d1s 0.2.10 → 0.2.12

package/dist/lib/data-type-handlers.js

@@ -0,0 +1,426 @@
+/**
+ * Data Type Handlers for Enhanced Database Operations
+ * Provides validation, formatting, and display logic for various data types
+ */
+
+/**
+ * UUID validation regex - supports all UUID versions (1-5)
+ */
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+/**
+ * Data type handlers with validation, formatting, and display logic
+ */
+export const DataTypeHandlers = {
+  uuid: {
+    validate: (value) => {
+      if (!value || typeof value !== 'string') return false;
+      return UUID_REGEX.test(value);
+    },
+    format: (value) => {
+      if (!value) return null;
+      return value.toLowerCase().trim();
+    },
+    display: (value) => {
+      if (!value) return '';
+      if (value.length <= 16) return value;
+      return value.substring(0, 8) + '...' + value.substring(value.length - 8);
+    },
+    editComponent: 'input',
+    editProps: { 
+      type: 'text', 
+      placeholder: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+      pattern: UUID_REGEX.source,
+      title: 'Enter a valid UUID (e.g., 123e4567-e89b-12d3-a456-426614174000)'
+    }
+  },
+
+  text: {
+    validate: (value) => {
+      return typeof value === 'string' || value === null || value === undefined;
+    },
+    format: (value) => {
+      if (value === null || value === undefined) return null;
+      return String(value);
+    },
+    display: (value) => {
+      if (!value) return '';
+      if (value.length <= 50) return value;
+      return value.substring(0, 50) + '...';
+    },
+    editComponent: 'input',
+    editProps: { type: 'text' }
+  },
+
+  longText: {
+    validate: (value) => {
+      return typeof value === 'string' || value === null || value === undefined;
+    },
+    format: (value) => {
+      if (value === null || value === undefined) return null;
+      return String(value);
+    },
+    display: (value) => {
+      if (!value) return '';
+      if (value.length <= 100) return value;
+      return value.substring(0, 100) + '...';
+    },
+    editComponent: 'textarea',
+    editProps: { 
+      rows: 4,
+      placeholder: 'Enter long text content...'
+    }
+  },
+
+  json: {
+    validate: (value) => {
+      if (value === null || value === undefined) return true;
+      if (typeof value === 'string') {
+        try {
+          JSON.parse(value);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      return typeof value === 'object';
+    },
+    format: (value) => {
+      if (value === null || value === undefined) return null;
+      if (typeof value === 'string') {
+        try {
+          // Validate JSON by parsing, then return original string
+          JSON.parse(value);
+          return value;
+        } catch {
+          throw new Error('Invalid JSON format');
+        }
+      }
+      return JSON.stringify(value);
+    },
+    display: (value) => {
+      if (!value) return '';
+      const formatted = typeof value === 'string' ? value : JSON.stringify(value);
+      if (formatted.length <= 50) return formatted;
+      return formatted.substring(0, 50) + '...';
+    },
+    editComponent: 'textarea',
+    editProps: { 
+      rows: 6,
+      placeholder: 'Enter valid JSON...',
+      className: 'font-mono'
+    }
+  },
+
+  integer: {
+    validate: (value) => {
+      if (value === null || value === undefined) return true;
+      return Number.isInteger(Number(value));
+    },
+    format: (value) => {
+      if (value === null || value === undefined) return null;
+      const num = Number(value);
+      if (!Number.isInteger(num)) {
+        throw new Error('Value must be an integer');
+      }
+      return num;
+    },
+    display: (value) => {
+      if (value === null || value === undefined) return '';
+      return String(value);
+    },
+    editComponent: 'input',
+    editProps: { 
+      type: 'number',
+      step: '1',
+      pattern: '[0-9-]+'
+    }
+  },
+
+  real: {
+    validate: (value) => {
+      if (value === null || value === undefined) return true;
+      return !isNaN(Number(value)) && isFinite(Number(value));
+    },
+    format: (value) => {
