
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Query builder, and validator, for MySQL and node that utilizes the underlying table to provide a level of checking
A utility function to help with query writing for dealing with MySQL compatible databases.
It uses the meta-data from the database table (desc table) to automatically determine the proper checking and required fields when performing a SELECT, INSERT or UPDATE. If you are performing lots of simple CRUD statements, without any fancy MySQL functions this utility helps a lot. This data is cached, so repeated calls to 'desc' is not incurred.
The utility was also written to support the widely popular DataTables (https://datatables.net/) Javascript control, making it very easy to support all the query params for sorting, searching and querying, with little to no effort.
The library can be used in two different modes:
Any errors result in exceptions being thrown.
npm install mg-dbop
First example, pulls back a single row from the given table, with the given primary key fields passed in.
It returns null if no rows were found.
const dbOpMySql = require("mg-dbop");
const dbConn = //get a connection to MySQL database
const customId = "xxx";
const row = await dbOpMySql.selectOne(
dbConn,
"table1", {
"tableId": customId
},
[
"column1", "column2"
]
);
Second example, without any columns specified, will return everything.
const dbOpMySql = require("mg-dbop");
const dbConn = //get a connection to MySQL database
const customId = "xxx";
const row = await dbOpMySql.selectOne(
dbConn,
"table1", {
"tableId": customId,
"tableSecId" : 321
}
);
This will automatically look for the primary key values and construct the insert accordingly, making sure all required fields are passed in.
const dbOpMySql = require("mg-dbop");
const dbConn = //get a connection to MySQL database
const data = {
field : data,
field2 : data,
primaryKey : pkData
};
await dbOpMySql.insert(dbConn, "table", data);
It will return the lastInsertId
of the last insert. Alternatively you can always call dbOpMySql.getLastResult()
for the actual object returned from MySql.
For fields that are designated datetime & date you can pass in the values now()/NOW() for the database to use the current time.
A 4th optional field, ignore, will add in the IGNORE flag to the INSERT statement.
You can also psuedo name space the body, by passing in "alias.table" as the table defintion. At this point, the fields will expect to see "alias.column1".
This will automatically look for the primary key values and construct the update accordingly, making sure all required fields are passed in.
const dbOpMySql = require("mg-dbop");
const dbConn = //get a connection to MySQL database
const data = {
field : data,
field2 : data,
primaryKey : pkData
};
await dbOpMySql.update(dbConn, "table", data);
This will return the number of rows that were up changed in this update.
You can also psuedo name space the body, by passing in "alias.table" as the table defintion. At this point, the fields will expect to see "alias.column1".
There are a number of helper methods that are available to make data clean up simpler.
These methods are using the builder pattern:
This method returns the last SQL result from an INSERT/UPDATE
This way works in the same way, using the database metadata contained within 'desc table' to drive a lot of the logic and query building.
The format is { "<table>.<alias>.<column>" : "<table>.<alias>.<column>" }
for defining the tables and the way they are joined. If it is a single table then pass in a string: "<table>.<alias>"
const dbOpMySql = require("mg-dbop");
const dbConn = //get a connection to MySQL database
// Create SQL Builder, tying together all the tables we want to join
// ""
const sql = await dbOpMySql.sqlBuilder(dbConn, {
"table1.t1.tableId": "table2.t2.tableId"
});
Next there is a series of methods you can call on the object to create the string
sql.select("t1.tableName")
.where("tableId=?", someValue2)
.where("AND enabled=1")
.where("AND dtMod > ?", someValue2)
.orderby("tableId desc")
.limit(0,10);
Once it is built you can then execute it:
const results = await sql.run();
const countV = await sql.count();
const firstRow = await sql.runFirstRow();
Datatables have a rich array of options associated with it. dbOpMySql makes it easy to integrate.
const sql = await dbOpMySql.sqlBuilder(dbConn, {
"table1.t1.tableId": "table2.t2.tableId", {
"table1.t1.rStatus" : "rStatus.rs.id",
"table1.t1.rType" : {
"join" : "rStatus.rs.id",
"columns" : "rs.label" // optional
}
});
// passing in the object where all the query params exist
sql.dataTableFilter( req );
// add in optional .where() statements you may wish; or .select() columns
// format the result as to what dataTables expect
const result = {
data: await sql.run(),
recordsTotal: await sql.count(),
}
You can also specify some additional query params:
The 3rd param makes it easier to create LEFT JOIN statements to join tables that may have null rows associated with them. The syntax is an object with:
{
"primaryTable.t1.tableId" : "joinedTable1.jt1.tableId"
}
The table you are joining to must be on the right hand side. This will automatically select all the fields on the joinedTable and put them in the SELECT. Alternatively you can specify which columns from the joinedTable you want:
{
"primaryTable.t1.tableId" : {
"join" : "joinedTable1.jt1.tableId",
"columns" : "jt1.label"
}
.setOptions({
dataTableJsonColumnMap : {
"__":"jsColumnName" // for auto JSon search within a JSON type of field; co.__year will search for 'year' in the JSon column
},
"rowFilterRemoveErantPeriod" : true, // Remove period in column name in the result that starts with .
"rowFilterRemoveNullRow" : true, // Remove any null values in the columns
})
FAQs
Query builder, and validator, for MySQL and node that utilizes the underlying table to provide a level of checking
We found that mg-dbop demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.