inibase 1.5.11 → 1.6.0

package/dist/cli.js

@@ -7,7 +7,8 @@ import { parseArgs } from "node:util";
 import Inison from "inison";
 import { isExists } from "./file.js";
 import Inibase, {} from "./index.js";
-import { isNumber, isStringified, setField, unsetField } from "./utils.js";
+import { isNumber, isStringified, isValidName, setField, unsetField, } from "./utils.js";
+const isSafeName = (input) => isValidName(input);
 const textGreen = (input) => `\u001b[1;32m${input}\u001b[0m`;
 const textRed = (input) => `\u001b[1;31m${input}\u001b[0m`;
 const textBlue = (input) => `\u001b[1;34m${input}\u001b[0m`;
@@ -178,7 +179,9 @@ rl.on("line", async (input) => {
                 console.log(`${textRed("  Err:")} Please specify table name`);
                 break;
             }
-            if (!(await isExists(join(path, splitedInput[1]))))
+            if (!isSafeName(splitedInput[1]))
+                console.log(`${textRed("  Err:")} Invalid table name, only alphanumeric characters, underscores and hyphens are allowed`);
+            else if (!(await isExists(join(path, splitedInput[1]))))
                 console.log(`${textRed("  Err:")} Table doesn't exist`);
             else {
                 table = splitedInput[1];

package/dist/index.d.ts

@@ -51,7 +51,7 @@ declare global {
         entries<T extends object>(o: T): Entries<T>;
     }
 }
-export declare const ERROR_CODES: readonly ["GROUP_UNIQUE", "FIELD_UNIQUE", "FIELD_REQUIRED", "NO_SCHEMA", "TABLE_EMPTY", "INVALID_ID", "INVALID_TYPE", "INVALID_PARAMETERS", "NO_ENV", "TABLE_EXISTS", "TABLE_NOT_EXISTS", "INVALID_REGEX_MATCH"];
+export declare const ERROR_CODES: readonly ["GROUP_UNIQUE", "FIELD_UNIQUE", "FIELD_REQUIRED", "NO_SCHEMA", "TABLE_EMPTY", "INVALID_ID", "INVALID_TYPE", "INVALID_PARAMETERS", "NO_ENV", "TABLE_EXISTS", "TABLE_NOT_EXISTS", "INVALID_REGEX_MATCH", "INVALID_NAME"];
 export type ErrorCode = (typeof ERROR_CODES)[number];
 export type ErrorLang = "en" | "ar" | "fr" | "es";
 export declare const globalConfig: {

