spice-js 2.6.7 → 2.6.8

package/build/bootstrap/cache.js

@@ -16,7 +16,11 @@ function _connect() {
 
       for (var key of Object.keys(spice.config.cache.providers)) {
         spice.cache_providers[key] = new spice.config.cache.providers[key](spice.config.cache.drivers[key] || {});
-        spice.cache_providers[key].initialize();
+        spice.cache_providers[key].initialize().then(() => {
+          console.log("Redis initialized successfully");
+        }).catch(err => {
+          console.error("Error initializing Redis:", err);
+        });
       }
     } catch (e) {
       console.log(e.stack);

package/build/models/SpiceModel.js

@@ -7,6 +7,8 @@ var _2 = require("..");
 
 var _ResourceLifecycleTriggered = _interopRequireDefault(require("../events/events/ResourceLifecycleTriggered"));
 
+var _Security = require("../utility/Security");
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 function _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }
@@ -495,11 +497,13 @@ class SpiceModel {
   setMonitor() {
     var current_time = new Date().getTime();
     var obj = this.getCacheProviderObject();
-    obj.set("monitor::" + this.type, {
+    var key = "monitor::" + this.type;
+    var value = {
       time: current_time
-    }, {
+    };
+    obj.set(key, value, {
       ttl: 0
-    }); //console.log("Monitor Set", spice.monitor);
+    });
   }
 
   get(args) {
@@ -512,7 +516,10 @@ class SpiceModel {
         }
 
         if (_.isString(args.id)) {
-          yield _this4.run_hook(args, "get", "before");
+          if (args.skip_hooks != true) {
+            yield _this4.run_hook(args, "get", "before");
+          }
+
           var key = _this4.type + "::" + args.id;
           var results = {};
 
@@ -540,8 +547,14 @@ class SpiceModel {
           }
 
           if (results.deleted == undefined || results.deleted == false) {
-            yield _this4.run_hook(results, "get", "after");
-            results = yield _this4.do_serialize(results, "read", {}, args, (yield _this4.propsToBeRemoved(results)));
+            if (args.skip_read_serialize != true && args.skip_serialize != true) {
+              results = yield _this4.do_serialize(results, "read", {}, args, (yield _this4.propsToBeRemoved(results)));
+            }
+
+            if (args.skip_hooks != true) {
+              yield _this4.run_hook(results, "get", "after");
+            }
+
             return results;
           } else {
             throw new Error(_this4.type + " does not exist");
@@ -575,7 +588,9 @@ class SpiceModel {
           args = {};
         }
 
-        yield _this6.run_hook(_this6, "list", "before");
+        if (args.skip_hooks != true) {
+          yield _this6.run_hook(_this6, "list", "before");
+        }
 
         _.remove(args.ids, o => o == undefined);
 
@@ -603,8 +618,14 @@ class SpiceModel {
 
         _.remove(results, o => o.type != _this6.type);
 
-        yield _this6.run_hook(results, "list", "after", args.context);
-        results = yield _this6.do_serialize(results, "read", {}, args, (yield _this6.propsToBeRemoved(results)));
+        if (args.skip_read_serialize != true && args.skip_serialize != true) {
+          results = yield _this6.do_serialize(results, "read", {}, args, (yield _this6.propsToBeRemoved(results)));
+        }
+
+        if (args.skip_hooks != true) {
+          yield _this6.run_hook(results, "list", "after", args.context);
+        }
+
         return results;
       } catch (e) {
         console.log(e.stack);
@@ -664,34 +685,33 @@ class SpiceModel {
           new: _this8,
           id: args.id
         };
-
-        if (args.skip_hooks != true) {
-          yield _this8.run_hook(cover_obj, "update", "before", results);
-        }
-
         var form;
 
         if (args.skip_write_serialize != true && args.skip_serialize != true) {
-          form = yield _this8.do_serialize(_this8, "write", cover_obj.new, args);
+          cover_obj.new = yield _this8.do_serialize(_this8, "write", cover_obj.new, args);
         }
 
