alasql 1.7.4 → 1.7.6

package/.github/workflows/nodejs.yml

@@ -13,7 +13,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [12.x, 14.x, 16.x, 17.x]
+        node-version: [12.x, 14.x, 15.x]
 
     steps:
     - uses: actions/checkout@v2

package/README.md

@@ -1,3 +1,7 @@
+<h2>
+Please use version 1.x as prior versions has a security flaw if you use user generated data to concat your SQL strings instead of providing them as a parameters to AlaSQL. 
+</h2>
+
 _AlaSQL is an open source project used on more than two million page views per month - and we appreciate any and all contributions we can get. [Please help out](https://github.com/agershun/alasql/labels/Please%20help%20out%21)._
 
 _Have a question? Ask on [Stack Overflow](http://stackoverflow.com/questions/ask?tags=AlaSQL) using the "alasql" tag._
@@ -471,7 +475,7 @@ var b = browserify("./main.js").bundle();
 
 #### Vue
 
-For some frameworks (lige Vue) alasql cant access XLSX by it self. We recommend handling it by including AlaSQL the following way:
+For some frameworks (lige Vue) alasql cant access XLSX by it self. We recommend handeling it by including AlaSQL the following way:
 
 ```import alasql from 'alasql';
 import XLSX from 'xlsx';
@@ -601,15 +605,9 @@ The testruns can be found in the [testlog](TESTLOG.md).
 
 
 
-## Contributing
-
-See [Contributing](CONTRIBUTING.md) for details.
-
-Thanks to all the people who already contributed!
+## Bleeding Edge
 
-<a href="https://github.com/agershun/alasql/graphs/contributors">
-  <img src="https://contributors-img.web.app/image?repo=agershun/alasql" />
-</a>
+If you want to try the most recent development version of the library please download [this file](https://rawgit.com/agershun/alasql/develop/dist/alasql.fs.js) or visit the [testbench](https://rawgit.com/agershun/alasql/develop/utils/testbench.html) to play around in the browser console.
 
 
 ## License

package/bin/alasql-cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 //
 // Command line interface for Alasql
-// Version: 0.2.2
+// Version: 1.7.6
 // Date: 28.07.2015
 // (c) 2014-2015, Andrey Gershun & M. Rangel Wulff
 //

package/dist/alasql-worker.js

@@ -1,7 +1,7 @@
-//! AlaSQL v1.7.4-develop-89075a50undefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v1.7.6 | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 /*
 @module alasql
-@version 1.7.4-develop-89075a50undefined
+@version 1.7.6
 
 AlaSQL - JavaScript SQL database
 © 2014-2016	Andrey Gershun & Mathias Rangel Wulff

package/dist/alasql-worker.min.js

@@ -1,2 +1,2 @@
-//! AlaSQL v1.7.4-develop-89075a50undefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
-!function(r,e){"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?module.exports=e():r.alasql=e()}(this,function(){function i(r,e,o){"function"==typeof(e=e||[])&&(scope=o,o=e,e=[]),"object"!=typeof e&&(e=[e]);var t=i.lastid++;i.buffer[t]=o,i.webworker.postMessage({id:t,sql:r,params:e})}var a;if(i.options={},i.options.progress=function(){},isArray=function(r){return"[object Array]"===Object.prototype.toString.call(r)},i.promise=function(){throw new Error("Please include a Promise/A+ library")},"undefined"!=typeof Promise&&(a=function(r,e,n,s){return new Promise(function(o,t){i(r,e,function(r,e){e?t(e):(n&&s&&!1!==i.options.progress&&i.options.progress(n,s),o(r))})})},i.promise=function(r,e){if("undefined"==typeof Promise)throw new Error("Please include a Promise/A+ library");if("string"==typeof r)return a(r,e);if(!isArray(r)||r.length<1||void 0!==e)throw new Error("Error in .promise parameters");var o=r;if(!(o.length<1)){for(var t,n,s=[],i=0;i<o.length;i++){if("string"==typeof(n=o[i])&&(n=[n]),!isArray(n)||n.length<1||2<n.length)throw new Error("Error in .promise parameter");t=n[0],n=n[1]||void 0,s.push(a(t,n,i,o.length))}return Promise.all(s)}}),i=i||!1)return i.worker=function(){throw new Error("Can find webworker in this enviroment")},"undefined"!