package/dist/index.js

@@ -21,6 +21,7 @@ export const ERROR_CODES = [
     "TABLE_EXISTS",
     "TABLE_NOT_EXISTS",
     "INVALID_REGEX_MATCH",
+    "INVALID_NAME",
 ];
 // hide ExperimentalWarning glob()
 process.removeAllListeners("warning");
@@ -39,6 +40,7 @@ export default class Inibase {
     uniqueMap;
     schemaFileExtension = process.env.INIBASE_SCHEMA_EXTENSION ?? "json";
     constructor(database, mainFolder = ".", language = "en") {
+        Utils.validateName(database);
         this.databasePath = join(mainFolder, database);
         this.language = language;
         this.pageInfo = {};
@@ -69,6 +71,7 @@ export default class Inibase {
             INVALID_TYPE: "Expect {variable} to be {variable}, got {variable} instead",
             INVALID_PARAMETERS: "The given parameters are not valid",
             INVALID_REGEX_MATCH: "Field {variable} does not match the expected pattern",
+            INVALID_NAME: "Name {variable} is not valid",
             NO_ENV: Number(process.versions.node.split(".").reduce((a, b) => a + b)) >= 26
                 ? "please run with '--env-file=.env'"
                 : "please use dotenv",
@@ -85,6 +88,7 @@ export default class Inibase {
             INVALID_TYPE: "من المتوقع أن يكون {variable} من النوع {variable}، لكن تم العثور على {variable} بدلاً من ذلك",
             INVALID_PARAMETERS: "المعلمات المقدمة غير صالحة",
             INVALID_REGEX_MATCH: "الحقل {variable} لا يتطابق مع النمط المتوقع",
+            INVALID_NAME: "الاسم {variable} غير صالح",
             NO_ENV: Number(process.versions.node.split(".").reduce((a, b) => a + b)) >= 26
                 ? "يرجى التشغيل باستخدام '--env-file=.env'"
                 : "يرجى استخدام dotenv",
@@ -101,6 +105,7 @@ export default class Inibase {
             INVALID_TYPE: "Attendu que {variable} soit de type {variable}, mais trouvé {variable} à la place",
             INVALID_PARAMETERS: "Les paramètres donnés ne sont pas valides",
             INVALID_REGEX_MATCH: "Le champ {variable} ne correspond pas au modèle attendu",
+            INVALID_NAME: "Le nom {variable} n'est pas valide",
             NO_ENV: Number(process.versions.node.split(".").reduce((a, b) => a + b)) >= 26
                 ? "veuillez exécuter avec '--env-file=.env'"
                 : "veuillez utiliser dotenv",
@@ -117,6 +122,7 @@ export default class Inibase {
             INVALID_TYPE: "Se espera que {variable} sea {variable}, pero se encontró {variable} en su lugar",
             INVALID_PARAMETERS: "Los parámetros proporcionados no son válidos",
             INVALID_REGEX_MATCH: "El campo {variable} no coincide con el patrón esperado",
+            INVALID_NAME: "El nombre {variable} no es válido",
             NO_ENV: Number(process.versions.node.split(".").reduce((a, b) => a + b)) >= 26
                 ? "por favor ejecute con '--env-file=.env'"
                 : "por favor use dotenv",
@@ -163,6 +169,9 @@ export default class Inibase {
      * @param {TableConfig} [config]
      */
     async createTable(tableName, schema, config) {
+        Utils.validateName(tableName);
+        if (schema)
+            Utils.validateSchema(schema);
         const tablePath = join(this.databasePath, tableName);
         if (await File.isExists(tablePath))
             throw this.createError("TABLE_EXISTS", tableName);
@@ -211,11 +220,15 @@ export default class Inibase {
      * @param {(TableConfig&{name?: string})} [config]
      */
     async updateTable(tableName, schema, config) {
+        Utils.validateName(tableName);
+        if (config?.name)
+            Utils.validateName(config.name);
         const table = await this.getTable(tableName);
         if (!table)
             return;
         const tablePath = join(this.databasePath, tableName);
         if (schema) {
+            Utils.validateSchema(schema);
             // remove id from schema
             schema = schema.filter(({ key }) => !["id", "createdAt", "updatedAt"].includes(key));
             let schemaIdFilePath = "";
@@ -330,6 +343,7 @@ export default class Inibase {
      * @return {*}  {Promise<TableObject | undefined>}
      */
     async getTable(tableName) {
+        Utils.validateName(tableName);
         const tablePath = join(this.databasePath, tableName);
         if (!(await File.isExists(tablePath)))
             throw this.createError("TABLE_NOT_EXISTS", tableName);
@@ -349,6 +363,7 @@ export default class Inibase {
         return globalConfig[this.databasePath].tables?.get(tableName);
     }
     async getTableSchema(tableName) {
+        Utils.validateName(tableName);
         const tablePath = join(this.databasePath, tableName);
         let schemaFile;
         let schema;
@@ -1151,6 +1166,7 @@ export default class Inibase {
      * @param {string} tableName
      */
     async clearCache(tableName) {
+        Utils.validateName(tableName);
         const cacheFolderPath = join(this.databasePath, tableName, ".cache");
         await rm(cacheFolderPath, { recursive: true, force: true });
         await mkdir(cacheFolderPath);
@@ -1159,12 +1175,15 @@ export default class Inibase {
         page: 1,
         perPage: 15,
     }, onlyOne, onlyLinesNumbers, _whereIsLinesNumbers) {
+        Utils.validateName(tableName);
         const tablePath = join(this.databasePath, tableName);
         // Ensure options.columns is an array
         if (options.columns) {
             options.columns = Array.isArray(options.columns)
                 ? options.columns
                 : [options.columns];
+            for (const column of options.columns)
+                Utils.validateName(column);
             if (options.columns.length && !options.columns.includes("id"))
                 options.columns.push("id");
         }
@@ -1407,6 +1426,12 @@ export default class Inibase {
                 page: 1,
                 perPage: 15,
             };
+        Utils.validateName(tableName);
+        if (options.columns)
+            for (const column of (Array.isArray(options.columns)
+                ? options.columns
+                : [options.columns]))
+                Utils.validateName(column);
         const tablePath = join(this.databasePath, tableName);
         await this.getTable(tableName);
         if (!globalConfig[this.databasePath].tables?.get(tableName)?.schema)
@@ -1487,6 +1512,12 @@ export default class Inibase {
         perPage: 15,
     }, returnUpdatedData, _whereIsLinesNumbers) {
         const renameList = [];
+        Utils.validateName(tableName);
+        if (options.columns)
+            for (const column of (Array.isArray(options.columns)
+                ? options.columns
+                : [options.columns]))
+                Utils.validateName(column);
         const tablePath = join(this.databasePath, tableName);
         await this.throwErrorIfTableEmpty(tableName);
         let clonedData = structuredClone(data);
@@ -1601,6 +1632,7 @@ export default class Inibase {
      * @return {boolean | null}  {(Promise<boolean | null>)}
      */
     async delete(tableName, where, _whereIsLinesNumbers) {
+        Utils.validateName(tableName);
         const tablePath = join(this.databasePath, tableName);
         await this.throwErrorIfTableEmpty(tableName);
         if (!where) {
@@ -1694,11 +1726,14 @@ export default class Inibase {
         return false;
     }
     async sum(tableName, columns, where) {
-        const RETURN = {};
-        const tablePath = join(this.databasePath, tableName);
-        await this.throwErrorIfTableEmpty(tableName);
+        Utils.validateName(tableName);
         if (!Array.isArray(columns))
             columns = [columns];
+        for (const column of columns)
+            Utils.validateName(column);
+        await this.throwErrorIfTableEmpty(tableName);
+        const RETURN = {};
+        const tablePath = join(this.databasePath, tableName);
         for await (const column of columns) {
             const columnPath = join(tablePath, `${column}${this.getFileExtension(tableName)}`);
             if (await File.isExists(columnPath)) {
@@ -1715,11 +1750,14 @@ export default class Inibase {
         return columns.length > 1 ? RETURN : Object.values(RETURN)[0];
     }
     async max(tableName, columns, where) {
+        Utils.validateName(tableName);
+        if (!Array.isArray(columns))
+            columns = [columns];
+        for (const column of columns)
+            Utils.validateName(column);
         const RETURN = {};
         const tablePath = join(this.databasePath, tableName);
         await this.throwErrorIfTableEmpty(tableName);
-        if (!Array.isArray(columns))
-            columns = [columns];
         for await (const column of columns) {
             const columnPath = join(tablePath, `${column}${this.getFileExtension(tableName)}`);
             if (await File.isExists(columnPath)) {
@@ -1736,11 +1774,14 @@ export default class Inibase {
         return RETURN;
     }
     async min(tableName, columns, where) {
+        Utils.validateName(tableName);
+        if (!Array.isArray(columns))
+            columns = [columns];
+        for (const column of columns)
+            Utils.validateName(column);
         const RETURN = {};
         const tablePath = join(this.databasePath, tableName);
         await this.throwErrorIfTableEmpty(tableName);
-        if (!Array.isArray(columns))
-            columns = [columns];
         for await (const column of columns) {
             const columnPath = join(tablePath, `${column}${this.getFileExtension(tableName)}`);
             if (await File.isExists(columnPath)) {

