dbgate-api-premium 7.1.8 → 7.1.9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dbgate-api-premium",
   "main": "src/index.js",
-  "version": "7.1.8",
+  "version": "7.1.9",
   "homepage": "https://www.dbgate.io/",
   "repository": {
     "type": "git",
@@ -30,11 +30,11 @@
     "compare-versions": "^3.6.0",
     "cors": "^2.8.5",
     "cross-env": "^6.0.3",
-    "dbgate-datalib": "7.1.8",
+    "dbgate-datalib": "7.1.9",
     "dbgate-query-splitter": "^4.12.0",
-    "dbgate-rest": "7.1.8",
-    "dbgate-sqltree": "7.1.8",
-    "dbgate-tools": "7.1.8",
+    "dbgate-rest": "7.1.9",
+    "dbgate-sqltree": "7.1.9",
+    "dbgate-tools": "7.1.9",
     "debug": "^4.3.4",
     "diff": "^5.0.0",
     "diff2html": "^3.4.13",
@@ -88,7 +88,7 @@
   "devDependencies": {
     "@types/fs-extra": "^9.0.11",
     "@types/lodash": "^4.14.149",
-    "dbgate-types": "7.1.8",
+    "dbgate-types": "7.1.9",
     "env-cmd": "^10.1.0",
     "jsdoc-to-markdown": "^9.0.5",
     "node-loader": "^1.0.2",

package/src/controllers/archive.js

@@ -19,6 +19,26 @@ const unzipDirectory = require('../shell/unzipDirectory');
 
 const logger = getLogger('archive');
 
+/**
+ * Rejects any archive name (folder or file) that contains path-traversal
+ * sequences, directory separators, or null bytes. These values are used
+ * directly in path.join() calls; allowing traversal would let callers read
+ * or write arbitrary files outside the archive directory.
+ */
+function assertSafeArchiveName(name, label) {
+  if (typeof name !== 'string' || name.length === 0) {
+    throw new Error(`DBGM-00000 Invalid ${label}: must be a non-empty string`);
+  }
+  if (name.includes('\0') || name.includes('..') || name.includes('/') || name.includes('\\')) {
+    throw new Error(`DBGM-00000 Invalid ${label}: path traversal not allowed`);
+  }
+  // Reject names that resolve to the archive root itself (e.g. '.')
+  const resolved = path.resolve(archivedir(), name);
+  if (resolved === path.resolve(archivedir())) {
+    throw new Error(`DBGM-00000 Invalid ${label}: must not resolve to the archive root`);
+  }
+}
+
 module.exports = {
   folders_meta: true,
   async folders() {
@@ -39,6 +59,7 @@ module.exports = {
 
   createFolder_meta: true,
   async createFolder({ folder }) {
+    assertSafeArchiveName(folder, 'folder');
     await fs.mkdir(path.join(archivedir(), folder));
     socket.emitChanged('archive-folders-changed');
     return true;
@@ -46,8 +67,12 @@ module.exports = {
 
   createLink_meta: true,
   async createLink({ linkedFolder }) {
+    if ( typeof linkedFolder !== 'string' || linkedFolder.length === 0) {
+      throw new Error(`DBGM-00000 Invalid linkedFolder: must be a non-empty string`);
+    }
+    assertSafeArchiveName(path.parse(linkedFolder).name, 'linkedFolder');
     const folder = await this.getNewArchiveFolder({ database: path.parse(linkedFolder).name + '.link' });
-    fs.writeFile(path.join(archivedir(), folder), linkedFolder);
+    await fs.writeFile(path.join(archivedir(), folder), linkedFolder);
     clearArchiveLinksCache();
     socket.emitChanged('archive-folders-changed');
     return folder;
@@ -71,6 +96,8 @@ module.exports = {
 
   files_meta: true,
   async files({ folder }) {
+    if (!folder) return [];
+    assertSafeArchiveName(folder, 'folder');
     try {
       if (folder.endsWith('.zip')) {
         if (await fs.exists(path.join(archivedir(), folder))) {
@@ -121,6 +148,9 @@ module.exports = {
 
