sqlite-hub 0.9.3 → 0.9.4

package/server/utils/fileValidation.js

@@ -6,25 +6,108 @@ const { ConflictError, NotFoundError, ValidationError } = require("./errors");
 const SQLITE_EXTENSIONS = new Set([".db", ".sqlite", ".sqlite3"]);
 const SQL_DUMP_EXTENSIONS = new Set([".sql"]);
 const SQLITE_HEADER = Buffer.from("SQLite format 3\0", "utf8");
+const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f]/;
 
-function expandHome(filePath) {
+function splitPathSegments(filePath) {
+  return String(filePath)
+    .split(/[\\/]+/)
+    .filter((segment) => segment && segment !== ".");
+}
+
+function hasParentTraversal(filePath) {
+  return splitPathSegments(filePath).includes("..");
+}
+
+function isAbsolutePathInput(filePath) {
+  return path.isAbsolute(filePath) || path.win32.isAbsolute(filePath);
+}
+
+function toAbsolutePath(filePath, baseDirectory = process.cwd()) {
+  const normalizedPath = String(filePath);
+
+  if (isAbsolutePathInput(normalizedPath)) {
+    return path.normalize(normalizedPath);
+  }
+
+  return path.normalize(`${baseDirectory}${path.sep}${normalizedPath}`);
+}
+
+function assertSafePathInput(filePath, label = "File path") {
   if (typeof filePath !== "string" || !filePath.trim()) {
-    throw new ValidationError("A file path is required.");
+    throw new ValidationError(`${label} is required.`);
+  }
+
+  if (CONTROL_CHARACTER_PATTERN.test(filePath)) {
+    throw new ValidationError(`${label} contains unsupported control characters.`);
+  }
+
+  if (hasParentTraversal(filePath)) {
+    throw new ValidationError(`${label} must not contain parent directory segments.`);
   }
 
-  if (filePath === "~") {
+  return filePath.trim();
+}
+
+function expandHome(filePath, label = "File path") {
+  const normalizedPath = assertSafePathInput(filePath, label);
+
+  if (normalizedPath === "~") {
     return os.homedir();
   }
 
-  if (filePath.startsWith("~/")) {
-    return path.join(os.homedir(), filePath.slice(2));
+  if (normalizedPath.startsWith("~/")) {
+    return toAbsolutePath(normalizedPath.slice(2), os.homedir());
   }
 
-  return filePath;
+  return normalizedPath;
+}
+
+function resolveBaseDirectory(baseDirectory, label = "Base directory") {
+  return toAbsolutePath(assertSafePathInput(baseDirectory, label));
+}
+
+function isInsideDirectory(filePath, baseDirectory) {
+  const relativePath = path.relative(baseDirectory, filePath);
+  return (
+    relativePath === "" ||
+    (!relativePath.startsWith("..") && !path.isAbsolute(relativePath))
+  );
+}
+
+function assertPathInsideDirectory(filePath, baseDirectory, label = "File path") {
+  const resolvedBaseDirectory = resolveBaseDirectory(baseDirectory);
+  const resolvedPath = toAbsolutePath(filePath);
+
+  if (!isInsideDirectory(resolvedPath, resolvedBaseDirectory)) {
+    throw new ValidationError(`${label} must stay inside ${resolvedBaseDirectory}.`);
+  }
+
+  return resolvedPath;
+}
+
+function resolveUserPath(filePath, options = {}) {
+  const label = options.label ?? "File path";
+  const expandedPath = expandHome(filePath, label);
+  const baseDirectory = options.baseDirectory
+    ? resolveBaseDirectory(options.baseDirectory)
+    : null;
+  const resolvedPath =
+    baseDirectory && !isAbsolutePathInput(expandedPath)
+      ? toAbsolutePath(expandedPath, baseDirectory)
+      : toAbsolutePath(expandedPath);
+
+  if (baseDirectory) {
+    return assertPathInsideDirectory(resolvedPath, baseDirectory, label);
+  }
+
+  return resolvedPath;
 }
 
