@syncfusion/ej2-form-renderer 34.2.2

package/src/common/expressions/expression-parser.js

@@ -0,0 +1,270 @@
+/**
+ * ExpressionParser - Parse and compile expressions
+ *
+ * Converts string expressions into safe, compiled functions
+ * Supports field references, operators, functions, and conditionals
+ * @private
+ */
+var ExpressionParser = /** @class */ (function () {
+    function ExpressionParser() {
+        this.supportedFunctions = [
+            'SUM', 'AVG', 'MIN', 'MAX', 'COUNT',
+            'ROUND', 'FLOOR', 'CEIL', 'ABS', 'SQRT',
+            'UPPER', 'LOWER', 'CONCAT', 'LENGTH', 'TRIM', 'SUBSTRING',
+            'TODAY', 'AGE', 'DATEFORMAT', 'DATEDIFF', 'ADDDAYS', 'SUBDAYS', 'INCLUDES', 'CONTAINS', 'ISNAN', 'SUPPORTEDVALUESOF', 'TOSTRING', 'DATE', 'GETTIME',
+            'EVERY', 'SOME'
+        ];
+        this.availableFields = new Map();
+    }
+    /**
+     * Initialize parser with available fields for type validation
+     */
+    ExpressionParser.prototype.setAvailableFields = function (fields) {
+        var _this = this;
+        this.availableFields.clear();
+        fields.forEach(function (field) {
+            _this.availableFields.set(field.name, field);
+        });
+    };
+    ExpressionParser.prototype.validateFieldOperations = function (expression) {
+        var errors = [];
+        // Skip if no fields available
+        if (this.availableFields.size === 0) {
+            return errors;
+        }
+        // Invalid operators for string fields (allow only + for concatenation)
+        var stringInvalidOps = ['-', '*', '/', '%', '^'];
+        // All operators invalid for date fields
+        var dateInvalidOps = ['-', '*', '/', '%', '^', '+'];
+        // Track reported operator positions to avoid duplicates
+        var reportedOperators = new Set();
+        // Extract all field references and their surrounding operators
+        var fieldRefPattern = /(\{[^}]+\})/g;
+        var match;
+        while ((match = fieldRefPattern.exec(expression)) !== null) {
+            var fieldRef = match[0];
+            var fieldName = fieldRef.slice(1, -1); // Remove { }
+            var field = this.availableFields.get(fieldName);
+            if (!field)
+                continue; // Field not found in available fields, skip validation
+            var fieldIndex = match.index;
+            var fieldEndIndex = fieldIndex + fieldRef.length;
+            // Get context around field reference (including spaces)
+            var textBefore = expression.substring(Math.max(0, fieldIndex - 10), fieldIndex);
+            var textAfter = expression.substring(fieldEndIndex, Math.min(expression.length, fieldEndIndex + 10));
+            // Extract the operator if present (skip spaces)
+            var operatorBefore = textBefore.replace(/\s+$/, '').slice(-1);
+            var operatorAfter = textAfter.replace(/^\s+/, '').charAt(0);
+            // Calculate actual position of operators in the original expression
+            var textBeforeTrimmed = textBefore.replace(/\s+$/, '');
+            var textAfterTrimmed = textAfter.replace(/^\s+/, '');
+            var operatorBeforePos = fieldIndex - (textBefore.length - textBeforeTrimmed.length) - 1;
+            var operatorAfterPos = fieldEndIndex + (textAfter.length - textAfterTrimmed.length);
+            // For STRING fields: reject all operators except +
+            if (field.type === 'string' && !field.format) {
+                if (operatorBefore && stringInvalidOps.indexOf(operatorBefore) !== -1) {
+                    var key = operatorBeforePos + ":" + operatorBefore;
+                    if (!reportedOperators.has(key)) {
+                        errors.push("Cannot perform '" + operatorBefore + "' operation on string field '{" + fieldName + "}'");
+                        reportedOperators.add(key);
+                    }
+                }
+                if (operatorAfter && stringInvalidOps.indexOf(operatorAfter) !== -1) {
+                    var key = operatorAfterPos + ":" + operatorAfter;
+                    if (!reportedOperators.has(key)) {
+                        errors.push("Cannot perform '" + operatorAfter + "' operation on string field '{" + fieldName + "}'");
+                        reportedOperators.add(key);
+                    }
+                }
+            }
+            // For DATE fields: reject ALL operators including +
+            if (field.format === 'date' || field.format === 'date-time' || field.format === 'time') {
+                if (operatorBefore && dateInvalidOps.indexOf(operatorBefore) !== -1) {
+                    var key = operatorBeforePos + ":" + operatorBefore;
