grafeo-ogm 1.7.2 → 1.7.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +30 -0
- package/README.md +2 -0
- package/dist/cjs/compilers/fulltext.compiler.d.ts.map +1 -1
- package/dist/cjs/compilers/fulltext.compiler.js +20 -6
- package/dist/cjs/compilers/fulltext.compiler.js.map +1 -1
- package/dist/cjs/compilers/vector.compiler.js +13 -1
- package/dist/cjs/compilers/vector.compiler.js.map +1 -1
- package/dist/cjs/execution/result-mapper.d.ts.map +1 -1
- package/dist/cjs/execution/result-mapper.js +8 -2
- package/dist/cjs/execution/result-mapper.js.map +1 -1
- package/dist/cjs/utils/lucene.d.ts +12 -3
- package/dist/cjs/utils/lucene.d.ts.map +1 -1
- package/dist/cjs/utils/lucene.js +28 -13
- package/dist/cjs/utils/lucene.js.map +1 -1
- package/dist/esm/compilers/fulltext.compiler.d.ts.map +1 -1
- package/dist/esm/compilers/fulltext.compiler.js +20 -6
- package/dist/esm/compilers/fulltext.compiler.js.map +1 -1
- package/dist/esm/compilers/vector.compiler.js +13 -1
- package/dist/esm/compilers/vector.compiler.js.map +1 -1
- package/dist/esm/execution/result-mapper.d.ts.map +1 -1
- package/dist/esm/execution/result-mapper.js +8 -2
- package/dist/esm/execution/result-mapper.js.map +1 -1
- package/dist/esm/utils/lucene.d.ts +12 -3
- package/dist/esm/utils/lucene.d.ts.map +1 -1
- package/dist/esm/utils/lucene.js +28 -13
- package/dist/esm/utils/lucene.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,35 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.7.3 (2026-05-05)
|
|
4
|
+
|
|
5
|
+
> Security hardening release. Four defensive fixes surfaced by the same
|
|
6
|
+
> internal audit that produced 1.7.2. No behaviour change for callers
|
|
7
|
+
> that weren't reaching the hardened paths — Cypher emit is byte-
|
|
8
|
+
> identical for stored-property filters, vectors, and result mappings
|
|
9
|
+
> below the new boundaries.
|
|
10
|
+
|
|
11
|
+
### Fixed
|
|
12
|
+
|
|
13
|
+
- **Lucene bareword booleans neutralised.** `sanitizeLuceneQuery` already escaped symbol-form operators (`+`, `-`, `&&`, `||`, `^`, `~`, `:`, etc.) but let bareword `AND` / `OR` / `NOT` / `TO` survive — so an attacker could still inject a boolean query (e.g. `foo AND _exists_:adminFlag`) even when the developer routed input through the sanitizer. The function now lowercases standalone uppercase booleans BEFORE the placeholder dance, turning them into literal-word matches under Lucene's standard analyser. Word boundaries (`\b`) keep middle-of-word matches like `BAND` / `STOP` / `PORTO` untouched.
|
|
14
|
+
- **Vector + fulltext phrase length capped at 8 KB.** `searchByPhrase` forwards the input directly to the configured embedding provider (OpenAI / Vertex AI / etc., usually billable per token); fulltext forwards directly to the database parser. Pre-1.7.3 there was no cap — an attacker could send a multi-megabyte phrase to drive runaway billing or exhaust driver memory. New behaviour: throws `OGMError` with a clear message before any external call. 8 KB is well above any legitimate search query.
|
|
15
|
+
- **Neo4j Integer overflow no longer truncates silently.** `ResultMapper.convertNeo4jTypes` previously called `value.toNumber()` unconditionally — values above `Number.MAX_SAFE_INTEGER` (2⁵³) returned a wrong-but-plausible Number (e.g. `9007199254740993n` came back as `9007199254740992`). The mapper now gates on `value.inSafeRange()` and returns a `BigInt` for out-of-range integers. Values within the safe range still return as `Number`, so ordinary IDs / counters keep their existing type — only the overflow path changes.
|
|
16
|
+
|
|
17
|
+
### Documented
|
|
18
|
+
|
|
19
|
+
- **`@cypher` SDL trust boundary made explicit.** The `statement` argument is interpolated verbatim into Cypher with no parameterisation. README now flags this as a development-time-only trust requirement: if `typeDefs` are ever assembled from runtime input (env vars, database records, remote config, user input), the application has a Cypher-injection vector equivalent to RCE on the database. The runtime cannot distinguish developer-authored from user-derived SDL — that boundary is the application's responsibility.
|
|
20
|
+
|
|
21
|
+
### Test coverage
|
|
22
|
+
|
|
23
|
+
- `tests/lucene.spec.ts` — 6 new tests covering bareword lowercase, word-boundary safety, the documented attack vector, and `&&` / `AND` interleaving.
|
|
24
|
+
- `tests/fulltext.compiler.spec.ts` + `tests/vector.compiler.spec.ts` — 3 new tests covering the 8 KB boundary (throw above, accept at).
|
|
25
|
+
- `tests/result-mapper.spec.ts` — 2 new tests covering the `inSafeRange` boundary (Number for safe, BigInt for overflow).
|
|
26
|
+
- 1332 → 1343 tests, all passing.
|
|
27
|
+
|
|
28
|
+
### Out of scope (deferred)
|
|
29
|
+
|
|
30
|
+
- Tier 3 contract violations (aggregate codegen mismatch, `setLabels` overlap, `upsert` MERGE-key validation, `extractConnectWhereConditions` array divergence, `InterfaceModel.find` limit/offset) — each needs a public-API decision before fixing.
|
|
31
|
+
- Tier 4 hot-path performance (double selection cache, `params:{}` allocation per where frame, `Object.entries` + `Object.create(null)` per result-mapper visit) — needs a benchmark harness before changes are accepted.
|
|
32
|
+
|
|
3
33
|
## 1.7.2 (2026-05-05)
|
|
4
34
|
|
|
5
35
|
> Codegen/runtime parity bug fixes surfaced by an internal audit. Five
|
package/README.md
CHANGED
|
@@ -866,6 +866,8 @@ type Book @node {
|
|
|
866
866
|
|
|
867
867
|
`statement` is the Cypher body — `this` is bound to the matched node. `columnName` is the alias the OGM reads from the `RETURN` clause; if omitted it defaults to the field name.
|
|
868
868
|
|
|
869
|
+
> **⚠️ Security — `@cypher` SDL is trusted code, not data.** The `statement` argument is interpolated **verbatim** into the compiled Cypher (no parameterisation, no escaping). Treat `@cypher` directives the same way you treat `eval()` in your application code: the string MUST be a constant authored at development time, never built from runtime input. If your `typeDefs` are ever assembled from user input, environment variables, database records, or remote configuration, you have a Cypher-injection vector equivalent to RCE on the database (`MATCH (n) DETACH DELETE n RETURN '' AS x` in a `statement` will wipe the graph). The grafeo-ogm runtime cannot distinguish between developer-authored and user-derived SDL — that boundary is the application's responsibility.
|
|
870
|
+
|
|
869
871
|
#### Using @cypher in SELECT
|
|
870
872
|
|
|
871
873
|
```typescript
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fulltext.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/fulltext.compiler.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,aAAa,EAEd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"fulltext.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/fulltext.compiler.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,aAAa,EAEd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA+BhF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,cAAc;IAE1C;;;OAGG;IACH,OAAO,CACL,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,cAAc,EACvB,OAAO,SAAM,GACZ,cAAc;IAqBjB;;;OAGG;IACH,mBAAmB,CACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EAC5D,QAAQ,EAAE,aAAa,EACvB,MAAM,SAAM,GACX,cAAc;IA2CjB,OAAO,CAAC,WAAW;IA4CnB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAgCnB,+EAA+E;IAC/E,OAAO,CAAC,gBAAgB;IAoCxB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAkEhC;;OAEG;IACH,OAAO,CAAC,SAAS;IAiDjB;;;OAGG;IACH,OAAO,CAAC,UAAU;IA8DlB;;;OAGG;IACH,OAAO,CAAC,UAAU;CA2BnB"}
|
|
@@ -6,6 +6,23 @@ const model_1 = require("../model");
|
|
|
6
6
|
const validation_1 = require("../utils/validation");
|
|
7
7
|
/** Maximum recursion depth for nested fulltext logical operators */
|
|
8
8
|
const MAX_DEPTH = 10;
|
|
9
|
+
/**
|
|
10
|
+
* Hard cap on the length of a fulltext phrase, in characters. Lucene
|
|
11
|
+
* itself accepts essentially unbounded query strings, but the OGM
|
|
12
|
+
* pipeline forwards untrusted user input directly to the driver — and
|
|
13
|
+
* a multi-megabyte phrase wastes round-trip bandwidth, parser CPU on
|
|
14
|
+
* the database side, and (for callers that pre-process via embedding
|
|
15
|
+
* providers) provider tokens. 8 KB is well above any legitimate
|
|
16
|
+
* search query.