-function resolveUserPath(filePath) {
-  return path.resolve(expandHome(filePath));
+function resolvePathInsideDirectory(baseDirectory, inputPath, label = "File path") {
+  return resolveUserPath(inputPath, {
+    baseDirectory,
+    label,
+  });
 }
 
 function assertExtension(filePath, allowedExtensions, label) {
@@ -124,11 +207,14 @@ function getFileMetadata(filePath) {
 
 module.exports = {
   SQLITE_EXTENSIONS,
+  assertPathInsideDirectory,
+  assertSafePathInput,
   ensureFileDoesNotExist,
   ensureParentDirectory,
   getFileMetadata,
   isRealSqliteDatabase,
   isWritable,
+  resolvePathInsideDirectory,
   resolveUserPath,
   validateSqlDumpPath,
   validateSqlitePath,

package/tailwind.config.cjs

@@ -0,0 +1,73 @@
+const forms = require("@tailwindcss/forms");
+const containerQueries = require("@tailwindcss/container-queries");
+
+module.exports = {
+  darkMode: "class",
+  content: ["./frontend/index.html", "./frontend/js/**/*.js"],
+  theme: {
+    extend: {
+      colors: {
+        "on-secondary-fixed": "#1c1b1b",
+        background: "rgb(var(--rgb-background) / <alpha-value>)",
+        "inverse-primary": "#6a5f00",
+        "primary-fixed": "#fde403",
+        tertiary: "#fbfffe",
+        outline: "#979177",
+        "on-secondary": "#313030",
+        "error-container": "#93000a",
+        "on-primary-fixed-variant": "#504700",
+        "on-tertiary-container": "#006f72",
+        "on-tertiary-fixed-variant": "#004f51",
+        "secondary-fixed-dim": "#c8c6c5",
+        "tertiary-fixed-dim": "#00dce1",
+        "on-background": "rgb(var(--rgb-on-surface) / <alpha-value>)",
+        "surface-tint": "#dec800",
+        "primary-fixed-dim": "#dec800",
+        "on-surface": "rgb(var(--rgb-on-surface) / <alpha-value>)",
+        "surface-container-low": "rgb(var(--rgb-surface-low) / <alpha-value>)",
+        "on-tertiary": "#003738",
+        "surface-container": "rgb(var(--rgb-surface-container) / <alpha-value>)",
+        "on-surface-variant": "rgb(var(--rgb-on-surface-variant) / <alpha-value>)",
+        "on-primary-container": "#706400",
+        "on-error": "#690005",
+        "surface-container-high": "rgb(var(--rgb-surface-high) / <alpha-value>)",
+        "surface-container-highest": "rgb(var(--rgb-surface-highest) / <alpha-value>)",
+        error: "rgb(var(--rgb-error) / <alpha-value>)",
+        primary: "#fffeff",
+        "outline-variant": "rgb(var(--rgb-outline) / <alpha-value>)",
+        "on-error-container": "#ffdad6",
+        "on-secondary-fixed-variant": "#474746",
+        "surface-container-lowest": "rgb(var(--rgb-surface-lowest) / <alpha-value>)",
+        "inverse-surface": "#e5e2e1",
+        surface: "rgb(var(--rgb-surface) / <alpha-value>)",
+        "tertiary-container": "#04faff",
+        "on-tertiary-fixed": "#002021",
+        "tertiary-fixed": "#2dfaff",
+        "surface-variant": "#353534",
+        "on-primary": "#373100",
+        "primary-container": "rgb(var(--rgb-primary) / <alpha-value>)",
+        "inverse-on-surface": "#313030",
+        secondary: "#c8c6c5",
+        "on-secondary-container": "#b7b5b4",
+        "on-primary-fixed": "#201c00",
+        "secondary-container": "#474746",
+        "surface-dim": "rgb(var(--rgb-surface) / <alpha-value>)",
+        "surface-bright": "rgb(var(--rgb-surface-bright) / <alpha-value>)",
+        "secondary-fixed": "#e5e2e1",
+      },
+      fontFamily: {
+        headline: "var(--font-family-headline)",
+        body: "var(--font-family-body)",
+        label: "var(--font-family-body)",
+        mono: "var(--font-family-mono)",
+      },
+      borderRadius: {
+        DEFAULT: "0px",
+        lg: "0px",
+        xl: "0px",
+        full: "9999px",
+      },
+    },
+  },
+  plugins: [forms, containerQueries],
+};

