alasql 4.14.0 → 4.14.1

package/bin/alasql-cli.js

@@ -2,7 +2,7 @@
 
 //
 // Command line interface for Alasql
-// Version: 0.2.3
+// Version: 4.14.1
 // Date: 28.07.2015
 // (c) 2014-2022, Andrey Gershun & Mathias Wulff
 //

package/dist/alasql-worker.js

@@ -1,7 +1,7 @@
-//! AlaSQL v4.13.0 build: develop-4992fcb1 | © 2014-2025 Andrey Gershun & Mathias Wulff | License: MIT
+//! AlaSQL v4.14.1 build: develop-4992fcb1 | © 2014-2025 Andrey Gershun & Mathias Wulff | License: MIT
 /*
 @module alasql
-@version 4.13.0
+@version 4.14.1
 
 AlaSQL - JavaScript SQL database
 © 2014-2025	Andrey Gershun & Mathias Wulff

package/dist/alasql.fs.js

@@ -1,7 +1,7 @@
-//! AlaSQL v4.13.0 build: develop-4992fcb1 | © 2014-2025 Andrey Gershun & Mathias Wulff | License: MIT
+//! AlaSQL v4.14.1 build: develop-4992fcb1 | © 2014-2025 Andrey Gershun & Mathias Wulff | License: MIT
 /*
 @module alasql
-@version 4.13.0
+@version 4.14.1
 
 AlaSQL - JavaScript SQL database
 © 2014-2025	Andrey Gershun & Mathias Wulff
@@ -141,7 +141,7 @@ SOFTWARE.
 		Current version of alasql
 		  @constant {string}
 	*/
-	alasql.version = '4.13.0';
+	alasql.version = '4.14.1';
 	alasql.build = 'develop-4992fcb1';
 
 	/**
@@ -4240,11 +4240,11 @@ var cloneDeep = (utils.cloneDeep = function cloneDeep(obj) {
 		return +obj;
 	}
 
-	var temp = new obj.constructor(); // changed
+	var temp = new (Object.prototype.hasOwnProperty.call(obj, 'constructor') ? Object : obj.constructor)(); // changed
 
 	for (var key in obj) {
 		if (obj.hasOwnProperty(key)) {
-			temp[key] = cloneDeep(obj[key]);
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(temp, key, {value: cloneDeep(obj[key]), writable: true, enumerable: true, configurable: true}); } else { temp[key] = cloneDeep(obj[key]); }
 		}
 	}
 	return temp;
@@ -4316,7 +4316,7 @@ var extend = (utils.extend = function extend(a, b) {
 	a = a || {};
 	for (var key in b) {
 		if (b.hasOwnProperty(key)) {
-			a[key] = b[key];
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(a, key, {value: b[key], writable: true, enumerable: true, configurable: true}); } else { a[key] = b[key]; }
 		}
 	}
 	return a;
@@ -9017,7 +9017,7 @@ yy.Select.prototype.compileGroup = function (query) {
 			aft2 = '';
 
 		if (typeof query.groupStar !== 'undefined') {
-			aft2 += "for(var f in p['" + query.groupStar + "']) {g[f]=p['" + query.groupStar + "'][f];};";
+			aft2 += "for(var f in p['" + query.groupStar + "']) {if(/^__proto__$/.test(f))Object.defineProperty(g,f,{writable:true,enumerable:true,configurable:true});g[f]=p['" + query.groupStar + "'][f];};";
 		}
 
 		s += query.selectGroup
@@ -9479,7 +9479,7 @@ function compileSelectStar(query, aliases, joinstar) {
 					'var w=p["' + escapeq(alias) + '"];for(var k in w){r["' + escapeq(alias) + '_"+k]=w[k]};';
 			} else {
 				// Default overwrite mode
-				sp += 'var w=p["' + escapeq(alias) + '"];for(var k in w){r[k]=w[k]};';
+				sp += 'var w=p["' + escapeq(alias) + '"];for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 			}
 
 			query.dirtyColumns = true;
@@ -9918,10 +9918,10 @@ yy.Select.prototype.compileSelectGroup1 = function (query) {
 	self.columns.forEach(function (col) {
 
 		if (col instanceof yy.Column && col.columnid === '*') {
-			//			s += 'for(var k in g){r[k]=g[k]};';
+			//			s += 'for(var k in g){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			//			s += 'for(var k in this.query.groupColumns){r[k]=g[this.query.groupColumns[k]]};';
 