|
|
17
|
+
*/
|
|
18
|
+
const MAX_FULLTEXT_PHRASE_LENGTH = 8 * 1024;
|
|
19
|
+
function assertValidFulltextPhrase(phrase) {
|
|
20
|
+
if (typeof phrase !== 'string' || phrase.trim().length === 0)
|
|
21
|
+
throw new errors_1.OGMError('Fulltext phrase must not be empty');
|
|
22
|
+
if (phrase.length > MAX_FULLTEXT_PHRASE_LENGTH)
|
|
23
|
+
throw new errors_1.OGMError(`Fulltext phrase exceeds the maximum length of ${MAX_FULLTEXT_PHRASE_LENGTH} characters ` +
|
|
24
|
+
`(got ${phrase.length}). Truncate or split the input before searching.`);
|
|
25
|
+
}
|
|
9
26
|
/**
|
|
10
27
|
* Compiles fulltext search input into Cypher CALL clauses using
|
|
11
28
|
* db.index.fulltext.queryNodes and db.index.fulltext.queryRelationships.
|
|
@@ -56,8 +73,7 @@ class FulltextCompiler {
|
|
|
56
73
|
const indexName = keys[0];
|
|
57
74
|
(0, validation_1.assertSafeIdentifier)(indexName, 'fulltext index name');
|
|
58
75
|
const input = fulltext[indexName];
|
|
59
|
-
|
|
60
|
-
throw new errors_1.OGMError('Fulltext phrase must not be empty');
|
|
76
|
+
assertValidFulltextPhrase(input.phrase);
|
|
61
77
|
if (relIndex.name !== indexName)
|
|
62
78
|
throw new errors_1.OGMError(`Unknown relationship fulltext index "${indexName}". Expected "${relIndex.name}".`);
|
|
63
79
|
const lines = [
|
|
@@ -111,8 +127,7 @@ class FulltextCompiler {
|
|
|
111
127
|
}
|
|
112
128
|
/** Compile a node-level fulltext index: `{ IndexName: { phrase, score? } }` */
|
|
113
129
|
compileNodeIndex(indexName, input, nodeDef, nodeVar, paramCounter) {
|
|
114
|
-
|
|
115
|
-
throw new errors_1.OGMError('Fulltext phrase must not be empty');
|
|
130
|
+
assertValidFulltextPhrase(input.phrase);
|
|
116
131
|
const nodeIndex = nodeDef.fulltextIndexes.find((idx) => idx.name === indexName);
|
|
117
132
|
if (!nodeIndex)
|
|
118
133
|
throw new errors_1.OGMError(`Unknown fulltext index "${indexName}" for node "${nodeDef.typeName}"`);
|
|
@@ -157,8 +172,7 @@ class FulltextCompiler {
|
|
|
157
172
|
const ftIndex = (relProps.fulltextIndexes ?? []).find((idx) => idx.name === indexName);
|
|
158
173
|
if (!ftIndex)
|
|
159
174
|
throw new errors_1.OGMError(`Unknown fulltext index "${indexName}" on @relationshipProperties "${relDef.properties}"`);
|
|
160
|
-
|
|
161
|
-
throw new errors_1.OGMError('Fulltext phrase must not be empty');
|
|
175
|
+
assertValidFulltextPhrase(input.phrase);
|
|
162
176
|
const paramName = `ft_phrase_${paramCounter.count++}`;
|
|
163
177
|
const params = { [paramName]: input.phrase };
|
|
164
178
|
const cypher = [
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fulltext.compiler.js","sourceRoot":"","sources":["../../../src/compilers/fulltext.compiler.ts"],"names":[],"mappings":";;;AAAA,sCAAqC;AACrC,oCAKkB;AAElB,oDAI6B;AAE7B,oEAAoE;AACpE,MAAM,SAAS,GAAG,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"fulltext.compiler.js","sourceRoot":"","sources":["../../../src/compilers/fulltext.compiler.ts"],"names":[],"mappings":";;;AAAA,sCAAqC;AACrC,oCAKkB;AAElB,oDAI6B;AAE7B,oEAAoE;AACpE,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,CAAC;AAE5C,SAAS,yBAAyB,CAAC,MAAe;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,iBAAQ,CAAC,mCAAmC,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,0BAA0B;QAC5C,MAAM,IAAI,iBAAQ,CAChB,iDAAiD,0BAA0B,cAAc;YACvF,QAAQ,MAAM,CAAC,MAAM,kDAAkD,CAC1E,CAAC;AACN,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAa,gBAAgB;IAC3B,YAAoB,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IAAG,CAAC;IAE9C;;;OAGG;IACH,OAAO,CACL,QAAuB,EACvB,OAAuB,EACvB,OAAO,GAAG,GAAG;QAEb,IAAA,iCAAoB,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAE1E,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,IAAA,sBAAc,EAAC,QAAQ,CAAC;YAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBACjC,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;gBACjE,CAAC;qBAAM,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC;QAEL,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,mBAAmB,CACjB,QAA4D,EAC5D,QAAuB,EACvB,MAAM,GAAG,GAAG;QAEZ,IAAA,iCAAoB,EAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,IAAI,iBAAQ,CAChB,sDAAsD,CACvD,CAAC;QAEJ,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAA,iCAAoB,EAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAElC,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAC7B,MAAM,IAAI,iBAAQ,CAChB,wCAAwC,SAAS,gBAAgB,QAAQ,CAAC,IAAI,IAAI,CACnF,CAAC;QAEJ,MAAM,KAAK,GAAG;YACZ,8CAA8C,SAAS,gBAAgB;YACvE,yBAAyB,MAAM,SAAS;SACzC,CAAC;QAEF,MAAM,MAAM,GAA4B,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACpE,MAAM,MAAM,GAAmB;YAC7B,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,MAAM;SACP,CAAC;QAEF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;YAC9B,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,gCAAgC;IAChC,8EAA8E;IAEtE,WAAW,CACjB,KAAoB,EACpB,OAAuB,EACvB,OAAe,EACf,YAA+B,EAC/B,KAAK,GAAG,CAAC;QAET,IAAI,KAAK,GAAG,SAAS;YACnB,MAAM,IAAI,iBAAQ,CAChB,qDAAqD,SAAS,EAAE,CACjE,CAAC;QACJ,IAAI,IAAA,sBAAc,EAAC,KAAK,CAAC;YACvB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAEjE,IAAI,IAAI,IAAI,KAAK;YACf,OAAO,IAAI,CAAC,SAAS,CACnB,KAAK,CAAC,EAAE,EACR,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,GAAG,CAAC,CACV,CAAC;QACJ,IAAI,KAAK,IAAI,KAAK;YAChB,OAAO,IAAI,CAAC,UAAU,CACpB,KAAK,CAAC,GAAG,EACT,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,GAAG,CAAC,CACV,CAAC;QACJ,IAAI,KAAK,IAAI,KAAK;YAChB,OAAO,IAAI,CAAC,UAAU,CACpB,KAAK,CAAC,GAAG,EACT,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,GAAG,CAAC,CACV,CAAC;QAEJ,MAAM,IAAI,iBAAQ,CAChB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,WAAW,CACjB,IAA6B,EAC7B,OAAuB,EACvB,OAAe,EACf,YAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,IAAI,iBAAQ,CAChB,sDAAsD,CACvD,CAAC;QAEJ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAA,iCAAoB,EAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAEgB,CAAC;QAEvC,wDAAwD;QACxD,IAAI,IAAA,4BAAoB,EAAC,KAAK,CAAC;YAC7B,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAE3E,2DAA2D;QAC3D,OAAO,IAAI,CAAC,wBAAwB,CAClC,GAAG,EACH,KAA2C,EAC3C,OAAO,EACP,OAAO,EACP,YAAY,CACb,CAAC;IACJ,CAAC;IAED,+EAA+E;IACvE,gBAAgB,CACtB,SAAiB,EACjB,KAAyB,EACzB,OAAuB,EACvB,OAAe,EACf,YAA+B;QAE/B,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAC5C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAChC,CAAC;QACF,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,iBAAQ,CAChB,2BAA2B,SAAS,eAAe,OAAO,CAAC,QAAQ,GAAG,CACvE,CAAC;QAEJ,MAAM,SAAS,GAAG,aAAa,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,MAAM,GAA4B,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAEtE,MAAM,MAAM,GAAG;YACb,sCAAsC,SAAS,OAAO,SAAS,GAAG;YAClE,iBAAiB,OAAO,SAAS;SAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAElD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,YAAY,YAAY,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAC9B,YAAoB,EACpB,KAAyC,EACzC,OAAuB,EACvB,OAAe,EACf,YAA+B;QAE/B,6CAA6C;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,iBAAQ,CAChB,+BAA+B,YAAY,cAAc,OAAO,CAAC,QAAQ,GAAG,CAC7E,CAAC;QAEJ,IAAI,CAAC,MAAM,CAAC,UAAU;YACpB,MAAM,IAAI,iBAAQ,CAChB,iBAAiB,YAAY,SAAS,OAAO,CAAC,QAAQ,kCAAkC,CACzF,CAAC;QAEJ,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,iBAAQ,CAChB,iCAAiC,MAAM,CAAC,UAAU,aAAa,CAChE,CAAC;QAEJ,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YACxB,MAAM,IAAI,iBAAQ,CAChB,wDAAwD,CACzD,CAAC;QAEJ,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAA,iCAAoB,EAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAE/B,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAChC,CAAC;QACF,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,iBAAQ,CAChB,2BAA2B,SAAS,iCAAiC,MAAM,CAAC