alepha 0.14.1 → 0.14.3

package/src/orm/__tests__/security.spec.ts

@@ -0,0 +1,710 @@
+import { Alepha, t } from "alepha";
+import { describe, it } from "vitest";
+import { $entity, $repository, DatabaseProvider, pg, sql } from "../index.ts";
+import {
+  NodeSqliteProvider,
+  nodeSqliteOptions,
+} from "../providers/drivers/NodeSqliteProvider.ts";
+
+/**
+ * SQL Injection Security Tests
+ *
+ * This test suite validates that the ORM properly sanitizes and escapes user input
+ * to prevent SQL injection attacks across various scenarios:
+ * - Basic filter operators (eq, ne, like, ilike, etc.)
+ * - JSONB queries
+ * - Array operators
+ * - Raw SQL queries
+ * - Both PostgreSQL and SQLite
+ */
+describe("SQL Injection Security Tests", () => {
+  // Define test entities with various column types
+  const users = $entity({
+    name: "users",
+    schema: t.object({
+      id: pg.primaryKey(),
+      username: t.text(),
+      email: t.text(),
+      age: t.integer(),
+      profile: t.object({
+        bio: t.text(),
+        settings: t.object({
+          theme: t.text(),
+          notifications: t.boolean(),
+        }),
+      }),
+      tags: t.array(t.text()),
+      metadata: t.object({
+        permissions: t.array(t.text()),
+        lastLogin: t.optional(t.text()),
+      }),
+    }),
+  });
+
+  class App {
+    users = $repository(users);
+  }
+
+  const sqlInjectionPayloads = [
+    // Classic SQL injection patterns
+    "' OR '1'='1",
+    "' OR 1=1--",
+    "' OR 1=1#",
+    "' OR 1=1/*",
+    "admin'--",
+    "admin' #",
+    "admin'/*",
+
+    // Union-based injection
+    "' UNION SELECT NULL--",
+    "' UNION SELECT NULL, NULL--",
+    "' UNION ALL SELECT NULL--",
+
+    // Stacked queries
+    "'; DROP TABLE users--",
+    "'; DELETE FROM users--",
+    "'; UPDATE users SET username='hacked'--",
+
+    // Boolean-based blind injection
+    "' AND 1=1--",
+    "' AND 1=2--",
+    "' AND SUBSTRING(@@version,1,1)='5",
+
+    // Time-based blind injection
+    "'; WAITFOR DELAY '00:00:05'--",
+    "'; SELECT SLEEP(5)--",
+    "' AND (SELECT * FROM (SELECT(SLEEP(5)))a)--",
+
+    // Quote escaping attempts
+    "''",
+    "\\'",
+    "\\x27",
+    "%27",
+
+    // Comment variations
+    "--",
+    "-- -",
+    "#",
+    "/**/",
+    "/* comment */",
+
+    // Hex encoding
+    "0x27",
+    "0x4F0x52",
+
+    // Special characters
+    "';!--\"<XSS>=&{()}",
+    "@@version",
+    "char(39)",
+
+    // PostgreSQL specific
+    "$1",
+    "$$",
+    "';--",
+    "1; SELECT version();",
+
+    // SQLite specific
+    "' || '1",
+    "'; ATTACH DATABASE 'file' AS db;--",
+
+    // JSONB injection attempts (PostgreSQL)
+    "' -> 'key",
+    "' ->> 'key",
+    "' #> '{key}'",
+    "' #>> '{key}'",
+    '\' @> \'{"key":"value"}\'',
+    "' ? 'key",
+    "' ?| array['key']",
+    "' ?& array['key']",
+  ];
+
+  describe("PostgreSQL", () => {
+    describe("Basic Filter Operators", () => {
+      it("should prevent SQL injection in eq operator", async ({ expect }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        // Create a legitimate user
+        await app.users.create({
+          username: "alice",
+          email: "alice@example.com",
+          age: 30,
+          profile: {
+            bio: "Hello world",
+            settings: { theme: "dark", notifications: true },
+          },
+          tags: ["admin"],
+          metadata: { permissions: ["read", "write"], lastLogin: "2024-01-01" },
+        });
+
+        // Try each SQL injection payload
+        for (const payload of sqlInjectionPayloads) {
+          const result = await app.users.findMany({
+            where: { username: { eq: payload } },
+          });
+
+          // Should return empty array since payload doesn't match any real username
+          expect(result).toEqual([]);
+        }
+      });
+
+      it("should prevent SQL injection in ne operator", async ({ expect }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "bob",
+          email: "bob@example.com",
+          age: 25,
+          profile: {
+            bio: "Developer",
+            settings: { theme: "light", notifications: false },
+          },
+          tags: [],
+          metadata: { permissions: ["read"] },
+        });
+
+        for (const payload of sqlInjectionPayloads) {
+          // Should not cause SQL errors or unexpected behavior
+          const result = await app.users.findMany({
+            where: { username: { ne: payload } },
+          });
+
+          // Should return the legitimate user
+          expect(result.length).toBeGreaterThanOrEqual(0);
+        }
+      });
+
+      it("should prevent SQL injection in contains operator", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "charlie",
