inibase 1.6.5 → 1.7.0

package/dist/cli.js

@@ -180,7 +180,7 @@ rl.on("line", async (input) => {
                 break;
             }
             if (!isSafeName(splitedInput[1]))
-                console.log(`${textRed("  Err:")} Invalid table name, only alphanumeric characters, underscores and hyphens are allowed`);
+                console.log(`${textRed("  Err:")} Invalid table name`);
             else if (!(await isExists(join(path, splitedInput[1]))))
                 console.log(`${textRed("  Err:")} Table doesn't exist`);
             else {

package/dist/file.js

@@ -6,8 +6,8 @@ import { pipeline } from "node:stream/promises";
 import { createGunzip, createGzip } from "node:zlib";
 import Inison from "inison";
 import { globalConfig, } from "./index.js";
-import { detectFieldType, isArrayOfObjects, isNumber, isObject, isStringified, } from "./utils.js";
-import { compare, encodeID, exec, gunzip, gzip } from "./utils.server.js";
+import { detectFieldType, isArrayOfObjects, isNumber, isObject, isStringified, isValidID, } from "./utils.js";
+import { compare, decodeID, encodeID, exec, gunzip, gzip, } from "./utils.server.js";
 // Locks older than this are assumed abandoned by a crashed/killed process, not a slow operation.
 const STALE_LOCK_MS = 30_000;
 export const lock = async (folderPath, prefix) => {
@@ -506,6 +506,205 @@ export const remove = async (filePath, linesToDelete) => {
         return [fileTempPath, null];
     }
 };
+/**
+ * Field types whose on-disk bytes equal the encoded query value (identity or
+ * canonical numeric/id transforms), making a native whole-line equality search safe.
+ */
+const EQUALS_FAST_TYPES = new Set([
+    "string",
+    "text",
+    "textarea",
+    "html",
+    "url",
+    "email",
+    "number",
+    "date",
+    "timestamp",
+    "time",
+    "id",
+    "table",
+]);
+/**
+ * True when the query value is, or looks like, a number. Such values alias across
+ * several raw byte forms under `decode` (e.g. "123", "0123", "1e3"), so the exact
+ * native match would silently drop legitimate lines -> fall back to the JS reader.
+ */
+const looksNumeric = (value) => typeof value === "number" ||
+    (typeof value === "string" && value !== "" && isNumber(value));
+const shellQuote = (str) => `'${String(str).replace(/'/g, `'\\''`)}'`;
+/**
+ * Computes the exact on-disk byte strings a native `grep -x -F` must match for a
+ * `=` (equality) search so that every matched line decodes to one of the compared
+ * values. Returns the pattern array, or null when the search cannot be handled by
+ * the fast path (caller then falls back to the JS readline scan).
+ */
+function buildEqualsPatterns(comparedAtValue, field) {
+    const values = Array.isArray(comparedAtValue)
+        ? comparedAtValue
+        : [comparedAtValue];
+    if (!values.length)
+        return null;
+    const patterns = [];
+    for (const value of values) {
+        if (value === null || value === undefined || value === "")
+            return null; // null-like values -> readline path
+        const type = field.type;
+        if (type === "id" || type === "table") {
+            let forms;
+            if (isValidID(value))
+                forms = [value, String(decodeID(value) ?? value)];
+            else if (typeof value === "number" ||
+                (typeof value === "string" && isNumber(value)))
+                forms = [String(Number(value))];
+            else
+                forms = [value];
+            for (const form of [...new Set(forms)]) {
+                let valid = false;
+                try {
+                    valid = compare("=", decode(form, field), value, type);
+                }
+                catch {
+                    valid = false;
+                }
+                if (!valid)
+                    return null;
+                patterns.push(form);
+            }
+        }
+        else if (type === "number" ||
+            type === "date" ||
+            type === "timestamp" ||
+            type === "time") {
+            const form = String(Number(value));
+            let valid = false;
+            try {
+                valid = compare("=", decode(form, field), value, type);
+            }
+            catch {
+                valid = false;
+            }
+            if (!valid)
+                return null;
+            patterns.push(form);
+        }
+        else {
+            // scalar string-like field types
+            if (looksNumeric(value))
+                return null; // numeric aliasing -> readline path
+            const raw = String(value);
+            if (raw === "null" ||
+                raw === "undefined" ||
+                raw.startsWith("{") ||
+                raw.startsWith("["))
+                return null;
+            let encoded;
+            try {
+                encoded = encode(value);
+            }
+            catch {
+                return null;
+            }
+            const form = String(encoded);
+            let valid = false;
+            try {
+                valid = compare("=", decode(form, field), value, type);
+            }
+            catch {
+                valid = false;
+            }