,UAAU,GAAG,CAC1F,CAAC;QAEJ,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,aAAa,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,MAAM,GAA4B,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAEtE,MAAM,MAAM,GAAG;YACb,8CAA8C,SAAS,OAAO,SAAS,GAAG;YAC1E,kCAAkC;YAClC,0BAA0B,OAAO,SAAS;SAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAElD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,YAAY,YAAY,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,SAAS,CACf,QAAyB,EACzB,OAAuB,EACvB,OAAe,EACf,YAA+B,EAC/B,KAAa;QAEb,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,MAAM,IAAI,iBAAQ,CAAC,qCAAqC,CAAC,CAAC;QAE5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,OAAO,IAAI,CAAC,WAAW,CACrB,QAAQ,CAAC,CAAC,CAAC,EACX,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,CACN,CAAC;QAEJ,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAC7B,MAAM,EACN,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,CACN,CAAC;YACF,IAAA,wBAAW,EAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,aAAa,CAAC,IAAI,CAChB;gBACE,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC7C,YAAY,OAAO,SAAS;aAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;YACjC,GAAG;YACH,QAAQ,OAAO,uBAAuB;SACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED;;;OAGG;IACK,UAAU,CAChB,QAAyB,EACzB,OAAuB,EACvB,OAAe,EACf,YAA+B,EAC/B,KAAa;QAEb,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,MAAM,IAAI,iBAAQ,CAAC,sCAAsC,CAAC,CAAC;QAE7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,OAAO,IAAI,CAAC,WAAW,CACrB,QAAQ,CAAC,CAAC,CAAC,EACX,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,CACN,CAAC;QAEJ,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,sCAAsC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAC5B,QAAQ,CAAC,CAAC,CAAC,EACX,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,CACN,CAAC;QACF,IAAA,wBAAW,EAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE/B,2EAA2E;QAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAC7B,QAAQ,CAAC,CAAC,CAAC,EACX,OAAO,EACP,GAAG,EACH,YAAY,EACZ,KAAK,CACN,CAAC;YACF,IAAA,wBAAW,EAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAEtC,WAAW,CAAC,IAAI,CACd;gBACE,QAAQ;gBACR,UAAU,OAAO,EAAE;gBACnB,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC7C,eAAe,OAAO,EAAE;gBACxB,gBAAgB;gBAChB,GAAG;aACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,QAAQ,OAAO,SAAS,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED;;;OAGG;IACK,UAAU,CAChB,KAAoB,EACpB,OAAuB,EACvB,OAAe,EACf,YAA+B,EAC/B,KAAa;QAEb,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAClC,KAAK,EACL,OAAO,EACP,UAAU,EACV,YAAY,EACZ,KAAK,CACN,CAAC;QACF,MAAM,SAAS,GAA4B,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;QAErE,MAAM,MAAM,GAAG;YACb,UAAU,OAAO,IAAI,IAAA,6BAAgB,EAAC,OAAO,CAAC,KAAK,CAAC,GAAG;YACvD,oBAAoB;YACpB,KAAK,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAClD,sBAAsB,OAAO,EAAE;YAC/B,GAAG;YACH,QAAQ,OAAO,cAAc;SAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;CACF;AAvaD,4CAuaC"}
|
|
@@ -121,9 +121,21 @@ function assertValidVector(vector) {
|
|
|
121
121
|
throw new errors_1.OGMError(`Vector search "vector" contains a non-finite value at index ${i}`);
|
|
122
122
|
}
|
|
123
123
|
}
|
|
124
|
-
/**
|
|
124
|
+
/**
|
|
125
|
+
* Hard cap on the length of a vector-search phrase, in characters. The
|
|
126
|
+
* phrase is forwarded to the configured embedding provider (OpenAI,
|
|
127
|
+
* Vertex AI, etc.) which usually charges per token; without a cap an
|
|
128
|
+
* attacker can drive runaway billing and exhaust driver memory by
|
|
129
|
+
* sending a multi-megabyte phrase. 8 KB is well above any legitimate
|
|
130
|
+
* search query and below the embedding-provider limits we know about.
|
|
131
|
+
*/
|
|
132
|
+
const MAX_VECTOR_PHRASE_LENGTH = 8 * 1024;
|
|
133
|
+
/** Validate `phrase` is a non-empty, non-whitespace, length-capped string. */
|
|
125
134
|
function assertValidPhrase(phrase) {
|
|
126
135
|
if (typeof phrase !== 'string' || phrase.trim().length === 0)
|
|
127
136
|
throw new errors_1.OGMError('Vector search "phrase" must be a non-empty string');
|
|
137
|
+
if (phrase.length > MAX_VECTOR_PHRASE_LENGTH)
|
|
138
|
+
throw new errors_1.OGMError(`Vector search "phrase" exceeds the maximum length of ${MAX_VECTOR_PHRASE_LENGTH} characters ` +
|
|
139
|
+
`(got ${phrase.length}). Truncate or split the input before searching.`);
|
|
128
140
|
}
|
|
129
141
|
//# sourceMappingURL=vector.compiler.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vector.compiler.js","sourceRoot":"","sources":["../../../src/compilers/vector.compiler.ts"],"names":[],"mappings":";;;AAAA,sCAAqC;AAErC,oDAA2D;AAE3D,yEAAyE;AACzE,MAAM,KAAK,GAAG,IAAI,CAAC;AAOnB;;;;;;;;;;;GAWG;AACH,MAAa,cAAc;IACzB,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,gBAAe,CAAC;IAEhB;;;OAGG;IACH,eAAe,CAAC,KAMf;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEnD,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,YAAY,MAAM,EAAE,CAAC;QAEzC,MAAM,MAAM,GAAG,oCAAoC,SAAS,MAAM,MAAM,MAAM,WAAW,0BAA0B,CAAC;QAEpH,MAAM,MAAM,GAA4B;YACtC,CAAC,SAAS,CAAC,EAAE,SAAS;YACtB,CAAC,MAAM,CAAC,EAAE,KAAK;YACf,CAAC,WAAW,CAAC,EAAE,MAAM;SACtB,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,KAOf;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEnD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE1B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YACvD,MAAM,IAAI,iBAAQ,CAChB,iBAAiB,SAAS,0GAA0G,CACrI,CAAC;QAEJ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,YAAY,MAAM,EAAE,CAAC;QACzC,MAAM,aAAa,GAAG,cAAc,MAAM,EAAE,CAAC;QAC7C,MAAM,gBAAgB,GAAG,oBAAoB,MAAM,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,eAAe,MAAM,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAG;YACb,6BAA6B,WAAW,MAAM,aAAa,MAAM,gBAAgB,qBAAqB,UAAU,EAAE;YAClH,oCAAoC,SAAS,MAAM,MAAM,KAAK,UAAU,0BAA0B;SACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAA4B;YACtC,CAAC,SAAS,CAAC,EAAE,SAAS;YACtB,CAAC,MAAM,CAAC,EAAE,KAAK;YACf,CAAC,WAAW,CAAC,EAAE,MAAM;YACrB,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,QAAQ;YAC/B,CAAC,gBAAgB,CAAC,EAAE,cAAc,IAAI,EAAE;SACzC,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;;;;OAMG;IACK,iBAAiB,CACvB,SAAiB,EACjB,OAAuB;QAEvB,IAAA,iCAAoB,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,SAAS,uBAAuB,OAAO,CAAC,QAAQ,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AApHD,wCAoHC;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,iBAAQ,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,gEAAgE;AAChE,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,iBAAQ,CAAC,2CAA2C,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrB,MAAM,IAAI,iBAAQ,CAAC,0CAA0C,CAAC,CAAC;IACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,iBAAQ,CAChB,+DAA+D,CAAC,EAAE,CACnE,CAAC;IACN,CAAC;AACH,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"vector.compiler.js","sourceRoot":"","sources":["../../../src/compilers/vector.compiler.ts"],"names":[],"mappings":";;;AAAA,sCAAqC;AAErC,oDAA2D;AAE3D,yEAAyE;AACzE,MAAM,KAAK,GAAG,IAAI,CAAC;AAOnB;;;;;;;;;;;GAWG;AACH,MAAa,cAAc;IACzB,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,gBAAe,CAAC;IAEhB;;;OAGG;IACH,eAAe,CAAC,KAMf;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEnD,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,YAAY,MAAM,EAAE,CAAC;QAEzC,MAAM,MAAM,GAAG,oCAAoC,SAAS,MAAM,MAAM,MAAM,WAAW,0BAA0B,CAAC;QAEpH,MAAM,MAAM,GAA4B;YACtC,CAAC,SAAS,CAAC,EAAE,SAAS;YACtB,CAAC,MAAM,CAAC,EAAE,KAAK;YACf,CAAC,WAAW,CAAC,EAAE,MAAM;SACtB,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,KAOf;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEnD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE1B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YACvD,MAAM,IAAI,iBAAQ,CAChB,iBAAiB,SAAS,0GAA0G,CACrI,CAAC;QAEJ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,YAAY,MAAM,EAAE,CAAC;QACzC,MAAM,aAAa,GAAG,cAAc,MAAM,EAAE,CAAC;QAC7C,MAAM,gBAAgB,GAAG,oBAAoB,MAAM,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,eAAe,MAAM,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAG;YACb,6BAA6B,WAAW,MAAM,aAAa,MAAM,gBAAgB,qBAAqB,UAAU,EAAE;YAClH,oCAAoC,SAAS,MAAM,MAAM,KAAK,UAAU,0BAA0B;SACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAA4B;YACtC,CAAC,SAAS,CAAC,EAAE,SAAS;YACtB,CAAC,MAAM,CAAC,EAAE,KAAK;YACf,CAAC,WAAW,CAAC,EAAE,MAAM;YACrB,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,QAAQ;YAC/B,CAAC,gBAAgB,CAAC,EAAE,cAAc,IAAI,EAAE;SACzC,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;;;;OAMG;IACK,iBAAiB,CACvB,SAAiB,EACjB,OAAuB;QAEvB,IAAA,iCAAoB,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,SAAS,uBAAuB,OAAO,CAAC,QAAQ,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AApHD,wCAoHC;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,iBAAQ,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,gEAAgE;AAChE,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,iBAAQ,CAAC,2CAA2C,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrB,MAAM,IAAI,iBAAQ,CAAC,0CAA0C,CAAC,CAAC;IACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,iBAAQ,CAChB,+DAA+D,CAAC,EAAE,CACnE,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,CAAC;AAE1C,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,iBAAQ,CAAC,mDAAmD,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,GAAG,wBAAwB;QAC1C,MAAM,IAAI,iBAAQ,CAChB,wDAAwD,wBAAwB,cAAc;YAC5F,QAAQ,MAAM,CAAC,MAAM,kDAAkD,CAC1E,CAAC;AACN,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"result-mapper.d.ts","sourceRoot":"","sources":["../../../src/execution/result-mapper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;GAIG;AACH,qBAAa,YAAY;IACvB;;;;OAIG;IACH,MAAM,CAAC,SAAS,CACd,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAU1B;;OAEG;IACH,MAAM,CAAC,UAAU,CACf,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IAI5B;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAU,GAAG,OAAO;
|
|
1
|
+
{"version":3,"file":"result-mapper.d.ts","sourceRoot":"","sources":["../../../src/execution/result-mapper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;GAIG;AACH,qBAAa,YAAY;IACvB;;;;OAIG;IACH,MAAM,CAAC,SAAS,CACd,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAU1B;;OAEG;IACH,MAAM,CAAC,UAAU,CACf,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IAI5B;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAU,GAAG,OAAO;CAsErE"}
|
|
@@ -47,9 +47,15 @@ class ResultMapper {
|
|
|
47
47
|
// Fast path: primitives (most common in query results)
|
|
48
48
|
if (typeof value !== 'object')
|
|
49
49
|
return value;
|
|
50
|
-
// Neo4j Integer → number
|
|
50
|
+
// Neo4j Integer → number (or BigInt when the value exceeds the
|
|
51
|
+
// safe-integer range). Pre-1.7.3 this always called `toNumber()`,
|
|
52
|
+
// which silently truncated values above 2^53 — e.g. a stored id
|
|
53
|
+
// of `9007199254740993n` came back as `9007199254740992`. Now we
|
|
54
|
+
// gate on `inSafeRange()` and fall back to BigInt for out-of-range
|
|
55
|
+
// values so consumers see the exact stored value (or can detect
|
|
56
|
+
// the BigInt and route accordingly).
|
|
51
57
|
if (neo4j_driver_1.default.isInt(value))
|
|
52
|
-
return value.toNumber();
|
|
58
|
+
return value.inSafeRange() ? value.toNumber() : value.toBigInt();
|
|
53
59
|
// Array → map each element (check before other object types)
|
|
54
60
|
if (Array.isArray(value))
|
|
55
61
|
return value.map((item) => ResultMapper.convertNeo4jTypes(item, depth + 1));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"result-mapper.js","sourceRoot":"","sources":["../../../src/execution/result-mapper.ts"],"names":[],"mappings":";;;;;;AAAA,gEAAiC;AAEjC,sCAAqC;AAErC;;;;GAIG;AACH,MAAa,YAAY;IACvB;;;;OAIG;IACH,MAAM,CAAC,SAAS,CACd,MAAmB,EACnB,SAAkB;QAElB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,OAAO,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAA4B,CAAC;QAC1E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAA4B,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CACf,OAAsB,EACtB,SAAkB;QAElB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAc,EAAE,QAAgB,CAAC;QACxD,4DAA4D;QAC5D,IAAI,KAAK,GAAG,EAAE;YACZ,MAAM,IAAI,iBAAQ,CAChB,sGAAsG,CACvG,CAAC;QAEJ,4BAA4B;QAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAExD,uDAAuD;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5C,
|
|
1
|
+
{"version":3,"file":"result-mapper.js","sourceRoot":"","sources":["../../../src/execution/result-mapper.ts"],"names":[],"mappings":";;;;;;AAAA,gEAAiC;AAEjC,sCAAqC;AAErC;;;;GAIG;AACH,MAAa,YAAY;IACvB;;;;OAIG;IACH,MAAM,CAAC,SAAS,CACd,MAAmB,EACnB,SAAkB;QAElB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,OAAO,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAA4B,CAAC;QAC1E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAA4B,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CACf,OAAsB,EACtB,SAAkB;QAElB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAc,EAAE,QAAgB,CAAC;QACxD,4DAA4D;QAC5D,IAAI,KAAK,GAAG,EAAE;YACZ,MAAM,IAAI,iBAAQ,CAChB,sGAAsG,CACvG,CAAC;QAEJ,4BAA4B;QAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAExD,uDAAuD;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5C,+DAA+D;QAC/D,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,gEAAgE;QAChE,qCAAqC;QACrC,IAAI,sBAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YACpB,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAEnE,6DAA6D;QAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACtB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAChD,CAAC;QAEJ,oCAAoC;QACpC,IACE,sBAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YACvB,sBAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACnB,sBAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACnB,sBAAK,CAAC,eAAe,CAAC,KAAK,CAAC;YAC5B,sBAAK,CAAC,WAAW,CAAC,KAAK,CAAC;YACxB,sBAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAEvB,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QAE1B,6BAA6B;QAC7B,IAAI,sBAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAA4B;gBACrC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACV,CAAC,EAAE,KAAK,CAAC,CAAC;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC;YACF,IAAI,KAAK,CAAC,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,YAAY,sBAAK,CAAC,KAAK,CAAC,IAAI;YACnC,OAAO,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAErE,8CAA8C;QAC9C,IAAI,KAAK,YAAY,sBAAK,CAAC,KAAK,CAAC,YAAY;YAC3C,OAAO,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAErE,6BAA6B;QAC7B,IAAI,KAAK,YAAY,sBAAK,CAAC,KAAK,CAAC,IAAI;YACnC,MAAM,IAAI,iBAAQ,CAAC,uCAAuC,CAAC,CAAC;QAE9D,4FAA4F;QAC5F,MAAM,MAAM,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAE/D,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAzGD,oCAyGC"}
|
|
@@ -1,9 +1,18 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Escapes special Lucene characters in a query string.
|
|
3
|
-
* Special characters: + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
|
|
4
3
|
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* Symbol-form operators escaped:
|
|
5
|
+
* + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
|
|
6
|
+
*
|
|
7
|
+
* Bareword booleans (`AND`, `OR`, `NOT`, `TO`) are also neutralised. Pre-
|
|
8
|
+
* 1.7.3 they survived sanitisation, letting an attacker inject a boolean
|
|
9
|
+
* query (e.g. `foo AND _exists_:adminFlag`) even after symbol escaping.
