miqro 7.3.3 → 7.3.4

package/build/esm/editor/auth.js

@@ -18,13 +18,15 @@ export default {
             const cookieToken = args.req.cookies[ADMIN_EDITOR_AUTH_COOKIE];
             //console.log("\n\nqueryToken[%s] cookieToken[%s] KEY[%s]\n\n", queryToken, cookieToken, KEY);
             if (queryToken) {
-                if (typeof queryToken === "string" && timingSafeEqual(Buffer.from(queryToken), Buffer.from(KEY))) {
+                const queryBuf = Buffer.from(String(queryToken));
+                const keyBuf = Buffer.from(KEY);
+                if (typeof queryToken === "string" && queryBuf.length === keyBuf.length && timingSafeEqual(queryBuf, keyBuf)) {
                     args.res.setCookie(ADMIN_EDITOR_AUTH_COOKIE, KEY, {
-                        expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 31 * 12 * 500),
+                        expires: new Date(Date.now() + 1000 * 60 * 60 * 24),
                         httpOnly: true,
-                        //secure: true,
+                        //secure: args.req.secure,
+                        sameSite: "strict",
                         path: "/",
-                        //sameSite: "strict"
                     });
                     args.req.searchParams.delete(ADMIN_EDITOR_AUTH_QUERY);
                     const queryString = args.req.searchParams.toString();

package/build/esm/src/common/esbuild.js

@@ -59,6 +59,7 @@ export async function esBuild(options, logger) {
             else {
                 exec(esBuildCMD, {
                     maxBuffer: 1024 * 1000 * 2000,
+                    timeout: 60000,
                     cwd: dirname(options.entryPoints[0])
                 }, (err, stdout, _stderr) => {
                     if (err) {

package/build/esm/src/common/exit.js

@@ -80,20 +80,38 @@ export function setupExitHandlers(app) {
         }
         process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });
-    process.on("SIGTERM", function () {
+    process.on("SIGTERM", async function () {
         app.logger?.info('SIGTERM received');
+        if (app.server) {
+            await Promise.race([
+                app.stop(),
+                new Promise(r => setTimeout(r, 5000))
+            ]);
+        }
         process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });
-    process.on('SIGHUP', function () {
+    process.on('SIGHUP', async function () {
         app.logger?.info('SIGHUP received');
+        if (app.server) {
+            await Promise.race([
+                app.stop(),
+                new Promise(r => setTimeout(r, 5000))
+            ]);
+        }
         process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });
     /*process.on('SIGKILL', function () {
       server.logger.info('SIGKILL received');
       process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });*/
-    process.on('SIGINT', function () {
+    process.on('SIGINT', async function () {
         app.logger?.info('SIGINT received');
+        if (app.server) {
+            await Promise.race([
+                app.stop(),
+                new Promise(r => setTimeout(r, 5000))
+            ]);
+        }
         process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
     });
 }

package/build/esm/src/services/app.d.ts

@@ -28,6 +28,7 @@ export interface MiqroOptions extends ImportJSXFileOptions {
     https?: boolean;
     httpRedirect?: number;
     noMinify?: boolean;
+    allowedRedirectHosts?: string[];
 }
 export interface InflateOptions {
     inflateDir?: string;

package/build/esm/src/services/app.js

@@ -383,7 +383,12 @@ export class Miqro {
         if (this.options?.httpRedirect) {
             this.httpsRedirectServer = new App();
             this.httpsRedirectServer.use(async (req, res) => {
-                const hostname = req.headers.host.split(":").length > 1 ? req.headers.host.split(":")[0] : req.headers.host;
+                const hostname = req.headers.host?.split(":")[0] ?? "";
+                const allowed = this.options?.allowedRedirectHosts;
+                if (allowed && !allowed.includes(hostname)) {
+                    res.writeHead(400).end("Invalid Host header");
+                    return;
+                }
                 return await res.redirect('https://' + hostname + ":" + this.options.port + req.url);
             });
         }

