alasql 0.4.11 → 0.4.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/bin/alasql-cli.js +1 -1
  2. package/dist/alasql-worker.js +2 -2
  3. package/dist/alasql-worker.min.js +1 -1
  4. package/dist/alasql.fs.js +15 -15
  5. package/dist/alasql.js +15 -15
  6. package/dist/alasql.min.js +2 -16
  7. package/package.json +1 -1
  8. package/test/test814.js +45 -0
  9. package/test/test814_fs.js +45 -0
  10. package/test/test814_min.js +45 -0
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "alasql",
3
3
  "description": "Use SQL to select and filter javascript data - including relational joins and search in nested objects (JSON). Export to and import from Excel and CSV",
4
- "version": "0.4.11",
4
+ "version": "0.4.13",
5
5
  "author": "Andrey Gershun <agershun@gmail.com>",
6
6
  "contributors": [
7
7
  "Mathias Rangel Wulff <m@rawu.dk>"
package/test/test814.js ADDED
@@ -0,0 +1,45 @@
1
+ if (typeof exports === 'object') {
2
+ var assert = require('assert');
3
+ var alasql = require('../dist/alasql');
4
+ }
5
+
6
+ var test = '814_'; // insert test file number
7
+
8
+ describe('Test ' + test + ' - XXS or RCE from BRALITERAL', function () {
9
+ before(function () {
10
+ alasql('create database test' + test);
11
+ alasql('use test' + test);
12
+ alasql('CREATE table i_am_a_table;');
13
+ });
14
+
15
+ after(function () {
16
+ alasql('drop database test' + test);
17
+ });
18
+
19
+ const genPayload = command => `
20
+ console.log(${JSON.stringify(command)})
21
+ `;
22
+
23
+ //
24
+
25
+ it('A) Update SET', function () {
26
+ assert.throws(()=>alasql( `UPDATE i_am_a_table SET [0'+${genPayload(">&2 echo UPDATE pwned $(whoami)")}+']=42;`))
27
+ });
28
+
29
+ it('B) Compare fields', function () {
30
+ assert.throws(()=>alasql( `SELECT * from i_am_a_table where whatever=['+${genPayload(">&2 echo SELECT pwned $(whoami)")}+'];`))
31
+
32
+
33
+ });
34
+
35
+ it('C) Select field', function () {
36
+ assert.throws(()=>alasql( `SELECT \`'+${genPayload(">&2 echo SELECT pwned again, back-quote works too. $(whoami)")}+'\` from i_am_a_table where 1;`))
37
+ });
38
+
39
+
40
+ it('D) Function name', function () {
41
+ assert.throws(()=>alasql( `SELECT [whatever||${genPayload('>&2 echo calling function pwned')}||]('whatever');`))
42
+ });
43
+
44
+
45
+ });
package/test/test814_fs.js ADDED
@@ -0,0 +1,45 @@
1
+ if (typeof exports === 'object') {
2
+ var assert = require('assert');
3
+ var alasql = require('../dist/alasql.fs');
4
+ }
5
+
6
+ var test = '814_fs'; // insert test file number
7
+
8
+ describe('Test ' + test + ' - XXS or RCE from BRALITERAL', function () {
9
+ before(function () {
10
+ alasql('create database test' + test);
11
+ alasql('use test' + test);
12
+ alasql('CREATE table i_am_a_table;');
13
+ });
14
+
15
+ after(function () {
16
+ alasql('drop database test' + test);
17
+ });
18
+
19
+ const genPayload = command => `
20
+ console.log(${JSON.stringify(command)})
21
+ `;
22
+
23
+ //
24
+
25
+ it('A) Update SET', function () {
26
+ assert.throws(()=>alasql( `UPDATE i_am_a_table SET [0'+${genPayload(">&2 echo UPDATE pwned $(whoami)")}+']=42;`))
27
+ });
28
+
29
+ it('B) Compare fields', function () {
30
+ assert.throws(()=>alasql( `SELECT * from i_am_a_table where whatever=['+${genPayload(">&2 echo SELECT pwned $(whoami)")}+'];`))
31
+
32
+
33
+ });
34
+
35
+ it('C) Select field', function () {
36
+ assert.throws(()=>alasql( `SELECT \`'+${genPayload(">&2 echo SELECT pwned again, back-quote works too. $(whoami)")}+'\` from i_am_a_table where 1;`))
37
+ });
38
+
39
+
40
+ it('D) Function name', function () {
41
+ assert.throws(()=>alasql( `SELECT [whatever||${genPayload('>&2 echo calling function pwned')}||]('whatever');`))
42
+ });
43
+
44
+
45
+ });
package/test/test814_min.js ADDED
@@ -0,0 +1,45 @@
1
+ if (typeof exports === 'object') {
2
+ var assert = require('assert');
3
+ var alasql = require('../dist/alasql.min');
4
+ }
5
+
6
+ var test = '814_min'; // insert test file number
7
+
8
+ describe('Test ' + test + ' - XXS or RCE from BRALITERAL', function () {
9
+ before(function () {
10
+ alasql('create database test' + test);
11
+ alasql('use test' + test);
12
+ alasql('CREATE table i_am_a_table;');
13
+ });
14
+
15
+ after(function () {
16
+ alasql('drop database test' + test);
17
+ });
18
+
19
+ const genPayload = command => `
20
+ console.log(${JSON.stringify(command)})
21
+ `;
22
+
23
+ //
24
+
25
+ it('A) Update SET', function () {
26
+ assert.throws(()=>alasql( `UPDATE i_am_a_table SET [0'+${genPayload(">&2 echo UPDATE pwned $(whoami)")}+']=42;`))
27
+ });
28
+
29
+ it('B) Compare fields', function () {
30
+ assert.throws(()=>alasql( `SELECT * from i_am_a_table where whatever=['+${genPayload(">&2 echo SELECT pwned $(whoami)")}+'];`))
31
+
32
+
33
+ });
34
+
35
+ it('C) Select field', function () {
36
+ assert.throws(()=>alasql( `SELECT \`'+${genPayload(">&2 echo SELECT pwned again, back-quote works too. $(whoami)")}+'\` from i_am_a_table where 1;`))
37
+ });
38
+
39
+
40
+ it('D) Function name', function () {
41
+ assert.throws(()=>alasql( `SELECT [whatever||${genPayload('>&2 echo calling function pwned')}||]('whatever');`))
42
+ });
43
+
44
+
45
+ });