=typeof Worker&&(i.worker=function(r,e,o){if(void 0===(r=!0===r?void 0:r))for(var t=document.getElementsByTagName("script"),n=0;n<t.length;n++){if("alasql-worker.js"===t[n].src.substr(-16).toLowerCase()){r=t[n].src.substr(0,t[n].src.length-16)+"alasql.js";break}if("alasql-worker.min.js"===t[n].src.substr(-20).toLowerCase()){r=t[n].src.substr(0,t[n].src.length-20)+"alasql.min.js";break}if("alasql.js"===t[n].src.substr(-9).toLowerCase()){r=t[n].src;break}if("alasql.min.js"===t[n].src.substr(-13).toLowerCase()){r=t[n].src.substr(0,t[n].src.length-13)+"alasql.min.js";break}}if(void 0===r)throw new Error("Path to alasql.js is not specified");var s;!1!==r?(s=(s="importScripts('")+r+"');self.onmessage = function(event) {alasql(event.data.sql,event.data.params, function(data){postMessage({id:event.data.id, data:data});});}",s=new Blob([s],{type:"text/plain"}),i.webworker=new Worker(URL.createObjectURL(s)),i.webworker.onmessage=function(r){var e=r.data.id;i.buffer[e](r.data.data),delete i.buffer[e]},i.webworker.onerror=function(r){throw r},1<arguments.length&&i("REQUIRE "+e.map(function(r){return'"'+r+'"'}).join(","),[],o)):!1===r&&delete i.webworker}),i.lastid=0,i.buffer={},i.worker(),i;throw new Error("alasql was not found")});
+//! AlaSQL v1.7.6 | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+!function(r,e){"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?module.exports=e():r.alasql=e()}(this,function(){function i(r,e,t){"function"==typeof(e=e||[])&&(scope=t,t=e,e=[]),"object"!=typeof e&&(e=[e]);var o=i.lastid++;i.buffer[o]=t,i.webworker.postMessage({id:o,sql:r,params:e})}var s;if(i.options={},i.options.progress=function(){},isArray=function(r){return"[object Array]"===Object.prototype.toString.call(r)},i.promise=function(){throw new Error("Please include a Promise/A+ library")},"undefined"!=typeof Promise&&(s=function(r,e,n,s){return new Promise(function(t,o){i(r,e,function(r,e){e?o(e):(n&&s&&!1!==i.options.progress&&i.options.progress(n,s),t(r))})})},i.promise=function(r,e){if("undefined"==typeof Promise)throw new Error("Please include a Promise/A+ library");if("string"==typeof r)return s(r,e);if(!isArray(r)||r.length<1||void 0!==e)throw new Error("Error in .promise parameters");return function(r){if(!(r.length<1)){for(var e,t,o=[],n=0;n<r.length;n++){if("string"==typeof(t=r[n])&&(t=[t]),!isArray(t)||t.length<1||2<t.length)throw new Error("Error in .promise parameter");e=t[0],t=t[1]||void 0,o.push(s(e,t,n,r.length))}return Promise.all(o)}}(r)}),!(i=i||!1))throw new Error("alasql was not found");return i.worker=function(){throw new Error("Can find webworker in this enviroment")},"undefined"!=typeof Worker&&(i.worker=function(r,e,t){if(void 0===(r=!0===r?void 0:r))for(var o=document.getElementsByTagName("script"),n=0;n<o.length;n++){if("alasql-worker.js"===o[n].src.substr(-16).toLowerCase()){r=o[n].src.substr(0,o[n].src.length-16)+"alasql.js";break}if("alasql-worker.min.js"===o[n].src.substr(-20).toLowerCase()){r=o[n].src.substr(0,o[n].src.length-20)+"alasql.min.js";break}if("alasql.js"===o[n].src.substr(-9).toLowerCase()){r=o[n].src;break}if("alasql.min.js"===o[n].src.substr(-13).toLowerCase()){r=o[n].src.substr(0,o[n].src.length-13)+"alasql.min.js";break}}if(void 0===r)throw new Error("Path to alasql.js is not specified");var s;!1!==r?(s="importScripts('",s+=r,s+="');self.onmessage = function(event) {alasql(event.data.sql,event.data.params, function(data){postMessage({id:event.data.id, data:data});});}",s=new Blob([s],{type:"text/plain"}),i.webworker=new Worker(URL.createObjectURL(s)),i.webworker.onmessage=function(r){var e=r.data.id;i.buffer[e](r.data.data),delete i.buffer[e]},i.webworker.onerror=function(r){throw r},1<arguments.length&&i("REQUIRE "+e.map(function(r){return'"'+r+'"'}).join(","),[],t)):!1===r&&delete i.webworker}),i.lastid=0,i.buffer={},i.worker(),i});

