sqlite-hub 0.9.3 → 0.9.6

package/server/services/storage/appStateStore.js

@@ -1,7 +1,12 @@
 const fs = require("node:fs");
 const path = require("node:path");
+const { pathToFileURL } = require("node:url");
 const Database = require("better-sqlite3");
 const { ConflictError, NotFoundError, ValidationError } = require("../../utils/errors");
+const {
+  resolvePathInsideDirectory,
+  resolveUserPath,
+} = require("../../utils/fileValidation");
 const {
   buildAutoTitle,
   buildSqlPreview,
@@ -33,6 +38,8 @@ const DEFAULT_STATE = {
 };
 
 const CONNECTION_LOGO_DIRECTORY = "db_logos";
+const LEGACY_STATE_FILENAME = "app-state.json";
+const STATE_DATABASE_FILENAME = "sqlite-hub-state.db";
 const MAX_CONNECTION_LOGO_SIZE_BYTES = 5 * 1024 * 1024;
 const CONNECTION_LOGO_EXTENSION_BY_MIME_TYPE = {
   "image/jpeg": "jpg",
@@ -107,17 +114,81 @@ function isChartCompatibleQuery(queryType, rawSql = "") {
   );
 }
 
+function normalizeStateStorePath(filePath, label) {
+  return resolveUserPath(filePath, { label });
+}
+
+function normalizeLegacyFilePath(filePath, { currentFilePath, expectedFileName, label }) {
+  if (!filePath) {
+    return null;
+  }
+
+  const resolvedPath = normalizeStateStorePath(filePath, label);
+
+  if (resolvedPath === currentFilePath || path.basename(resolvedPath) !== expectedFileName) {
+    return null;
+  }
+
+  return resolvedPath;
+}
+
+function normalizeLegacyDatabasePaths(legacyDatabasePaths, currentFilePath) {
+  if (!Array.isArray(legacyDatabasePaths)) {
+    return [];
+  }
+
+  const normalizedPaths = legacyDatabasePaths
+    .map((legacyPath) =>
+      normalizeLegacyFilePath(legacyPath, {
+        currentFilePath,
+        expectedFileName: STATE_DATABASE_FILENAME,
+        label: "Legacy app state database path",
+      })
+    )
+    .filter(Boolean);
+
+  return normalizedPaths.filter(
+    (legacyPath, index, legacyPaths) => legacyPaths.indexOf(legacyPath) === index
+  );
+}
+
+function readUtf8File(fileUrl) {
+  const fileHandle = fs.openSync(fileUrl, "r");
+
+  try {
+    const fileSize = fs.fstatSync(fileHandle).size;
+    const buffer = Buffer.alloc(fileSize);
+    fs.readSync(fileHandle, buffer, 0, buffer.length, 0);
+    return buffer.toString("utf8");
+  } finally {
+    fs.closeSync(fileHandle);
+  }
+}
+
 class AppStateStore {
   constructor(filePath, options = {}) {
-    this.filePath = filePath;
-    this.logoDirectory = path.join(path.dirname(this.filePath), CONNECTION_LOGO_DIRECTORY);
-    this.legacyFilePath = options.legacyFilePath ?? null;
-    this.legacyDatabasePaths = Array.isArray(options.legacyDatabasePaths)
-      ? options.legacyDatabasePaths
-      : [];
-    this.isFreshDatabase = !fs.existsSync(filePath);
-
-    fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
+    this.filePath = normalizeStateStorePath(filePath, "App state database path");
+    this.stateDirectory = path.dirname(this.filePath);
+    this.logoDirectory = resolvePathInsideDirectory(
+      this.stateDirectory,
+      CONNECTION_LOGO_DIRECTORY,
+      "Connection logo directory"
+    );
+    this.legacyFilePath = normalizeLegacyFilePath(options.legacyFilePath, {
+      currentFilePath: this.filePath,
+      expectedFileName: LEGACY_STATE_FILENAME,
+      label: "Legacy app state path",
+    });
+    this.legacyFileUrl = this.legacyFilePath
+      ? pathToFileURL(this.legacyFilePath)
+      : null;
+    this.legacyDatabasePaths = normalizeLegacyDatabasePaths(
+      options.legacyDatabasePaths,
+      this.filePath
+    );
+    this.isFreshDatabase = !fs.existsSync(this.filePath);
+
+    fs.mkdirSync(this.stateDirectory, { recursive: true });
     fs.mkdirSync(this.logoDirectory, { recursive: true });
 
