@@ -18,6 +18,24 @@ export class Query extends BaseQuery {
1818 this . _parameters = { ...this . _parameters , ...queryObj } ;
1919 }
2020 }
21+ // Validate if input is alphanumeric
22+ private isValidAlphanumeric ( input : string ) : boolean {
23+ const alphanumericRegex = / ^ [ a - z A - Z 0 - 9 _ . - ] + $ / ;
24+ return alphanumericRegex . test ( input ) ;
25+ }
26+ // Validate if input is a valid regex pattern
27+ private isValidRegexPattern ( input : string ) : boolean {
28+ try {
29+ new RegExp ( input ) ;
30+ return true ;
31+ } catch ( error ) {
32+ return false ;
33+ }
34+ }
35+ // Validate if value is an array of strings, numbers, or booleans
36+ private isValidValue ( value : any [ ] ) : boolean {
37+ return Array . isArray ( value ) && value . every ( item => typeof item === 'string' || typeof item === 'number' || typeof item === 'boolean' ) ;
38+ }
2139
2240 /**
2341 * @method where
@@ -40,18 +58,22 @@ export class Query extends BaseQuery {
4058 * @returns {Query }
4159 */
4260 where (
43- fieldUid : string ,
44- queryOperation : QueryOperation | TaxonomyQueryOperation ,
61+ fieldUid : string ,
62+ queryOperation : QueryOperation | TaxonomyQueryOperation ,
4563 fields : string | string [ ] | number | number [ ] | object | boolean ,
4664 additionalData ?: object
4765 ) : Query {
66+ if ( ! this . isValidAlphanumeric ( fieldUid ) ) {
67+ console . error ( "Invalid fieldUid:" , fieldUid ) ;
68+ return this ;
69+ }
4870 if ( queryOperation == QueryOperation . EQUALS ) {
4971 this . _parameters [ fieldUid ] = fields ;
50- } else {
72+ }
73+ else {
5174 const parameterValue : { [ key in QueryOperation ] ?: string | string [ ] } = { [ queryOperation ] : fields , ...additionalData } ;
5275 this . _parameters [ fieldUid ] = parameterValue ;
5376 }
54-
5577 return this ;
5678 }
5779
@@ -70,11 +92,18 @@ export class Query extends BaseQuery {
7092 * @returns {Query }
7193 */
7294 regex ( fieldUid : string , regexPattern : string , options ?: string ) : Query {
73- this . _parameters [ fieldUid ] = { $regex : regexPattern } ;
74-
75- if ( options ) this . _parameters [ fieldUid ] . $options = options ;
76-
77- return this ;
95+ if ( ! this . isValidAlphanumeric ( fieldUid ) ) {
96+ console . error ( "Invalid fieldUid:" , fieldUid ) ;
97+ return this ;
98+ }
99+ if ( ! this . isValidRegexPattern ( regexPattern ) ) {
100+ throw new Error ( "Invalid regexPattern: Must be a valid regular expression" ) ;
101+ }
102+ else {
103+ this . _parameters [ fieldUid ] = { $regex : regexPattern } ;
104+ if ( options ) this . _parameters [ fieldUid ] . $options = options ;
105+ return this ;
106+ }
78107 }
79108
80109 /**
@@ -95,8 +124,10 @@ export class Query extends BaseQuery {
95124 */
96125 whereIn ( referenceUid : string , queryInstance : Query ) : Query {
97126 // eslint-disable-next-line @typescript-eslint/naming-convention, prettier/prettier
127+ if ( ! this . isValidAlphanumeric ( referenceUid ) ) {
128+ throw new Error ( "Invalid referenceUid: Must be alphanumeric." ) ;
129+ }
98130 this . _parameters [ referenceUid ] = { '$in_query' : queryInstance . _parameters } ;
99-
100131 return this ;
101132 }
102133
@@ -118,8 +149,10 @@ export class Query extends BaseQuery {
118149 */
119150 whereNotIn ( referenceUid : string , queryInstance : Query ) : Query {
120151 // eslint-disable-next-line @typescript-eslint/naming-convention, prettier/prettier
152+ if ( ! this . isValidAlphanumeric ( referenceUid ) ) {