package/build/lib.cjs

@@ -720,7 +720,7 @@ function ReadBuffer(options) {
           req.removeListener("end", endListener);
           try {
             const concatBuffers = Buffer.concat(buffers);
-            const responseBuffer = req.headers["content-encoding"] === "gzip" ? (0, import_zlib.gunzipSync)(concatBuffers) : concatBuffers;
+            const responseBuffer = req.headers["content-encoding"] === "gzip" ? (0, import_zlib.gunzipSync)(concatBuffers, { maxOutputLength: limit }) : concatBuffers;
             req.logger.trace("ctx.buffer %o", responseBuffer);
             req.buffer = responseBuffer;
             resolve24();
@@ -2897,32 +2897,42 @@ var init_websocket = __esm({
             req.logger.debug("upgrading connection");
             socket.write(createUpgradeHeaders(acceptKey, extraHeaders));
             socket.on("data", async (data) => {
-              const frame = parseFrame(data, this.options.maxFrameSize);
-              if (frame === PING) {
-                try {
-                  socket.write(Buffer.from([138, 0]));
-                } catch (e) {
-                  req.logger.error(e);
-                }
-              } else if (frame !== null) {
-                if (!this.options.onMessage) {
-                  socket.end();
-                  socket.destroy();
+              try {
+                const frame = parseFrame(data, this.options.maxFrameSize);
+                if (frame === PING) {
+                  try {
+                    socket.write(Buffer.from([138, 0]));
+                  } catch (e) {
+                    req.logger.error(e);
+                  }
+                } else if (frame !== null) {
+                  if (!this.options.onMessage) {
+                    socket.end();
+                    socket.destroy();
+                  } else {
+                    try {
+                      await this.options.onMessage(client, frame);
+                    } catch (e) {
+                      req.logger.error(e);
+                    }
+                  }
                 } else {
                   try {
-                    await this.options.onMessage(client, frame);
+                    socket.write(Buffer.from([136, 0]));
                   } catch (e) {
                     req.logger.error(e);
                   }
+                  socket.end();
+                  socket.destroy();
                 }
-              } else {
+              } catch (e) {
                 try {
-                  socket.write(Buffer.from([136, 0]));
-                } catch (e) {
-                  req.logger.error(e);
+                  req.logger?.error(e);
+                  socket.end();
+                  socket.destroy();
+                } catch (e2) {
+                  console.error(e2);
                 }
-                socket.end();
-                socket.destroy();
               }
             });
             socket.on("error", async (error2) => {
@@ -9446,6 +9456,7 @@ async function esBuild2(options, logger) {
       } else {
         (0, import_node_child_process.exec)(esBuildCMD, {
           maxBuffer: 1024 * 1e3 * 2e3,
+          timeout: 6e4,
           cwd: (0, import_node_path5.dirname)(options.entryPoints[0])
         }, (err, stdout, _stderr) => {
           if (err) {
@@ -9891,7 +9902,7 @@ function sqlite3ExecutorPrepare(args) {
       const where = getWhereStatement(q);
       const returing = q._returning.length === 0 ? "*" : q._returning.join(",");
       const whereSQL = where.sql !== "" ? ` WHERE ${where.sql}` : "";
-      const sql = `DELETE FROM "${q._table}"${whereSQL}${getOrderBy(q._orderBy)}${getLimit(q._limitBy, q._offsetBy)} RETURNING ${returing}`;
+      const sql = `DELETE FROM ${renderTable(q._table)}${whereSQL}${getOrderBy(q._orderBy)}${getLimit(q._limitBy, q._offsetBy)} RETURNING ${returing}`;
       return {
         sql,
         values: where.values
@@ -9904,7 +9915,7 @@ function sqlite3ExecutorPrepare(args) {
     }
     case "create-table": {
       const q = args;
-      const sql = `CREATE TABLE${q._ignoreDuplicate ? " IF NOT EXISTS" : ""} "${q._table}"${getCreateTableColumns(q._definition)}`;
+      const sql = `CREATE TABLE${q._ignoreDuplicate ? " IF NOT EXISTS" : ""} ${renderTable(q._table)}${getCreateTableColumns(q._definition)}`;
       return sql;
     }
     case "drop-database": {
@@ -9914,7 +9925,7 @@ function sqlite3ExecutorPrepare(args) {
     }
     case "drop-table": {
       const q = args;
-      const sql = `DROP TABLE${q._ignoreDuplicate ? " IF EXISTS" : ""} "${q._table}"`;
+      const sql = `DROP TABLE${q._ignoreDuplicate ? " IF EXISTS" : ""} ${renderTable(q._table)}`;
       return sql;
     }
     case "alter-table": {
@@ -9933,17 +9944,17 @@ function sqlite3ExecutorPrepare(args) {
               throw new Error("unsupported alter action add without definition");
             }
             alters.push({
-              sql: `ALTER TABLE "${q._table}" ADD COLUMN ${getCreateTableColumn(l._column, l._definition, [])}`
+              sql: `ALTER TABLE ${renderTable(q._table)} ADD COLUMN ${getCreateTableColumn(l._column, l._definition, [])}`
             });
             break;
           case "drop":
             alters.push({