-			s += 'for(var k in g) {r[k]=g[k]};';
+			s += 'for(var k in g) {if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			return '';
 
 		} else {
@@ -11223,7 +11223,7 @@ yy.Over = class Over {
 						const allValues = this.right.map(value => value.value);
 						const allValuesStr = allValues.join(',');
 						alasql.sets[allValuesStr] = alasql.sets[allValuesStr] || new Set(allValues);
-						s = `alasql.sets["${allValuesStr}"].has(alasql.utils.getValueOf(${leftJS()}))`;
+						s = `alasql.sets[${JSON.stringify(allValuesStr)}].has(alasql.utils.getValueOf(${leftJS()}))`;
 					}
 				} else {
 					s = `(${rightJS()}.indexOf(${leftJS()}) > -1)`;
@@ -11257,7 +11257,7 @@ yy.Over = class Over {
 						const allValues = this.right.map(value => value.value);
 						const allValuesStr = allValues.join(',');
 						alasql.sets[allValuesStr] = alasql.sets[allValuesStr] || new Set(allValues);
-						s = `!alasql.sets["${allValuesStr}"].has(alasql.utils.getValueOf(${leftJS()}))`;
+						s = `!alasql.sets[${JSON.stringify(allValuesStr)}].has(alasql.utils.getValueOf(${leftJS()}))`;
 					}
 				} else {
 					s = `(${rightJS()}.indexOf(${leftJS()}) === -1)`;
@@ -13188,7 +13188,7 @@ yy.CreateTable.prototype.execute = function (databaseid, params, cb) {
 
 			table.update(
 				function (t) {
-					for (var f in r) t[f] = r[f];
+					for (var f in r) {if(/^__proto__$/.test(f))Object.defineProperty(t,f,{writable:true,enumerable:true,configurable:true});t[f] = r[f];}
 				},
 				table.data.indexOf(toreplace),
 				params
@@ -14957,7 +14957,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 					});
 				} else {
 
-					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){r[k]=w[k]};';
+					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 					sw = JSONtoJS(values);
 				}
 			}
@@ -15036,7 +15036,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 			self.output.columns.forEach(function (col) {
 				if (col.columnid === '*') {
 					// For *, expand all properties
-					s += 'for(var key in r){ outputRow[key] = r[key]; }';
+					s += 'for(var key in r){ if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = r[key]; }';
 				} else {
 					var colname = col.as || col.columnid;
 					// Direct property access for simple columns
@@ -15115,7 +15115,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 							if (col.columnid === '*') {
 								// For *, expand all properties
 								for (var key in r) {
-									outputRow[key] = r[key];
+									if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = r[key];
 								}
 							} else {
 								var colname = col.as || col.columnid;
@@ -15440,7 +15440,7 @@ yy.Delete.prototype.compile = function (databaseid) {
 						if (col.columnid === '*') {
 							// For *, expand all properties
 							for (var key in r) {
-								outputRow[key] = r[key];
+								if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = r[key];
 							}
 						} else {
 							var colname = col.as || col.columnid;
@@ -15511,7 +15511,7 @@ yy.Delete.prototype.compile = function (databaseid) {
 						if (col.columnid === '*') {
 							// For *, expand all properties
 							for (var key in r) {
-								outputRow[key] = r[key];
+								if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = r[key];
 							}
 						} else {
 							var colname = col.as || col.columnid;
@@ -15681,7 +15681,7 @@ yy.Update.prototype.compile = function (databaseid) {
 					if (col.columnid === '*') {
 						// For *, use INSERTED values
 						for (var key in inserted) {
-							outputRow[key] = inserted[key];
+							if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = inserted[key];
 						}
 					} else {
 						var colname = col.as || col.columnid;

