alasql 4.1.10 → 4.1.12

package/bin/alasql-cli.js

@@ -2,7 +2,7 @@
 
 //
 // Command line interface for Alasql
-// Version: 0.2.3
+// Version: 4.1.12
 // Date: 28.07.2015
 // (c) 2014-2022, Andrey Gershun & Mathias Wulff
 //

package/dist/alasql-worker.js

@@ -1,7 +1,7 @@
-//! AlaSQL v4.1.9 build: develop-a3395d54 | © 2014-2023 Andrey Gershun & Mathias Wulff | License: MIT
+//! AlaSQL v4.1.12 build: develop-1493d57a | © 2014-2023 Andrey Gershun & Mathias Wulff | License: MIT
 /*
 @module alasql
-@version 4.1.9
+@version 4.1.12
 
 AlaSQL - JavaScript SQL database
 © 2014-2023	Andrey Gershun & Mathias Wulff

package/dist/alasql.fs.js

@@ -1,7 +1,7 @@
-//! AlaSQL v4.1.9 build: develop-a3395d54 | © 2014-2023 Andrey Gershun & Mathias Wulff | License: MIT
+//! AlaSQL v4.1.12 build: develop-1493d57a | © 2014-2023 Andrey Gershun & Mathias Wulff | License: MIT
 /*
 @module alasql
-@version 4.1.9
+@version 4.1.12
 
 AlaSQL - JavaScript SQL database
 © 2014-2023	Andrey Gershun & Mathias Wulff
@@ -141,8 +141,8 @@ var alasql = function(sql, params, cb, scope) {
 	Current version of alasql 
  	@constant {string} 
 */
-alasql.version = '4.1.9';
-alasql.build = 'develop-a3395d54';
+alasql.version = '4.1.12';
+alasql.build = 'develop-1493d57a';
 
 /**
 	Debug flag
@@ -4019,11 +4019,11 @@ var cloneDeep = (utils.cloneDeep = function cloneDeep(obj) {
 		return +obj;
 	}
 
-	var temp = new obj.constructor(); // changed
+	var temp = new (Object.prototype.hasOwnProperty.call(obj, 'constructor') ? Object : obj.constructor)(); // changed
 
 	for (var key in obj) {
 		if (obj.hasOwnProperty(key)) {
-			temp[key] = cloneDeep(obj[key]);
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(temp, key, {value: cloneDeep(obj[key]), writable: true, enumerable: true, configurable: true}); } else { temp[key] = cloneDeep(obj[key]); }
 		}
 	}
 	return temp;
@@ -4095,7 +4095,7 @@ var extend = (utils.extend = function extend(a, b) {
 	a = a || {};
 	for (var key in b) {
 		if (b.hasOwnProperty(key)) {
-			a[key] = b[key];
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(a, key, {value: b[key], writable: true, enumerable: true, configurable: true}); } else { a[key] = b[key]; }
 		}
 	}
 	return a;
@@ -6613,9 +6613,8 @@ function queryfn3(query) {
 				var d = query.selectgfn(g, query.params, alasql);
 
 				for (const key in query.groupColumns) {
-					if (query.groupColumns[key] !== key
-						&& d[query.groupColumns[key]])
-						delete d[query.groupColumns[key]]
+					if (query.groupColumns[key] !== key && d[query.groupColumns[key]])
+						delete d[query.groupColumns[key]];
 				}
 				query.data.push(d);
 			}
@@ -6883,7 +6882,7 @@ var preIndex = function (query) {
 				// Check if index already exists
 				var ixx =
 					alasql.databases[source.databaseid].tables[source.tableid].indices[
-					hash(source.onrightfns + '`' + source.srcwherefns)
+						hash(source.onrightfns + '`' + source.srcwherefns)
 					];
 				if (!alasql.databases[source.databaseid].tables[source.tableid].dirty && ixx) {
 					source.ix = ixx;
@@ -6938,7 +6937,7 @@ var preIndex = function (query) {
 				// Check if index exists
 				ixx =
 					alasql.databases[source.databaseid].tables[source.tableid].indices[
-					hash(source.wxleftfns + '`')
+						hash(source.wxleftfns + '`')
 					];
 			}
 			if (!alasql.databases[source.databaseid].tables[source.tableid].dirty && ixx) {
@@ -8681,7 +8680,7 @@ yy.Select.prototype.compileGroup = function (query) {
 			aft2 = '';
 
 		if (typeof query.groupStar !== 'undefined') {
-			aft2 += "for(var f in p['" + query.groupStar + "']) {g[f]=p['" + query.groupStar + "'][f];};";
+			aft2 += "for(var f in p['" + query.groupStar + "']) {if(/^__proto__$/.test(f))Object.defineProperty(g,f,{writable:true,enumerable:true,configurable:true});g[f]=p['" + query.groupStar + "'][f];};";
 		}
 
