@steedos/filters 3.0.15-beta.51 → 3.0.15-beta.52

package/dist/steedos-filters.umd.js

@@ -839,27 +839,43 @@
         return operation === "between";
     };
 
-    // "{userId}"或"{user.name}"格式
+    // "{userId}"或"{user.name}"格式，整个值必须是一个公式，不支持表达式
+    // 兼容原eval实现下也能取值的"{{userId}}"、"{{user.name}}"写法
+    const FORMULA_REG = /^(?:\{(\w+)(?:\.(\w+))?\}|\{\{(\w+)(?:\.(\w+))?\}\})$/;
+    // 原eval实现判断是否为公式的规则，含有"{xxx}"但不是上面格式的值以前会被当作JS表达式执行
+    const LEGACY_FORMULA_REG = /\{\w+(\.\w+)?\}/;
+    const FORBIDDEN_KEYS = ["__proto__", "prototype", "constructor"];
+
     let checkFormula = (formula) => {
-        return typeof formula === "string" && /\{\w+(\.\w+)?\}/.test(formula);
+        // 与原eval实现保持一致：忽略首尾空白
+        return typeof formula === "string" && FORMULA_REG.test(formula.trim());
     };
 
-    // "{userId}"转换为"this['userId']","{user.name}"转换为"this['user'].['name']"
-    let prepareFormula = (formula, prefix = "this") => {
-        var reg, rev;
-        reg = /(\{[^{}]*\})/g;
-        rev = formula.replace(reg, function (m, $1) {
-            return prefix + $1.replace(/\{\s*/, "[\"").replace(/\s*\}/, "\"]").replace(/\s*\.\s*/g, "\"][\"");
-        });
-        return rev;
+    // "{userId}"解析为["userId"],"{user.name}"解析为["user", "name"]
+    let prepareFormula = (formula) => {
+        const match = FORMULA_REG.exec(formula.trim());
+        const key = match[1] || match[3];
+        const subKey = match[2] || match[4];
+        return subKey ? [key, subKey] : [key];
     };
 
+    // 按路径从context中取值，不使用eval，避免执行任意代码
     let evaluateFormula = (formula, context) => {
         if (checkFormula(formula)) {
-            formula = prepareFormula(formula);
-            return function () {
-                return eval(formula);
-            }.call(context);
+            const keys = prepareFormula(formula);
+            let value = context;
+            for (const key of keys) {
+                if (FORBIDDEN_KEYS.indexOf(key) > -1) {
+                    return undefined;
+                }
+                // 与原eval实现保持一致：中间值为空时抛出异常
+                value = value[key];
+            }
+            return value;
+        }
+        else if (typeof formula === "string" && LEGACY_FORMULA_REG.test(formula)) {
+            // 出于安全考虑不再执行JS表达式，与原实现中表达式无法解析时一样抛出异常，由调用方按原有逻辑处理
+            throw new Error(`Unsupported filter formula: ${formula}`);
         }
         else {
             return formula;

package/dist/steedos-filters.umd.min.js

@@ -1,4 +1,4 @@
-(function(global,factory){typeof exports==="object"&&typeof module!=="undefined"?factory(exports,require("lodash"),require("moment")):typeof define==="function"&&define.amd?define(["exports","lodash","moment"],factory):(global=typeof globalThis!=="undefined"?globalThis:global||self,factory(global.SteedosFilters={},global._,global.moment))})(this,function(exports,lodash,moment){function leftPad(text,length){while(text.length<length){text="0"+text}return text}var FORMAT_TYPES={3:"abbreviated",4:"wide",5:"narrow"};var LDML_FORMATTERS={y:function(date,count,useUtc){var year=date[useUtc?"getUTCFullYear":"getFullYear"]();if(count===2){year=year%100}return leftPad(year.toString(),count)},M:function(date,count,useUtc,dateParts){var month=date[useUtc?"getUTCMonth":"getMonth"]();var formatType=FORMAT_TYPES[count];if(formatType){return dateParts.getMonthNames(formatType,"format")[month]}return leftPad((month+1).toString(),Math.min(count,2))},L:function(date,count,useUtc,dateParts){var month=date[useUtc?"getUTCMonth":"getMonth"]();var formatType=FORMAT_TYPES[count];if(formatType){return dateParts.getMonthNames(formatType,"standalone")[month]}return leftPad((month+1).toString(),Math.min(count,2))},Q:function(date,count,useUtc,dateParts){var month=date[useUtc?"getUTCMonth":"getMonth"]();var quarter=Math.floor(month/3);var formatType=FORMAT_TYPES[count];if(formatType){return dateParts.getQuarterNames(formatType)[quarter]}return leftPad((quarter+1).toString(),Math.min(count,2))},E:function(date,count,useUtc,dateParts){var day=date[useUtc?"getUTCDay":"getDay"]();var formatType=FORMAT_TYPES[count<3?3:count];return dateParts.getDayNames(formatType)[day]},a:function(date,count,useUtc,dateParts){var hours=date[useUtc?"getUTCHours":"getHours"](),period=hours<12?0:1,formatType=FORMAT_TYPES[count];return dateParts.getPeriodNames(formatType)[period]},d:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCDate":"getDate"]().toString(),Math.min(count,2))},H:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCHours":"getHours"]().toString(),Math.min(count,2))},h:function(date,count,useUtc){var hours=date[useUtc?"getUTCHours":"getHours"]();return leftPad((hours%12||12).toString(),Math.min(count,2))},m:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCMinutes":"getMinutes"]().toString(),Math.min(count,2))},s:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCSeconds":"getSeconds"]().toString(),Math.min(count,2))},S:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCMilliseconds":"getMilliseconds"]().toString(),3).substr(0,count)},x:function(date,count,useUtc){var timezoneOffset=useUtc?0:date.getTimezoneOffset(),signPart=timezoneOffset>0?"-":"+",timezoneOffsetAbs=Math.abs(timezoneOffset),hours=Math.floor(timezoneOffsetAbs/60),minutes=timezoneOffsetAbs%60,hoursPart=leftPad(hours.toString(),2),minutesPart=leftPad(minutes.toString(),2);return signPart+hoursPart+(count>=3?":":"")+(count>1||minutes?minutesPart:"")},X:function(date,count,useUtc){if(useUtc||!date.getTimezoneOffset()){return"Z"}return LDML_FORMATTERS.x(date,count,useUtc)},Z:function(date,count,useUtc){return LDML_FORMATTERS.X(date,count>=5?3:2,useUtc)}};var getFormatter=function(format,dateParts){return function(date){var charIndex,formatter,char,charCount=0,separator="'",isEscaping=false,isCurrentCharEqualsNext,result="";if(!date)return null;if(!format)return date;var useUtc=format[format.length-1]==="Z"||format.slice(-3)==="'Z'";for(charIndex=0;charIndex<format.length;charIndex++){char=format[charIndex];formatter=LDML_FORMATTERS[char];isCurrentCharEqualsNext=char===format[charIndex+1];charCount++;if(!isCurrentCharEqualsNext){if(formatter&&!isEscaping){result+=formatter(date,charCount,useUtc,dateParts)}charCount=0}if(char===separator&&!isCurrentCharEqualsNext){isEscaping=!isEscaping}else if(isEscaping||!formatter){result+=char}if(char===separator&&isCurrentCharEqualsNext){charIndex++}}return result}};const _getFormatter=getFormatter;var MONTHS=["January","February","March","April","May","June","July","August","September","October","November","December"],DAYS=["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"],PERIODS=["AM","PM"],QUARTERS=["Q1","Q2","Q3","Q4"];var cutCaptions=function(captions,format){var lengthByFormat={abbreviated:3,short:2,narrow:1};return captions.map(function(caption){return caption.substr(0,lengthByFormat[format])})};function getMonthNames(format){return cutCaptions(MONTHS,format)}function getDayNames(format){return cutCaptions(DAYS,format)}function getQuarterNames(format){return QUARTERS}function getPeriodNames(format){return PERIODS}var defaultDateNames={getMonthNames:getMonthNames,getDayNames:getDayNames,getQuarterNames:getQuarterNames,getPeriodNames:getPeriodNames};const DevExpressData={utils:{isConjunctiveOperator:function(condition){return/^(and|&&|&)$/i.test(condition)},normalizeBinaryCriterion:function(crit){return[crit[0],crit.length<3?"