Skip to content

1.5.0 Security-Focused Release

Choose a tag to compare

View all tags
@velkymx velkymx released this 12 Dec 00:38
· 187 commits to main since this release
1.5.0
42b2418
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⏺ Release Notes: v1.5.0

Security-Focused Release

Version 1.5.0 is a major security update that addresses critical vulnerabilities and adds enterprise-grade
security features to ts-orm. This release focuses on preventing SQL injection attacks, enhancing input
validation, and protecting sensitive information through error sanitization.

Highlights

  • SQL Injection Prevention: Hybrid validation and escaping for all database identifiers
  • Enhanced Validation: Strict format checking for UUID, datetime, date, and boolean types
  • Error Sanitization: Protected error messages prevent schema information leakage
  • Security Test Suite: 9 new tests covering injection attempts and validation edge cases

Security Enhancements

SQL Injection Prevention

  • ✅ All table names validated and escaped before query execution
  • ✅ All column names validated and escaped (WHERE, SET, ORDER BY, JOIN clauses)
  • ✅ Qualified identifiers (e.g., table.column) validated in JOIN operations
  • ✅ Hybrid approach: Pattern validation [a-zA-Z0-9_] + mysql2 escapeId()
  • ✅ Protection against common injection vectors:
    • Malicious table names: users; DROP TABLE users--
    • Malicious ORDER BY: id; DROP TABLE--
    • Malicious WHERE conditions: id' OR '1'='1

Enhanced Input Validation

  • ✅ UUID v4 format validation: Regex pattern
    /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
  • ✅ Datetime format validation: YYYY-MM-DD HH:MM:SS with range checks (month 1-12, day 1-31, hour 0-23,
    etc.)
  • ✅ Date format validation: YYYY-MM-DD with validity checks using Date object
  • ✅ Boolean type validation: Accepts true, false, 0, 1, '0', '1'
  • ✅ Enum null handling: Properly allows null/undefined for non-required enum fields
  • ✅ Required field fix: Now allows falsy values like false and 0 but rejects undefined/null

Error Sanitization

  • ✅ Database errors mapped to safe, generic messages
  • ✅ Full error details logged server-side with console.error()
  • ✅ Schema information never exposed to clients
  • ✅ Error mappings:
    • ER_DUP_ENTRY → "Record already exists"
    • ER_NO_REFERENCED_ROW → "Related record not found"
    • ER_ROW_IS_REFERENCED → "Cannot delete record - it is referenced by other records"
    • All other errors → "Database operation failed"
Assets 2
Loading