alasql 1.7.4 → 1.7.6

package/dist/alasql.js

@@ -1,7 +1,7 @@
-//! AlaSQL v1.7.4-develop-89075a50undefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v1.7.6 | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 /*
 @module alasql
-@version 1.7.4-develop-89075a50undefined
+@version 1.7.6
 
 AlaSQL - JavaScript SQL database
 © 2014-2016	Andrey Gershun & Mathias Rangel Wulff
@@ -142,7 +142,7 @@ var alasql = function(sql, params, cb, scope) {
 	Current version of alasql 
  	@constant {string} 
 */
-alasql.version = '1.7.4-develop-89075a50undefined';
+alasql.version = '1.7.6';
 
 /**
 	Debug flag
@@ -4022,11 +4022,11 @@ var cloneDeep = (utils.cloneDeep = function cloneDeep(obj) {
 		return +obj;
 	}
 
-	var temp = obj.constructor(); // changed
+	var temp = (Object.prototype.hasOwnProperty.call(obj, 'constructor') ? Object : obj.constructor)(); // changed
 
 	for (var key in obj) {
 		if (obj.hasOwnProperty(key)) {
-			temp[key] = cloneDeep(obj[key]);
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(temp, key, {value: cloneDeep(obj[key]), writable: true, enumerable: true, configurable: true}); } else { temp[key] = cloneDeep(obj[key]); }
 		}
 	}
 	return temp;
@@ -4098,7 +4098,7 @@ var extend = (utils.extend = function extend(a, b) {
 	a = a || {};
 	for (var key in b) {
 		if (b.hasOwnProperty(key)) {
-			a[key] = b[key];
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(a, key, {value: b[key], writable: true, enumerable: true, configurable: true}); } else { a[key] = b[key]; }
 		}
 	}
 	return a;
@@ -4323,6 +4323,12 @@ var getXLSX = function () {
 	return XLSX;
 };
 
+var jss = JSON.stringify;
+var reName = /[^a-z\d@-_]+/gi;
+var nss = (e) => e.replace(reName, '');
+var reTick = /`/g;
+var tss = (e) => e.replace(reTick, '');
+
 // set AlaSQl path
 alasql.path = alasql.utils.findAlaSQLPath();
 
@@ -6303,7 +6309,7 @@ yy.Search.prototype.toString = function () {
 
 yy.Search.prototype.toJS = function (context) {
 
-	var s = 'this.queriesfn[' + (this.queriesidx - 1) + '](this.params,null,' + context + ')';
+	var s = 'this.queriesfn[' + jss(this.queriesidx - 1) + '](this.params,null,' + jss(context) + ')';
 	// var s = '';
 	return s;
 };
@@ -6664,11 +6670,11 @@ alasql.srch.SET = function (val, args, stope, params) {
 		.map(function (st) {
 
 			if (st.method === '@') {
-				return "alasql.vars['" + st.variable + "']=" + st.expression.toJS('x', '');
+				return 'alasql.vars[' + jss(st.variable) + ']=' + st.expression.toJS('x', '');
 			} else if (st.method === '$') {
-				return "params['" + st.variable + "']=" + st.expression.toJS('x', '');
+				return 'params[' + jss(st.variable) + ']=' + st.expression.toJS('x', '');
 			} else {
-				return "x['" + st.column.columnid + "']=" + st.expression.toJS('x', '');
+				return 'x[' + jss(st.column.columnid) + ']=' + st.expression.toJS('x', '');
 			}
 		})
 		.join(';');
@@ -6755,17 +6761,26 @@ var compileSearchOrder = function (order) {
 					s += 'if(a' + dg + '==b' + dg + '){';
 				} else {
 					s +=
-						"if((a['" +
-						columnid +
-						"']||'')" +
+						'if((a[' +
+						jss(columnid) +
+						"]||'')" +
 						dg +
 						(ord.direction === 'ASC' ? '>' : '<') +
-						"(b['" +
-						columnid +
-						"']||'')" +
+						'(b[' +
+						jss(columnid) +
+						"]||'')" +
 						dg +
 						')return 1;';
-					s += "if((a['" + columnid + "']||'')" + dg + "==(b['" + columnid + "']||'')" + dg + '){';
+					s +=
+						'if((a[' +
+						jss(columnid) +
+						"]||'')" +
+						dg +
+						'==(b[' +
+						jss(columnid) +
+						"]||'')" +
+						dg +
+						'){';
 				}
 			} else {
 				dg = '.valueOf()';
@@ -9056,7 +9071,7 @@ yy.Select.prototype.compileGroup = function (query) {
 			aft2 = '';
 
 		if (typeof query.groupStar !== 'undefined') {
-			aft2 += "for(var f in p['" + query.groupStar + "']) {g[f]=p['" + query.groupStar + "'][f];};";
+			aft2 += "for(var f in p['" + query.groupStar + "']) {if(/^__proto__$/.test(f))Object.defineProperty(g,f,{writable:true,enumerable:true,configurable:true});g[f]=p['" + query.groupStar + "'][f];};";
 		}
 