=":String(crit[1]).toLowerCase(),crit.length<2?true:crit[crit.length-1]]},isUnaryOperation:function(crit){return crit[0]==="!"&&Array.isArray(crit[1])}}};const DevExpressOData={pad(text,length,right){text=String(text);while(text.length<length){text=right?text+"0":"0"+text}return text},padLeft2(text){return this.pad(text,2)},serializePropName(propName){return propName.replace(/\./g,"/")},serializeValue(value,protocolVersion){if(value===undefined){return null}switch(protocolVersion){case 2:return this.serializeValueV2(value);case 3:return this.serializeValueV2(value);case 4:return this.serializeValueV4(value);default:return this.serializeValueV4(value)}},serializeValueV2(value){if(value instanceof Date){return this.serializeDate(value)}if(typeof value==="string"){return this.serializeString(value)}return String(value)},serializeValueV4(value){if(value instanceof Date){return this.formatISO8601(value,false,false)}if(Array.isArray(value)){return"["+value.map(item=>{return this.serializeValueV4(item)}).join(",")+"]"}return this.serializeValueV2(value)},serializeString(value){return"'"+value.replace(/'/g,"''")+"'"},serializeDate(value,serializationFormat){if(!serializationFormat){return value}if(!(value instanceof Date)){return null}if(serializationFormat==="number"){return value&&value.valueOf?value.valueOf():null}return _getFormatter(serializationFormat,defaultDateNames)(value)},formatISO8601(date,skipZeroTime,skipTimezone){var bag=[];var isZeroTime=function(){return date.getUTCHours()+date.getUTCMinutes()+date.getUTCSeconds()+date.getUTCMilliseconds()<1};bag.push(date.getUTCFullYear());bag.push("-");bag.push(this.padLeft2(date.getUTCMonth()+1));bag.push("-");bag.push(this.padLeft2(date.getUTCDate()));if(!(skipZeroTime&&isZeroTime())){bag.push("T");bag.push(this.padLeft2(date.getUTCHours()));bag.push(":");bag.push(this.padLeft2(date.getUTCMinutes()));bag.push(":");bag.push(this.padLeft2(date.getUTCSeconds()));if(date.getUTCMilliseconds()){bag.push(".");bag.push(this.pad(date.getUTCMilliseconds(),3))}if(!skipTimezone){bag.push("Z")}}return bag.join("")}};class SteedosFilter{constructor(filters,odataProtocolVersion=4,forceLowerCase){this.filters=filters||[];this.protocolVersion=odataProtocolVersion;this.forceLowerCase=forceLowerCase;this.formatters={"=":this.createBinaryOperationFormatter("eq"),"<>":this.createBinaryOperationFormatter("ne"),">":this.createBinaryOperationFormatter("gt"),">=":this.createBinaryOperationFormatter("ge"),"<":this.createBinaryOperationFormatter("lt"),"<=":this.createBinaryOperationFormatter("le"),startswith:this.createStringFuncFormatter("startswith"),endswith:this.createStringFuncFormatter("endswith")};this.formattersV2={...this.formatters,...{contains:this.createStringFuncFormatter("substringof",true),notcontains:this.createStringFuncFormatter("not substringof",true)}};this.formattersV4={...this.formatters,...{contains:this.createStringFuncFormatter("contains"),notcontains:this.createStringFuncFormatter("not contains"),notstartswith:this.createStringFuncFormatter("not startswith"),notendswith:this.createStringFuncFormatter("not endswith"),in:this.createBinaryOperationFormatter("in"),notin:this.createBinaryOperationFormatter("notin")}}}createBinaryOperationFormatter(op){return(prop,val)=>{return prop+" "+op+" "+val}}createStringFuncFormatter(op,reverse){return(prop,val)=>{var bag=[op,"("];if(val&&this.forceLowerCase){val=val.toLowerCase()}if(reverse){bag.push(val,",",prop)}else{bag.push(prop,",",val)}bag.push(")");return bag.join("")}}compileUnary(criteria){var op=criteria[0],crit=this.compileCore(criteria[1]);if(op==="!"){return"not ("+crit+")"}throw new Error("E4003")}compileGroup(criteria){var bag=[],groupOperator,nextGroupOperator;criteria.forEach(criterion=>{if(Array.isArray(criterion)){if(bag.length>1&&groupOperator!==nextGroupOperator){throw new Error("E4019")}bag.push("("+this.compileCore(criterion)+")");groupOperator=nextGroupOperator;nextGroupOperator="and"}else{nextGroupOperator=DevExpressData.utils.isConjunctiveOperator(criterion)?"and":"or"}});return bag.join(" "+groupOperator+" ")}compileBinary(criteria){criteria=DevExpressData.utils.normalizeBinaryCriterion(criteria);var op=criteria[1],formatters=this.protocolVersion===4?this.formattersV4:this.formattersV2,formatter=formatters[op.toLowerCase()];if(!formatter){throw new Error("E4003")}var fieldName=criteria[0],value=criteria[2];return formatter(DevExpressOData.serializePropName(fieldName),op==="in"||op==="notin"?value:DevExpressOData.serializeValue(value,this.protocolVersion))}compileCore(criteria){if(!criteria||criteria.length===0){return""}if(Array.isArray(criteria[0])){return this.compileGroup(criteria)}if(DevExpressData.utils.isUnaryOperation(criteria)){return this.compileUnary(criteria)}return this.compileBinary(criteria)}formatFiltersToODataQuery(){let filters=this.filters;let query=this.compileCore(filters);return query}}var filter=Object.freeze({__proto__:null,default:SteedosFilter});let t=key=>{return key};let getMonthDays=(year,month)=>{var days,endDate,millisecond,startDate;if(month===11){return 31}millisecond=1e3*60*60*24;startDate=new Date(year,month,1);endDate=new Date(year,month+1,1);days=(endDate-startDate)/millisecond;return days};let getNextQuarterFirstDay=(year,month)=>{if(!year){year=(new Date).getFullYear()}if(!month){month=(new Date).getMonth()}if(month<3){month=3}else if(month<6){month=6}else if(month<9){month=9}else{year++;month=0}return new Date(year,month,1)};let getLastMonthFirstDay=(year,month)=>{if(!year){year=(new Date).getFullYear()}if(!month){month=(new Date).getMonth()}if(month===0){month=11;year--;return new Date(year,month,1)}month--;return new Date(year,month,1)};let getQuarterStartMonth=month=>{if(!month){month=(new Date).getMonth()}if(month<3){return 0}else if(month<6){return 3}else if(month<9){return 6}return 9};let getLastQuarterFirstDay=(year,month)=>{if(!year){year=(new Date).getFullYear()}if(!month){month=(new Date).getMonth()}if(month<3){year--;month=9}else if(month<6){month=0}else if(month<9){month=3}else{month=6}return new Date(year,month,1)};let getBetweenTimeBuiltinValueItem=(key,utcOffset)=>{var currentMonth,currentYear,endValue,firstDay,label,lastDay,lastMonday,lastMonthFinalDay,lastMonthFirstDay,lastQuarterEndDay,lastQuarterStartDay,lastSunday,last_120_days,last_30_days,last_60_days,last_7_days,last_90_days,millisecond,minusDay,monday,month,nextMonday,nextMonthFinalDay,nextMonthFirstDay,nextQuarterEndDay,nextQuarterStartDay,nextSunday,nextYear,next_120_days,next_30_days,next_60_days,next_7_days,next_90_days,now,previousYear,startValue,strEndDay,strFirstDay,strLastDay,strMonday,strStartDay,strSunday,strToday,strTomorrow,strYestday,sunday,thisQuarterEndDay,thisQuarterStartDay,tomorrow,values,week,year,yestday;now=new Date;millisecond=1e3*60*60*24;yestday=new Date(now.getTime()-millisecond);tomorrow=new Date(now.getTime()+millisecond);week=now.getDay();minusDay=week!