rez_core 4.0.64 → 4.0.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rez_core",
-  "version": "4.0.64",
+  "version": "4.0.66",
   "description": "",
   "author": "",
   "private": false,

package/src/module/filter/service/filter.service.ts

@@ -36,54 +36,26 @@ export class FilterService {
   ) {
     if (!column) return [];
   
-    // Basic SQL injection protection for identifiers
-    if (!/^[a-zA-Z0-9_]+$/.test(tableName) || !/^[a-zA-Z0-9_]+$/.test(column)) {
-      throw new Error('Invalid table or column name');
-    }
-  
     let whereSQL = '';
     const values: any[] = [];
   
     if (whereClauses.length > 0) {
       const clauseParts = whereClauses.map((clause) => {
-        // remove alias 'e.'
-        let parsedQuery = clause.query.replace(/\be\./g, '');
+        let parsedQuery = clause.query.replace(/\be\./g, ''); // remove e.
   
         Object.entries(clause.params).forEach(([key, val]) => {
           if (Array.isArray(val)) {
-            // Always use IN operator for arrays
+            // if it's an array → expand placeholders (?, ?, ?)
             const placeholders = val.map(() => '?').join(', ');
-            // Replace either "= :param" or ":param" with "IN (?, ?, ?)"
-            if (parsedQuery.match(new RegExp(`=\\s*:${key}\\b`))) {
-              parsedQuery = parsedQuery.replace(
-                new RegExp(`=\\s*:${key}\\b`, 'g'),
-                `IN (${placeholders})`,
-              );
-            } else {
-              parsedQuery = parsedQuery.replace(
-                new RegExp(`:\\b${key}\\b`, 'g'),
-                `(${placeholders})`,
-              );
-              // add IN keyword if not already there
-              if (!parsedQuery.includes('IN')) {
-                parsedQuery = parsedQuery.replace(
-                  new RegExp(`(${placeholders})`),
-                  `IN $1`,
-                );
-              }
-            }
-            values.push(...val);
+            parsedQuery = parsedQuery.replace(new RegExp(`:${key}`, 'g'), `(${placeholders})`);
+            values.push(...val); // flatten values
           } else {
-            parsedQuery = parsedQuery.replace(
-              new RegExp(`:\\b${key}\\b`, 'g'),
-              '?',
-            );
+            parsedQuery = parsedQuery.replace(new RegExp(`:${key}`, 'g'), '?');
             values.push(val);
           }
         });
   
-        // group safely
-        return `(${parsedQuery})`;
+        return parsedQuery;
       });
   
       whereSQL = `WHERE ${clauseParts.join(' AND ')}`;
@@ -99,7 +71,7 @@ export class FilterService {
     const rows = await this.dataSource.query(rawSQL, values);
   
     const total = rows.reduce(
-      (sum, r) => sum + Number(r.tab_value_count || 0),
+      (sum, r) => sum + parseInt(r.tab_value_count, 10),
       0,
     );
   
@@ -107,12 +79,11 @@ export class FilterService {
       { tab_value: 'All', tab_value_count: total },
       ...rows.map((r) => ({
         tab_value: r.tab_value ?? 'UNKNOWN',
-        tab_value_count: Number(r.tab_value_count || 0),
+        tab_value_count: parseInt(r.tab_value_count, 10),
       })),
     ];
   }
   
-  
 
   async applyFilterWrapper(dto: FilterRequestDto) {
     const {
@@ -891,22 +862,22 @@ if (
     if (Array.isArray(val) && val.length === 0) {
       return { query: '1=1', params: {} };
     }
-  
+
     if ((op === 'equal' || op === 'not_equal') && !Array.isArray(val)) {
       throw new BadRequestException(
         `Value for multi-select must be an array for operator: ${op}`,
       );
     }
-  
+
     switch (op) {
       case 'equal':
         return {
-          query: `e.${attr} IN (:...${key})`, // <-- use :... for arrays
+          query: `e.${attr} IN (:${key})`,
           params: { [key]: val },
         };
       case 'not_equal':
         return {
-          query: `e.${attr} NOT IN (:...${key})`,
+          query: `e.${attr} NOT IN (:${key})`,
           params: { [key]: val },
         };
       case 'contains':
@@ -929,7 +900,7 @@ if (
         );
     }
   }
-  
+
   private buildYearCondition(attr: string, op: string, val: any, key: string) {
     switch (op) {
       case 'equal':