+          email: "charlie@example.com",
+          age: 35,
+          profile: {
+            bio: "Designer",
+            settings: { theme: "dark", notifications: true },
+          },
+          tags: ["designer"],
+          metadata: { permissions: ["read", "write"] },
+        });
+
+        for (const payload of sqlInjectionPayloads) {
+          const result = await app.users.findMany({
+            where: { username: { contains: payload } },
+          });
+
+          // Should safely handle the payload as a literal string
+          expect(result).toEqual([]);
+        }
+      });
+
+      it("should prevent SQL injection in contains operator (email field)", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "Diana",
+          email: "diana@example.com",
+          age: 28,
+          profile: {
+            bio: "Manager",
+            settings: { theme: "light", notifications: true },
+          },
+          tags: ["manager"],
+          metadata: { permissions: ["admin"] },
+        });
+
+        for (const payload of sqlInjectionPayloads) {
+          const result = await app.users.findMany({
+            where: { email: { contains: payload } },
+          });
+
+          expect(result).toEqual([]);
+        }
+      });
+
+      it("should prevent SQL injection in gt/gte/lt/lte operators", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "eve",
+          email: "eve@example.com",
+          age: 40,
+          profile: {
+            bio: "Executive",
+            settings: { theme: "dark", notifications: false },
+          },
+          tags: [],
+          metadata: { permissions: ["admin", "read", "write"] },
+        });
+
+        // Numeric operators should either reject non-numeric payloads or treat them safely
+        // PostgreSQL will throw a type error for invalid integer syntax
+        // This is actually GOOD - the database layer is rejecting malicious input
+        for (const payload of sqlInjectionPayloads) {
+          try {
+            const result = await app.users.findMany({
+              where: { age: { gt: payload as any } },
+            });
+
+            // If it doesn't throw, it should return safe results
+            expect(Array.isArray(result)).toBe(true);
+          } catch (error) {
+            // PostgreSQL rejects invalid integer syntax - this is expected and safe
+            // The SQL is still parameterized, preventing injection
+            expect(error).toBeDefined();
+          }
+        }
+      });
+
+      it("should prevent SQL injection in inArray operator", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "frank",
+          email: "frank@example.com",
+          age: 33,
+          profile: {
+            bio: "Developer",
+            settings: { theme: "dark", notifications: true },
+          },
+          tags: ["dev"],
+          metadata: { permissions: ["read"] },
+        });
+
+        const result = await app.users.findMany({
+          where: {
+            username: { inArray: sqlInjectionPayloads.slice(0, 10) },
+          },
+        });
+
+        // Should treat each payload as a literal string to compare
+        expect(result).toEqual([]);
+      });
+    });
+
+    describe("Array Operator Injection", () => {
+      it("should prevent SQL injection in arrayContains", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "jack",
+          email: "jack@example.com",
+          age: 36,
+          profile: {
+            bio: "Security Expert",
+            settings: { theme: "dark", notifications: true },
+          },
+          tags: ["security", "expert"],
+          metadata: { permissions: ["admin", "audit"] },
+        });
+
+        for (const payload of sqlInjectionPayloads) {
+          const result = await app.users.findMany({
+            where: {
+              tags: { arrayContains: [payload] },
+            },
+          });
+
+          expect(result).toEqual([]);
+        }
+      });
+
+      it("should prevent SQL injection in arrayOverlaps", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "kate",
+          email: "kate@example.com",
+          age: 32,
+          profile: {
+            bio: "Product Manager",
+            settings: { theme: "light", notifications: false },
+          },
+          tags: ["product", "manager"],
+          metadata: { permissions: ["read", "write"] },
+        });
+
+        const result = await app.users.findMany({
+          where: {
+            tags: { arrayOverlaps: sqlInjectionPayloads.slice(0, 5) },
+          },
+        });
+
+        expect(result).toEqual([]);
+      });
+
+      it("should prevent SQL injection in arrayContained", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "leo",
