jsql-neo 6.5.15 → 6.5.16

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.5.15** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.5.16** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.5.15 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.5.16 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/mysql_compat.js

@@ -146,6 +146,7 @@ class Connection extends EventEmitter {
       const r = await executeSQL(engine, finalSql, {
         safety: this.safety,
         allowComments: this.allowComments,
+        allowWrites: true,
         maxStatements: this.config.multipleStatements ? null : 1,
       });
       const results = Array.isArray(r) ? r : [r];

package/lib/mysql_server.js

@@ -957,6 +957,8 @@ class MysqlConnection {
           const r = await executeSQL(engine, sqlToRun, {
             allowComments: this.server.allowComments,
             safety: this.server.safety,
+            // 协议服务器本身就是数据库端：客户端发来的 DROP/DELETE/UPDATE 必须执行。
+            allowWrites: true,
             maxStatements: 1,
             session: this.session,
           });

package/lib/sql.js

@@ -18,6 +18,24 @@ const DANGEROUS_SQL = [
 // （CWE-770）。可在 executeSQL 通过 opts.maxSqlLength 放宽/关闭（传 Infinity）。
 const DEFAULT_MAX_SQL_LENGTH = 64 * 1024 * 1024;
 
+// 破坏性语句：安全模式下默认拦截（可显式 allowWrites: true 放行）。
+// 多语句注入（`SELECT …; DROP TABLE s;`）的修复分两层：
+//   1) 安全模式默认只允许一条语句（mysql2 默认也是单语句）；
+//   2) 单条 DROP / TRUNCATE / DELETE / UPDATE 也需显式放行。
+// 协议服务器（MySQL / PG）与迁移/管理台会显式传 allowWrites，保持原有能力。
+const DESTRUCTIVE_STMT_TYPES = new Set([
+  'delete', 'update', 'truncate',
+  'dropTable', 'dropIndex', 'dropView', 'dropDatabase',
+]);
+
+/** 递归看 WITH 包着的真正语句，返回破坏性语句类型或 null */
+function findDestructiveStatement(stmt) {
+  if (!stmt || typeof stmt !== 'object') return null;
+  if (DESTRUCTIVE_STMT_TYPES.has(stmt.type)) return stmt.type;
+  if (stmt.type === 'with' && stmt.statement) return findDestructiveStatement(stmt.statement);
+  return null;
+}
+
 function findDangerousSQL(tokens) {
   // 先把注释去掉，防止通过 /*comment*/DROP 绕过检测
   const commentStripped = [];
@@ -8032,26 +8050,43 @@ async function executeSQL(engine, sql, paramsOrOpts, opts = {}) {
   } else if (paramsOrOpts && typeof paramsOrOpts === 'object') {
     // 第三参为对象时：含已知 opts 键 → 视为 opts；否则视为命名参数（{id: 1} → :id / $id）
     const OPTS_KEYS = ['safety', 'session', 'params', 'functions', 'aggregates',
-      'allowComments', 'maxStatements', 'maxSqlLength', 'context', 'timeout', 'dialect'];
+      'allowComments', 'maxStatements', 'maxSqlLength', 'context', 'timeout', 'dialect',
+      'allowWrites', 'allowMultiStatement'];
     const looksLikeOpts = Object.keys(paramsOrOpts).some(k => OPTS_KEYS.includes(k));
     if (looksLikeOpts) opts = paramsOrOpts;
     else sql = applyParams(sql, paramsOrOpts);
   }
-  if (opts.safety !== false) {
+  const safetyOn = opts.safety !== false;
+  if (safetyOn) {
     if (!opts.allowComments && hasComments(sql)) {
       throw new Error('SQL comments are disabled for security (--, #, /* */)');
     }
   }
   let statements = splitStatements(sql, { maxLength: opts.maxSqlLength });
-  if (opts.maxStatements != null && statements.length > opts.maxStatements) {
-    throw new Error(`too many statements (${statements.length} > ${opts.maxStatements})`);
-  }
-  if (opts.safety !== false) {
+  // 安全模式默认单语句：`SELECT 1; DROP TABLE s;` 不能再把第二条语句一起执行。
+  // 需要多语句的内部调用方显式传 maxStatements 或 allowMultiStatement: true。
+  const maxStatements = opts.maxStatements != null
+    ? opts.maxStatements
+    : (safetyOn && opts.allowMultiStatement !== true ? 1 : Infinity);
+  if (statements.length > maxStatements) {
+    throw new Error(`too many statements (${statements.length} > ${maxStatements})`);
+  }
+  if (safetyOn) {
     for (const stmtSql of statements) {
       const dangerous = findDangerousSQL(tokenize(stmtSql));
       if (dangerous) throw new Error(`SQL statement blocked by security policy: ${dangerous}`);
     }
   }
+  // 先全部解析、再统一做破坏性检查 —— 若有第二条是 DROP，第一条 SELECT 也不能先执行。
+  const parsedStatements = statements.map(s => parseSQL(s));
+  if (safetyOn && opts.allowWrites !== true) {
+    for (const stmt of parsedStatements) {
+      const destructive = findDestructiveStatement(stmt);
+      if (destructive) {
+        throw new Error(`SQL statement blocked by security policy: ${destructive} (pass { allowWrites: true } or { safety: false } to allow writes)`);
+      }
+    }
+  }
   const ctx = {};
   if (opts.session) ctx.session = opts.session;
   if (opts.params) ctx.params = opts.params;   // 原生 ? 占位符（applyParams 之外的另一种用法）
@@ -8059,8 +8094,8 @@ async function executeSQL(engine, sql, paramsOrOpts, opts = {}) {
   if (opts.aggregates && typeof opts.aggregates === 'object') ctx.aggregates = opts.aggregates;
   const executor = new SQLExecutor(engine, Object.keys(ctx).length > 0 ? ctx : null);
   const results = [];
-  for (const stmtSql of statements) {
-    const stmt = parseSQL(stmtSql);
+  for (let si = 0; si < parsedStatements.length; si++) {
+    const stmt = parsedStatements[si];
     const t0 = process.hrtime.bigint();
     let r = await executor.execute(stmt);
     const durationMs = Number(process.hrtime.bigint() - t0) / 1e6;

