Escape character update; README
This commit is contained in:
Sean Edmunds
88
server.cjs
88
server.cjs
@@ -5,6 +5,7 @@ const fs = require("node:fs");
|
||||
const wol = require("wol");
|
||||
const mariadb = require("mariadb");
|
||||
const bodyParser = require("body-parser");
|
||||
const escapeString = require("sql-escape-string");
|
||||
|
||||
const pool = mariadb.createPool({
|
||||
host: process.env.DB_HOST,
|
||||
@@ -13,33 +14,6 @@ const pool = mariadb.createPool({
|
||||
connectionLimit: 5,
|
||||
});
|
||||
|
||||
function sqlEscape(str) {
|
||||
return str.replace(/[\0\x08\x09\x1a\n\r"'\\\%]/g, (char) => {
|
||||
switch (char) {
|
||||
case "\0":
|
||||
return "\\0";
|
||||
case "\x08":
|
||||
return "\\b";
|
||||
case "\x09":
|
||||
return "\\t";
|
||||
case "\x1a":
|
||||
return "\\z";
|
||||
case "\n":
|
||||
return "\\n";
|
||||
case "\r":
|
||||
return "\\r";
|
||||
case '"':
|
||||
case "'":
|
||||
case "\\":
|
||||
case "%":
|
||||
return `\\${char}`; // prepends a backslash to backslash, percent,
|
||||
// and double/single quotes
|
||||
default:
|
||||
return char;
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// initializing app
|
||||
const app = express();
|
||||
|
||||
@@ -63,7 +37,7 @@ app.get("/trigger/api/personalData", async (req, res) => {
|
||||
|
||||
app.patch("/trigger/api/personalData", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `UPDATE trigger_database.personalData SET firstName = '${sqlEscape(req.body.firstName)}', lastName = '${sqlEscape(req.body.lastName)}', email = '${sqlEscape(req.body.email)}', physicalAddress = '${sqlEscape(req.body.physicalAddress)}';`;
|
||||
const query = `UPDATE trigger_database.personalData SET firstName = ${escapeString(req.body.firstName)}, lastName = ${escapeString(req.body.lastName)}, email = ${escapeString(req.body.email)}, physicalAddress = ${escapeString(req.body.physicalAddress)};`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -86,7 +60,7 @@ app.get("/trigger/api/messages", async (req, res) => {
|
||||
|
||||
app.post("/trigger/api/messages", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `INSERT INTO trigger_database.messages (message) VALUES ('${sqlEscape(req.body.message)}');`;
|
||||
const query = `INSERT INTO trigger_database.messages (message) VALUES (${escapeString(req.body.message)});`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -100,7 +74,7 @@ app.post("/trigger/api/messages", async (req, res) => {
|
||||
|
||||
app.patch("/trigger/api/messages", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `UPDATE trigger_database.messages SET message = '${sqlEscape(req.body.message)}' WHERE id = '${req.body.id}';`;
|
||||
const query = `UPDATE trigger_database.messages SET message = ${escapeString(req.body.message)} WHERE id = ${req.body.id};`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -114,7 +88,7 @@ app.patch("/trigger/api/messages", async (req, res) => {
|
||||
|
||||
app.delete("/trigger/api/messages", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `DELETE FROM trigger_database.messages WHERE id = '${req.body.id}';`;
|
||||
const query = `DELETE FROM trigger_database.messages WHERE id = ${req.body.id};`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -137,7 +111,7 @@ app.get("/trigger/api/apps", async (req, res) => {
|
||||
|
||||
app.post("/trigger/api/apps", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `INSERT INTO trigger_database.apps (name, url, icon, baseUrl, filterName, enabled, \`index\`) VALUES ('${sqlEscape(req.body.name)}', '${sqlEscape(req.body.url)}', '${sqlEscape(req.body.icon)}', '${sqlEscape(req.body.baseUrl)}', '${sqlEscape(req.body.filterName)}', ${req.body.enabled}, ${req.body.index});`;
|
||||
const query = `INSERT INTO trigger_database.apps (name, url, icon, baseUrl, filterName, enabled, \`index\`) VALUES (${escapeString(req.body.name)}, ${escapeString(req.body.url)}, ${escapeString(req.body.icon)}, ${escapeString(req.body.baseUrl)}, ${escapeString(req.body.filterName)}, ${req.body.enabled}, ${req.body.index});`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -151,7 +125,7 @@ app.post("/trigger/api/apps", async (req, res) => {
|
||||
|
||||
