alasql 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -1,9 +1,14 @@
 # Changelog
 
 
-## 0.7.0 (03/03/2021)
+## 0.7.1 (2021-03-05)
 
-- Fix: Code injection vulnerability processing literals #1302
+- Bump: Update lodash dependency
+
+
+## 0.7.0 (2021-03-03)
+
+- Fix: Code injection vulnerability processing literals
 - Fix: Return empty results in group by when input is empty #927
 
 

package/README.md

@@ -1,3 +1,7 @@
+<h2>
+Please use version 0.7 as prior versions has a security flaw if you use user generated data to concat your SQL strings instead of providing them as a parameters to AlaSQL. 
+</h2>
+
 _AlaSQL is an open source project used on more than two million page views per month - and we appreciate any and all contributions we can get. [Please help out](https://github.com/agershun/alasql/labels/Please%20help%20out%21)._
 
 _Have a question? Ask on [Stack Overflow](http://stackoverflow.com/questions/ask?tags=AlaSQL) using the "alasql" tag._
@@ -23,9 +27,7 @@ _Have a question? Ask on [Stack Overflow](http://stackoverflow.com/questions/ask
 <h2 align="center"><a href="http://alasql.org"><img src="https://cloud.githubusercontent.com/assets/1063454/19309516/94f8007e-9085-11e6-810f-62fd60b42185.png" alt="AlaSQL logo" styl="max-width:80%"/></a>
 </h2>
 
-<h2>
-Please use version 0.7 - prior versions has a security flaw if you concat your SQL strings instead of providing them as a parameter to AlaSQL. 
-</h2>
+
 
 AlaSQL - _( [à la](http://en.wiktionary.org/wiki/%C3%A0_la) [SQL](http://en.wikipedia.org/wiki/SQL) ) [ælæ ɛskju:ɛl]_ - is an open source SQL database for JavaScript with a strong focus on query speed and data source flexibility for both relational data and schemaless data.  It works in the web browser, Node.js, and mobile apps.
 

package/bin/alasql-cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 //
 // Command line interface for Alasql
-// Version: 0.2.2
+// Version: 0.7.2
 // Date: 28.07.2015
 // (c) 2014-2015, Andrey Gershun & M. Rangel Wulff
 //

package/dist/alasql-worker.js

@@ -1,7 +1,7 @@
-//! AlaSQL v0.7.0-develop-b1a58b1bundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v0.7.2 | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 /*
 @module alasql
-@version 0.7.0-develop-b1a58b1bundefined
+@version 0.7.2
 
 AlaSQL - JavaScript SQL database
 © 2014-2016	Andrey Gershun & Mathias Rangel Wulff

package/dist/alasql-worker.min.js

@@ -1,2 +1,2 @@
-//! AlaSQL v0.7.0-develop-b1a58b1bundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v0.7.2 | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 !function(r,e){"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?module.exports=e():r.alasql=e()}(this,function(){function i(r,e,t){"function"==typeof(e=e||[])&&(scope=t,t=e,e=[]),"object"!=typeof e&&(e=[e]);var o=i.lastid++;i.buffer[o]=t,i.webworker.postMessage({id:o,sql:r,params:e})}var s;if(i.options={},i.options.progress=function(){},isArray=function(r){return"[object Array]"===Object.prototype.toString.call(r)},i.promise=function(){throw new Error("Please include a Promise/A+ library")},"undefined"!=typeof Promise&&(s=function(r,e,n,s){return new Promise(function(t,o){i(r,e,function(r,e){e?o(e):(n&&s&&!1!==i.options.progress&&i.options.progress(n,s),t(r))})})},i.promise=function(r,e){if("undefined"==typeof Promise)throw new Error("Please include a Promise/A+ library");if("string"==typeof r)return s(r,e);if(!isArray(r)||r.length<1||void 0!==e)throw new Error("Error in .promise parameters");return function(r){if(!(r.length<1)){for(var e,t,o=[],n=0;n<r.length;n++){if("string"==typeof(t=r[n])&&(t=[t]),!isArray(t)||t.length<1||2<t.length)throw new Error("Error in .promise parameter");e=t[0],t=t[1]||void 0,o.push(s(e,t,n,r.length))}return Promise.all(o)}}(r)}),!(i=i||!1))throw new Error("alasql was not found");return i.worker=function(){throw new Error("Can find webworker in this enviroment")},"undefined"!=typeof Worker&&(i.worker=function(r,e,t){if(void 0===(r=!0===r?void 0:r))for(var o=document.getElementsByTagName("script"),n=0;n<o.length;n++){if("alasql-worker.js"===o[n].src.substr(-16).toLowerCase()){r=o[n].src.substr(0,o[n].src.length-16)+"alasql.js";break}if("alasql-worker.min.js"===o[n].src.substr(-20).toLowerCase()){r=o[n].src.substr(0,o[n].src.length-20)+"alasql.min.js";break}if("alasql.js"===o[n].src.substr(-9).toLowerCase()){r=o[n].src;break}if("alasql.min.js"===o[n].src.substr(-13).toLowerCase()){r=o[n].src.substr(0,o[n].src.length-13)+"alasql.min.js";break}}if(void 0===r)throw new Error("Path to alasql.js is not specified");var s;!1!==r?(s="importScripts('",s+=r,s+="');self.onmessage = function(event) {alasql(event.data.sql,event.data.params, function(data){postMessage({id:event.data.id, data:data});});}",s=new Blob([s],{type:"text/plain"}),i.webworker=new Worker(URL.createObjectURL(s)),i.webworker.onmessage=function(r){var e=r.data.id;i.buffer[e](r.data.data),delete i.buffer[e]},i.webworker.onerror=function(r){throw r},1<arguments.length&&i("REQUIRE "+e.map(function(r){return'"'+r+'"'}).join(","),[],t)):!1===r&&delete i.webworker}),i.lastid=0,i.buffer={},i.worker(),i});

