authress-engineering / dynamodb-armor Goto Github PK

const keyExpressionTokens = parseExpression(originalParams.KeyConditionExpression);
    const filterExpressionTokens = parseExpression(originalParams.FilterExpression);
    const matchingFilterExpressionKey = Object.keys(filterExpressionTokens.keys).some(filterKey => Object.keys(keyExpressionTokens.keys)
    .some(keyKey => originalParams.ExpressionAttributeNames[keyKey] === originalParams.ExpressionAttributeNames[filterKey]));
    
    // TODO: convert this from a error generation to in memory filtering
    if (matchingFilterExpressionKey) {
      throw new DynamoDbError({ title: 'DynamoDB disallows having a FilterExpression contain ', key: matchingFilterExpressionKey, parameters: originalParams }, 'InvalidExpression');
    }

for (const partialExpression of partialExpressions) {
    const partialExpressionOrderedTokens = (partialExpression || '').replace(/^(DELETE|ADD|SET|REMOVE)\s+/i, '')
    .trim().split(',').filter(token => token).map(token => token.trim());

    const isValidKey = operand => operand.match(/^#\w+(\.#\w)*$/);
    const isValidOperand = operand => operand.match(/^:\w+$/) || operand.match(/^(#\w+(\.#\w)*|:\w+)[-+](#\w+(\.#\w)*|:\w+)$/);
    
    const arrayIterator = partialExpressionOrderedTokens[Symbol.iterator]();
    let result;
    
    while ((result = arrayIterator.next()) && !result.done) {
      const key = arrayIterator.next().value;
      const equalSign = arrayIterator.next().value;
      const operand = arrayIterator.next().value;

      if (!isValidKey(key) || equalSign !== '=' || !isValidOperand(operand)) {
        logger({ code: 'InvalidExpression', expression });
        throw new DynamoDbError({
          title: 'Invalid Expression: the expression does not match what DynamoDB expects: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Expressions.UpdateExpressions.html', expression,
          tokens: [key, equalSign, operand]
        }, 'InvalidExpression');
      }
      
      // parseExpressionRecursive(token, orderedTokens);
    }
  }