<commit_before>"use strict";

var _ = require('lodash');
var builder = require('./queryBuilder');

var buildOrderStatement = function(query, orders) {
  return orders.map(value => {
    let type = value.split('.');
    let name = type[0];
    let orderType = type[1].toLowerCase();

    if (orderType !== 'asc' && orderType !== 'desc') {
      throw new Error('Invalid order \'' + orderType + '\', valid values are \'desc\' or \'asc\'');
    }

    return query.order(name, orderType === 'asc');
  });
};

module.exports = function (db, logger) {
  var limit = '';

  return function *(table, params, callback) {
    var promise;
    // get the queried columns, remove the reserved words, as they are not columns
    var columns = _.keys(_.omit(params,
      'order', 'limit'
    ));

    // to prevent simple sql injection
    if (table.match(/;/)) {
      return Promise.reject(new Error('Syntax error'))
    }

    var query = builder.squel.select().from(table);

    // build order statement
    if (params.order !== undefined) {
      try {
        buildOrderStatement(query, params.order.split(','));
      }
      catch(error) {
        return Promise.reject(error);
      }
    }

    // build the limit statement
    if (params.limit !== undefined) {
      query.limit(parseInt(params.limit));
    }

    if (columns.length !== 0) {
      query.where(builder.buildWhereExpression(columns, params));
    }

    query = query.toString();
    promise = db.query(query);

    logger.debug(query);

    return promise.then(callback);
  };
};<commit_msg>Use parameterized queries when fetching data<commit_after>"use strict";

var _ = require('lodash');
var builder = require('./queryBuilder');

var buildOrderStatement = function(query, orders) {
  return orders.map(value => {
    let type = value.split('.');
    let name = type[0];
    let orderType = type[1].toLowerCase();

    if (orderType !== 'asc' && orderType !== 'desc') {
      throw new Error('Invalid order \'' + orderType + '\', valid values are \'desc\' or \'asc\'');
    }

    return query.order(name, orderType === 'asc');
  });
};

module.exports = function (db, logger) {
  var limit = '';

  return function *(table, params, callback) {
    var promise;
    // get the queried columns, remove the reserved words, as they are not columns
    var columns = _.keys(_.omit(params,
      'order', 'limit'
    ));

    // to prevent simple sql injection
    if (table.match(/;/)) {
      return Promise.reject(new Error('Syntax error'))
    }

    var query = builder.squel.select().from(table);

    // build order statement
    if (params.order !== undefined) {
      try {
        buildOrderStatement(query, params.order.split(','));
      }
      catch(error) {
        return Promise.reject(error);
      }
    }

    // build the limit statement
    if (params.limit !== undefined) {
      query.limit(parseInt(params.limit));
    }

    if (columns.length !== 0) {
      query.where(builder.buildWhereExpression(columns, params));
    }

    logger.debug(query.toString());

    query = query.toParam();
    promise = db.query(query.text, query.values);

    return promise.then(callback);
  };
};
{'fraction_non_alphanumeric': 0.1600504095778198, 'fraction_numerical': 0.001890359168241966, 'mean_word_length': 2.788782816229117, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6456918', 'n_tokens_mistral': 945, 'n_tokens_neox': 922, 'n_words': 244}