     this.db = new Database(this.filePath);
@@ -313,7 +384,7 @@ class AppStateStore {
   }
 
   readLegacyState() {
-    const raw = fs.readFileSync(this.legacyFilePath, "utf8");
+    const raw = readUtf8File(this.legacyFileUrl);
     const parsed = JSON.parse(raw);
 
     return {
@@ -328,11 +399,9 @@ class AppStateStore {
 
   getExistingLegacyDatabasePaths() {
     return this.legacyDatabasePaths
-      .filter(Boolean)
-      .map((legacyPath) => path.resolve(legacyPath))
       .filter(
         (legacyPath, index, legacyPaths) =>
-          legacyPath !== path.resolve(this.filePath) &&
+          legacyPath !== this.filePath &&
           legacyPaths.indexOf(legacyPath) === index &&
           fs.existsSync(legacyPath)
       );
@@ -361,6 +430,9 @@ class AppStateStore {
               .map((column) => column.name)
           )
         : new Set();
+      const logoPathSelection = recentConnectionColumns.has("logoPath")
+        ? "logoPath"
+        : "NULL AS logoPath";
 
       return {
         settings: tables.has("settings")
@@ -373,19 +445,23 @@ class AppStateStore {
           : {},
         recentConnections: tables.has("recent_connections")
           ? legacyDb
-              .prepare(`
-                SELECT
-                  id,
-                  label,
-                  path,
-                  lastOpenedAt,
-                  lastModifiedAt,
-                  sizeBytes,
-                  readOnly,
-                  ${recentConnectionColumns.has("logoPath") ? "logoPath" : "NULL AS logoPath"}
-                FROM recent_connections
-                ORDER BY lastOpenedAt DESC, id ASC
-              `)
+              .prepare(
+                [
+                  "SELECT",
+                  [
+                    "id",
+                    "label",
+                    "path",
+                    "lastOpenedAt",
+                    "lastModifiedAt",
+                    "sizeBytes",
+                    "readOnly",
+                    logoPathSelection,
+                  ].join(", "),
+                  "FROM recent_connections",
+                  "ORDER BY lastOpenedAt DESC, id ASC",
+                ].join(" ")
+              )
               .all()
           : [],
         sqlHistory: tables.has("sql_history")
@@ -939,8 +1015,8 @@ class AppStateStore {
       onlyFavorites,
       latestStatus,
     });
-    const rows = this.db
-      .prepare(`
+    const queryHistoryRowsSql = [
+      `
         SELECT
           q.id,
           q.database_key,
@@ -963,20 +1039,24 @@ class AppStateStore {
           latest.status AS last_run_status,
           latest.error_message AS last_run_error_message,
           latest.affected_rows AS last_run_affected_rows
-        ${baseFromSql}
-        ${whereSql}
-        ${orderBySql}
-        LIMIT ?
-        OFFSET ?
-      `)
+      `,
+      baseFromSql,
+      whereSql,
+      orderBySql,
+      "LIMIT ?",
+      "OFFSET ?",
+    ].join("\n");
+    const rows = this.db
+      .prepare(queryHistoryRowsSql)
       .all(...params, normalizedLimit, normalizedOffset)
       .map((row) => this.decorateQueryHistoryRow(row));
+    const queryHistoryCountSql = [
+      "SELECT COUNT(*) AS count",
+      baseFromSql,
+      whereSql,
+    ].join("\n");
     const countRow = this.db
-      .prepare(`
-        SELECT COUNT(*) AS count
-        ${baseFromSql}
-        ${whereSql}
-      `)
+      .prepare(queryHistoryCountSql)
       .get(...params);
     const total = Number(countRow?.count ?? 0);
 
@@ -1263,7 +1343,14 @@ class AppStateStore {
       .filter((item) => item.chartsEligible);
   }
 
-  getQueryHistoryItemById(historyId) {
+  getQueryHistoryItemById(historyId, databaseKey) {
+    const normalizedDatabaseKey = this.normalizeQueryHistoryText(databaseKey);
+    const tenantId = normalizedDatabaseKey;
+
+    if (!tenantId) {
+      throw new ValidationError("Query history lookup requires a database key.");
+    }
+
     const row = this.db
       .prepare(`
         SELECT
@@ -1289,6 +1376,7 @@ class AppStateStore {
           latest.error_message AS last_run_error_message,
           latest.affected_rows AS last_run_affected_rows
         FROM query_history q
+        -- tenantId scope is enforced on q.database_key for direct id lookups.
         LEFT JOIN query_runs latest
           ON latest.id = (
             SELECT runs.id
@@ -1298,8 +1386,9 @@ class AppStateStore {
             LIMIT 1
           )
         WHERE q.id = ?
+          AND q.database_key = ?
       `)
-      .get(Number(historyId));
+      .get(Number(historyId), tenantId);
 
