@rainbow-o23/n3 1.0.33 → 1.0.35

package/index.cjs

@@ -21,6 +21,10 @@ const ERR_PIPELINE_STEP_REF_NOT_EMPTY = 'O03-00013';
 const ERR_PIPELINE_STEP_REF_NOT_FOUND = 'O03-00014';
 const ERR_PIPELINE_REF_NOT_EMPTY = 'O03-00015';
 const ERR_PIPELINE_REF_NOT_FOUND = 'O03-00016';
+const ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL = 'O03-00017';
+const ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS = 'O03-00018';
+const ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL = 'O03-00019';
+const ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION = 'O03-00020';
 
 class AbstractTypeOrmDataSource {
     _name;
@@ -322,6 +326,34 @@ class TypeOrmDataSourceHelper {
 
 const AsyncFunction = Object.getPrototypeOf(async function () {
 }).constructor;
+const createGlobalProxy = (ex) => {
+    return new Proxy({}, {
+        get() {
+            ex();
+        },
+        set() {
+            ex();
+        },
+        apply() {
+            ex();
+        }
+    });
+};
+const AvoidNames = ['global', 'process', 'eval', 'Function'];
+const AvoidProxyObjects = [
+    createGlobalProxy(() => {
+        throw new n1.UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL, 'Cannot use global in dynamic snippet.');
+    }),
+    createGlobalProxy(() => {
+        throw new n1.UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS, 'Cannot use process in dynamic snippet.');
+    }),
+    createGlobalProxy(() => {
+        throw new n1.UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL, 'Cannot use eval in dynamic snippet.');
+    }),
+    createGlobalProxy(() => {
+        throw new n1.UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION, 'Cannot use Function in dynamic snippet.');
+    })
+];
 class Utils {
     static createFunction(snippet, creators) {
         try {
@@ -329,8 +361,23 @@ class Utils {
                 return creators.createDefault();
             }
             else if (typeof snippet === 'string') {
-                const F = creators.async ? AsyncFunction : Function;
-                return new F(...creators.getVariableNames(), snippet);
+                const variableNames = creators.getVariableNames() ?? [];
+                if (creators.async) {
+                    const func = new AsyncFunction(...variableNames, ...AvoidNames, snippet);
+                    return (async (...args) => {
+                        const availableArgs = [...args];
+                        availableArgs.length = variableNames.length;
+                        return await func(...availableArgs, ...AvoidProxyObjects);
+                    });
+                }
+                else {
+                    const func = new Function(...variableNames, ...AvoidNames, snippet);
+                    return ((...args) => {
+                        const availableArgs = [...args];
+                        availableArgs.length = variableNames.length;
+                        return func(...availableArgs, ...AvoidProxyObjects);
+                    });
+                }
             }
             else {
                 return snippet;
@@ -517,7 +564,16 @@ class AbstractFragmentaryPipelineStep extends n1.AbstractPipelineStep {
             }
         }
         else if (typeof funcOrSnippet === 'string') {
-            const func = new Function(...this.generateToResponseVariableNames(), funcOrSnippet);
+            const func = Utils.createSyncFunction(funcOrSnippet, {
+                createDefault: () => {
+                    throw new n1.UncatchableError(ERR_PIPELINE_STEP_SNIPPET_NOT_EMPTY, 'Cannot create perform func on empty snippet.');
+                },
+                getVariableNames: () => this.generateToResponseVariableNames(),
+                error: (e) => {
+                    this.getLogger().error(`Failed on create function for snippet[${funcOrSnippet}].`);
+                    throw e;
+                }
+            });
             if (this.useUnboxMerging()) {
                 return ($result, $request, $helpers, $) => {
                     const r = func($result, $request, $helpers, $);
@@ -2277,6 +2333,10 @@ exports.ERR_EACH_FRAGMENT_NOT_ANY_ARRAY = ERR_EACH_FRAGMENT_NOT_ANY_ARRAY;
 exports.ERR_FETCH_ERROR = ERR_FETCH_ERROR;
 exports.ERR_PIPELINE_REF_NOT_EMPTY = ERR_PIPELINE_REF_NOT_EMPTY;
 exports.ERR_PIPELINE_REF_NOT_FOUND = ERR_PIPELINE_REF_NOT_FOUND;
+exports.ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL = ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL;
+exports.ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION = ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION;
+exports.ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL = ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL;
+exports.ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS = ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS;
 exports.ERR_PIPELINE_STEP_CONDITIONAL_SNIPPET_NOT_EMPTY = ERR_PIPELINE_STEP_CONDITIONAL_SNIPPET_NOT_EMPTY;
 exports.ERR_PIPELINE_STEP_METHOD_NOT_SUPPORTED = ERR_PIPELINE_STEP_METHOD_NOT_SUPPORTED;
 exports.ERR_PIPELINE_STEP_REF_NOT_EMPTY = ERR_PIPELINE_STEP_REF_NOT_EMPTY;

