Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: prisma.d.ts is not properly saved #1090

Merged
merged 2 commits into from
Mar 7, 2024
Merged

fix: prisma.d.ts is not properly saved #1090

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c5b9d59
fix: prisma.d.ts is not properly saved
ymc9 Mar 7, 2024
bc5db1b
bump version
ymc9 Mar 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "zenstack-monorepo",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"description": "",
"scripts": {
"build": "pnpm -r build",
Expand Down
2 changes: 1 addition & 1 deletion packages/ide/jetbrains/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ plugins {
}

group = "dev.zenstack"
version = "2.0.0-alpha.1"
version = "2.0.0-alpha.4"

repositories {
mavenCentral()
Expand Down
2 changes: 1 addition & 1 deletion packages/ide/jetbrains/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "jetbrains",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"displayName": "ZenStack JetBrains IDE Plugin",
"description": "ZenStack JetBrains IDE plugin",
"homepage": "https://zenstack.dev",
Expand Down
2 changes: 1 addition & 1 deletion packages/language/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@zenstackhq/language",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"displayName": "ZenStack modeling language compiler",
"description": "ZenStack modeling language compiler",
"homepage": "https://zenstack.dev",
Expand Down
2 changes: 1 addition & 1 deletion packages/misc/redwood/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "@zenstackhq/redwood",
"displayName": "ZenStack RedwoodJS Integration",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"description": "CLI and runtime for integrating ZenStack with RedwoodJS projects.",
"repository": {
"type": "git",
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/openapi/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "@zenstackhq/openapi",
"displayName": "ZenStack Plugin and Runtime for OpenAPI",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"description": "ZenStack plugin and runtime supporting OpenAPI",
"main": "index.js",
"repository": {
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/swr/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "@zenstackhq/swr",
"displayName": "ZenStack plugin for generating SWR hooks",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"description": "ZenStack plugin for generating SWR hooks",
"main": "index.js",
"repository": {
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/tanstack-query/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "@zenstackhq/tanstack-query",
"displayName": "ZenStack plugin for generating tanstack-query hooks",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"description": "ZenStack plugin for generating tanstack-query hooks",
"main": "index.js",
"exports": {
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/trpc/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "@zenstackhq/trpc",
"displayName": "ZenStack plugin for tRPC",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"description": "ZenStack plugin for tRPC",
"main": "index.js",
"repository": {
Expand Down
3 changes: 2 additions & 1 deletion packages/plugins/trpc/tests/projects/t3-trpc-v10/.gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,4 +40,5 @@ yarn-error.log*

# typescript
*.tsbuildinfo
package-lock.json
package-lock.json
package.json
2 changes: 1 addition & 1 deletion packages/runtime/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "@zenstackhq/runtime",
"displayName": "ZenStack Runtime Library",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"description": "Runtime of ZenStack for both client-side and server-side environments.",
"repository": {
"type": "git",
Expand Down
2 changes: 1 addition & 1 deletion packages/schema/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"publisher": "zenstack",
"displayName": "ZenStack Language Tools",
"description": "Build scalable web apps with minimum code by defining authorization and validation rules inside the data schema that closer to the database",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"author": {
"name": "ZenStack Team"
},
Expand Down
16 changes: 10 additions & 6 deletions packages/schema/src/plugins/enhancer/enhance/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,9 @@ export async function generate(model: Model, options: PluginOptions, project: Pr
let logicalPrismaClientDir: string | undefined;
let dmmf: DMMF.Document | undefined;

if (needsLogicalClient(model)) {
const withLogicalClient = needsLogicalClient(model);

if (withLogicalClient) {
// schema contains delegate models, need to generate a logical prisma schema
const result = await generateLogicalPrisma(model, options, outDir);

Comment on lines 36 to 44
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 NOTE
This review was outside the diff hunks and was mapped to the diff hunk with the greatest overlap. Original lines [41-54]

The change from saveSourceFile to prismaDts.save() for saving the source file when withLogicalClient is true is a good improvement in terms of direct usage of the ts-morph library's capabilities. However, there's a potential security concern with the use of path.join without sanitizing or validating the outDir parameter, which could lead to path traversal vulnerabilities if outDir is influenced by user input.

To mitigate this, ensure that any user input influencing the outDir parameter is properly sanitized or validated before being used in path operations. Consider implementing a sanitization function or using existing libraries to help with this task.

- path.join(outDir, 'prisma.d.ts')
+ path.join(sanitizePath(outDir), 'prisma.d.ts')

Note: sanitizePath is a placeholder for the actual sanitization function you implement.

📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [333-335]

The dynamic construction of a regular expression using delegateModelNames.join('|') could potentially lead to Regular Expression Denial-of-Service (ReDoS) vulnerabilities if delegateModelNames is influenced by user input or can grow unbounded.

Consider validating delegateModelNames to ensure they do not contain patterns that could lead to inefficient regex matching. Alternatively, use a more efficient regex pattern or a different approach to achieve the desired functionality without risking ReDoS.

📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [356-358]

Similar to the previous comment regarding ReDoS vulnerabilities, dynamically constructing a regular expression with delegateInfo could pose a risk if the input is not properly validated or controlled.