==0?week-1:6;monday=new Date(now.getTime()-minusDay*millisecond);sunday=new Date(monday.getTime()+6*millisecond);lastSunday=new Date(monday.getTime()-millisecond);lastMonday=new Date(lastSunday.getTime()-millisecond*6);nextMonday=new Date(sunday.getTime()+millisecond);nextSunday=new Date(nextMonday.getTime()+millisecond*6);currentYear=now.getFullYear();previousYear=currentYear-1;nextYear=currentYear+1;currentMonth=now.getMonth();year=now.getFullYear();month=now.getMonth();firstDay=new Date(currentYear,currentMonth,1);if(currentMonth===11){year++;month++}else{month++}nextMonthFirstDay=new Date(year,month,1);nextMonthFinalDay=new Date(year,month,getMonthDays(year,month));lastDay=new Date(nextMonthFirstDay.getTime()-millisecond);lastMonthFirstDay=getLastMonthFirstDay(currentYear,currentMonth);lastMonthFinalDay=new Date(firstDay.getTime()-millisecond);thisQuarterStartDay=new Date(currentYear,getQuarterStartMonth(currentMonth),1);thisQuarterEndDay=new Date(currentYear,getQuarterStartMonth(currentMonth)+2,getMonthDays(currentYear,getQuarterStartMonth(currentMonth)+2));lastQuarterStartDay=getLastQuarterFirstDay(currentYear,currentMonth);lastQuarterEndDay=new Date(lastQuarterStartDay.getFullYear(),lastQuarterStartDay.getMonth()+2,getMonthDays(lastQuarterStartDay.getFullYear(),lastQuarterStartDay.getMonth()+2));nextQuarterStartDay=getNextQuarterFirstDay(currentYear,currentMonth);nextQuarterEndDay=new Date(nextQuarterStartDay.getFullYear(),nextQuarterStartDay.getMonth()+2,getMonthDays(nextQuarterStartDay.getFullYear(),nextQuarterStartDay.getMonth()+2));last_7_days=new Date(now.getTime()-6*millisecond);last_30_days=new Date(now.getTime()-29*millisecond);last_60_days=new Date(now.getTime()-59*millisecond);last_90_days=new Date(now.getTime()-89*millisecond);last_120_days=new Date(now.getTime()-119*millisecond);next_7_days=new Date(now.getTime()+6*millisecond);next_30_days=new Date(now.getTime()+29*millisecond);next_60_days=new Date(now.getTime()+59*millisecond);next_90_days=new Date(now.getTime()+89*millisecond);next_120_days=new Date(now.getTime()+119*millisecond);switch(key){case"last_year":label=t("creator_filter_operation_between_last_year");startValue=new Date(previousYear+"-01-01T00:00:00Z");endValue=new Date(previousYear+"-12-31T23:59:59Z");break;case"this_year":label=t("creator_filter_operation_between_this_year");startValue=new Date(currentYear+"-01-01T00:00:00Z");endValue=new Date(currentYear+"-12-31T23:59:59Z");break;case"next_year":label=t("creator_filter_operation_between_next_year");startValue=new Date(nextYear+"-01-01T00:00:00Z");endValue=new Date(nextYear+"-12-31T23:59:59Z");break;case"last_quarter":strFirstDay=moment(lastQuarterStartDay).format("YYYY-MM-DD");strLastDay=moment(lastQuarterEndDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_quarter");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"this_quarter":strFirstDay=moment(thisQuarterStartDay).format("YYYY-MM-DD");strLastDay=moment(thisQuarterEndDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_this_quarter");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"next_quarter":strFirstDay=moment(nextQuarterStartDay).format("YYYY-MM-DD");strLastDay=moment(nextQuarterEndDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_quarter");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"last_month":strFirstDay=moment(lastMonthFirstDay).format("YYYY-MM-DD");strLastDay=moment(lastMonthFinalDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_month");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"this_month":strFirstDay=moment(firstDay).format("YYYY-MM-DD");strLastDay=moment(lastDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_this_month");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"next_month":strFirstDay=moment(nextMonthFirstDay).format("YYYY-MM-DD");strLastDay=moment(nextMonthFinalDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_month");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"last_week":strMonday=moment(lastMonday).format("YYYY-MM-DD");strSunday=moment(lastSunday).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_week");startValue=new Date(strMonday+"T00:00:00Z");endValue=new Date(strSunday+"T23:59:59Z");break;case"this_week":strMonday=moment(monday).format("YYYY-MM-DD");strSunday=moment(sunday).format("YYYY-MM-DD");label=t("creator_filter_operation_between_this_week");startValue=new Date(strMonday+"T00:00:00Z");endValue=new Date(strSunday+"T23:59:59Z");break;case"next_week":strMonday=moment(nextMonday).format("YYYY-MM-DD");strSunday=moment(nextSunday).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_week");startValue=new Date(strMonday+"T00:00:00Z");endValue=new Date(strSunday+"T23:59:59Z");break;case"yestday":strYestday=moment(yestday).format("YYYY-MM-DD");label=t("creator_filter_operation_between_yestday");startValue=new Date(strYestday+"T00:00:00Z");endValue=new Date(strYestday+"T23:59:59Z");break;case"today":strToday=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_today");startValue=new Date(strToday+"T00:00:00Z");endValue=new Date(strToday+"T23:59:59Z");break;case"tomorrow":strTomorrow=moment(tomorrow).format("YYYY-MM-DD");label=t("creator_filter_operation_between_tomorrow");startValue=new Date(strTomorrow+"T00:00:00Z");endValue=new Date(strTomorrow+"T23:59:59Z");break;case"last_7_days":strStartDay=moment(last_7_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_7_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"last_30_days":strStartDay=moment(last_30_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_30_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"last_60_days":strStartDay=moment(last_60_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_60_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"last_90_days":strStartDay=moment(last_90_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_90_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"last_120_days":strStartDay=moment(last_120_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_120_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_7_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_7_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_7_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_30_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_30_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_30_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_60_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_60_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_60_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_90_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_90_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_90_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_120_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_120_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_120_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z")}values=[startValue,endValue];if(utcOffset){values=values.map(function(fv){if(fv){fv=new Date(fv.getTime());fv.setHours(fv.getHours()-utcOffset)}return fv})}return{label:label,key:key,values:values}};let getBetweenBuiltinValueItem=(key,utcOffset)=>{return getBetweenTimeBuiltinValueItem(key,utcOffset)};let isBetweenFilterOperation=operation=>{return operation==="between"};let checkFormula=formula=>{return typeof formula==="string"&&/\{\w+(\.\w+)?\}/.test(formula)};let prepareFormula=(formula,prefix="this")=>{var reg,rev;reg=/(\{[^{}]*\})/g;rev=formula.replace(reg,function(m,$1){return prefix+$1.replace(/\{\s*/,'["').replace(/\s*\}/,'"]').replace(/\s*\.