package/lib/sqlite_worker.js

@@ -118,6 +118,9 @@ async function executeStatement(sql, params) {
     },
     functions: userFunctions,
     aggregates: userAggregates,
+    // sqlite 兼容层是完整 SQL 接口：写操作与多语句都应保留。
+    allowWrites: true,
+    allowMultiStatement: true,
   });
   if (result && result.type === 'insert' && result.insertId !== null && result.insertId !== undefined) {
     _lastInsertId = Number(result.insertId);

package/lib/web_ui.js

@@ -236,7 +236,8 @@ class WebUI {
         const db = await this.db(dbName);
         const t0 = Date.now();
         try {
-          const res2 = await executeSQL(db, sql);
+          // 管理台是有鉴权的 SQL 控制台：需要执行 UPDATE/DELETE 等写语句。
+          const res2 = await executeSQL(db, sql, { allowWrites: true, allowMultiStatement: true });
           const ms = Date.now() - t0;
           const out = { ok: true, ms };
           if (res2 && res2.rows) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "6.5.15",
+  "version": "6.5.16",
   "description": "JSQL-NEO \u2014 Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",

package/test/btree.test.js

@@ -177,9 +177,6 @@ for (let t = 0; t < 25; t++) {
   ok('random mixed t' + t + ' vs reference', okAll && bt.size === ref.size, { size: bt.size, ref: ref.size, reason: reason });
 }
 
