bigquery-client
Version:
A feature-rich Node.js client for Google BigQuery with support for CRUD operations, transactions, query building, and advanced features like aggregate functions, pagination, and logging.
220 lines (219 loc) • 7.3 kB
TypeScript
/**
* @fileoverview Query Validation Utility - Advanced security and data validation for BigQuery operations
* @version 1.0.6
* @author Pravin Jadhav
* @description This module provides comprehensive validation capabilities including SQL injection protection,
* parameter validation, schema validation, and security best practices for BigQuery operations.
*/
/**
* Advanced query validation and security system for BigQuery operations
*
* This class provides comprehensive validation capabilities including:
* - SQL injection detection and prevention
* - Parameter type and value validation
* - Schema structure validation
* - Query syntax validation
* - Security best practices enforcement
* - Input sanitization and normalization
*
* @class QueryValidator
* @example
* ```typescript
* // Validate a query for security
* try {
* QueryValidator.validateQuery('SELECT * FROM users WHERE id = ?');
* console.log('Query is safe to execute');
* } catch (error) {
* console.error('Query validation failed:', error.message);
* }
*
* // Validate query parameters
* QueryValidator.validateParameters([123, 'john@example.com', true]);
* ```
*/
export declare class QueryValidator {
/**
* Validates SQL queries for security vulnerabilities and syntax issues
*
* This method provides comprehensive query validation including:
* - SQL injection pattern detection
* - Dangerous statement identification
* - Comment and union-based attack prevention
* - Query structure validation
* - Security best practices enforcement
*
* @static
* @param {string} query - SQL query string to validate
* @returns {void}
* @throws {ValidationError} When query contains security vulnerabilities or invalid syntax
*
* @example
* ```typescript
* // Valid queries pass validation
* QueryValidator.validateQuery('SELECT * FROM users WHERE active = ?');
* QueryValidator.validateQuery('INSERT INTO logs (message, timestamp) VALUES (?, ?)');
* QueryValidator.validateQuery('UPDATE users SET last_login = ? WHERE id = ?');
*
* // Invalid queries throw ValidationError
* try {
* QueryValidator.validateQuery("SELECT * FROM users; DROP TABLE users;");
* } catch (error) {
* console.error('SQL injection detected:', error.message);
* }
*
* try {
* QueryValidator.validateQuery("SELECT * FROM users WHERE id = 1 OR '1'='1'");
* } catch (error) {
* console.error('Injection pattern detected:', error.message);
* }
*
* // Empty or invalid queries
* try {
* QueryValidator.validateQuery('');
* } catch (error) {
* console.error('Invalid query format:', error.message);
* }
* ```
*/
static validateQuery(query: string): void;
/**
* Validates query parameters for type safety and security
*
* This method ensures parameter integrity by:
* - Verifying parameter array structure
* - Checking for null/undefined values
* - Validating parameter types
* - Preventing parameter-based injection
* - Ensuring data consistency
*
* @static
* @param {any[]} params - Array of query parameters to validate
* @returns {void}
* @throws {ValidationError} When parameters are invalid or potentially unsafe
*
* @example
* ```typescript
* // Valid parameter arrays
* QueryValidator.validateParameters([123, 'john@example.com', true]);
* QueryValidator.validateParameters(['active', new Date(), 42.5]);
* QueryValidator.validateParameters([{ id: 1, name: 'test' }]);
*
* // Invalid parameters throw ValidationError
* try {
* QueryValidator.validateParameters('not an array');
* } catch (error) {
* console.error('Parameters must be array:', error.message);
* }
*
* try {
* QueryValidator.validateParameters([123, null, 'valid']);
* } catch (error) {
* console.error('Null parameters not allowed:', error.message);
* }
*
* try {
* QueryValidator.validateParameters([undefined, 'test']);
* } catch (error) {
* console.error('Undefined parameters not allowed:', error.message);
* }
*
* // Empty arrays are valid
* QueryValidator.validateParameters([]);
* ```
*/
static validateParameters(params: any[]): void;
/**
* Validates BigQuery table schema definitions for correctness and consistency
*
* This method provides schema validation including:
* - Schema structure verification
* - Field type validation
* - Required field checking
* - Data type compatibility
* - Schema consistency enforcement
*
* @static
* @param {any} schema - Schema object to validate
* @returns {void}
* @throws {ValidationError} When schema is invalid or malformed
*
* @example
* ```typescript
* // Valid schema objects (BigQuery types)
* QueryValidator.validateSchema({
* id: 'INTEGER',
* name: 'STRING',
* email: 'STRING',
* created_at: 'TIMESTAMP'
* });
*
* // Valid schema objects (JavaScript types)
* QueryValidator.validateSchema({
* id: 'number',
* name: 'string',
* active: 'boolean',
* created_at: 'timestamp'
* });
*
* QueryValidator.validateSchema({
* user_id: 'INTEGER',
* metadata: 'JSON',
* score: 'FLOAT',
* active: 'BOOLEAN'
* });
*
* // Invalid schemas throw ValidationError
* try {
* QueryValidator.validateSchema(null);
* } catch (error) {
* console.error('Schema cannot be null:', error.message);
* }
*
* try {
* QueryValidator.validateSchema(['not', 'an', 'object']);
* } catch (error) {
* console.error('Schema must be object:', error.message);
* }
*
* try {
* QueryValidator.validateSchema('invalid schema');
* } catch (error) {
* console.error('Schema format invalid:', error.message);
* }
* ```
*/
static validateSchema(schema: any): void;
/**
* Validates table and column names for BigQuery compatibility
*
* @static
* @param {string} name - Table or column name to validate
* @returns {void}
* @throws {ValidationError} When name doesn't meet BigQuery naming requirements
*
* @example
* ```typescript
* // Valid names
* QueryValidator.validateIdentifier('users');
* QueryValidator.validateIdentifier('user_events');
* QueryValidator.validateIdentifier('analytics_2023');
*
* // Invalid names
* try {
* QueryValidator.validateIdentifier('123_invalid');
* } catch (error) {
* console.error('Names cannot start with numbers');
* }
* ```
*/
static validateIdentifier(name: string): void;
/**
* Validates query complexity to prevent resource exhaustion
*
* @static
* @param {string} query - SQL query to analyze
* @returns {void}
* @throws {ValidationError} When query is too complex or resource-intensive
*/
static validateQueryComplexity(query: string): void;
}