@depup/mysql2 3.19.0-depup.0

package/lib/commands/client_handshake.js

@@ -0,0 +1,383 @@
+// This file was modified by Oracle on June 17, 2021.
+// Handshake errors are now maked as fatal and the corresponding events are
+// emitted in the command instance itself.
+// Modifications copyright (c) 2021, Oracle and/or its affiliates.
+
+// This file was modified by Oracle on September 21, 2021.
+// Handshake workflow now supports additional authentication factors requested
+// by the server.
+// Modifications copyright (c) 2021, Oracle and/or its affiliates.
+
+'use strict';
+
+const Command = require('./command.js');
+const Packets = require('../packets/index.js');
+const ClientConstants = require('../constants/client.js');
+const CharsetToEncoding = require('../constants/charset_encodings.js');
+const auth41 = require('../auth_41.js');
+const { getAuthPlugin } = require('./auth_switch.js');
+const {
+  calculateToken: calculateSha2Token,
+} = require('../auth_plugins/caching_sha2_password.js');
+
+function flagNames(flags) {
+  const res = [];
+  for (const c in ClientConstants) {
+    if (flags & ClientConstants[c]) {
+      res.push(c.replace(/_/g, ' ').toLowerCase());
+    }
+  }
+  return res;
+}
+
+class ClientHandshake extends Command {
+  constructor(clientFlags) {
+    super();
+    this.handshake = null;
+    this.clientFlags = clientFlags;
+    this.authenticationFactor = 0;
+  }
+
+  start() {
+    return ClientHandshake.prototype.handshakeInit;
+  }
+
+  sendSSLRequest(connection) {
+    const sslRequest = new Packets.SSLRequest(
+      this.clientFlags,
+      connection.config.charsetNumber
+    );
+    connection.writePacket(sslRequest.toPacket());
+  }
+
+  sendCredentials(connection) {
+    if (connection.config.debug) {
+      console.log(
+        'Sending handshake packet: flags:%d=(%s)',
+        this.clientFlags,
+        flagNames(this.clientFlags).join(', ')
+      );
+    }
+    this.user = connection.config.user;
+    this.password = connection.config.password;
+    // "password1" is an alias to the original "password" value
+    // to make it easier to integrate multi-factor authentication
+    this.password1 = connection.config.password;
+    // "password2" and "password3" are the 2nd and 3rd factor authentication
+    // passwords, which can be undefined depending on the authentication
+    // plugin being used
+    this.password2 = connection.config.password2;
+    this.password3 = connection.config.password3;
+    this.passwordSha1 = connection.config.passwordSha1;
+    this.database = connection.config.database;
+    this.authPluginName = this.handshake.authPluginName;
+
+    // Optimization: Try to use the server's preferred authentication method
+    // to avoid an unnecessary auth switch roundtrip
+    const serverAuthMethod = this.handshake.authPluginName;
+    const isSecureConnection =
+      connection.config.ssl || connection.config.socketPath;
+
+    // Combine auth plugin data for easier handling
+    // Note: authPluginData2 can include a trailing NUL byte when PLUGIN_AUTH is set
+    // We must ensure exactly 20 bytes for the scramble
+    const authPluginData =
+      this.handshake.authPluginData1 && this.handshake.authPluginData2
+        ? Buffer.concat([
+            this.handshake.authPluginData1,
+            this.handshake.authPluginData2,
+          ]).slice(0, 20)
+        : Buffer.alloc(20);
+
+    // Check if user has custom auth plugin or legacy handler for the server-advertised method
+    // If so, we must not bypass the auth switch flow with our built-in implementation
+    const hasCustomAuthPlugin =
+      connection.config.authPlugins &&
+      Object.prototype.hasOwnProperty.call(
+        connection.config.authPlugins,
+        serverAuthMethod
+      );
+    const hasLegacyAuthSwitchHandler =
+      typeof connection.config.authSwitchHandler === 'function';
+
+    // Determine which auth method to use
+    // Try to use server's preferred method if we can, otherwise fallback to native
+    const canUseDirectAuth =
+      !hasCustomAuthPlugin &&
+      !hasLegacyAuthSwitchHandler &&
+      this.canUseAuthMethodDirectly(serverAuthMethod, isSecureConnection);
+
+    const clientAuthMethod = canUseDirectAuth
+      ? serverAuthMethod
+      : 'mysql_native_password';
+
+    // Calculate the auth token for the chosen method
+    const authToken = this.calculateAuthToken(
+      clientAuthMethod,
+      this.password,
+      authPluginData
+    );
+
+    if (connection.config.debug) {
+      console.log(
+        'Server auth method: %s, Using auth method: %s',
+        serverAuthMethod,
+        clientAuthMethod
+      );
+    }
+
+    const handshakeResponse = new Packets.HandshakeResponse({