+          email: "leo@example.com",
+          age: 38,
+          profile: {
+            bio: "CTO",
+            settings: { theme: "dark", notifications: true },
+          },
+          tags: ["cto", "leadership"],
+          metadata: { permissions: ["admin", "owner"] },
+        });
+
+        const result = await app.users.findMany({
+          where: {
+            tags: { arrayContained: sqlInjectionPayloads.slice(0, 5) },
+          },
+        });
+
+        expect(result).toEqual([]);
+      });
+    });
+
+    describe("Raw SQL Injection", () => {
+      it("should safely handle parameterized queries", async ({ expect }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "maria",
+          email: "maria@example.com",
+          age: 26,
+          profile: {
+            bio: "Designer",
+            settings: { theme: "light", notifications: true },
+          },
+          tags: ["design"],
+          metadata: { permissions: ["read"] },
+        });
+
+        for (const payload of sqlInjectionPayloads) {
+          // Using parameterized queries should be safe
+          const result = await app.users.query(
+            (t) => sql`SELECT * FROM ${t} WHERE ${t.username} = ${payload}`,
+            t.pick(users.schema, ["username"]),
+          );
+
+          // Should treat payload as a literal value
+          expect(result).toEqual([]);
+        }
+      });
+
+      it("should prevent injection in complex SQL expressions", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create();
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "nathan",
+          email: "nathan@example.com",
+          age: 41,
+          profile: {
+            bio: "Consultant",
+            settings: { theme: "dark", notifications: false },
+          },
+          tags: ["consulting"],
+          metadata: { permissions: ["read", "write", "admin"] },
+        });
+
+        for (const payload of sqlInjectionPayloads) {
+          const result = await app.users.query(
+            (t) =>
+              sql`SELECT * FROM ${t} WHERE ${t.username} LIKE ${`%${payload}%`}`,
+            t.pick(users.schema, ["username"]),
+          );
+
+          expect(result).toEqual([]);
+        }
+      });
+    });
+  });
+
+  describe("SQLite", () => {
+    describe("Basic Filter Operators", () => {
+      it("should prevent SQL injection in eq operator", async ({ expect }) => {
+        const alepha = Alepha.create().with({
+          provide: DatabaseProvider,
+          use: NodeSqliteProvider,
+        });
+
+        alepha.store.mut(nodeSqliteOptions, (old) => ({
+          ...old,
+          path: "sqlite://:memory:",
+        }));
+
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "sqlite_alice",
+          email: "alice@sqlite.com",
+          age: 30,
+          profile: {
+            bio: "SQLite tester",
+            settings: { theme: "dark", notifications: true },
+          },
+          tags: ["sqlite"],
+          metadata: { permissions: ["read"] },
+        });
+
+        for (const payload of sqlInjectionPayloads) {
+          const result = await app.users.findMany({
+            where: { username: { eq: payload } },
+          });
+
+          expect(result).toEqual([]);
+        }
+      });
+
+      it("should prevent SQL injection in contains operator (SQLite)", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create().with({
+          provide: DatabaseProvider,
+          use: NodeSqliteProvider,
+        });
+
+        alepha.store.mut(nodeSqliteOptions, (old) => ({
+          ...old,
+          path: "sqlite://:memory:",
+        }));
+
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "sqlite_bob",
+          email: "bob@sqlite.com",
+          age: 25,
+          profile: {
+            bio: "SQLite developer",
+            settings: { theme: "light", notifications: false },
+          },
+          tags: ["dev"],
+          metadata: { permissions: ["read", "write"] },
+        });
+
+        for (const payload of sqlInjectionPayloads) {
+          const result = await app.users.findMany({
+            where: { username: { contains: payload } },
+          });
+
+          expect(result).toEqual([]);
+        }
+      });
+
+      it("should prevent SQL injection in inArray operator", async ({
+        expect,
+      }) => {
+        const alepha = Alepha.create().with({
+          provide: DatabaseProvider,
+          use: NodeSqliteProvider,
+        });
+
+        alepha.store.mut(nodeSqliteOptions, (old) => ({
+          ...old,
+          path: "sqlite://:memory:",
+        }));
+
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "sqlite_charlie",
+          email: "charlie@sqlite.com",
+          age: 35,
+          profile: {
