badmfck-api-server 3.8.1 → 3.8.2

package/dist/apiServer/APIService.js

@@ -95,7 +95,7 @@ async function Initializer(services) {
 exports.Initializer = Initializer;
 class APIService extends BaseService_1.BaseService {
     static nextLogID = 0;
-    version = "3.8.1";
+    version = "3.8.2";
     options;
     monitor = null;
     started = new Date();

package/dist/apiServer/db/MysqlAdapter.d.ts

@@ -48,6 +48,7 @@ export declare class MysqlAdapter implements IDBAdapter {
     query(request: IDBQuery, conn?: mysql.PoolConnection): Promise<IDBResult>;
     finalizeConnection(conn: mysql.PoolConnection): void;
     prepareQuery(request: IDBQuery): string;
+    static safeReplace(query: string, key: string, value: string): string;
     static prepareQueryFieldValue(field: IDBQueryField): string | number | boolean | null | undefined;
     prepareCountQuery(query: string): string;
     commit(trx: ITransaction): Promise<IDBError | null>;

package/dist/apiServer/db/MysqlAdapter.js

@@ -519,7 +519,7 @@ class MysqlAdapter {
                     queryField.name = name.replaceAll("`", '').replaceAll('\"', "").replaceAll('\'', "");
                 fields[i] = queryField;
                 const parsed = MysqlAdapter.prepareQueryFieldValue(fields[i]);
-                query = query.replaceAll("@" + name, parsed + "");
+                query = MysqlAdapter.safeReplace(query, "@" + name, parsed + "");
             }
         }
         const tmp = query.toLowerCase();
@@ -538,9 +538,8 @@ class MysqlAdapter {
                 insertFieldNames.push('`' + f.name + '`');
                 insertFieldValues.push(f.__parsedValue);
             }
-            query = query
-                .replaceAll('@fields', insertFieldNames.join(","))
-                .replaceAll('@values', insertFieldValues.join(","));
+            query = MysqlAdapter.safeReplace(query, "@fields", insertFieldNames.join(","));
+            query = MysqlAdapter.safeReplace(query, "@values", insertFieldValues.join(","));
         }
         if (query.indexOf("@insert") !== -1) {
             let oninsertNames = [];
@@ -554,7 +553,7 @@ class MysqlAdapter {
                 oninsertNames.push(f.name);
                 oninsertValues.push(f.__parsedValue);
             }
-            query = query.replaceAll("@insert", `(${oninsertNames.join(",")}) VALUES (${oninsertValues.join(",")})`);
+            query = MysqlAdapter.safeReplace(query, "@insert", `(${oninsertNames.join(",")}) VALUES (${oninsertValues.join(",")})`);
         }
         if (query.indexOf("@onupdate") !== -1) {
             let onUpdate = [];
@@ -566,7 +565,7 @@ class MysqlAdapter {
                     continue;
                 onUpdate.push('`' + f.name + '` = ' + f.__parsedValue);
             }
-            query = query.replaceAll("@onupdate", onUpdate.join(" , "));
+            query = MysqlAdapter.safeReplace(query, "@onupdate", onUpdate.join(" , "));
         }
         if (query.indexOf('@onduplicate') !== -1) {
             let onDuplicate = [];
@@ -578,10 +577,14 @@ class MysqlAdapter {
                     continue;
                 onDuplicate.push('`' + f.name + '` = ' + f.__parsedValue);
             }
-            query = query.replaceAll("@onduplicate", onDuplicate.join(" , "));
+            query = MysqlAdapter.safeReplace(query, "@onduplicate", onDuplicate.join(" , "));
         }
         return query;
     }
+    static safeReplace(query, key, value) {
+        const regex = new RegExp(key + "(?=\\b|\\s|,|\\)|$)", "g");
+        return query.replace(regex, value);
+    }
     static prepareQueryFieldValue(field) {
         let value = field.value;
         let system = field.system;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "badmfck-api-server",
-  "version": "3.8.1",
+  "version": "3.8.2",
   "description": "Simple API http server based on express",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",