   createFile_meta: true,
   async createFile({ folder, file, fileType, tableInfo }) {
+    assertSafeArchiveName(folder, 'folder');
+    assertSafeArchiveName(file, 'file');
+    assertSafeArchiveName(fileType, 'fileType');
     await fs.writeFile(
       path.join(resolveArchiveFolder(folder), `${file}.${fileType}`),
       tableInfo ? JSON.stringify({ __isStreamHeader: true, tableInfo }) : ''
@@ -131,6 +161,9 @@ module.exports = {
 
   deleteFile_meta: true,
   async deleteFile({ folder, file, fileType }) {
+    assertSafeArchiveName(folder, 'folder');
+    assertSafeArchiveName(file, 'file');
+    assertSafeArchiveName(fileType, 'fileType');
     await fs.unlink(path.join(resolveArchiveFolder(folder), `${file}.${fileType}`));
     socket.emitChanged(`archive-files-changed`, { folder });
     return true;
@@ -138,6 +171,10 @@ module.exports = {
 
   renameFile_meta: true,
   async renameFile({ folder, file, newFile, fileType }) {
+    assertSafeArchiveName(folder, 'folder');
+    assertSafeArchiveName(file, 'file');
+    assertSafeArchiveName(newFile, 'newFile');
+    assertSafeArchiveName(fileType, 'fileType');
     await fs.rename(
       path.join(resolveArchiveFolder(folder), `${file}.${fileType}`),
       path.join(resolveArchiveFolder(folder), `${newFile}.${fileType}`)
@@ -148,6 +185,8 @@ module.exports = {
 
   modifyFile_meta: true,
   async modifyFile({ folder, file, changeSet, mergedRows, mergeKey, mergeMode }) {
+    assertSafeArchiveName(folder, 'folder');
+    assertSafeArchiveName(file, 'file');
     await jsldata.closeDataStore(`archive://${folder}/${file}`);
     const changedFilePath = path.join(resolveArchiveFolder(folder), `${file}.jsonl`);
 
@@ -187,6 +226,8 @@ module.exports = {
 
   renameFolder_meta: true,
   async renameFolder({ folder, newFolder }) {
+    assertSafeArchiveName(folder, 'folder');
+    assertSafeArchiveName(newFolder, 'newFolder');
     const uniqueName = await this.getNewArchiveFolder({ database: newFolder });
     await fs.rename(path.join(archivedir(), folder), path.join(archivedir(), uniqueName));
     socket.emitChanged(`archive-folders-changed`);
@@ -196,6 +237,7 @@ module.exports = {
   deleteFolder_meta: true,
   async deleteFolder({ folder }) {
     if (!folder) throw new Error('Missing folder parameter');
+    assertSafeArchiveName(folder, 'folder');
     if (folder.endsWith('.link') || folder.endsWith('.zip')) {
       await fs.unlink(path.join(archivedir(), folder));
     } else {
@@ -207,6 +249,8 @@ module.exports = {
 
   saveText_meta: true,
   async saveText({ folder, file, text }) {
+    assertSafeArchiveName(folder, 'folder');
+    assertSafeArchiveName(file, 'file');
     await fs.writeFile(path.join(resolveArchiveFolder(folder), `${file}.jsonl`), text);
     socket.emitChanged(`archive-files-changed`, { folder });
     return true;
@@ -214,6 +258,8 @@ module.exports = {
 
   saveJslData_meta: true,
   async saveJslData({ folder, file, jslid, changeSet }) {
+    assertSafeArchiveName(folder, 'folder');
+    assertSafeArchiveName(file, 'file');
     const source = getJslFileName(jslid);
     const target = path.join(resolveArchiveFolder(folder), `${file}.jsonl`);
     if (changeSet) {
@@ -232,11 +278,20 @@ module.exports = {
 