 		/*
@@ -9329,9 +9344,10 @@ function compileSelectStar(query, aliases, joinstar) {
 
 		if (columns && columns.length > 0) {
 			columns.forEach(function (tcol) {
+				var escapedColumnId = escapeq(tcol.columnid);
 				if (joinstar && alasql.options.joinstar == 'underscore') {
 					ss.push(
-						"'" + alias + '_' + tcol.columnid + "':p['" + alias + "']['" + tcol.columnid + "']"
+						"'" + alias + '_' + escapedColumnId + "':p['" + alias + "']['" + escapedColumnId + "']"
 					);
 				} else if (joinstar && alasql.options.joinstar == 'json') {
 					//				ss.push('\''+alias+'_'+tcol.columnid+'\':p[\''+alias+'\'][\''+tcol.columnid+'\']');
@@ -9339,16 +9355,16 @@ function compileSelectStar(query, aliases, joinstar) {
 						"r['" +
 						alias +
 						"']['" +
-						tcol.columnid +
+						escapedColumnId +
 						"']=p['" +
 						alias +
 						"']['" +
-						tcol.columnid +
+						escapedColumnId +
 						"'];";
 				} else {
-					var value = "p['" + alias + "']['" + tcol.columnid + "']";
+					var value = "p['" + alias + "']['" + escapedColumnId + "']";
 					if (!columnIds[tcol.columnid]) {
-						var key = "'" + tcol.columnid + "':";
+						var key = "'" + escapedColumnId + "':";
 						ss.push(key + value);
 						columnIds[tcol.columnid] = {
 							id: ss.length - 1,
@@ -9379,7 +9395,7 @@ function compileSelectStar(query, aliases, joinstar) {
 		} else {
 
 			// if column not exist, then copy all
-			sp += 'var w=p["' + alias + '"];for(var k in w){r[k]=w[k]};';
+			sp += 'var w=p["' + alias + '"];for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 
 			query.dirtyColumns = true;
 		}
@@ -9387,7 +9403,7 @@ function compileSelectStar(query, aliases, joinstar) {
 
 	});
 
-	return {s: ss.join(','), sp: sp};
+	return { s: ss.join(','), sp: sp };
 }
 
 yy.Select.prototype.compileSelect1 = function (query, params) {
@@ -9438,14 +9454,14 @@ yy.Select.prototype.compileSelect1 = function (query, params) {
 					if (false && tbid && !query.defcols['.'][col.tableid] && !query.defcols[col.columnid]) {
 						ss.push(
 							"'" +
-								escapeq(col.as || col.columnid) +
-								"':p['" +
-								query.defaultTableid +
-								"']['" +
-								col.tableid +
-								"']['" +
-								col.columnid +
-								"']"
+							escapeq(col.as || col.columnid) +
+							"':p['" +
+							query.defaultTableid +
+							"']['" +
+							col.tableid +
+							"']['" +
+							col.columnid +
+							"']"
 						);
 					} else {
 						// workaround for multisheet xlsx export with custom COLUMNS
@@ -9480,12 +9496,12 @@ yy.Select.prototype.compileSelect1 = function (query, params) {
 						} else {
 							ss.push(
 								"'" +
-									escapeq(col.as || col.columnid) +
-									"':p['" +
-									tbid +
-									"']['" +
-									col.columnid +
-									"']"
+								escapeq(col.as || col.columnid) +
+								"':p['" +
+								tbid +
+								"']['" +
+								col.columnid +
+								"']"
 							);
 						}
 					}
@@ -9570,9 +9586,9 @@ yy.Select.prototype.compileSelect1 = function (query, params) {
 			) {
 				ss.push(
 					"'" +
-						escapeq(col.as) +
-						"':" +
-						n2u(col.expression.toJS('p', query.defaultTableid, query.defcols))
+					escapeq(col.as) +
+					"':" +
+					n2u(col.expression.toJS('p', query.defaultTableid, query.defcols))
 				);
 			} else if (col.aggregatorid === 'COUNT') {
 				ss.push("'" + escapeq(col.as) + "':1");
@@ -9602,9 +9618,9 @@ yy.Select.prototype.compileSelect1 = function (query, params) {
 
