inibase 1.6.5 → 1.6.6

package/dist/cli.js

@@ -180,7 +180,7 @@ rl.on("line", async (input) => {
                 break;
             }
             if (!isSafeName(splitedInput[1]))
-                console.log(`${textRed("  Err:")} Invalid table name, only alphanumeric characters, underscores and hyphens are allowed`);
+                console.log(`${textRed("  Err:")} Invalid table name`);
             else if (!(await isExists(join(path, splitedInput[1]))))
                 console.log(`${textRed("  Err:")} Table doesn't exist`);
             else {

package/dist/utils.d.ts

@@ -236,13 +236,17 @@ export declare const createError: (language: ErrorLang, name: ErrorCode, variabl
 /**
  * Validates that a string is a safe name for a table, database or column.
  *
- * Names must start with an alphanumeric character (Latin or Arabic), followed
- * by alphanumerics (Latin or Arabic), underscores, hyphens or spaces, and be
- * at most 255 characters long. Leading or trailing spaces are not allowed.
+ * Instead of whitelisting allowed characters, this uses a blacklist that blocks
+ * only characters known to cause problems with shell commands, filesystem
+ * paths, or injection attacks. All Unicode letters (Latin, Arabic, Chinese,
+ * etc.), digits, underscores, hyphens, spaces and forward slashes are allowed.
  *
- * This prevents path traversal (`../`, `..\\`), null-byte injection (`\0`),
- * shell injection (`;`, `|`, backticks, `$()`, tabs, newlines, slashes) and
- * other reserved-name issues.
+ * Blocked characters: null bytes, control characters, `\`, `;`, `|`, `&`,
+ * `<`, `>`, `$`, backtick, `!`, `'`, `"`, `{`, `}`, `(`, `)`, `~`, and `.`
+ * (reserved as column-path separator).  Forward slash (`/`) is intentionally
+ * allowed so that nested table names like `"user/logs"` work.
+ *
+ * Leading or trailing spaces are not allowed.
  *
  * @param input - The value to be checked.
  * @returns boolean - True if the name is safe to use, false otherwise.

package/dist/utils.js

@@ -726,13 +726,17 @@ export const createError = (language, name, variable) => {
 /**
  * Validates that a string is a safe name for a table, database or column.
  *
- * Names must start with an alphanumeric character (Latin or Arabic), followed
- * by alphanumerics (Latin or Arabic), underscores, hyphens or spaces, and be
- * at most 255 characters long. Leading or trailing spaces are not allowed.
+ * Instead of whitelisting allowed characters, this uses a blacklist that blocks
+ * only characters known to cause problems with shell commands, filesystem
+ * paths, or injection attacks. All Unicode letters (Latin, Arabic, Chinese,
+ * etc.), digits, underscores, hyphens, spaces and forward slashes are allowed.
  *
- * This prevents path traversal (`../`, `..\\`), null-byte injection (`\0`),
- * shell injection (`;`, `|`, backticks, `$()`, tabs, newlines, slashes) and
- * other reserved-name issues.
+ * Blocked characters: null bytes, control characters, `\`, `;`, `|`, `&`,
+ * `<`, `>`, `$`, backtick, `!`, `'`, `"`, `{`, `}`, `(`, `)`, `~`, and `.`
+ * (reserved as column-path separator).  Forward slash (`/`) is intentionally
+ * allowed so that nested table names like `"user/logs"` work.
+ *
+ * Leading or trailing spaces are not allowed.
  *
  * @param input - The value to be checked.
  * @returns boolean - True if the name is safe to use, false otherwise.
@@ -741,12 +745,14 @@ export const isValidName = (input) => typeof input === "string" &&
     input.length > 0 &&
     input.length <= 255 &&
     validNamePattern.test(input);
-// Word characters: Latin alphanumerics, underscores, hyphens and Arabic blocks.
-const nameWordCharClass = "a-zA-Z0-9_\\u0600-\\u06FF\\u0750-\\u077F\\u08A0-\\u08FF-";
-// Leading characters: same as word chars minus underscore and hyphen.
-const nameFirstCharClass = "a-zA-Z0-9\\u0600-\\u06FF\\u0750-\\u077F\\u08A0-\\u08FF";
-// eslint-disable-next-line no-misleading-character-class
-const validNamePattern = new RegExp(`^[${nameFirstCharClass}](?:[${nameWordCharClass} ]*[${nameWordCharClass}])?$`);
+// Forbidden characters: control chars, path separators, shell metacharacters,
+// quoting, grouping, history expansion, home-dir expansion and dot (reserved
+// as column-path separator).  The forward slash (/) is intentionally allowed
+// so that nested table names like "user/logs" work.
+const nameForbiddenChars = "\\x00-\\x1F\\x7F.\\\\;|&<>$`!'\\" + "{}()~";
+// Names must be 1-255 chars, start/end with a non-forbidden non-whitespace
+// character, and contain no forbidden characters in between.
+const validNamePattern = new RegExp(`^[^${nameForbiddenChars}\\s\\p{Z}\\p{Cf}][^${nameForbiddenChars}\\p{Cf}]*[^${nameForbiddenChars}\\s\\p{Z}\\p{Cf}]$|^[^${nameForbiddenChars}\\s\\p{Z}\\p{Cf}]$`, "u");
 /**
  * Validates that a string is a safe name for a table, database or column and
  * throws a translated `INVALID_NAME` error if it is not.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inibase",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "type": "module",
   "author": {
     "name": "Karim Amahtil",