mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-10-26 14:30:19 +00:00
UNITRONIX
235c9c0706
Bump axios/multer and npm overrides; add safeSqlIdent and multer cleanup; harden JWT aud/iss/nbf; CSP without unsafe-eval via static protobuf build and data-bd-call delegation; ship Security Test Suite v1.2.0 and docs. Ignore generated RdClient protobuf artifacts (~40k lines) — rebuild locally with npm run protocols:rdclient. Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
31 lines
739 B
JavaScript
31 lines
739 B
JavaScript
'use strict';
|
|
|
|
/** Unquoted SQL identifier: letters, digits, underscore; must not start with a digit. */
|
|
const SAFE_SQL_IDENT_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
|
|
|
|
/**
|
|
* @param {unknown} name
|
|
* @returns {string} validated identifier
|
|
* @throws {Error} when name is not a safe SQL identifier
|
|
*/
|
|
function assertSafeSqlIdent(name) {
|
|
if (typeof name !== 'string' || !SAFE_SQL_IDENT_RE.test(name)) {
|
|
throw new Error(`Unsafe SQL identifier: ${String(name)}`);
|
|
}
|
|
return name;
|
|
}
|
|
|
|
/**
|
|
* @param {unknown} name
|
|
* @returns {boolean}
|
|
*/
|
|
function isSafeSqlIdent(name) {
|
|
return typeof name === 'string' && SAFE_SQL_IDENT_RE.test(name);
|
|
}
|
|
|
|
module.exports = {
|
|
SAFE_SQL_IDENT_RE,
|
|
assertSafeSqlIdent,
|
|
isSafeSqlIdent,
|
|
};
|