inibase 1.0.0-rc.102 → 1.0.0-rc.104

package/dist/file.d.ts

@@ -3,6 +3,7 @@ export declare const lock: (folderPath: string, prefix?: string) => Promise<void
 export declare const unlock: (folderPath: string, prefix?: string) => Promise<void>;
 export declare const write: (filePath: string, data: any) => Promise<void>;
 export declare const read: (filePath: string) => Promise<string>;
+export declare function escapeShellPath(filePath: string): string;
 /**
  * Checks if a file or directory exists at the specified path.
  *

package/dist/file.js

@@ -1,14 +1,14 @@
 import { createWriteStream } from "node:fs";
 import { access, appendFile, copyFile, constants as fsConstants, open, readFile, unlink, writeFile, } from "node:fs/promises";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGunzip, createGzip } from "node:zlib";
+import { spawn as spawnSync } from "node:child_process";
 import Inison from "inison";
 import { detectFieldType, isArrayOfObjects, isStringified, isNumber, isObject, } from "./utils.js";
 import { compare, encodeID, exec, gunzip, gzip } from "./utils.server.js";
-import { spawn } from "node:child_process";
 export const lock = async (folderPath, prefix) => {
     let lockFile = null;
     const lockFilePath = join(folderPath, `${prefix ?? ""}.locked`);
@@ -36,6 +36,12 @@ export const write = async (filePath, data) => {
 export const read = async (filePath) => filePath.endsWith(".gz")
     ? (await gunzip(await readFile(filePath, "utf8"))).toString()
     : await readFile(filePath, "utf8");
+export function escapeShellPath(filePath) {
+    // Resolve the path to avoid relative path issues
+    const resolvedPath = resolve(filePath);
+    // Escape double quotes and special shell characters
+    return resolvedPath.replace(/(["\\$`])/g, "\\$1");
+}
 const _pipeline = async (filePath, rl, writeStream, transform) => {
     if (filePath.endsWith(".gz"))
         await pipeline(rl, transform, createGzip(), writeStream);
@@ -194,9 +200,10 @@ export async function get(filePath, lineNumbers, fieldType, fieldChildrenType, s
             }
         }
         else if (lineNumbers == -1) {
+            const escapedFilePath = `${escapeShellPath(filePath)}`;
             const command = filePath.endsWith(".gz")
-                ? `zcat ${filePath} | sed -n '$p'`
-                : `sed -n '$p' ${filePath}`, foundedLine = (await exec(command)).stdout.trimEnd();
+                ? `zcat ${escapedFilePath} | sed -n '$p'`
+                : `sed -n '$p' ${escapedFilePath}`, foundedLine = (await exec(command)).stdout.trimEnd();
             if (foundedLine)
                 lines[linesCount] = decode(foundedLine, fieldType, fieldChildrenType, secretKey);
         }
@@ -215,9 +222,10 @@ export async function get(filePath, lineNumbers, fieldType, fieldChildrenType, s
                 }
                 return [lines, linesCount];
             }
+            const escapedFilePath = `${escapeShellPath(filePath)}`;
             const command = filePath.endsWith(".gz")
-                ? `zcat ${filePath} | sed -n '${lineNumbers.join("p;")}p'`
-                : `sed -n '${lineNumbers.join("p;")}p' ${filePath}`, foundedLines = (await exec(command)).stdout.trimEnd().split("\n");
+                ? `zcat "${escapedFilePath}" | sed -n '${lineNumbers.join("p;")}p'`
+                : `sed -n '${lineNumbers.join("p;")}p' "${escapedFilePath}"`, foundedLines = (await exec(command)).stdout.trimEnd().split("\n");
             let index = 0;
             for (const line of foundedLines) {
                 lines[lineNumbers[index]] = decode(line, fieldType, fieldChildrenType, secretKey);
@@ -278,7 +286,7 @@ export const replace = async (filePath, replacements, totalItems) => {
         }
         else {
             return new Promise((resolve) => {
-                const sedProcess = spawn("sed", [
+                const sedProcess = spawnSync("sed", [
                     "-e",
                     `s/.*/${replacements}/`,
                     "-e",
@@ -347,9 +355,10 @@ export const append = async (filePath, data) => {
                 await appendFile(fileTempPath, `${Array.isArray(data) ? data.join("\n") : data}\n`);
             }
             else {
+                const escapedFileTempPath = `${escapeShellPath(fileTempPath)}`;
                 await exec(`echo $'${(Array.isArray(data) ? data.join("\n") : data)
                     .toString()
-                    .replace(/'/g, "\\'")}' | gzip - >> ${fileTempPath}`);
+                    .replace(/'/g, "\\'")}' | gzip - >> ${escapedFileTempPath}`);
             }
         }
         else
@@ -402,7 +411,10 @@ export const prepend = async (filePath, data) => {
             const fileChildTempPath = filePath.replace(/([^/]+)\/?$/, ".tmp/tmp_$1");
             try {
                 await write(fileChildTempPath, `${Array.isArray(data) ? data.join("\n") : data}\n`);
-                await exec(`cat ${fileChildTempPath} ${filePath} > ${fileTempPath}`);
+                const escapedFilePath = `${escapeShellPath(filePath)}`;
+                const escapedFileTempPath = `${escapeShellPath(fileTempPath)}`;
+                const escapedFileChildTempPath = `${escapeShellPath(fileChildTempPath)}`;
+                await exec(`cat ${escapedFileChildTempPath} ${escapedFilePath} > ${escapedFileTempPath}`);
             }
             catch {
                 return [fileTempPath, null];
@@ -439,9 +451,11 @@ export const remove = async (filePath, linesToDelete) => {
         throw new Error("UNVALID_LINE_NUMBERS");
     const fileTempPath = filePath.replace(/([^/]+)\/?$/, ".tmp/$1");
     try {
+        const escapedFilePath = `${escapeShellPath(filePath)}`;
+        const escapedFileTempPath = `${escapeShellPath(fileTempPath)}`;
         const command = filePath.endsWith(".gz")
-            ? `zcat ${filePath} | sed "${linesToDelete.join("d;")}d" | gzip > ${fileTempPath}`
-            : `sed "${linesToDelete.join("d;")}d" ${filePath} > ${fileTempPath}`;
+            ? `zcat ${escapedFilePath} | sed "${linesToDelete.join("d;")}d" | gzip > ${fileTempPath}`
+            : `sed "${linesToDelete.join("d;")}d" ${escapedFilePath} > ${escapedFileTempPath}`;
         await exec(command);
         return [fileTempPath, filePath];
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inibase",
-  "version": "1.0.0-rc.102",
+  "version": "1.0.0-rc.104",
   "type": "module",
   "author": {
     "name": "Karim Amahtil",
@@ -19,7 +19,7 @@
   },
   "description": "A file-based & memory-efficient, serverless, ACID compliant, relational database management system",
   "engines": {
-    "node": ">=16"
+    "node": ">=22"
   },
   "files": [
     "/dist"