sql-love 1.1.2 → 1.1.5

package/README.md

@@ -1,13 +1,13 @@
-<img alt="SQL Love Logo" src="https://github.com/kensnyder/sql-love/raw/main/assets/sql-love-logo.png?v=1.1.2" width="250" height="208" />
+<img alt="SQL Love Logo" src="https://github.com/kensnyder/sql-love/raw/main/assets/sql-love-logo.png?v=1.1.5" width="250" height="208" />
 
 # sql-love
 
-[![Language](https://badgen.net/static/language/TS?v=1.1.2)](https://github.com/search?q=repo:kensnyder/sql-love++language:TypeScript&type=code)
-[![Code Coverage](https://codecov.io/gh/kensnyder/sql-love/branch/main/graph/badge.svg?v=1.1.2)](https://codecov.io/gh/kensnyder/sql-love)
+[![Language](https://badgen.net/static/language/TS?v=1.1.5)](https://github.com/search?q=repo:kensnyder/sql-love++language:TypeScript&type=code)
+[![Code Coverage](https://codecov.io/gh/kensnyder/sql-love/branch/main/graph/badge.svg?v=1.1.5)](https://codecov.io/gh/kensnyder/sql-love)
 ![Dependencies](https://badgen.net/static/dependencies/0/green)
 ![Tree shakeable](https://badgen.net/static/tree%20shakeable/Yes/green)
 ![Gzip Size](https://badgen.net/static/gzip%20size/9kb/blue)
-[![ISC License](https://badgen.net/static/license/ISC/green?v=1.1.2)](https://opensource.org/licenses/ISC)
+[![ISC License](https://badgen.net/static/license/ISC/green?v=1.1.5)](https://opensource.org/licenses/ISC)
 
 Classes for parsing and building SQL select queries in Node/Bun/Deno.
 
@@ -189,7 +189,7 @@ Use the following methods to build queries. And see
 - `query.having(columnValueRecord)` - Add multiple conditions
 - `query.orHaving(expressions)` - Multiple `having()`s joined by OR
 - `query.orderBy(column, direction)` - Add ORDER BY clause
-- `query.sortField(column, mapNames, modifier)` - Add ORDER BY clause with mapNames
+- `query.sortField(field, mapNames, modifier)` - Add ORDER BY clause for an allowed field in mapNames
 - `query.limit(num)` - Limit by the given number
 - `query.offset(num)` - Specify an offset
 - `query.page(num)` - Automatically calculate offset based on limit and page
@@ -316,8 +316,11 @@ query.orderBy('modified_at DESC NULLS LAST'); // ORDER BY modified_at DESC NULLS
 query.orderBy('modified_at USING >'); // ORDER BY modified_at USING >
 
 // Sorting with support for hyphens and mapping
-query.sortField('-modified_at'); // ORDER BY modified_at DESC
+// Only fields present in mapNames are allowed, so field names may safely
+// come from user input (e.g. a "?sort=-created" query string param).
+// Unknown fields emit a console.warn and add no ORDER BY clause.
 query.sortField('-created', { created: 'created_at' }); // ORDER BY created_at DESC
+query.sortField('-foo', { created: 'created_at' }); // console.warn; no ORDER BY added
 query.sortField(
   '-created_at',
   {

package/dist/index.cjs

@@ -406,9 +406,10 @@ var SelectBuilder = class _SelectBuilder {
    */
   constructor(sql, bindings = {}) {
     if (sql) {
-      if (bindings) {
-        const keys = Object.keys(bindings);
-        const regexp = new RegExp(`:(${keys.join("|")})`, "g");
+      const keys = bindings ? Object.keys(bindings) : [];
+      if (keys.length > 0) {
+        const names = keys.sort((a, b) => b.length - a.length).map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+        const regexp = new RegExp(`(?<!:):(${names})\\b`, "g");
         sql = sql.replace(regexp, ($0, $1) => {
           this._bindings.push(bindings[$1]);
           return `__BOUND_${this._bindings.length - 1}__`;
@@ -859,7 +860,7 @@ UNION
     if (numArgs === 1) {
       collection.push(column);
       return this;
-    } else if (numArgs === 2 && Array.isArray(operator) && operator.length > 0 && substrCount(column, "?") === operator.length) {
+    } else if (numArgs === 2 && Array.isArray(operator) && substrCount(column, "?") === operator.length) {
       const values = operator;
       const sql = column.replace(/\?/g, () => {
         this._bindings.push(values.shift());
@@ -1035,13 +1036,16 @@ UNION
     return this;
   }
   /**
-   * Sort by the given column, with a map of columns to translate
-   * @param fieldName  The file name such as 'created_at' or '-created_at' for descending
-   * @param [mapNames]  Column names to translate from field to column expression
+   * Sort by the given field, with a map of allowed fields to column expressions.
+   * Only field names present in mapNames are allowed; anything else emits a
+   * console.warn and adds no ORDER BY clause. This prevents SQL injection when
+   * fieldName comes from user input.
+   * @param fieldName  The field name such as 'created' or '-created' for descending
+   * @param mapNames  Allowed field names mapped to column expressions
    * @param [modifier]  Additional clause to append such as 'NULLS LAST' or 'COLLATE "en_US"'
    * @example
-   *   query.sortField('-modified_at'); // ORDER BY modified_at DESC
    *   query.sortField('-created', {'created': 'created_at'}); // ORDER BY created_at DESC
+   *   query.sortField('-foo', {'created': 'created_at'}); // console.warn; no ORDER BY added
    *   query.sortField('-created', {
    *     'created': 'created_at NULLS LAST',
    *     '-created': 'created_at DESC NULLS LAST'
@@ -1064,7 +1068,13 @@ UNION
       direction = "DESC";
       fieldName = fieldName.slice(1);
     }
-    const column = mapNames[fieldName] || fieldName;
+    if (!Object.prototype.hasOwnProperty.call(mapNames, fieldName)) {
+      console.warn(
+        `SelectBuilder: sortField() ignoring unknown field "${fieldName.slice(0, 100)}"`
+      );
+      return this;
+    }
+    const column = mapNames[fieldName];
     if (modifier) {
       direction += ` ${modifier}`;
     }