package/tests/security-paths.test.js

@@ -0,0 +1,84 @@
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { pathToFileURL } = require("node:url");
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const { ValidationError } = require("../server/utils/errors");
+const {
+  resolvePathInsideDirectory,
+  resolveUserPath,
+} = require("../server/utils/fileValidation");
+const { MediaTaggingService } = require("../server/services/sqlite/mediaTaggingService");
+
+function createTempDirectory(t) {
+  const directoryPath = fs.mkdtempSync(path.join(os.tmpdir(), "sqlite-hub-security-"));
+  t.after(() => fs.rmSync(directoryPath, { recursive: true, force: true }));
+  return directoryPath;
+}
+
+test("resolveUserPath rejects parent traversal segments", () => {
+  assert.throws(() => resolveUserPath("../outside.db"), ValidationError);
+  assert.throws(() => resolveUserPath("~/../outside.db"), ValidationError);
+  assert.throws(() => resolveUserPath("data/\0outside.db"), ValidationError);
+});
+
+test("resolvePathInsideDirectory resolves only paths under the supplied root", (t) => {
+  const root = createTempDirectory(t);
+  const insidePath = path.join(root, "media", "photo.jpg");
+
+  assert.equal(
+    resolvePathInsideDirectory(root, "media/photo.jpg", "Media file path"),
+    insidePath
+  );
+  assert.equal(
+    resolvePathInsideDirectory(root, insidePath, "Media file path"),
+    insidePath
+  );
+  assert.throws(
+    () =>
+      resolvePathInsideDirectory(
+        root,
+        path.join(path.dirname(root), "secret.txt"),
+        "Media file path"
+      ),
+    ValidationError
+  );
+  assert.throws(
+    () => resolvePathInsideDirectory(root, "../secret.txt", "Media file path"),
+    ValidationError
+  );
+});
+
+test("media file resolution is scoped to the active database directory", (t) => {
+  const root = createTempDirectory(t);
+  const mediaDirectory = path.join(root, "media");
+  const mediaPath = path.join(mediaDirectory, "photo.jpg");
+
+  fs.mkdirSync(mediaDirectory, { recursive: true });
+  fs.writeFileSync(mediaPath, "image");
+
+  const service = new MediaTaggingService({
+    connectionManager: {
+      getActiveConnection: () => ({
+        path: path.join(root, "database.sqlite"),
+      }),
+    },
+    appStateStore: {},
+  });
+
+  assert.equal(service.resolveMediaFilePath("media/photo.jpg"), mediaPath);
+  assert.equal(
+    service.resolveMediaFilePath(pathToFileURL(mediaPath).toString()),
+    mediaPath
+  );
+  assert.deepEqual(service.getMediaFileForRequest("media/photo.jpg"), {
+    directory: mediaDirectory,
+    fileName: "photo.jpg",
+  });
+  assert.throws(() => service.resolveMediaFilePath("../secret.jpg"), ValidationError);
+  assert.throws(
+    () => service.resolveMediaFilePath(path.join(path.dirname(root), "secret.jpg")),
+    ValidationError
+  );
+});

package/tests/sql-identifier-safety.test.js

@@ -0,0 +1,66 @@
+const Database = require("better-sqlite3");
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const { DataBrowserService } = require("../server/services/sqlite/dataBrowserService");
+const { quoteIdentifier } = require("../server/utils/identifier");
+
+test("data browser mutations preserve quoted dynamic identifiers", () => {
+  const db = new Database(":memory:");
+  const tableName = 'items" archived';
+  const valueColumn = 'display"name';
+
+  try {
+    db.exec(
+      [
+        "CREATE TABLE",
+        quoteIdentifier(tableName),
+        "(",
+        quoteIdentifier(valueColumn),
+        "TEXT, status INTEGER",
+        ")",
+      ].join(" ")
+    );
+    db.prepare(
+      [
+        "INSERT INTO",
+        quoteIdentifier(tableName),
+        "(" + quoteIdentifier(valueColumn) + ", status)",
+        "VALUES (?, ?)",
+      ].join(" ")
+    ).run("before", 0);
+
+    const service = new DataBrowserService({
+      connectionManager: {
+        assertWritable() {},
+        getActiveDatabase: () => db,
+      },
+    });
+    const tableData = service.getTableData(tableName, { limit: 10, offset: 0 });
+    const identity = tableData.rows[0].__identity;
+
+    const updated = service.updateTableRow(tableName, {
+      identity,
+      values: {
+        [valueColumn]: "after",
+      },
+    });
+
+    assert.equal(updated.row[valueColumn], "after");
+    assert.equal(
+      db.prepare(["SELECT", quoteIdentifier(valueColumn), "FROM", quoteIdentifier(tableName)].join(" ")).get()[valueColumn],
+      "after"
+    );
+
+    const deleted = service.deleteTableRow(tableName, {
+      identity: updated.row.__identity,
+    });
+
+    assert.equal(deleted.affectedRowCount, 1);
+    assert.equal(
+      db.prepare(["SELECT COUNT(*) AS count FROM", quoteIdentifier(tableName)].join(" ")).get().count,
+      0
+    );
+  } finally {
+    db.close();
+  }
+});