|
|
10
|
+
* The standard Lucene analyser lowercases tokens during indexing, so
|
|
11
|
+
* lowercasing the bareword turns it into a literal-word match — which
|
|
12
|
+
* is what callers of `sanitizeLuceneQuery` expect (the function exists
|
|
13
|
+
* to make untrusted user input safe to pass to Lucene). Range-modifier
|
|
14
|
+
* boost/fuzzy (`^N`, `~N`) are already disarmed because `^` and `~`
|
|
15
|
+
* get backslash-escaped in the symbol pass.
|
|
7
16
|
*/
|
|
8
17
|
export declare function sanitizeLuceneQuery(query: string): string;
|
|
9
18
|
//# sourceMappingURL=lucene.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lucene.d.ts","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"lucene.d.ts","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBzD"}
|
package/dist/cjs/utils/lucene.js
CHANGED
|
@@ -3,23 +3,38 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
3
3
|
exports.sanitizeLuceneQuery = sanitizeLuceneQuery;
|
|
4
4
|
/**
|
|
5
5
|
* Escapes special Lucene characters in a query string.
|
|
6
|
-
* Special characters: + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
|
|
7
6
|
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
7
|
+
* Symbol-form operators escaped:
|
|
8
|
+
* + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
|
|
9
|
+
*
|
|
10
|
+
* Bareword booleans (`AND`, `OR`, `NOT`, `TO`) are also neutralised. Pre-
|
|
11
|
+
* 1.7.3 they survived sanitisation, letting an attacker inject a boolean
|
|
12
|
+
* query (e.g. `foo AND _exists_:adminFlag`) even after symbol escaping.
|
|
13
|
+
* The standard Lucene analyser lowercases tokens during indexing, so
|
|
14
|
+
* lowercasing the bareword turns it into a literal-word match — which
|
|
15
|
+
* is what callers of `sanitizeLuceneQuery` expect (the function exists
|
|
16
|
+
* to make untrusted user input safe to pass to Lucene). Range-modifier
|
|
17
|
+
* boost/fuzzy (`^N`, `~N`) are already disarmed because `^` and `~`
|
|
18
|
+
* get backslash-escaped in the symbol pass.
|
|
10
19
|
*/
|
|
11
20
|
function sanitizeLuceneQuery(query) {
|
|
12
|
-
//
|
|
13
|
-
//
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
//
|
|
21
|
+
// FIRST pass: neutralise bareword booleans BEFORE the placeholder dance
|
|
22
|
+
// below. Running this last would let user-typed " AND " / " OR " collide
|
|
23
|
+
// with the restoration regex (which matches those exact tokens) and
|
|
24
|
+
// wrongly rewrite literal user words to escaped `\&\&` / `\|\|`. Running
|
|
25
|
+
// this first turns user `foo AND bar` into `foo and bar` (literal-word
|
|
26
|
+
// match) before any other pass sees it. Word boundaries (`\b`) keep us
|
|
27
|
+
// from touching middle-of-word matches like `BAND` or `STOP`.
|
|
28
|
+
let result = query.replace(/\b(AND|OR|NOT|TO)\b/g, (match) => match.toLowerCase());
|
|
29
|
+
// Second pass: escape multi-char operators as atomic units. We use
|
|
30
|
+
// " AND " / " OR " as placeholders (rather than NULL bytes) because
|
|
31
|
+
// the lowercase pass above guarantees no user-typed uppercase " AND "
|
|
32
|
+
// / " OR " can survive to collide with the restoration regex below.
|
|
33
|
+
result = result.replace(/&&/g, ' AND ').replace(/\|\|/g, ' OR ');
|
|
34
|
+
// Third pass: escape individual special characters (& and | individually)
|
|
18
35
|
result = result.replace(/([+\-&|!(){}[\]^"~*?:\\/])/g, '\\$1');
|
|
19
|
-
//
|
|
20
|
-
result = result
|
|
21
|
-
.replace(/\u0000AND\u0000/g, '\\&\\&')
|
|
22
|
-
.replace(/\u0000OR\u0000/g, '\\|\\|');
|
|
36
|
+
// Fourth pass: restore multi-char operators with proper escaping
|
|
37
|
+
result = result.replace(/ AND /g, '\\&\\&').replace(/ OR /g, '\\|\\|');
|
|
23
38
|
return result;
|
|
24
39
|
}
|
|
25
40
|
//# sourceMappingURL=lucene.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lucene.js","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"lucene.js","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":";;AAgBA,kDAyBC;AAzCD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3D,KAAK,CAAC,WAAW,EAAE,CACpB,CAAC;IAEF,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjE,0EAA0E;IAC1E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IAE/D,iEAAiE;IACjE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEvE,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fulltext.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/fulltext.compiler.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,aAAa,EAEd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"fulltext.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/fulltext.compiler.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,aAAa,EAEd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA+BhF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,cAAc;IAE1C;;;OAGG;IACH,OAAO,CACL,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,cAAc,EACvB,OAAO,SAAM,GACZ,cAAc;IAqBjB;;;OAGG;IACH,mBAAmB,CACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EAC5D,QAAQ,EAAE,aAAa,EACvB,MAAM,SAAM,GACX,cAAc;IA2CjB,OAAO,CAAC,WAAW;IA4CnB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAgCnB,+EAA+E;IAC/E,OAAO,CAAC,gBAAgB;IAoCxB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAkEhC;;OAEG;IACH,OAAO,CAAC,SAAS;IAiDjB;;;OAGG;IACH,OAAO,CAAC,UAAU;IA8DlB;;;OAGG;IACH,OAAO,CAAC,UAAU;CA2BnB"}
|
|
@@ -3,6 +3,23 @@ import { isFulltextLeaf, isFulltextIndexEntry, } from '../model';
|
|
|
3
3
|
import { assertSafeIdentifier, escapeIdentifier, mergeParams, } from '../utils/validation';
|
|
4
4
|
/** Maximum recursion depth for nested fulltext logical operators */
|
|
5
5
|
const MAX_DEPTH = 10;
|
|
6
|
+
/**
|
|
7
|
+
* Hard cap on the length of a fulltext phrase, in characters. Lucene
|
|
8
|
+
* itself accepts essentially unbounded query strings, but the OGM
|
|
9
|
+
* pipeline forwards untrusted user input directly to the driver — and
|
|
10
|
+
* a multi-megabyte phrase wastes round-trip bandwidth, parser CPU on
|
|
11
|
+
* the database side, and (for callers that pre-process via embedding
|
|
12
|
+
* providers) provider tokens. 8 KB is well above any legitimate
|
|
13
|
+
* search query.
|
|
14
|
+
*/
|
|
15
|
+
const MAX_FULLTEXT_PHRASE_LENGTH = 8 * 1024;
|
|
16
|
+
function assertValidFulltextPhrase(phrase) {
|
|
17
|
+
if (typeof phrase !== 'string' || phrase.trim().length === 0)
|
|
18
|
+
throw new OGMError('Fulltext phrase must not be empty');
|
|
19
|
+
if (phrase.length > MAX_FULLTEXT_PHRASE_LENGTH)
|
|
20
|
+
throw new OGMError(`Fulltext phrase exceeds the maximum length of ${MAX_FULLTEXT_PHRASE_LENGTH} characters ` +
|
|
21
|
+
`(got ${phrase.length}). Truncate or split the input before searching.`);
|
|
22
|
+
}
|
|
6
23
|
/**
|
|
7
24
|
* Compiles fulltext search input into Cypher CALL clauses using
|
|
8
25
|
* db.index.fulltext.queryNodes and db.index.fulltext.queryRelationships.
