sql-string.js 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148
  1. "use strict";
  2. const moment = require("moment");
  3. const dataTypes = require("./data-types");
  4. const { logger } = require("./utils/logger");
  5. function arrayToList(array, timeZone, dialect, format2) {
  6. return array.reduce((sql, val, i) => {
  7. if (i !== 0) {
  8. sql += ", ";
  9. }
  10. if (Array.isArray(val)) {
  11. sql += `(${arrayToList(val, timeZone, dialect, format2)})`;
  12. } else {
  13. sql += escape(val, timeZone, dialect, format2);
  14. }
  15. return sql;
  16. }, "");
  17. }
  18. exports.arrayToList = arrayToList;
  19. function escape(val, timeZone, dialect, format2) {
  20. let prependN = false;
  21. if (val === void 0 || val === null) {
  22. return "NULL";
  23. }
  24. switch (typeof val) {
  25. case "boolean":
  26. if (["sqlite", "mssql", "oracle"].includes(dialect)) {
  27. return +!!val;
  28. }
  29. return (!!val).toString();
  30. case "number":
  31. case "bigint":
  32. return val.toString();
  33. case "string":
  34. prependN = dialect === "mssql";
  35. break;
  36. }
  37. if (val instanceof Date) {
  38. val = dataTypes[dialect].DATE.prototype.stringify(val, { timezone: timeZone });
  39. }
  40. if (Buffer.isBuffer(val)) {
  41. if (dataTypes[dialect].BLOB) {
  42. return dataTypes[dialect].BLOB.prototype.stringify(val);
  43. }
  44. return dataTypes.BLOB.prototype.stringify(val);
  45. }
  46. if (Array.isArray(val)) {
  47. const partialEscape = (escVal) => escape(escVal, timeZone, dialect, format2);
  48. if (dialect === "postgres" && !format2) {
  49. return dataTypes.ARRAY.prototype.stringify(val, { escape: partialEscape });
  50. }
  51. return arrayToList(val, timeZone, dialect, format2);
  52. }
  53. if (!val.replace) {
  54. throw new Error(`Invalid value ${logger.inspect(val)}`);
  55. }
  56. if (["postgres", "sqlite", "mssql", "snowflake", "db2"].includes(dialect)) {
  57. val = val.replace(/'/g, "''");
  58. if (dialect === "postgres") {
  59. val = val.replace(/\0/g, "\\0");
  60. }
  61. } else if (dialect === "oracle" && typeof val === "string") {
  62. if (val.startsWith("TO_TIMESTAMP_TZ") || val.startsWith("TO_DATE")) {
  63. const splitVal = val.split(/\(|\)/);
  64. if (splitVal.length !== 3 || splitVal[2] !== "") {
  65. throw new Error("Invalid SQL function call.");
  66. }
  67. const functionName = splitVal[0].trim();
  68. const insideParens = splitVal[1].trim();
  69. if (functionName !== "TO_TIMESTAMP_TZ" && functionName !== "TO_DATE") {
  70. throw new Error("Invalid SQL function call. Expected TO_TIMESTAMP_TZ or TO_DATE.");
  71. }
  72. const params = insideParens.split(",");
  73. if (params.length !== 2) {
  74. throw new Error("Unexpected input received.\nSequelize supports TO_TIMESTAMP_TZ or TO_DATE exclusively with a combination of value and format.");
  75. }
  76. const dateValue = params[0].trim().replace(/'/g, "");
  77. const formatValue = params[1].trim();
  78. if (functionName === "TO_TIMESTAMP_TZ") {
  79. const expectedFormat = "'YYYY-MM-DD HH24:MI:SS.FFTZH:TZM'";
  80. if (formatValue !== expectedFormat) {
  81. throw new Error(`Invalid format string for TO_TIMESTAMP_TZ. Expected format: ${expectedFormat}`);
  82. }
  83. const formattedDate = moment(dateValue).format("YYYY-MM-DD HH:mm:ss.SSS Z");
  84. if (formattedDate !== dateValue) {
  85. throw new Error("Invalid date value for TO_TIMESTAMP_TZ. Expected format: 'YYYY-MM-DD HH:mm:ss.SSS Z'");
  86. }
  87. } else if (functionName === "TO_DATE") {
  88. const expectedFormat = "'YYYY/MM/DD'";
  89. if (formatValue !== expectedFormat) {
  90. throw new Error(`Invalid format string for TO_DATE. Expected format: ${expectedFormat}`);
  91. }
  92. const formattedDate = moment(dateValue).format("YYYY-MM-DD");
  93. if (formattedDate !== dateValue) {
  94. throw new Error("Invalid date value for TO_DATE. Expected format: 'YYYY-MM-DD'");
  95. }
  96. }
  97. return val;
  98. }
  99. val = val.replace(/'/g, "''");
  100. } else {
  101. val = val.replace(/[\0\n\r\b\t\\'"\x1a]/g, (s) => {
  102. switch (s) {
  103. case "\0":
  104. return "\\0";
  105. case "\n":
  106. return "\\n";
  107. case "\r":
  108. return "\\r";
  109. case "\b":
  110. return "\\b";
  111. case " ":
  112. return "\\t";
  113. case "":
  114. return "\\Z";
  115. default:
  116. return `\\${s}`;
  117. }
  118. });
  119. }
  120. return `${(prependN ? "N'" : "'") + val}'`;
  121. }
  122. exports.escape = escape;
  123. function format(sql, values, timeZone, dialect) {
  124. values = [].concat(values);
  125. if (typeof sql !== "string") {
  126. throw new Error(`Invalid SQL string provided: ${sql}`);
  127. }
  128. return sql.replace(/\?/g, (match) => {
  129. if (!values.length) {
  130. return match;
  131. }
  132. return escape(values.shift(), timeZone, dialect, true);
  133. });
  134. }
  135. exports.format = format;
  136. function formatNamedParameters(sql, values, timeZone, dialect) {
  137. return sql.replace(/:+(?!\d)(\w+)/g, (value, key) => {
  138. if (dialect === "postgres" && value.slice(0, 2) === "::") {
  139. return value;
  140. }
  141. if (values[key] !== void 0) {
  142. return escape(values[key], timeZone, dialect, true);
  143. }
  144. throw new Error(`Named parameter "${value}" has no value in the given object.`);
  145. });
  146. }
  147. exports.formatNamedParameters = formatNamedParameters;
  148. //# sourceMappingURL=sql-string.js.map