-        var db_data = form || _this8;
+        if (args.skip_hooks != true) {
+          yield _this8.run_hook(cover_obj, "update", "before", results);
+        }
+
+        var db_data = cover_obj.new || _this8;
         yield _this8.database.update(args.id, db_data);
 
         _this8.setMonitor();
 
+        if (args.skip_read_serialize != true && args.skip_serialize != true) {
+          cover_obj.new = yield _this8.do_serialize(cover_obj.new, "read", {}, args, (yield _this8.propsToBeRemoved(cover_obj.new)));
+        }
+
         if (args.skip_hooks != true) {
           yield _this8.run_hook(_extends({}, _this8, {
             id: args.id
           }), "update", "after", results);
         }
 
-        if (args.skip_read_serialize != true && args.skip_serialize != true) {
-          form = yield _this8.do_serialize(form, "read", {}, args, (yield _this8.propsToBeRemoved(form)));
-        }
-
         _this8.id = args.id;
-        return _extends({}, form, {
+        return _extends({}, cover_obj.new, {
           id: args.id
         });
       } catch (e) {
@@ -724,16 +744,28 @@ class SpiceModel {
           id = args.id;
         }
 
-        yield _this9.run_hook(workingForm, "create", "before");
-        workingForm = yield _this9.do_serialize(workingForm, "write", {}, args);
+        if (args.skip_write_serialize != true && args.skip_serialize != true) {
+          workingForm = yield _this9.do_serialize(workingForm, "write", {}, args);
+        }
+
+        if (args.skip_hooks != true) {
+          yield _this9.run_hook(workingForm, "create", "before");
+        }
+
         var results = yield _this9.database.insert(id, workingForm, args.expiry);
 
         _this9.setMonitor();
 
-        yield _this9.run_hook(_extends({}, results, {
-          id
-        }), "create", "after");
-        results = yield _this9.do_serialize(results, "read", {}, args, (yield _this9.propsToBeRemoved(results)));
+        if (args.skip_read_serialize != true && args.skip_serialize != true) {
+          results = yield _this9.do_serialize(results, "read", {}, args, (yield _this9.propsToBeRemoved(results)));
+        }
+
+        if (args.skip_hooks != true) {
+          yield _this9.run_hook(_extends({}, results, {
+            id
+          }), "create", "after");
+        }
+
         return _extends({}, results, {
           id
         });
@@ -757,7 +789,10 @@ class SpiceModel {
       var results = yield _this10.database.get(args.id);
 
       try {
-        yield _this10.run_hook(args, "delete", "before");
+        if (args.skip_hooks != true) {
+          yield _this10.run_hook(args, "delete", "before");
+        }
+
         var delete_response = {};
 
         if (args.hard) {
@@ -770,7 +805,10 @@ class SpiceModel {
           delete_response = yield _this10.database.update(args.id, "");
         }
 
-        yield _this10.run_hook(results, "delete", "after", results);
+        if (args.skip_hooks != true) {
+          yield _this10.run_hook(results, "delete", "after", results);
+        }
+
         return {};
       } catch (e) {
         console.log(e.stack);
@@ -822,6 +860,10 @@ class SpiceModel {
           }
         }
 
+        if ((0, _Security.hasSQLInjection)(query)) {
+          return [];
+        }
+
         if (args.limit) {
           args.limit = Number(args.limit);
         }
@@ -834,7 +876,9 @@ class SpiceModel {
           args.sort = "created_at DESC";
         }
 
-        yield _this11.run_hook(_this11, "list", "before");
+        if (args.skip_hooks != true) {
+          yield _this11.run_hook(_this11, "list", "before");
+        }
 
         function removeSpaceAndSpecialCharacters(str) {
           return str.replace(/[^a-zA-Z0-9]/g, "");
@@ -884,8 +928,11 @@ class SpiceModel {
               var _cached_results2 = yield _this11.getCacheProviderObject(_this11.type).get(key);
 
               results = _cached_results2 == null ? void 0 : _cached_results2.value;
+              var shouleForceRefresh = yield _this11.shouldForceRefresh(_cached_results2);
+              console.log("Cache Results", _this11.type, (_cached_results2 == null ? void 0 : _cached_results2.value) == undefined, shouleForceRefresh, (_cached_results2 == null ? void 0 : _cached_results2.value) == undefined || shouleForceRefresh);
 