|
|
@@ -53,8 +70,7 @@ export class FulltextCompiler {
|
|
|
53
70
|
const indexName = keys[0];
|
|
54
71
|
assertSafeIdentifier(indexName, 'fulltext index name');
|
|
55
72
|
const input = fulltext[indexName];
|
|
56
|
-
|
|
57
|
-
throw new OGMError('Fulltext phrase must not be empty');
|
|
73
|
+
assertValidFulltextPhrase(input.phrase);
|
|
58
74
|
if (relIndex.name !== indexName)
|
|
59
75
|
throw new OGMError(`Unknown relationship fulltext index "${indexName}". Expected "${relIndex.name}".`);
|
|
60
76
|
const lines = [
|
|
@@ -108,8 +124,7 @@ export class FulltextCompiler {
|
|
|
108
124
|
}
|
|
109
125
|
/** Compile a node-level fulltext index: `{ IndexName: { phrase, score? } }` */
|
|
110
126
|
compileNodeIndex(indexName, input, nodeDef, nodeVar, paramCounter) {
|
|
111
|
-
|
|
112
|
-
throw new OGMError('Fulltext phrase must not be empty');
|
|
127
|
+
assertValidFulltextPhrase(input.phrase);
|
|
113
128
|
const nodeIndex = nodeDef.fulltextIndexes.find((idx) => idx.name === indexName);
|
|
114
129
|
if (!nodeIndex)
|
|
115
130
|
throw new OGMError(`Unknown fulltext index "${indexName}" for node "${nodeDef.typeName}"`);
|
|
@@ -154,8 +169,7 @@ export class FulltextCompiler {
|
|
|
154
169
|
const ftIndex = (relProps.fulltextIndexes ?? []).find((idx) => idx.name === indexName);
|
|
155
170
|
if (!ftIndex)
|
|
156
171
|
throw new OGMError(`Unknown fulltext index "${indexName}" on @relationshipProperties "${relDef.properties}"`);
|
|
157
|
-
|
|
158
|
-
throw new OGMError('Fulltext phrase must not be empty');
|
|
172
|
+
assertValidFulltextPhrase(input.phrase);
|
|
159
173
|
const paramName = `ft_phrase_${paramCounter.count++}`;
|
|
160
174
|
const params = { [paramName]: input.phrase };
|
|
161
175
|
const cypher = [
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fulltext.compiler.js","sourceRoot":"","sources":["../../../src/compilers/fulltext.compiler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACL,cAAc,EACd,oBAAoB,GAGrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,oEAAoE;AACpE,MAAM,SAAS,GAAG,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"fulltext.compiler.js","sourceRoot":"","sources":["../../../src/compilers/fulltext.compiler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACL,cAAc,EACd,oBAAoB,GAGrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,oEAAoE;AACpE,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,CAAC;AAE5C,SAAS,yBAAyB,CAAC,MAAe;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,QAAQ,CAAC,mCAAmC,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,0BAA0B;QAC5C,MAAM,IAAI,QAAQ,CAChB,iDAAiD,0BAA0B,cAAc;YACvF,QAAQ,MAAM,CAAC,MAAM,kDAAkD,CAC1E,CAAC;AACN,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IAC3B,YAAoB,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IAAG,CAAC;IAE9C;;;OAGG;IACH,OAAO,CACL,QAAuB,EACvB,OAAuB,EACvB,OAAO,GAAG,GAAG;QAEb,oBAAoB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAE1E,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,cAAc,CAAC,QAAQ,CAAC;YAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBACjC,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;gBACjE,CAAC;qBAAM,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC;QAEL,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,mBAAmB,CACjB,QAA4D,EAC5D,QAAuB,EACvB,MAAM,GAAG,GAAG;QAEZ,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,IAAI,QAAQ,CAChB,sDAAsD,CACvD,CAAC;QAEJ,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,oBAAoB,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAElC,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAC7B,MAAM,IAAI,QAAQ,CAChB,wCAAwC,SAAS,gBAAgB,QAAQ,CAAC,IAAI,IAAI,CACnF,CAAC;QAEJ,MAAM,KAAK,GAAG;YACZ,8CAA8C,SAAS,gBAAgB;YACvE,yBAAyB,MAAM,SAAS;SACzC,CAAC;QAEF,MAAM,MAAM,GAA4B,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACpE,MAAM,MAAM,GAAmB;YAC7B,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,MAAM;SACP,CAAC;QAEF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;YAC9B,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,gCAAgC;IAChC,8EAA8E;IAEtE,WAAW,CACjB,KAAoB,EACpB,OAAuB,EACvB,OAAe,EACf,YAA+B,EAC/B,KAAK,GAAG,CAAC;QAET,IAAI,KAAK,GAAG,SAAS;YACnB,MAAM,IAAI,QAAQ,CAChB,qDAAqD,SAAS,EAAE,CACjE,CAAC;QACJ,IAAI,cAAc,CAAC,KAAK,CAAC;YACvB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAEjE,IAAI,IAAI,IAAI,KAAK;YACf,OAAO,IAAI,CAAC,SAAS,CACnB,KAAK,CAAC,EAAE,EACR,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,GAAG,CAAC,CACV,CAAC;QACJ,IAAI,KAAK,IAAI,KAAK;YAChB,OAAO,IAAI,CAAC,UAAU,CACpB,KAAK,CAAC,GAAG,EACT,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,GAAG,CAAC,CACV,CAAC;QACJ,IAAI,KAAK,IAAI,KAAK;YAChB,OAAO,IAAI,CAAC,UAAU,CACpB,KAAK,CAAC,GAAG,EACT,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,GAAG,CAAC,CACV,CAAC;QAEJ,MAAM,IAAI,QAAQ,CAChB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,WAAW,CACjB,IAA6B,EAC7B,OAAuB,EACvB,OAAe,EACf,YAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,IAAI,QAAQ,CAChB,sDAAsD,CACvD,CAAC;QAEJ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,oBAAoB,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAEgB,CAAC;QAEvC,wDAAwD;QACxD,IAAI,oBAAoB,CAAC,KAAK,CAAC;YAC7B,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAE3E,2DAA2D;QAC3D,OAAO,IAAI,CAAC,wBAAwB,CAClC,GAAG,EACH,KAA2C,EAC3C,OAAO,EACP,OAAO,EACP,YAAY,CACb,CAAC;IACJ,CAAC;IAED,+EAA+E;IACvE,gBAAgB,CACtB,SAAiB,EACjB,KAAyB,EACzB,OAAuB,EACvB,OAAe,EACf,YAA+B;QAE/B,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAC5C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAChC,CAAC;QACF,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,QAAQ,CAChB,2BAA2B,SAAS,eAAe,OAAO,CAAC,QAAQ,GAAG,CACvE,CAAC;QAEJ,MAAM,SAAS,GAAG,aAAa,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,MAAM,GAA4B,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAEtE,MAAM,MAAM,GAAG;YACb,sCAAsC,SAAS,OAAO,SAAS,GAAG;YAClE,iBAAiB,OAAO,SAAS;SAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAElD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,YAAY,YAAY,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAC9B,YAAoB,EACpB,KAAyC,EACzC,OAAuB,EACvB,OAAe,EACf,YAA+B;QAE/B,6CAA6C;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,QAAQ,CAChB,+BAA+B,YAAY,cAAc,OAAO,CAAC,QAAQ,GAAG,CAC7E,CAAC;QAEJ,IAAI,CAAC,MAAM,CAAC,UAAU;YACpB,MAAM,IAAI,QAAQ,CAChB,iBAAiB,YAAY,SAAS,OAAO,CAAC,QAAQ,kCAAkC,CACzF,CAAC;QAEJ,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,QAAQ,CAChB,iCAAiC,MAAM,CAAC,UAAU,aAAa,CAChE,CAAC;QAEJ,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YACxB,MAAM,IAAI,QAAQ,CAChB,wDAAwD,CACzD,CAAC;QAEJ,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/B,oBAAoB,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAE/B,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAChC,CAAC;QACF,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,QAAQ,CAChB,2BAA2B,SAAS,iCAAiC,MAAM,CAAC,UAAU,GAAG,CAC1F,CAAC;QAEJ,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,aAAa,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,MAAM,GAA4B,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAEtE,MAAM,MAAM,GAAG;YACb,8CAA8C,SAAS,OAAO,SAAS,GAAG;YAC1E,kCAAkC;YAClC,0BAA0B,OAAO,SAAS;SAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAElD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,YAAY,YAAY,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,SAAS,CACf,QAAyB,EACzB,OAAuB,EACvB,OAAe,EACf,YAA+B,EAC/B,KAAa;QAEb,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAE5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,OAAO,IAAI,CAAC,WAAW,CACrB,QAAQ,CAAC,CAAC,CAAC,EACX,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,CACN,CAAC;QAEJ,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAC7B,MAAM,EACN,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,CACN,CAAC;YACF,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,aAAa,CAAC,IAAI,CAChB;gBACE,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC7C,YAAY,OAAO,SAAS;aAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;YACjC,GAAG;YACH,QAAQ,OAAO,uBAAuB;SACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED;;;OAGG;IACK,UAAU,CAChB,QAAyB,EACzB,OAAuB,EACvB,OAAe,EACf,YAA+B,EAC/B,KAAa;QAEb,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAE7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,OAAO,IAAI,CAAC,WAAW,CACrB,QAAQ,CAAC,CAAC,CAAC,EACX,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,CACN,CAAC;QAEJ,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,sCAAsC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAC5B,QAAQ,CAAC,CAAC,CAAC,EACX,OAAO,EACP,OAAO,EACP,YAAY,EACZ,KAAK,CACN,CAAC;QACF,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE/B,2EAA2E;QAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAC7B,QAAQ,CAAC,CAAC,CAAC,EACX,OAAO,EACP,GAAG,EACH,YAAY,EACZ,KAAK,CACN,CAAC;YACF,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAEtC,WAAW,CAAC,IAAI,CACd;gBACE,QAAQ;gBACR,UAAU,OAAO,EAAE;gBACnB,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC7C,eAAe,OAAO,EAAE;gBACxB,gBAAgB;gBAChB,GAAG;aACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,QAAQ,OAAO,SAAS,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED;;;OAGG;IACK,UAAU,CAChB,KAAoB,EACpB,OAAuB,EACvB,OAAe,EACf,YAA+B,EAC/B,KAAa;QAEb,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAClC,KAAK,EACL,OAAO,EACP,UAAU,EACV,YAAY,EACZ,KAAK,CACN,CAAC;QACF,MAAM,SAAS,GAA4B,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;QAErE,MAAM,MAAM,GAAG;YACb,UAAU,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;YACvD,oBAAoB;YACpB,KAAK,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAClD,sBAAsB,OAAO,EAAE;YAC/B,GAAG;YACH,QAAQ,OAAO,cAAc;SAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;CACF"}
|
|
@@ -117,9 +117,21 @@ function assertValidVector(vector) {
|
|
|
117
117
|
throw new OGMError(`Vector search "vector" contains a non-finite value at index ${i}`);
|
|
118
118
|
}
|
|
119
119
|
}
|
|
120
|
-
/**
|
|
120
|
+
/**
|
|
121
|
+
* Hard cap on the length of a vector-search phrase, in characters. The
|
|
122
|
+
* phrase is forwarded to the configured embedding provider (OpenAI,
|
|
123
|
+
* Vertex AI, etc.) which usually charges per token; without a cap an
|
|
124
|
+
* attacker can drive runaway billing and exhaust driver memory by
|
|
125
|
+
* sending a multi-megabyte phrase. 8 KB is well above any legitimate
|
|
126
|
+
* search query and below the embedding-provider limits we know about.
