mssql-cr-layer 3.0.7 → 3.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mssql-cr-layer",
-  "version": "3.0.7",
+  "version": "3.0.9",
   "description": "A MS SQL Server interface layer for common requests",
   "repository": "andrglo/mssql-cr-layer",
   "author": {

package/src/index.js

@@ -2,6 +2,7 @@ const mssql = require('mssql')
 const assert = require('assert')
 const every = require('lodash.every')
 const debug = require('debug')('layer:mssql')
+const scanMarkers = require('./scan-markers')
 
 const connectionParams = new WeakMap() // Hidden connection parameters
 
@@ -237,19 +238,23 @@ MssqlCrLayer.prototype.query = function(statement, params, options) {
 
   const convertParams = function() {
     if (Array.isArray(params)) {
-      const match = statement.match(/(\$\w*\b)/g)
+      const markers = scanMarkers(statement)
       assert(
-          ((match && match.length) || 0) <= Object.keys(params).length,
+          markers.length <= Object.keys(params).length,
           'There are more ' + 'parameters in statement than in object params'
       )
       const paramsObj = {}
-      if (match) {
-        match.map(function(param) {
-          const key = param.substr(1)
-          paramsObj['p' + key] = params[Number(key) - 1]
-          statement = statement.replace(param, '@p' + key)
-        })
-      }
+      // rewrite by position: replacing by token would hit the first
+      // occurrence anywhere in the statement, comments and literals included
+      let converted = ''
+      let last = 0
+      markers.forEach(function(marker) {
+        const key = marker.name
+        paramsObj['p' + key] = params[Number(key) - 1]
+        converted += statement.slice(last, marker.index) + '@p' + key
+        last = marker.index + marker.length
+      })
+      statement = converted + statement.slice(last)
       params = paramsObj
     }
   }
@@ -310,12 +315,38 @@ MssqlCrLayer.prototype.close = function() {
 }
 
 /**
- * Wrap the identifier within the appropriate delimiters
+ * Wrap the identifier within the appropriate delimiters, escaping the
+ * closing delimiter by doubling it - the standard SQL escape - so an
+ * identifier holding a delimiter cannot close the quoted context and
+ * append arbitrary SQL. A NUL character cannot be escaped by any
+ * delimiter style, so it is rejected, as is a non string identifier
  * @param identifier {string}
  * @returns identifier {string}
  */
 MssqlCrLayer.prototype.wrap = function(identifier) {
-  return this.delimiters[0] + identifier + this.delimiters[1]
+  if (typeof identifier !== 'string') {
+    throw new Error(
+      'Invalid identifier: a string is expected, got ' + typeof identifier
+    )
+  }
+  if (identifier.indexOf('\0') !== -1) {
+    throw new Error(
+      'Invalid identifier: the NUL character is not allowed'
+    )
+  }
+  // delimiters is a prototype property a consumer can override. Read it once
+  // and check it here, at the point of use: anything but a two character
+  // string leaves close undefined or hijackable via Symbol.split, and the
+  // escape below silently becomes a no op
+  const delimiters = this.delimiters
+  if (typeof delimiters !== 'string' || delimiters.length !== 2) {
+    throw new Error(
+      'Invalid delimiters: a two character string is expected'
+    )
+  }
+  const open = delimiters[0]
+  const close = delimiters[1]
+  return open + identifier.split(close).join(close + close) + close
 }
 
 function getType(value, param) {

package/src/scan-markers.js

@@ -0,0 +1,111 @@
+/**
+ * Find the parameter markers of a T-SQL statement that are in code context.
+ *
+ * A regex over the whole statement cannot tell a marker from a marker
+ * lookalike sitting inside a string literal, a quoted identifier or a
+ * comment - 'Total R$100 a vista' reads as the marker $100 - so the
+ * statement is walked once, tracking the context, and only the markers
+ * found in code are reported.
+ *
+ * The marker grammar reproduces the old /(\$\w*\b)/g exactly: the sigil
+ * followed by one or more word characters, maximal munch. A sigil not
+ * followed by a word character is not a marker, so '%R$%' stays inert.
+ *
+ * There is no dollar quoting in T-SQL and no backslash escape in its
+ * string literals - a quote is escaped by doubling it, and so is the
+ * closing bracket of a bracketed identifier.
+ *
+ * @param statement {string}
+ * @returns {Array} [{index, length, name}, ...] in the order they appear,
+ * index being the offset of the sigil and name the token without it
+ */
+module.exports = function scanMarkers(statement) {
+  const markers = []
+  const length = statement.length
+  let i = 0
+  while (i < length) {
+    const char = statement[i]
+    if (char === '\'') {
+      i = skipQuoted(statement, i, '\'')
+    } else if (char === '"') {
+      i = skipQuoted(statement, i, '"')
+    } else if (char === '[') {
+      i = skipQuoted(statement, i, ']')
+    } else if (char === '-' && statement[i + 1] === '-') {
+      const end = statement.indexOf('\n', i + 2)
+      i = end === -1 ? length : end + 1
+    } else if (char === '/' && statement[i + 1] === '*') {
+      i = skipBlockComment(statement, i)
+    } else if (char === '$') {
+      let end = i + 1
+      while (end < length && isWordChar(statement[end])) {
+        end++
+      }
+      if (end > i + 1) {
+        markers.push({
+          index: i,
+          length: end - i,
+          name: statement.slice(i + 1, end)
+        })
+      }
+      i = end
+    } else {
+      i++
+    }
+  }
+  return markers
+}
+
+function isWordChar(char) {
+  return (
+    (char >= 'a' && char <= 'z') ||
+    (char >= 'A' && char <= 'Z') ||
+    (char >= '0' && char <= '9') ||
+    char === '_'
+  )
+}
+
+/**
+ * Skip the quoted run opened at start, whose closing delimiter is close and
+ * is escaped by doubling it. Unterminated runs to the end of the statement
+ * @returns the offset of the first character after the run
+ */
+function skipQuoted(statement, start, close) {
+  let i = start + 1
+  while (i < statement.length) {
+    if (statement[i] === close) {
+      if (statement[i + 1] === close) {
+        i += 2
+        continue
+      }
+      return i + 1
+    }
+    i++
+  }
+  return statement.length
+}
+
+/**
+ * Skip the block comment opened at start. T-SQL nests block comments, so the
+ * depth is tracked and the comment ends only when it gets back to zero
+ * @returns the offset of the first character after the comment
+ */
+function skipBlockComment(statement, start) {
+  let depth = 1
+  let i = start + 2
+  while (i < statement.length) {
+    if (statement[i] === '/' && statement[i + 1] === '*') {
+      depth++
+      i += 2
+    } else if (statement[i] === '*' && statement[i + 1] === '/') {
+      depth--
+      i += 2
+      if (depth === 0) {
+        return i
+      }
+    } else {
+      i++
+    }
+  }
+  return statement.length
+}