app.patch("/trigger/api/apps", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `UPDATE trigger_database.apps SET name = '${sqlEscape(req.body.name)}', url = '${sqlEscape(req.body.url)}', icon = '${sqlEscape(req.body.icon)}', baseUrl = '${sqlEscape(req.body.baseUrl)}', filterName = '${sqlEscape(req.body.filterName)}', enabled = ${req.body.enabled} WHERE id = '${req.body.id}';`;
|
||||
const query = `UPDATE trigger_database.apps SET name = ${escapeString(req.body.name)}, url = ${escapeString(req.body.url)}, icon = ${escapeString(req.body.icon)}, baseUrl = ${escapeString(req.body.baseUrl)}, filterName = ${escapeString(req.body.filterName)}, enabled = ${req.body.enabled} WHERE id = ${req.body.id};`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -165,7 +139,7 @@ app.patch("/trigger/api/apps", async (req, res) => {
|
||||
|
||||
app.delete("/trigger/api/apps", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `DELETE FROM trigger_database.apps WHERE id = '${req.body.id}'`;
|
||||
const query = `DELETE FROM trigger_database.apps WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -198,7 +172,7 @@ app.get("/trigger/api/links", async (req, res) => {
|
||||
|
||||
app.post("/trigger/api/links", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `INSERT INTO trigger_database.links (name, url, category, \`index\`) VALUES ('${sqlEscape(req.body.name)}', '${sqlEscape(req.body.url)}', '${sqlEscape(req.body.category)}', ${req.body.index});`;
|
||||
const query = `INSERT INTO trigger_database.links (name, url, category, \`index\`) VALUES (${escapeString(req.body.name)}, ${escapeString(req.body.url)}, ${escapeString(req.body.category)}, ${req.body.index});`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -212,7 +186,7 @@ app.post("/trigger/api/links", async (req, res) => {
|
||||
|
||||
app.patch("/trigger/api/links", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `UPDATE trigger_database.links SET name = '${sqlEscape(req.body.name)}', url = '${sqlEscape(req.body.url)}', category = '${sqlEscape(req.body.category)}' WHERE id = '${req.body.id}'`;
|
||||
const query = `UPDATE trigger_database.links SET name = ${escapeString(req.body.name)}, url = ${escapeString(req.body.url)}, category = ${escapeString(req.body.category)} WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -226,19 +200,17 @@ app.patch("/trigger/api/links", async (req, res) => {
|
||||
|
||||
app.delete("/trigger/api/links", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
if(req.body.length > 1) {
|
||||
if (req.body.length > 1) {
|
||||
req.body.map((link) => {
|
||||
conn
|
||||
.query("DELETE FROM trigger_database.links where id IN (?)", [
|
||||
link.id,
|
||||
])
|
||||
.query("DELETE FROM trigger_database.links where id IN (?)", [link.id])
|
||||
.then((rows) => {
|
||||
res.status(200);
|
||||
});
|
||||
});
|
||||
res.send({ status: "success" });
|
||||
} else {
|
||||
const query = `DELETE FROM trigger_database.links WHERE id = '${req.body.id}'`;
|
||||
const query = `DELETE FROM trigger_database.links WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -262,7 +234,7 @@ app.get("/trigger/api/providers", async (req, res) => {
|
||||
|
||||
app.post("/trigger/api/providers", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `INSERT INTO trigger_database.providers (name, url, prefix) VALUES ('${sqlEscape(req.body.name)}', '${req.body.url}', '${req.body.prefix}')`;
|
||||
const query = `INSERT INTO trigger_database.providers (name, url, prefix) VALUES (${escapeString(req.body.name)}, ${req.body.url}, ${req.body.prefix})`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -276,7 +248,7 @@ app.post("/trigger/api/providers", async (req, res) => {
|
||||
|
||||
app.patch("/trigger/api/providers", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `UPDATE trigger_database.providers SET name = '${sqlEscape(req.body.name)}', url = '${sqlEscape(req.body.url)}', prefix = '${sqlEscape(req.body.prefix)}' WHERE id = '${req.body.id}'`;
|
||||
const query = `UPDATE trigger_database.providers SET name = ${escapeString(req.body.name)}, url = ${escapeString(req.body.url)}, prefix = ${escapeString(req.body.prefix)} WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -290,7 +262,7 @@ app.patch("/trigger/api/providers", async (req, res) => {
