/g, '>') });
|
|
22
|
-
});
|
|
23
|
-
// try { } catch (err) { return { error: err.toString() }; }
|
|
24
|
-
|
|
25
|
-
if (!stopWords.length) return { body };
|
|
26
|
-
|
|
27
|
-
const disabledCheckFields = Object.keys(schema)?.filter((el) => schema[el]?.xssCheck === false); // exclude specific columns
|
|
28
|
-
|
|
29
|
-
// check RTE
|
|
30
|
-
/* const richTextFields = Object.keys(schema).filter((el) => ['Summernote', 'Tiny', 'Ace'].includes(schema[el]?.type));
|
|
31
|
-
richTextFields.filter((key) => !checkList.find((el) => body[key].includes(el)))?.forEach((key) => {
|
|
32
|
-
disabledCheckFields.push(key);
|
|
33
|
-
}); */
|
|
34
|
-
|
|
35
|
-
const field = Object.keys(body)
|
|
36
|
-
?.find((key) => body[key]
|
|
37
|
-
&& !disabledCheckFields.includes(key)
|
|
38
|
-
&& body[key].toLowerCase().includes(stopWords[0]));
|
|
39
|
-
if (field) {
|
|
40
|
-
return { error: `rule: ${stopWords[0]} | attr: ${field} | val: ${body[field]}`, body };
|
|
41
|
-
}
|
|
42
|
-
return { body };
|
|
43
|
-
}
|
|
44
|
-
|
|
45
|
-
export default checkXSS;
|
|
1
|
+
/* import sqlInjection from '../../../policy/funcs/sqlInjection.js'; */
|
|
2
|
+
import xssInjection from './xssInjection.js';
|
|
3
|
+
|
|
4
|
+
/* const checkList = xssInjection.concat(sqlInjection); */
|
|
5
|
+
|
|
6
|
+
// RTE - rich text editor
|
|
7
|
+
|
|
8
|
+
function checkXSS({ body, schema = {} }) {
|
|
9
|
+
const data = typeof body === 'string' ? body : JSON.stringify(body);
|
|
10
|
+
const stopWords = xssInjection.filter((el) => data.toLowerCase().includes(el));
|
|
11
|
+
|
|
12
|
+
// check sql injection
|
|
13
|
+
const stopSpecialSymbols = data.match(/\p{S}OR\p{S}|\p{P}OR\p{P}| OR |\+OR\+/gi);
|
|
14
|
+
if (stopSpecialSymbols?.length) stopSpecialSymbols?.forEach((el) => stopWords.push(el));
|
|
15
|
+
|
|
16
|
+
// escape arrows on non-RTE
|
|
17
|
+
Object.keys(body)
|
|
18
|
+
.filter((key) => ['<', '>'].find((el) => body[key]?.includes?.(el))
|
|
19
|
+
&& !['Summernote', 'Tiny', 'Ace'].includes(schema[key]?.type))
|
|
20
|
+
?.forEach((key) => {
|
|
21
|
+
Object.assign(body, { [key]: body[key].replace(/</g, '<').replace(/>/g, '>') });
|
|
22
|
+
});
|
|
23
|
+
// try { } catch (err) { return { error: err.toString() }; }
|
|
24
|
+
|
|
25
|
+
if (!stopWords.length) return { body };
|
|
26
|
+
|
|
27
|
+
const disabledCheckFields = Object.keys(schema)?.filter((el) => schema[el]?.xssCheck === false); // exclude specific columns
|
|
28
|
+
|
|
29
|
+
// check RTE
|
|
30
|
+