+      flags: this.clientFlags,
+      user: this.user,
+      database: this.database,
+      password: this.password,
+      passwordSha1: this.passwordSha1,
+      charsetNumber: connection.config.charsetNumber,
+      authPluginData1: this.handshake.authPluginData1,
+      authPluginData2: this.handshake.authPluginData2,
+      compress: connection.config.compress,
+      connectAttributes: connection.config.connectAttributes,
+      authToken: authToken,
+      authPluginName: clientAuthMethod,
+    });
+    connection.writePacket(handshakeResponse.toPacket());
+
+    // If we used a non-native auth method in the initial handshake response,
+    // we need to prepare for potential AuthMoreData packets by creating
+    // the appropriate auth plugin instance
+    if (clientAuthMethod !== 'mysql_native_password') {
+      this.initializeAuthPlugin(clientAuthMethod, authPluginData, connection);
+    }
+  }
+
+  calculateNativePasswordAuthToken(authPluginData) {
+    // TODO: dont split into authPluginData1 and authPluginData2, instead join when 1 & 2 received
+    const authPluginData1 = authPluginData.slice(0, 8);
+    const authPluginData2 = authPluginData.slice(8, 20);
+    let authToken;
+    if (this.passwordSha1) {
+      authToken = auth41.calculateTokenFromPasswordSha(
+        this.passwordSha1,
+        authPluginData1,
+        authPluginData2
+      );
+    } else {
+      authToken = auth41.calculateToken(
+        this.password,
+        authPluginData1,
+        authPluginData2
+      );
+    }
+    return authToken;
+  }
+
+  calculateSha256Token(password, scramble) {
+    // Reuse the token calculation from caching_sha2_password plugin
+    // to avoid code duplication and ensure consistency
+    return calculateSha2Token(password, scramble);
+  }
+
+  // Helper: Calculate auth token for a specific auth method
+  calculateAuthToken(authMethod, password, authPluginData) {
+    switch (authMethod) {
+      case 'mysql_native_password':
+        return this.calculateNativePasswordAuthToken(authPluginData);
+
+      case 'caching_sha2_password':
+        return this.calculateSha256Token(password, authPluginData);
+
+      case 'sha256_password':
+      case 'mysql_clear_password':
+        // These methods send plaintext password over secure connections
+        return password
+          ? Buffer.from(`${password}\0`, 'utf8')
+          : Buffer.alloc(0);
+
+      default:
+        // Unknown method - use native password as fallback
+        return this.calculateNativePasswordAuthToken(authPluginData);
+    }
+  }
+
+  // Helper: Determine if we can use a specific auth method directly
+  canUseAuthMethodDirectly(authMethod, isSecureConnection) {
+    switch (authMethod) {
+      case 'mysql_native_password':
+      case 'caching_sha2_password':
+        // These methods work with or without SSL
+        return true;
+
+      case 'sha256_password':
+      case 'mysql_clear_password':
+        // These methods require secure connection for direct use
+        return isSecureConnection;
+
+      default:
+        // Unknown methods - fallback to native password
+        return false;
+    }
+  }
+
+  // Helper: Initialize auth plugin for handling subsequent AuthMoreData packets
+  initializeAuthPlugin(authMethod, authPluginData, connection) {
+    const authPlugin = getAuthPlugin(authMethod, connection);
+    if (!authPlugin) {
+      return; // Plugin not found, will fallback to auth switch if needed
+    }
+
+    // Initialize the plugin with connection and command context
+    const pluginHandler = authPlugin({ connection, command: this });
+    connection._authPlugin = pluginHandler;
+
+    // Prime the plugin by calling it with the scramble data
+    // This advances the plugin's state machine (e.g., to STATE_TOKEN_SENT)
+    // We don't send the result because we already included it in the handshake response
+    try {
+      Promise.resolve(pluginHandler(authPluginData)).catch((err) => {
+        // Ignore errors during initialization since we already sent the token
+        if (connection.config.debug) {
+          console.log('Auth plugin initialization:', err.message);
+        }
+      });
+    } catch (err) {
+      // Ignore synchronous errors during initialization
+      if (connection.config.debug) {
+        console.log('Auth plugin initialization error:', err.message);
+      }
+    }
+  }
+
+  handshakeInit(helloPacket, connection) {
+    this.on('error', (e) => {
+      connection._fatalError = e;
+      connection._protocolError = e;
+    });
+    this.handshake = Packets.Handshake.fromPacket(helloPacket);
+    if (connection.config.debug) {
+      console.log(
+        'Server hello packet: capability flags:%d=(%s)',