 		/*
@@ -9073,9 +9072,10 @@ function compileSelectStar(query, aliases, joinstar) {
 
 		if (columns && columns.length > 0) {
 			columns.forEach(function (tcol) {
+				const escapedColumnId = escapeq(tcol.columnid);
 				if (joinstar && alasql.options.joinstar == 'underscore') {
 					ss.push(
-						"'" + alias + '_' + tcol.columnid + "':p['" + alias + "']['" + tcol.columnid + "']"
+						"'" + alias + '_' + escapedColumnId + "':p['" + alias + "']['" + escapedColumnId + "']"
 					);
 				} else if (joinstar && alasql.options.joinstar == 'json') {
 					//				ss.push('\''+alias+'_'+tcol.columnid+'\':p[\''+alias+'\'][\''+tcol.columnid+'\']');
@@ -9083,16 +9083,16 @@ function compileSelectStar(query, aliases, joinstar) {
 						"r['" +
 						alias +
 						"']['" +
-						tcol.columnid +
+						escapedColumnId +
 						"']=p['" +
 						alias +
 						"']['" +
-						tcol.columnid +
+						escapedColumnId +
 						"'];";
 				} else {
-					var value = "p['" + alias + "']['" + tcol.columnid + "']";
+					var value = "p['" + alias + "']['" + escapedColumnId + "']";
 					if (!columnIds[tcol.columnid]) {
-						var key = "'" + tcol.columnid + "':";
+						var key = "'" + escapedColumnId + "':";
 						ss.push(key + value);
 						columnIds[tcol.columnid] = {
 							id: ss.length - 1,
@@ -9107,7 +9107,7 @@ function compileSelectStar(query, aliases, joinstar) {
 					}
 				}
 
-				query.selectColumns[escapeq(tcol.columnid)] = true;
+				query.selectColumns[escapedColumnId] = true;
 
 				var coldef = {
 					columnid: tcol.columnid,
@@ -9123,7 +9123,7 @@ function compileSelectStar(query, aliases, joinstar) {
 		} else {
 
 			// if column not exist, then copy all
-			sp += 'var w=p["' + alias + '"];for(var k in w){r[k]=w[k]};';
+			sp += 'var w=p["' + alias + '"];for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 
 			query.dirtyColumns = true;
 		}
@@ -9451,10 +9451,10 @@ yy.Select.prototype.compileSelectGroup1 = function (query) {
 	self.columns.forEach(function (col) {
 
 		if (col instanceof yy.Column && col.columnid === '*') {
-			//			s += 'for(var k in g){r[k]=g[k]};';
+			//			s += 'for(var k in g){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			//			s += 'for(var k in this.query.groupColumns){r[k]=g[this.query.groupColumns[k]]};';
 
-			s += 'for(var k in g) {r[k]=g[k]};';
+			s += 'for(var k in g) {if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			return '';
 
 		} else {
@@ -10574,7 +10574,7 @@ yy.Over = class Over {
 				var ljs = '(' + leftJS() + '||{})';
 
 				if (typeof this.right === 'string') {
-					s = ljs + '["' + this.right + '"]';
+					s = ljs + '["' + escapeq(this.right) + '"]';
 				} else if (typeof this.right === 'number') {
 					s = ljs + '[' + this.right + ']';
 				} else if (this.right instanceof yy.FuncValue) {
@@ -10813,7 +10813,7 @@ yy.Over = class Over {
 		}
 
 		toJS() {
-			return "alasql.vars['" + this.variable + "']";
+			return "alasql.vars['" + escapeq(this.variable) + "']";
 		}
 	}
 
@@ -11202,7 +11202,7 @@ yy.Over = class Over {
 		toJS() {
 			var colas = this.nick;
 			if (colas === undefined) {
-				colas = this.toString();
+				colas = escapeq(this.toString());
 			}
 			return "g['" + colas + "']";
 		}
@@ -12715,7 +12715,7 @@ yy.CreateTable.prototype.execute = function (databaseid, params, cb) {
 
 			table.update(
 				function (t) {
-					for (var f in r) t[f] = r[f];
+					for (var f in r) {if(/^__proto__$/.test(f))Object.defineProperty(t,f,{writable:true,enumerable:true,configurable:true});t[f] = r[f];}
 				},
 				table.data.indexOf(toreplace),
 				params
@@ -14268,7 +14268,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 					});
 				} else {
 