package/dist/alasql.fs.js

@@ -1,7 +1,7 @@
-//! AlaSQL v0.7.0-develop-b1a58b1bundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v0.7.2 | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 /*
 @module alasql
-@version 0.7.0-develop-b1a58b1bundefined
+@version 0.7.2
 
 AlaSQL - JavaScript SQL database
 © 2014-2016	Andrey Gershun & Mathias Rangel Wulff
@@ -142,7 +142,7 @@ var alasql = function(sql, params, cb, scope) {
 	Current version of alasql 
  	@constant {string} 
 */
-alasql.version = '0.7.0-develop-b1a58b1bundefined';
+alasql.version = '0.7.2';
 
 /**
 	Debug flag
@@ -4027,11 +4027,11 @@ var cloneDeep = (utils.cloneDeep = function cloneDeep(obj) {
 		return +obj;
 	}
 
-	var temp = obj.constructor(); // changed
+	var temp = (Object.prototype.hasOwnProperty.call(obj, 'constructor') ? Object : obj.constructor)(); // changed
 
 	for (var key in obj) {
 		if (obj.hasOwnProperty(key)) {
-			temp[key] = cloneDeep(obj[key]);
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(temp, key, {value: cloneDeep(obj[key]), writable: true, enumerable: true, configurable: true}); } else { temp[key] = cloneDeep(obj[key]); }
 		}
 	}
 	return temp;
@@ -4103,7 +4103,7 @@ var extend = (utils.extend = function extend(a, b) {
 	a = a || {};
 	for (var key in b) {
 		if (b.hasOwnProperty(key)) {
-			a[key] = b[key];
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(a, key, {value: b[key], writable: true, enumerable: true, configurable: true}); } else { a[key] = b[key]; }
 		}
 	}
 	return a;
@@ -9061,7 +9061,7 @@ yy.Select.prototype.compileGroup = function (query) {
 			aft2 = '';
 
 		if (typeof query.groupStar !== 'undefined') {
-			aft2 += "for(var f in p['" + query.groupStar + "']) {g[f]=p['" + query.groupStar + "'][f];};";
+			aft2 += "for(var f in p['" + query.groupStar + "']) {if(/^__proto__$/.test(f))Object.defineProperty(g,f,{writable:true,enumerable:true,configurable:true});g[f]=p['" + query.groupStar + "'][f];};";
 		}
 
 		/*
@@ -9384,7 +9384,7 @@ function compileSelectStar(query, aliases, joinstar) {
 		} else {
 
 			// if column not exist, then copy all
-			sp += 'var w=p["' + alias + '"];for(var k in w){r[k]=w[k]};';
+			sp += 'var w=p["' + alias + '"];for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 
 			query.dirtyColumns = true;
 		}
@@ -9713,10 +9713,10 @@ yy.Select.prototype.compileSelectGroup1 = function (query) {
 	self.columns.forEach(function (col) {
 
 		if (col instanceof yy.Column && col.columnid === '*') {
-			//			s += 'for(var k in g){r[k]=g[k]};';
+			//			s += 'for(var k in g){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			//			s += 'for(var k in this.query.groupColumns){r[k]=g[this.query.groupColumns[k]]};';
 
-			s += 'for(var k in g) {r[k]=g[k]};';
+			s += 'for(var k in g) {if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			return '';
 
