
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
firebird-query
Advanced tools
A node-firebird wrapper for easy and safe query building.
npm install firebird-query
const { FirebirdQuery } = require('firebird-query');
const max = 10; /* opened sockets */
const options = {
host: '000.000.000.000',
port: 3050,
database: '/path/Database/FILE.FDB',
user: 'SYSDBA',
password: 'my_secure_password'
};
export const db = new FirebirdQuery(options, max);
Configure a .env
DB_HOST="000.000.000.000"
DB_PORT=3050
DB_DATABASE="/path/Database/FILE.FDB"
DB_USER="SYSDBA"
DB_PASSWORD="my_secure_password"
Then
export const db = new FirebirdQuery();
import { db } from './db.service.js';
const result = db.queryRaw`
SELECT COD, NAME
FROM USERS
WHERE SIGN_UP_DATE < ${date}`.execute();
console.log(result);
// --> [ { COD: 1, NAME: 'JOHN' }, { COD: 2, NAME: 'JANE' } ]
const result = db.queryRaw`
SELECT COD, NAME
FROM USERS
WHERE SIGN_UP_DATE < ${date}`.paginated(1,2); // take: 1, page: 2
console.log(result);
// --> [ { COD: 2, NAME: 'JANE' } ]
An object can be provided instead of a raw value.
AND
clausesconst result = t.queryRaw`SELECT COD, NAME FROM USERS WHERE ${{
COD: 1,
NAME: "John",
}}`.getQuery();
console.log(result);
// SELECT COD, NAME FROM USERS WHERE COD = '1' AND NAME = 'John'
If a where clause resolved to undefined
, it will be replaced with a tautology, making it irrelevant to the query result .
Take advantage of this behavior to conditionally add statements.
const name = "Tom";
const result = t.queryRaw`SELECT COD, NAME FROM USERS WHERE ${{
COD: name.startsWith("J") ? 1 : undefined,
NAME: name,
}}`.getQuery();
console.log(result);
// SELECT COD, NAME FROM USERS WHERE 1=1 AND NAME = 'Tom'
Set anything as object key. This example handles case insensitive queries.
const name = "Tom";
const result = t.queryRaw`SELECT COD, NAME FROM USERS WHERE ${{
["LOWER(NAME)"]: name.toLowerCase(),
}}`.getQuery();
console.log(result);
// SELECT COD, NAME FROM USERS WHERE LOWER(NAME) = 'tom'
const name = "Tom";
const result = t.queryRaw`SELECT COD, NAME FROM USERS WHERE ${{
COD: { gte: 1 },
NAME: { startsWith: name },
}}`.getQuery();
console.log(result);
// SELECT COD, NAME FROM USERS WHERE COD >= '1' AND NAME LIKE 'Tom%'
const result = await db.insertOne({
tableName: 'USERS',
rowValues: {
NAME: 'JAKE',
},
returning: ['COD']
}).execute()
console.log(result); // --> { COD: 3 }
Performs an efficient INSERT statement and inserts multiple rows in a single query.
Does not support returning clause.
const result = await db.insertMany({
tableName: 'USERS',
columnNames: ['NAME', 'PHONE'],
rowValues: [
{ NAME: 'John', PHONE: '555-555-5555' },
{ NAME: 'Jane', PHONE: '555-555-0000' },
]
}).execute();
console.log(result); // --> 2 rows inserted
updateOne
Update a single row. Supports returning.
const result = await db.updateOne({
tableName: 'USERS',
rowValues: {
NAME: 'John',
PHONE: '555-555-5555'
},
conditions: {
COD: 1
},
returning: ['COD']
});
console.log(result); // --> { COD: 1 }
updateOrInsert Update or insert a single row. Supports returning clause
WARNING: Ensure there’s only one potential row affected.
const result = await db.updateOrInsert({
tableName: 'USERS',
rowValues: {
COD: 1,
NAME: 'John',
},
returning: ['COD']
});
console.log(result); // --> { COD: 1 }
Each method counts on typescript inference as long as a return parameter is provided.
The ouput must be manually inferred.
The result is always an array of the type provided
const result = db.queryRaw<{ COD: number }>`
SELECT COD
FROM USERS
WHERE COD = ${1}`.execute();
console.log(result); // --> [ { COD: 1 } ]
An async method that returns a ISOLATION_READ_COMMITTED transaction instance to work with. It has the same methods to query and mutate the database in addition to
// recommended usage
db.initTransaction().then(async (t) => {
// t(ransaction) is scoped in this async function.
//Every query and mutation correspond to this specific transaction.
})
FAQs
node-firebird plugin for easy and safe query building.
The npm package firebird-query receives a total of 6 weekly downloads. As such, firebird-query popularity was classified as not popular.
We found that firebird-query demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.