-					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){r[k]=w[k]};';
+					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 					sw = JSONtoJS(values);
 				}
 			}

package/dist/alasql.js

@@ -1,7 +1,7 @@
-//! AlaSQL v4.1.9 build: develop-a3395d54 | © 2014-2023 Andrey Gershun & Mathias Wulff | License: MIT
+//! AlaSQL v4.1.12 build: develop-1493d57a | © 2014-2023 Andrey Gershun & Mathias Wulff | License: MIT
 /*
 @module alasql
-@version 4.1.9
+@version 4.1.12
 
 AlaSQL - JavaScript SQL database
 © 2014-2023	Andrey Gershun & Mathias Wulff
@@ -141,8 +141,8 @@ var alasql = function(sql, params, cb, scope) {
 	Current version of alasql 
  	@constant {string} 
 */
-alasql.version = '4.1.9';
-alasql.build = 'develop-a3395d54';
+alasql.version = '4.1.12';
+alasql.build = 'develop-1493d57a';
 
 /**
 	Debug flag
@@ -4019,11 +4019,11 @@ var cloneDeep = (utils.cloneDeep = function cloneDeep(obj) {
 		return +obj;
 	}
 
-	var temp = new obj.constructor(); // changed
+	var temp = new (Object.prototype.hasOwnProperty.call(obj, 'constructor') ? Object : obj.constructor)(); // changed
 
 	for (var key in obj) {
 		if (obj.hasOwnProperty(key)) {
-			temp[key] = cloneDeep(obj[key]);
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(temp, key, {value: cloneDeep(obj[key]), writable: true, enumerable: true, configurable: true}); } else { temp[key] = cloneDeep(obj[key]); }
 		}
 	}
 	return temp;
@@ -4095,7 +4095,7 @@ var extend = (utils.extend = function extend(a, b) {
 	a = a || {};
 	for (var key in b) {
 		if (b.hasOwnProperty(key)) {
-			a[key] = b[key];
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(a, key, {value: b[key], writable: true, enumerable: true, configurable: true}); } else { a[key] = b[key]; }
 		}
 	}
 	return a;
@@ -6613,9 +6613,8 @@ function queryfn3(query) {
 				var d = query.selectgfn(g, query.params, alasql);
 
 				for (const key in query.groupColumns) {
-					if (query.groupColumns[key] !== key
-						&& d[query.groupColumns[key]])
-						delete d[query.groupColumns[key]]
+					if (query.groupColumns[key] !== key && d[query.groupColumns[key]])
+						delete d[query.groupColumns[key]];
 				}
 				query.data.push(d);
 			}
@@ -6883,7 +6882,7 @@ var preIndex = function (query) {
 				// Check if index already exists
 				var ixx =
 					alasql.databases[source.databaseid].tables[source.tableid].indices[
-					hash(source.onrightfns + '`' + source.srcwherefns)
+						hash(source.onrightfns + '`' + source.srcwherefns)
 					];
 				if (!alasql.databases[source.databaseid].tables[source.tableid].dirty && ixx) {
 					source.ix = ixx;
@@ -6938,7 +6937,7 @@ var preIndex = function (query) {
 				// Check if index exists
 				ixx =
 					alasql.databases[source.databaseid].tables[source.tableid].indices[
-					hash(source.wxleftfns + '`')
+						hash(source.wxleftfns + '`')
 					];
 			}
 			if (!alasql.databases[source.databaseid].tables[source.tableid].dirty && ixx) {
@@ -8681,7 +8680,7 @@ yy.Select.prototype.compileGroup = function (query) {
 			aft2 = '';
 
 		if (typeof query.groupStar !== 'undefined') {
-			aft2 += "for(var f in p['" + query.groupStar + "']) {g[f]=p['" + query.groupStar + "'][f];};";
+			aft2 += "for(var f in p['" + query.groupStar + "']) {if(/^__proto__$/.test(f))Object.defineProperty(g,f,{writable:true,enumerable:true,configurable:true});g[f]=p['" + query.groupStar + "'][f];};";
 		}
 