-console.log(failed === 0 ? `\nALL ${passed} BTREE TESTS PASSED` : `\n${failed} FAILURES (${passed} passed)`);
-process.exit(failed === 0 ? 0 : 1);
-
 /* ---- 回归：remove 后分隔键未更新导致内部键重复 ----
  *
  * 旧实现里 remove() 只改叶子，不更新祖先的分隔键副本。删掉某个正好是分隔键
@@ -205,3 +202,56 @@ process.exit(failed === 0 ? 0 : 1);
   if (errs.length) { okAll = false; reason = reason || ('validate: ' + errs[0]); }
   ok('回归：remove 后分隔键未更新', okAll && bt.size === ref.size, { size: bt.size, ref: ref.size, reason, keys: bt._root.keys });
 }
+
+/* ---- 回归：混合增删触发再平衡后索引条目丢失（C1）----
+ *
+ * 报告数据：search(6) → [54,28]（应为 [28,44,54]）、size 少 1。
+ * 根因是删除路径「先再平衡、后确认键是否存在」：把分支合并/借用之后才去删，
+ * 目标键可能已被搬到别的节点，于是这个 rowIndex 静默消失，size 也随之错位。
+ * 下面用固定操作序列（含多行同键 + 反复删除触发 merge/borrow）锁定该场景，
+ * 逐值与参考实现比对。
+ */
+{
+  const bt = new BTree(4);
+  const ref = new Map();
+  const ops = [];
+  // 先铺满两层，制造出可合并/可借用的兄弟节点
+  for (let k = 1; k <= 12; k++) ops.push([1, k, k]);
+  // key=6 挂三个行号（报告里的 28 / 44 / 54）
+  ops.push([1, 6, 28], [1, 6, 44], [1, 6, 54]);
+  // 删掉一批键，触发叶子合并 / 内部键下移
+  for (let k = 1; k <= 11; k += 2) ops.push([0, k, k]);
+  // 再插入新键，触发分裂
+  for (let k = 13; k <= 20; k++) ops.push([1, k, k]);
+  // 继续混合删除，踩 borrow/merge 路径
+  for (let k = 2; k <= 10; k += 2) ops.push([0, k, k]);
+  for (let k = 14; k <= 20; k += 2) ops.push([0, k, k]);
+  // 再插入，反复触发结构变化
+  ops.push([1, 21, 21], [1, 22, 22], [1, 23, 23], [0, 21, 21]);
+
+  let okAll = true, reason = '';
+  for (const [ins, k, r] of ops) {
+    if (ins) {
+      bt.insert(k, r);
+      if (!ref.has(k)) ref.set(k, new Set());
+      ref.get(k).add(r);
+    } else {
+      bt.remove(k, r);
+      if (ref.has(k)) { ref.get(k).delete(r); if (ref.get(k).size === 0) ref.delete(k); }
+    }
+  }
+  for (const [k, vals] of ref) {
+    const got = bt.search(k).slice().sort((a, b) => a - b);
+    const exp = [...vals].sort((a, b) => a - b);
+    if (JSON.stringify(got) !== JSON.stringify(exp)) { okAll = false; reason = reason || ('search(' + k + ')=' + JSON.stringify(got) + ' exp ' + JSON.stringify(exp)); }
+  }
+  const errs = validate(bt);
+  if (errs.length) { okAll = false; reason = reason || ('validate: ' + errs[0]); }
+  const six = bt.search(6).slice().sort((a, b) => a - b);
+  ok('C1 回归：key=6 三行号全部保留', JSON.stringify(six) === '[28,44,54]', six);
+  ok('C1 回归：混合增删后 size 与参考一致', bt.size === ref.size, { size: bt.size, ref: ref.size, reason });
+  ok('C1 回归：混合增删后逐键可搜到', okAll, reason);
+}
+
+console.log(failed === 0 ? `\nALL ${passed} BTREE TESTS PASSED` : `\n${failed} FAILURES (${passed} passed)`);
+process.exit(failed === 0 ? 0 : 1);