package/dist/index.d.ts

@@ -359,13 +359,16 @@ export declare class SelectBuilder {
 	 */
 	orderBy(column: string, direction?: "ASC" | "DESC"): this;
 	/**
-	 * Sort by the given column, with a map of columns to translate
-	 * @param fieldName  The file name such as 'created_at' or '-created_at' for descending
-	 * @param [mapNames]  Column names to translate from field to column expression
+	 * Sort by the given field, with a map of allowed fields to column expressions.
+	 * Only field names present in mapNames are allowed; anything else emits a
+	 * console.warn and adds no ORDER BY clause. This prevents SQL injection when
+	 * fieldName comes from user input.
+	 * @param fieldName  The field name such as 'created' or '-created' for descending
+	 * @param mapNames  Allowed field names mapped to column expressions
 	 * @param [modifier]  Additional clause to append such as 'NULLS LAST' or 'COLLATE "en_US"'
 	 * @example
-	 *   query.sortField('-modified_at'); // ORDER BY modified_at DESC
 	 *   query.sortField('-created', {'created': 'created_at'}); // ORDER BY created_at DESC
+	 *   query.sortField('-foo', {'created': 'created_at'}); // console.warn; no ORDER BY added
 	 *   query.sortField('-created', {
 	 *     'created': 'created_at NULLS LAST',
 	 *     '-created': 'created_at DESC NULLS LAST'

package/dist/index.mjs

@@ -366,9 +366,10 @@ var SelectBuilder = class _SelectBuilder {
    */
   constructor(sql, bindings = {}) {
     if (sql) {
-      if (bindings) {
-        const keys = Object.keys(bindings);
-        const regexp = new RegExp(`:(${keys.join("|")})`, "g");
+      const keys = bindings ? Object.keys(bindings) : [];
+      if (keys.length > 0) {
+        const names = keys.sort((a, b) => b.length - a.length).map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+        const regexp = new RegExp(`(?<!:):(${names})\\b`, "g");
         sql = sql.replace(regexp, ($0, $1) => {
           this._bindings.push(bindings[$1]);
           return `__BOUND_${this._bindings.length - 1}__`;
@@ -819,7 +820,7 @@ UNION
     if (numArgs === 1) {
       collection.push(column);
       return this;
-    } else if (numArgs === 2 && Array.isArray(operator) && operator.length > 0 && substrCount(column, "?") === operator.length) {
+    } else if (numArgs === 2 && Array.isArray(operator) && substrCount(column, "?") === operator.length) {
       const values = operator;
       const sql = column.replace(/\?/g, () => {
         this._bindings.push(values.shift());
@@ -995,13 +996,16 @@ UNION
     return this;
   }
   /**
-   * Sort by the given column, with a map of columns to translate
-   * @param fieldName  The file name such as 'created_at' or '-created_at' for descending
-   * @param [mapNames]  Column names to translate from field to column expression
+   * Sort by the given field, with a map of allowed fields to column expressions.
+   * Only field names present in mapNames are allowed; anything else emits a
+   * console.warn and adds no ORDER BY clause. This prevents SQL injection when
+   * fieldName comes from user input.
+   * @param fieldName  The field name such as 'created' or '-created' for descending
+   * @param mapNames  Allowed field names mapped to column expressions
    * @param [modifier]  Additional clause to append such as 'NULLS LAST' or 'COLLATE "en_US"'
    * @example
-   *   query.sortField('-modified_at'); // ORDER BY modified_at DESC
    *   query.sortField('-created', {'created': 'created_at'}); // ORDER BY created_at DESC
+   *   query.sortField('-foo', {'created': 'created_at'}); // console.warn; no ORDER BY added
    *   query.sortField('-created', {
    *     'created': 'created_at NULLS LAST',
    *     '-created': 'created_at DESC NULLS LAST'
@@ -1024,7 +1028,13 @@ UNION
       direction = "DESC";
       fieldName = fieldName.slice(1);
     }
-    const column = mapNames[fieldName] || fieldName;
+    if (!Object.prototype.hasOwnProperty.call(mapNames, fieldName)) {
+      console.warn(
+        `SelectBuilder: sortField() ignoring unknown field "${fieldName.slice(0, 100)}"`
+      );
+      return this;
+    }
+    const column = mapNames[fieldName];
     if (modifier) {
       direction += ` ${modifier}`;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sql-love",
-  "version": "1.1.2",
+  "version": "1.1.5",
   "description": "Build SQL queries with JavaScript",
   "type": "module",
   "engines": {
@@ -55,7 +55,7 @@
     "@types/bun": "latest",
     "@types/node": "latest",
     "dts-bundle-generator": "9.5.1",
-    "prettier": "3.9.6",
+    "prettier": "3.9.9",
     "prettier-plugin-organize-imports": "4.3.0",
     "typescript": "5.9.3"
   }