dbgate-tools 7.2.4 → 7.2.5

package/lib/ScriptWriter.js

@@ -7,6 +7,20 @@ exports.jsonScriptToJavascript = exports.playJsonScriptWriter = exports.ScriptWr
 const uniq_1 = __importDefault(require("lodash/uniq"));
 const cloneDeepWith_1 = __importDefault(require("lodash/cloneDeepWith"));
 const packageTools_1 = require("./packageTools");
+// Line terminators (LF, CR, U+2028, U+2029) end a `//` comment; keep every line commented so
+// comment/schedule text from a JSON script cannot break out and run as code. GHSA-rfx7-cmmf-7ff7
+const JS_LINE_TERMINATORS_RE = /\r\n|[\r\n\u2028\u2029]/g;
+// runners.js/scheduler.js scan the whole generated script text for `// @require ...` /
+// `// @schedule ...` with unanchored regexes, so a directive can be formed by an '@' appearing
+// *anywhere* in user-controlled text next to a '//' - not just one re-commented at a line start
+// (e.g. "sometext // @require dbgate-plugin-evil" on a single line). Escape every '@' so
+// user-controlled comment/schedule text can never reconstruct a directive, regardless of position.
+const AT_RE = /@/g;
+function sanitizeCommentText(text) {
+    return String(text)
+        .replace(AT_RE, '\\@')
+        .replace(JS_LINE_TERMINATORS_RE, '\n// ');
+}
 class ScriptWriterJavaScript {
     constructor(varCount = '0') {
         this.s = '';
@@ -60,7 +74,7 @@ class ScriptWriterJavaScript {
         this._put(`await dbgateApi.dataReplicator(${JSON.stringify(options, null, 2)});`);
     }
     comment(s) {
-        this._put(`// ${s}`);
+        this._put(`// ${sanitizeCommentText(s)}`);
     }
     getScript(schedule = null) {
         const packageNames = this.packageNames;
@@ -68,7 +82,7 @@ class ScriptWriterJavaScript {
             .map(packageName => `// @require ${packageName}\n`)
             .join('');
         if (schedule)
-            prefix += `// @schedule ${schedule}`;
+            prefix += `// @schedule ${sanitizeCommentText(schedule)}`;
         if (prefix)
             prefix += '\n';
         return prefix + this.s;

package/lib/codexModels.d.ts

@@ -0,0 +1,27 @@
+export type CodexModelInfo = {
+    id: string;
+    name: string;
+};
+export declare const CODEX_MODELS: readonly [{
+    readonly id: "gpt-5.6-sol";
+    readonly name: "GPT-5.6 Sol";
+}, {
+    readonly id: "gpt-5.6-terra";
+    readonly name: "GPT-5.6 Terra";
+}, {
+    readonly id: "gpt-5.6-luna";
+    readonly name: "GPT-5.6 Luna";
+}, {
+    readonly id: "gpt-5.5";
+    readonly name: "GPT-5.5";
+}, {
+    readonly id: "gpt-5.4";
+    readonly name: "GPT-5.4";
+}, {
+    readonly id: "gpt-5.4-mini";
+    readonly name: "GPT-5.4 mini";
+}, {
+    readonly id: "gpt-5.3-codex-spark";
+    readonly name: "GPT-5.3 Codex Spark";
+}];
+export declare const DEFAULT_CODEX_MODEL = "gpt-5.6-sol";

package/lib/codexModels.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CODEX_MODEL = exports.CODEX_MODELS = void 0;
+exports.CODEX_MODELS = [
+    { id: 'gpt-5.6-sol', name: 'GPT-5.6 Sol' },
+    { id: 'gpt-5.6-terra', name: 'GPT-5.6 Terra' },
+    { id: 'gpt-5.6-luna', name: 'GPT-5.6 Luna' },
+    { id: 'gpt-5.5', name: 'GPT-5.5' },
+    { id: 'gpt-5.4', name: 'GPT-5.4' },
+    { id: 'gpt-5.4-mini', name: 'GPT-5.4 mini' },
+    { id: 'gpt-5.3-codex-spark', name: 'GPT-5.3 Codex Spark' },
+];
+exports.DEFAULT_CODEX_MODEL = 'gpt-5.6-sol';

package/lib/index.d.ts

@@ -28,3 +28,4 @@ export * from './redisKeysLoader';
 export * from './rowProgressReporter';
 export * from './diagramTools';
 export * from './queryMetadataTools';
+export * from './codexModels';

package/lib/index.js

@@ -44,3 +44,4 @@ __exportStar(require("./redisKeysLoader"), exports);
 __exportStar(require("./rowProgressReporter"), exports);
 __exportStar(require("./diagramTools"), exports);
 __exportStar(require("./queryMetadataTools"), exports);
+__exportStar(require("./codexModels"), exports);