+        this.handshake.capabilityFlags,
+        flagNames(this.handshake.capabilityFlags).join(', ')
+      );
+    }
+    connection.serverCapabilityFlags = this.handshake.capabilityFlags;
+    connection.serverEncoding = CharsetToEncoding[this.handshake.characterSet];
+    connection.connectionId = this.handshake.connectionId;
+    const serverSSLSupport =
+      this.handshake.capabilityFlags & ClientConstants.SSL;
+    // multi factor authentication is enabled with the
+    // "MULTI_FACTOR_AUTHENTICATION" capability and should only be used if it
+    // is supported by the server
+    const multiFactorAuthentication =
+      this.handshake.capabilityFlags &
+      ClientConstants.MULTI_FACTOR_AUTHENTICATION;
+    this.clientFlags = this.clientFlags | multiFactorAuthentication;
+    // use compression only if requested by client and supported by server
+    connection.config.compress =
+      connection.config.compress &&
+      this.handshake.capabilityFlags & ClientConstants.COMPRESS;
+    this.clientFlags = this.clientFlags | connection.config.compress;
+    if (connection.config.ssl) {
+      // client requires SSL but server does not support it
+      if (!serverSSLSupport) {
+        const err = new Error('Server does not support secure connection');
+        err.code = 'HANDSHAKE_NO_SSL_SUPPORT';
+        err.fatal = true;
+        this.emit('error', err);
+        return false;
+      }
+      // send ssl upgrade request and immediately upgrade connection to secure
+      this.clientFlags |= ClientConstants.SSL;
+      this.sendSSLRequest(connection);
+      connection.startTLS((err) => {
+        // after connection is secure
+        if (err) {
+          // SSL negotiation error are fatal
+          err.code = 'HANDSHAKE_SSL_ERROR';
+          err.fatal = true;
+          this.emit('error', err);
+          return;
+        }
+        // rest of communication is encrypted
+        this.sendCredentials(connection);
+      });
+    } else {
+      this.sendCredentials(connection);
+    }
+    if (multiFactorAuthentication) {
+      // if the server supports multi-factor authentication, we enable it in
+      // the client
+      this.authenticationFactor = 1;
+    }
+    return ClientHandshake.prototype.handshakeResult;
+  }
+
+  handshakeResult(packet, connection) {
+    const marker = packet.peekByte();
+    // packet can be OK_Packet, ERR_Packet, AuthSwitchRequest, AuthNextFactor
+    // or AuthMoreData
+    if (marker === 0xfe || marker === 1 || marker === 0x02) {
+      const authSwitch = require('./auth_switch');
+      try {
+        if (marker === 1) {
+          authSwitch.authSwitchRequestMoreData(packet, connection, this);
+        } else {
+          // if authenticationFactor === 0, it means the server does not support
+          // the multi-factor authentication capability
+          if (this.authenticationFactor !== 0) {
+            // if we are past the first authentication factor, we should use the
+            // corresponding password (if there is one)
+            connection.config.password =
+              this[`password${this.authenticationFactor}`];
+            // update the current authentication factor
+            this.authenticationFactor += 1;
+          }
+          // if marker === 0x02, it means it is an AuthNextFactor packet,
+          // which is similar in structure to an AuthSwitchRequest packet,
+          // so, we can use it directly
+          authSwitch.authSwitchRequest(packet, connection, this);
+        }
+        return ClientHandshake.prototype.handshakeResult;
+      } catch (err) {
+        // Authentication errors are fatal
+        err.code = 'AUTH_SWITCH_PLUGIN_ERROR';
+        err.fatal = true;
+
+        if (this.onResult) {
+          this.onResult(err);
+        } else {
+          this.emit('error', err);
+        }
+        return null;
+      }
+    }
+    if (marker !== 0) {
+      const err = new Error('Unexpected packet during handshake phase');
+      // Unknown handshake errors are fatal
+      err.code = 'HANDSHAKE_UNKNOWN_ERROR';
+      err.fatal = true;
+
+      if (this.onResult) {
+        this.onResult(err);
+      } else {
+        this.emit('error', err);
+      }
+      return null;
+    }
+    // this should be called from ClientHandshake command only
+    // and skipped when called from ChangeUser command
+    if (!connection.authorized) {
+      connection.authorized = true;
+      if (connection.config.compress) {
+        const enableCompression =
+          require('../compressed_protocol.js').enableCompression;
+        enableCompression(connection);
+      }
+    }
+    if (this.onResult) {
+      this.onResult(null);
+    }
+    return null;
+  }
+}
+module.exports = ClientHandshake;