\s*/g,'"]["')});return rev};let evaluateFormula=(formula,context)=>{if(checkFormula(formula)){formula=prepareFormula(formula);return function(){return eval(formula)}.call(context)}else{return formula}};const _evaluateFormula=evaluateFormula;const REG_FOR_ENCORD=/\;|\/|\?|\:|\@|\&|\=|\+|\$|\,|\#|\%(?!25|3B|3b|2F|2f|3F|3f|3A|3a|40|26|3D|3d|2B|2b|24|2C|2c|23|5C|5c|5E|5e|7C|7c|5B|5b|5D|5d|7B|7b|7D|7d)|\^|(\\\()|(\\\))|(\\\.)|\\|\||\[|\]|\{|\}/;const convertSpecialCharacter=str=>{if(str.indexOf("%5C(")>-1||str.indexOf("%5C)")>-1){return str}if(str.indexOf("%5C.")>-1){return str}if(str.indexOf("%5C*")>-1){return str}return str.replace(/([\^\$\(\)\*\+\?\.\\\|\[\]\{\}])/g,"\\$1")};let extendUserContext=(userContext,utcOffset)=>{if(!userContext.now){userContext.now=new Date}return userContext};let formatFiltersToDev=(filters,userContext={userId:null,spaceId:null,user:{utcOffset:0}})=>{if(lodash.isNull(filters)||lodash.isUndefined(filters)){return}let utcOffset=userContext.user?userContext.user.utcOffset:0;userContext=extendUserContext(userContext);var regDate=/^\d{4}-\d{1,2}-\d{1,2}(T|\s)\d{1,2}\:\d{1,2}(\:\d{1,2}(\.\d{1,3})?)?(Z|((\+|\-)\d{1,2}\:\d{1,2}))?$/;var filtersLooper,selector;if(!lodash.isFunction(filters)&&!filters.length){return}selector=[];filtersLooper=function(filters_loop){var builtinValue,field,i,isBetweenOperation,option,ref,sub_selector,tempFilters,tempLooperResult,value;tempFilters=[];tempLooperResult=null;if(filters_loop==="!"){return filters_loop}if(lodash.isFunction(filters_loop)){filters_loop=filters_loop()}if(!lodash.isArray(filters_loop)){if(lodash.isObject(filters_loop)){if(filters_loop.operation){filters_loop=[filters_loop.field,filters_loop.operation,filters_loop.value]}else{return null}}else{return null}}if(filters_loop.length===1){tempLooperResult=filtersLooper(filters_loop[0]);if(tempLooperResult){tempFilters.push(tempLooperResult)}}else if(filters_loop.length===2){filters_loop.forEach(function(n,i){tempLooperResult=filtersLooper(n);if(tempLooperResult){return tempFilters.push(tempLooperResult)}})}else if(filters_loop.length===3){if(lodash.includes(["or","and"],filters_loop[1])){tempFilters=[];i=0;while(i<filters_loop.length){if(lodash.includes(["or","and"],filters_loop[i])){i++;continue}tempLooperResult=filtersLooper(filters_loop[i]);if(!tempLooperResult){i++;continue}if(i>0){tempFilters.push(filters_loop[i-1])}tempFilters.push(tempLooperResult);i++}if(lodash.includes(["or","and"],tempFilters[0])){tempFilters.shift()}}else{if(lodash.isString(filters_loop[1])){field=filters_loop[0];option=filters_loop[1];value=filters_loop[2];if(lodash.isFunction(value)){value=value()}if(option==="!="){option="<>"}value=_evaluateFormula(value,userContext);sub_selector=[];isBetweenOperation=isBetweenFilterOperation(option);if(isBetweenOperation&&lodash.isString(value)){builtinValue=getBetweenBuiltinValueItem(value,utcOffset);if(builtinValue){value=builtinValue.values}}if(lodash.isArray(value)){value=value.map(function(item){if(typeof item==="string"){if(["contains","startswith","endswith","notcontains","notstartswith","notendswith"].indexOf(option)>-1){item=convertSpecialCharacter(item)}if(regDate.test(item)){item=new Date(item)}else if(REG_FOR_ENCORD.test(item)){item=encodeURIComponent(item)}}return item});if(["=","in"].indexOf(option)>-1){if(value.length){sub_selector.push([field,"in",`(${JSON.stringify(value).replace(/\"/g,"'").slice(1).slice(0,-1)})`],"and")}else{sub_selector.push([field,"=","__badQueryForEmptyArray"],"and")}}else if(["<>","notin"].indexOf(option)>-1){sub_selector.push([field,"notin",`(${JSON.stringify(value).replace(/\"/g,"'").slice(1).slice(0,-1)})`],"and")}else if(["notcontains","notstartswith","notendswith"].indexOf(option)>-1){lodash.each(value,function(v){return sub_selector.push([field,option,v],"and")})}else if(isBetweenOperation){if(value.length>0){if([null,undefined,""].indexOf(value[0])<0||[null,undefined,""].indexOf(value[1])<0){if([null,undefined,""].indexOf(value[0])<0){sub_selector.push([field,">=",value[0]],"and")}if([null,undefined,""].indexOf(value[1])<0){sub_selector.push([field,"<=",value[1]],"and")}}}}else{lodash.each(value,function(v){return sub_selector.push([field,option,v],"or")})}if(sub_selector[sub_selector.length-1]==="and"||sub_selector[sub_selector.length-1]==="or"){sub_selector.pop()}if(sub_selector.length){tempFilters=sub_selector}}else if(value===false){if(option==="="){tempFilters=[[field,"=",false],"or",[field,"=",null]]}else if(option==="<>"){tempFilters=[field,"=",true]}}else{if(isBetweenOperation&&!lodash.isArray(value));else{if(typeof value==="string"){if(["contains","startswith","endswith","notcontains","notstartswith","notendswith"].indexOf(option)>-1){value=convertSpecialCharacter(value)}if(regDate.test(value)){value=new Date(value)}else if(REG_FOR_ENCORD.test(value)){if(["in","notin"].indexOf(option)<0){value=encodeURIComponent(value)}}}tempFilters=[field,option,value]}}}else{filters_loop.forEach(function(n,i){tempLooperResult=filtersLooper(n);if(tempLooperResult){return tempFilters.push(tempLooperResult)}})}}}else{if((ref=lodash.intersection(["or","and"],filters_loop))!=null?ref.length:void 0){tempFilters=[];i=0;while(i<filters_loop.length){if(lodash.includes(["or","and"],filters_loop[i])){i++;continue}tempLooperResult=filtersLooper(filters_loop[i]);if(!tempLooperResult){i++;continue}if(i>0){tempFilters.push(filters_loop[i-1])}tempFilters.push(tempLooperResult);i++}if(lodash.includes(["or","and"],tempFilters[0])){tempFilters.shift()}}else{filters_loop.forEach(function(n,i){tempLooperResult=filtersLooper(n);if(tempLooperResult){return tempFilters.push(tempLooperResult)}})}}if(tempFilters.length){return tempFilters}else{return null}};selector=filtersLooper(filters);return selector};let formatFiltersToODataQuery=(filters,userContext,odataProtocolVersion,forceLowerCase)=>{let devFilters=formatFiltersToDev(filters,userContext);return new SteedosFilter(devFilters,odataProtocolVersion,forceLowerCase).formatFiltersToODataQuery()};const _formatFiltersToDev=formatFiltersToDev;const _formatFiltersToODataQuery=formatFiltersToODataQuery;let expandFieldName=(initial,fieldName)=>{lodash.reduce(fieldName.split("."),function(m,k){if(!m[k]){m[k]={}}return m[k]},initial);return initial};let expandFieldNames=fieldNames=>{let initial={};fieldNames.forEach(n=>{expandFieldName(initial,n)});return initial};let generateIndents=count=>{return Array(count).fill("    ").join("")};let reduceGraphqlFieldsQuery=(fields,indentsCount)=>{if(!indentsCount){indentsCount=0}let itemQuery;return` {