-              if ((_cached_results2 == null ? void 0 : _cached_results2.value) == undefined || (yield _this11.shouldForceRefresh(_cached_results2))) {
+              if ((_cached_results2 == null ? void 0 : _cached_results2.value) == undefined || shouleForceRefresh) {
+                console.log("Getting From Database With Cache", _this11.type);
                 results = yield _this11.database.search(_this11.type, args.columns || "", query || "", args.limit, args.offset, args.sort, args.do_count, args.statement_consistent);
 
                 _this11.getCacheProviderObject(_this11.type).set(key, {
@@ -904,8 +951,13 @@ class SpiceModel {
         }
 
         try {
-          yield _this11.run_hook(results.data, "list", "after");
-          results.data = yield _this11.do_serialize(results.data, "read", {}, args, (yield _this11.propsToBeRemoved(results.data)));
+          if (args.skip_read_serialize != true && args.skip_serialize != true) {
+            results.data = yield _this11.do_serialize(results.data, "read", {}, args, (yield _this11.propsToBeRemoved(results.data)));
+          }
+
+          if (args.skip_hooks != true) {
+            yield _this11.run_hook(results.data, "list", "after");
+          }
         } catch (e) {
           console.log(e);
         }

package/build/utility/Security.js

@@ -0,0 +1,51 @@
+"use strict";
+
+exports.__esModule = true;
+exports.hasSQLInjection = hasSQLInjection;
+
+function hasSQLInjection(input) {
+  // Convert input to lowercase for easier pattern matching
+  var lowerInput = input.toLowerCase(); // List of patterns that indicate potential SQL injection
+
+  var patterns = ["--", // T-SQL comment
+  "/*", // Start of block comment
+  "*/", // End of block comment
+  "or 1=1", // OR statement that's always true
+  "or true", // OR statement that's always true (non-T-SQL databases)
+  "union all", // UNION statement (often used to retrieve data from another table)
+  "union select", // Another form of UNION statement
+  ";", // Commenting out the rest of a query
+  "drop table", // DDL statements are very suspicious
+  "update ", // Modification commands
+  "insert into", // Insertion commands
+  "delete from", // Deletion commands
+  "exec(", // Execution function in T-SQL
+  "execute(", // Another execution function in T-SQL
+  "xp_", // Extended stored procedures in T-SQL - often used in older SQL Server attacks
+  "0x", // Hex encoding
+  "benchmark(", // MySQL benchmark function - can be used for time-based blind attacks
+  "sleep(", // MySQL sleep function - can also be used for time-based blind attacks
+  "pg_sleep(", // PostgreSQL sleep function - time-based blind attack
+  "cast(", // Casting can be used for type-based attacks
+  "convert(", // Similar to the above
+  "waitfor delay" // SQL Server delay function - time-based blind attack
+  ];
+
+  for (var pattern of patterns) {
+    if (lowerInput.includes(pattern)) {
+      return true;
+    }
+  } // Additional patterns based on regular expressions for more complex detections
+
+
+  var regexPatterns = [/['"‘’“”][\s]*[+]+[\s]*['"‘’“”]/ // String concatenation, often used to obfuscate injections
+  ];
+
+  for (var regex of regexPatterns) {
+    if (regex.test(lowerInput)) {
+      return true;
+    }
+  }
+
+  return false;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spice-js",
-  "version": "2.6.7",
+  "version": "2.6.8",
   "description": "spice",
   "main": "build/index.js",
   "repository": {
@@ -15,7 +15,6 @@
   "license": "ISC",
   "dependencies": {
     "agenda": "^3.1.0",
-    "caniuse-lite": "^1.0.30001283",
     "co": "^4.6.0",
     "dotenv": "^8.2.0",
     "flat": "^5.0.0",