+      if (value === null || value === undefined) return null;
+      const num = Number(value);
+      if (isNaN(num) || !isFinite(num)) {
+        throw new Error('Value must be a valid number');
+      }
+      return num;
+    },
+    display: (value) => {
+      if (value === null || value === undefined) return '';
+      return String(value);
+    },
+    editComponent: 'input',
+    editProps: { 
+      type: 'number',
+      step: 'any'
+    }
+  },
+
+  boolean: {
+    validate: (value) => {
+      if (value === null || value === undefined) return true;
+      return typeof value === 'boolean' || value === 'true' || value === 'false' || value === 1 || value === 0;
+    },
+    format: (value) => {
+      if (value === null || value === undefined) return null;
+      if (typeof value === 'boolean') return value;
+      if (value === 'true' || value === 1) return true;
+      if (value === 'false' || value === 0) return false;
+      throw new Error('Value must be a boolean');
+    },
+    display: (value) => {
+      if (value === null || value === undefined) return '';
+      return value ? 'true' : 'false';
+    },
+    editComponent: 'select',
+    editProps: {
+      options: [
+        { value: '', label: 'NULL' },
+        { value: 'true', label: 'True' },
+        { value: 'false', label: 'False' }
+      ]
+    }
+  },
+
+  date: {
+    validate: (value) => {
+      if (value === null || value === undefined) return true;
+      return !isNaN(Date.parse(value));
+    },
+    format: (value) => {
+      if (value === null || value === undefined) return null;
+      const date = new Date(value);
+      if (isNaN(date.getTime())) {
+        throw new Error('Value must be a valid date');
+      }
+      return date.toISOString().split('T')[0];
+    },
+    display: (value) => {
+      if (!value) return '';
+      return value;
+    },
+    editComponent: 'input',
+    editProps: { type: 'date' }
+  },
+
+  datetime: {
+    validate: (value) => {
+      if (value === null || value === undefined) return true;
+      return !isNaN(Date.parse(value));
+    },
+    format: (value) => {
+      if (value === null || value === undefined) return null;
+      const date = new Date(value);
+      if (isNaN(date.getTime())) {
+        throw new Error('Value must be a valid datetime');
+      }
+      return date.toISOString();
+    },
+    display: (value) => {
+      if (!value) return '';
+      return new Date(value).toLocaleString();
+    },
+    editComponent: 'input',
+    editProps: { type: 'datetime-local' }
+  },
+
+  blob: {
+    validate: (value) => {
+      // For blob data, we typically handle as base64 strings or Buffer objects
+      if (value === null || value === undefined) return true;
+      return typeof value === 'string' || Buffer.isBuffer(value);
+    },
+    format: (value) => {
+      if (value === null || value === undefined) return null;
+      return value; // Keep as-is for blob data
+    },
+    display: (value) => {
+      if (!value) return '';
+      if (typeof value === 'string') {
+        return `<BLOB: ${value.length} chars>`;
+      }
+      if (Buffer.isBuffer(value)) {
+        return `<BLOB: ${value.length} bytes>`;
+      }
+      return '<BLOB>';
+    },
+    editComponent: 'input',
+    editProps: { 
+      type: 'file',
+      accept: '*/*'
+    }
+  }
+};
+
+/**
+ * Detects the data type of a value based on its content
+ * @param {any} value - The value to analyze
+ * @returns {string} - The detected data type
+ */
+export function detectDataType(value) {
+  if (value === null || value === undefined) return 'text';
+  
+  if (typeof value === 'string') {
+    // Check for UUID pattern
+    if (UUID_REGEX.test(value)) return 'uuid';
+    
+    // Check for JSON
+    try {
+      JSON.parse(value);
+      return 'json';
+    } catch {
+      // Not JSON, continue checking
+    }
+    
+    // Check for date/datetime
+    if (!isNaN(Date.parse(value))) {
+      // Simple heuristic: if it looks like a full datetime, classify as datetime
+      if (value.includes('T') || value.includes(' ')) return 'datetime';
+      return 'date';
+    }
+    
+    // Check for boolean