package/lib/packageTools.d.ts

@@ -1,6 +1,18 @@
 import type { EngineDriver, ExtensionsDirectory } from 'dbgate-types';
 export declare function isValidJsIdentifier(name: string): boolean;
 export declare function assertValidJsIdentifier(name: string, label: string): void;
+/**
+ * Tests whether a value is a canonical DbGate plugin package name (dbgate-plugin-<name>).
+ * By construction this rejects absolute paths, path traversal (..), path separators
+ * and scoped/@-names, none of which may ever be passed to require()/require.resolve().
+ */
+export declare function isValidPluginPackageName(packageName: any): boolean;
+/**
+ * Asserts that packageName is a canonical DbGate plugin package name.
+ * Must be called before any code path that resolves or require()s a plugin by name,
+ * so that caller-supplied paths cannot be loaded as modules.
+ */
+export declare function assertValidPluginPackageName(packageName: any): string;
 /**
  * Validates a shell API function name.
  * Allowed forms:

package/lib/packageTools.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findEngineDriver = exports.evalShellApiFunctionName = exports.compileShellApiFunctionName = exports.extractPackageName = exports.extractShellApiPlugins = exports.assertValidShellApiFunctionName = exports.assertValidJsIdentifier = exports.isValidJsIdentifier = void 0;
+exports.findEngineDriver = exports.evalShellApiFunctionName = exports.compileShellApiFunctionName = exports.extractPackageName = exports.extractShellApiPlugins = exports.assertValidShellApiFunctionName = exports.assertValidPluginPackageName = exports.isValidPluginPackageName = exports.assertValidJsIdentifier = exports.isValidJsIdentifier = void 0;
 const camelCase_1 = __importDefault(require("lodash/camelCase"));
 const isString_1 = __importDefault(require("lodash/isString"));
 const isPlainObject_1 = __importDefault(require("lodash/isPlainObject"));
@@ -36,6 +36,28 @@ function assertValidJsIdentifier(name, label) {
     }
 }
 exports.assertValidJsIdentifier = assertValidJsIdentifier;
+const VALID_PLUGIN_NAME_RE = /^dbgate-plugin-[a-zA-Z0-9_-]+$/;
+/**
+ * Tests whether a value is a canonical DbGate plugin package name (dbgate-plugin-<name>).
+ * By construction this rejects absolute paths, path traversal (..), path separators
+ * and scoped/@-names, none of which may ever be passed to require()/require.resolve().
+ */
+function isValidPluginPackageName(packageName) {
+    return typeof packageName === 'string' && VALID_PLUGIN_NAME_RE.test(packageName);
+}
+exports.isValidPluginPackageName = isValidPluginPackageName;
+/**
+ * Asserts that packageName is a canonical DbGate plugin package name.
+ * Must be called before any code path that resolves or require()s a plugin by name,
+ * so that caller-supplied paths cannot be loaded as modules.
+ */
+function assertValidPluginPackageName(packageName) {
+    if (!isValidPluginPackageName(packageName)) {
+        throw new Error(`DBGM-00000 Invalid plugin package name: ${String(packageName).substring(0, 100)}`);
+    }
+    return packageName;
+}
+exports.assertValidPluginPackageName = assertValidPluginPackageName;
 /**
  * Validates a shell API function name.
  * Allowed forms:
@@ -51,8 +73,8 @@ function assertValidShellApiFunctionName(functionName) {
         if (!isValidJsIdentifier(nsMatch[1])) {
             throw new Error(`DBGM-00433 Invalid function part in functionName: ${nsMatch[1].substring(0, 100)}`);
         }
-        if (!/^dbgate-plugin-[a-zA-Z0-9_-]+$/.test(nsMatch[2])) {
-            throw new Error(`DBGM-00434 Invalid plugin package in functionName: ${nsMatch[2].substring(0, 100)}`);
+        if (!isValidPluginPackageName(nsMatch[2])) {
+            throw new Error(`DBGM-00000 Invalid plugin package in functionName: ${nsMatch[2].substring(0, 100)}`);
         }
     }
     else {
@@ -62,7 +84,6 @@ function assertValidShellApiFunctionName(functionName) {
     }
 }
 exports.assertValidShellApiFunctionName = assertValidShellApiFunctionName;
-const VALID_PLUGIN_NAME_RE = /^dbgate-plugin-[a-zA-Z0-9_-]+$/;
 function extractShellApiPlugins(functionName, props) {
     const res = [];
     const nsMatch = functionName.match(/^([^@]+)@([^@]+)/);
@@ -76,9 +97,7 @@ function extractShellApiPlugins(functionName, props) {
         }
     }
     for (const plugin of res) {
-        if (!VALID_PLUGIN_NAME_RE.test(plugin)) {
-            throw new Error(`DBGM-00436 Invalid plugin name: ${String(plugin).substring(0, 100)}`);
-        }
+        assertValidPluginPackageName(plugin);
     }
     return res;
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "7.2.4",
+  "version": "7.2.5",
   "name": "dbgate-tools",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
@@ -26,7 +26,7 @@
   ],
   "devDependencies": {
     "@types/node": "^13.7.0",
-    "dbgate-types": "7.2.4",
+    "dbgate-types": "7.2.5",
     "jest": "^28.1.3",
     "ts-jest": "^28.0.7",
     "typescript": "^4.4.3"
@@ -34,7 +34,7 @@
   "dependencies": {
     "blueimp-md5": "^2.19.0",
     "dbgate-query-splitter": "^4.12.0",
-    "dbgate-sqltree": "7.2.4",
+    "dbgate-sqltree": "7.2.5",
     "debug": "^4.3.4",
     "json-stable-stringify": "^1.0.1",
     "lodash": "^4.17.21",