package/dist/utils.d.ts

@@ -218,3 +218,33 @@ export declare const findLastIdNumber: (schema: Schema) => number;
 export declare function addIdToSchema(schema: Schema, startWithID: {
     value: number;
 }): Field[];
+/**
+ * Validates that a string is a safe name for a table, database or column.
+ *
+ * Names must match `^[a-zA-Z0-9][a-zA-Z0-9_-]*$` (starts with an alphanumeric
+ * character, followed by alphanumerics, underscores or hyphens) and be at most
+ * 255 characters long.
+ *
+ * This prevents path traversal (`../`, `..\\`), null-byte injection (`\0`),
+ * shell injection (`;`, `|`, backticks, `$()`, spaces, slashes) and other
+ * reserved-name issues.
+ *
+ * @param input - The value to be checked.
+ * @returns boolean - True if the name is safe to use, false otherwise.
+ */
+export declare const isValidName: (input: unknown) => input is string;
+/**
+ * Validates that a string is a safe name for a table, database or column and
+ * throws an error if it is not.
+ *
+ * @param name - The name to validate.
+ * @throws {Error} If the name is not a safe name.
+ */
+export declare const validateName: (name: string) => void;
+/**
+ * Recursively validates every field key of a schema.
+ *
+ * @param schema - The schema to validate.
+ * @throws {Error} If any field key is not a safe name.
+ */
+export declare const validateSchema: (schema: Schema) => void;

package/dist/utils.js

@@ -628,3 +628,47 @@ export function addIdToSchema(schema, startWithID) {
     const addIdToSchemaHelper = (schema) => schema.map(addIdToField);
     return addIdToSchemaHelper(clonedSchema);
 }
+/**
+ * Validates that a string is a safe name for a table, database or column.
+ *
+ * Names must match `^[a-zA-Z0-9][a-zA-Z0-9_-]*$` (starts with an alphanumeric
+ * character, followed by alphanumerics, underscores or hyphens) and be at most
+ * 255 characters long.
+ *
+ * This prevents path traversal (`../`, `..\\`), null-byte injection (`\0`),
+ * shell injection (`;`, `|`, backticks, `$()`, spaces, slashes) and other
+ * reserved-name issues.
+ *
+ * @param input - The value to be checked.
+ * @returns boolean - True if the name is safe to use, false otherwise.
+ */
+export const isValidName = (input) => typeof input === "string" &&
+    input.length > 0 &&
+    input.length <= 255 &&
+    /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(input);
+/**
+ * Validates that a string is a safe name for a table, database or column and
+ * throws an error if it is not.
+ *
+ * @param name - The name to validate.
+ * @throws {Error} If the name is not a safe name.
+ */
+export const validateName = (name) => {
+    if (!isValidName(name))
+        throw new Error(`Invalid name: '${name}'. Names must contain only alphanumeric characters, underscores or hyphens, must start with an alphanumeric character and must be at most 255 characters long.`);
+};
+/**
+ * Recursively validates every field key of a schema.
+ *
+ * @param schema - The schema to validate.
+ * @throws {Error} If any field key is not a safe name.
+ */
+export const validateSchema = (schema) => {
+    for (const field of schema) {
+        validateName(field.key);
+        if (field.table)
+            validateName(field.table);
+        if (field.children && isArrayOfObjects(field.children))
+            validateSchema(field.children);
+    }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inibase",
-  "version": "1.5.11",
+  "version": "1.6.0",
   "type": "module",
   "author": {
     "name": "Karim Amahtil",