|
||||
|
||||
app.delete("/trigger/api/providers", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `DELETE FROM trigger_database.providers WHERE id = '${req.body.id}'`;
|
||||
const query = `DELETE FROM trigger_database.providers WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -313,7 +285,7 @@ app.get("/trigger/api/themes", async (req, res) => {
|
||||
|
||||
app.post("/trigger/api/themes", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `INSERT INTO trigger_database.themes (name, backgroundImage, backgroundColor, searchColor, primaryColor, accentColor, borderColor) VALUES ('${sqlEscape(req.body.name)}','${sqlEscape(req.body.backgroundImage)}','${req.body.backgroundColor}','${req.body.searchColor}','${req.body.primaryColor}','${req.body.accentColor}','${req.body.borderColor}')`;
|
||||
const query = `INSERT INTO trigger_database.themes (name, backgroundImage, backgroundColor, searchColor, primaryColor, accentColor, borderColor) VALUES (${escapeString(req.body.name)},${escapeString(req.body.backgroundImage)},${req.body.backgroundColor},${req.body.searchColor},${req.body.primaryColor},${req.body.accentColor},${req.body.borderColor})`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -327,7 +299,7 @@ app.post("/trigger/api/themes", async (req, res) => {
|
||||
|
||||
app.patch("/trigger/api/themes", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `UPDATE trigger_database.themes SET name = '${sqlEscape(req.body.name)}', backgroundImage = '${sqlEscape(req.body.backgroundImage)}', backgroundColor = '${req.body.backgroundColor}', searchColor = '${req.body.searchColor}', primaryColor = '${req.body.primaryColor}', accentColor = '${req.body.accentColor}', borderColor = '${req.body.borderColor}', randomEnabled = '${req.body.randomEnabled ? 1 : 0}' WHERE id = '${req.body.id}';`;
|
||||
const query = `UPDATE trigger_database.themes SET name = ${escapeString(req.body.name)}, backgroundImage = ${escapeString(req.body.backgroundImage)}, backgroundColor = ${req.body.backgroundColor}, searchColor = ${req.body.searchColor}, primaryColor = ${req.body.primaryColor}, accentColor = ${req.body.accentColor}, borderColor = ${req.body.borderColor}, randomEnabled = ${req.body.randomEnabled ? 1 : 0} WHERE id = ${req.body.id};`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -341,7 +313,7 @@ app.patch("/trigger/api/themes", async (req, res) => {
|
||||
|
||||
app.delete("/trigger/api/themes", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `DELETE FROM trigger_database.themes WHERE id = '${req.body.id}'`;
|
||||
const query = `DELETE FROM trigger_database.themes WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -370,7 +342,7 @@ app.get("/trigger/api/themePlaylists", async (req, res) => {
|
||||
|
||||
app.post("/trigger/api/themePlaylists", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `INSERT INTO trigger_database.themePlaylists (name, themeList) VALUES ('${sqlEscape(req.body.name)}','${sqlEscape(req.body.themeList)}');`;
|
||||
const query = `INSERT INTO trigger_database.themePlaylists (name, themeList) VALUES (${escapeString(req.body.name)},${escapeString(req.body.themeList)});`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -384,7 +356,7 @@ app.post("/trigger/api/themePlaylists", async (req, res) => {
|
||||
|
||||
app.patch("/trigger/api/themePlaylists", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `UPDATE trigger_database.themePlaylists SET name = '${sqlEscape(req.body.name)}', themeList = '${req.body.themeList}' WHERE id = '${req.body.id}';`;
|
||||
const query = `UPDATE trigger_database.themePlaylists SET name = ${escapeString(req.body.name)}, themeList = ${req.body.themeList} WHERE id = ${req.body.id};`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -398,7 +370,7 @@ app.patch("/trigger/api/themePlaylists", async (req, res) => {
|
||||
|
||||
app.delete("/trigger/api/themePlaylists", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `DELETE FROM trigger_database.themePlaylists WHERE id = '${req.body.id}'`;
|
||||
const query = `DELETE FROM trigger_database.themePlaylists WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -421,7 +393,7 @@ app.get("/trigger/api/categories", async (req, res) => {
|
||||
