joe/OptiTrainer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Various fixes, SQL injection prevention (escaping) and basic web-server. Also remove the fake data file of 7mb...

Browse Source
This commit is contained in:
Joe Tretter
2020-04-22 21:10:21 -05:00
parent 886467327c
commit 07ceb58dda
7 changed files with 39 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
server/index.js
View File

@@ -1,6 +1,7 @@
const micro = require('micro');
const queryString = require('querystring');
const Database = require('better-sqlite3');
const fs = require('fs');
module.exports = (req, res) => {
console.log(req.method, req.url);
@@ -8,7 +9,8 @@ module.exports = (req, res) => {
//console.log(res);
if (req.method === "GET") {
console.log("Get Request coming in");
let qsAttr;
String.prototype.mySqlEsc = function(){return(this.replace(/'/g,"''"))};
let qsAttr;
let func=req.url;
if (req.url.indexOf("?") >=0){
func=req.url.substring(0,req.url.indexOf("?"))
@@ -23,6 +25,7 @@ module.exports = (req, res) => {
//console.log(JSON.stringify(allDates));
db.close();
micro.send(res,200,allDates);
return(true);
}
if (func === "/getSymbols") {
console.log("Request for Symbols");
@@ -32,6 +35,7 @@ module.exports = (req, res) => {
//console.log(JSON.stringify(allDates));
db.close();
micro.send(res,200,allDates);
return(true);
}
if (func === "/getDates") {
console.log("Request for Dates");
@@ -41,16 +45,17 @@ module.exports = (req, res) => {
//console.log(JSON.stringify(allDates));
db.close();
micro.send(res,200,allDates);
return(true);
}
if (func === "/getTimes") {
console.log("Request for Times");
const db = new Database('./quoteDBs/consolidated.sqlite3', { verbose: console.log });
let sql = "SELECT distinct time(TimeStamp,'localtime') Time FROM OptionQuotes where 1=1"
if (qsAttr.Symbol) {
sql +=" and Symbol='" + qsAttr.Symbol+ "'";
sql +=" and Symbol='" + qsAttr.Symbol.mySqlEsc() + "'";
}
if (qsAttr.Date){
sql +=" and date(TimeStamp,'localtime')='" + qsAttr.Date+ "'";
sql +=" and date(TimeStamp,'localtime')='" + qsAttr.Date.mySqlEsc() + "'";
}
sql+=" order by 1";
const stmt = db.prepare(sql);
@@ -58,19 +63,20 @@ module.exports = (req, res) => {
//console.log(JSON.stringify(allDates));
db.close();
micro.send(res,200,allDates);
return(true);
}
if (func === "/getOptionChain") {
console.log("Request for OptionChain");
const db = new Database('./quoteDBs/consolidated.sqlite3', { verbose: console.log });
let sql = "SELECT Data FROM OptionQuotes where 1=1"
if (qsAttr.Symbol) {
sql +=" and Symbol='" + qsAttr.Symbol+ "'"
sql +=" and Symbol='" + qsAttr.Symbol.mySqlEsc() + "'"
}
if (qsAttr.Date){
sql +=" and date(TimeStamp,'localtime')='" + qsAttr.Date+ "'";
sql +=" and date(TimeStamp,'localtime')='" + qsAttr.Date.mySqlEsc() + "'";
}
if (qsAttr.Time){
sql +=" and time(TimeStamp,'localtime')='" + qsAttr.Time+ "'";
sql +=" and time(TimeStamp,'localtime')='" + qsAttr.Time.mySqlEsc() + "'";
}
const stmt = db.prepare(sql);
@@ -78,8 +84,27 @@ module.exports = (req, res) => {
//console.log(JSON.stringify(allDates));
db.close();
micro.send(res,200,allDates);
return(true);
}
console.log("Request for File");
// Anything else we deliver as file data
if (func === "/") { func += 'index.html';}
// this is very basic protection only...
if ((func.indexOf("..") === -1) && (func.indexOf("~") === -1) && (func.indexOf("favicon ") === -1) ){
res.setHeader('Content-Type', 'text/html');
fs.readFile(".."+func, (err,filecontent)=>{
if (err) {
micro.send(res,500,err);
} else {
micro.send(res,200,filecontent);
}
});
} else {
res.setHeader('Content-Type', 'text/html');
micro.send(res,401,"Invalid file to serve");
}
}
}