+(function(global,factory){typeof exports==="object"&&typeof module!=="undefined"?factory(exports,require("lodash"),require("moment")):typeof define==="function"&&define.amd?define(["exports","lodash","moment"],factory):(global=typeof globalThis!=="undefined"?globalThis:global||self,factory(global.SteedosFilters={},global._,global.moment))})(this,function(exports,lodash,moment){function leftPad(text,length){while(text.length<length){text="0"+text}return text}var FORMAT_TYPES={3:"abbreviated",4:"wide",5:"narrow"};var LDML_FORMATTERS={y:function(date,count,useUtc){var year=date[useUtc?"getUTCFullYear":"getFullYear"]();if(count===2){year=year%100}return leftPad(year.toString(),count)},M:function(date,count,useUtc,dateParts){var month=date[useUtc?"getUTCMonth":"getMonth"]();var formatType=FORMAT_TYPES[count];if(formatType){return dateParts.getMonthNames(formatType,"format")[month]}return leftPad((month+1).toString(),Math.min(count,2))},L:function(date,count,useUtc,dateParts){var month=date[useUtc?"getUTCMonth":"getMonth"]();var formatType=FORMAT_TYPES[count];if(formatType){return dateParts.getMonthNames(formatType,"standalone")[month]}return leftPad((month+1).toString(),Math.min(count,2))},Q:function(date,count,useUtc,dateParts){var month=date[useUtc?"getUTCMonth":"getMonth"]();var quarter=Math.floor(month/3);var formatType=FORMAT_TYPES[count];if(formatType){return dateParts.getQuarterNames(formatType)[quarter]}return leftPad((quarter+1).toString(),Math.min(count,2))},E:function(date,count,useUtc,dateParts){var day=date[useUtc?"getUTCDay":"getDay"]();var formatType=FORMAT_TYPES[count<3?3:count];return dateParts.getDayNames(formatType)[day]},a:function(date,count,useUtc,dateParts){var hours=date[useUtc?"getUTCHours":"getHours"](),period=hours<12?0:1,formatType=FORMAT_TYPES[count];return dateParts.getPeriodNames(formatType)[period]},d:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCDate":"getDate"]().toString(),Math.min(count,2))},H:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCHours":"getHours"]().toString(),Math.min(count,2))},h:function(date,count,useUtc){var hours=date[useUtc?"getUTCHours":"getHours"]();return leftPad((hours%12||12).toString(),Math.min(count,2))},m:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCMinutes":"getMinutes"]().toString(),Math.min(count,2))},s:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCSeconds":"getSeconds"]().toString(),Math.min(count,2))},S:function(date,count,useUtc){return leftPad(date[useUtc?"getUTCMilliseconds":"getMilliseconds"]().toString(),3).substr(0,count)},x:function(date,count,useUtc){var timezoneOffset=useUtc?0:date.getTimezoneOffset(),signPart=timezoneOffset>0?"-":"+",timezoneOffsetAbs=Math.abs(timezoneOffset),hours=Math.floor(timezoneOffsetAbs/60),minutes=timezoneOffsetAbs%60,hoursPart=leftPad(hours.toString(),2),minutesPart=leftPad(minutes.toString(),2);return signPart+hoursPart+(count>=3?":":"")+(count>1||minutes?minutesPart:"")},X:function(date,count,useUtc){if(useUtc||!date.getTimezoneOffset()){return"Z"}return LDML_FORMATTERS.x(date,count,useUtc)},Z:function(date,count,useUtc){return LDML_FORMATTERS.X(date,count>=5?3:2,useUtc)}};var getFormatter=function(format,dateParts){return function(date){var charIndex,formatter,char,charCount=0,separator="'",isEscaping=false,isCurrentCharEqualsNext,result="";if(!date)return null;if(!format)return date;var useUtc=format[format.length-1]==="Z"||format.slice(-3)==="'Z'";for(charIndex=0;charIndex<format.length;charIndex++){char=format[charIndex];formatter=LDML_FORMATTERS[char];isCurrentCharEqualsNext=char===format[charIndex+1];charCount++;if(!isCurrentCharEqualsNext){if(formatter&&!isEscaping){result+=formatter(date,charCount,useUtc,dateParts)}charCount=0}if(char===separator&&!isCurrentCharEqualsNext){isEscaping=!isEscaping}else if(isEscaping||!formatter){result+=char}if(char===separator&&isCurrentCharEqualsNext){charIndex++}}return result}};const _getFormatter=getFormatter;var MONTHS=["January","February","March","April","May","June","July","August","September","October","November","December"],DAYS=["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"],PERIODS=["AM","PM"],QUARTERS=["Q1","Q2","Q3","Q4"];var cutCaptions=function(captions,format){var lengthByFormat={abbreviated:3,short:2,narrow:1};return captions.map(function(caption){return caption.substr(0,lengthByFormat[format])})};function getMonthNames(format){return cutCaptions(MONTHS,format)}function getDayNames(format){return cutCaptions(DAYS,format)}function getQuarterNames(format){return QUARTERS}function getPeriodNames(format){return PERIODS}var defaultDateNames={getMonthNames:getMonthNames,getDayNames:getDayNames,getQuarterNames:getQuarterNames,getPeriodNames:getPeriodNames};const DevExpressData={utils:{isConjunctiveOperator:function(condition){return/^(and|&&|&)$/i.test(condition)},normalizeBinaryCriterion:function(crit){return[crit[0],crit.length<3?"=":String(crit[1]).toLowerCase(),crit.length<2?true:crit[crit.length-1]]},isUnaryOperation:function(crit){return crit[0]==="!"&&Array.isArray(crit[1])}}};const DevExpressOData={pad(text,length,right){text=String(text);while(text.length<length){text=right?text+"0":"0"+text}return text},padLeft2(text){return this.pad(text,2)},serializePropName(propName){return propName.replace(/\./g,"/")},serializeValue(value,protocolVersion){if(value===undefined){return null}switch(protocolVersion){case 2:return this.serializeValueV2(value);case 3:return this.serializeValueV2(value);case 4:return this.serializeValueV4(value);default:return this.serializeValueV4(value)}},serializeValueV2(value){if(value instanceof Date){return this.serializeDate(value)}if(typeof value==="string"){return this.serializeString(value)}return String(value)},serializeValueV4(value){if(value instanceof Date){return this.formatISO8601(value,false,false)}if(Array.isArray(value)){return"["+value.map(item=>{return this.serializeValueV4(item)}).join(",")+"]"}return this.serializeValueV2(value)},serializeString(value){return"'"+value.replace(/'/g,"''")+"'"},serializeDate(value,serializationFormat){if(!serializationFormat){return value}if(!(value instanceof Date)){return null}if(serializationFormat==="number"){return value&&value.valueOf?value.valueOf():null}return _getFormatter(serializationFormat,defaultDateNames)(value)},formatISO8601(date,skipZeroTime,skipTimezone){var bag=[];var isZeroTime=function(){return date.getUTCHours()+date.getUTCMinutes()+date.getUTCSeconds()+date.getUTCMilliseconds()<1};bag.push(date.getUTCFullYear());bag.push("-");bag.push(this.padLeft2(date.getUTCMonth()+1));bag.push("-");bag.push(this.padLeft2(date.getUTCDate()));if(!(skipZeroTime&&isZeroTime())){bag.push("T");bag.push(this.padLeft2(date.getUTCHours()));bag.push(":");bag.push(this.padLeft2(date.getUTCMinutes()));bag.push(":");bag.push(this.padLeft2(date.getUTCSeconds()));if(date.getUTCMilliseconds()){bag.push(".");bag.push(this.pad(date.getUTCMilliseconds(),3))}if(!skipTimezone){bag.push("Z")}}return bag.join("")}};class SteedosFilter{constructor(filters,odataProtocolVersion=4,forceLowerCase){this.filters=filters||[];this.protocolVersion=odataProtocolVersion;this.forceLowerCase=forceLowerCase;this.formatters={"=":this.createBinaryOperationFormatter("eq"),"<>":this.createBinaryOperationFormatter("ne"),">":this.createBinaryOperationFormatter("gt"),">=":this.createBinaryOperationFormatter("ge"),"<":this.createBinaryOperationFormatter("lt"),"<=":this.createBinaryOperationFormatter("le"),startswith:this.createStringFuncFormatter("startswith"),endswith:this.createStringFuncFormatter("endswith")};this.formattersV2={...this.formatters,...{contains:this.createStringFuncFormatter("substringof",true),notcontains:this.createStringFuncFormatter("not substringof",true)}};this.formattersV4={...this.formatters,...