axiodb 21.7.8 → 22.2.0

package/lib/Services/Database/database.operation.js

@@ -108,7 +108,7 @@ class Database {
      **/
     isCollectionExists(collectionName) {
         return __awaiter(this, void 0, void 0, function* () {
-            const collectionPath = path_1.default.join(this.path, collectionName);
+            const collectionPath = PathSanitizer_helper_1.default.safePath(this.path, collectionName);
             const exists = yield this.folderManager.DirectoryExists(collectionPath);
             return exists.statusCode === StatusCode_1.StatusCodes.OK;
         });
@@ -121,7 +121,7 @@ class Database {
      */
     deleteCollection(collectionName) {
         return __awaiter(this, void 0, void 0, function* () {
-            const collectionPath = path_1.default.join(this.path, collectionName);
+            const collectionPath = PathSanitizer_helper_1.default.safePath(this.path, collectionName);
             const exists = yield this.folderManager.DirectoryExists(collectionPath);
             if (exists.statusCode === StatusCode_1.StatusCodes.OK) {
                 // Remove collection metadata
@@ -305,4 +305,3 @@ class Database {
     }
 }
 exports.default = Database;
-//# sourceMappingURL=database.operation.js.map

package/lib/Services/Index/Index.service.js

@@ -240,4 +240,3 @@ class IndexManager {
     }
 }
 exports.IndexManager = IndexManager;
-//# sourceMappingURL=Index.service.js.map

package/lib/Services/Index/IndexCache.service.js

@@ -275,4 +275,3 @@ IndexCache.instances = new Map();
 IndexCache.MIN_TTL_MS = 5 * 60 * 1000; // 5 minutes
 IndexCache.MAX_TTL_MS = 15 * 60 * 1000; // 15 minutes
 IndexCache.CLEANUP_INTERVAL_MS = 60 * 1000; // Check every 1 minute
-//# sourceMappingURL=IndexCache.service.js.map

package/lib/Services/Index/ReadIndex.service.js

@@ -231,4 +231,3 @@ class ReadIndex extends Index_service_1.IndexManager {
     }
 }
 exports.ReadIndex = ReadIndex;
-//# sourceMappingURL=ReadIndex.service.js.map

package/lib/Services/Indexation.operation.js

@@ -26,6 +26,7 @@ const Converter_helper_1 = __importDefault(require("../Helper/Converter.helper")
 const Console_helper_1 = __importDefault(require("../Helper/Console.helper"));
 const StatusCode_1 = require("../config/Keys/StatusCode");
 const response_helper_1 = __importDefault(require("../Helper/response.helper"));
+const PathSanitizer_helper_1 = __importDefault(require("../Helper/PathSanitizer.helper"));
 const server_1 = __importDefault(require("../server/config/server"));
 const server_2 = __importDefault(require("../tcp/config/server"));
 const AuthSeeder_service_1 = __importDefault(require("./Auth/AuthSeeder.service"));
@@ -163,7 +164,7 @@ class AxioDB {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this._initializing)
                 yield this.ready;
-            const dbPath = path_1.default.join(this.currentPATH, DBName);
+            const dbPath = PathSanitizer_helper_1.default.safePath(this.currentPATH, DBName);
             // Check if the database already exists
             const exists = yield this.folderManager.DirectoryExists(dbPath);
             if (exists.statusCode !== StatusCode_1.StatusCodes.OK) {
@@ -237,7 +238,7 @@ class AxioDB {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this._initializing)
                 yield this.ready;
-            const dbPath = path_1.default.join(this.currentPATH, DBName);
+            const dbPath = PathSanitizer_helper_1.default.safePath(this.currentPATH, DBName);
             const exists = yield this.folderManager.DirectoryExists(dbPath);
             return exists.statusCode === StatusCode_1.StatusCodes.OK;
         });
@@ -258,7 +259,7 @@ class AxioDB {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this._initializing)
                 yield this.ready;
-            const dbPath = path_1.default.join(this.currentPATH, DBName);
+            const dbPath = PathSanitizer_helper_1.default.safePath(this.currentPATH, DBName);
             const exists = yield this.folderManager.DirectoryExists(dbPath);
             if (exists.statusCode === StatusCode_1.StatusCodes.OK) {
                 yield this.folderManager.DeleteDirectory(dbPath);
@@ -272,4 +273,3 @@ class AxioDB {
     }
 }
 exports.AxioDB = AxioDB;
-//# sourceMappingURL=Indexation.operation.js.map