package/index.js

@@ -19,6 +19,10 @@ const ERR_PIPELINE_STEP_REF_NOT_EMPTY = 'O03-00013';
 const ERR_PIPELINE_STEP_REF_NOT_FOUND = 'O03-00014';
 const ERR_PIPELINE_REF_NOT_EMPTY = 'O03-00015';
 const ERR_PIPELINE_REF_NOT_FOUND = 'O03-00016';
+const ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL = 'O03-00017';
+const ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS = 'O03-00018';
+const ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL = 'O03-00019';
+const ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION = 'O03-00020';
 
 class AbstractTypeOrmDataSource {
     _name;
@@ -320,6 +324,34 @@ class TypeOrmDataSourceHelper {
 
 const AsyncFunction = Object.getPrototypeOf(async function () {
 }).constructor;
+const createGlobalProxy = (ex) => {
+    return new Proxy({}, {
+        get() {
+            ex();
+        },
+        set() {
+            ex();
+        },
+        apply() {
+            ex();
+        }
+    });
+};
+const AvoidNames = ['global', 'process', 'eval', 'Function'];
+const AvoidProxyObjects = [
+    createGlobalProxy(() => {
+        throw new UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL, 'Cannot use global in dynamic snippet.');
+    }),
+    createGlobalProxy(() => {
+        throw new UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS, 'Cannot use process in dynamic snippet.');
+    }),
+    createGlobalProxy(() => {
+        throw new UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL, 'Cannot use eval in dynamic snippet.');
+    }),
+    createGlobalProxy(() => {
+        throw new UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION, 'Cannot use Function in dynamic snippet.');
+    })
+];
 class Utils {
     static createFunction(snippet, creators) {
         try {
@@ -327,8 +359,23 @@ class Utils {
                 return creators.createDefault();
             }
             else if (typeof snippet === 'string') {
-                const F = creators.async ? AsyncFunction : Function;
-                return new F(...creators.getVariableNames(), snippet);
+                const variableNames = creators.getVariableNames() ?? [];
+                if (creators.async) {
+                    const func = new AsyncFunction(...variableNames, ...AvoidNames, snippet);
+                    return (async (...args) => {
+                        const availableArgs = [...args];
+                        availableArgs.length = variableNames.length;
+                        return await func(...availableArgs, ...AvoidProxyObjects);
+                    });
+                }
+                else {
+                    const func = new Function(...variableNames, ...AvoidNames, snippet);
+                    return ((...args) => {
+                        const availableArgs = [...args];
+                        availableArgs.length = variableNames.length;
+                        return func(...availableArgs, ...AvoidProxyObjects);
+                    });
+                }
             }
             else {
                 return snippet;
@@ -515,7 +562,16 @@ class AbstractFragmentaryPipelineStep extends AbstractPipelineStep {
             }
         }
         else if (typeof funcOrSnippet === 'string') {
-            const func = new Function(...this.generateToResponseVariableNames(), funcOrSnippet);
+            const func = Utils.createSyncFunction(funcOrSnippet, {
+                createDefault: () => {
+                    throw new UncatchableError(ERR_PIPELINE_STEP_SNIPPET_NOT_EMPTY, 'Cannot create perform func on empty snippet.');
+                },
+                getVariableNames: () => this.generateToResponseVariableNames(),
+                error: (e) => {
+                    this.getLogger().error(`Failed on create function for snippet[${funcOrSnippet}].`);
+                    throw e;
+                }
+            });
             if (this.useUnboxMerging()) {
                 return ($result, $request, $helpers, $) => {
                     const r = func($result, $request, $helpers, $);
@@ -2261,4 +2317,4 @@ class TypeOrmTransactionalPipelineStepSets extends PipelineStepSets {
     }
 }
 