     if (!row) {
       throw new NotFoundError(`Query history item not found: ${historyId}`);
@@ -1357,14 +1446,7 @@ class AppStateStore {
   }
 
   getQueryHistoryItemForDatabase(historyId, databaseKey) {
-    const item = this.getQueryHistoryItemById(historyId);
-    const normalizedDatabaseKey = this.normalizeQueryHistoryText(databaseKey);
-
-    if (normalizedDatabaseKey && item.databaseKey !== normalizedDatabaseKey) {
-      throw new NotFoundError(`Query history item not found: ${historyId}`);
-    }
-
-    return item;
+    return this.getQueryHistoryItemById(historyId, databaseKey);
   }
 
   getChartQueryHistoryItemForDatabase(historyId, databaseKey) {
@@ -1377,8 +1459,9 @@ class AppStateStore {
     return item;
   }
 
-  getQueryRunsByHistoryId(historyId, limit = 8) {
+  getQueryRunsByHistoryId(historyId, limit = 8, databaseKey) {
     const normalizedLimit = Math.max(1, Math.min(50, Number(limit) || 8));
+    const item = this.getQueryHistoryItemById(historyId, databaseKey);
 
     return this.db
       .prepare(`
@@ -1396,7 +1479,7 @@ class AppStateStore {
         ORDER BY executed_at DESC, id DESC
         LIMIT ?
       `)
-      .all(Number(historyId), normalizedLimit)
+      .all(item.id, normalizedLimit)
       .map((row) => this.decorateQueryRun(row));
   }
 
@@ -1489,16 +1572,40 @@ class AppStateStore {
     };
   }
 
-  updateQueryHistoryField(historyId, fieldName, value) {
-    const result = this.db
-      .prepare(`UPDATE query_history SET ${fieldName} = ? WHERE id = ?`)
-      .run(value, Number(historyId));
+  updateQueryHistoryField(historyId, fieldName, value, databaseKey) {
+    const normalizedDatabaseKey = this.normalizeQueryHistoryText(databaseKey);
+
+    if (!normalizedDatabaseKey) {
+      throw new ValidationError("Query history update requires a database key.");
+    }
+
+    const statements = {
+      is_favorite: this.db.prepare(
+        "UPDATE query_history SET is_favorite = ? WHERE id = ? AND database_key = ?"
+      ),
+      is_saved: this.db.prepare(
+        "UPDATE query_history SET is_saved = ? WHERE id = ? AND database_key = ?"
+      ),
+      title: this.db.prepare(
+        "UPDATE query_history SET title = ? WHERE id = ? AND database_key = ?"
+      ),
+      notes: this.db.prepare(
+        "UPDATE query_history SET notes = ? WHERE id = ? AND database_key = ?"
+      ),
+    };
+    const statement = statements[fieldName];
+
+    if (!statement) {
+      throw new ValidationError(`Query history field cannot be updated: ${fieldName}`);
+    }
+
+    const result = statement.run(value, Number(historyId), normalizedDatabaseKey);
 
     if (!result.changes) {
       throw new NotFoundError(`Query history item not found: ${historyId}`);
     }
 
-    return this.getQueryHistoryItemById(historyId);
+    return this.getQueryHistoryItemById(historyId, normalizedDatabaseKey);
   }
 
   resolveUniqueQueryHistoryChartName(queryHistoryId, candidateName, { excludeChartId = null } = {}) {
@@ -1507,15 +1614,20 @@ class AppStateStore {
     let suffix = 2;
 
     while (true) {
+      const excludeChartClause = excludeChartId ? "AND id != ?" : "";
       const row = this.db
-        .prepare(`
-          SELECT id
-          FROM query_history_chart
-          WHERE query_history_id = ?
-            AND name = ?
-            ${excludeChartId ? "AND id != ?" : ""}
-          LIMIT 1
-        `)
+        .prepare(
+          [
+            "SELECT id",
+            "FROM query_history_chart",
+            "WHERE query_history_id = ?",
+            "AND name = ?",
+            excludeChartClause,
+            "LIMIT 1",
+          ]
+            .filter(Boolean)
+            .join(" ")
+        )
         .get(
           Number(queryHistoryId),
           nextName,
@@ -1653,34 +1765,42 @@ class AppStateStore {
     return true;
   }
 