+            if (!valid)
+                return null;
+            patterns.push(form);
+        }
+    }
+    return [...new Set(patterns)];
+}
+/**
+ * Native whole-line equality search (`grep -a -n -x -F`). Returns the same tuple
+ * shape as `search`, or null when the fast path could not be used/verified safely
+ * (in which case the caller should fall back to the JS readline scan).
+ */
+async function searchEqualsNative(filePath, patterns, field, searchIn, comparedAtValue, limit, offset, readWholeFile) {
+    const totalPatternSize = patterns.reduce((acc, pattern) => acc + String(pattern).length, 0) +
+        patterns.length * 8;
+    if (totalPatternSize > 32_768 || patterns.length > 1024)
+        return null;
+    if (searchIn?.size) {
+        for (const lineNumber of searchIn) {
+            if (lineNumber < 0)
+                return null; // exclusion ranges -> readline path
+        }
+    }
+    const source = filePath.endsWith(".gz")
+        ? `gunzip -c ${escapeShellPath(filePath)}`
+        : `cat ${escapeShellPath(filePath)}`;
+    // Column files whose lines start with "[" or "{" are array/object-encoded
+    // (decode() eagerly unstringifies them), so a native whole-line grep could
+    // silently miss matches that live inside those containers. Detect such lines
+    // up front; when any are present, fall back to the JS reader.
+    let probe;
+    try {
+        ({ stdout: probe } = await exec(`LC_ALL=C ${source} | LC_ALL=C grep -a -m 1 -E '^[[{]'`, { maxBuffer: 1024 * 1024 * 4 }));
+    }
+    catch (err) {
+        if (Number(err?.code) !== 1)
+            return null; // probe failure -> readline fallback
+    }
+    if (probe)
+        return null;
+    const command = `LC_ALL=C ${source} | LC_ALL=C grep -a -n -x -F ${patterns
+        .map((pattern) => `-e ${shellQuote(pattern)}`)
+        .join(" ")}`;
+    let stdout;
+    try {
+        ({ stdout } = await exec(command, { maxBuffer: 1024 * 1024 * 256 }));
+    }
+    catch (err) {
+        if (Number(err?.code) === 1)
+            return [null, 0, null]; // grep: no matches
+        return null; // native failure -> readline fallback
+    }
+    const rawLines = stdout ? stdout.trimEnd().split("\n") : [];
+    let matched = [];
+    for (const line of rawLines) {
+        const colonIndex = line.indexOf(":");
+        if (colonIndex === -1)
+            continue;
+        const lineNumber = Number(line.slice(0, colonIndex));
+        if (!Number.isInteger(lineNumber) || lineNumber < 1)
+            continue;
+        matched.push([lineNumber, line.slice(colonIndex + 1)]);
+    }
+    if (searchIn?.size)
+        matched = matched.filter(([lineNumber]) => searchIn.has(lineNumber));
+    const linesNumbers = new Set();
+    const matchingLines = {};
+    let processed = 0;
+    let finalTotal = null;
+    for (const [lineNumber, raw] of matched) {
+        processed++;
+        linesNumbers.add(lineNumber);
+        if (offset && processed < offset)
+            continue;
+        if (limit && processed > limit + (offset ? offset - 1 : 0)) {
+            if (readWholeFile)
+                continue;
+            finalTotal = processed;
+            break;
+        }
+        const decodedLine = decode(raw, field);
+        // Defensive verification: the raw line must decode to one of the compared
+        // values (guaranteed by construction, kept as a safety net).
+        const verifies = Array.isArray(comparedAtValue)
+            ? comparedAtValue.some((value) => compare("=", decodedLine, value, field.type))
+            : compare("=", decodedLine, comparedAtValue, field.type);
+        if (!verifies)
+            return null;
+        matchingLines[lineNumber] = decodedLine;
+    }
+    const total = finalTotal ?? processed;
+    return total ? [matchingLines, total, linesNumbers] : [null, 0, null];
+}
 /**
  * Asynchronously searches a file for lines matching specified criteria, using comparison and logical operators.
  *
@@ -524,6 +723,22 @@ export const remove = async (filePath, linesToDelete) => {
  * Note: Decodes each line for comparison and can handle complex queries with multiple conditions.
  */
 export const search = async (filePath, operator, comparedAtValue, logicalOperator, searchIn, field, limit, offset, readWholeFile) => {
+    // Native fast path for exact-equality searches (whole-line `grep -x -F`).
+    const fieldType = field?.type;
+    if (operator === "=" &&
+        !Array.isArray(operator) &&
+        !logicalOperator &&
+        comparedAtValue !== null &&
+        comparedAtValue !== undefined &&
+        typeof fieldType === "string" &&
+        EQUALS_FAST_TYPES.has(fieldType)) {
+        const patterns = buildEqualsPatterns(comparedAtValue, field);
+        if (patterns) {
+            const fastResult = await searchEqualsNative(filePath, patterns, field, searchIn, comparedAtValue, limit, offset, readWholeFile);
+            if (fastResult)
+                return fastResult;
+        }
+    }
     // Initialize a Map to store the matching lines with their line numbers.
     const matchingLines = {};
     // Initialize counters for line number, found items, and processed items.