-export { AbstractFragmentaryPipelineStep, AbstractTypeOrmBySQLPipelineStep, AbstractTypeOrmDataSource, AbstractTypeOrmLoadBySQLPipelineStep, AbstractTypeOrmPipelineStep, AsyncPipelineStepSets, BetterSqlite3TypeOrmDatasource, ConditionalPipelineStepSets, DEFAULT_TRANSACTION_NAME, DeletePropertyPipelineStep, ERR_EACH_FRAGMENT_NOT_ANY_ARRAY, ERR_FETCH_ERROR, ERR_PIPELINE_REF_NOT_EMPTY, ERR_PIPELINE_REF_NOT_FOUND, ERR_PIPELINE_STEP_CONDITIONAL_SNIPPET_NOT_EMPTY, ERR_PIPELINE_STEP_METHOD_NOT_SUPPORTED, ERR_PIPELINE_STEP_REF_NOT_EMPTY, ERR_PIPELINE_STEP_REF_NOT_FOUND, ERR_PIPELINE_STEP_SNIPPET_NOT_EMPTY, ERR_TYPEORM_DATASOURCE_CREATOR_NOT_FOUND, ERR_TYPEORM_DATASOURCE_NOT_FOUND, ERR_TYPEORM_DATASOURCE_TYPE_NOT_FOUND, ERR_TYPEORM_ENTITY_NOT_FOUND, ERR_TYPEORM_SQL_NOT_EMPTY, ERR_TYPEORM_STEP_SNIPPET_NOT_EMPTY, ERR_TYPEORM_TRANSACTION_NOT_FOUND, EachPipelineStepSets, FetchPipelineStep, GetPropertyPipelineStep, HttpAbortErrorCode, HttpUnknownErrorCode, MssqlTypeOrmDatasource, MysqlTypeOrmDatasource, OracleTypeOrmDatasource, ParallelPipelineStepSets, ParsedSqlSegmentType, PgsqlTypeOrmDatasource, PipelineStepSets, RefPipelinePipelineStep, RefStepPipelineStep, RoutesPipelineStepSets, SnippetPipelineStep, SnowflakePipelineStep, SupportedDataSourceTypes, TypeOrmBulkSaveBySQLPipelineStep, TypeOrmBySnippetPipelineStep, TypeOrmDataSourceHelper, TypeOrmDataSourceManager, TypeOrmLoadEntityByIdPipelineStep, TypeOrmLoadManyBySQLPipelineStep, TypeOrmLoadOneBySQLPipelineStep, TypeOrmParsedSQLCache, TypeOrmSaveBySQLPipelineStep, TypeOrmSaveEntityPipelineStep, TypeOrmTransactionalPipelineStepSets, Utils };
+export { AbstractFragmentaryPipelineStep, AbstractTypeOrmBySQLPipelineStep, AbstractTypeOrmDataSource, AbstractTypeOrmLoadBySQLPipelineStep, AbstractTypeOrmPipelineStep, AsyncPipelineStepSets, BetterSqlite3TypeOrmDatasource, ConditionalPipelineStepSets, DEFAULT_TRANSACTION_NAME, DeletePropertyPipelineStep, ERR_EACH_FRAGMENT_NOT_ANY_ARRAY, ERR_FETCH_ERROR, ERR_PIPELINE_REF_NOT_EMPTY, ERR_PIPELINE_REF_NOT_FOUND, ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL, ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION, ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL, ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS, ERR_PIPELINE_STEP_CONDITIONAL_SNIPPET_NOT_EMPTY, ERR_PIPELINE_STEP_METHOD_NOT_SUPPORTED, ERR_PIPELINE_STEP_REF_NOT_EMPTY, ERR_PIPELINE_STEP_REF_NOT_FOUND, ERR_PIPELINE_STEP_SNIPPET_NOT_EMPTY, ERR_TYPEORM_DATASOURCE_CREATOR_NOT_FOUND, ERR_TYPEORM_DATASOURCE_NOT_FOUND, ERR_TYPEORM_DATASOURCE_TYPE_NOT_FOUND, ERR_TYPEORM_ENTITY_NOT_FOUND, ERR_TYPEORM_SQL_NOT_EMPTY, ERR_TYPEORM_STEP_SNIPPET_NOT_EMPTY, ERR_TYPEORM_TRANSACTION_NOT_FOUND, EachPipelineStepSets, FetchPipelineStep, GetPropertyPipelineStep, HttpAbortErrorCode, HttpUnknownErrorCode, MssqlTypeOrmDatasource, MysqlTypeOrmDatasource, OracleTypeOrmDatasource, ParallelPipelineStepSets, ParsedSqlSegmentType, PgsqlTypeOrmDatasource, PipelineStepSets, RefPipelinePipelineStep, RefStepPipelineStep, RoutesPipelineStepSets, SnippetPipelineStep, SnowflakePipelineStep, SupportedDataSourceTypes, TypeOrmBulkSaveBySQLPipelineStep, TypeOrmBySnippetPipelineStep, TypeOrmDataSourceHelper, TypeOrmDataSourceManager, TypeOrmLoadEntityByIdPipelineStep, TypeOrmLoadManyBySQLPipelineStep, TypeOrmLoadOneBySQLPipelineStep, TypeOrmParsedSQLCache, TypeOrmSaveBySQLPipelineStep, TypeOrmSaveEntityPipelineStep, TypeOrmTransactionalPipelineStepSets, Utils };

