inibase 1.6.4 → 1.6.6

package/README.md

@@ -634,6 +634,11 @@ const users = await db.get("user", undefined, {
   columns: ["!username", "!address.street"],
 });
 
+// Columns accept dotted nested paths (e.g. "address.street" => nested field)
+const nested = await db.get("user", undefined, {
+  columns: ["address.street", "hobbies.name"],
+});
+
 // Get all columns explicitly with the "*" wildcard
 const all = await db.get("user", undefined, {
   columns: ["*"],

package/dist/cli.js

@@ -180,7 +180,7 @@ rl.on("line", async (input) => {
                 break;
             }
             if (!isSafeName(splitedInput[1]))
-                console.log(`${textRed("  Err:")} Invalid table name, only alphanumeric characters, underscores and hyphens are allowed`);
+                console.log(`${textRed("  Err:")} Invalid table name`);
             else if (!(await isExists(join(path, splitedInput[1]))))
                 console.log(`${textRed("  Err:")} Table doesn't exist`);
             else {

package/dist/index.d.ts

@@ -79,6 +79,16 @@ export default class Inibase {
     constructor(database: string, mainFolder?: string, language?: ErrorLang);
     createError(name: ErrorCode, variable?: string | number | (string | number)[]): Error;
     private validateName;
+    /**
+     * Validates column paths used in the `columns` option.
+     *
+     * Each column may be a nested path of dot-separated names
+     * (e.g. "address.street", "hobbies.name") and may optionally
+     * start with "!" for exclusion. The "*" wildcard (select all)
+     * and its "!*" counterpart are special values and are skipped.
+     * Every segment of a path is validated individually.
+     */
+    private validateColumns;
     private validateSchema;
     private getFileExtension;
     private schemaToIdsPath;

package/dist/index.js

@@ -64,6 +64,28 @@ export default class Inibase {
     validateName(name) {
         Utils.validateName(name, this.language);
     }
+    /**
+     * Validates column paths used in the `columns` option.
+     *
+     * Each column may be a nested path of dot-separated names
+     * (e.g. "address.street", "hobbies.name") and may optionally
+     * start with "!" for exclusion. The "*" wildcard (select all)
+     * and its "!*" counterpart are special values and are skipped.
+     * Every segment of a path is validated individually.
+     */
+    validateColumns(columns) {
+        for (const column of columns) {
+            if (column === "*" || column === "!*")
+                continue;
+            const path = column.startsWith("!") ? column.slice(1) : column;
+            for (const segment of path.split(".")) {
+                if (!segment)
+                    this.validateName(column);
+                else
+                    this.validateName(segment);
+            }
+        }
+    }
     validateSchema(schema) {
         Utils.validateSchema(schema, this.language);
     }
@@ -1109,9 +1131,7 @@ export default class Inibase {
             options.columns = Array.isArray(options.columns)
                 ? options.columns
                 : [options.columns];
-            for (const column of options.columns)
-                if (column !== "*")
-                    this.validateName(column);
+            this.validateColumns(options.columns);
             if (options.columns.length && !options.columns.includes("id"))
                 options.columns.push("id");
         }
@@ -1356,11 +1376,9 @@ export default class Inibase {
             };
         this.validateName(tableName);
         if (options.columns)
-            for (const column of (Array.isArray(options.columns)
+            this.validateColumns((Array.isArray(options.columns)
                 ? options.columns
-                : [options.columns]))
-                if (column !== "*")
-                    this.validateName(column);
+                : [options.columns]));
         const tablePath = join(this.databasePath, tableName);
         await this.getTable(tableName);
         if (!globalConfig[this.databasePath].tables?.get(tableName)?.schema)
@@ -1443,11 +1461,9 @@ export default class Inibase {
         const renameList = [];
         this.validateName(tableName);
         if (options.columns)
-            for (const column of (Array.isArray(options.columns)
+            this.validateColumns((Array.isArray(options.columns)
                 ? options.columns
-                : [options.columns]))
-                if (column !== "*")
-                    this.validateName(column);
+                : [options.columns]));
         const tablePath = join(this.databasePath, tableName);
         await this.throwErrorIfTableEmpty(tableName);
         let clonedData = structuredClone(data);