package/.npmingnore

@@ -1,4 +0,0 @@
-publish_brew.sh
-pbulish_npm.sh
-changelog.md
-gitignore.md

package/changelog.md

@@ -1,84 +0,0 @@
-# v0.9.3
-
-- improving rerendering
-- fixed the sorting bug in charts
-- data row size is stored in localstorage
-- saved charts
-
-# v0.9.1
-
-- Improvements in tagging queue
-- rotate right, rotate left
-
-# v0.9.0
-
-- tagging view
-- filtered out the create, update, delete queries from the chart section
-
-# v0.8.8
-
-- modal window fix in delete query
-- csv export filename based on query name
-- unsaved query history tab
-
-# v0.8.7
-
-- UX fixes
-- fixing a lot of the vibe slop
-- trying to build reuseable components
-
-# v0.8.0
-
-- DDL copy button
-- open in charts button in query details
-- clear makes editor active
-- UI fixes
-- Overview improvement
-
-# v0.7.0
-
-- hide query history, hide editor
-- better cli interface
-- plotting and graphs
-- removing inconsistencies in the UI
-
-# v0.6.0
-
-- table designer, create tables in sqlit_hub
-
-# v0.5.1
-
-- bug fix in sql editor
-
-# v0.5.0
-
-- sql query history
-- open in finder in overview
-- sort columns in data & sql_editor
-- json view in row editor
-
-# v0.4.0
-
-- search in data
-- shift + enter
-- logos for databases
-- clean up some chaotic code things :)
-
-# v0.3.2
-
-- delete rows
-- modal windows for rows
-
-# v0.3.1
-
-- visualize tables
-- export csv from data and sql_editor
-- Backup mode
-
-# v0.2.0
-
-- db fix
-
-# v0.1.3
-
-- edit in sql editor

package/docs/DESIGN_GUIDELINES.md

@@ -1,36 +0,0 @@
-# SQLite Hub UI Rules for Codex
-
-Follow these rules exactly when creating or modifying UI controls.
-
-1. Reuse existing shared components before creating anything new.
-2. Use exactly one semantic main class per control.
-3. Never combine multiple button-style classes on the same element.
-4. View-specific classes may change layout, width, spacing, or position only.
-5. View-specific classes must not redefine the base style of shared components.
-6. The standard height for interactive controls is `36px`.
-7. The source of truth for control height is `--control-height` in `frontend/styles/tokens.css`.
-8. Controls in the same row must have the same height.
-9. All regular buttons must use one of these classes only: `standard-button`, `signature-button`, `delete-button`.
-10. Use `standard-button` for normal actions.
-11. Use `signature-button` only for the primary yellow CTA in a context.
-12. Use `delete-button` only for destructive actions.
-13. `signature-button` must keep its hover state and chamfered corner.
-14. All visible clickable buttons must have a hover state.
-15. Disabled states must come from the shared component, not from local view CSS.
-16. All reusable checkboxes must use `standard-checkbox`.
-17. Do not build feature-specific checkbox shells or checkbox base styles.
-18. Inputs and selects must follow the shared base rules in `frontend/styles/base.css`.
-19. Ghost or transparent inputs must not use a white background, including unfocused state.
-20. When a new control pattern appears in multiple places, promote it to a shared component first, then migrate existing usages.
-
-## Source of Truth
-
-- `frontend/styles/tokens.css`
-- `frontend/styles/base.css`
-- `frontend/index.html`
-
-## Default Decision Rules
-
-- Prefer reuse over invention.
-- Prefer migration over local override.
-- Prefer shared component updates over per-view fixes.