|
|
127
|
+
*/
|
|
128
|
+
const MAX_VECTOR_PHRASE_LENGTH = 8 * 1024;
|
|
129
|
+
/** Validate `phrase` is a non-empty, non-whitespace, length-capped string. */
|
|
121
130
|
function assertValidPhrase(phrase) {
|
|
122
131
|
if (typeof phrase !== 'string' || phrase.trim().length === 0)
|
|
123
132
|
throw new OGMError('Vector search "phrase" must be a non-empty string');
|
|
133
|
+
if (phrase.length > MAX_VECTOR_PHRASE_LENGTH)
|
|
134
|
+
throw new OGMError(`Vector search "phrase" exceeds the maximum length of ${MAX_VECTOR_PHRASE_LENGTH} characters ` +
|
|
135
|
+
`(got ${phrase.length}). Truncate or split the input before searching.`);
|
|
124
136
|
}
|
|
125
137
|
//# sourceMappingURL=vector.compiler.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vector.compiler.js","sourceRoot":"","sources":["../../../src/compilers/vector.compiler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,yEAAyE;AACzE,MAAM,KAAK,GAAG,IAAI,CAAC;AAOnB;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACzB,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,gBAAe,CAAC;IAEhB;;;OAGG;IACH,eAAe,CAAC,KAMf;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEnD,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,YAAY,MAAM,EAAE,CAAC;QAEzC,MAAM,MAAM,GAAG,oCAAoC,SAAS,MAAM,MAAM,MAAM,WAAW,0BAA0B,CAAC;QAEpH,MAAM,MAAM,GAA4B;YACtC,CAAC,SAAS,CAAC,EAAE,SAAS;YACtB,CAAC,MAAM,CAAC,EAAE,KAAK;YACf,CAAC,WAAW,CAAC,EAAE,MAAM;SACtB,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,KAOf;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEnD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE1B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YACvD,MAAM,IAAI,QAAQ,CAChB,iBAAiB,SAAS,0GAA0G,CACrI,CAAC;QAEJ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,YAAY,MAAM,EAAE,CAAC;QACzC,MAAM,aAAa,GAAG,cAAc,MAAM,EAAE,CAAC;QAC7C,MAAM,gBAAgB,GAAG,oBAAoB,MAAM,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,eAAe,MAAM,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAG;YACb,6BAA6B,WAAW,MAAM,aAAa,MAAM,gBAAgB,qBAAqB,UAAU,EAAE;YAClH,oCAAoC,SAAS,MAAM,MAAM,KAAK,UAAU,0BAA0B;SACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAA4B;YACtC,CAAC,SAAS,CAAC,EAAE,SAAS;YACtB,CAAC,MAAM,CAAC,EAAE,KAAK;YACf,CAAC,WAAW,CAAC,EAAE,MAAM;YACrB,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,QAAQ;YAC/B,CAAC,gBAAgB,CAAC,EAAE,cAAc,IAAI,EAAE;SACzC,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;;;;OAMG;IACK,iBAAiB,CACvB,SAAiB,EACjB,OAAuB;QAEvB,oBAAoB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,IAAI,QAAQ,CAChB,0BAA0B,SAAS,uBAAuB,OAAO,CAAC,QAAQ,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,gEAAgE;AAChE,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,2CAA2C,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,0CAA0C,CAAC,CAAC;IACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAChB,+DAA+D,CAAC,EAAE,CACnE,CAAC;IACN,CAAC;AACH,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"vector.compiler.js","sourceRoot":"","sources":["../../../src/compilers/vector.compiler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,yEAAyE;AACzE,MAAM,KAAK,GAAG,IAAI,CAAC;AAOnB;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACzB,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,gBAAe,CAAC;IAEhB;;;OAGG;IACH,eAAe,CAAC,KAMf;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEnD,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,YAAY,MAAM,EAAE,CAAC;QAEzC,MAAM,MAAM,GAAG,oCAAoC,SAAS,MAAM,MAAM,MAAM,WAAW,0BAA0B,CAAC;QAEpH,MAAM,MAAM,GAA4B;YACtC,CAAC,SAAS,CAAC,EAAE,SAAS;YACtB,CAAC,MAAM,CAAC,EAAE,KAAK;YACf,CAAC,WAAW,CAAC,EAAE,MAAM;SACtB,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,KAOf;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEnD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE1B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YACvD,MAAM,IAAI,QAAQ,CAChB,iBAAiB,SAAS,0GAA0G,CACrI,CAAC;QAEJ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,YAAY,MAAM,EAAE,CAAC;QACzC,MAAM,aAAa,GAAG,cAAc,MAAM,EAAE,CAAC;QAC7C,MAAM,gBAAgB,GAAG,oBAAoB,MAAM,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,eAAe,MAAM,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAG;YACb,6BAA6B,WAAW,MAAM,aAAa,MAAM,gBAAgB,qBAAqB,UAAU,EAAE;YAClH,oCAAoC,SAAS,MAAM,MAAM,KAAK,UAAU,0BAA0B;SACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAA4B;YACtC,CAAC,SAAS,CAAC,EAAE,SAAS;YACtB,CAAC,MAAM,CAAC,EAAE,KAAK;YACf,CAAC,WAAW,CAAC,EAAE,MAAM;YACrB,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,QAAQ;YAC/B,CAAC,gBAAgB,CAAC,EAAE,cAAc,IAAI,EAAE;SACzC,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;;;;OAMG;IACK,iBAAiB,CACvB,SAAiB,EACjB,OAAuB;QAEvB,oBAAoB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,IAAI,QAAQ,CAChB,0BAA0B,SAAS,uBAAuB,OAAO,CAAC,QAAQ,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,gEAAgE;AAChE,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,2CAA2C,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,0CAA0C,CAAC,CAAC;IACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAChB,+DAA+D,CAAC,EAAE,CACnE,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,CAAC;AAE1C,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,QAAQ,CAAC,mDAAmD,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,GAAG,wBAAwB;QAC1C,MAAM,IAAI,QAAQ,CAChB,wDAAwD,wBAAwB,cAAc;YAC5F,QAAQ,MAAM,CAAC,MAAM,kDAAkD,CAC1E,CAAC;AACN,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"result-mapper.d.ts","sourceRoot":"","sources":["../../../src/execution/result-mapper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;GAIG;AACH,qBAAa,YAAY;IACvB;;;;OAIG;IACH,MAAM,CAAC,SAAS,CACd,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAU1B;;OAEG;IACH,MAAM,CAAC,UAAU,CACf,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IAI5B;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAU,GAAG,OAAO;
|
|
1
|
+
{"version":3,"file":"result-mapper.d.ts","sourceRoot":"","sources":["../../../src/execution/result-mapper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;GAIG;AACH,qBAAa,YAAY;IACvB;;;;OAIG;IACH,MAAM,CAAC,SAAS,CACd,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAU1B;;OAEG;IACH,MAAM,CAAC,UAAU,CACf,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IAI5B;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAU,GAAG,OAAO;CAsErE"}
|
|
@@ -41,9 +41,15 @@ export class ResultMapper {
|
|
|
41
41
|
// Fast path: primitives (most common in query results)
|
|
42
42
|
if (typeof value !== 'object')
|
|
43
43
|
return value;
|
|
44
|
-
// Neo4j Integer → number
|
|
44
|
+
// Neo4j Integer → number (or BigInt when the value exceeds the
|
|
45
|
+
// safe-integer range). Pre-1.7.3 this always called `toNumber()`,
|
|
46
|
+
// which silently truncated values above 2^53 — e.g. a stored id
|
|
47
|
+
// of `9007199254740993n` came back as `9007199254740992`. Now we
|
|
48
|
+
// gate on `inSafeRange()` and fall back to BigInt for out-of-range
|
|
49
|
+
// values so consumers see the exact stored value (or can detect
|
|
50
|
+
// the BigInt and route accordingly).