   saveRows_meta: true,
   async saveRows({ folder, file, rows }) {
-    const fileStream = fs.createWriteStream(path.join(resolveArchiveFolder(folder), `${file}.jsonl`));
+    assertSafeArchiveName(folder, 'folder');
+    assertSafeArchiveName(file, 'file');
+    const filePath = path.join(resolveArchiveFolder(folder), `${file}.jsonl`);
+    const fileStream = fs.createWriteStream(filePath);
     for (const row of rows) {
-      await fileStream.write(JSON.stringify(row) + '\n');
+      const ok = fileStream.write(JSON.stringify(row) + '\n');
+      if (!ok) {
+        await new Promise(resolve => fileStream.once('drain', resolve));
+      }
     }
-    await fileStream.close();
+    await new Promise((resolve, reject) => {
+      fileStream.end(() => resolve());
+      fileStream.on('error', reject);
+    });
     socket.emitChanged(`archive-files-changed`, { folder });
     return true;
   },
@@ -256,6 +311,8 @@ module.exports = {
 
   getArchiveData_meta: true,
   async getArchiveData({ folder, file }) {
+    assertSafeArchiveName(folder, 'folder');
+    assertSafeArchiveName(file, 'file');
     let rows;
     if (folder.endsWith('.zip')) {
       rows = await unzipJsonLinesFile(path.join(archivedir(), folder), `${file}.jsonl`);
@@ -270,7 +327,7 @@ module.exports = {
     if (!fileName?.endsWith('.zip')) {
       throw new Error(`${fileName} is not a ZIP file`);
     }
-
+    assertSafeArchiveName(fileName.slice(0, -4), 'fileName');
     const folder = await this.getNewArchiveFolder({ database: fileName });
     await fs.copyFile(filePath, path.join(archivedir(), folder));
     socket.emitChanged(`archive-folders-changed`);
@@ -280,6 +337,7 @@ module.exports = {
 
   zip_meta: true,
   async zip({ folder }) {
+    assertSafeArchiveName(folder, 'folder');
     const newFolder = await this.getNewArchiveFolder({ database: folder + '.zip' });
     await zipDirectory(path.join(archivedir(), folder), path.join(archivedir(), newFolder));
     socket.emitChanged(`archive-folders-changed`);
@@ -289,6 +347,7 @@ module.exports = {
 
   unzip_meta: true,
   async unzip({ folder }) {
+    assertSafeArchiveName(folder, 'folder');
     const newFolder = await this.getNewArchiveFolder({ database: folder.slice(0, -4) });
     await unzipDirectory(path.join(archivedir(), folder), path.join(archivedir(), newFolder));
     socket.emitChanged(`archive-folders-changed`);
@@ -298,6 +357,7 @@ module.exports = {
 
   getZippedPath_meta: true,
   async getZippedPath({ folder }) {
+    assertSafeArchiveName(folder, 'folder');
     if (folder.endsWith('.zip')) {
       return { filePath: path.join(archivedir(), folder) };
     }

package/src/controllers/runners.js

@@ -10,6 +10,7 @@ const {
   extractShellApiPlugins,
   compileShellApiFunctionName,
   jsonScriptToJavascript,
+  assertValidShellApiFunctionName,
   getLogger,
   safeJsonParse,
   pinoLogRecordToMessageRecord,
@@ -54,19 +55,23 @@ logger.info('DBGM-00014 Finished job script');
 dbgateApi.runScript(run);
 `;
 
