
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
anydb-sql combines node-anydb and node-sql into a single package full of awesomeness.
anydb-sql combines node-anydb and node-sql into a single package full of awesomeness.
Initializing an instance also creates a connection pool. The url argument is the same as in node-anydb
var anydbsql = require('anydb-sql');
var db = anydbsql({
url: 'postgres://user:pass@host:port/database',
connections: { min: 2, max: 20 }
});
Defining a table is the same as in node-sql:
var user = db.define({
name: 'users',
columns: {
id: {primaryKey: true},
email: {},
password: {}
}
});
But now you can also add properties based on relationships between tables:
var user = db.define({
name: 'users',
columns: { ... }
has: {
posts: {from: 'posts', many: true},
group: {from: 'groups'}
}
});
// user.posts is now a "subtable"
Read about joins and subobjects to see how you can
use subtables with selectDeep
Queries have all the methods as in node-sql, plus the additional methods:
If you omit the callback from a querying method, an eventemitter will be returned instead (like in anydb).
Use regular node-sql queries then chain one of the querying methods at the end:
user.where({email: email}).get(function(err, user) {
// user.name,
});
Join queries can be constructed using node-sql. The format of the results is the same as with anydb
user.select(user.name, post.content)
.from(user.join(post).on(user.id.equals(post.userId)))
.where(post.date.gt(yesterday))
.all(function(err, userposts) {
// res[0].name and res[0].content
});
When creating join queries, you can generate sub-objects in the result by
using selectDeep
user.from(user.join(post).on(user.id.equals(post.userId)))
.where(post.date.gt(yesterday))
.selectDeep(user.name, post.content)
.all(function(err, res) {
// res[0].user.name and res[0].post.content
});
With selectDeep you can also utilize has
relationships to get full-blown
result structures:
user.from(user.join(user.posts).on(user.id.equals(user.posts.userId)))
.where(user.posts.date.gt(yesterday))
.selectDeep(user.id, user.name, user.posts)
.all(function(err, res) {
// res[0] is
// { id: id, name: name, posts: [postObj, postObj, ...] }
});
selectDeep
can accept tables, their fields, their has
relationships,
relationship fields, relationships' relationships etc (recursively)
user.from(user.join(user.posts).on(
user.id.equals(user.posts.userId))
.join(user.posts.comments).on(
user.posts.id.equals(user.posts.comments.postId))
.selectDeep(user.id, user.name, user.posts.id, user.posts.content,
user.posts.comments).all(function(err, res) {
// res[0] is
// {id: id, name: name: posts: [
// {id: pid, content: content, comments: [commentObj, ...]},
// {id: pid, content: content, comments: [commentObj, ...]},
// ...
// ]}
});
To create a transaction and execute queries within it, use
db.begin()
Execute constructed queries within that transaction using
execWithin
, getWithin
or allWithin
var tx = db.begin()
user.insert({name: 'blah'}).returning(user.id).execWithin(tx);
user.insert({name: 'bleh'}).returning(user.id).execWithin(tx);
user.where({name: 'blah').getWithin(tx, function(err, res) {
// the user is there!
});
tx.commit();
Transactions also have the same API as anydb tranactions.
You can close the connection pool
db.close();
Or execute custom queries
db.query(...anydb arguments...)
MIT
FAQs
Minimal ORM for mysql, postgresql and sqlite with complete arbitrary SQL query support (based on brianc's query builder sql)
The npm package anydb-sql receives a total of 18 weekly downloads. As such, anydb-sql popularity was classified as not popular.
We found that anydb-sql demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.