-              sql: `ALTER TABLE "${q._table}" DROP COLUMN "${l._column}"`
+              sql: `ALTER TABLE ${renderTable(q._table)} DROP COLUMN "${l._column}"`
             });
             break;
           case "rename":
             alters.push({
-              sql: `ALTER TABLE "${q._table}" RENAME COLUMN "${l._column}" TO "${l._newName}"`
+              sql: `ALTER TABLE ${renderTable(q._table)} RENAME COLUMN "${l._column}" TO "${l._newName}"`
             });
             break;
           default:
@@ -9956,7 +9967,7 @@ function sqlite3ExecutorPrepare(args) {
       const q = args;
       const rows = getInsertValues(q._columns, q._values);
       const returing = q._returning.length === 0 ? "*" : q._returning.join(",");
-      const sql = `INSERT${q._ignoreDuplicate ? " OR IGNORE" : ""} INTO "${q._table}"${getInsertColumns(q._columns)}${rows.sql} RETURNING ${returing}`;
+      const sql = `INSERT${q._ignoreDuplicate ? " OR IGNORE" : ""} INTO ${renderTable(q._table)}${getInsertColumns(q._columns)}${rows.sql} RETURNING ${returing}`;
       return [{
         sql,
         values: rows.values
@@ -9994,7 +10005,7 @@ function sqlite3ExecutorPrepare(args) {
       const where = getWhereStatement(q);
       const whereSQL = where.sql !== "" ? ` WHERE ${where.sql}` : "";
       const setSQL = ` SET ${q._sets.map((set) => `${renderColumn(set.column)}=?`)}`;
-      const sql = `UPDATE "${q._table}"${setSQL}${whereSQL}${getOrderBy(q._orderBy)}${getLimit(q._limitBy, q._offsetBy)} RETURNING ${returing}`;
+      const sql = `UPDATE ${renderTable(q._table)}${setSQL}${whereSQL}${getOrderBy(q._orderBy)}${getLimit(q._limitBy, q._offsetBy)} RETURNING ${returing}`;
       return [{
         sql,
         values: q._sets.map((set) => set.value).concat(where.values)
@@ -10159,7 +10170,7 @@ function getCreateTableColumns(definition) {
 function getCreateTableColumn(columnName, def, primaryKeyColumns) {
   const primaryKey = primaryKeyColumns.length === 1 && columnName === primaryKeyColumns[0] ? " PRIMARY KEY" : "";
   const notNull = `${def.allowNull == false ? " NOT NULL" : ""}`;
-  const defaultValue = `${def.defaultValue !== void 0 ? ` DEFAULT '${def.defaultValue}'` : ""}`;
+  const defaultValue = def.defaultValue !== void 0 ? ` DEFAULT '${String(def.defaultValue).replace(/'/g, "''")}'` : "";
   const autoIncrement = `${def.autoIncrement !== void 0 && def.autoIncrement === true ? ` AUTOINCREMENT` : ""}`;
   switch (def.type) {
     case "datetime":
@@ -10204,8 +10215,21 @@ function getOrderBy(orderBy, wrapper = '"') {
 function getLimit(limit, offsetBy) {
   return `${limit !== void 0 ? ` LIMIT ${limit}` : ""}${offsetBy ? ` OFFSET ${offsetBy}` : ""}`;
 }
+var IDENT_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function renderColumn(column, wrapper = '"') {
-  return `${column.split(".").map((c) => `${wrapper}${c}${wrapper}`).join(".")}`;
+  const parts = column.split(".");
+  for (const p of parts) {
+    if (!IDENT_RE.test(p)) {
+      throw new Error(`invalid identifier: ${p}`);
+    }
+  }
+  return parts.map((c) => `${wrapper}${c}${wrapper}`).join(".");
+}
+function renderTable(name, wrapper = '"') {
+  if (!IDENT_RE.test(name)) {
+    throw new Error(`invalid table name: ${name}`);
+  }
+  return `${wrapper}${name}${wrapper}`;
 }
 function mergePrepareArgs(to, merge, concatOperator = " AND ") {
   return (merge instanceof Array ? merge : [merge]).reduce((current, value) => {
@@ -10412,6 +10436,9 @@ async function postgresExecutor(config) {
     connectionString: databaseOptions.connectionString
     // "postgresql://postgres:password@localhost:5432/db"
   });
+  driver.on("error", (err) => {
+    console.error("pg client error:", err);
+  });
   await driver.connect();
   return {
     disconnect: async function postgresExecutorDisconnect() {
@@ -10423,14 +10450,14 @@ async function postgresExecutor(config) {
       switch (args._type) {
         case "create-table": {
           const q = args;
-          const sql = `CREATE TABLE${q._ignoreDuplicate ? " IF NOT EXISTS" : ""} "${q._table}"${getCreateTableColumns2(q._definition)}`;
+          const sql = `CREATE TABLE${q._ignoreDuplicate ? " IF NOT EXISTS" : ""} ${renderTable(q._table)}${getCreateTableColumns2(q._definition)}`;
           return sql;
         }
         case "insert": {
           const q = args;
           const rows = getInsertValues(q._columns, q._values);
           const returing = q._returning.length === 0 ? "*" : q._returning.join(",");
-          const sql = `INSERT INTO "${q._table}"${getInsertColumns(q._columns)}${rows.sql} ${q._ignoreDuplicate ? "ON CONFLICT DO NOTHING " : ""}RETURNING ${returing}`;
+          const sql = `INSERT INTO ${renderTable(q._table)}${getInsertColumns(q._columns)}${rows.sql} ${q._ignoreDuplicate ? "ON CONFLICT DO NOTHING " : ""}RETURNING ${returing}`;
           return {
             sql,
             values: rows.values
@@ -10441,7 +10468,7 @@ async function postgresExecutor(config) {
           let alters = [];
           if (q._renameTable) {
             alters.push({
-              sql: `ALTER TABLE "${q._table}" RENAME TO "?"`,
+              sql: `ALTER TABLE ${renderTable(q._table)} RENAME TO "?"`,
               values: [q._renameTable]