package/dist/utils.d.ts

@@ -236,13 +236,17 @@ export declare const createError: (language: ErrorLang, name: ErrorCode, variabl
 /**
  * Validates that a string is a safe name for a table, database or column.
  *
- * Names must start with an alphanumeric character (Latin or Arabic), followed
- * by alphanumerics (Latin or Arabic), underscores, hyphens or spaces, and be
- * at most 255 characters long. Leading or trailing spaces are not allowed.
+ * Instead of whitelisting allowed characters, this uses a blacklist that blocks
+ * only characters known to cause problems with shell commands, filesystem
+ * paths, or injection attacks. All Unicode letters (Latin, Arabic, Chinese,
+ * etc.), digits, underscores, hyphens, spaces and forward slashes are allowed.
  *
- * This prevents path traversal (`../`, `..\\`), null-byte injection (`\0`),
- * shell injection (`;`, `|`, backticks, `$()`, tabs, newlines, slashes) and
- * other reserved-name issues.
+ * Blocked characters: null bytes, control characters, `\`, `;`, `|`, `&`,
+ * `<`, `>`, `$`, backtick, `!`, `'`, `"`, `{`, `}`, `(`, `)`, `~`, and `.`
+ * (reserved as column-path separator).  Forward slash (`/`) is intentionally
+ * allowed so that nested table names like `"user/logs"` work.
+ *
+ * Leading or trailing spaces are not allowed.
  *
  * @param input - The value to be checked.
  * @returns boolean - True if the name is safe to use, false otherwise.

package/dist/utils.js

@@ -726,13 +726,17 @@ export const createError = (language, name, variable) => {
 /**
  * Validates that a string is a safe name for a table, database or column.
  *
- * Names must start with an alphanumeric character (Latin or Arabic), followed
- * by alphanumerics (Latin or Arabic), underscores, hyphens or spaces, and be
- * at most 255 characters long. Leading or trailing spaces are not allowed.
+ * Instead of whitelisting allowed characters, this uses a blacklist that blocks
+ * only characters known to cause problems with shell commands, filesystem
+ * paths, or injection attacks. All Unicode letters (Latin, Arabic, Chinese,
+ * etc.), digits, underscores, hyphens, spaces and forward slashes are allowed.
  *
- * This prevents path traversal (`../`, `..\\`), null-byte injection (`\0`),
- * shell injection (`;`, `|`, backticks, `$()`, tabs, newlines, slashes) and
- * other reserved-name issues.
+ * Blocked characters: null bytes, control characters, `\`, `;`, `|`, `&`,
+ * `<`, `>`, `$`, backtick, `!`, `'`, `"`, `{`, `}`, `(`, `)`, `~`, and `.`
+ * (reserved as column-path separator).  Forward slash (`/`) is intentionally
+ * allowed so that nested table names like `"user/logs"` work.
+ *
+ * Leading or trailing spaces are not allowed.
  *
  * @param input - The value to be checked.
  * @returns boolean - True if the name is safe to use, false otherwise.
@@ -741,12 +745,14 @@ export const isValidName = (input) => typeof input === "string" &&
     input.length > 0 &&
     input.length <= 255 &&
     validNamePattern.test(input);
-// Word characters: Latin alphanumerics, underscores, hyphens and Arabic blocks.
-const nameWordCharClass = "a-zA-Z0-9_\\u0600-\\u06FF\\u0750-\\u077F\\u08A0-\\u08FF-";
-// Leading characters: same as word chars minus underscore and hyphen.
-const nameFirstCharClass = "a-zA-Z0-9\\u0600-\\u06FF\\u0750-\\u077F\\u08A0-\\u08FF";
-// eslint-disable-next-line no-misleading-character-class
-const validNamePattern = new RegExp(`^[${nameFirstCharClass}](?:[${nameWordCharClass} ]*[${nameWordCharClass}])?$`);
+// Forbidden characters: control chars, path separators, shell metacharacters,
+// quoting, grouping, history expansion, home-dir expansion and dot (reserved
+// as column-path separator).  The forward slash (/) is intentionally allowed
+// so that nested table names like "user/logs" work.
+const nameForbiddenChars = "\\x00-\\x1F\\x7F.\\\\;|&<>$`!'\\" + "{}()~";
+// Names must be 1-255 chars, start/end with a non-forbidden non-whitespace
+// character, and contain no forbidden characters in between.
+const validNamePattern = new RegExp(`^[^${nameForbiddenChars}\\s\\p{Z}\\p{Cf}][^${nameForbiddenChars}\\p{Cf}]*[^${nameForbiddenChars}\\s\\p{Z}\\p{Cf}]$|^[^${nameForbiddenChars}\\s\\p{Z}\\p{Cf}]$`, "u");
 /**
  * Validates that a string is a safe name for a table, database or column and
  * throws a translated `INVALID_NAME` error if it is not.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inibase",
-  "version": "1.6.4",
+  "version": "1.6.6",
   "type": "module",
   "author": {
     "name": "Karim Amahtil",