-const loaderScriptTemplate = (prefix, functionName, props, runid) => `
+const loaderScriptTemplate = (functionName, props, runid) => {
+  const plugins = extractShellApiPlugins(functionName, props);
+  const prefix = plugins.map(packageName => `// @require ${packageName}\n`).join('');
+  return `
 ${prefix}
 const dbgateApi = require(process.env.DBGATE_API);
 dbgateApi.initializeApiEnvironment();
-${requirePluginsTemplate(extractShellApiPlugins(functionName, props))}
+${requirePluginsTemplate(plugins)}
 require=null;
 async function run() {
 const reader=await ${compileShellApiFunctionName(functionName)}(${JSON.stringify(props)});
-const writer=await dbgateApi.collectorWriter({runid: '${runid}'});
+const writer=await dbgateApi.collectorWriter({runid: ${JSON.stringify(runid)}});
 await dbgateApi.copyStream(reader, writer);
 }
 dbgateApi.runScript(run);
 `;
+};
 
 module.exports = {
   /** @type {import('dbgate-types').OpenedRunner[]} */
@@ -377,14 +382,12 @@ module.exports = {
         return { errorMessage: 'DBGM-00289 Unallowed file' };
       }
     }
-    const prefix = extractShellApiPlugins(functionName)
-      .map(packageName => `// @require ${packageName}\n`)
-      .join('');
 
     const promise = new Promise((resolve, reject) => {
+      assertValidShellApiFunctionName(functionName);
       const runid = crypto.randomUUID();
       this.requests[runid] = { resolve, reject, exitOnStreamError: true };
-      this.startCore(runid, loaderScriptTemplate(prefix, functionName, props, runid));
+      this.startCore(runid, loaderScriptTemplate(functionName, props, runid));
     });
     return promise;
   },

package/src/currentVersion.js

@@ -1,5 +1,5 @@
 
 module.exports = { 
-  version: '7.1.8',
-  buildTime: '2026-04-09T13:37:40.330Z'
+  version: '7.1.9',
+  buildTime: '2026-04-22T11:39:40.647Z'
 };

package/src/shell/unzipDirectory.js

@@ -16,23 +16,53 @@ function unzipDirectory(zipPath, outputDirectory) {
   return new Promise((resolve, reject) => {
     yauzl.open(zipPath, { lazyEntries: true }, (err, zipFile) => {
       if (err) return reject(err);
-
+      let settled = false;
+      /** Track active streams so we can destroy them on early abort */
+      const activeStreams = new Set();
+      const safeReject = rejectErr => {
+        if (settled) return;
+        settled = true;
+        for (const s of activeStreams) {
+          s.destroy();
+        }
+        activeStreams.clear();
+        zipFile.close();
+        reject(rejectErr);
+      };
       /** Pending per-file extractions – we resolve the main promise after they’re all done */
       const pending = [];
 
+      // Resolved output boundary used for zip-slip checks on every entry
+      const resolvedOutputDir = path.resolve(outputDirectory);
+
       // kick things off
       zipFile.readEntry();
 
       zipFile.on('entry', entry => {
+        // Null-byte poison check
+        if (entry.fileName.includes('\0')) {
+          return safeReject(new Error(`DBGM-00000 ZIP entry with null byte in filename rejected`));
+        }
+
         const destPath = path.join(outputDirectory, entry.fileName);
+        const resolvedDest = path.resolve(destPath);
+
+        // Zip-slip protection: every extracted path must stay inside outputDirectory
+        if (resolvedDest !== resolvedOutputDir && !resolvedDest.startsWith(resolvedOutputDir + path.sep)) {
+          return safeReject(
+            new Error(`DBGM-00000 ZIP slip detected: entry "${entry.fileName}" would escape output directory`)
+          );
+        }
 
         // Handle directories (their names always end with “/” in ZIPs)
         if (/\/$/.test(entry.fileName)) {
           // Ensure directory exists, then continue to next entry
           fs.promises
             .mkdir(destPath, { recursive: true })
-            .then(() => zipFile.readEntry())
-            .catch(reject);
+            .then(() => {
+              if (!settled) zipFile.readEntry();
+            })
+            .catch(safeReject);
           return;
         }
 
@@ -46,17 +76,29 @@ function unzipDirectory(zipPath, outputDirectory) {
                   if (err) return rej(err);
 
                   const writeStream = fs.createWriteStream(destPath);
+                  activeStreams.add(readStream);
+                  activeStreams.add(writeStream);
                   readStream.pipe(writeStream);
 