-  toggleFavorite(historyId, nextValue) {
-    return this.updateQueryHistoryField(historyId, "is_favorite", nextValue ? 1 : 0);
+  toggleFavorite(historyId, nextValue, databaseKey) {
+    return this.updateQueryHistoryField(historyId, "is_favorite", nextValue ? 1 : 0, databaseKey);
   }
 
-  toggleSaved(historyId, nextValue) {
-    return this.updateQueryHistoryField(historyId, "is_saved", nextValue ? 1 : 0);
+  toggleSaved(historyId, nextValue, databaseKey) {
+    return this.updateQueryHistoryField(historyId, "is_saved", nextValue ? 1 : 0, databaseKey);
   }
 
-  renameQuery(historyId, title) {
+  renameQuery(historyId, title, databaseKey) {
     return this.updateQueryHistoryField(
       historyId,
       "title",
-      this.normalizeQueryHistoryText(title)
+      this.normalizeQueryHistoryText(title),
+      databaseKey
     );
   }
 
-  updateQueryNotes(historyId, notes) {
+  updateQueryNotes(historyId, notes, databaseKey) {
     return this.updateQueryHistoryField(
       historyId,
       "notes",
-      this.normalizeQueryHistoryText(notes)
+      this.normalizeQueryHistoryText(notes),
+      databaseKey
     );
   }
 
-  deleteQueryHistoryItem(historyId) {
+  deleteQueryHistoryItem(historyId, databaseKey) {
+    const normalizedDatabaseKey = this.normalizeQueryHistoryText(databaseKey);
+
+    if (!normalizedDatabaseKey) {
+      throw new ValidationError("Query history delete requires a database key.");
+    }
+
     const result = this.db
-      .prepare("DELETE FROM query_history WHERE id = ?")
-      .run(Number(historyId));
+      .prepare("DELETE FROM query_history WHERE id = ? AND database_key = ?")
+      .run(Number(historyId), normalizedDatabaseKey);
 
     if (!result.changes) {
       throw new NotFoundError(`Query history item not found: ${historyId}`);
@@ -1938,8 +2058,13 @@ class AppStateStore {
 
     const safeConnectionId = String(connectionId ?? "connection").replace(/[^a-zA-Z0-9_-]/g, "_");
     const storedFileName = `${safeConnectionId}-${Date.now()}.${extension}`;
+    const logoFilePath = resolvePathInsideDirectory(
+      this.logoDirectory,
+      storedFileName,
+      "Connection logo path"
+    );
 
-    fs.writeFileSync(path.join(this.logoDirectory, storedFileName), buffer);
+    fs.writeFileSync(logoFilePath, buffer);
 
     return storedFileName;
   }
@@ -1951,7 +2076,14 @@ class AppStateStore {
       return;
     }
 
-    fs.rmSync(path.join(this.logoDirectory, normalizedLogoPath), { force: true });
+    fs.rmSync(
+      resolvePathInsideDirectory(
+        this.logoDirectory,
+        normalizedLogoPath,
+        "Connection logo path"
+      ),
+      { force: true }
+    );
   }
 
   decorateConnection(connection = {}) {
@@ -1972,7 +2104,13 @@ class AppStateStore {
       return null;
     }
 
-    return path.basename(trimmedLogoPath);
+    const baseName = path.basename(trimmedLogoPath);
+
+    if (baseName !== trimmedLogoPath || baseName === "." || baseName === "..") {
+      return null;
+    }
+
+    return baseName;
   }
 
   setActiveConnectionId(id) {
@@ -2142,7 +2280,7 @@ class AppStateStore {
       ...MEDIA_TAGGING_CONFIG_FIELDS.map((field) => field.column),
     ];
     const assignments = MEDIA_TAGGING_CONFIG_FIELDS.map(
-      (field) => `${field.column} = excluded.${field.column}`
+      (field) => field.column + " = excluded." + field.column
     );
 
     if (this.mediaTaggingConfigHasLegacyJsonColumn) {
@@ -2155,15 +2293,17 @@ class AppStateStore {
     assignments.push("updated_at = excluded.updated_at");
     values.push(updatedAt);
 