             });
           }
@@ -10452,17 +10479,17 @@ async function postgresExecutor(config) {
                   throw new Error("unsupported alter action add without definition");
                 }
                 alters.push({
-                  sql: `ALTER TABLE "${q._table}" ADD COLUMN ${getCreateTableColumn2(l._column, l._definition, [])}`
+                  sql: `ALTER TABLE ${renderTable(q._table)} ADD COLUMN ${getCreateTableColumn2(l._column, l._definition, [])}`
                 });
                 break;
               case "drop":
                 alters.push({
-                  sql: `ALTER TABLE "${q._table}" DROP COLUMN "${l._column}"`
+                  sql: `ALTER TABLE ${renderTable(q._table)} DROP COLUMN "${l._column}"`
                 });
                 break;
               case "rename":
                 alters.push({
-                  sql: `ALTER TABLE "${q._table}" RENAME COLUMN "${l._column}" TO "${l._newName}"`
+                  sql: `ALTER TABLE ${renderTable(q._table)} RENAME COLUMN "${l._column}" TO "${l._newName}"`
                 });
                 break;
               default:
@@ -10498,7 +10525,7 @@ function getCreateTableColumns2(definition) {
 function getCreateTableColumn2(columnName, def, primaryKeyColumns) {
   const primaryKey = primaryKeyColumns.length === 1 && columnName === primaryKeyColumns[0] ? " PRIMARY KEY" : "";
   const notNull = `${def.allowNull == false ? " NOT NULL" : ""}`;
-  const defaultValue = `${def.defaultValue !== void 0 ? ` DEFAULT '${def.defaultValue}'` : ""}`;
+  const defaultValue = def.defaultValue !== void 0 ? ` DEFAULT '${String(def.defaultValue).replace(/'/g, "''")}'` : "";
   if (def.autoIncrement) {
     return `"${columnName}" BIGSERIAL${primaryKey}`;
   }
@@ -10793,10 +10820,16 @@ var Where = class _Where {
     return this;
   }
   limit(limit) {
+    if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 0) {
+      throw new Error("limit must be a non-negative integer");
+    }
     this._limitBy = limit;
     return this;
   }
   offset(offset) {
+    if (typeof offset !== "number" || !Number.isInteger(offset) || offset < 0) {
+      throw new Error("offset must be a non-negative integer");
+    }
     this._offsetBy = offset;
     return this;
   }
@@ -14133,13 +14166,15 @@ var auth_default = {
       const queryToken = args.req.query[ADMIN_EDITOR_AUTH_QUERY];
       const cookieToken = args.req.cookies[ADMIN_EDITOR_AUTH_COOKIE];
       if (queryToken) {
-        if (typeof queryToken === "string" && (0, import_node_crypto5.timingSafeEqual)(Buffer.from(queryToken), Buffer.from(KEY))) {
+        const queryBuf = Buffer.from(String(queryToken));
+        const keyBuf = Buffer.from(KEY);
+        if (typeof queryToken === "string" && queryBuf.length === keyBuf.length && (0, import_node_crypto5.timingSafeEqual)(queryBuf, keyBuf)) {
           args.res.setCookie(ADMIN_EDITOR_AUTH_COOKIE, KEY, {
-            expires: new Date(Date.now() + 1e3 * 60 * 60 * 24 * 31 * 12 * 500),
+            expires: new Date(Date.now() + 1e3 * 60 * 60 * 24),
             httpOnly: true,
-            //secure: true,
+            //secure: args.req.secure,
+            sameSite: "strict",
             path: "/"
-            //sameSite: "strict"
           });
           args.req.searchParams.delete(ADMIN_EDITOR_AUTH_QUERY);
           const queryString = args.req.searchParams.toString();
@@ -14407,16 +14442,34 @@ function setupExitHandlers(app) {
     }
     process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
   });
-  process.on("SIGTERM", function() {
+  process.on("SIGTERM", async function() {
     app.logger?.info("SIGTERM received");
+    if (app.server) {
+      await Promise.race([
+        app.stop(),
+        new Promise((r) => setTimeout(r, 5e3))
+      ]);
+    }
     process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
   });
-  process.on("SIGHUP", function() {
+  process.on("SIGHUP", async function() {
     app.logger?.info("SIGHUP received");
+    if (app.server) {
+      await Promise.race([
+        app.stop(),
+        new Promise((r) => setTimeout(r, 5e3))
+      ]);
+    }
     process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
   });
-  process.on("SIGINT", function() {
+  process.on("SIGINT", async function() {
     app.logger?.info("SIGINT received");
+    if (app.server) {
+      await Promise.race([
+        app.stop(),
+        new Promise((r) => setTimeout(r, 5e3))
+      ]);
+    }
     process.exit(EXIT_CODES.ABNORMAL_UNCONTROLLED);
   });
 }
@@ -17706,7 +17759,12 @@ var Miqro = class _Miqro {
     if (this.options?.httpRedirect) {
       this.httpsRedirectServer = new App();
       this.httpsRedirectServer.use(async (req, res) => {
-        const hostname = req.headers.host.split(":").length > 1 ? req.headers.host.split(":")[0] : req.headers.host;
+        const hostname = req.headers.host?.split(":")[0] ?? "";
+        const allowed2 = this.options?.allowedRedirectHosts;
+        if (allowed2 && !allowed2.includes(hostname)) {
+          res.writeHead(400).end("Invalid Host header");
+          return;
+        }
         return await res.redirect("https://" + hostname + ":" + this.options.port + req.url);
       });
     }