package/dist/alasql.js

@@ -1,7 +1,7 @@
-//! AlaSQL v4.13.0 build: develop-4992fcb1 | © 2014-2025 Andrey Gershun & Mathias Wulff | License: MIT
+//! AlaSQL v4.14.1 build: develop-4992fcb1 | © 2014-2025 Andrey Gershun & Mathias Wulff | License: MIT
 /*
 @module alasql
-@version 4.13.0
+@version 4.14.1
 
 AlaSQL - JavaScript SQL database
 © 2014-2025	Andrey Gershun & Mathias Wulff
@@ -141,7 +141,7 @@ SOFTWARE.
 		Current version of alasql
 		  @constant {string}
 	*/
-	alasql.version = '4.13.0';
+	alasql.version = '4.14.1';
 	alasql.build = 'develop-4992fcb1';
 
 	/**
@@ -4240,11 +4240,11 @@ var cloneDeep = (utils.cloneDeep = function cloneDeep(obj) {
 		return +obj;
 	}
 
-	var temp = new obj.constructor(); // changed
+	var temp = new (Object.prototype.hasOwnProperty.call(obj, 'constructor') ? Object : obj.constructor)(); // changed
 
 	for (var key in obj) {
 		if (obj.hasOwnProperty(key)) {
-			temp[key] = cloneDeep(obj[key]);
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(temp, key, {value: cloneDeep(obj[key]), writable: true, enumerable: true, configurable: true}); } else { temp[key] = cloneDeep(obj[key]); }
 		}
 	}
 	return temp;
@@ -4316,7 +4316,7 @@ var extend = (utils.extend = function extend(a, b) {
 	a = a || {};
 	for (var key in b) {
 		if (b.hasOwnProperty(key)) {
-			a[key] = b[key];
+			/* A "__proto__" key from parsed data is copied as data, never as the prototype */ if (key === '__proto__') { Object.defineProperty(a, key, {value: b[key], writable: true, enumerable: true, configurable: true}); } else { a[key] = b[key]; }
 		}
 	}
 	return a;
@@ -9017,7 +9017,7 @@ yy.Select.prototype.compileGroup = function (query) {
 			aft2 = '';
 
 		if (typeof query.groupStar !== 'undefined') {
-			aft2 += "for(var f in p['" + query.groupStar + "']) {g[f]=p['" + query.groupStar + "'][f];};";
+			aft2 += "for(var f in p['" + query.groupStar + "']) {if(/^__proto__$/.test(f))Object.defineProperty(g,f,{writable:true,enumerable:true,configurable:true});g[f]=p['" + query.groupStar + "'][f];};";
 		}
 
 		s += query.selectGroup
@@ -9479,7 +9479,7 @@ function compileSelectStar(query, aliases, joinstar) {
 					'var w=p["' + escapeq(alias) + '"];for(var k in w){r["' + escapeq(alias) + '_"+k]=w[k]};';
 			} else {
 				// Default overwrite mode
-				sp += 'var w=p["' + escapeq(alias) + '"];for(var k in w){r[k]=w[k]};';
+				sp += 'var w=p["' + escapeq(alias) + '"];for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 			}
 
 			query.dirtyColumns = true;
@@ -9918,10 +9918,10 @@ yy.Select.prototype.compileSelectGroup1 = function (query) {
 	self.columns.forEach(function (col) {
 
 		if (col instanceof yy.Column && col.columnid === '*') {
-			//			s += 'for(var k in g){r[k]=g[k]};';
+			//			s += 'for(var k in g){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			//			s += 'for(var k in this.query.groupColumns){r[k]=g[this.query.groupColumns[k]]};';
 
-			s += 'for(var k in g) {r[k]=g[k]};';
+			s += 'for(var k in g) {if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=g[k]};';
 			return '';
 