|
|
45
51
|
if (neo4j.isInt(value))
|
|
46
|
-
return value.toNumber();
|
|
52
|
+
return value.inSafeRange() ? value.toNumber() : value.toBigInt();
|
|
47
53
|
// Array → map each element (check before other object types)
|
|
48
54
|
if (Array.isArray(value))
|
|
49
55
|
return value.map((item) => ResultMapper.convertNeo4jTypes(item, depth + 1));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"result-mapper.js","sourceRoot":"","sources":["../../../src/execution/result-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,cAAc,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACvB;;;;OAIG;IACH,MAAM,CAAC,SAAS,CACd,MAAmB,EACnB,SAAkB;QAElB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,OAAO,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAA4B,CAAC;QAC1E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAA4B,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CACf,OAAsB,EACtB,SAAkB;QAElB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAc,EAAE,QAAgB,CAAC;QACxD,4DAA4D;QAC5D,IAAI,KAAK,GAAG,EAAE;YACZ,MAAM,IAAI,QAAQ,CAChB,sGAAsG,CACvG,CAAC;QAEJ,4BAA4B;QAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAExD,uDAAuD;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5C,
|
|
1
|
+
{"version":3,"file":"result-mapper.js","sourceRoot":"","sources":["../../../src/execution/result-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,cAAc,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACvB;;;;OAIG;IACH,MAAM,CAAC,SAAS,CACd,MAAmB,EACnB,SAAkB;QAElB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,OAAO,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAA4B,CAAC;QAC1E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAA4B,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CACf,OAAsB,EACtB,SAAkB;QAElB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAc,EAAE,QAAgB,CAAC;QACxD,4DAA4D;QAC5D,IAAI,KAAK,GAAG,EAAE;YACZ,MAAM,IAAI,QAAQ,CAChB,sGAAsG,CACvG,CAAC;QAEJ,4BAA4B;QAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAExD,uDAAuD;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5C,+DAA+D;QAC/D,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,gEAAgE;QAChE,qCAAqC;QACrC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YACpB,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAEnE,6DAA6D;QAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACtB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAChD,CAAC;QAEJ,oCAAoC;QACpC,IACE,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACnB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACnB,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC;YAC5B,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC;YACxB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAEvB,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QAE1B,6BAA6B;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAA4B;gBACrC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACV,CAAC,EAAE,KAAK,CAAC,CAAC;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC;YACF,IAAI,KAAK,CAAC,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,YAAY,KAAK,CAAC,KAAK,CAAC,IAAI;YACnC,OAAO,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAErE,8CAA8C;QAC9C,IAAI,KAAK,YAAY,KAAK,CAAC,KAAK,CAAC,YAAY;YAC3C,OAAO,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAErE,6BAA6B;QAC7B,IAAI,KAAK,YAAY,KAAK,CAAC,KAAK,CAAC,IAAI;YACnC,MAAM,IAAI,QAAQ,CAAC,uCAAuC,CAAC,CAAC;QAE9D,4FAA4F;QAC5F,MAAM,MAAM,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAE/D,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
|
|
@@ -1,9 +1,18 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Escapes special Lucene characters in a query string.
|
|
3
|
-
* Special characters: + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
|
|
4
3
|
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* Symbol-form operators escaped:
|
|
5
|
+
* + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
|
|
6
|
+
*
|
|
7
|
+
* Bareword booleans (`AND`, `OR`, `NOT`, `TO`) are also neutralised. Pre-
|
|
8
|
+
* 1.7.3 they survived sanitisation, letting an attacker inject a boolean
|
|
9
|
+
* query (e.g. `foo AND _exists_:adminFlag`) even after symbol escaping.
|
|
10
|
+
* The standard Lucene analyser lowercases tokens during indexing, so
|
|
11
|
+
* lowercasing the bareword turns it into a literal-word match — which
|
|
12
|
+
* is what callers of `sanitizeLuceneQuery` expect (the function exists
|
|
13
|
+
* to make untrusted user input safe to pass to Lucene). Range-modifier
|
|
14
|
+
* boost/fuzzy (`^N`, `~N`) are already disarmed because `^` and `~`
|
|
15
|
+
* get backslash-escaped in the symbol pass.
|
|
7
16
|
*/
|
|
8
17
|
export declare function sanitizeLuceneQuery(query: string): string;
|
|
9
18
|
//# sourceMappingURL=lucene.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lucene.d.ts","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"lucene.d.ts","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBzD"}
|
package/dist/esm/utils/lucene.js
CHANGED
|
@@ -1,22 +1,37 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Escapes special Lucene characters in a query string.
|
|
3
|
-
* Special characters: + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
|
|
4
3
|
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* Symbol-form operators escaped:
|
|
5
|
+
* + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /
|
|
6
|
+
*
|
|
7
|
+
* Bareword booleans (`AND`, `OR`, `NOT`, `TO`) are also neutralised. Pre-
|
|
8
|
+
* 1.7.3 they survived sanitisation, letting an attacker inject a boolean
|
|
9
|
+
* query (e.g. `foo AND _exists_:adminFlag`) even after symbol escaping.
|
|
10
|
+
* The standard Lucene analyser lowercases tokens during indexing, so
|
|
11
|
+
* lowercasing the bareword turns it into a literal-word match — which
|
|
12
|
+
* is what callers of `sanitizeLuceneQuery` expect (the function exists
|
|
13
|
+
* to make untrusted user input safe to pass to Lucene). Range-modifier
|
|
14
|
+
* boost/fuzzy (`^N`, `~N`) are already disarmed because `^` and `~`
|
|
15
|
+
* get backslash-escaped in the symbol pass.
|
|
7
16
|
*/
|
|
8
17
|
export function sanitizeLuceneQuery(query) {
|
|
9
|
-
//
|
|
10
|
-
//
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
//
|
|
18
|
+
// FIRST pass: neutralise bareword booleans BEFORE the placeholder dance
|
|
19
|
+
// below. Running this last would let user-typed " AND " / " OR " collide
|
|
20
|
+
// with the restoration regex (which matches those exact tokens) and
|
|
21
|
+
// wrongly rewrite literal user words to escaped `\&\&` / `\|\|`. Running
|
|
22
|
+
// this first turns user `foo AND bar` into `foo and bar` (literal-word
|
|
23
|
+
// match) before any other pass sees it. Word boundaries (`\b`) keep us
|
|
24
|
+
// from touching middle-of-word matches like `BAND` or `STOP`.
|
|
25
|
+
let result = query.replace(/\b(AND|OR|NOT|TO)\b/g, (match) => match.toLowerCase());
|
|
26
|
+
// Second pass: escape multi-char operators as atomic units. We use
|
|
27
|
+
// " AND " / " OR " as placeholders (rather than NULL bytes) because
|
|
28
|
+
// the lowercase pass above guarantees no user-typed uppercase " AND "
|
|
29
|
+
// / " OR " can survive to collide with the restoration regex below.
|
|
30
|
+
result = result.replace(/&&/g, ' AND ').replace(/\|\|/g, ' OR ');
|
|
31
|
+
// Third pass: escape individual special characters (& and | individually)
|
|
15
32
|
result = result.replace(/([+\-&|!(){}[\]^"~*?:\\/])/g, '\\$1');
|
|
16
|
-
//
|
|
17
|
-
result = result
|
|
18
|
-
.replace(/\u0000AND\u0000/g, '\\&\\&')
|
|
19
|
-
.replace(/\u0000OR\u0000/g, '\\|\\|');
|
|
33
|
+
// Fourth pass: restore multi-char operators with proper escaping
|
|
34
|
+
result = result.replace(/ AND /g, '\\&\\&').replace(/ OR /g, '\\|\\|');
|
|
20
35
|
return result;
|
|
21
36
|
}
|
|
22
37
|
//# sourceMappingURL=lucene.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lucene.js","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"lucene.js","sourceRoot":"","sources":["../../../src/utils/lucene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3D,KAAK,CAAC,WAAW,EAAE,CACpB,CAAC;IAEF,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjE,0EAA0E;IAC1E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IAE/D,iEAAiE;IACjE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEvE,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "grafeo-ogm",
|
|
3
|
-
"version": "1.7.
|
|
3
|
+
"version": "1.7.3",
|
|
4
4
|
"description": "Type-safe Neo4j ORM / OGM for TypeScript. Define your graph in GraphQL SDL, get fully typed Prisma-like CRUD, optimized Cypher, and zero-config code generation. Community successor to @neo4j/graphql-ogm.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "Alejandro Guzman",
|