package/dist/alasql.fs.js

@@ -1,7 +1,7 @@
-//! AlaSQL v1.7.4-develop-89075a50undefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v1.7.6 | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 /*
 @module alasql
-@version 1.7.4-develop-89075a50undefined
+@version 1.7.6
 
 AlaSQL - JavaScript SQL database
 © 2014-2016	Andrey Gershun & Mathias Rangel Wulff
@@ -142,7 +142,7 @@ var alasql = function(sql, params, cb, scope) {
 	Current version of alasql 
  	@constant {string} 
 */
-alasql.version = '1.7.4-develop-89075a50undefined';
+alasql.version = '1.7.6';
 
 /**
 	Debug flag
@@ -4027,11 +4027,11 @@ var cloneDeep = (utils.cloneDeep = function cloneDeep(obj) {
 		return +obj;
 	}
 
-	var temp = obj.constructor(); // changed
+	var temp = (Object.prototype.hasOwnProperty.call(obj, 'constructor') ? Object : obj.constructor)(); // changed
 
 	for (var key in obj) {
 		if (obj.hasOwnProperty(key)) {
-			temp[key] = cloneDeep(obj[key]);
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(temp, key, {value: cloneDeep(obj[key]), writable: true, enumerable: true, configurable: true}); } else { temp[key] = cloneDeep(obj[key]); }
 		}
 	}
 	return temp;
@@ -4103,7 +4103,7 @@ var extend = (utils.extend = function extend(a, b) {
 	a = a || {};
 	for (var key in b) {
 		if (b.hasOwnProperty(key)) {
-			a[key] = b[key];
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(a, key, {value: b[key], writable: true, enumerable: true, configurable: true}); } else { a[key] = b[key]; }
 		}
 	}
 	return a;
@@ -4328,6 +4328,12 @@ var getXLSX = function () {
 	return XLSX;
 };
 
+var jss = JSON.stringify;
+var reName = /[^a-z\d@-_]+/gi;
+var nss = (e) => e.replace(reName, '');
+var reTick = /`/g;
+var tss = (e) => e.replace(reTick, '');
+
 // set AlaSQl path
 alasql.path = alasql.utils.findAlaSQLPath();
 
@@ -6308,7 +6314,7 @@ yy.Search.prototype.toString = function () {
 
 yy.Search.prototype.toJS = function (context) {
 
-	var s = 'this.queriesfn[' + (this.queriesidx - 1) + '](this.params,null,' + context + ')';
+	var s = 'this.queriesfn[' + jss(this.queriesidx - 1) + '](this.params,null,' + jss(context) + ')';
 	// var s = '';
 	return s;
 };
@@ -6669,11 +6675,11 @@ alasql.srch.SET = function (val, args, stope, params) {
 		.map(function (st) {
 
 			if (st.method === '@') {
-				return "alasql.vars['" + st.variable + "']=" + st.expression.toJS('x', '');
+				return 'alasql.vars[' + jss(st.variable) + ']=' + st.expression.toJS('x', '');
 			} else if (st.method === '$') {
-				return "params['" + st.variable + "']=" + st.expression.toJS('x', '');
+				return 'params[' + jss(st.variable) + ']=' + st.expression.toJS('x', '');
 			} else {
-				return "x['" + st.column.columnid + "']=" + st.expression.toJS('x', '');
+				return 'x[' + jss(st.column.columnid) + ']=' + st.expression.toJS('x', '');
 			}
 		})
 		.join(';');
@@ -6760,17 +6766,26 @@ var compileSearchOrder = function (order) {
 					s += 'if(a' + dg + '==b' + dg + '){';
 				} else {
 					s +=
-						"if((a['" +
-						columnid +
-						"']||'')" +
+						'if((a[' +
+						jss(columnid) +
+						"]||'')" +
 						dg +
 						(ord.direction === 'ASC' ? '>' : '<') +
-						"(b['" +
-						columnid +
-						"']||'')" +
+						'(b[' +
+						jss(columnid) +
+						"]||'')" +
 						dg +
 						')return 1;';
-					s += "if((a['" + columnid + "']||'')" + dg + "==(b['" + columnid + "']||'')" + dg + '){';
+					s +=
+						'if((a[' +
+						jss(columnid) +
+						"]||'')" +
+						dg +
+						'==(b[' +
+						jss(columnid) +
+						"]||'')" +
+						dg +
+						'){';
 				}
 			} else {