+            bio: "SQLite admin",
+            settings: { theme: "dark", notifications: true },
+          },
+          tags: ["admin"],
+          metadata: { permissions: ["admin"] },
+        });
+
+        const result = await app.users.findMany({
+          where: {
+            username: { inArray: sqlInjectionPayloads.slice(0, 10) },
+          },
+        });
+
+        expect(result).toEqual([]);
+      });
+    });
+
+    describe("Raw SQL Injection (SQLite)", () => {
+      it("should safely handle parameterized queries", async ({ expect }) => {
+        const alepha = Alepha.create().with({
+          provide: DatabaseProvider,
+          use: NodeSqliteProvider,
+        });
+
+        alepha.store.mut(nodeSqliteOptions, (old) => ({
+          ...old,
+          path: "sqlite://:memory:",
+        }));
+
+        const app = alepha.inject(App);
+        await alepha.start();
+
+        await app.users.create({
+          username: "sqlite_eve",
+          email: "eve@sqlite.com",
+          age: 40,
+          profile: {
+            bio: "SQL expert",
+            settings: { theme: "light", notifications: false },
+          },
+          tags: ["sql"],
+          metadata: { permissions: ["admin"] },
+        });
+
+        for (const payload of sqlInjectionPayloads) {
+          const result = await app.users.query(
+            (t) => sql`SELECT * FROM ${t} WHERE ${t.username} = ${payload}`,
+            t.pick(users.schema, ["username"]),
+          );
+
+          expect(result).toEqual([]);
+        }
+      });
+    });
+  });
+
+  describe("Edge Cases and Special Characters", () => {
+    it("should handle unicode and special characters safely", async ({
+      expect,
+    }) => {
+      const alepha = Alepha.create();
+      const app = alepha.inject(App);
+      await alepha.start();
+
+      const specialChars = [
+        "用户名", // Chinese
+        "пользователь", // Russian
+        "مستخدم", // Arabic
+        "🔥💻🚀", // Emojis
+        // Note: \u0000 (null byte) is not supported by PostgreSQL (invalid encoding)
+        "\n\r\t", // Whitespace
+        "\\\\", // Backslashes
+        "<<<>>>", // Angle brackets
+      ];
+
+      for (const char of specialChars) {
+        try {
+          const created = await app.users.create({
+            username: char,
+            email: `${char}@example.com`,
+            age: 25,
+            profile: {
+              bio: char,
+              settings: { theme: "dark", notifications: true },
+            },
+            tags: [char],
+            metadata: { permissions: [char] },
+          });
+
+          const found = await app.users.findOne({
+            where: { username: { eq: char } },
+          });
+
+          expect(found.id).toBe(created.id);
+          expect(found.username).toBe(char);
+        } catch (error) {
+          // Some special characters may have database-specific limitations
+          // (e.g., PostgreSQL doesn't support null bytes in text fields)
+          // The important thing is that it fails safely without SQL injection
+          expect(error).toBeDefined();
+        }
+      }
+    });
+
+    it("should handle long strings with injection attempts safely", async ({
+      expect,
+    }) => {
+      const alepha = Alepha.create();
+      const app = alepha.inject(App);
+      await alepha.start();
+
+      // Create a string that's close to max length and contains SQL injection attempt
+      const longString = `${"A".repeat(100)}' OR '1'='1${"B".repeat(100)}`;
+
+      const created = await app.users.create({
+        username: longString,
+        email: "long@example.com",
+        age: 30,
+        profile: {
+          bio: longString,
+          settings: { theme: "dark", notifications: true },
+        },
+        tags: ["long"],
+        metadata: { permissions: ["read"] },
+      });
+
+      const found = await app.users.findOne({
+        where: {
+          username: { eq: longString },
+        },
+      });
+
+      expect(found.id).toBe(created.id);
+      expect(found.username).toBe(longString);
+    });
+
+    it("should handle empty strings and nulls", async ({ expect }) => {
+      const alepha = Alepha.create();
+      const app = alepha.inject(App);
+      await alepha.start();
+
+      const created = await app.users.create({
+        username: "",
+        email: "empty@example.com",
+        age: 30,
+        profile: {
+          bio: "",
+          settings: { theme: "dark", notifications: true },
+        },
+        tags: [],
+        metadata: { permissions: [] },
+      });
+
+      const found = await app.users.findOne({
+        where: { username: { eq: "" } },
+      });
+
+      expect(found.id).toBe(created.id);
+    });
+  });
+});