{contains:this.createStringFuncFormatter("contains"),notcontains:this.createStringFuncFormatter("not contains"),notstartswith:this.createStringFuncFormatter("not startswith"),notendswith:this.createStringFuncFormatter("not endswith"),in:this.createBinaryOperationFormatter("in"),notin:this.createBinaryOperationFormatter("notin")}}}createBinaryOperationFormatter(op){return(prop,val)=>{return prop+" "+op+" "+val}}createStringFuncFormatter(op,reverse){return(prop,val)=>{var bag=[op,"("];if(val&&this.forceLowerCase){val=val.toLowerCase()}if(reverse){bag.push(val,",",prop)}else{bag.push(prop,",",val)}bag.push(")");return bag.join("")}}compileUnary(criteria){var op=criteria[0],crit=this.compileCore(criteria[1]);if(op==="!"){return"not ("+crit+")"}throw new Error("E4003")}compileGroup(criteria){var bag=[],groupOperator,nextGroupOperator;criteria.forEach(criterion=>{if(Array.isArray(criterion)){if(bag.length>1&&groupOperator!==nextGroupOperator){throw new Error("E4019")}bag.push("("+this.compileCore(criterion)+")");groupOperator=nextGroupOperator;nextGroupOperator="and"}else{nextGroupOperator=DevExpressData.utils.isConjunctiveOperator(criterion)?"and":"or"}});return bag.join(" "+groupOperator+" ")}compileBinary(criteria){criteria=DevExpressData.utils.normalizeBinaryCriterion(criteria);var op=criteria[1],formatters=this.protocolVersion===4?this.formattersV4:this.formattersV2,formatter=formatters[op.toLowerCase()];if(!formatter){throw new Error("E4003")}var fieldName=criteria[0],value=criteria[2];return formatter(DevExpressOData.serializePropName(fieldName),op==="in"||op==="notin"?value:DevExpressOData.serializeValue(value,this.protocolVersion))}compileCore(criteria){if(!criteria||criteria.length===0){return""}if(Array.isArray(criteria[0])){return this.compileGroup(criteria)}if(DevExpressData.utils.isUnaryOperation(criteria)){return this.compileUnary(criteria)}return this.compileBinary(criteria)}formatFiltersToODataQuery(){let filters=this.filters;let query=this.compileCore(filters);return query}}var filter=Object.freeze({__proto__:null,default:SteedosFilter});let t=key=>{return key};let getMonthDays=(year,month)=>{var days,endDate,millisecond,startDate;if(month===11){return 31}millisecond=1e3*60*60*24;startDate=new Date(year,month,1);endDate=new Date(year,month+1,1);days=(endDate-startDate)/millisecond;return days};let getNextQuarterFirstDay=(year,month)=>{if(!year){year=(new Date).getFullYear()}if(!month){month=(new Date).getMonth()}if(month<3){month=3}else if(month<6){month=6}else if(month<9){month=9}else{year++;month=0}return new Date(year,month,1)};let getLastMonthFirstDay=(year,month)=>{if(!year){year=(new Date).getFullYear()}if(!month){month=(new Date).getMonth()}if(month===0){month=11;year--;return new Date(year,month,1)}month--;return new Date(year,month,1)};let getQuarterStartMonth=month=>{if(!month){month=(new Date).getMonth()}if(month<3){return 0}else if(month<6){return 3}else if(month<9){return 6}return 9};let getLastQuarterFirstDay=(year,month)=>{if(!year){year=(new Date).getFullYear()}if(!month){month=(new Date).getMonth()}if(month<3){year--;month=9}else if(month<6){month=0}else if(month<9){month=3}else{month=6}return new Date(year,month,1)};let getBetweenTimeBuiltinValueItem=(key,utcOffset)=>{var currentMonth,currentYear,endValue,firstDay,label,lastDay,lastMonday,lastMonthFinalDay,lastMonthFirstDay,lastQuarterEndDay,lastQuarterStartDay,lastSunday,last_120_days,last_30_days,last_60_days,last_7_days,last_90_days,millisecond,minusDay,monday,month,nextMonday,nextMonthFinalDay,nextMonthFirstDay,nextQuarterEndDay,nextQuarterStartDay,nextSunday,nextYear,next_120_days,next_30_days,next_60_days,next_7_days,next_90_days,now,previousYear,startValue,strEndDay,strFirstDay,strLastDay,strMonday,strStartDay,strSunday,strToday,strTomorrow,strYestday,sunday,thisQuarterEndDay,thisQuarterStartDay,tomorrow,values,week,year,yestday;now=new Date;millisecond=1e3*60*60*24;yestday=new Date(now.getTime()-millisecond);tomorrow=new Date(now.getTime()+millisecond);week=now.getDay();minusDay=week!==0?week-1:6;monday=new Date(now.getTime()-minusDay*millisecond);sunday=new Date(monday.getTime()+6*millisecond);lastSunday=new Date(monday.getTime()-millisecond);lastMonday=new Date(lastSunday.getTime()-millisecond*6);nextMonday=new Date(sunday.getTime()+millisecond);nextSunday=new Date(nextMonday.getTime()+millisecond*6);currentYear=now.getFullYear();previousYear=currentYear-1;nextYear=currentYear+1;currentMonth=now.getMonth();year=now.getFullYear();month=now.getMonth();firstDay=new Date(currentYear,currentMonth,1);if(currentMonth===11){year++;month++}else{month++}nextMonthFirstDay=new Date(year,month,1);nextMonthFinalDay=new Date(year,month,getMonthDays(year,month));lastDay=new Date(nextMonthFirstDay.getTime()-millisecond);lastMonthFirstDay=getLastMonthFirstDay(currentYear,currentMonth);lastMonthFinalDay=new Date(firstDay.getTime()-millisecond);thisQuarterStartDay=new Date(currentYear,getQuarterStartMonth(currentMonth),1);thisQuarterEndDay=new Date(currentYear,getQuarterStartMonth(currentMonth)+2,getMonthDays(currentYear,getQuarterStartMonth(currentMonth)+2));lastQuarterStartDay=getLastQuarterFirstDay(currentYear,currentMonth);lastQuarterEndDay=new Date(lastQuarterStartDay.getFullYear(),lastQuarterStartDay.getMonth()+2,getMonthDays(lastQuarterStartDay.getFullYear(),lastQuarterStartDay.getMonth()+2));nextQuarterStartDay=getNextQuarterFirstDay(currentYear,currentMonth);nextQuarterEndDay=new Date(nextQuarterStartDay.getFullYear(),nextQuarterStartDay.getMonth()+2,getMonthDays(nextQuarterStartDay.getFullYear(),nextQuarterStartDay.getMonth()+2));last_7_days=new Date(now.getTime()-6*millisecond);last_30_days=new Date(now.getTime()-29*millisecond);last_60_days=new Date(now.getTime()-59*millisecond);last_90_days=new Date(now.getTime()-89*millisecond);last_120_days=new Date(now.getTime()-119*millisecond);next_7_days=new Date(now.getTime()+6*millisecond);next_30_days=new Date(now.getTime()+29*millisecond);next_60_days=new Date(now.getTime()+59*millisecond);next_90_days=new Date(now.getTime()+89*millisecond);next_120_days=new Date(now.getTime()+119*millisecond);switch(key){case"last_year":label=t("creator_filter_operation_between_last_year");startValue=new Date(previousYear+"-01-01T00:00:00Z");endValue=new Date(previousYear+"-12-31T23:59:59Z");break;case"this_year":label=t("creator_filter_operation_between_this_year");startValue=new Date(currentYear+"-01-01T00:00:00Z");endValue=new Date(currentYear+"-12-31T23:59:59Z");break;case"next_year":label=t("creator_filter_operation_between_next_year");startValue=new Date(nextYear+"-01-01T00:00:00Z");endValue=new Date(nextYear+"-12-31T23:59:59Z");break;case"last_quarter":strFirstDay=moment(lastQuarterStartDay).format("YYYY-MM-DD");strLastDay=moment(lastQuarterEndDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_quarter");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"this_quarter":strFirstDay=moment(thisQuarterStartDay).format("YYYY-MM-DD");strLastDay=moment(thisQuarterEndDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_this_quarter");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"next_quarter":strFirstDay=moment(nextQuarterStartDay).format("YYYY-MM-DD");strLastDay=moment(nextQuarterEndDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_quarter");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"last_month":strFirstDay=moment(lastMonthFirstDay).format("YYYY-MM-DD");strLastDay=moment(lastMonthFinalDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_month");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"this_month":strFirstDay=moment(firstDay).format("YYYY-MM-DD");strLastDay=moment(lastDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_this_month");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"next_month":strFirstDay=moment(nextMonthFirstDay).format("YYYY-MM-DD");strLastDay=moment(nextMonthFinalDay).