package/lib/error-codes.d.ts

@@ -15,3 +15,7 @@ export declare const ERR_PIPELINE_STEP_REF_NOT_EMPTY: O23ReservedErrorCode;
 export declare const ERR_PIPELINE_STEP_REF_NOT_FOUND: O23ReservedErrorCode;
 export declare const ERR_PIPELINE_REF_NOT_EMPTY: O23ReservedErrorCode;
 export declare const ERR_PIPELINE_REF_NOT_FOUND: O23ReservedErrorCode;
+export declare const ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL: O23ReservedErrorCode;
+export declare const ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS: O23ReservedErrorCode;
+export declare const ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL: O23ReservedErrorCode;
+export declare const ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION: O23ReservedErrorCode;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rainbow-o23/n3",
-	"version": "1.0.33",
+	"version": "1.0.35",
 	"description": "o23 pipelines",
 	"main": "index.cjs",
 	"module": "index.js",
@@ -21,7 +21,7 @@
 		"url": "https://github.com/InsureMO/rainbow-o23/issues"
 	},
 	"dependencies": {
-		"@rainbow-o23/n1": "1.0.33",
+		"@rainbow-o23/n1": "1.0.35",
 		"@theinternetfolks/snowflake": "^1.3.0",
 		"node-fetch": "2.6.7",
 		"typeorm": "^0.3.17"
@@ -41,7 +41,7 @@
 		"better-sqlite3": "^9.0.0",
 		"eslint": "^8.29.0",
 		"mssql": "^10.0.1",
-		"mysql2": "^3.9.4",
+		"mysql2": "^3.9.7",
 		"oracledb": "^6.2.0",
 		"pg": "^8.11.3",
 		"pg-query-stream": "^4.5.3",

package/src/lib/error-codes.ts

@@ -16,3 +16,7 @@ export const ERR_PIPELINE_STEP_REF_NOT_EMPTY: O23ReservedErrorCode = 'O03-00013'
 export const ERR_PIPELINE_STEP_REF_NOT_FOUND: O23ReservedErrorCode = 'O03-00014';
 export const ERR_PIPELINE_REF_NOT_EMPTY: O23ReservedErrorCode = 'O03-00015';
 export const ERR_PIPELINE_REF_NOT_FOUND: O23ReservedErrorCode = 'O03-00016';
+export const ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL: O23ReservedErrorCode = 'O03-00017';
+export const ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS: O23ReservedErrorCode = 'O03-00018';
+export const ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL: O23ReservedErrorCode = 'O03-00019';
+export const ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION: O23ReservedErrorCode = 'O03-00020';