153+ throw new Error ( "Invalid referenceUid: Must be alphanumeric." ) ;
154+ }
121155 this . _parameters [ referenceUid ] = { '$nin_query' : queryInstance . _parameters } ;
122-
123156 return this ;
124157 }
125158
@@ -183,6 +216,14 @@ export class Query extends BaseQuery {
183216 * @returns {Query }
184217 */
185218 containedIn ( key : string , value : ( string | number | boolean ) [ ] ) : Query {
219+ if ( ! this . isValidAlphanumeric ( key ) ) {
220+ console . error ( "Invalid key:" , key ) ;
221+ return this ;
222+ }
223+ if ( ! this . isValidValue ( value ) ) {
224+ console . error ( "Invalid value:" , value ) ;
225+ return this ;
226+ }
186227 this . _parameters [ key ] = { '$in' : value } ;
187228 return this ;
188229 }
@@ -201,6 +242,14 @@ export class Query extends BaseQuery {
201242 * @returns {Query }
202243 */
203244 notContainedIn ( key : string , value : ( string | number | boolean ) [ ] ) : Query {
245+ if ( ! this . isValidAlphanumeric ( key ) ) {
246+ console . error ( "Invalid key:" , key ) ;
247+ return this ;
248+ }
249+ if ( ! this . isValidValue ( value ) ) {
250+ console . error ( "Invalid value:" , value ) ;
251+ return this ;
252+ }
204253 this . _parameters [ key ] = { '$nin' : value } ;
205254 return this ;
206255 }
@@ -219,6 +268,10 @@ export class Query extends BaseQuery {
219268 * @returns {Query }
220269 */
221270 exists ( key : string ) : Query {
271+ if ( ! this . isValidAlphanumeric ( key ) ) {
272+ console . error ( "Invalid key:" , key ) ;
273+ return this ;
274+ }
222275 this . _parameters [ key ] = { '$exists' : true } ;
223276 return this ;
224277 }
@@ -237,6 +290,10 @@ export class Query extends BaseQuery {
237290 * @returns {Query }
238291 */
239292 notExists ( key : string ) : Query {
293+ if ( ! this . isValidAlphanumeric ( key ) ) {
294+ console . error ( "Invalid key:" , key ) ;
295+ return this ;
296+ }
240297 this . _parameters [ key ] = { '$exists' : false } ;
241298 return this ;
242299 }
@@ -300,6 +357,14 @@ export class Query extends BaseQuery {
300357 * @returns {Query }
301358 */
302359 equalTo ( key : string , value : string | number | boolean ) : Query {
360+ if ( ! this . isValidAlphanumeric ( key ) ) {
361+ console . error ( "Invalid key:" , key ) ;
362+ return this ;
363+ }
364+ if ( typeof value !== 'string' && typeof value !== 'number' ) {
365+ console . error ( "Invalid value (expected string or number):" , value ) ;
366+ return this ;
367+ }
303368 this . _parameters [ key ] = value ;
304369 return this ;
305370 }
@@ -317,6 +382,14 @@ export class Query extends BaseQuery {
317382 * @returns {Query }
318383 */
319384 notEqualTo ( key : string , value : string | number | boolean ) : Query {
385+ if ( ! this . isValidAlphanumeric ( key ) ) {
386+ console . error ( "Invalid key:" , key ) ;
387+ return this ;
388+ }
389+ if ( typeof value !== 'string' && typeof value !== 'number' ) {
390+ console . error ( "Invalid value (expected string or number):" , value ) ;
391+ return this ;
392+ }
320393 this . _parameters [ key ] = { '$ne' : value } ;
321394 return this ; ;
322395 }
@@ -335,6 +408,10 @@ export class Query extends BaseQuery {
335408 * @returns {Query }
336409 */
337410 referenceIn ( key : string , query : Query ) : Query {
411+ if ( ! this . isValidAlphanumeric ( key ) ) {
412+ console . error ( "Invalid key:" , key ) ;
413+ return this ;
414+ }
338415 this . _parameters [ key ] = { '$in_query' : query . _parameters }