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_month");startValue=new Date(strFirstDay+"T00:00:00Z");endValue=new Date(strLastDay+"T23:59:59Z");break;case"last_week":strMonday=moment(lastMonday).format("YYYY-MM-DD");strSunday=moment(lastSunday).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_week");startValue=new Date(strMonday+"T00:00:00Z");endValue=new Date(strSunday+"T23:59:59Z");break;case"this_week":strMonday=moment(monday).format("YYYY-MM-DD");strSunday=moment(sunday).format("YYYY-MM-DD");label=t("creator_filter_operation_between_this_week");startValue=new Date(strMonday+"T00:00:00Z");endValue=new Date(strSunday+"T23:59:59Z");break;case"next_week":strMonday=moment(nextMonday).format("YYYY-MM-DD");strSunday=moment(nextSunday).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_week");startValue=new Date(strMonday+"T00:00:00Z");endValue=new Date(strSunday+"T23:59:59Z");break;case"yestday":strYestday=moment(yestday).format("YYYY-MM-DD");label=t("creator_filter_operation_between_yestday");startValue=new Date(strYestday+"T00:00:00Z");endValue=new Date(strYestday+"T23:59:59Z");break;case"today":strToday=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_today");startValue=new Date(strToday+"T00:00:00Z");endValue=new Date(strToday+"T23:59:59Z");break;case"tomorrow":strTomorrow=moment(tomorrow).format("YYYY-MM-DD");label=t("creator_filter_operation_between_tomorrow");startValue=new Date(strTomorrow+"T00:00:00Z");endValue=new Date(strTomorrow+"T23:59:59Z");break;case"last_7_days":strStartDay=moment(last_7_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_7_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"last_30_days":strStartDay=moment(last_30_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_30_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"last_60_days":strStartDay=moment(last_60_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_60_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"last_90_days":strStartDay=moment(last_90_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_90_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"last_120_days":strStartDay=moment(last_120_days).format("YYYY-MM-DD");strEndDay=moment(now).format("YYYY-MM-DD");label=t("creator_filter_operation_between_last_120_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_7_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_7_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_7_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_30_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_30_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_30_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_60_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_60_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_60_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_90_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_90_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_90_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z");break;case"next_120_days":strStartDay=moment(now).format("YYYY-MM-DD");strEndDay=moment(next_120_days).format("YYYY-MM-DD");label=t("creator_filter_operation_between_next_120_days");startValue=new Date(strStartDay+"T00:00:00Z");endValue=new Date(strEndDay+"T23:59:59Z")}values=[startValue,endValue];if(utcOffset){values=values.map(function(fv){if(fv){fv=new Date(fv.getTime());fv.setHours(fv.getHours()-utcOffset)}return fv})}return{label:label,key:key,values:values}};let getBetweenBuiltinValueItem=(key,utcOffset)=>{return getBetweenTimeBuiltinValueItem(key,utcOffset)};let isBetweenFilterOperation=operation=>{return operation==="between"};const FORMULA_REG=/^(?:\{(\w+)(?:\.(\w+))?\}|\{\{(\w+)(?:\.(\w+))?\}\})$/;const LEGACY_FORMULA_REG=/\{\w+(\.\w+)?\}/;const FORBIDDEN_KEYS=["__proto__","prototype","constructor"];let checkFormula=formula=>{return typeof formula==="string"&&FORMULA_REG.test(formula.trim())};let prepareFormula=formula=>{const match=FORMULA_REG.exec(formula.trim());const key=match[1]||match[3];const subKey=match[2]||match[4];return subKey?[key,subKey]:[key]};let evaluateFormula=(formula,context)=>{if(checkFormula(formula)){const keys=prepareFormula(formula);let value=context;for(const key of keys){if(FORBIDDEN_KEYS.indexOf(key)>-1){return undefined}value=value[key]}return value}else if(typeof formula==="string"&&LEGACY_FORMULA_REG.test(formula)){throw new Error(`Unsupported filter formula: ${formula}`)}else{return formula}};const _evaluateFormula=evaluateFormula;const REG_FOR_ENCORD=/\;|\/|\?|\:|\@|\&|\=|\+|\$|\,|\#|\%(?!25|3B|3b|2F|2f|3F|3f|3A|3a|40|26|3D|3d|2B|2b|24|2C|2c|23|5C|5c|5E|5e|7C|7c|5B|5b|5D|5d|7B|7b|7D|7d)|\^|(\\\()|(\\\))|(\\\.)|\\|\||\[|\]|\{|\}/;const convertSpecialCharacter=str=>{if(str.indexOf("%5C(")>-1||str.indexOf("%5C)")>-1){return str}if(str.indexOf("%5C.")>-1){return str}if(str.indexOf("%5C*")>-1){return str}return str.replace(/([\^\$\(\)\*\+\?\.\\\|\[\]\{\}])/g,"\\$1")};let extendUserContext=(userContext,utcOffset)=>{if(!userContext.now){userContext.now=new Date}return userContext};let formatFiltersToDev=(filters,userContext={userId:null,spaceId:null,user:{utcOffset:0}})=>{if(lodash.isNull(filters)||lodash.isUndefined(filters)){return}let utcOffset=userContext.user?userContext.user.utcOffset:0;userContext=extendUserContext(userContext);var regDate=/^\d{4}-\d{1,2}-\d{1,2}(T|\s)\d{1,2}\:\d{1,2}(\:\d{1,2}(\.\d{1,3})?)?(Z|((\+|\-)\d{1,2}\:\d{1,2}))?$/;var filtersLooper,selector;if(!lodash.isFunction(filters)&&!filters.length){return}selector=[];filtersLooper=function(filters_loop){var builtinValue,field,i,isBetweenOperation,option,ref,sub_selector,tempFilters,tempLooperResult,value;tempFilters=[];tempLooperResult=null;if(filters_loop==="!"){return filters_loop}if(lodash.isFunction(filters_loop)){filters_loop=filters_loop()}if(!lodash.isArray(filters_loop)){if(lodash.isObject(filters_loop)){if(filters_loop.operation){filters_loop=[filters_loop.field,filters_loop.operation,filters_loop.value]}else{return null}}else{return null}}if(filters_loop.length===1){tempLooperResult=filtersLooper(filters_loop[0]);if(tempLooperResult){tempFilters.push(tempLooperResult)}}else if(filters_loop.length===2){filters_loop.forEach(function(n,i){tempLooperResult=filtersLooper(n);if(tempLooperResult){return tempFilters.push(tempLooperResult)}})}else if(filters_loop.length===3){if(lodash.includes(["or","and"],filters_loop[1])){tempFilters=[];i=0;while(i<filters_loop.length){if(lodash.includes(["or","and"],filters_loop[i])){i++;continue}tempLooperResult=filtersLooper(filters_loop[i]);if(!tempLooperResult){i++;continue}if(i>0){tempFilters.push(filters_loop[i-1])}tempFilters.push(tempLooperResult);i++}if(lodash.includes(["or","and"],tempFilters[0])){tempFilters.shift()}}else{if(lodash.isString(filters_loop[1])){field=filters_loop[0];option=filters_loop[1];value=filters_loop[2];if(lodash.isFunction(value)){value=value()}if(option==="!