 			ss.push(
 				"'" +
-					escapeq(col.as || col.columnid || col.toString()) +
-					"':" +
-					n2u(col.toJS('p', query.defaultTableid, query.defcols))
+				escapeq(col.as || col.columnid || col.toString()) +
+				"':" +
+				n2u(col.toJS('p', query.defaultTableid, query.defcols))
 			);
 			//			ss.push('\''+escapeq(col.toString())+'\':'+col.toJS("p",query.defaultTableid));
 			//if(col instanceof yy.Expression) {
@@ -9708,10 +9724,10 @@ yy.Select.prototype.compileSelectGroup1 = function (query) {
 	self.columns.forEach(function (col) {
 
 		if (col instanceof yy.Column && col.columnid === '*') {
-			//			s += 'for(var k in g){r[k]=g[k]};';
+			//			s += 'for(var k in g){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			//			s += 'for(var k in this.query.groupColumns){r[k]=g[this.query.groupColumns[k]]};';
 
-			s += 'for(var k in g) {r[k]=g[k]};';
+			s += 'for(var k in g) {if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			return '';
 
 		} else {
@@ -10457,8 +10473,8 @@ yy.Over.prototype.toString = function () {
 */
 
 /**
-  	Expression statement ( = 2*2; )
-  	@class
+		Expression statement ( = 2*2; )
+		@class
 	@param {object} params Initial parameters
 */
 yy.ExpressionStatement = function (params) {
@@ -10833,7 +10849,7 @@ yy.Op.prototype.toJS = function (context, tableid, defcols) {
 		var ljs = '(' + leftJS() + '||{})';
 
 		if (typeof this.right === 'string') {
-			s = ljs + '["' + this.right + '"]';
+			s = ljs + '["' + escapeq(this.right) + '"]';
 		} else if (typeof this.right === 'number') {
 			s = ljs + '[' + this.right + ']';
 		} else if (this.right instanceof yy.FuncValue) {
@@ -11064,7 +11080,7 @@ yy.VarValue.prototype.toType = function () {
 };
 
 yy.VarValue.prototype.toJS = function () {
-	return "alasql.vars['" + this.variable + "']";
+	return "alasql.vars['" + escapeq(this.variable) + "']";
 };
 
 yy.NumValue = function (params) {
@@ -11458,7 +11474,7 @@ yy.AggrValue.prototype.toJS = function (/*context, tableid, defcols*/) {
 
 	var colas = this.nick;
 	if (colas === undefined) {
-		colas = this.toString();
+		colas = escapeq(this.toString());
 	}
 	return "g['" + colas + "']";
 };
@@ -13028,7 +13044,7 @@ yy.CreateTable.prototype.execute = function (databaseid, params, cb) {
 
 			table.update(
 				function (t) {
-					for (var f in r) t[f] = r[f];
+					for (var f in r) {if(/^__proto__$/.test(f))Object.defineProperty(t,f,{writable:true,enumerable:true,configurable:true});t[f] = r[f];}
 				},
 				table.data.indexOf(toreplace),
 				params
@@ -14574,7 +14590,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 					});
 				} else {
 
-					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){r[k]=w[k]};';
+					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 					sw = JSONtoJS(values);
 				}
 			}
@@ -17170,8 +17186,7 @@ alasql.into.XLSX = function (filename, opts, data, columns, cb) {
 			var colm = 1,
 				rowm = 1;
 		}
-		var zeroColumnFix = columns.length ? 0 : 1;
-		var colmax = Math.max(col0 + columns.length - 1 + zeroColumnFix, colm);
+		var colmax = Math.max(col0 + columns.length, colm);
 		var rowmax = Math.max(row0 + dataLength + 2, rowm);
 
 		var i = row0 + 1;
@@ -18760,6 +18775,7 @@ LS.dropDatabase = function (lsdbid, ifexists, cb) {
 
 LS.attachDatabase = function (lsdbid, databaseid, args, params, cb) {
 	var res = 1;
+	//	console.warn({lsdbid, databaseid, args, params, cb, dbs: Object.keys(alasql.databases)})
 	if (alasql.databases[databaseid]) {
 		throw new Error('Unable to attach database as "' + databaseid + '" because it already exists');
 	}