observability-toolkit 1.8.0 → 1.8.4

package/dist/lib/query-sanitizer.js

@@ -0,0 +1,261 @@
+/**
+ * ClickHouse-specific query escaping and input validation
+ *
+ * Provides security utilities for sanitizing user inputs before
+ * including them in ClickHouse queries via SigNoz API.
+ */
+/**
+ * Dangerous SQL/query patterns that should never appear in user input
+ * Case-insensitive matching is used
+ */
+export const DANGEROUS_PATTERNS = [
+    'DROP',
+    'DELETE',
+    'INSERT',
+    'UPDATE',
+    'ALTER',
+    'CREATE',
+    'TRUNCATE',
+    '--',
+    '/*',
+    '*/',
+    ';',
+    'UNION',
+    'INTO OUTFILE',
+    'INTO DUMPFILE',
+    'LOAD_FILE',
+    'SYSTEM',
+    'ATTACH',
+    'DETACH',
+    'RENAME',
+    'OPTIMIZE',
+    'GRANT',
+    'REVOKE',
+];
+/**
+ * Escape a string value for use in ClickHouse single-quoted strings
+ *
+ * ClickHouse uses backslash escaping for special characters.
+ * @see https://clickhouse.com/docs/en/sql-reference/syntax#string
+ *
+ * @param value - The string value to escape
+ * @returns Escaped string safe for use in single-quoted ClickHouse strings
+ */
+export function escapeClickHouseString(value) {
+    return value
+        // Escape backslashes first (must be first to avoid double-escaping)
+        .replace(/\\/g, '\\\\')
+        // Escape single quotes
+        .replace(/'/g, "\\'")
+        // Escape null bytes
+        .replace(/\0/g, '\\0')
+        // Escape newlines
+        .replace(/\n/g, '\\n')
+        // Escape carriage returns
+        .replace(/\r/g, '\\r')
+        // Escape tabs
+        .replace(/\t/g, '\\t');
+}
+/**
+ * Escape LIKE wildcard characters for use in ClickHouse LIKE patterns
+ *
+ * This escapes % and _ which have special meaning in LIKE patterns.
+ * Use this when the user's input should be treated as a literal string
+ * in a LIKE clause, not as a pattern.
+ *
+ * @param value - The string value to escape for LIKE
+ * @returns Escaped string with LIKE wildcards escaped
+ */
+export function escapeClickHouseLike(value) {
+    // First escape backslashes (used as escape character in LIKE)
+    // Then escape the LIKE wildcards
+    return value
+        .replace(/\\/g, '\\\\')
+        .replace(/%/g, '\\%')
+        .replace(/_/g, '\\_');
+}
+/**
+ * Sanitize an identifier (column name, table name, etc.)
+ *
+ * Only allows alphanumeric characters, underscores, and dots.
+ * Removes all other characters.
+ *
+ * @param name - The identifier to sanitize
+ * @returns Sanitized identifier containing only safe characters
+ */
+export function sanitizeIdentifier(name) {
+    return name.replace(/[^a-zA-Z0-9_.]/g, '');
+}
+/**
+ * Maximum length for query input validation
+ * Prevents performance issues with very long inputs
+ */
+export const MAX_QUERY_INPUT_LENGTH = 10000;
+/**
+ * Special character patterns as array for index-based iteration
+ * Array iteration with for-loop is faster than Set iteration with for...of
+ * (avoids iterator object creation overhead)
+ */
+const SPECIAL_CHAR_PATTERNS = ['--', '/*', '*/', ';'];
+/**
+ * SQL keywords from DANGEROUS_PATTERNS (excluding special chars)
+ * Pre-filtered at module load time
+ */
+const SQL_KEYWORDS = DANGEROUS_PATTERNS.filter(p => !SPECIAL_CHAR_PATTERNS.includes(p));
+/**
+ * Escape regex metacharacters in a string for safe use in RegExp constructor
+ * Prevents ReDoS attacks when using user-influenced patterns
+ */
+function escapeRegexPattern(pattern) {
+    return pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Validate that escaped patterns don't contain unescaped alternation chars
+ * Prevents regex injection if patterns are incorrectly added to SQL_KEYWORDS
+ */
+function validateEscapedPatterns(escaped) {
+    for (const pattern of escaped) {
+        // After escaping, only \\| should exist (escaped pipe), not bare |
+        if (/(?<!\\)\|/.test(pattern)) {
+            throw new Error(`[SECURITY] Invalid pattern in SQL_KEYWORDS after escaping: contains unescaped alternation`);
+        }
+    }
+}
+/**
+ * Pre-compiled regex for all SQL keywords with word boundaries
+ * Combined into single alternation pattern for O(1) matching
+ * Example: /\b(DROP|DELETE|INSERT|...)\b/i
+ *
+ * Security: Validates escaped patterns to prevent injection via malformed SQL_KEYWORDS
+ */
+const SQL_KEYWORDS_REGEX = (() => {
+    const escaped = SQL_KEYWORDS.map(escapeRegexPattern);
+    validateEscapedPatterns(escaped);
+    return new RegExp(`\\b(${escaped.join('|')})\\b`, 'i');
+})();
+/**
+ * Check if a string contains any dangerous SQL patterns
+ *
+ * Uses case-insensitive matching and word boundary detection
+ * for most patterns to reduce false positives.