|
||||
app.post("/trigger/api/categories", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `INSERT INTO trigger_database.linkCategories (categoryName, categoryIndex, filterName) VALUES ('${sqlEscape(req.body.categoryName)}','${req.body.categoryIndex || 0}','${sqlEscape(req.body.filterName)}')`;
|
||||
const query = `INSERT INTO trigger_database.linkCategories (categoryName, categoryIndex, filterName) VALUES (${escapeString(req.body.categoryName)},${req.body.categoryIndex || 0},${escapeString(req.body.filterName)})`;
|
||||
conn.query(query).then((rows) => {
|
||||
res.status(200).send({ status: "success" });
|
||||
});
|
||||
@@ -430,7 +402,7 @@ app.post("/trigger/api/categories", async (req, res) => {
|
||||
|
||||
app.patch("/trigger/api/categories", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `UPDATE trigger_database.linkCategories SET categoryName = '${sqlEscape(req.body.categoryName)}', filterName = '${sqlEscape(req.body.filterName)}' WHERE id = '${req.body.id}';`;
|
||||
const query = `UPDATE trigger_database.linkCategories SET categoryName = ${escapeString(req.body.categoryName)}, filterName = ${escapeString(req.body.filterName)} WHERE id = ${req.body.id};`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -444,7 +416,7 @@ app.patch("/trigger/api/categories", async (req, res) => {
|
||||
|
||||
app.delete("/trigger/api/categories", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `DELETE FROM trigger_database.linkCategories WHERE id = '${req.body.id}'`;
|
||||
const query = `DELETE FROM trigger_database.linkCategories WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -515,7 +487,7 @@ app.get("/trigger/api/wolClients", async (req, res) => {
|
||||
|
||||
app.post("/trigger/api/wolClients", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `INSERT INTO trigger_database.wolClients (hostname, macAddress) VALUES ('${sqlEscape(req.body.hostname)}', '${sqlEscape(req.body.macAddress)}')`;
|
||||
const query = `INSERT INTO trigger_database.wolClients (hostname, macAddress) VALUES (${escapeString(req.body.hostname)}, ${escapeString(req.body.macAddress)})`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -530,7 +502,7 @@ app.post("/trigger/api/wolClients", async (req, res) => {
|
||||
|
||||
app.patch("/trigger/api/wolClients", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `UPDATE trigger_database.wolClients SET hostname = '${sqlEscape(req.body.hostname)}', macAddress = '${sqlEscape(req.body.macAddress)}' WHERE id = '${req.body.id}'`;
|
||||
const query = `UPDATE trigger_database.wolClients SET hostname = ${escapeString(req.body.hostname)}, macAddress = ${escapeString(req.body.macAddress)} WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -545,7 +517,7 @@ app.patch("/trigger/api/wolClients", async (req, res) => {
|
||||
|
||||
app.delete("/trigger/api/wolClients", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `DELETE FROM trigger_database.wolClients WHERE id = '${req.body.id}'`;
|
||||
const query = `DELETE FROM trigger_database.wolClients WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -575,7 +547,7 @@ app.get("/trigger/api/searchHistory", async (req, res) => {
|
||||
|
||||
app.post("/trigger/api/searchHistory", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `INSERT INTO trigger_database.searchHistory (prefix, provider, searchTerm) VALUES ('${sqlEscape(req.body.prefix)}', '${sqlEscape(req.body.provider)}', '${sqlEscape(req.body.searchTerm)}')`;
|
||||
const query = `INSERT INTO trigger_database.searchHistory (prefix, provider, searchTerm) VALUES (${escapeString(req.body.prefix)}, ${escapeString(req.body.provider)}, ${escapeString(req.body.searchTerm)})`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
@@ -589,7 +561,7 @@ app.post("/trigger/api/searchHistory", async (req, res) => {
|
||||
|
||||
app.delete("/trigger/api/searchHistory", async (req, res) => {
|
||||
const conn = await pool.getConnection();
|
||||
const query = `DELETE FROM trigger_database.searchHistory WHERE id = '${req.body.id}'`;
|
||||
const query = `DELETE FROM trigger_database.searchHistory WHERE id = ${req.body.id}`;
|
||||
conn
|
||||
.query(query)
|
||||
.then((rows) => {
|
||||
|
||||
Reference in New Issue
Block a user