package/dist/utils.d.ts

@@ -236,13 +236,17 @@ export declare const createError: (language: ErrorLang, name: ErrorCode, variabl
 /**
  * Validates that a string is a safe name for a table, database or column.
  *
- * Names must start with an alphanumeric character (Latin or Arabic), followed
- * by alphanumerics (Latin or Arabic), underscores, hyphens or spaces, and be
- * at most 255 characters long. Leading or trailing spaces are not allowed.
+ * Instead of whitelisting allowed characters, this uses a blacklist that blocks
+ * only characters known to cause problems with shell commands, filesystem
+ * paths, or injection attacks. All Unicode letters (Latin, Arabic, Chinese,
+ * etc.), digits, underscores, hyphens, spaces and forward slashes are allowed.
  *
- * This prevents path traversal (`../`, `..\\`), null-byte injection (`\0`),
- * shell injection (`;`, `|`, backticks, `$()`, tabs, newlines, slashes) and
- * other reserved-name issues.
+ * Blocked characters: null bytes, control characters, `\`, `;`, `|`, `&`,
+ * `<`, `>`, `$`, backtick, `!`, `'`, `"`, `{`, `}`, `(`, `)`, `~`, and `.`
+ * (reserved as column-path separator).  Forward slash (`/`) is intentionally
+ * allowed so that nested table names like `"user/logs"` work.
+ *
+ * Leading or trailing spaces are not allowed.
  *
  * @param input - The value to be checked.
  * @returns boolean - True if the name is safe to use, false otherwise.

package/dist/utils.js

@@ -726,13 +726,17 @@ export const createError = (language, name, variable) => {
 /**
  * Validates that a string is a safe name for a table, database or column.
  *
- * Names must start with an alphanumeric character (Latin or Arabic), followed
- * by alphanumerics (Latin or Arabic), underscores, hyphens or spaces, and be
- * at most 255 characters long. Leading or trailing spaces are not allowed.
+ * Instead of whitelisting allowed characters, this uses a blacklist that blocks
+ * only characters known to cause problems with shell commands, filesystem
+ * paths, or injection attacks. All Unicode letters (Latin, Arabic, Chinese,
+ * etc.), digits, underscores, hyphens, spaces and forward slashes are allowed.
  *
- * This prevents path traversal (`../`, `..\\`), null-byte injection (`\0`),
- * shell injection (`;`, `|`, backticks, `$()`, tabs, newlines, slashes) and
- * other reserved-name issues.
+ * Blocked characters: null bytes, control characters, `\`, `;`, `|`, `&`,
+ * `<`, `>`, `$`, backtick, `!`, `'`, `"`, `{`, `}`, `(`, `)`, `~`, and `.`
+ * (reserved as column-path separator).  Forward slash (`/`) is intentionally
+ * allowed so that nested table names like `"user/logs"` work.
+ *
+ * Leading or trailing spaces are not allowed.
  *
  * @param input - The value to be checked.
  * @returns boolean - True if the name is safe to use, false otherwise.
@@ -741,12 +745,14 @@ export const isValidName = (input) => typeof input === "string" &&
     input.length > 0 &&
     input.length <= 255 &&
     validNamePattern.test(input);
-// Word characters: Latin alphanumerics, underscores, hyphens and Arabic blocks.
-const nameWordCharClass = "a-zA-Z0-9_\\u0600-\\u06FF\\u0750-\\u077F\\u08A0-\\u08FF-";
-// Leading characters: same as word chars minus underscore and hyphen.
-const nameFirstCharClass = "a-zA-Z0-9\\u0600-\\u06FF\\u0750-\\u077F\\u08A0-\\u08FF";
-// eslint-disable-next-line no-misleading-character-class
-const validNamePattern = new RegExp(`^[${nameFirstCharClass}](?:[${nameWordCharClass} ]*[${nameWordCharClass}])?$`);
+// Forbidden characters: control chars, path separators, shell metacharacters,
+// quoting, grouping, history expansion, home-dir expansion and dot (reserved
+// as column-path separator).  The forward slash (/) is intentionally allowed
+// so that nested table names like "user/logs" work.
+const nameForbiddenChars = "\\x00-\\x1F\\x7F.\\\\;|&<>$`!'\\" + "{}()~";
+// Names must be 1-255 chars, start/end with a non-forbidden non-whitespace
+// character, and contain no forbidden characters in between.
+const validNamePattern = new RegExp(`^[^${nameForbiddenChars}\\s\\p{Z}\\p{Cf}][^${nameForbiddenChars}\\p{Cf}]*[^${nameForbiddenChars}\\s\\p{Z}\\p{Cf}]$|^[^${nameForbiddenChars}\\s\\p{Z}\\p{Cf}]$`, "u");
 /**
  * Validates that a string is a safe name for a table, database or column and
  * throws a translated `INVALID_NAME` error if it is not.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inibase",
-  "version": "1.6.5",
+  "version": "1.7.0",
   "type": "module",
   "author": {
     "name": "Karim Amahtil",