/* const richTextFields = Object.keys(schema).filter((el) => ['Summernote', 'Tiny', 'Ace'].includes(schema[el]?.type));
|
|
31
|
+
richTextFields.filter((key) => !checkList.find((el) => body[key].includes(el)))?.forEach((key) => {
|
|
32
|
+
disabledCheckFields.push(key);
|
|
33
|
+
}); */
|
|
34
|
+
|
|
35
|
+
const field = Object.keys(body)
|
|
36
|
+
?.find((key) => body[key]
|
|
37
|
+
&& !disabledCheckFields.includes(key)
|
|
38
|
+
&& body[key].toLowerCase().includes(stopWords[0]));
|
|
39
|
+
if (field) {
|
|
40
|
+
return { error: `rule: ${stopWords[0]} | attr: ${field} | val: ${body[field]}`, body };
|
|
41
|
+
}
|
|
42
|
+
return { body };
|
|
43
|
+
}
|
|
44
|
+
|
|
45
|
+
export default checkXSS;
|
|
@@ -1,72 +1,72 @@
|
|
|
1
|
-
const xssInjection = [
|
|
2
|
-
'onkeypress=',
|
|
3
|
-
'onkeyup=',
|
|
4
|
-
'ondblclick=',
|
|
5
|
-
'onerror=',
|
|
6
|
-
'onmouseover=',
|
|
7
|
-
'<meta',
|
|
8
|
-
'<script',
|
|
9
|
-
'vascript:',
|
|
10
|
-
'onkeydown=',
|
|
11
|
-
'onmousedown=',
|
|
12
|
-
'onmouseenter=',
|
|
13
|
-
'onmouseleave=',
|
|
14
|
-
'onmousemove=',
|
|
15
|
-
'onmouseout=',
|
|
16
|
-
'onmouseup=',
|
|
17
|
-
'onmousewheel=',
|
|
18
|
-
'onpaste=',
|
|
19
|
-
'onscroll=',
|
|
20
|
-
'onwheel=',
|
|
21
|
-
'javascript:',
|
|
22
|
-
'\\x',
|
|
23
|
-
'eval(',
|
|
24
|
-
'onmouseover=',
|
|
25
|
-
'action=',
|
|
26
|
-
'xlink:',
|
|
27
|
-
'allowscriptaccess',
|
|
28
|
-
'href=',
|
|
29
|
-
'behavior:',
|
|
30
|
-
'onreadystatechange=',
|
|
31
|
-
'onstart=',
|
|
32
|
-
'offline=',
|
|
33
|
-
'onabort=',
|
|
34
|
-
'onafterprint=',
|
|
35
|
-
'onbeforeonload=',
|
|
36
|
-
'onbeforeprint=',
|
|
37
|
-
'onblur=',
|
|
38
|
-
'oncanplay=',
|
|
39
|
-
'oncanplaythrough=',
|
|
40
|
-
'onchange=',
|
|
41
|
-
'onclick=',
|
|
42
|
-
'oncontextmenu=',
|
|
43
|
-
'ondblclick=',
|
|
44
|
-
'ondrag=',
|
|
45
|
-
'ondragend=',
|
|
46
|
-
'ondragenter=',
|
|
47
|
-
'ondragleave=',
|
|
48
|
-
'ondragover=',
|
|
49
|
-
'ondragstart=',
|
|
50
|
-
'ondrop=',
|
|
51
|
-
'ondurationchange=',
|
|
52
|
-
'onemptied=',
|
|
53
|
-
'onended=',
|
|
54
|
-
'onerror=',
|
|
55
|
-
'onfocus=',
|
|
56
|
-
'onformchange=',
|
|
57
|
-
'onforminput=',
|
|
58
|
-
'onhaschange=',
|
|
59
|
-
'oninput=',
|
|
60
|
-
'oninvalid=',
|
|
61
|
-
'onkeydown=',
|
|
62
|
-
'onkeypress=',
|
|
63
|
-
'onkeyup=',
|
|
64
|
-
'onload=',
|
|
65
|
-
'onloadeddata=',
|
|
66
|
-
'onloadedmetadata=',
|
|
67
|
-
'onloadstart=',
|
|
68
|
-
'alert(',
|
|
69
|
-
'script:',
|
|
70
|
-
];
|
|
71
|
-
|
|
72
|
-
export default xssInjection;
|
|
1
|
+
const xssInjection = [
|
|
2
|
+
'onkeypress=',
|
|
3
|
+