+    if (value === 'true' || value === 'false') return 'boolean';
+    
+    // Check for number
+    if (!isNaN(Number(value)) && isFinite(Number(value))) {
+      return Number.isInteger(Number(value)) ? 'integer' : 'real';
+    }
+    
+    // Long text heuristic
+    if (value.length > 255) return 'longText';
+    
+    return 'text';
+  }
+  
+  if (typeof value === 'number') {
+    return Number.isInteger(value) ? 'integer' : 'real';
+  }
+  
+  if (typeof value === 'boolean') return 'boolean';
+  
+  if (typeof value === 'object') return 'json';
+  
+  if (Buffer.isBuffer(value)) return 'blob';
+  
+  return 'text';
+}
+
+/**
+ * Gets the appropriate data type handler for a value
+ * @param {any} value - The value to get a handler for
+ * @returns {Object} - The data type handler
+ */
+export function getDataTypeHandler(value) {
+  const type = detectDataType(value);
+  return DataTypeHandlers[type] || DataTypeHandlers.text;
+}
+
+/**
+ * Validates a value against its detected or specified data type
+ * @param {any} value - The value to validate
+ * @param {string} dataType - Optional explicit data type
+ * @returns {boolean} - True if valid
+ */
+export function validateValue(value, dataType = null) {
+  const type = dataType || detectDataType(value);
+  const handler = DataTypeHandlers[type];
+  
+  if (!handler) {
+    throw new Error(`Unknown data type: ${type}`);
+  }
+  
+  return handler.validate(value);
+}
+
+/**
+ * Formats a value according to its data type
+ * @param {any} value - The value to format
+ * @param {string} dataType - Optional explicit data type
+ * @returns {any} - The formatted value
+ */
+export function formatValue(value, dataType = null) {
+  const type = dataType || detectDataType(value);
+  const handler = DataTypeHandlers[type];
+  
+  if (!handler) {
+    throw new Error(`Unknown data type: ${type}`);
+  }
+  
+  return handler.format(value);
+}
+
+/**
+ * Gets display representation of a value
+ * @param {any} value - The value to display
+ * @param {string} dataType - Optional explicit data type
+ * @returns {string} - The display string
+ */
+export function getDisplayValue(value, dataType = null) {
+  const type = dataType || detectDataType(value);
+  const handler = DataTypeHandlers[type];
+  
+  if (!handler) {
+    return String(value || '');
+  }
+  
+  return handler.display(value);
+}
+
+/**
+ * Enhanced WHERE clause builder with UUID support
+ * @param {Object} conditions - Conditions object
+ * @param {Object} options - Options for comparison operators
+ * @returns {Object} - WHERE clause and parameters
+ */
+export function buildEnhancedWhereClause(conditions, options = {}) {
+  if (!conditions || typeof conditions !== 'object') {
+    throw new Error('Conditions must be an object');
+  }
+
+  const entries = Object.entries(conditions);
+  if (entries.length === 0) {
+    return { whereClause: '', params: [] };
+  }
+
+  const clauses = [];
+  const params = [];
+
+  for (const [column, value] of entries) {
+    const operator = options.operators?.[column] || '=';
+    const dataType = options.dataTypes?.[column] || detectDataType(value);
+    
+    // Handle different operators
+    if (operator === 'LIKE') {
+      clauses.push(`${column} LIKE ?`);
+      params.push(`%${value}%`);
+    } else if (operator === 'IN') {
+      if (!Array.isArray(value)) {
+        throw new Error(`IN operator requires an array value for column ${column}`);
+      }
+      const placeholders = value.map(() => '?').join(', ');
+      clauses.push(`${column} IN (${placeholders})`);
+      params.push(...value);
+    } else if (operator === 'BETWEEN') {
+      if (!Array.isArray(value) || value.length !== 2) {
+        throw new Error(`BETWEEN operator requires an array of 2 values for column ${column}`);
+      }
+      clauses.push(`${column} BETWEEN ? AND ?`);
+      params.push(value[0], value[1]);
+    } else {
+      // Standard operators: =, !=, <, >, <=, >=
+      clauses.push(`${column} ${operator} ?`);
+      params.push(formatValue(value, dataType));
+    }
+  }
+
+  return {
+    whereClause: clauses.join(' AND '),
+    params: params
+  };
+}