 				dg = '.valueOf()';
@@ -9061,7 +9076,7 @@ yy.Select.prototype.compileGroup = function (query) {
 			aft2 = '';
 
 		if (typeof query.groupStar !== 'undefined') {
-			aft2 += "for(var f in p['" + query.groupStar + "']) {g[f]=p['" + query.groupStar + "'][f];};";
+			aft2 += "for(var f in p['" + query.groupStar + "']) {if(/^__proto__$/.test(f))Object.defineProperty(g,f,{writable:true,enumerable:true,configurable:true});g[f]=p['" + query.groupStar + "'][f];};";
 		}
 
 		/*
@@ -9334,9 +9349,10 @@ function compileSelectStar(query, aliases, joinstar) {
 
 		if (columns && columns.length > 0) {
 			columns.forEach(function (tcol) {
+				var escapedColumnId = escapeq(tcol.columnid);
 				if (joinstar && alasql.options.joinstar == 'underscore') {
 					ss.push(
-						"'" + alias + '_' + tcol.columnid + "':p['" + alias + "']['" + tcol.columnid + "']"
+						"'" + alias + '_' + escapedColumnId + "':p['" + alias + "']['" + escapedColumnId + "']"
 					);
 				} else if (joinstar && alasql.options.joinstar == 'json') {
 					//				ss.push('\''+alias+'_'+tcol.columnid+'\':p[\''+alias+'\'][\''+tcol.columnid+'\']');
@@ -9344,16 +9360,16 @@ function compileSelectStar(query, aliases, joinstar) {
 						"r['" +
 						alias +
 						"']['" +
-						tcol.columnid +
+						escapedColumnId +
 						"']=p['" +
 						alias +
 						"']['" +
-						tcol.columnid +
+						escapedColumnId +
 						"'];";
 				} else {
-					var value = "p['" + alias + "']['" + tcol.columnid + "']";
+					var value = "p['" + alias + "']['" + escapedColumnId + "']";
 					if (!columnIds[tcol.columnid]) {
-						var key = "'" + tcol.columnid + "':";
+						var key = "'" + escapedColumnId + "':";
 						ss.push(key + value);
 						columnIds[tcol.columnid] = {
 							id: ss.length - 1,
@@ -9384,7 +9400,7 @@ function compileSelectStar(query, aliases, joinstar) {
 		} else {
 
 			// if column not exist, then copy all
-			sp += 'var w=p["' + alias + '"];for(var k in w){r[k]=w[k]};';
+			sp += 'var w=p["' + alias + '"];for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 
 			query.dirtyColumns = true;
 		}
@@ -9392,7 +9408,7 @@ function compileSelectStar(query, aliases, joinstar) {
 
 	});
 
-	return {s: ss.join(','), sp: sp};
+	return { s: ss.join(','), sp: sp };
 }
 
 yy.Select.prototype.compileSelect1 = function (query, params) {
@@ -9443,14 +9459,14 @@ yy.Select.prototype.compileSelect1 = function (query, params) {
 					if (false && tbid && !query.defcols['.'][col.tableid] && !query.defcols[col.columnid]) {
 						ss.push(
 							"'" +
-								escapeq(col.as || col.columnid) +
-								"':p['" +
-								query.defaultTableid +
-								"']['" +
-								col.tableid +
-								"']['" +
-								col.columnid +
-								"']"
+							escapeq(col.as || col.columnid) +
+							"':p['" +
+							query.defaultTableid +
+							"']['" +
+							col.tableid +
+							"']['" +
+							col.columnid +
+							"']"
 						);
 					} else {
 						// workaround for multisheet xlsx export with custom COLUMNS
@@ -9485,12 +9501,12 @@ yy.Select.prototype.compileSelect1 = function (query, params) {
 						} else {
 							ss.push(
 								"'" +
-									escapeq(col.as || col.columnid) +
-									"':p['" +
-									tbid +
-									"']['" +
-									col.columnid +
-									"']"
+								escapeq(col.as || col.columnid) +
+								"':p['" +
+								tbid +
+								"']['" +
+								col.columnid +
+								"']"
 							);
 						}
 					}
@@ -9575,9 +9591,9 @@ yy.Select.prototype.compileSelect1 = function (query, params) {
 			) {
 				ss.push(
 					"'" +
-						escapeq(col.as) +
-						"':" +
-						n2u(col.expression.toJS('p', query.defaultTableid, query.defcols))
+					escapeq(col.as) +
+					"':" +
+					n2u(col.expression.toJS('p', query.defaultTableid, query.defcols))