package/lib/Services/Transaction/LockManager.service.js

@@ -157,4 +157,3 @@ class LockManager {
 // One LockManager per collection path, shared across every caller.
 LockManager.instances = new Map();
 exports.default = LockManager;
-//# sourceMappingURL=LockManager.service.js.map

package/lib/Services/Transaction/Session.service.js

@@ -230,4 +230,3 @@ class Session {
     }
 }
 exports.default = Session;
-//# sourceMappingURL=Session.service.js.map

package/lib/Services/Transaction/Transaction.service.js

@@ -517,4 +517,3 @@ class Transaction {
     }
 }
 exports.default = Transaction;
-//# sourceMappingURL=Transaction.service.js.map

package/lib/Services/Transaction/TransactionIndexManager.service.js

@@ -245,4 +245,3 @@ class TransactionIndexManager {
     }
 }
 exports.default = TransactionIndexManager;
-//# sourceMappingURL=TransactionIndexManager.service.js.map

package/lib/Services/Transaction/TransactionRegistry.service.js

@@ -158,4 +158,3 @@ class TransactionRegistry {
     }
 }
 exports.default = TransactionRegistry;
-//# sourceMappingURL=TransactionRegistry.service.js.map

package/lib/Services/Transaction/WriteAheadLog.service.js

@@ -269,4 +269,3 @@ class WriteAheadLog {
     }
 }
 exports.default = WriteAheadLog;
-//# sourceMappingURL=WriteAheadLog.service.js.map

package/lib/client/AggregationProxy.js

@@ -29,4 +29,3 @@ class AggregationProxy {
     }
 }
 exports.default = AggregationProxy;
-//# sourceMappingURL=AggregationProxy.js.map

package/lib/client/AxioDBCloud.client.js

@@ -270,4 +270,3 @@ class AxioDBCloud extends events_1.EventEmitter {
     }
 }
 exports.AxioDBCloud = AxioDBCloud;
-//# sourceMappingURL=AxioDBCloud.client.js.map

package/lib/client/CollectionProxy.js

@@ -119,4 +119,3 @@ class CollectionProxy {
     }
 }
 exports.default = CollectionProxy;
-//# sourceMappingURL=CollectionProxy.js.map

package/lib/client/DatabaseProxy.js

@@ -58,4 +58,3 @@ class DatabaseProxy {
     }
 }
 exports.default = DatabaseProxy;
-//# sourceMappingURL=DatabaseProxy.js.map

package/lib/client/DeleteOperationProxy.js

@@ -40,4 +40,3 @@ class DeleteOperationProxy {
     }
 }
 exports.default = DeleteOperationProxy;
-//# sourceMappingURL=DeleteOperationProxy.js.map

package/lib/client/PooledConnection.js

@@ -280,4 +280,3 @@ class PooledConnection {
     }
 }
 exports.default = PooledConnection;
-//# sourceMappingURL=PooledConnection.js.map

package/lib/client/ReaderProxy.js

@@ -66,4 +66,3 @@ class ReaderProxy {
     }
 }
 exports.default = ReaderProxy;
-//# sourceMappingURL=ReaderProxy.js.map

package/lib/client/TransactionProxy.js

@@ -98,4 +98,3 @@ class TransactionProxy {
     }
 }
 exports.default = TransactionProxy;
-//# sourceMappingURL=TransactionProxy.js.map

package/lib/client/UpdateOperationProxy.js

@@ -42,4 +42,3 @@ class UpdateOperationProxy {
     }
 }
 exports.default = UpdateOperationProxy;
-//# sourceMappingURL=UpdateOperationProxy.js.map

package/lib/client/types/client.types.js

@@ -9,4 +9,3 @@ var ConnectionState;
     ConnectionState["RECONNECTING"] = "RECONNECTING";
     ConnectionState["FAILED"] = "FAILED";
 })(ConnectionState || (exports.ConnectionState = ConnectionState = {}));
-//# sourceMappingURL=client.types.js.map

package/lib/config/DB.js

@@ -36,4 +36,3 @@ exports.default = {
     InstanceTypes,
     OperatorRegistry: OperatorRegistry_1.OperatorRegistry,
 };
-//# sourceMappingURL=DB.js.map

