
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
pgsql-parser
Advanced tools
The real PostgreSQL parser for Node.js. Built with the actual PostgreSQL parser, pgsql-parser
delivers true-to-spec SQL parsing and reconstruction. Transform SQL queries into ASTs, modify them programmatically, and convert them back to SQL with complete fidelity.
npm install pgsql-parser
The package exports both async and sync methods. Async methods handle initialization automatically, while sync methods require explicit initialization.
โ ๏ธ If you don't need the parser functionality, consider using the TS-only (no WASM, zero runtime dependencies) pgsql-deparser
for a super fast, lightweight deparser. Battle-tested with 23,000+ SQL statements ๐
import { parse, deparse } from 'pgsql-parser';
// Parse SQL to AST
const stmts = await parse('SELECT * FROM test_table');
// Deparse AST back to SQL
const sql = await deparse(stmts);
Sync methods require explicit initialization using loadModule()
:
import { loadModule, parseSync, deparseSync } from 'pgsql-parser';
// Initialize first (required for sync methods)
await loadModule();
// Now safe to use sync methods
const stmts = parseSync('SELECT * FROM test_table');
const sql = deparseSync(stmts);
Note: We recommend using async methods as they handle initialization automatically. Use sync methods only when necessary, and always call loadModule()
first.
Rewrite part of a SQL query:
import { parse, deparse } from 'pgsql-parser';
const stmts = await parse('SELECT * FROM test_table');
// Assuming the structure of stmts is known and matches the expected type
stmts[0].RawStmt.stmt.SelectStmt.fromClause[0].RangeVar.relname = 'another_table';
console.log(await deparse(stmts));
// SELECT * FROM "another_table"
The pgsql-deparser
module serializes ASTs to SQL in pure TypeScript, avoiding the full parser's native dependencies. It's useful when only SQL string conversion from ASTs is needed, and is written in pure TypeScript for easy cross-environment deployment.
Here's how you can use the deparser in your TypeScript code, using @pgsql/utils
to create an AST for deparse
:
import * as t from '@pgsql/utils';
import { RangeVar, SelectStmt } from '@pgsql/types';
import { deparse } from 'pgsql-deparser';
// This could have been obtained from any JSON or AST, not necessarily @pgsql/utils
const stmt: { SelectStmt: SelectStmt } = t.nodes.selectStmt({
targetList: [
t.nodes.resTarget({
val: t.nodes.columnRef({
fields: [t.nodes.aStar()]
})
})
],
fromClause: [
t.nodes.rangeVar({
relname: 'some_table',
inh: true,
relpersistence: 'p'
})
],
limitOption: 'LIMIT_OPTION_DEFAULT',
op: 'SETOP_NONE'
});
// Modify the AST if needed
(stmt.SelectStmt.fromClause[0] as {RangeVar: RangeVar}).RangeVar.relname = 'another_table';
// Deparse the modified AST back to a SQL string
console.log(await deparse(stmt));
// Output: SELECT * FROM another_table
Built on the excellent work of several contributors:
pgsql-parser
.pgsql-parser
for parsing and deparsing SQL queries.AS DESCRIBED IN THE LICENSES, THE SOFTWARE IS PROVIDED "AS IS", AT YOUR OWN RISK, AND WITHOUT WARRANTIES OF ANY KIND.
No developer or entity involved in creating Software will be liable for any claims or damages whatsoever associated with your use, inability to use, or your interaction with other users of the Software code or Software CLI, including any direct, indirect, incidental, special, exemplary, punitive or consequential damages, or loss of profits, cryptocurrencies, tokens, or anything else of value.
FAQs
The real PostgreSQL query parser
We found that pgsql-parser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socketโs new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.