 				);
 			} else if (col.aggregatorid === 'COUNT') {
 				ss.push("'" + escapeq(col.as) + "':1");
@@ -9607,9 +9623,9 @@ yy.Select.prototype.compileSelect1 = function (query, params) {
 
 			ss.push(
 				"'" +
-					escapeq(col.as || col.columnid || col.toString()) +
-					"':" +
-					n2u(col.toJS('p', query.defaultTableid, query.defcols))
+				escapeq(col.as || col.columnid || col.toString()) +
+				"':" +
+				n2u(col.toJS('p', query.defaultTableid, query.defcols))
 			);
 			//			ss.push('\''+escapeq(col.toString())+'\':'+col.toJS("p",query.defaultTableid));
 			//if(col instanceof yy.Expression) {
@@ -9713,10 +9729,10 @@ yy.Select.prototype.compileSelectGroup1 = function (query) {
 	self.columns.forEach(function (col) {
 
 		if (col instanceof yy.Column && col.columnid === '*') {
-			//			s += 'for(var k in g){r[k]=g[k]};';
+			//			s += 'for(var k in g){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			//			s += 'for(var k in this.query.groupColumns){r[k]=g[this.query.groupColumns[k]]};';
 
-			s += 'for(var k in g) {r[k]=g[k]};';
+			s += 'for(var k in g) {if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			return '';
 
 		} else {
@@ -10462,8 +10478,8 @@ yy.Over.prototype.toString = function () {
 */
 
 /**
-  	Expression statement ( = 2*2; )
-  	@class
+		Expression statement ( = 2*2; )
+		@class
 	@param {object} params Initial parameters
 */
 yy.ExpressionStatement = function (params) {
@@ -10838,7 +10854,7 @@ yy.Op.prototype.toJS = function (context, tableid, defcols) {
 		var ljs = '(' + leftJS() + '||{})';
 
 		if (typeof this.right === 'string') {
-			s = ljs + '["' + this.right + '"]';
+			s = ljs + '["' + escapeq(this.right) + '"]';
 		} else if (typeof this.right === 'number') {
 			s = ljs + '[' + this.right + ']';
 		} else if (this.right instanceof yy.FuncValue) {
@@ -11069,7 +11085,7 @@ yy.VarValue.prototype.toType = function () {
 };
 
 yy.VarValue.prototype.toJS = function () {
-	return "alasql.vars['" + this.variable + "']";
+	return "alasql.vars['" + escapeq(this.variable) + "']";
 };
 
 yy.NumValue = function (params) {
@@ -11463,7 +11479,7 @@ yy.AggrValue.prototype.toJS = function (/*context, tableid, defcols*/) {
 
 	var colas = this.nick;
 	if (colas === undefined) {
-		colas = this.toString();
+		colas = escapeq(this.toString());
 	}
 	return "g['" + colas + "']";
 };
@@ -13033,7 +13049,7 @@ yy.CreateTable.prototype.execute = function (databaseid, params, cb) {
 
 			table.update(
 				function (t) {
-					for (var f in r) t[f] = r[f];
+					for (var f in r) {if(/^__proto__$/.test(f))Object.defineProperty(t,f,{writable:true,enumerable:true,configurable:true});t[f] = r[f];}
 				},
 				table.data.indexOf(toreplace),
 				params
@@ -14579,7 +14595,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 					});
 				} else {
 
-					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){r[k]=w[k]};';
+					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 					sw = JSONtoJS(values);
 				}
 			}
@@ -17175,8 +17191,7 @@ alasql.into.XLSX = function (filename, opts, data, columns, cb) {
 			var colm = 1,
 				rowm = 1;
 		}
-		var zeroColumnFix = columns.length ? 0 : 1;
-		var colmax = Math.max(col0 + columns.length - 1 + zeroColumnFix, colm);
+		var colmax = Math.max(col0 + columns.length, colm);
 		var rowmax = Math.max(row0 + dataLength + 2, rowm);
 
 		var i = row0 + 1;
@@ -18765,6 +18780,7 @@ LS.dropDatabase = function (lsdbid, ifexists, cb) {
 
 LS.attachDatabase = function (lsdbid, databaseid, args, params, cb) {
 	var res = 1;
+	//	console.warn({lsdbid, databaseid, args, params, cb, dbs: Object.keys(alasql.databases)})
 	if (alasql.databases[databaseid]) {
 		throw new Error('Unable to attach database as "' + databaseid + '" because it already exists');
 	}