+                    if (!reportedOperators.has(key)) {
+                        errors.push("Cannot perform '" + operatorBefore + "' operation on date field '{" + fieldName + "}'");
+                        reportedOperators.add(key);
+                    }
+                }
+                if (operatorAfter && dateInvalidOps.indexOf(operatorAfter) !== -1) {
+                    var key = operatorAfterPos + ":" + operatorAfter;
+                    if (!reportedOperators.has(key)) {
+                        errors.push("Cannot perform '" + operatorAfter + "' operation on date field '{" + fieldName + "}'");
+                        reportedOperators.add(key);
+                    }
+                }
+            }
+        }
+        return errors;
+    };
+    /**
+     * Validate expression syntax
+     */
+    ExpressionParser.prototype.validate = function (expression) {
+        var errors = [];
+        if (!expression || expression.trim() === '') {
+            return { valid: true, errors: [] };
+        }
+        // Check for unbalanced braces
+        var openBraces = (expression.match(/\{/g) || []).length;
+        var closeBraces = (expression.match(/\}/g) || []).length;
+        if (openBraces !== closeBraces) {
+            errors.push('Unbalanced braces in expression');
+        }
+        // Check for unbalanced parentheses
+        var openParens = (expression.match(/\(/g) || []).length;
+        var closeParens = (expression.match(/\)/g) || []).length;
+        if (openParens !== closeParens) {
+            errors.push('Unbalanced parentheses in expression');
+        }
+        // Check for invalid function calls
+        var funcPattern = /(\w+)\s*\(/g;
+        var match;
+        while ((match = funcPattern.exec(expression)) !== null) {
+            var funcName = match[1].toUpperCase();
+            // Only validate uppercase-named functions
+            if (funcName === funcName.toUpperCase() && this.supportedFunctions.indexOf(funcName) === -1) {
+                errors.push("Unknown function: " + funcName);
+            }
+        }
+        // Validate field operations based on field types
+        var fieldOpErrors = this.validateFieldOperations(expression);
+        errors.push.apply(errors, fieldOpErrors);
+        return {
+            valid: errors.length === 0,
+            errors: errors
+        };
+    };
+    /**
+     * Compile expression to executable function
+     */
+    ExpressionParser.prototype.compile = function (expression, options) {
+        if (options === void 0) { options = {}; }
+        try {
+            // Set available fields for validation if provided
+            if (options.availableFields && Array.isArray(options.availableFields)) {
+                this.setAvailableFields(options.availableFields);
+            }
+            // Validate expression before compiling
+            var validation = this.validate(expression);
+            if (!validation.valid) {
+                return function () { return null; };
+            }
+            // Replace field references with context lookups
+            var compiled_1 = expression;
+            // Handle field references FIRST (this includes refs inside ${...})
+            compiled_1 = this.compileFieldReferences(compiled_1);
+            compiled_1 = options.isCustomValidation ? this.compileInputReferences(compiled_1) : compiled_1;
+            // Handle bare function calls SECOND (e.g., SUM([...]) without braces)
+            compiled_1 = this.compileBareFunctionCalls(compiled_1);
+            // Handle math expressions THIRD (now ${} and {} contain already-replaced refs)
+            compiled_1 = this.compileMatrixExpressions(compiled_1);
+            return function (context) {
+                try {
+                    // This uses Function constructor with controlled context binding
+                    // which is safer than eval() but still allows expressions
+                    // Note: compiled expression already uses context['field'] syntax
+                    var func = new Function('context', "\n            try {\n              return " + compiled_1 + ";\n            } catch (e) {\n              return null;\n            }\n          ");
+                    return func(context);
+                }
+                catch (e) {
+                    return null;
+                }
+            };
+        }
+        catch (error) {
+            return function () { return null; };
+        }
+    };
+    // Private helpers
+    ExpressionParser.prototype.compileMatrixExpressions = function (expression) {
+        var compiled = expression;
+        var constants = ['PI', 'TRUE', 'FALSE', 'NULL', 'UNDEFINED', 'Math'];
