saltcorn-db-code 0.1.0 → 0.2.0

package/README.md

@@ -27,7 +27,13 @@ TODO
 ![Test functions screen](./screenshots/test_functions.png)
 
 
-## Local installation during development
+## Installation
+
+You can install directly from your saltcorn instance. 
+- Go to Settings - Modules
+- Choose "Add another module" under top right dropdown menu.
+- Fill name, source (npm) and saltcorn-db-code as Location.
+- Create a View with View Pattern DBCodeConsole
 
 From the Saltcorn checkout:
 

package/lib/sql-builders.js

@@ -1,5 +1,118 @@
 const { assertIdentifier, assertAllowed, ALLOWED_LANGUAGES, ALLOWED_VOLATILITY, ALLOWED_SECURITY } = require("./validation");
 
+function escapeRegex(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function hasExactlyOneTopLevelTerminatedStatement(sql) {
+  const text = String(sql || "");
+  let i = 0;
+  let inSingle = false;
+  let inDouble = false;
+  let inLineComment = false;
+  let inBlockComment = false;
+  let dollarTag = null;
+  let semicolonCount = 0;
+
+  while (i < text.length) {
+    const c = text[i];
+    const next = text[i + 1];
+
+    if (inLineComment) {
+      if (c === "\n") inLineComment = false;
+      i += 1;
+      continue;
+    }
+
+    if (inBlockComment) {
+      if (c === "*" && next === "/") {
+        inBlockComment = false;
+        i += 2;
+      } else {
+        i += 1;
+      }
+      continue;
+    }
+
+    if (dollarTag) {
+      if (text.startsWith(dollarTag, i)) {
+        i += dollarTag.length;
+        dollarTag = null;
+      } else {
+        i += 1;
+      }
+      continue;
+    }
+
+    if (inSingle) {
+      if (c === "'" && next === "'") {
+        i += 2;
+      } else if (c === "'") {
+        inSingle = false;
+        i += 1;
+      } else {
+        i += 1;
+      }
+      continue;
+    }
+
+    if (inDouble) {
+      if (c === '"' && next === '"') {
+        i += 2;
+      } else if (c === '"') {
+        inDouble = false;
+        i += 1;
+      } else {
+        i += 1;
+      }
+      continue;
+    }
+
+    if (c === "-" && next === "-") {
+      inLineComment = true;
+      i += 2;
+      continue;
+    }
+
+    if (c === "/" && next === "*") {
+      inBlockComment = true;
+      i += 2;
+      continue;
+    }
+
+    if (c === "$") {
+      const match = text.slice(i).match(/^\$[A-Za-z_][A-Za-z0-9_]*\$|^\$\$/);
+      if (match) {
+        dollarTag = match[0];
+        i += dollarTag.length;
+        continue;
+      }
+    }
+
+    if (c === "'") {
+      inSingle = true;
+      i += 1;
+      continue;
+    }
+
+    if (c === '"') {
+      inDouble = true;
+      i += 1;
+      continue;
+    }
+
+    if (c === ";") semicolonCount += 1;
+    i += 1;
+  }
+
+  if (inSingle || inDouble || inBlockComment || inLineComment || dollarTag) return false;
+  if (semicolonCount !== 1) return false;
+
+  const trimmed = text.trim();
+  if (!trimmed.endsWith(";")) return false;
+  return true;
+}
+
 function quoteIdent(identifier) {
   assertIdentifier(identifier);
   return `"${identifier.replace(/"/g, '""')}"`;
@@ -54,10 +167,14 @@ function buildDropRoutineSql({ schema, name, identityArguments = "", kind = "fun
 function validateCreateRoutineDdl(sql, schema) {
   const ddl = String(sql || "").trim();
   if (!ddl) throw new Error("DDL is required.");
+  assertIdentifier(schema, "schema");
+  if (!hasExactlyOneTopLevelTerminatedStatement(ddl)) {
+    throw new Error("DDL must contain exactly one CREATE FUNCTION/PROCEDURE statement terminated by a single top-level semicolon.");
+  }
   if (!/^CREATE\s+(OR\s+REPLACE\s+)?(FUNCTION|PROCEDURE)\s+/i.test(ddl)) {
     throw new Error("DDL must start with CREATE FUNCTION, CREATE OR REPLACE FUNCTION, CREATE PROCEDURE, or CREATE OR REPLACE PROCEDURE.");
   }
-  const schemaPattern = new RegExp(`^CREATE\\s+(OR\\s+REPLACE\\s+)?(FUNCTION|PROCEDURE)\\s+("${schema.replace(/"/g, '""')}"|${schema})\\.`, "i");
+  const schemaPattern = new RegExp(`^CREATE\\s+(OR\\s+REPLACE\\s+)?(FUNCTION|PROCEDURE)\\s+("${escapeRegex(schema)}"|${escapeRegex(schema)})\\s*\\.`, "i");
   if (!schemaPattern.test(ddl)) throw new Error(`DDL must create the routine explicitly in the current tenant schema: ${schema}.`);
   return ddl;
 }

package/lib/view-context.js

@@ -7,27 +7,49 @@
  * is null and all links use the /db-code paths as before.
  */
 
