@aikidosec/firewall/sinks/prisma/extractSQLFromObject.js

Zen by Aikido is an embedded Application Firewall that autonomously protects Node.js apps against common and critical attacks, provides rate limiting, detects malicious traffic (including bots), and more.

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.extractSQLFromObject = extractSQLFromObject;
const SQLDialectPostgres_1 = require("../../vulnerabilities/sql-injection/dialects/SQLDialectPostgres");
function isTaggedTemplate(value) {
    if (!value ||
        typeof value !== "object" ||
        !("strings" in value) ||
        !Array.isArray(value.strings) ||
        value.strings.length === 0) {
        return false;
    }
    if (!value.strings.every((s) => typeof s === "string")) {
        return false;
    }
    if (!("values" in value) || !Array.isArray(value.values)) {
        return false;
    }
    return true;
}
function extractSQLFromObject(obj, dialect) {
    if (Array.isArray(obj) &&
        obj.length > 0 &&
        typeof obj[0] === "string" &&
        obj[0].length > 0) {
        return obj[0];
    }
    if (isTaggedTemplate(obj)) {
        return extractSQLFromTaggedTemplate(obj, dialect);
    }
}
function extractSQLFromTaggedTemplate(template, dialect) {
    const { strings } = template;
    let sql = "";
    for (let i = 0; i < strings.length; i++) {
        sql += strings[i];
        if (i < template.values.length) {
            sql += getPlaceholderForDialect(dialect, i);
        }
    }
    return sql;
}
function getPlaceholderForDialect(dialect, index) {
    if (dialect.getHumanReadableName() ===
        SQLDialectPostgres_1.SQLDialectPostgres.prototype.getHumanReadableName()) {
        return `$${index + 1}`;
    }
    return "?";
}