Various fixes, SQL injection prevention (escaping) and basic web-server. Also remove the fake data file of 7mb...

index.html

@@ -11,7 +11,6 @@
 
 <!-- app-css -->
 <link rel="stylesheet" href="css/optiTrainer.css">
-<script src='js/spyDataFake.js'></script>
 <script src='js/optiTrainer.js'></script>
 <script src='js/masterFilter.js'></script>
 

js/optiTrainer.js

@@ -3,7 +3,7 @@ var allCombinations;
 var optionChainContext={};
 
 $(document).ready(_=>{
-	dta=fakeDta;
+	dta={};
 	allCombinations=$.get("http://localhost:3000/getCombinations",
 		data=>{allCombinations=data;},
 		"json");

server/index.js

@@ -1,6 +1,7 @@
 const micro = require('micro');
 const queryString = require('querystring');
 const Database = require('better-sqlite3');
+const fs = require('fs');
 
 module.exports = (req, res) => {
     console.log(req.method, req.url);
@@ -8,6 +9,7 @@ module.exports = (req, res) => {
     //console.log(res);
     if (req.method === "GET") {
         console.log("Get Request coming in");
+		String.prototype.mySqlEsc = function(){return(this.replace(/'/g,"''"))};
         let qsAttr; 
         let func=req.url;
         if (req.url.indexOf("?") >=0){
@@ -23,6 +25,7 @@ module.exports = (req, res) => {
             //console.log(JSON.stringify(allDates)); 
             db.close(); 
             micro.send(res,200,allDates);
+			return(true);
         }
         if (func === "/getSymbols") {
             console.log("Request for Symbols");
@@ -32,6 +35,7 @@ module.exports = (req, res) => {
             //console.log(JSON.stringify(allDates)); 
             db.close(); 
             micro.send(res,200,allDates);
+			return(true);
         }
         if (func === "/getDates") {
             console.log("Request for Dates");
@@ -41,16 +45,17 @@ module.exports = (req, res) => {
             //console.log(JSON.stringify(allDates)); 
             db.close(); 
             micro.send(res,200,allDates);
+			return(true);
         }
         if (func === "/getTimes") {
             console.log("Request for Times");
             const db = new Database('./quoteDBs/consolidated.sqlite3', { verbose: console.log });
             let sql = "SELECT distinct time(TimeStamp,'localtime') Time FROM OptionQuotes where 1=1"
             if (qsAttr.Symbol) {
-                sql +=" and Symbol='" + qsAttr.Symbol+ "'";
+                sql +=" and Symbol='" + qsAttr.Symbol.mySqlEsc() + "'";
             }
             if (qsAttr.Date){
-                sql +=" and date(TimeStamp,'localtime')='" + qsAttr.Date+ "'";
+                sql +=" and date(TimeStamp,'localtime')='" + qsAttr.Date.mySqlEsc() + "'";
             }
             sql+=" order by 1";
             const stmt = db.prepare(sql);
@@ -58,19 +63,20 @@ module.exports = (req, res) => {
             //console.log(JSON.stringify(allDates)); 
             db.close(); 
             micro.send(res,200,allDates);
+			return(true);
         }
         if (func === "/getOptionChain") {
             console.log("Request for OptionChain");
             const db = new Database('./quoteDBs/consolidated.sqlite3', { verbose: console.log });
             let sql = "SELECT Data FROM OptionQuotes where 1=1"
             if (qsAttr.Symbol) {
-                sql +=" and Symbol='" + qsAttr.Symbol+ "'"
+                sql +=" and Symbol='" + qsAttr.Symbol.mySqlEsc() + "'"
             }
             if (qsAttr.Date){
-                sql +=" and date(TimeStamp,'localtime')='" + qsAttr.Date+ "'";
+                sql +=" and date(TimeStamp,'localtime')='" + qsAttr.Date.mySqlEsc() + "'";
             }
             if (qsAttr.Time){
-                sql +=" and time(TimeStamp,'localtime')='" + qsAttr.Time+ "'";
+                sql +=" and time(TimeStamp,'localtime')='" + qsAttr.Time.mySqlEsc() + "'";
             }
             
             const stmt = db.prepare(sql);
@@ -78,8 +84,27 @@ module.exports = (req, res) => {
             //console.log(JSON.stringify(allDates)); 
             db.close(); 
             micro.send(res,200,allDates);
+			return(true);
         }
 
+		console.log("Request for File");
+		// Anything else we deliver as file data
+		if (func === "/") { func += 'index.html';}
+		// this is very basic protection only...
+		if ((func.indexOf("..") === -1) && (func.indexOf("~") === -1) && (func.indexOf("favicon	") === -1) ){
+			res.setHeader('Content-Type', 'text/html');
+			fs.readFile(".."+func, (err,filecontent)=>{
+				if (err) {
+					micro.send(res,500,err);
+				} else {
+					micro.send(res,200,filecontent);
+				}
+			});
+		} else {
+			res.setHeader('Content-Type', 'text/html');
+			micro.send(res,401,"Invalid file to serve");
+		}
+
     }
 }
 

server/quoteDBs/createTable.sql

@@ -1,4 +1,3 @@
-CREATE TABLE IF NOT EXISTS "OptionQuotes"("Id" INTEGER,
+CREATE TABLE IF NOT EXISTS "OptionQuotes"( "TimeStamp"DateTime DEFAULT CURRENT_TIMESTAMP,
-"TimeStamp"DateTime DEFAULT CURRENT_TIMESTAMP,
 "Symbol" Text,
 "Data" Text);

server/quoteDBs/fillBigDB_initial.sh

@@ -9,6 +9,9 @@ ls quoteStore_202*.sqlite3.gz | while read db; do
 	echo unpacking $db
 	gzip -dc $db >/tmp/xx.sqlite3
 	echo processing...
+	sqlite3 /tmp/xx.sqlite3 'create table tmp as select timestamp,symbol,data from OptionQuotes;'
+	sqlite3 /tmp/xx.sqlite3 'drop table OptionQuotes;'
+	sqlite3 /tmp/xx.sqlite3 'alter table tmp rename to OptionQuotes;'
 	sqlite3 /tmp/xx.sqlite3  '.dump OptionQuotes' | sqlite3 consolidated.sqlite3
 	echo deleting...
 	rm /tmp/xx.sqlite3

server/quoteDBs/fillBigDB_update.sh

@@ -6,6 +6,9 @@ ls quoteStore_202*.sqlite3.gz | while read db; do
 	echo unpacking $db
 	gzip -dc $db >/tmp/xx.sqlite3
 	echo processing...
+	sqlite3 /tmp/xx.sqlite3 'create table tmp as select timestamp,symbol,data from OptionQuotes;'
+	sqlite3 /tmp/xx.sqlite3 'drop table OptionQuotes;'
+	sqlite3 /tmp/xx.sqlite3 'alter table tmp rename to OptionQuotes;'
 	sqlite3 /tmp/xx.sqlite3  '.dump OptionQuotes' | sqlite3 consolidated.sqlite3
 	echo deleting...
 	rm /tmp/xx.sqlite3