chanjs 2.7.11 → 2.7.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/core/Repository.js +9 -0
- package/package.json +1 -1
package/core/Repository.js
CHANGED
|
@@ -10,6 +10,14 @@ import {
|
|
|
10
10
|
const SORT_FIELD_REGEX = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
|
|
11
11
|
const OPERATORS = { $like:'like', $gt:'>', $gte:'>=', $lt:'<', $lte:'<=', $ne:'<>' };
|
|
12
12
|
|
|
13
|
+
/**
|
|
14
|
+
* 分页/分页相关保留字，不可能是合法的 WHERE 过滤列。
|
|
15
|
+
* 某些 controller 会把整个 req.query（含 pageSize/current/page）透传给 Repository.query，
|
|
16
|
+
* 若不加拦截会被 applyQuery 当成过滤字段拼进 SQL（如 `where pageSize = '20'`），
|
|
17
|
+
* 既报错又泄露分页语义。统一在此剥离，避免每个接口各自兜底。
|
|
18
|
+
*/
|
|
19
|
+
const PAGINATION_KEYS = new Set(['current', 'page', 'pageNum', 'pageSize', 'limit', 'offset']);
|
|
20
|
+
|
|
13
21
|
/** 查询条件是否存在至少一个合法字段 */
|
|
14
22
|
const hasValidQueryField = query =>
|
|
15
23
|
Object.keys(query).some(f => SORT_FIELD_REGEX.test(f));
|
|
@@ -34,6 +42,7 @@ const guardInvalidQuery = query => {
|
|
|
34
42
|
*/
|
|
35
43
|
function applyQuery(dbQuery, query) {
|
|
36
44
|
for (const [field, val] of Object.entries(query)) {
|
|
45
|
+
if (PAGINATION_KEYS.has(field)) continue; // 分页参数不是过滤列，直接跳过
|
|
37
46
|
if (!SORT_FIELD_REGEX.test(field)) {
|
|
38
47
|
logger.warn(`[Repository] 非法查询字段：${field}`);
|
|
39
48
|
continue;
|