 		/*
@@ -9073,9 +9072,10 @@ function compileSelectStar(query, aliases, joinstar) {
 
 		if (columns && columns.length > 0) {
 			columns.forEach(function (tcol) {
+				const escapedColumnId = escapeq(tcol.columnid);
 				if (joinstar && alasql.options.joinstar == 'underscore') {
 					ss.push(
-						"'" + alias + '_' + tcol.columnid + "':p['" + alias + "']['" + tcol.columnid + "']"
+						"'" + alias + '_' + escapedColumnId + "':p['" + alias + "']['" + escapedColumnId + "']"
 					);
 				} else if (joinstar && alasql.options.joinstar == 'json') {
 					//				ss.push('\''+alias+'_'+tcol.columnid+'\':p[\''+alias+'\'][\''+tcol.columnid+'\']');
@@ -9083,16 +9083,16 @@ function compileSelectStar(query, aliases, joinstar) {
 						"r['" +
 						alias +
 						"']['" +
-						tcol.columnid +
+						escapedColumnId +
 						"']=p['" +
 						alias +
 						"']['" +
-						tcol.columnid +
+						escapedColumnId +
 						"'];";
 				} else {
-					var value = "p['" + alias + "']['" + tcol.columnid + "']";
+					var value = "p['" + alias + "']['" + escapedColumnId + "']";
 					if (!columnIds[tcol.columnid]) {
-						var key = "'" + tcol.columnid + "':";
+						var key = "'" + escapedColumnId + "':";
 						ss.push(key + value);
 						columnIds[tcol.columnid] = {
 							id: ss.length - 1,
@@ -9107,7 +9107,7 @@ function compileSelectStar(query, aliases, joinstar) {
 					}
 				}
 
-				query.selectColumns[escapeq(tcol.columnid)] = true;
+				query.selectColumns[escapedColumnId] = true;
 
 				var coldef = {
 					columnid: tcol.columnid,
@@ -9123,7 +9123,7 @@ function compileSelectStar(query, aliases, joinstar) {
 		} else {
 
 			// if column not exist, then copy all
-			sp += 'var w=p["' + alias + '"];for(var k in w){r[k]=w[k]};';
+			sp += 'var w=p["' + alias + '"];for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 
 			query.dirtyColumns = true;
 		}
@@ -9451,10 +9451,10 @@ yy.Select.prototype.compileSelectGroup1 = function (query) {
 	self.columns.forEach(function (col) {
 
 		if (col instanceof yy.Column && col.columnid === '*') {
-			//			s += 'for(var k in g){r[k]=g[k]};';
+			//			s += 'for(var k in g){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			//			s += 'for(var k in this.query.groupColumns){r[k]=g[this.query.groupColumns[k]]};';
 
-			s += 'for(var k in g) {r[k]=g[k]};';
+			s += 'for(var k in g) {if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			return '';
 
 		} else {
@@ -10574,7 +10574,7 @@ yy.Over = class Over {
 				var ljs = '(' + leftJS() + '||{})';
 
 				if (typeof this.right === 'string') {
-					s = ljs + '["' + this.right + '"]';
+					s = ljs + '["' + escapeq(this.right) + '"]';
 				} else if (typeof this.right === 'number') {
 					s = ljs + '[' + this.right + ']';
 				} else if (this.right instanceof yy.FuncValue) {
@@ -10813,7 +10813,7 @@ yy.Over = class Over {
 		}
 
 		toJS() {
-			return "alasql.vars['" + this.variable + "']";
+			return "alasql.vars['" + escapeq(this.variable) + "']";
 		}
 	}
 
@@ -11202,7 +11202,7 @@ yy.Over = class Over {
 		toJS() {
 			var colas = this.nick;
 			if (colas === undefined) {
-				colas = this.toString();
+				colas = escapeq(this.toString());
 			}
 			return "g['" + colas + "']";
 		}
@@ -12715,7 +12715,7 @@ yy.CreateTable.prototype.execute = function (databaseid, params, cb) {
 
 			table.update(
 				function (t) {
-					for (var f in r) t[f] = r[f];
+					for (var f in r) {if(/^__proto__$/.test(f))Object.defineProperty(t,f,{writable:true,enumerable:true,configurable:true});t[f] = r[f];}
 				},
 				table.data.indexOf(toreplace),
 				params
@@ -14268,7 +14268,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 					});
 				} else {
 
-					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){r[k]=w[k]};';
+					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 					sw = JSONtoJS(values);
 				}
 			}