339416 return this ;
340417 }
@@ -353,6 +430,10 @@ export class Query extends BaseQuery {
353430 * @returns {Query }
354431 */
355432 referenceNotIn ( key : string , query : Query ) : Query {
433+ if ( ! this . isValidAlphanumeric ( key ) ) {
434+ console . error ( "Invalid key:" , key ) ;
435+ return this ;
436+ }
356437 this . _parameters [ key ] = { '$nin_query' : query . _parameters }
357438 return this ;
358439 }
@@ -371,6 +452,10 @@ export class Query extends BaseQuery {
371452 * @returns {Query }
372453 */
373454 tags ( values : ( string | number | boolean ) [ ] ) : Query {
455+ if ( ! this . isValidValue ( values ) ) {
456+ console . error ( "Invalid value:" , values ) ;
457+ return this ;
458+ }
374459 this . _parameters [ 'tags' ] = values ;
375460 return this ;
376461 }
@@ -389,6 +474,10 @@ export class Query extends BaseQuery {
389474 * @returns {Query }
390475 */
391476 search ( key : string ) : Query {
477+ if ( ! this . isValidAlphanumeric ( key ) ) {
478+ console . error ( "Invalid key:" , key ) ;
479+ return this ;
480+ }
392481 this . _queryParams [ 'typeahead' ] = key
393482 return this
394483 }
@@ -407,6 +496,15 @@ export class Query extends BaseQuery {
407496 * @returns {Query }
408497 */
409498 lessThan ( key : string , value : ( string | number ) ) : Query {
499+ if ( ! this . isValidAlphanumeric ( key ) ) {
500+ console . error ( "Invalid key:" , key ) ;
501+ return this ;
502+ }
503+ if ( typeof value !== 'string' && typeof value !== 'number' ) {
504+ console . error ( "Invalid value (expected string or number):" , value ) ;
505+ return this ;
506+ }
507+
410508 this . _parameters [ key ] = { '$lt' : value } ;
411509 return this ;
412510 }
@@ -425,6 +523,14 @@ export class Query extends BaseQuery {
425523 * @returns {Query }
426524 */
427525 lessThanOrEqualTo ( key : string , value : ( string | number ) ) : Query {
526+ if ( ! this . isValidAlphanumeric ( key ) ) {
527+ console . error ( "Invalid key:" , key ) ;
528+ return this ;
529+ }
530+ if ( typeof value !== 'string' && typeof value !== 'number' ) {
531+ console . error ( "Invalid value (expected string or number):" , value ) ;
532+ return this ;
533+ }
428534 this . _parameters [ key ] = { '$lte' : value } ;
429535 return this ;
430536 }
@@ -443,6 +549,14 @@ export class Query extends BaseQuery {
443549 * @returns {Query }
444550 */
445551 greaterThan ( key : string , value : ( string | number ) ) : Query {
552+ if ( ! this . isValidAlphanumeric ( key ) ) {
553+ console . error ( "Invalid key:" , key ) ;
554+ return this ;
555+ }
556+ if ( typeof value !== 'string' && typeof value !== 'number' ) {
557+ console . error ( "Invalid value (expected string or number):" , value ) ;
558+ return this ;
559+ }
446560 this . _parameters [ key ] = { '$gt' : value } ;
447561 return this ;
448562 }
@@ -461,6 +575,14 @@ export class Query extends BaseQuery {
461575 * @returns {Query }
462576 */
463577 greaterThanOrEqualTo ( key : string , value : ( string | number ) ) : Query {
578+ if ( ! this . isValidAlphanumeric ( key ) ) {
579+ console . error ( "Invalid key:" , key ) ;
580+ return this ;
581+ }
582+ if ( typeof value !== 'string' && typeof value !== 'number' ) {
583+ console . error ( "Invalid value (expected string or number):" , value ) ;
584+ return this ;
585+ }
464586 this . _parameters [ key ] = { '$gte' : value } ;
465587 return this ;
466588 }
0 commit comments