 		} else {
@@ -13022,7 +13022,7 @@ yy.CreateTable.prototype.execute = function (databaseid, params, cb) {
 
 			table.update(
 				function (t) {
-					for (var f in r) t[f] = r[f];
+					for (var f in r) {if(/^__proto__$/.test(f))Object.defineProperty(t,f,{writable:true,enumerable:true,configurable:true});t[f] = r[f];}
 				},
 				table.data.indexOf(toreplace),
 				params
@@ -14568,7 +14568,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 					});
 				} else {
 
-					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){r[k]=w[k]};';
+					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 					sw = JSONtoJS(values);
 				}
 			}

package/dist/alasql.js

@@ -1,7 +1,7 @@
-//! AlaSQL v0.7.0-develop-b1a58b1bundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v0.7.2 | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 /*
 @module alasql
-@version 0.7.0-develop-b1a58b1bundefined
+@version 0.7.2
 
 AlaSQL - JavaScript SQL database
 © 2014-2016	Andrey Gershun & Mathias Rangel Wulff
@@ -142,7 +142,7 @@ var alasql = function(sql, params, cb, scope) {
 	Current version of alasql 
  	@constant {string} 
 */
-alasql.version = '0.7.0-develop-b1a58b1bundefined';
+alasql.version = '0.7.2';
 
 /**
 	Debug flag
@@ -4022,11 +4022,11 @@ var cloneDeep = (utils.cloneDeep = function cloneDeep(obj) {
 		return +obj;
 	}
 
-	var temp = obj.constructor(); // changed
+	var temp = (Object.prototype.hasOwnProperty.call(obj, 'constructor') ? Object : obj.constructor)(); // changed
 
 	for (var key in obj) {
 		if (obj.hasOwnProperty(key)) {
-			temp[key] = cloneDeep(obj[key]);
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(temp, key, {value: cloneDeep(obj[key]), writable: true, enumerable: true, configurable: true}); } else { temp[key] = cloneDeep(obj[key]); }
 		}
 	}
 	return temp;
@@ -4098,7 +4098,7 @@ var extend = (utils.extend = function extend(a, b) {
 	a = a || {};
 	for (var key in b) {
 		if (b.hasOwnProperty(key)) {
-			a[key] = b[key];
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(a, key, {value: b[key], writable: true, enumerable: true, configurable: true}); } else { a[key] = b[key]; }
 		}
 	}
 	return a;
@@ -9056,7 +9056,7 @@ yy.Select.prototype.compileGroup = function (query) {
 			aft2 = '';
 
 		if (typeof query.groupStar !== 'undefined') {
-			aft2 += "for(var f in p['" + query.groupStar + "']) {g[f]=p['" + query.groupStar + "'][f];};";
+			aft2 += "for(var f in p['" + query.groupStar + "']) {if(/^__proto__$/.test(f))Object.defineProperty(g,f,{writable:true,enumerable:true,configurable:true});g[f]=p['" + query.groupStar + "'][f];};";
 		}
 
 		/*
@@ -9379,7 +9379,7 @@ function compileSelectStar(query, aliases, joinstar) {
 		} else {
 
 			// if column not exist, then copy all
-			sp += 'var w=p["' + alias + '"];for(var k in w){r[k]=w[k]};';
+			sp += 'var w=p["' + alias + '"];for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 
 			query.dirtyColumns = true;
 		}
@@ -9708,10 +9708,10 @@ yy.Select.prototype.compileSelectGroup1 = function (query) {
 	self.columns.forEach(function (col) {
 
 		if (col instanceof yy.Column && col.columnid === '*') {
-			//			s += 'for(var k in g){r[k]=g[k]};';
+			//			s += 'for(var k in g){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			//			s += 'for(var k in this.query.groupColumns){r[k]=g[this.query.groupColumns[k]]};';
 
-			s += 'for(var k in g) {r[k]=g[k]};';
+			s += 'for(var k in g) {if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			return '';
 
 		} else {
@@ -13017,7 +13017,7 @@ yy.CreateTable.prototype.execute = function (databaseid, params, cb) {
 
 			table.update(
 				function (t) {
-					for (var f in r) t[f] = r[f];
+					for (var f in r) {if(/^__proto__$/.test(f))Object.defineProperty(t,f,{writable:true,enumerable:true,configurable:true});t[f] = r[f];}
 				},
 				table.data.indexOf(toreplace),
 				params
@@ -14563,7 +14563,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 					});
 				} else {
 
-					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){r[k]=w[k]};';
+					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 					sw = JSONtoJS(values);
 				}
 			}