package/lib/config/Interfaces/Auth/auth.interface.js

@@ -1,4 +1,3 @@
 "use strict";
 // Interfaces for the Control Server RBAC + Authentication feature.
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=auth.interface.js.map

package/lib/config/Interfaces/Helper/response.helper.interface.js

@@ -1,3 +1,2 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=response.helper.interface.js.map

package/lib/config/Interfaces/Operation/Indexation.operation.interface.js

@@ -1,3 +1,2 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=Indexation.operation.interface.js.map

package/lib/config/Interfaces/Operation/aggregation.interface.js

@@ -1,3 +1,2 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=aggregation.interface.js.map

package/lib/config/Interfaces/Operation/database.operation.interface.js

@@ -1,3 +1,2 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=database.operation.interface.js.map

package/lib/config/Interfaces/Transaction/transaction.interface.js

@@ -1,3 +1,2 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=transaction.interface.js.map

package/lib/config/Interfaces/shared.types.js

@@ -4,4 +4,3 @@
  * Import from here instead of using `any` for document data.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=shared.types.js.map

package/lib/config/Keys/Keys.js

@@ -20,4 +20,3 @@ var WebServer;
     WebServer[WebServer["WebSocketServerPORT"] = 2028] = "WebSocketServerPORT";
     WebServer[WebServer["GraphQLServerPORT"] = 2029] = "GraphQLServerPORT";
 })(WebServer || (exports.WebServer = WebServer = {}));
-//# sourceMappingURL=Keys.js.map

package/lib/config/Keys/Permissions.js

@@ -120,4 +120,3 @@ exports.LOGIN_RATE_LIMIT_MAX_ATTEMPTS = 5;
 exports.LOGIN_RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000; // 15 minutes
 exports.LOGIN_RATE_LIMIT_COOLDOWN_MS = 15 * 60 * 1000; // 15 minutes
 exports.LOGIN_RATE_LIMIT_SWEEP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
-//# sourceMappingURL=Permissions.js.map

package/lib/config/Keys/StatusCode.js

@@ -66,4 +66,3 @@ var StatusCodes;
     StatusCodes[StatusCodes["NOT_EXTENDED"] = 510] = "NOT_EXTENDED";
     StatusCodes[StatusCodes["NETWORK_AUTHENTICATION_REQUIRED"] = 511] = "NETWORK_AUTHENTICATION_REQUIRED";
 })(StatusCodes || (exports.StatusCodes = StatusCodes = {}));
-//# sourceMappingURL=StatusCode.js.map

package/lib/engine/Filesystem/FileManager.js

@@ -280,7 +280,13 @@ class FileManager {
                         // Fall back to system commands if native method fails
                         const osType = worker_process_1.default.getOS();
                         if (osType === "windows") {
-                            const stdout = yield this.WorkerProcess.execCommand(`powershell -command "(Get-Item '${path}').length"`);
+                            const stdout = yield this.WorkerProcess.execCommandSafely("powershell", [
+                                "-NoProfile",
+                                "-command",
+                                "(Get-Item -LiteralPath $args[0]).length",
+                                "--",
+                                path,
+                            ]);
                             const size = parseInt(stdout, 10) || 0;
                             // Restore original permissions if they were modified
                             if (originalMode !== null && (originalMode & 0o444) !== 0o444) {
@@ -289,8 +295,8 @@ class FileManager {
                             return this.responseHelper.Success(size);
                         }
                         else {
-                            const stdout = yield this.WorkerProcess.execCommand(`wc -c < "${path}" 2>/dev/null || echo 0`);
-                            const size = parseInt(stdout, 10) || 0;
+                            const stdout = yield this.WorkerProcess.execCommandSafely("wc", ["-c", "--", path]);
+                            const size = parseInt(stdout.trim(), 10) || 0;
                             // Restore original permissions if they were modified
                             if (originalMode !== null && (originalMode & 0o444) !== 0o444) {
                                 yield promises_1.default.chmod(path, originalMode);
@@ -330,4 +336,3 @@ class FileManager {
     }
 }
 exports.default = FileManager;
-//# sourceMappingURL=FileManager.js.map