package/src/lib/step/abstract-fragmentary-pipeline-step.ts

@@ -10,6 +10,7 @@ import {
 	PipelineStepPayload,
 	UncatchableError
 } from '@rainbow-o23/n1';
+import {ERR_PIPELINE_STEP_SNIPPET_NOT_EMPTY} from '../error-codes';
 import {PipelineStepSetsContext} from './step-sets';
 import {
 	HandleAnyError,
@@ -210,7 +211,17 @@ export abstract class AbstractFragmentaryPipelineStep<In = PipelineStepPayload,
 				};
 			}
 		} else if (typeof funcOrSnippet === 'string') {
-			const func = new Function(...this.generateToResponseVariableNames(), funcOrSnippet);
+			// eslint-disable-next-line @typescript-eslint/ban-types
+			const func: Function = Utils.createSyncFunction(funcOrSnippet, {
+				createDefault: (): never => {
+					throw new UncatchableError(ERR_PIPELINE_STEP_SNIPPET_NOT_EMPTY, 'Cannot create perform func on empty snippet.');
+				},
+				getVariableNames: () => this.generateToResponseVariableNames(),
+				error: (e: Error) => {
+					this.getLogger().error(`Failed on create function for snippet[${funcOrSnippet}].`);
+					throw e;
+				}
+			});
 			if (this.useUnboxMerging()) {
 				return ($result: OutFragment, $request: PipelineStepData<In>, $helpers: PipelineStepHelpers, $: PipelineStepHelpers): Out => {
 					const r = func($result, $request, $helpers, $);

package/src/lib/step/utils.ts

@@ -1,4 +1,10 @@
-import {Nullable, Undefinable} from '@rainbow-o23/n1';
+import {Nullable, UncatchableError, Undefinable} from '@rainbow-o23/n1';
+import {
+	ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL,
+	ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION,
+	ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL,
+	ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS
+} from '../error-codes';
 import {ScriptFuncOrBody} from './types';
 
 // get async function constructor, to create the dynamic function
@@ -6,6 +12,35 @@ const AsyncFunction = Object.getPrototypeOf(async function () {
 	// nothing, since this purpose is get the constructor, body is not concerned
 }).constructor;
 
+const createGlobalProxy = (ex: () => never) => {
+	return new Proxy({}, {
+		get() {
+			ex();
+		},
+		set() {
+			ex();
+		},
+		apply() {
+			ex();
+		}
+	});
+};
+const AvoidNames = ['global', 'process', 'eval', 'Function'];
+const AvoidProxyObjects = [
+	createGlobalProxy(() => {
+		throw new UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL, 'Cannot use global in dynamic snippet.');
+	}),
+	createGlobalProxy(() => {
+		throw new UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_PROCESS, 'Cannot use process in dynamic snippet.');
+	}),
+	createGlobalProxy(() => {
+		throw new UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_EVAL, 'Cannot use eval in dynamic snippet.');
+	}),
+	createGlobalProxy(() => {
+		throw new UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_FUNCTION, 'Cannot use Function in dynamic snippet.');
+	})
+];
+
 export class Utils {
 	// eslint-disable-next-line @typescript-eslint/ban-types
 	public static createFunction<F = Function>(snippet: ScriptFuncOrBody<F>, creators: {
@@ -18,8 +53,32 @@ export class Utils {
 			if (snippet == null || (typeof snippet === 'string' && snippet.trim().length === 0)) {
 				return creators.createDefault();
 			} else if (typeof snippet === 'string') {
-				const F = creators.async ? AsyncFunction : Function;
-				return new F(...creators.getVariableNames(), snippet) as F;
+				// if (snippet.includes('global')) {
+				// 	// noinspection ExceptionCaughtLocallyJS
+				// 	throw new UncatchableError(ERR_PIPELINE_SNIPPET_CANNOT_USE_GLOBAL, '"global" is not allowed in dynamic snippet.');
+				// }
+				const variableNames = creators.getVariableNames() ?? [];
+				if (creators.async) {
+					const func = new AsyncFunction(...variableNames, ...AvoidNames, snippet);
+					// eslint-disable-next-line @typescript-eslint/no-explicit-any
+					return (async (...args: Array<any>) => {
+						const availableArgs = [...args];
+						availableArgs.length = variableNames.length;
+						// Pass specified length of parameters,
+						// along with an additional global object to prevent internal access to the actual global object.
+						return await func(...availableArgs, ...AvoidProxyObjects);
+					}) as F;
+				} else {
+					const func = new Function(...variableNames, ...AvoidNames, snippet);
+					// eslint-disable-next-line @typescript-eslint/no-explicit-any
+					return ((...args: Array<any>) => {
+						const availableArgs = [...args];
+						availableArgs.length = variableNames.length;
+						// Pass specified length of parameters,
+						// along with an additional global object to prevent internal access to the actual global object.
+						return func(...availableArgs, ...AvoidProxyObjects);
+					}) as F;
+				}
 			} else {
 				return snippet;
 			}