package/lib/commands/close_statement.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const Command = require('./command');
+const Packets = require('../packets/index.js');
+
+class CloseStatement extends Command {
+  constructor(id) {
+    super();
+    this.id = id;
+  }
+
+  start(packet, connection) {
+    connection.writePacket(new Packets.CloseStatement(this.id).toPacket(1));
+    return null;
+  }
+}
+
+module.exports = CloseStatement;

package/lib/commands/command.js

@@ -0,0 +1,54 @@
+'use strict';
+
+const EventEmitter = require('events').EventEmitter;
+const Timers = require('timers');
+
+class Command extends EventEmitter {
+  constructor() {
+    super();
+    this.next = null;
+  }
+
+  // slow. debug only
+  stateName() {
+    const state = this.next;
+    for (const i in this) {
+      if (this[i] === state && i !== 'next') {
+        return i;
+      }
+    }
+    return 'unknown name';
+  }
+
+  execute(packet, connection) {
+    if (!this.next) {
+      this.next = this.start;
+      connection._resetSequenceId();
+    }
+    if (packet && packet.isError()) {
+      const err = packet.asError(connection.clientEncoding);
+      err.sql = this.sql || this.query;
+      if (this.queryTimeout) {
+        Timers.clearTimeout(this.queryTimeout);
+        this.queryTimeout = null;
+      }
+      if (this.onResult) {
+        this.onResult(err);
+        this.emit('end');
+      } else {
+        this.emit('error', err);
+        this.emit('end');
+      }
+      return true;
+    }
+    // TODO: don't return anything from execute, it's ugly and error-prone. Listen for 'end' event in connection
+    this.next = this.next(packet, connection);
+    if (this.next) {
+      return false;
+    }
+    this.emit('end');
+    return true;
+  }
+}
+
+module.exports = Command;