'onkeyup=',
|
|
4
|
+
'ondblclick=',
|
|
5
|
+
'onerror=',
|
|
6
|
+
'onmouseover=',
|
|
7
|
+
'<meta',
|
|
8
|
+
'<script',
|
|
9
|
+
'vascript:',
|
|
10
|
+
'onkeydown=',
|
|
11
|
+
'onmousedown=',
|
|
12
|
+
'onmouseenter=',
|
|
13
|
+
'onmouseleave=',
|
|
14
|
+
'onmousemove=',
|
|
15
|
+
'onmouseout=',
|
|
16
|
+
'onmouseup=',
|
|
17
|
+
'onmousewheel=',
|
|
18
|
+
'onpaste=',
|
|
19
|
+
'onscroll=',
|
|
20
|
+
'onwheel=',
|
|
21
|
+
'javascript:',
|
|
22
|
+
'\\x',
|
|
23
|
+
'eval(',
|
|
24
|
+
'onmouseover=',
|
|
25
|
+
'action=',
|
|
26
|
+
'xlink:',
|
|
27
|
+
'allowscriptaccess',
|
|
28
|
+
'href=',
|
|
29
|
+
'behavior:',
|
|
30
|
+
'onreadystatechange=',
|
|
31
|
+
'onstart=',
|
|
32
|
+
'offline=',
|
|
33
|
+
'onabort=',
|
|
34
|
+
'onafterprint=',
|
|
35
|
+
'onbeforeonload=',
|
|
36
|
+
'onbeforeprint=',
|
|
37
|
+
'onblur=',
|
|
38
|
+
'oncanplay=',
|
|
39
|
+
'oncanplaythrough=',
|
|
40
|
+
'onchange=',
|
|
41
|
+
'onclick=',
|
|
42
|
+
'oncontextmenu=',
|
|
43
|
+
'ondblclick=',
|
|
44
|
+
'ondrag=',
|
|
45
|
+
'ondragend=',
|
|
46
|
+
'ondragenter=',
|
|
47
|
+
'ondragleave=',
|
|
48
|
+
'ondragover=',
|
|
49
|
+
'ondragstart=',
|
|
50
|
+
'ondrop=',
|
|
51
|
+
'ondurationchange=',
|
|
52
|
+
'onemptied=',
|
|
53
|
+
'onended=',
|
|
54
|
+
'onerror=',
|
|
55
|
+
'onfocus=',
|
|
56
|
+
'onformchange=',
|
|
57
|
+
'onforminput=',
|
|
58
|
+
'onhaschange=',
|
|
59
|
+
'oninput=',
|
|
60
|
+
'oninvalid=',
|
|
61
|
+
'onkeydown=',
|
|
62
|
+
'onkeypress=',
|
|
63
|
+
'onkeyup=',
|
|
64
|
+
'onload=',
|
|
65
|
+
'onloadeddata=',
|
|
66
|
+
'onloadedmetadata=',
|
|
67
|
+
'onloadstart=',
|
|
68
|
+
'alert(',
|
|
69
|
+
'script:',
|
|
70
|
+
];
|
|
71
|
+
|
|
72
|
+
export default xssInjection;
|
package/crud/funcs/dataDelete.js
CHANGED
|
@@ -1,15 +1,15 @@
|
|
|
1
|
-
import getPG from '../../pg/funcs/getPG.js';
|
|
2
|
-
|
|
3
|
-
import getMeta from '../../pg/funcs/getMeta.js';
|
|
4
|
-
|
|
5
|
-
export default async function dataDelete({
|
|
6
|
-
table, id,
|
|
7
|
-
}) {
|
|
8
|
-
const pg = getPG({ name: 'client' });
|
|
9
|
-
const { pk } = await getMeta(table);
|
|
10
|
-
if (!pg.tlist?.includes(table)) return 'table not exist';
|
|
11
|
-
const delQuery = `delete from ${table} WHERE ${pk} = $1 returning *`;
|
|
12
|
-
// console.log(updateDataset);
|
|
13
|
-
const res = await pg.one(delQuery, [id]) || {};
|
|
14
|
-
return res;
|
|
15
|
-
}
|
|
1
|
+
import getPG from '../../pg/funcs/getPG.js';
|
|
2
|
+
|
|
3
|
+
import getMeta from '../../pg/funcs/getMeta.js';
|
|
4
|
+
|
|
5
|
+