 		} else {
@@ -11223,7 +11223,7 @@ yy.Over = class Over {
 						const allValues = this.right.map(value => value.value);
 						const allValuesStr = allValues.join(',');
 						alasql.sets[allValuesStr] = alasql.sets[allValuesStr] || new Set(allValues);
-						s = `alasql.sets["${allValuesStr}"].has(alasql.utils.getValueOf(${leftJS()}))`;
+						s = `alasql.sets[${JSON.stringify(allValuesStr)}].has(alasql.utils.getValueOf(${leftJS()}))`;
 					}
 				} else {
 					s = `(${rightJS()}.indexOf(${leftJS()}) > -1)`;
@@ -11257,7 +11257,7 @@ yy.Over = class Over {
 						const allValues = this.right.map(value => value.value);
 						const allValuesStr = allValues.join(',');
 						alasql.sets[allValuesStr] = alasql.sets[allValuesStr] || new Set(allValues);
-						s = `!alasql.sets["${allValuesStr}"].has(alasql.utils.getValueOf(${leftJS()}))`;
+						s = `!alasql.sets[${JSON.stringify(allValuesStr)}].has(alasql.utils.getValueOf(${leftJS()}))`;
 					}
 				} else {
 					s = `(${rightJS()}.indexOf(${leftJS()}) === -1)`;
@@ -13188,7 +13188,7 @@ yy.CreateTable.prototype.execute = function (databaseid, params, cb) {
 
 			table.update(
 				function (t) {
-					for (var f in r) t[f] = r[f];
+					for (var f in r) {if(/^__proto__$/.test(f))Object.defineProperty(t,f,{writable:true,enumerable:true,configurable:true});t[f] = r[f];}
 				},
 				table.data.indexOf(toreplace),
 				params
@@ -14957,7 +14957,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 					});
 				} else {
 
-					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){r[k]=w[k]};';
+					//					sw = 'var w='+JSONtoJS(values)+';for(var k in w){if(/^__proto__$/.test(k))Object.defineProperty(r,k,{writable:true,enumerable:true,configurable:true});r[k]=w[k]};';
 					sw = JSONtoJS(values);
 				}
 			}
@@ -15036,7 +15036,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 			self.output.columns.forEach(function (col) {
 				if (col.columnid === '*') {
 					// For *, expand all properties
-					s += 'for(var key in r){ outputRow[key] = r[key]; }';
+					s += 'for(var key in r){ if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = r[key]; }';
 				} else {
 					var colname = col.as || col.columnid;
 					// Direct property access for simple columns
@@ -15115,7 +15115,7 @@ yy.Insert.prototype.compile = function (databaseid) {
 							if (col.columnid === '*') {
 								// For *, expand all properties
 								for (var key in r) {
-									outputRow[key] = r[key];
+									if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = r[key];
 								}
 							} else {
 								var colname = col.as || col.columnid;
@@ -15440,7 +15440,7 @@ yy.Delete.prototype.compile = function (databaseid) {
 						if (col.columnid === '*') {
 							// For *, expand all properties
 							for (var key in r) {
-								outputRow[key] = r[key];
+								if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = r[key];
 							}
 						} else {
 							var colname = col.as || col.columnid;
@@ -15511,7 +15511,7 @@ yy.Delete.prototype.compile = function (databaseid) {
 						if (col.columnid === '*') {
 							// For *, expand all properties
 							for (var key in r) {
-								outputRow[key] = r[key];
+								if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = r[key];
 							}
 						} else {
 							var colname = col.as || col.columnid;
@@ -15681,7 +15681,7 @@ yy.Update.prototype.compile = function (databaseid) {
 					if (col.columnid === '*') {
 						// For *, use INSERTED values
 						for (var key in inserted) {
-							outputRow[key] = inserted[key];
+							if(/^__proto__$/.test(key))Object.defineProperty(outputRow,key,{writable:true,enumerable:true,configurable:true});outputRow[key] = inserted[key];
 						}
 					} else {
 						var colname = col.as || col.columnid;