package/src/bootstrap/cache.js

@@ -8,7 +8,14 @@ async function connect() {
       spice.cache_providers[key] = new spice.config.cache.providers[key](
         spice.config.cache.drivers[key] || {}
       );
-      spice.cache_providers[key].initialize();
+      spice.cache_providers[key]
+        .initialize()
+        .then(() => {
+          console.log("Redis initialized successfully");
+        })
+        .catch((err) => {
+          console.error("Error initializing Redis:", err);
+        });
     }
   } catch (e) {
     console.log(e.stack);

package/src/models/SpiceModel.js

@@ -4,6 +4,7 @@ import { MapType, DataType } from "..";
 let co = require("co");
 var regeneratorRuntime = require("regenerator-runtime");
 import ResourceLifecycleTriggered from "../events/events/ResourceLifecycleTriggered";
+import { hasSQLInjection } from "../utility/Security";
 
 var SDate = require("sonover-date"),
   UUID = require("uuid"),
@@ -417,8 +418,9 @@ export default class SpiceModel {
   setMonitor() {
     let current_time = new Date().getTime();
     let obj = this.getCacheProviderObject();
-    obj.set(`monitor::${this.type}`, { time: current_time }, { ttl: 0 });
-    //console.log("Monitor Set", spice.monitor);
+    let key = `monitor::${this.type}`;
+    let value = { time: current_time };
+    obj.set(key, value, { ttl: 0 });
   }
 
   async get(args) {
@@ -427,7 +429,9 @@ export default class SpiceModel {
         args = {};
       }
       if (_.isString(args.id)) {
-        await this.run_hook(args, "get", "before");
+        if (args.skip_hooks != true) {
+          await this.run_hook(args, "get", "before");
+        }
         let key = `${this.type}::${args.id}`;
         let results = {};
         if (this.shouldUseCache(this.type)) {
@@ -435,6 +439,7 @@ export default class SpiceModel {
             key
           );
           results = cached_results?.value;
+
           if (
             cached_results?.value == undefined ||
             (await this.shouldForceRefresh(cached_results))
@@ -461,14 +466,18 @@ export default class SpiceModel {
         }
 
         if (results.deleted == undefined || results.deleted == false) {
-          await this.run_hook(results, "get", "after");
-          results = await this.do_serialize(
-            results,
-            "read",
-            {},
-            args,
-            await this.propsToBeRemoved(results)
-          );
+          if (args.skip_read_serialize != true && args.skip_serialize != true) {
+            results = await this.do_serialize(
+              results,
+              "read",
+              {},
+              args,
+              await this.propsToBeRemoved(results)
+            );
+          }
+          if (args.skip_hooks != true) {
+            await this.run_hook(results, "get", "after");
+          }
           return results;
         } else {
           throw new Error(`${this.type} does not exist`);
@@ -493,8 +502,9 @@ export default class SpiceModel {
       if (!args) {
         args = {};
       }
-
-      await this.run_hook(this, "list", "before");
+      if (args.skip_hooks != true) {
+        await this.run_hook(this, "list", "before");
+      }
       _.remove(args.ids, (o) => o == undefined);
       let key = `${this.type}::${_.join(args.ids, "|")}`;
       let results = [];
@@ -520,15 +530,19 @@ export default class SpiceModel {
         }
       }
       _.remove(results, (o) => o.type != this.type);
+      if (args.skip_read_serialize != true && args.skip_serialize != true) {
+        results = await this.do_serialize(
+          results,
+          "read",
+          {},
+          args,
+          await this.propsToBeRemoved(results)
+        );
+      }
 