export default async function dataDelete({
|
|
6
|
+
table, id,
|
|
7
|
+
}) {
|
|
8
|
+
const pg = getPG({ name: 'client' });
|
|
9
|
+
const { pk } = await getMeta(table);
|
|
10
|
+
if (!pg.tlist?.includes(table)) return 'table not exist';
|
|
11
|
+
const delQuery = `delete from ${table} WHERE ${pk} = $1 returning *`;
|
|
12
|
+
// console.log(updateDataset);
|
|
13
|
+
const res = await pg.one(delQuery, [id]) || {};
|
|
14
|
+
return res;
|
|
15
|
+
}
|
package/crud/funcs/dataInsert.js
CHANGED
|
@@ -1,24 +1,24 @@
|
|
|
1
|
-
import getPG from '../../pg/funcs/getPG.js';
|
|
2
|
-
import getMeta from '../../pg/funcs/getMeta.js';
|
|
3
|
-
|
|
4
|
-
export default async function dataInsert({ table, data }) {
|
|
5
|
-
const pg = getPG({ name: 'client' });
|
|
6
|
-
if (!data) return null;
|
|
7
|
-
const { columns } = await getMeta(table);
|
|
8
|
-
if (!columns) return null;
|
|
9
|
-
|
|
10
|
-
const names = columns.map((el) => el.name);
|
|
11
|
-
const filterData = Object.keys(data)
|
|
12
|
-
.filter((el) => data[el] && names.includes(el)).map((el) => [el, data[el]]);
|
|
13
|
-
|
|
14
|
-
const insertQuery = `insert into ${table}
|
|
15
|
-
|
|
16
|
-
( ${filterData?.map((key) => `"${key[0]}"`).join(',')})
|
|
17
|
-
|
|
18
|
-
values (${filterData?.map((key, i) => `$${i + 1}`).join(',')})
|
|
19
|
-
|
|
20
|
-
returning *`;
|
|
21
|
-
|
|
22
|
-
const res = await pg.query(insertQuery, [...filterData.map((el) => (typeof el[1] === 'object' ? JSON.stringify(el[1]) : el[1]))]) || {};
|
|
23
|
-
return res;
|
|
24
|
-
}
|
|
1
|
+
import getPG from '../../pg/funcs/getPG.js';
|
|
2
|
+
import getMeta from '../../pg/funcs/getMeta.js';
|
|
3
|
+
|
|
4
|
+
export default async function dataInsert({ table, data }) {
|
|
5
|
+
const pg = getPG({ name: 'client' });
|
|
6
|
+
if (!data) return null;
|
|
7
|
+
const { columns } = await getMeta(table);
|
|
8
|
+
if (!columns) return null;
|
|
9
|
+
|
|
10
|
+
const names = columns.map((el) => el.name);
|
|
11
|
+
const filterData = Object.keys(data)
|
|
12
|
+
.filter((el) => data[el] && names.includes(el)).map((el) => [el, data[el]]);
|
|
13
|
+
|
|
14
|
+
const insertQuery = `insert into ${table}
|
|
15
|
+
|
|
16
|
+
( ${filterData?.map((key) => `"${key[0]}"`).join(',')})
|
|
17
|
+
|
|
18
|
+
values (${filterData?.map((key, i) => `$${i + 1}`).join(',')})
|
|
19
|
+
|
|
20
|
+
returning *`;
|
|
21
|
+
|
|
22
|
+
const res = await pg.query(insertQuery, [...filterData.map((el) => (typeof el[1] === 'object' ? JSON.stringify(el[1]) : el[1]))]) || {};
|
|
23
|
+
return res;
|
|
24
|
+
}
|