+        var functions = [
+            'SUM', 'AVG', 'MIN', 'MAX', 'COUNT',
+            'ROUND', 'FLOOR', 'CEIL', 'ABS', 'SQRT',
+            'UPPER', 'LOWER', 'CONCAT', 'LENGTH', 'TRIM', 'SUBSTRING',
+            'TODAY', 'AGE', 'DATEFORMAT', 'DATEDIFF', 'ADDDAYS', 'SUBDAYS'
+        ];
+        // Create fresh regex each time to avoid lastIndex issues with g flag
+        var mathExprPattern = /\$?\{([^}]+)\}/g;
+        // Process ${...} and {...} blocks: replace bare identifiers with context lookups
+        compiled = compiled.replace(mathExprPattern, function (_match, content) {
+            var transformed = content;
+            // STEP 1: Handle function calls first
+            // Match function names followed by ( and prefix with context.
+            // Use negative lookbehind to avoid double-replacing (e.g., context.SUM)
+            functions.forEach(function (fn) {
+                // eslint-disable-next-line security/detect-non-literal-regexp
+                var funcCallRegex = new RegExp("(?<!context\\.)\\b" + fn + "\\b(?=\\s*\\()", 'g');
+                transformed = transformed.replace(funcCallRegex, "context." + fn);
+            });
+            constants.forEach(function (constant) {
+                // eslint-disable-next-line security/detect-non-literal-regexp
+                var constantRegex = new RegExp("\\b" + constant + "\\b", 'g');
+                transformed = transformed.replace(constantRegex, "context." + constant);
+            });
+            // Return as parenthesized expression
+            return "(" + transformed + ")";
+        });
+        return compiled;
+    };
+    ExpressionParser.prototype.compileBareFunctionCalls = function (expression) {
+        var compiled = expression;
+        var functions = [
+            'SUM', 'AVG', 'MIN', 'MAX', 'COUNT',
+            'ROUND', 'FLOOR', 'CEIL', 'ABS', 'SQRT',
+            'UPPER', 'LOWER', 'CONCAT', 'LENGTH', 'TRIM', 'SUBSTRING',
+            'TODAY', 'AGE', 'DATEFORMAT', 'DATEDIFF', 'ADDDAYS', 'SUBDAYS'
+        ];
+        // Handle bare function calls like SUM([...]) that are not inside ${...} or {...}
+        // Use negative lookbehind to avoid matching if already preceded by context.
+        functions.forEach(function (fn) {
+            // eslint-disable-next-line security/detect-non-literal-regexp
+            var funcCallRegex = new RegExp("(?<!context\\.)\\b" + fn + "\\b(?=\\s*\\()", 'g');
+            compiled = compiled.replace(funcCallRegex, "context." + fn);
+        });
+        return compiled;
+    };
+    ExpressionParser.prototype.compileFieldReferences = function (expression) {
+        var compiled = expression;
+        // Create fresh regex each time to avoid lastIndex issues with g flag
+        var fieldRefPattern = /\{([^{}]+)\}/g;
+        // Replace {fieldName} with context['fieldName'] or field access
+        compiled = compiled.replace(fieldRefPattern, function (match, ref) {
+            // Handle escaped braces
+            if (ref.startsWith('\\') && ref.endsWith('\\')) {
+                return match; // Keep as is
+            }
+            // Handle nested paths like {customer.name}
+            return "context['" + ref.replace(/\./g, '\'].[') + "']";
+        });
+        return compiled;
+    };
+    ExpressionParser.prototype.compileInputReferences = function (expression) {
+        var compiled = expression;
+        // First, protect string literals to avoid replacing 'input' inside strings
+        var strings = [];
+        var stringProtected = compiled;
+        // eslint-disable-next-line security/detect-unsafe-regex
+        stringProtected = stringProtected.replace(/(['"`])(?:(?=(\\?))\2.)*?\1/g, function (match) {
+            strings.push(match);
+            return "__STRING_" + (strings.length - 1) + "__";
+        });
+        // Case 1: Replace input.property with context['input'].property
+        var inputPropertyPattern = /(?<!context\[')\binput\./g;
+        stringProtected = stringProtected.replace(inputPropertyPattern, 'context[\'input\'].');
+        // Case 2: Replace bare 'input' with context['input']
+        // Use negative lookbehind to avoid replacing if already preceded by context.'
+        var inputPattern = /(?<!context\[')\binput\b(?!\s*[(\.])/g;
+        stringProtected = stringProtected.replace(inputPattern, 'context[\'input\']');
+        // Restore string literals
+        var result = stringProtected;
+        strings.forEach(function (str, idx) {
+            result = result.replace("__STRING_" + idx + "__", str);
+        });
+        return result;
+    };
+    return ExpressionParser;
+}());
+export { ExpressionParser };