package/dist/lib/sql-operations.js

@@ -2,6 +2,7 @@
 
 import { promisify } from 'util';
 import { exec } from 'child_process';
+import { sanitizeTableName, sanitizeColumnName, createParameterizedQuery } from './sql-sanitizer.js';
 import logger from '@/lib/logger';
 
 const execAsync = promisify(exec);
@@ -226,8 +227,16 @@ export function removeSQLComments(sql) {
  * @returns {Promise<boolean>} True if the table exists; otherwise, false.
  */
 export async function tableExists(projectDir, databaseName, env, tableName, remote = false) {
-  // Query the sqlite_master table for the given table name.
-  const query = `SELECT name FROM sqlite_master WHERE type='table' AND name = '${tableName}' COLLATE NOCASE;`;
+  // Validate and sanitize table name to prevent SQL injection
+  try {
+    sanitizeTableName(tableName); // This will throw if invalid
+  } catch (error) {
+    logger.error('Invalid table name:', tableName, error.message);
+    return false;
+  }
+  
+  // Query the sqlite_master table for the given table name using proper escaping
+  const query = `SELECT name FROM sqlite_master WHERE type='table' AND name = '${tableName.replace(/'/g, "''")}' COLLATE NOCASE;`;
 
   const result = await executeSQL(projectDir, databaseName, query, env, remote);
   try {
@@ -282,10 +291,18 @@ export async function executeSQL(projectDir, databaseName, sql, env = {}, remote
       }
     }
 
+    // Validate database name to prevent command injection
+    if (!databaseName || typeof databaseName !== 'string' || !/^[a-zA-Z0-9_-]+$/.test(databaseName)) {
+      throw new Error('Invalid database name for security reasons');
+    }
+
     const isWindows = process.platform === 'win32';
     const npxCommand = isWindows ? 'npx.cmd' : 'npx';
     const executionFlag = remote ? '--remote' : '--local';
-    const command = `${npxCommand} wrangler d1 execute ${databaseName} ${executionFlag} --command="${cleanSQL.replace(/"/g, '\\"')}"`;
+    
+    // Additional SQL escape for shell command execution
+    const shellEscapedSQL = cleanSQL.replace(/"/g, '\\"').replace(/\$/g, '\\$');
+    const command = `${npxCommand} wrangler d1 execute ${databaseName} ${executionFlag} --command="${shellEscapedSQL}"`;
     
     // Only log in development
     if (logger.shouldLog('debug')) {
@@ -357,8 +374,12 @@ export async function fetchRemoteTableData(
   limit,
   orderingColumn = "id"
 ) {
-  // Use the provided ordering column; if not provided, default to "id".
-  const query = `SELECT * FROM "${tableName}" ORDER BY "${orderingColumn}" DESC LIMIT ${limit};`;
+  // Validate and sanitize inputs to prevent SQL injection
+  const sanitizedTableName = sanitizeTableName(tableName);
+  const sanitizedColumn = sanitizeColumnName(orderingColumn);
+  const safeLimit = Math.max(1, Math.min(parseInt(limit) || 50, 1000)); // Cap limit to prevent large queries
+  
+  const query = `SELECT * FROM ${sanitizedTableName} ORDER BY ${sanitizedColumn} DESC LIMIT ${safeLimit};`;
   try {
     // Execute the SQL command on the remote database.
     const result = await executeSQL(projectDir, databaseName, query, env, true);
@@ -393,9 +414,12 @@ export async function fetchRemoteTableData(
 export function generateBulkInsertSQL(tableName, rows) {
   if (!rows || rows.length === 0) return '';
   
-  // Get the list of columns from the first row object.
+  // Validate and sanitize table name
+  const sanitizedTableName = sanitizeTableName(tableName);
+  
+  // Get the list of columns from the first row object and sanitize them
   const columns = Object.keys(rows[0]);
-  const columnList = columns.map(col => `"${col}"`).join(', ');
+  const columnList = columns.map(col => sanitizeColumnName(col)).join(', ');
 
   // Build the values list for each row.
   const valuesList = rows.map(row => {
@@ -408,7 +432,7 @@ export function generateBulkInsertSQL(tableName, rows) {
     return `(${values})`;
   }).join(', ');
 
-  return `INSERT INTO "${tableName}" (${columnList}) VALUES ${valuesList};`;
+  return `INSERT INTO ${sanitizedTableName} (${columnList}) VALUES ${valuesList};`;
 }
 
 // ---------------------------------------------------------------------