+function escapeAttr(value) {
+  return String(value ?? "")
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+function sanitizeViewBaseUrl(value) {
+  const text = String(value || "").trim();
+  if (!text) return null;
+  if (!text.startsWith("/")) return null;
+  if (text.startsWith("//")) return null;
+  if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(text)) return null;
+  if (!/^\/(view|db-code)(\/|$)/.test(text)) return null;
+  if (/[\r\n]/.test(text)) return null;
+  return text;
+}
+
 /**
  * Build the list-page URL for the current context.
  * @param {string|null} viewBaseUrl
  * @param {string} kind  Optional kind filter ("function" or "procedure")
  */
 function listViewHref(viewBaseUrl, kind) {
-  if (!viewBaseUrl) {
+  const safeViewBaseUrl = sanitizeViewBaseUrl(viewBaseUrl);
+  if (!safeViewBaseUrl) {
     return kind ? `/db-code?kind=${encodeURIComponent(kind)}` : "/db-code";
   }
   const params = new URLSearchParams();
   if (kind) params.set("kind", kind);
   const qs = params.toString();
-  return qs ? `${viewBaseUrl}?${qs}` : viewBaseUrl;
+  return qs ? `${safeViewBaseUrl}?${qs}` : safeViewBaseUrl;
 }
 
 /**
  * Build the detail-page URL for the current context.
  */
 function detailViewHref(viewBaseUrl, oid) {
-  if (!viewBaseUrl) return `/db-code/routine/${oid}`;
-  return `${viewBaseUrl}?routine_oid=${oid}`;
+  const safeViewBaseUrl = sanitizeViewBaseUrl(viewBaseUrl);
+  if (!safeViewBaseUrl) return `/db-code/routine/${oid}`;
+  return `${safeViewBaseUrl}?routine_oid=${oid}`;
 }
 
 /**
@@ -35,24 +57,26 @@ function detailViewHref(viewBaseUrl, oid) {
  * the user is in a view context so the route can redirect back.
  */
 function routeHref(routePath, viewBaseUrl) {
-  if (!viewBaseUrl) return routePath;
+  const safeViewBaseUrl = sanitizeViewBaseUrl(viewBaseUrl);
+  if (!safeViewBaseUrl) return routePath;
   const sep = routePath.includes("?") ? "&" : "?";
-  return `${routePath}${sep}view_base_url=${encodeURIComponent(viewBaseUrl)}`;
+  return `${routePath}${sep}view_base_url=${encodeURIComponent(safeViewBaseUrl)}`;
 }
 
 /**
  * Hidden form input that carries view_base_url through POST requests.
  */
 function viewContextInput(viewBaseUrl) {
-  if (!viewBaseUrl) return "";
-  return `<input type="hidden" name="view_base_url" value="${viewBaseUrl.replace(/"/g, "&quot;")}">`;
+  const safeViewBaseUrl = sanitizeViewBaseUrl(viewBaseUrl);
+  if (!safeViewBaseUrl) return "";
+  return `<input type="hidden" name="view_base_url" value="${escapeAttr(safeViewBaseUrl)}">`;
 }
 
 /**
  * Read view_base_url from a request (query on GET, body on POST).
  */
 function getViewBaseUrl(req) {
-  return req.query?.view_base_url || req.body?.view_base_url || null;
+  return sanitizeViewBaseUrl(req.query?.view_base_url || req.body?.view_base_url || null);
 }
 
-module.exports = { listViewHref, detailViewHref, routeHref, viewContextInput, getViewBaseUrl };
+module.exports = { listViewHref, detailViewHref, routeHref, viewContextInput, getViewBaseUrl, sanitizeViewBaseUrl };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "saltcorn-db-code",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Saltcorn plugin to inspect and manage PostgreSQL database routines (functions and stored procedures) from the Saltcorn UI.",
   "main": "index.js",
   "scripts": {

package/routes/import.js

@@ -2,6 +2,7 @@ const { requireAdmin } = require("../lib/auth");
 const { escapeHtml, page } = require("../lib/html");
 const { ensurePostgres, currentTenantSchema } = require("../lib/introspection");
 const { validateImportPack, remapSchemaInDdl, renderPackPreview } = require("../lib/export-import");
+const { validateCreateRoutineDdl } = require("../lib/sql-builders");
 const { listViewHref, viewContextInput, getViewBaseUrl } = require("../lib/view-context");
 
 const db = require("@saltcorn/data/db");
@@ -206,6 +207,7 @@ async function importExecuteRoute(req, res) {
         if (validation.pack.source_schema && validation.pack.source_schema !== schema) {
           ddl = remapSchemaInDdl(ddl, validation.pack.source_schema, schema);
         }
+        ddl = validateCreateRoutineDdl(ddl, schema);
         await db.query(ddl);
         results.push({ name: r.name, kind: r.kind, status: "ok" });
       } catch (err) {