package/lib/commands/execute.js

@@ -0,0 +1,112 @@
+'use strict';
+
+const Command = require('./command.js');
+const Query = require('./query.js');
+const Packets = require('../packets/index.js');
+
+const getBinaryParser = require('../parsers/binary_parser.js');
+const getStaticBinaryParser = require('../parsers/static_binary_parser.js');
+
+class Execute extends Command {
+  constructor(options, callback) {
+    super();
+    this.statement = options.statement;
+    this.sql = options.sql;
+    this.values = options.values;
+    this.onResult = callback;
+    this.parameters = options.values;
+    this.insertId = 0;
+    this.timeout = options.timeout;
+    this.queryTimeout = null;
+    this._rows = [];
+    this._fields = [];
+    this._result = [];
+    this._fieldCount = 0;
+    this._rowParser = null;
+    this._executeOptions = options;
+    this._resultIndex = 0;
+    this._localStream = null;
+    this._unpipeStream = function () {};
+    this._streamFactory = options.infileStreamFactory;
+    this._connection = null;
+  }
+
+  buildParserFromFields(fields, connection) {
+    if (this.options.disableEval) {
+      return getStaticBinaryParser(fields, this.options, connection.config);
+    }
+
+    return getBinaryParser(fields, this.options, connection.config);
+  }
+
+  start(packet, connection) {
+    this._connection = connection;
+    this.options = Object.assign({}, connection.config, this._executeOptions);
+    this._setTimeout();
+    const executePacket = new Packets.Execute(
+      this.statement.id,
+      this.parameters,
+      connection.config.charsetNumber,
+      connection.config.timezone
+    );
+    //For reasons why this try-catch is here, please see
+    // https://github.com/sidorares/node-mysql2/pull/689
+    //For additional discussion, see
+    // 1. https://github.com/sidorares/node-mysql2/issues/493
+    // 2. https://github.com/sidorares/node-mysql2/issues/187
+    // 3. https://github.com/sidorares/node-mysql2/issues/480
+    try {
+      connection.writePacket(executePacket.toPacket(1));
+    } catch (error) {
+      this.onResult(error);
+    }
+    return Execute.prototype.resultsetHeader;
+  }
+
+  readField(packet, connection) {
+    let fields;
+    // disabling for now, but would be great to find reliable way to parse fields only once
+    // fields reported by prepare can be empty at all or just incorrect - see #169
+    //
+    // perfomance optimisation: if we already have this field parsed in statement header, use one from header
+    // const field = this.statement.columns.length == this._fieldCount ?
+    //  this.statement.columns[this._receivedFieldsCount] : new Packets.ColumnDefinition(packet);
+    const field = new Packets.ColumnDefinition(
+      packet,
+      connection.clientEncoding
+    );
+    this._receivedFieldsCount++;
+    this._fields[this._resultIndex].push(field);
+    if (this._receivedFieldsCount === this._fieldCount) {
+      fields = this._fields[this._resultIndex];
+      this.emit('fields', fields, this._resultIndex);
+      return Execute.prototype.fieldsEOF;
+    }
+    return Execute.prototype.readField;
+  }
+
+  fieldsEOF(packet, connection) {
+    // check EOF
+    if (!packet.isEOF()) {
+      return connection.protocolError('Expected EOF packet');
+    }
+    this._rowParser = new (this.buildParserFromFields(
+      this._fields[this._resultIndex],
+      connection
+    ))();
+    return Execute.prototype.row;
+  }
+}
+
+Execute.prototype.done = Query.prototype.done;
+Execute.prototype.doneInsert = Query.prototype.doneInsert;
+Execute.prototype.resultsetHeader = Query.prototype.resultsetHeader;
+Execute.prototype._findOrCreateReadStream =
+  Query.prototype._findOrCreateReadStream;
+Execute.prototype._streamLocalInfile = Query.prototype._streamLocalInfile;
+Execute.prototype._setTimeout = Query.prototype._setTimeout;
+Execute.prototype._handleTimeoutError = Query.prototype._handleTimeoutError;
+Execute.prototype.row = Query.prototype.row;
+Execute.prototype.stream = Query.prototype.stream;
+
+module.exports = Execute;

package/lib/commands/index.js

@@ -0,0 +1,27 @@
+'use strict';
+
+const ClientHandshake = require('./client_handshake.js');
+const ServerHandshake = require('./server_handshake.js');
+const Query = require('./query.js');
+const Prepare = require('./prepare.js');
+const CloseStatement = require('./close_statement.js');
+const Execute = require('./execute.js');
+const Ping = require('./ping.js');
+const RegisterSlave = require('./register_slave.js');
+const BinlogDump = require('./binlog_dump.js');
+const ChangeUser = require('./change_user.js');
+const Quit = require('./quit.js');
+
+module.exports = {
+  ClientHandshake,
+  ServerHandshake,
+  Query,
+  Prepare,
+  CloseStatement,
+  Execute,
+  Ping,
+  RegisterSlave,
+  BinlogDump,
+  ChangeUser,
+  Quit,
+};

package/lib/commands/ping.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const Command = require('./command');
+const CommandCode = require('../constants/commands');
+const Packet = require('../packets/packet');
+
+// TODO: time statistics?
+// usefull for queue size and network latency monitoring
+// store created,sent,reply timestamps
+class Ping extends Command {
+  constructor(callback) {
+    super();
+    this.onResult = callback;
+  }
+
+  start(packet, connection) {
+    const ping = new Packet(
+      0,
+      Buffer.from([1, 0, 0, 0, CommandCode.PING]),
+      0,
+      5
+    );
+    connection.writePacket(ping);
+    return Ping.prototype.pingResponse;
+  }
+
+  pingResponse() {
+    // TODO: check it's OK packet. error check already done in caller
+    if (this.onResult) {
+      process.nextTick(this.onResult.bind(this));
+    }
+    return null;
+  }
+}
+
+module.exports = Ping;