="){option="<>"}value=_evaluateFormula(value,userContext);sub_selector=[];isBetweenOperation=isBetweenFilterOperation(option);if(isBetweenOperation&&lodash.isString(value)){builtinValue=getBetweenBuiltinValueItem(value,utcOffset);if(builtinValue){value=builtinValue.values}}if(lodash.isArray(value)){value=value.map(function(item){if(typeof item==="string"){if(["contains","startswith","endswith","notcontains","notstartswith","notendswith"].indexOf(option)>-1){item=convertSpecialCharacter(item)}if(regDate.test(item)){item=new Date(item)}else if(REG_FOR_ENCORD.test(item)){item=encodeURIComponent(item)}}return item});if(["=","in"].indexOf(option)>-1){if(value.length){sub_selector.push([field,"in",`(${JSON.stringify(value).replace(/\"/g,"'").slice(1).slice(0,-1)})`],"and")}else{sub_selector.push([field,"=","__badQueryForEmptyArray"],"and")}}else if(["<>","notin"].indexOf(option)>-1){sub_selector.push([field,"notin",`(${JSON.stringify(value).replace(/\"/g,"'").slice(1).slice(0,-1)})`],"and")}else if(["notcontains","notstartswith","notendswith"].indexOf(option)>-1){lodash.each(value,function(v){return sub_selector.push([field,option,v],"and")})}else if(isBetweenOperation){if(value.length>0){if([null,undefined,""].indexOf(value[0])<0||[null,undefined,""].indexOf(value[1])<0){if([null,undefined,""].indexOf(value[0])<0){sub_selector.push([field,">=",value[0]],"and")}if([null,undefined,""].indexOf(value[1])<0){sub_selector.push([field,"<=",value[1]],"and")}}}}else{lodash.each(value,function(v){return sub_selector.push([field,option,v],"or")})}if(sub_selector[sub_selector.length-1]==="and"||sub_selector[sub_selector.length-1]==="or"){sub_selector.pop()}if(sub_selector.length){tempFilters=sub_selector}}else if(value===false){if(option==="="){tempFilters=[[field,"=",false],"or",[field,"=",null]]}else if(option==="<>"){tempFilters=[field,"=",true]}}else{if(isBetweenOperation&&!lodash.isArray(value));else{if(typeof value==="string"){if(["contains","startswith","endswith","notcontains","notstartswith","notendswith"].indexOf(option)>-1){value=convertSpecialCharacter(value)}if(regDate.test(value)){value=new Date(value)}else if(REG_FOR_ENCORD.test(value)){if(["in","notin"].indexOf(option)<0){value=encodeURIComponent(value)}}}tempFilters=[field,option,value]}}}else{filters_loop.forEach(function(n,i){tempLooperResult=filtersLooper(n);if(tempLooperResult){return tempFilters.push(tempLooperResult)}})}}}else{if((ref=lodash.intersection(["or","and"],filters_loop))!=null?ref.length:void 0){tempFilters=[];i=0;while(i<filters_loop.length){if(lodash.includes(["or","and"],filters_loop[i])){i++;continue}tempLooperResult=filtersLooper(filters_loop[i]);if(!tempLooperResult){i++;continue}if(i>0){tempFilters.push(filters_loop[i-1])}tempFilters.push(tempLooperResult);i++}if(lodash.includes(["or","and"],tempFilters[0])){tempFilters.shift()}}else{filters_loop.forEach(function(n,i){tempLooperResult=filtersLooper(n);if(tempLooperResult){return tempFilters.push(tempLooperResult)}})}}if(tempFilters.length){return tempFilters}else{return null}};selector=filtersLooper(filters);return selector};let formatFiltersToODataQuery=(filters,userContext,odataProtocolVersion,forceLowerCase)=>{let devFilters=formatFiltersToDev(filters,userContext);return new SteedosFilter(devFilters,odataProtocolVersion,forceLowerCase).formatFiltersToODataQuery()};const _formatFiltersToDev=formatFiltersToDev;const _formatFiltersToODataQuery=formatFiltersToODataQuery;let expandFieldName=(initial,fieldName)=>{lodash.reduce(fieldName.split("."),function(m,k){if(!m[k]){m[k]={}}return m[k]},initial);return initial};let expandFieldNames=fieldNames=>{let initial={};fieldNames.forEach(n=>{expandFieldName(initial,n)});return initial};let generateIndents=count=>{return Array(count).fill("    ").join("")};let reduceGraphqlFieldsQuery=(fields,indentsCount)=>{if(!indentsCount){indentsCount=0}let itemQuery;return` {
 ${lodash.map(fields,(fieldValue,fieldKey)=>{itemQuery=generateIndents(indentsCount)+generateIndents(1)+fieldKey;if(lodash.isEmpty(fieldValue)){itemQuery+="\n"}else{indentsCount+=1;itemQuery+=reduceGraphqlFieldsQuery(fieldValue,indentsCount);indentsCount-=1}return itemQuery}).join("")}${generateIndents(indentsCount)}}
 `};let formatFieldsToGraphqlQuery=fields=>{if(lodash.isString(fields)){fields=fields.split(",")}let expandedFields=expandFieldNames(fields);return reduceGraphqlFieldsQuery(expandedFields,3)};let formatFiltersToGraphqlQuery=(objectName,filters,fields,userContext,odataProtocolVersion,forceLowerCase)=>{if(!lodash.isString(filters)){filters=_formatFiltersToODataQuery(filters,userContext,odataProtocolVersion,forceLowerCase)}let filtersWrap=filters?`(filters:"${filters}")`:"";let graphqlFields=formatFieldsToGraphqlQuery(fields);let graphqlQuery=`
         query {

package/lib/formula.js

@@ -4,27 +4,53 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.evaluateFormula = void 0;
-// "{userId}"或"{user.name}"格式
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+// "{userId}"或"{user.name}"格式，整个值必须是一个公式，不支持表达式
+// 兼容原eval实现下也能取值的"{{userId}}"、"{{user.name}}"写法
+var FORMULA_REG = /^(?:\{(\w+)(?:\.(\w+))?\}|\{\{(\w+)(?:\.(\w+))?\}\})$/;
+// 原eval实现判断是否为公式的规则，含有"{xxx}"但不是上面格式的值以前会被当作JS表达式执行
+var LEGACY_FORMULA_REG = /\{\w+(\.\w+)?\}/;
+var FORBIDDEN_KEYS = ["__proto__", "prototype", "constructor"];
 var checkFormula = function checkFormula(formula) {
-  return typeof formula === "string" && /\{\w+(\.\w+)?\}/.test(formula);
+  // 与原eval实现保持一致：忽略首尾空白
+  return typeof formula === "string" && FORMULA_REG.test(formula.trim());
 };
 
-// "{userId}"转换为"this['userId']","{user.name}"转换为"this['user'].['name']"
+// "{userId}"解析为["userId"],"{user.name}"解析为["user", "name"]
 var prepareFormula = function prepareFormula(formula) {
-  var prefix = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : "this";
-  var reg, rev;
-  reg = /(\{[^{}]*\})/g;
-  rev = formula.replace(reg, function (m, $1) {
-    return prefix + $1.replace(/\{\s*/, "[\"").replace(/\s*\}/, "\"]").replace(/\s*\.\s*/g, "\"][\"");
-  });
-  return rev;
+  var match = FORMULA_REG.exec(formula.trim());
+  var key = match[1] || match[3];
+  var subKey = match[2] || match[4];
+  return subKey ? [key, subKey] : [key];
 };
+
+// 按路径从context中取值，不使用eval，避免执行任意代码
 var evaluateFormula = function evaluateFormula(formula, context) {
   if (checkFormula(formula)) {
-    formula = prepareFormula(formula);
-    return function () {
-      return eval(formula);
-    }.call(context);
+    var keys = prepareFormula(formula);
+    var value = context;
+    var _iterator = _createForOfIteratorHelper(keys),
+      _step;
+    try {
+      for (_iterator.s(); !(_step = _iterator.n()).done;) {
+        var key = _step.value;
+        if (FORBIDDEN_KEYS.indexOf(key) > -1) {
+          return undefined;
+        }
+        // 与原eval实现保持一致：中间值为空时抛出异常
+        value = value[key];
+      }
+    } catch (err) {
+      _iterator.e(err);
+    } finally {
+      _iterator.f();
+    }
+    return value;
+  } else if (typeof formula === "string" && LEGACY_FORMULA_REG.test(formula)) {
+    // 出于安全考虑不再执行JS表达式，与原实现中表达式无法解析时一样抛出异常，由调用方按原有逻辑处理
+    throw new Error("Unsupported filter formula: ".concat(formula));
   } else {
     return formula;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steedos/filters",
-  "version": "3.0.15-beta.51",
+  "version": "3.0.15-beta.52",
   "description": "filters lib for steedos",
   "main": "lib/index.js",
   "files": [
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "499f7339242f4e614daa610540fe2e4105e4607f"
+  "gitHead": "c0f569768b5d6636a315358a72e58d77f87614a9"
 }