Ensure that inputs to these regexes are validated or consider using hardcoded regexes instead. If dynamic construction is necessary, take steps to ensure the patterns are efficient and not susceptible to ReDoS.

Expand All @@ -49,15 +51,15 @@ export async function generate(model: Model, options: PluginOptions, project: Pr
`export type * from '${logicalPrismaClientDir}/index-fixed';`,
{ overwrite: true }
);
await saveSourceFile(prismaDts, options);
await prismaDts.save();
} else {
// just reexport the prisma client
const prismaDts = project.createSourceFile(
path.join(outDir, 'prisma.d.ts'),
`export type * from '${getPrismaClientImportSpec(outDir, options)}';`,
{ overwrite: true }
);
await saveSourceFile(prismaDts, options);
await prismaDts.save();
Comment on lines 58 to +62
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar to the previous comment, the use of path.join here also poses a potential security risk due to the possibility of path traversal vulnerabilities. It's crucial to ensure that the outDir parameter is sanitized or validated if it can be influenced by user input.

Implement a sanitization or validation step for the outDir parameter to prevent unauthorized file access.

- path.join(outDir, 'prisma.d.ts')
+ path.join(sanitizePath(outDir), 'prisma.d.ts')
Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation.

Suggested change
path.join(outDir, 'prisma.d.ts'),
`export type * from '${getPrismaClientImportSpec(outDir, options)}';`,
{ overwrite: true }
);
await saveSourceFile(prismaDts, options);
await prismaDts.save();
path.join(sanitizePath(outDir), 'prisma.d.ts'),
`export type * from '${getPrismaClientImportSpec(outDir, options)}';`,
{ overwrite: true }
);
await prismaDts.save();

}

const enhanceTs = project.createSourceFile(
Comment on lines 51 to 65
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [48-48]

Potential path traversal vulnerabilities detected due to user input influencing path operations. Ensure that any user input is sanitized or validated before being used in path operations to prevent unauthorized file access.

- path.join(outDir, 'prisma.d.ts')
+ path.join(sanitizePath(outDir), 'prisma.d.ts')

Note: sanitizePath is a placeholder for the actual sanitization function you implement.

Also applies to: 56-56, 64-64, 110-110, 136-136, 148-148, 163-163

📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [329-331]

Potential Regular Expression Denial-of-Service (ReDoS) vulnerabilities detected due to dynamically constructed regular expressions. Ensure that inputs to these regexes are validated or that the regex patterns are designed to be efficient and not susceptible to ReDoS.

- new RegExp(`\\${delegateModelNames.join('|')}(Unchecked)?(Create|Update).*Input`)
+ // Ensure delegateModelNames are validated or consider using a more efficient regex pattern

Also applies to: 352-354

Expand All @@ -67,16 +69,18 @@ import modelMeta from './model-meta';
import policy from './policy';
${options.withZodSchemas ? "import * as zodSchemas from './zod';" : 'const zodSchemas = undefined;'}
import { Prisma } from '${getPrismaClientImportSpec(outDir, options)}';
${logicalPrismaClientDir ? `import { type PrismaClient } from '${logicalPrismaClientDir}/index-fixed';` : ``}
${withLogicalClient ? `import { type PrismaClient } from '${logicalPrismaClientDir}/index-fixed';` : ``}

export function enhance<DbClient extends object>(prisma: DbClient, context?: EnhancementContext, options?: EnhancementOptions) {
export function enhance<DbClient extends object>(prisma: DbClient, context?: EnhancementContext, options?: EnhancementOptions)${
withLogicalClient ? ': PrismaClient' : ''
} {
return createEnhancement(prisma, {
modelMeta,
policy,
zodSchemas: zodSchemas as unknown as (ZodSchemas | undefined),
prismaModule: Prisma,
...options
}, context)${logicalPrismaClientDir ? ' as PrismaClient' : ''};
}, context)${withLogicalClient ? ' as PrismaClient' : ''};
}
`,
{ overwrite: true }
Comment on lines 69 to 86
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 NOTE
This review was outside the diff hunks and was mapped to the diff hunk with the greatest overlap. Original lines [66-83]

The creation and saving of the enhance.ts source file are correctly implemented. However, the use of path.join without sanitizing or validating the outDir parameter could lead to path traversal vulnerabilities, similar to the previous instances.

Ensure the outDir parameter is sanitized or validated to prevent potential security risks.

- path.join(outDir, 'enhance.ts')
+ path.join(sanitizePath(outDir), 'enhance.ts')

Expand Down
2 changes: 1 addition & 1 deletion packages/sdk/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@zenstackhq/sdk",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"description": "ZenStack plugin development SDK",
"main": "index.js",
"scripts": {
Expand Down
2 changes: 1 addition & 1 deletion packages/server/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@zenstackhq/server",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"displayName": "ZenStack Server-side Adapters",
"description": "ZenStack server-side adapters",
"homepage": "https://zenstack.dev",
Expand Down
2 changes: 1 addition & 1 deletion packages/testtools/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@zenstackhq/testtools",
"version": "2.0.0-alpha.2",
"version": "2.0.0-alpha.4",
"description": "ZenStack Test Tools",
"main": "index.js",
"private": true,
Expand Down
Loading