如何使用electron.js安全地进行SQL调用

0pizxfdo  于 2023-06-20  发布在  Electron
关注(0)|答案(1)|浏览(250)

我正在开发一个系统,需要我查询一个SQL数据库,它位于本地网络上,但不是在同一个系统上(不是SQLExpress。)
我已经设法查询用户在网页上的输入,并将该信息发送到Main.JS,但我不确定查询数据库的最有效方法。
我对SQL和electron.js都很陌生,所以最好有很多细节,谢谢!
在其他Stack Overflow问题(notably)之后,我有:
preload.js:

const invoke = (channel, args, cb = () => { return }) => {
    ipcRenderer.invoke(channel, args).then((res) => {
        cb(res);
    });
};

const handle = (channel, cb) => {
    ipcRenderer.on(channel, function (Event, message) {
        cb(Event, message);
    });
};

contextBridge.exposeInMainWorld("GlobalApi", {
    invoke: invoke,
    handle: handle
});

let get = function (path) {
    let data = dbFuncions.readSomeDatafromDB("path");
    return data; // Returning the function itself is a no-no shown below
    // return dbFunctions.readSomeDatafromDB("path"); Don't do this
}
contextBridge.exposeInMainWorld("myCoolApi", {
    get: get
});

renderer.js:

const { ipcRenderer } = require('electron');
const loginForm = document.getElementById('login-form');
const usernameInput = document.getElementById('username');
const passwordInput = document.getElementById('password');

loginForm.addEventListener('submit', (event) => {
    event.preventDefault();

    const username = usernameInput.value;
    const password = passwordInput.value;

    // This runs when the user submits their username and password.
    ipcRenderer.send('login', { username, password });
});

// This runs when the username and password has been checked (in main.js) and a success (true) or failure (false) has been recieved.
ipcRenderer.on('login-status', (event, isSuccess) => {
    const failureMessage = document.createElement('p');
    const successMessage = document.createElement('p');
    if (isSuccess) {
        successMessage.textContent = 'Login successful';
        successMessage.style.color = 'green';
        loginForm.appendChild(successMessage);
        setTimeout(() => {
            loginForm.removeChild(successMessage);
        }, 2000);
    } else {
        failureMessage.textContent = 'Incorrect details.';
        failureMessage.style.color = 'red';
        loginForm.appendChild(failureMessage);
        setTimeout(() => {
            loginForm.removeChild(failureMessage);
        }, 2000);
    }
});

main.js:

const { app, BrowserWindow, ipcMain } = require('electron');
var Connection = require('tedious').Connection;
var Request = require('tedious').Request
var TYPES = require('tedious').TYPES;
var dbFunctions = require('sql') //I know I'm missing a function here. The 'sql module' mentioned in the Stack Overflow 
const path = require('path');
let mainWindow;

var config = {
    server: 'your_server.database.windows.net',  //update me
    authentication: {
        type: 'default',
        options: {
            userName: 'your_username', //update me
            password: 'your_password'  //update me
        }
    },
    options: {
        // If modifying to work with Microsoft Azure (which I'm not), you need encryption:
        encrypt: true,
        database: 'your_database'  //update me
    }
};  
var connection = new Connection(config);
connection.on('connect', function (err) {
    // If no error, then good to proceed.  
    console.log("Connected");
    executeStatementLogin();
});

function executeStatementLogin() {
    // This needs updating!
    var request = new Request("SELECT username, password FROM table_name WHERE username = " + , function (err) {
        if (err) {
            console.log(err);
        }
    });
    // This needs updating!
    request.addParameter('Name', TYPES.NVarChar, 'SQL Server Express 2019');
    request.addParameter('Number', TYPES.NVarChar, 'SQLEXPRESS2019');
    request.addParameter('Cost', TYPES.Int, 11);
    request.addParameter('Price', TYPES.Int, 11);
    request.on('row', function (columns) {
        columns.forEach(function (column) {
            if (column.value === null) {
                console.log('NULL');
            } else {
                console.log("Product id of inserted item is " + column.value);
            }
        });
    });

    // Close the connection after the final event emitted by the request, after the callback passes
    request.on("requestCompleted", function (rowCount, more) {
        connection.close();
    });
}
function createWindow() {
    mainWindow = new BrowserWindow({
        width: 800,
        height: 600,
        webPreferences: {
            nodeIntegration: true,
            contextIsolation: false,
            enableWebSQL: true,
            preload: path.join(__dirname, 'preload.js')
        },
    });

    mainWindow.loadFile(path.join(__dirname, 'index.html'));

    mainWindow.on('closed', () => {
        mainWindow = null;
    });
}

app.on('ready', () => {
    createWindow();
});

app.on('window-all-closed', () => {
    if (process.platform !== 'darwin') {
        app.quit();
    }
});

// This is old code that I made. This runs when the user clicks submit and has username and password. This could be modified to do the SQL query, too
ipcMain.on('login', (event, loginData) => {
    const { username, password } = loginData;

    // Here, you can perform the necessary login verification logic
    // For demonstration purposes, we'll just log the username and password
    console.log(`Received login request. Username: ${username}, Password: ${password}`);

    let data = dbFunctions.get(path);

    window.webContents.send(
        path,
        data

    );
    if (username == 'exampletest' && password == 'testexample') { //Hardcoded solution to test if ifSuccess works and the result gets sent back (which it does)
        isSuccess = true
    } else {
        isSuccess = false
    }
    

    setTimeout(() => {
        event.reply('login-status', isSuccess);
    }, 2000);
});

on('login ',(event,loginData)=>是我做的旧代码。它具有用户已经输入的用户名和密码。通过在此创建SQL查询并执行此查询,可以潜在地修改此查询以执行SQL。
或者,修改解决方案,我发现here是所有的preload.js和配置,连接,类型,dbFunctions,请求和executeStatementLogin在main.js。
当我运行程序时,它会加载,但是在提交时会给出一个运行时错误。两种解决方案同时运行。我的解决方案工作正常(但没有实现SQL),而另一种解决方案抛出一个错误,即dbFunctions没有“get”函数。这是因为我不知道实际用于GET dbFunctions的SQL模块是什么,因为它似乎从未被指定。一旦我有了dbFunctions,我就可以开始修改需要更新的代码(//update me),尽管我不确定如何根据用户输入修改配置文件中的用户名和密码。
任何帮助都将不胜感激。谢谢!(假设我什么都不知道)

pb3s4cty

pb3s4cty1#

这里已经有类似的问题了:Electron Secure Mysql Credentials
此外,您永远不应该将凭据嵌入到电子应用程序中,因为它绝对不安全。您的应用程序不应直接调用SQL后端。

相关问题