package/editor/auth.ts

@@ -28,14 +28,15 @@ export default {
       //console.log("\n\nqueryToken[%s] cookieToken[%s] KEY[%s]\n\n", queryToken, cookieToken, KEY);
 
       if (queryToken) {
-        if (typeof queryToken === "string" && timingSafeEqual(Buffer.from(queryToken), Buffer.from(KEY))) {
+        const queryBuf = Buffer.from(String(queryToken));
+        const keyBuf = Buffer.from(KEY);
+        if (typeof queryToken === "string" && queryBuf.length === keyBuf.length && timingSafeEqual(queryBuf, keyBuf)) {
           args.res.setCookie(ADMIN_EDITOR_AUTH_COOKIE, KEY, {
-            expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 31 * 12 * 500),
+            expires: new Date(Date.now() + 1000 * 60 * 60 * 24),
             httpOnly: true,
-
-            //secure: true,
+            //secure: args.req.secure,
+            sameSite: "strict",
             path: "/",
-            //sameSite: "strict"
           });
           args.req.searchParams.delete(ADMIN_EDITOR_AUTH_QUERY);
           const queryString = args.req.searchParams.toString();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "miqro",
-  "version": "7.3.3",
+  "version": "7.3.4",
   "description": "",
   "type": "module",
   "main": "build/esm/src/lib.js",
@@ -41,12 +41,12 @@
   },
   "dependencies": {
     "postject": "1.0.0-alpha.6",
-    "@miqro/core": "^5.1.1",
+    "@miqro/core": "^5.1.2",
     "@miqro/jsx": "^1.0.2",
     "@miqro/jsx-dom": "^1.0.6",
     "@miqro/jsx-node": "^1.0.9",
     "@miqro/parser": "^2.0.6",
-    "@miqro/query": "^0.0.8",
+    "@miqro/query": "^0.0.9",
     "@miqro/runner": "^2.0.3",
     "@miqro/test": "^0.2.10",
     "@miqro/test-http": "^0.1.4",