+ *
+ * Performance: O(1) Set lookup for special chars + O(1) pre-compiled regex
+ * for SQL keywords (previously O(n) with n=22 patterns).
+ *
+ * Defense in depth: Rejects inputs exceeding MAX_QUERY_INPUT_LENGTH
+ * to prevent performance issues with very long strings.
+ *
+ * Security: Uses String() to freeze input as primitive, preventing TOCTOU
+ * race conditions with Proxy objects or getter-modified values.
+ *
+ * @param input - The input string to check
+ * @returns true if dangerous pattern found, false otherwise
+ */
+export function containsDangerousPattern(input) {
+    // Security: Freeze input as string primitive to prevent TOCTOU attacks
+    // where a Proxy or getter could return different values on each access
+    const frozenInput = String(input);
+    // Defense in depth: reject excessively long inputs
+    if (frozenInput.length > MAX_QUERY_INPUT_LENGTH) {
+        console.warn(`[SECURITY] Input length ${frozenInput.length} exceeds maximum ${MAX_QUERY_INPUT_LENGTH}`);
+        return true;
+    }
+    // O(1) check for special character patterns via string.includes
+    // Using index-based loop to avoid iterator object creation overhead
+    for (let i = 0; i < SPECIAL_CHAR_PATTERNS.length; i++) {
+        if (frozenInput.includes(SPECIAL_CHAR_PATTERNS[i])) {
+            return true;
+        }
+    }
+    // O(1) check for SQL keywords via pre-compiled combined regex
+    return SQL_KEYWORDS_REGEX.test(frozenInput);
+}
+/**
+ * Validate that user input does not contain dangerous patterns
+ *
+ * Throws an error if dangerous patterns are detected, including
+ * the field name for better error messages.
