@sap/hdbext/lib/sql-injection-utils.js

Hana-client extension library and utility functions for using SAP HANA in node.js

'use strict';

var whitespaceTable = {'\t': true, // HORIZONTAL TABULATION
  '\n': true, // NEW LINE
  '\v': true, // VERTICAL TABULATION
  '\f': true, // FORM FEED
  '\r': true, // CARRIAGE RETURN
  ' ': true, // SPACE
  '\u0085': true, // NEL
  '\u00A0': true, // NO-BREAK SPACE
  '\u1680': true, // OGHAM SPACE MARK
  '\u2000': true, // EN QUAD
  '\u2001': true, // EM QUAD
  '\u2002': true, // EN SPACE
  '\u2003': true, // EM SPACE
  '\u2004': true, // THREE-PER-EM SPACE
  '\u2005': true, // FOUR-PER-EM SPACE
  '\u2006': true, // SIX-PER-EM SPACE
  '\u2007': true, // FIGURE SPACE
  '\u2008': true, // PUNCTUATION SPACE
  '\u2009': true, // THIN SPACE
  '\u200A': true, // HAIR SPACE
  '\u2028': true, // LINE SEPARATOR
  '\u2029': true, // PARAGRAPH SEPARATOR
  '\u202F': true, // NARROW NO-BREAK SPACE
  '\u205F': true, // MEDIUM METHEMATICAL SPACE
  '\u3000': true // IDEOGRAPHIC SPACE
};

var separatorTable = {
  ',': true,
  '(': true,
  ')': true,
  '[': true,
  ']': true,
  '.': true,
  ';': true,
  ':': true,
  '+': true,
  '-': true,
  '*': true,
  '/': true,
  '%': true,
  '^': true,
  '<': true,
  '>': true,
  '=': true
};

function isValidNonEmptyString(str) {
  return !!(str && typeof str === 'string');
}

function isSeparator(character) {
  return !!separatorTable[character];
}

function isWhitespaceCharacter(character) {
  return !!whitespaceTable[character];
}

/**
 * @param value string
 * @return boolean
 */
module.exports.isAcceptableQuotedParameter = function (value) {
  return isValidNonEmptyString(value) && (value.search(/([^"]|^)"([^"]|$)/) === -1);
};

/**
 * @param value string
 * @param maxToken
 * @return boolean
 */
module.exports.isAcceptableParameter = function (value, maxToken) {
  if (!isValidNonEmptyString(value)) {
    return false;
  }
  if (!maxToken || typeof maxToken !== 'number') {
    maxToken = 1;
  }
  var outside = true; // outside of quotes
  var lastCharWasWhitespace = true;
  var lastCharWasSeparator = false;
  var currentChar;
  var charAfterCurrent;
  var token = 0;
  for (var i = 0; i < value.length; ++i) {
    currentChar = value.charAt(i);
    charAfterCurrent = value.charAt(i + 1);
    if (currentChar === '"') {
      if (!outside && charAfterCurrent === '"') {
        ++i;
        continue;
      }
      if (outside && !lastCharWasSeparator) { // opening "
        ++token;
      }
      outside = !outside;
    } else {
      if (!outside) {
        continue;
      }
      // outside "
      if (currentChar === '-' && charAfterCurrent === '-') {
        return false; // found comment
      }
      if (currentChar === '/' && charAfterCurrent === '*') {
        return false; // found comment
      }
      if (isSeparator(currentChar)) {
        if (token === 0) {
          token += 2;
        } else {
          ++token;
        }
        lastCharWasSeparator = true;
        lastCharWasWhitespace = false;
      } else if (isWhitespaceCharacter(currentChar)) {
        lastCharWasWhitespace = true;
      } else {
        if (lastCharWasWhitespace && !lastCharWasSeparator) {
          ++token;
        }
        lastCharWasSeparator = false;
        lastCharWasWhitespace = false;
      }
    }
  }
  return (outside && token <= maxToken);
};

/*
 * Returns the value parameter with all double quotation marks escaped (i. e. doubled).
 * @param value string
 * @return string escaped value
 */
module.exports.escapeDoubleQuotes = function (value) {
  return value.replace(/"/g, '""');
};

/*
 * Returns the string parameter with all single quotation marks escaped (i. e. doubled).
 * @param value string
 * @return string escaped value
 */
module.exports.escapeSingleQuotes = function (value) {
  return value.replace(/'/g, '\'\'');
};