package/lib/engine/Filesystem/FolderManager.js

@@ -107,7 +107,13 @@ class FolderManager {
                 let size;
                 if (osType === "windows") {
                     try {
-                        const stdout = yield this.WorkerProcess.execCommand(`powershell -command "(Get-ChildItem '${path}' -Recurse -Force | Measure-Object -Property Length -Sum).Sum"`);
+                        const stdout = yield this.WorkerProcess.execCommandSafely("powershell", [
+                            "-NoProfile",
+                            "-command",
+                            "(Get-ChildItem -LiteralPath $args[0] -Recurse -Force | Measure-Object -Property Length -Sum).Sum",
+                            "--",
+                            path,
+                        ]);
                         size = parseInt(stdout, 10) || 0;
                     }
                     catch (cmdError) {
@@ -117,7 +123,7 @@ class FolderManager {
                 }
                 else {
                     try {
-                        const stdout = yield this.WorkerProcess.execCommand(`du -sb "${path}" 2>/dev/null`);
+                        const stdout = yield this.WorkerProcess.execCommandSafely("du", ["-sb", path]);
                         size = parseInt(stdout.split("\t")[0], 10) || 0;
                     }
                     catch (cmdError) {
@@ -239,4 +245,3 @@ class FolderManager {
     }
 }
 exports.default = FolderManager;
-//# sourceMappingURL=FolderManager.js.map

package/lib/engine/node/WorkerForDataLoad.engine.js

@@ -67,4 +67,3 @@ processFiles().catch((error) => {
         worker_threads_1.parentPort.postMessage({ error: String(error) });
     }
 });
-//# sourceMappingURL=WorkerForDataLoad.engine.js.map

package/lib/engine/node/WorkerForSearch.engine.js

@@ -22,4 +22,3 @@ for (let i = 0; i < chunkLength; i++) {
 if (worker_threads_1.parentPort) {
     worker_threads_1.parentPort.postMessage(result);
 }
-//# sourceMappingURL=WorkerForSearch.engine.js.map

package/lib/server/config/PortFreeChecker.js

@@ -43,4 +43,3 @@ function checkPortAndDocker(port) {
         }
     });
 }
-//# sourceMappingURL=PortFreeChecker.js.map

package/lib/server/config/keys.d.ts

@@ -17,6 +17,12 @@ export declare const CORS_CONFIG: {
     ALLOW_CREDENTIALS: boolean;
 };
 export declare const staticPath: string;
+/**
+ * Security headers applied to every HTTP response.
+ * CSP allows 'unsafe-inline' only for styles: the GUI injects CSS via JS,
+ * while all scripts are external (self).
+ */
+export declare const SECURITY_HEADERS: Record<string, string>;
 interface MainRoutesInterface {
     method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
     path: string;

package/lib/server/config/keys.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorInfo = exports.AvailableRoutes = exports.staticPath = exports.CORS_CONFIG = exports.ServerKeys = void 0;
+exports.AuthorInfo = exports.AvailableRoutes = exports.SECURITY_HEADERS = exports.staticPath = exports.CORS_CONFIG = exports.ServerKeys = void 0;
 const path_1 = __importDefault(require("path"));
 var ServerKeys;
 (function (ServerKeys) {
@@ -29,6 +29,19 @@ exports.CORS_CONFIG = {
     ALLOW_CREDENTIALS: true,
 };
 exports.staticPath = path_1.default.resolve(__dirname, "../public/AxioControl");
+/**
+ * Security headers applied to every HTTP response.
+ * CSP allows 'unsafe-inline' only for styles: the GUI injects CSS via JS,
+ * while all scripts are external (self).
+ */
+exports.SECURITY_HEADERS = {
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY",
+    "Referrer-Policy": "no-referrer",
+    "X-XSS-Protection": "1; mode=block",
+    "Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=()",
+    "Content-Security-Policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'",
+};
 exports.AvailableRoutes = [
     {
         groupName: "Information",
@@ -309,4 +322,3 @@ exports.AuthorInfo = {
     LinkedIn: "https://www.linkedin.com/in/theankansaha/",
     github: "https://github.com/AnkanSaha",
 };
-//# sourceMappingURL=keys.js.map

package/lib/server/config/server.js

@@ -55,6 +55,11 @@ function createAxioDBControlServer(AxioDBInstance_1) {
         // Cookie support for session-based authentication (no signing secret needed -
         // the cookie value is meaningless without a matching entry in SessionStore's map)
         yield AxioDBControlServer.register(cookie_1.default);
+        AxioDBControlServer.addHook("onSend", (_request, reply) => __awaiter(this, void 0, void 0, function* () {
+            for (const [header, value] of Object.entries(keys_1.SECURITY_HEADERS)) {
+                reply.header(header, value);
+            }
+        }));
         AxioDBControlServer.addContentTypeParser("application/json", { parseAs: "string", bodyLimit: 52428800 }, (req, body, done) => {
             try {
                 const json = JSON.parse(body);
@@ -102,4 +107,3 @@ function createAxioDBControlServer(AxioDBInstance_1) {
         }
     });
 }
-//# sourceMappingURL=server.js.map