-                  // proceed to next entry once we’ve consumed *this* one
-                  readStream.on('end', () => zipFile.readEntry());
+                  // proceed to next entry once we've consumed *this* one
+                  readStream.on('end', () => {
+                    activeStreams.delete(readStream);
+                    if (!settled) zipFile.readEntry();
+                  });
+
+                  readStream.on('error', readErr => {
+                    activeStreams.delete(readStream);
+                    rej(readErr);
+                  });
 
                   writeStream.on('finish', () => {
+                    activeStreams.delete(writeStream);
                     logger.info(`DBGM-00068 Extracted "${entry.fileName}" → "${destPath}".`);
                     res();
                   });
 
                   writeStream.on('error', writeErr => {
+                    activeStreams.delete(writeStream);
                     logger.error(
                       extractErrorLogData(writeErr),
                       `DBGM-00069 Error extracting "${entry.fileName}" from "${zipPath}".`
@@ -67,22 +109,29 @@ function unzipDirectory(zipPath, outputDirectory) {
               })
           );
 
+        // Immediately abort the whole unzip if this file fails; otherwise the
+        // zip would never emit 'end' (lazyEntries won't advance without readEntry).
+        filePromise.catch(safeReject);
         pending.push(filePromise);
       });
 
       // Entire archive enumerated; wait for all streams to finish
       zipFile.on('end', () => {
+        if (settled) return;
         Promise.all(pending)
           .then(() => {
+            if (settled) return;
+            settled = true;
+            zipFile.close();
             logger.info(`DBGM-00070 Archive "${zipPath}" fully extracted to "${outputDirectory}".`);
             resolve(true);
           })
-          .catch(reject);
+          .catch(safeReject);
       });
 
       zipFile.on('error', err => {
         logger.error(extractErrorLogData(err), `DBGM-00071 ZIP file error in ${zipPath}.`);
-        reject(err);
+        safeReject(err);
       });
     });
   });

package/src/utility/cloudIntf.js

@@ -1,4 +1,5 @@
 const axios = require('axios');
+const https = require('https');
 const crypto = require('crypto');
 const fs = require('fs-extra');
 const _ = require('lodash');
@@ -36,6 +37,15 @@ const DBGATE_CLOUD_URL = process.env.LOCAL_DBGATE_CLOUD
   ? 'https://cloud.dbgate.udolni.net'
   : 'https://cloud.dbgate.io';
 
+
+const DBGATE_PUBLIC_CLOUD_URL =
+  DBGATE_CLOUD_URL === 'https://cloud.dbgate.io' ? 'https://api.dbgate.cloud' : DBGATE_CLOUD_URL;
+
+const stageAxiosConfig =
+  !process.env.PROD_DBGATE_CLOUD && (process.env.DEVWEB || process.env.DEVMODE)
+    ? { httpsAgent: new https.Agent({ rejectUnauthorized: false }) }
+    : {};
+
 async function createDbGateIdentitySession(client, redirectUri) {
   const resp = await axios.default.post(
     `${DBGATE_IDENTITY_URL}/api/create-session`,
@@ -48,6 +58,7 @@ async function createDbGateIdentitySession(client, redirectUri) {
         ...getLicenseHttpHeaders(),
         'Content-Type': 'application/json',
       },
+      ...stageAxiosConfig,
     }
   );
   return {
@@ -70,6 +81,7 @@ function startCloudTokenChecking(sid, callback) {
         headers: {
           ...getLicenseHttpHeaders(),
         },
+        ...stageAxiosConfig,
       });
       // console.log('CHECK RESP:', resp.data);
 