package/test/coverage.js

@@ -157,8 +157,8 @@ function tmp(name) {
     ok('sql aggregate', agg.rows[0][0] === 2);
     const fn = await executeSQL(db, 'SELECT VERSION(), CONCAT("x","y")');
     ok('sql func column names', fn.columns[0] === 'VERSION()');
-    await executeSQL(db, 'UPDATE users SET age = 31 WHERE name = \'Bob\'');
-    await executeSQL(db, 'DELETE FROM users WHERE id = 1');
+    await executeSQL(db, 'UPDATE users SET age = 31 WHERE name = \'Bob\'', { safety: false });
+    await executeSQL(db, 'DELETE FROM users WHERE id = 1', { safety: false });
     ok('sql count after delete', (await db.count('users')) === 1);
     await executeSQL(db, 'BEGIN');
     await executeSQL(db, "INSERT INTO users (name, age) VALUES ('Temp', 99)");
@@ -166,7 +166,7 @@ function tmp(name) {
     ok('sql rollback', (await db.count('users')) === 1);
     await executeSQL(db, 'START TRANSACTION');
     await executeSQL(db, "INSERT INTO users (name, age) VALUES ('X', 1)");
-    await executeSQL(db, 'TRUNCATE TABLE users');
+    await executeSQL(db, 'TRUNCATE TABLE users', { safety: false });
     ok('sql truncate', (await db.count('users')) === 0);
     const sqlApi = require(path.join(ROOT, 'lib/sql'));
     const parsed = sqlApi.parseSQL('SELECT * FROM t WHERE id = 5');

package/test/v6.5.14-regression.test.js

@@ -92,6 +92,34 @@ function makeDb() { return new Database(':memory:'); }
     ok('options.user 不匹配拒绝', srvOpt._userPassword('other') === undefined);
   }
 
+  // ── N1. SQL 安全策略：多语句 / 破坏性语句 ────────────────────
+  console.log('\n--- N1. SQL 安全策略 ---');
+  {
+    const attempts = async (sql, opts) => {
+      try { await executeSQL(db, sql, opts); return null; } catch (e) { return e.message; }
+    };
+    await q('CREATE TABLE guard(id INT PRIMARY KEY, v INT)');
+    await q("INSERT INTO guard VALUES (1, 1)");
+    const multi = await attempts('SELECT 1; DROP TABLE guard');
+    ok('多语句被拒绝（默认单语句）', /too many statements/i.test(multi || ''), multi);
+    ok('被拒后目标表仍在', (await q('SELECT * FROM guard')).rows.length === 1);
+    const drop = await attempts('DROP TABLE guard');
+    ok('单条 DROP 被拦截', /blocked by security policy: dropTable/i.test(drop || ''), drop);
+    const del = await attempts('DELETE FROM guard');
+    ok('单条 DELETE 被拦截', /blocked by security policy: delete/i.test(del || ''), del);
+    const upd = await attempts('UPDATE guard SET v = 2');
+    ok('单条 UPDATE 被拦截', /blocked by security policy: update/i.test(upd || ''), upd);
+    const trunc = await attempts('TRUNCATE TABLE guard');
+    ok('单条 TRUNCATE 被拦截', /blocked by security policy: truncate/i.test(trunc || ''), trunc);
+    ok('WITH ... DELETE 同样被拦截',
+      /blocked by security policy: delete/i.test(await attempts('WITH x AS (SELECT 1) DELETE FROM guard') || ''));
+    const allowed = await attempts('DELETE FROM guard', { allowWrites: true });
+    ok('allowWrites: true 放行写操作', allowed === null, allowed);
+    const multiAllowed = await attempts('SELECT 1; SELECT 2', { allowMultiStatement: true, allowWrites: true });
+    ok('allowMultiStatement 可显式放开多语句（非破坏性）', multiAllowed === null, multiAllowed);
+    ok('safety:false 仍可执行破坏性语句', (await attempts('DROP TABLE guard', { safety: false })) === null);
+  }
+
   // ── H2. NeDB $regex ─────────────────────────────────────────
   console.log('\n--- H2. NeDB $regex ---');
   {