+    const upsertSql = [
+      "INSERT INTO media_tagging_config",
+      "(" + explicitColumns.join(", ") + ")",
+      "VALUES",
+      "(" + explicitColumns.map(() => "?").join(", ") + ")",
+      "ON CONFLICT(database_key) DO UPDATE SET",
+      assignments.join(", "),
+    ].join(" ");
+
     this.db
-      .prepare(
-        `
-          INSERT INTO media_tagging_config (${explicitColumns.join(", ")})
-          VALUES (${explicitColumns.map(() => "?").join(", ")})
-          ON CONFLICT(database_key) DO UPDATE SET
-            ${assignments.join(",\n            ")}
-        `
-      )
+      .prepare(upsertSql)
       .run(...values);
 
     return this.getMediaTaggingConfig(normalizedDatabaseKey);

package/server/utils/appPaths.js

@@ -1,10 +1,24 @@
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
+const {
+  assertSafePathInput,
+  resolvePathInsideDirectory,
+} = require("./fileValidation");
 
 const APP_NAME = "sqlite-hub";
 const APP_STATE_DB_FILENAME = "sqlite-hub-state.db";
 const LEGACY_STATE_FILENAME = "app-state.json";
+const SAFE_HOMEBREW_SEGMENT_PATTERN = /^[a-zA-Z0-9._+-]+$/;
+
+function isSafeHomebrewSegment(segment) {
+  return (
+    typeof segment === "string" &&
+    SAFE_HOMEBREW_SEGMENT_PATTERN.test(segment) &&
+    segment !== "." &&
+    segment !== ".."
+  );
+}
 
 function resolvePackagedDataDirectories(packageRoot) {
   return [
@@ -51,7 +65,7 @@ function resolvePackagedLegacyStatePath(packageRoot) {
 }
 
 function resolveHomebrewCellarInfo(packageRoot) {
-  const resolvedPackageRoot = path.resolve(packageRoot);
+  const resolvedPackageRoot = path.resolve(assertSafePathInput(packageRoot, "Package root"));
   const { root } = path.parse(resolvedPackageRoot);
   const relativeSegments = resolvedPackageRoot
     .slice(root.length)
@@ -66,16 +80,44 @@ function resolveHomebrewCellarInfo(packageRoot) {
   const formulaName = relativeSegments[cellarIndex + 1];
   const currentVersion = relativeSegments[cellarIndex + 2];
 
-  if (formulaName !== APP_NAME || !currentVersion) {
+  if (
+    formulaName !== APP_NAME ||
+    !isSafeHomebrewSegment(currentVersion) ||
+    !isSafeHomebrewSegment(formulaName)
+  ) {
     return null;
   }
 
   return {
-    cellarRoot: path.join(root, ...relativeSegments.slice(0, cellarIndex + 2)),
+    cellarRoot: path.resolve(root, ...relativeSegments.slice(0, cellarIndex + 2)),
     currentVersion,
   };
 }
 
+function resolveLegacyStateDbPath(cellarRoot, versionName, dataSegments) {
+  const versionRoot = resolvePathInsideDirectory(
+    cellarRoot,
+    versionName,
+    "Homebrew version directory"
+  );
+  const packagedDataSegments = Array.isArray(dataSegments)
+    ? dataSegments
+    : [dataSegments];
+
+  return resolvePathInsideDirectory(
+    versionRoot,
+    path.join(
+      "libexec",
+      "lib",
+      "node_modules",
+      APP_NAME,
+      ...packagedDataSegments,
+      APP_STATE_DB_FILENAME
+    ),
+    "Legacy app state database path"
+  );
+}
+
 function safeStatMtimeMs(filePath) {
   try {
     return fs.statSync(filePath).mtimeMs;
@@ -93,29 +135,23 @@ function collectHomebrewLegacyStateDbPaths(packageRoot) {
 
   return fs
     .readdirSync(cellarInfo.cellarRoot, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory() && entry.name !== cellarInfo.currentVersion)
+    .filter(
+      (entry) =>
+        entry.isDirectory() &&
+        entry.name !== cellarInfo.currentVersion &&
+        isSafeHomebrewSegment(entry.name)
+    )
     .flatMap((entry) =>
       [
-        path.join(
+        resolveLegacyStateDbPath(
           cellarInfo.cellarRoot,
           entry.name,
-          "libexec",
-          "lib",
-          "node_modules",
-          APP_NAME,
-          "server",
-          "data",
-          APP_STATE_DB_FILENAME
+          ["server", "data"]
         ),
-        path.join(
+        resolveLegacyStateDbPath(
           cellarInfo.cellarRoot,
           entry.name,
-          "libexec",
-          "lib",
-          "node_modules",
-          APP_NAME,
-          "data",
-          APP_STATE_DB_FILENAME
+          ["data"]
         ),
       ].map((candidatePath) => ({
         path: candidatePath,