-      await this.run_hook(results, "list", "after", args.context);
-      results = await this.do_serialize(
-        results,
-        "read",
-        {},
-        args,
-        await this.propsToBeRemoved(results)
-      );
+      if (args.skip_hooks != true) {
+        await this.run_hook(results, "list", "after", args.context);
+      }
 
       return results;
     } catch (e) {
@@ -581,19 +595,35 @@ export default class SpiceModel {
         new: this,
         id: args.id,
       };
-      if (args.skip_hooks != true) {
-        await this.run_hook(cover_obj, "update", "before", results);
-      }
 
       let form;
       if (args.skip_write_serialize != true && args.skip_serialize != true) {
-        form = await this.do_serialize(this, "write", cover_obj.new, args);
+        cover_obj.new = await this.do_serialize(
+          this,
+          "write",
+          cover_obj.new,
+          args
+        );
+      }
+
+      if (args.skip_hooks != true) {
+        await this.run_hook(cover_obj, "update", "before", results);
       }
-      let db_data = form || this;
+      let db_data = cover_obj.new || this;
 
       await this.database.update(args.id, db_data);
       this.setMonitor();
 
+      if (args.skip_read_serialize != true && args.skip_serialize != true) {
+        cover_obj.new = await this.do_serialize(
+          cover_obj.new,
+          "read",
+          {},
+          args,
+          await this.propsToBeRemoved(cover_obj.new)
+        );
+      }
+
       if (args.skip_hooks != true) {
         await this.run_hook(
           {
@@ -605,17 +635,8 @@ export default class SpiceModel {
           results
         );
       }
-      if (args.skip_read_serialize != true && args.skip_serialize != true) {
-        form = await this.do_serialize(
-          form,
-          "read",
-          {},
-          args,
-          await this.propsToBeRemoved(form)
-        );
-      }
       this.id = args.id;
-      return { ...form, id: args.id };
+      return { ...cover_obj.new, id: args.id };
     } catch (e) {
       console.log("Error on update", e, e.stack);
       throw e;
@@ -639,26 +660,37 @@ export default class SpiceModel {
       if (args && args.id) {
         id = args.id;
       }
-      await this.run_hook(workingForm, "create", "before");
-      workingForm = await this.do_serialize(workingForm, "write", {}, args);
+
+      if (args.skip_write_serialize != true && args.skip_serialize != true) {
+        workingForm = await this.do_serialize(workingForm, "write", {}, args);
+      }
+
+      if (args.skip_hooks != true) {
+        await this.run_hook(workingForm, "create", "before");
+      }
 
       let results = await this.database.insert(id, workingForm, args.expiry);
       this.setMonitor();
-      await this.run_hook(
-        {
-          ...results,
-          id,
-        },
-        "create",
-        "after"
-      );
-      results = await this.do_serialize(
-        results,
-        "read",
-        {},
-        args,
-        await this.propsToBeRemoved(results)
-      );
+
+      if (args.skip_read_serialize != true && args.skip_serialize != true) {
+        results = await this.do_serialize(
+          results,
+          "read",
+          {},
+          args,
+          await this.propsToBeRemoved(results)
+        );
+      }
+      if (args.skip_hooks != true) {
+        await this.run_hook(
+          {
+            ...results,
+            id,
+          },
+          "create",
+          "after"
+        );
+      }
       return { ...results, id };
     } catch (e) {
       console.log(e.stack);
@@ -674,7 +706,9 @@ export default class SpiceModel {
     }
     let results = await this.database.get(args.id);
     try {
-      await this.run_hook(args, "delete", "before");
+      if (args.skip_hooks != true) {
+        await this.run_hook(args, "delete", "before");
+      }
       let delete_response = {};
       if (args.hard) {
         delete_response = await this.database.delete(args.id);
@@ -684,7 +718,9 @@ export default class SpiceModel {
         results.deleted = true;
         delete_response = await this.database.update(args.id, "");
       }
-      await this.run_hook(results, "delete", "after", results);
+      if (args.skip_hooks != true) {
+        await this.run_hook(results, "delete", "after", results);
+      }
       return {};
     } catch (e) {
       console.log(e.stack);
@@ -732,6 +768,9 @@ export default class SpiceModel {
         }
       }
 