+ *
+ * @param input - The input string to validate
+ * @param fieldName - Name of the field being validated (for error messages)
+ * @throws Error if dangerous pattern is found
+ */
+export function validateQueryInput(input, fieldName) {
+    if (containsDangerousPattern(input)) {
+        throw new Error(`Invalid ${fieldName}: contains potentially dangerous SQL pattern`);
+    }
+}
+/**
+ * Composable value sanitizer with configurable validation and escaping
+ *
+ * Provides flexible control over which operations to apply:
+ * - validate: Check for dangerous SQL patterns
+ * - escapeString: Escape for ClickHouse string context
+ * - escapeLike: Escape LIKE wildcards (%, _)
+ *
+ * @example
+ * // Validate only (no escaping)
+ * sanitizeValue(input, { escapeString: false, fieldName: 'search' });
+ *
+ * // Escape only (no validation) - use when input is already trusted
+ * sanitizeValue(input, { validate: false });
+ *
+ * // Full sanitization for LIKE clause
+ * sanitizeValue(input, { escapeLike: true, fieldName: 'search' });
+ *
+ * @param value - The value to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized string
+ * @throws Error if validation enabled and dangerous pattern found
+ */
+export function sanitizeValue(value, options = {}) {
+    const { validate = true, escapeString = true, escapeLike = false, fieldName = 'value', allowEmpty = true, } = options;
+    // Step 0: Check for empty string if not allowed
+    if (!allowEmpty && value === '') {
+        throw new Error(`Invalid ${fieldName}: empty string not allowed`);
+    }
+    // Step 1: Validate if enabled
+    if (validate) {
+        validateQueryInput(value, fieldName);
+    }
+    // Step 2: Apply escaping pipeline
+    let result = value;
+    if (escapeLike) {
+        result = escapeClickHouseLike(result);
+    }
+    if (escapeString) {
+        result = escapeClickHouseString(result);
+    }
+    return result;
+}
+/**
+ * Escape and validate a string value for use in WHERE clause conditions
+ *
+ * @deprecated Use sanitizeValue() for more flexibility:
+ *   sanitizeValue(value, { fieldName }) - same behavior
+ *   sanitizeValue(value, { validate: false }) - escape only
+ *
+ * @param value - The value to escape
+ * @param fieldName - Name of the field (for error messages)
+ * @returns Escaped string safe for ClickHouse queries
+ * @throws Error if dangerous pattern is found
+ */
+export function escapeFilterValueSafe(value, fieldName) {
+    return sanitizeValue(value, { fieldName });
+}
+/**
+ * Escape and validate a value for use in LIKE clauses
+ *
+ * @deprecated Use sanitizeValue() for more flexibility:
+ *   sanitizeValue(value, { escapeLike: true, fieldName }) - same behavior
+ *   sanitizeValue(value, { escapeLike: true, validate: false }) - escape only
+ *
+ * @param value - The value to escape
+ * @param fieldName - Name of the field (for error messages)
+ * @returns Escaped string safe for ClickHouse LIKE clauses
+ * @throws Error if dangerous pattern is found
+ */
+export function escapeLikeValueSafe(value, fieldName) {
+    return sanitizeValue(value, { escapeLike: true, fieldName });
+}
+//# sourceMappingURL=query-sanitizer.js.map

package/dist/lib/query-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-sanitizer.js","sourceRoot":"","sources":["../../src/lib/query-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,UAAU;IACV,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,OAAO;IACP,cAAc;IACd,eAAe;IACf,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,OAAO;IACP,QAAQ;CACA,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,KAAK;QACV,oEAAoE;SACnE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,uBAAuB;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,oBAAoB;SACnB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,kBAAkB;SACjB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,0BAA0B;SACzB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,cAAc;SACb,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,8DAA8D;IAC9D,iCAAiC;IACjC,OAAO,KAAK;SACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAEtD;;;GAGG;AACH,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,OAAiB;IAChD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,mEAAmE;QACnE,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE;IAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACrD,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,IAAI,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,mDAAmD;IACnD,IAAI,WAAW,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,2BAA2B,WAAW,CAAC,MAAM,oBAAoB,sBAAsB,EAAE,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gEAAgE;IAChE,oEAAoE;IACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,8CAA8C,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,UAA2B,EAAE;IACxE,MAAM,EACJ,QAAQ,GAAG,IAAI,EACf,YAAY,GAAG,IAAI,EACnB,UAAU,GAAG,KAAK,EAClB,SAAS,GAAG,OAAO,EACnB,UAAU,GAAG,IAAI,GAClB,GAAG,OAAO,CAAC;IAEZ,gDAAgD;IAChD,IAAI,CAAC,UAAU,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,4BAA4B,CAAC,CAAC;IACpE,CAAC;IAED,8BAA8B;IAC9B,IAAI,QAAQ,EAAE,CAAC;QACb,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,kCAAkC;IAClC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB;IACpE,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,SAAiB;IAClE,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/lib/query-sanitizer.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Unit tests for query-sanitizer.ts
+ */
+export {};
+//# sourceMappingURL=query-sanitizer.test.d.ts.map

package/dist/lib/query-sanitizer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-sanitizer.test.d.ts","sourceRoot":"","sources":["../../src/lib/query-sanitizer.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}