Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
poor-mans-t-sql-formatter-cli
Advanced tools
A T-SQL formatting utility in JS, transpiled from the C# library of the same name.
A command-line SQL formatter that runs in pretty much any environment (as long as node.js is installed).
It is based on the Poor Man's T-SQL Formatter NPM package (poor-mans-t-sql-formatter), which in turn is based on the C# library of the same name ( https://github.com/TaoK/PoorMansTSqlFormatter ).
This formatter should be equivalent in functionality to the C# command-line formatter that's existed for a few years (downloadable at http://architectshack.com/PoorMansTSqlFormatter.ashx), with two major differences:
(assuming node.js is installed)
npm install --global poor-mans-t-sql-formatter-cli
piped/stdin input & stdout output:
echo "select a from b join c on b.id = c.id where abc = 123 and def = N'whatêver' " | sqlformat
file input & output:
echo "with a as (select 1 as b) select * from a cros join c" > testfile.sql
sqlformat -f testfile.sql -g testfile.sql
cat testfile.sql
This command-line formatter will exit with a non-0 exit code if the SQL parsing "gets in trouble" - for example if it encounters an unfinished "IF" statement, suggesting that something about the SQL was not correctly understood/parsed, and may therefore "come out wrong". There's an option to disable this behavior if the SQL is known to be shady, or the parsing confusion is known to be innocuous.
If the parsing is aborted, any specified "output file" will be left untouched.
Command-line-utility-specific options:
Option | Description | Type | Default |
---|---|---|---|
--inputFile | Read input to be formatted from a file rather than stdin (typed or piped input) | string | |
--outputFile | Write formatted output to a file - like shell redirection of stdout, except on error it leaves the file untouched | string | |
--ignoreErrors | Return 0 (success) exit code even if parsing failed (and so the formatted output is suspect) | bool | |
--inputEncoding | Use a specific character encoding supported by node for input - basically utf-16le or utf-8 | string | utf-8 |
--outputEncoding | Use a specific character encoding supported by node for output - basically utf-16le or utf-8 | string | utf-8 |
--forceOutputBOM | Add a byte order mark (BOM) to the start of the output | bool |
Standard formatter options:
(please note, boolean options that normally default to "true" in the library have been flipped with a "no" prefix, following unixey command-line parameter conventions)
Option | Description | Type | Default |
---|---|---|---|
--indent | The unit of indentation - typically a tab (\t) or a number of spaces | string | \t |
--maxLineWidth | Request that the formatter wrap long lines to avoid exceeding this line length | int | 999 |
--spacesPerTab | This is used to measure line length, and only applies if you use tabs | int | 4 |
--statementBreaks | How many linebreaks should be added when starting a new statement? | int | 2 |
--clauseBreaks | How many linebreaks should be added when starting a new clause within a statement? | int | 1 |
--no-expandCommaLists | Should comma-delimited lists (columns, group by args, etc) be broken out onto new lines? | bool | |
--no-trailingCommas | When starting a new line because of a comma, should the comma be at the end of line (VS the start of the next)? | bool | |
--spaceAfterExpandedComma | Should a space be added after the comma? (typically not if they are "trailing") | bool | |
--no-expandBooleanExpressions | Should boolean operators (AND, OR) cause a linebreak? | bool | |
--no-expandCaseStatements | Should CASE expressions have their WHEN and THEN expressions be broken out on new lines? | bool | |
--no-expandBetweenConditions | Should BETWEEN expressions have the max argument broken out on a new line? | bool | |
--expandInLists | Should IN() lists have each argument on a new line? | bool | |
--breakJoinOnSections | Should the ON section of a JOIN clause be broken out onto its own line? | bool | |
--no-uppercaseKeywords | Should T-SQL keywords (like SELECT, FROM) be automatically uppercased? | bool | |
--keywordStandardization | Should less-common T-SQL keywords be replaced with their standard counterparts? (NOTE: only safe for T-SQL!) | bool |
Obfuscating formatter ("min" command) options:
Option | Description | Type | Default |
---|---|---|---|
--randomizeKeywordCase | Should the case of keywords be randomized, to minimize legibility? | bool | |
--randomizeLineLengths | Should the SQL be wrapped at arbitrary intervals, to minimize legibility? | bool | |
--no-preserveComments | Should comments in the code be retained (vs being stripped out)? | bool | |
--enableKeywordSubstitution | Should keywords with synonyms use less common forms? (NOTE: only safe for T-SQL!) | bool |
Please note, this command-line tool does NOT currently produce HTML (syntax-highlighted) output. This would be a reasonably trivial feature to add, it is definitely supported by the underlying library, but I haven't seen any realistic use-case. If you have one, please let me know (and/or fork, add the option(s), let me know).
This formatter effectively "inherits" all the functionality of the Poor Man's T-SQL Formatter library:
As noted in the JS library package doc (https://github.com/TaoK/poor-mans-t-sql-formatter-npm-package), this formatter is rather slow at the moment. On my laptop, formatting just a single query takes about half a second. That suggests that for bulk formatting workloads, it it might make sense to offer a wildcard/recursive file input/output option.
The encoding support is also very limited - as we use node's built-in encoding support, it comes down to utf-8 or utf-16le. It might be worth addressing this with the iconv-lite library, but adding even more code to load would also have its downsides. Something to think about.
Besides these things I'm not aware of any major outstanding concerns (vs for example the C# / .Net version of this same command-line formatter downloadable at http://architectshack.com/PoorMansTSqlFormatter.ashx), so any input / feature requests are welcome!
FAQs
A T-SQL formatting utility in JS, transpiled from the C# library of the same name.
The npm package poor-mans-t-sql-formatter-cli receives a total of 4 weekly downloads. As such, poor-mans-t-sql-formatter-cli popularity was classified as not popular.
We found that poor-mans-t-sql-formatter-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.