package/lib/server/controller/Auth/Auth.controller.js

@@ -159,4 +159,3 @@ class AuthController {
     }
 }
 exports.default = AuthController;
-//# sourceMappingURL=Auth.controller.js.map

package/lib/server/controller/Auth/RoleManagement.controller.js

@@ -96,4 +96,3 @@ class RoleManagementController {
     }
 }
 exports.default = RoleManagementController;
-//# sourceMappingURL=RoleManagement.controller.js.map

package/lib/server/controller/Auth/UserManagement.controller.js

@@ -124,4 +124,3 @@ class UserManagementController {
     }
 }
 exports.default = UserManagementController;
-//# sourceMappingURL=UserManagement.controller.js.map

package/lib/server/controller/Collections/Collection.controller.js

@@ -111,4 +111,3 @@ class CollectionController {
     }
 }
 exports.default = CollectionController;
-//# sourceMappingURL=Collection.controller.js.map

package/lib/server/controller/Database/Databse.controller.js

@@ -55,6 +55,7 @@ const promises_1 = require("node:stream/promises");
 const Permissions_1 = require("../../../config/Keys/Permissions");
 const Logger_helper_1 = __importDefault(require("../../../Helper/Logger.helper"));
 const databaseImport_helper_1 = require("../../helper/databaseImport.helper");
+const SafeErrorMessage_helper_1 = __importDefault(require("../../../Helper/SafeErrorMessage.helper"));
 class DatabaseController {
     constructor(AxioDBInstance) {
         this.AxioDBInstance = AxioDBInstance;
@@ -178,7 +179,7 @@ class DatabaseController {
                 return reply.status(500).send({
                     success: false,
                     message: "Error exporting database",
-                    error: error instanceof Error ? error.message : String(error),
+                    error: SafeErrorMessage_helper_1.default.sanitize(error),
                 });
             }
         });
@@ -320,4 +321,3 @@ class DatabaseController {
     }
 }
 exports.default = DatabaseController;
-//# sourceMappingURL=Databse.controller.js.map

package/lib/server/controller/Index/Index.controller.js

@@ -124,4 +124,3 @@ class IndexController {
     }
 }
 exports.default = IndexController;
-//# sourceMappingURL=Index.controller.js.map

package/lib/server/controller/Operation/CRUD.controller.js

@@ -334,4 +334,3 @@ class CRUDController {
     }
 }
 exports.default = CRUDController;
-//# sourceMappingURL=CRUD.controller.js.map

package/lib/server/controller/Stats.controller.js

@@ -102,4 +102,3 @@ class StatsController {
     }
 }
 exports.default = StatsController;
-//# sourceMappingURL=Stats.controller.js.map

package/lib/server/helper/databaseImport.helper.js

@@ -117,4 +117,3 @@ function claimImport(databaseName, username) {
 function releaseImport(databaseName) {
     activeImports.delete(databaseName);
 }
-//# sourceMappingURL=databaseImport.helper.js.map

package/lib/server/helper/documentCounterInFolder.helper.js

@@ -32,4 +32,3 @@ function countDocumentsInFolder(folderPath) {
         return items.filter((item) => item.isFile() && item.name.endsWith(Keys_1.General.DBMS_File_EXT)).length;
     });
 }
-//# sourceMappingURL=documentCounterInFolder.helper.js.map

package/lib/server/helper/responseBuilder.helper.js

@@ -19,4 +19,3 @@ function sendResponse(reply, response) {
     reply.code(response.statusCode);
     return response;
 }
-//# sourceMappingURL=responseBuilder.helper.js.map

package/lib/server/middleware/auth.middleware.js

@@ -61,4 +61,3 @@ function requireFreshPassword(request, reply) {
         }
     });
 }
-//# sourceMappingURL=auth.middleware.js.map

package/lib/server/middleware/permission.middleware.js

@@ -33,4 +33,3 @@ function requirePermission(permissionKey) {
         });
     };
 }
-//# sourceMappingURL=permission.middleware.js.map