package/src/common/expressions/grid-expressions.d.ts

@@ -0,0 +1,24 @@
+import { ExpressionEngine } from './expression-engine';
+/**
+ * @private
+ */
+export declare class GridExpressions {
+    private engine;
+    constructor();
+    /**
+     * Convert a column value to the proper JS type for expression evaluation.
+     * Form inputs return strings; numeric/boolean values must be coerced.
+     */
+    parseColumnValue(value: any, columnType?: string): any;
+    /**
+     * Evaluate all expression-bearing columns for a single row.
+     * Returns a new row object with calculated values merged in.
+     */
+    evaluateRowExpressions(row: Record<string, any>, columns: any[]): Record<string, any>;
+    /**
+     * Extract the subset of columns that carry a non-empty `expression`.
+     */
+    extractCalculatedColumns(columns: any[]): any[];
+    getEngine(): ExpressionEngine;
+}
+export default GridExpressions;

package/src/common/expressions/grid-expressions.js

@@ -0,0 +1,92 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+import { ExpressionEngine } from './expression-engine';
+/**
+ * @private
+ */
+var GridExpressions = /** @class */ (function () {
+    function GridExpressions() {
+        this.engine = new ExpressionEngine();
+    }
+    /**
+     * Convert a column value to the proper JS type for expression evaluation.
+     * Form inputs return strings; numeric/boolean values must be coerced.
+     */
+    GridExpressions.prototype.parseColumnValue = function (value, columnType) {
+        // Handle null/undefined/empty
+        if (value === null || value === undefined || value === '') {
+            return value;
+        }
+        // Parse number types
+        if (columnType === 'number') {
+            var parsed = parseFloat(String(value));
+            return isNaN(parsed) ? 0 : parsed;
+        }
+        // Parse boolean types
+        if (columnType === 'boolean') {
+            if (typeof value === 'boolean') {
+                return value;
+            }
+            return value === 'true' || value === '1' || value === 1 || value === true;
+        }
+        // Return as-is for string and other types
+        return value;
+    };
+    /**
+     * Evaluate all expression-bearing columns for a single row.
+     * Returns a new row object with calculated values merged in.
+     */
+    GridExpressions.prototype.evaluateRowExpressions = function (row, columns) {
+        var _this = this;
+        var calculatedRow = __assign({}, row);
+        // Find all columns with expressions
+        var calculatedColumns = columns.filter(function (col) { return col.expression && col.expression.toString().trim(); });
+        var _loop_1 = function (column) {
+            if (!column.expression) {
+                return "continue";
+            }
+            try {
+                // Prepare row values with proper type conversion
+                var typedRow_1 = {};
+                columns.forEach(function (col) {
+                    var value = calculatedRow[col.field];
+                    typedRow_1[col.field] = _this.parseColumnValue(value, col.type);
+                });
+                // Evaluate expression with current row as context
+                var result = this_1.engine.evaluate(column.expression, typedRow_1, {
+                    throwOnError: false
+                });
+                // Update row with calculated value
+                calculatedRow[column.field] = result;
+            }
+            catch (error) {
+                calculatedRow[column.field] = null;
+            }
+        };
+        var this_1 = this;
+        for (var _i = 0, calculatedColumns_1 = calculatedColumns; _i < calculatedColumns_1.length; _i++) {
+            var column = calculatedColumns_1[_i];
+            _loop_1(column);
+        }
+        return calculatedRow;
+    };
+    /**
+     * Extract the subset of columns that carry a non-empty `expression`.
+     */
+    GridExpressions.prototype.extractCalculatedColumns = function (columns) {
+        return columns.filter(function (col) { return col.expression && col.expression.toString().trim(); });
+    };
+    GridExpressions.prototype.getEngine = function () { return this.engine; };
+    return GridExpressions;
+}());
+export { GridExpressions };
+export default GridExpressions;

package/src/common/expressions/index.d.ts

@@ -0,0 +1,4 @@
+export * from './dependency-tracker';
+export * from './expression-engine';
+export * from './expression-parser';
+export * from './grid-expressions';

package/src/common/expressions/index.js

@@ -0,0 +1,4 @@
+export * from './dependency-tracker';
+export * from './expression-engine';
+export * from './expression-parser';
+export * from './grid-expressions';

package/src/common/index.d.ts

@@ -0,0 +1,10 @@
+export * from './checkbox-group';
+export * from './conditional-rule-engine';
+export * from './custom-validation-engine';
+export * from './datagrid-component';
+export * from './json-converter';
+export * from './minmax-rule-engine';
+export * from './option-fetcher';
+export * from './parser';
+export * from './static-html-renderer';
+export * from './utils';

package/src/common/index.js

@@ -0,0 +1,10 @@
+export * from './checkbox-group';
+export * from './conditional-rule-engine';
+export * from './custom-validation-engine';
+export * from './datagrid-component';
+export * from './json-converter';
+export * from './minmax-rule-engine';
+export * from './option-fetcher';
+export * from './parser';
+export * from './static-html-renderer';
+export * from './utils';