+      if (hasSQLInjection(query)) {
+        return [];
+      }
       if (args.limit) {
         args.limit = Number(args.limit);
       }
@@ -742,8 +781,9 @@ export default class SpiceModel {
       if (!args.sort) {
         args.sort = "created_at DESC";
       }
-
-      await this.run_hook(this, "list", "before");
+      if (args.skip_hooks != true) {
+        await this.run_hook(this, "list", "before");
+      }
       function removeSpaceAndSpecialCharacters(str) {
         return str.replace(/[^a-zA-Z0-9]/g, "");
       }
@@ -811,10 +851,18 @@ export default class SpiceModel {
               this.type
             ).get(key);
             results = cached_results?.value;
-            if (
-              cached_results?.value == undefined ||
-              (await this.shouldForceRefresh(cached_results))
-            ) {
+            let shouleForceRefresh = await this.shouldForceRefresh(
+              cached_results
+            );
+            console.log(
+              "Cache Results",
+              this.type,
+              cached_results?.value == undefined,
+              shouleForceRefresh,
+              cached_results?.value == undefined || shouleForceRefresh
+            );
+            if (cached_results?.value == undefined || shouleForceRefresh) {
+              console.log("Getting From Database With Cache", this.type);
               results = await this.database.search(
                 this.type,
                 args.columns || "",
@@ -849,14 +897,18 @@ export default class SpiceModel {
         }
       }
       try {
-        await this.run_hook(results.data, "list", "after");
-        results.data = await this.do_serialize(
-          results.data,
-          "read",
-          {},
-          args,
-          await this.propsToBeRemoved(results.data)
-        );
+        if (args.skip_read_serialize != true && args.skip_serialize != true) {
+          results.data = await this.do_serialize(
+            results.data,
+            "read",
+            {},
+            args,
+            await this.propsToBeRemoved(results.data)
+          );
+        }
+        if (args.skip_hooks != true) {
+          await this.run_hook(results.data, "list", "after");
+        }
       } catch (e) {
         console.log(e);
       }

package/src/utility/Security.js

@@ -0,0 +1,49 @@
+export function hasSQLInjection(input) {
+  // Convert input to lowercase for easier pattern matching
+  const lowerInput = input.toLowerCase();
+
+  // List of patterns that indicate potential SQL injection
+  const patterns = [
+    "--", // T-SQL comment
+    "/*", // Start of block comment
+    "*/", // End of block comment
+    "or 1=1", // OR statement that's always true
+    "or true", // OR statement that's always true (non-T-SQL databases)
+    "union all", // UNION statement (often used to retrieve data from another table)
+    "union select", // Another form of UNION statement
+    ";", // Commenting out the rest of a query
+    "drop table", // DDL statements are very suspicious
+    "update ", // Modification commands
+    "insert into", // Insertion commands
+    "delete from", // Deletion commands
+    "exec(", // Execution function in T-SQL
+    "execute(", // Another execution function in T-SQL
+    "xp_", // Extended stored procedures in T-SQL - often used in older SQL Server attacks
+    "0x", // Hex encoding
+    "benchmark(", // MySQL benchmark function - can be used for time-based blind attacks
+    "sleep(", // MySQL sleep function - can also be used for time-based blind attacks
+    "pg_sleep(", // PostgreSQL sleep function - time-based blind attack
+    "cast(", // Casting can be used for type-based attacks
+    "convert(", // Similar to the above
+    "waitfor delay", // SQL Server delay function - time-based blind attack
+  ];
+
+  for (let pattern of patterns) {
+    if (lowerInput.includes(pattern)) {
+      return true;
+    }
+  }
+
+  // Additional patterns based on regular expressions for more complex detections
+  const regexPatterns = [
+    /['"‘’“”][\s]*[+]+[\s]*['"‘’“”]/, // String concatenation, often used to obfuscate injections
+  ];
+
+  for (let regex of regexPatterns) {
+    if (regex.test(lowerInput)) {
+      return true;
+    }
+  }
+
+  return false;
+}