Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@squill/squill
Advanced tools
This library currently has the following adapter librariies,
Log
Table-per-type (TODO)
As much as possible, compile-time type-safety!
Provide unified query-building
sql.js
)Provide query-building specific to a database and version
Efficiency
Direct support for MySQL BIGINT UNSIGNED
type.
BIGINT UNSIGNED
.This project will have multiple subprojects,
Database-unifying subproject
Specific version undecided
Must not be a version that has been released too recently
An eye is kept on PostgreSQL to sanity-check the other two implementations
According to @webstrand ,
9.4 still receives updates, ubuntu 16.04 expires in 2021 and only has 9.5. So at least 9.5.
Preference is leaning towards 9.4 at the moment.
Because it must support multiple databases, it will only support features that all three databases support. This means that many features will be excluded.
Subprojects specific to a database and version
node
EnvironmentsThis library requires BigInt
support.
If your environment does not have them, you must polyfill them before this library is loaded.
The simplest BigInt
polyfill that should work is,
(global as any).BigInt = ((value : string|number|bigint) => {
return {
toString : () => {
return String(value);
},
};
}) as any;
typed-orm
supported RIGHT JOIN
s. Support is removed in this rewrite.
All RIGHT JOIN
s can be rewritten as LEFT JOIN
s
Using RIGHT JOIN
on a LATERAL
derived table introduces problems,
https://dev.mysql.com/doc/refman/8.0/en/lateral-derived-tables.html
If the table is in the left operand and contains a reference to the right operand, the join operation must be an INNER JOIN, CROSS JOIN, or RIGHT [OUTER] JOIN.
It is possible to use a column before it even exists in the query. This complicates compile-time type checking code.
Maybe keep support for RIGHT JOIN
but not support RIGHT JOIN LATERAL
?
Important, create sub-packages for different MySQL versions/different DBMSs
Support for other DBMS'
random 2cents: if you're going for this, I say ideally support every sql offered by aws rds (aurora, postgres, my, maira, oracle & MS)
Refactor FromXxx
to FromXxxArray
if it is meant to distribute?
Monitor this issue, https://github.com/microsoft/TypeScript/issues/32824
Reduce lib
and target
until we reach es2015
?
List of OIDs for built-in data types,
https://github.com/gajus/eslint-plugin-sql
To be used with https://github.com/brianc/node-postgres
https://okbob.blogspot.com/2009/08/mysql-functions-for-postgresql.html
Consider forcing users of library to allow library to create a library-specific schema for stored procedures/functions to unify behaviour of built-in functions/operators.
More goals and non-goals
Examples of compile-time type-safety you won't get from other libraries
Remove usages of "I" and replace with "we"?
WTF, Postgres!?
Quoting an identifier also makes it case-sensitive, whereas unquoted names are always folded to lower case. For example, the identifiers FOO, foo, and "foo" are considered the same by PostgreSQL, but "Foo" and "FOO" are different from these three and each other. (The folding of unquoted names to lower case in PostgreSQL is incompatible with the SQL standard, which says that unquoted names should be folded to upper case. Thus, foo should be equivalent to "FOO" not "foo" according to the standard. If you want to write portable applications you are advised to always quote a particular name or never quote it.)
NaN
, +Infinity
, -Infinity
are not valid DOUBLE
values according to the SQL standardInvestigate and compare against,
This library will not handle migrations but it's good to keep an eye on promising migration libraries
Remove static use of potentially polyfilled functions like BigInt
, etc.
Investigate https://www.postgresql.org/docs/9.2/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS-ESCAPE
E
(upper or lower case) just before the opening single quote, e.g., E'foo'
.standard_conforming_strings
is off
, then PostgreSQL recognizes backslash escapes in both regular and escape string constants. However, as of PostgreSQL 9.1, the default is on
Add subqueries to certain callbacks (For example, the .where()
method)
.select()
and .selectValue()
methods already have thistyped-orm
FULL OUTER JOIN
(MySQL does not have it)information_schema
FAQs
A SQL query-builder/ORM
The npm package @squill/squill receives a total of 12 weekly downloads. As such, @squill/squill popularity was classified as not popular.
We found that @squill/squill demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.