@@ -88,6 +100,7 @@ async function readCloudTokenHolder(sid) {
     headers: {
       ...getLicenseHttpHeaders(),
     },
+    ...stageAxiosConfig,
   });
   if (resp.data?.email) {
     return resp.data;
@@ -103,6 +116,7 @@ async function readCloudTestTokenHolder(email) {
       headers: {
         ...getLicenseHttpHeaders(),
       },
+      ...stageAxiosConfig,
     }
   );
   if (resp.data?.email) {
@@ -210,9 +224,9 @@ async function updateCloudFiles(isRefresh, language) {
   logger.info({ tags, lastCheckedTm }, 'DBGM-00082 Downloading cloud files');
 
   const resp = await axios.default.get(
-    `${DBGATE_CLOUD_URL}/public-cloud-updates?lastCheckedTm=${lastCheckedTm}&tags=${tags}&isRefresh=${
+    `${DBGATE_PUBLIC_CLOUD_URL}/public-cloud-updates?lastCheckedTm=${lastCheckedTm}&tags=${tags}&isRefresh=${
       isRefresh ? 1 : 0
-    }`,
+    }}`,
     {
       headers: {
         ...getLicenseHttpHeaders(),
@@ -220,6 +234,7 @@ async function updateCloudFiles(isRefresh, language) {
         'x-app-version': currentVersion.version,
         'x-app-language': language || 'en',
       },
+      ...stageAxiosConfig,
     }
   );
 
@@ -254,10 +269,11 @@ async function getPublicCloudFiles() {
 }
 
 async function getPublicFileData(path) {
-  const resp = await axios.default.get(`${DBGATE_CLOUD_URL}/public/${path}`, {
+  const resp = await axios.default.get(`${DBGATE_PUBLIC_CLOUD_URL}/public/${path}`, {
     headers: {
       ...getLicenseHttpHeaders(),
     },
+    ...stageAxiosConfig,
   });
   return resp.data;
 }
@@ -289,6 +305,7 @@ async function updatePremiumPromoWidget(language) {
         'x-app-version': currentVersion.version,
         'x-app-language': language || 'en',
       },
+      ...stageAxiosConfig,
     }
   );
 
@@ -336,6 +353,7 @@ async function callCloudApiGet(endpoint, signinHolder = null, additionalHeaders
       ...additionalHeaders,
     },
     validateStatus: status => status < 500,
+    ...stageAxiosConfig,
   });
   const { errorMessage, isLicenseLimit, limitedLicenseLimits } = resp.data;
   if (errorMessage) {
@@ -374,6 +392,7 @@ async function callCloudApiPost(endpoint, body, signinHolder = null) {
       ...signinHeaders,
     },
     validateStatus: status => status < 500,
+    ...stageAxiosConfig,
   });
   const { errorMessage, isLicenseLimit, limitedLicenseLimits } = resp.data;
   if (errorMessage) {
@@ -472,7 +491,7 @@ function removeCloudCachedConnection(folid, cntid) {
 
 async function getPublicIpInfo() {
   try {
-    const resp = await axios.default.get(`${DBGATE_CLOUD_URL}/ipinfo`);
+    const resp = await axios.default.get(`${DBGATE_CLOUD_URL}/ipinfo`, stageAxiosConfig);
     if (!resp.data?.ip) {
       return { ip: 'unknown-ip' };
     }
@@ -488,12 +507,15 @@ async function getPromoWidgetData() {
 }
 
 async function getPromoWidgetPreview(campaign, variant) {
-  const resp = await axios.default.get(`${DBGATE_CLOUD_URL}/premium-promo-widget-preview/${campaign}/${variant}`);
+  const resp = await axios.default.get(
+    `${DBGATE_CLOUD_URL}/premium-promo-widget-preview/${campaign}/${variant}`,
+    stageAxiosConfig
+  );
   return resp.data;
 }
 
 async function getPromoWidgetList() {
-  const resp = await axios.default.get(`${DBGATE_CLOUD_URL}/promo-widget-list`);
+  const resp = await axios.default.get(`${DBGATE_CLOUD_URL}/promo-widget-list`, stageAxiosConfig);
   return resp.data;
 }