@sap/xsodata 8.3.1 → 8.3.2

package/CHANGELOG.md

@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
 ## Unreleased
 
+## [8.3.2] - 2026-04-14
+
+* FOSS related security updates
+
 ## [8.3.1] - 2026-02-12
 
 * FOSS related security updates

package/documentation/annotations.md

@@ -34,7 +34,7 @@ If the annotations are enabled for an XSOData service, the following XML namespa
 of the $metadata document:
 
 ```
-xmlns:sap="http://www.sap.com/Protocols/SAPData"
+xmlns:sap="https://www.sap.com/Protocols/SAPData"
 ```
 
 The sections below describe the annotations (annotation attributes), which are supported by the XSOData XS2. Only the

package/index.js

@@ -1,6 +1,5 @@
 'use strict';
 
-
 //Includes
 const xsodata = require('./lib/xsodata');
 const configuration = require('./lib/configuration');
@@ -11,7 +10,3 @@ module.exports.ODataHandler = xsodata.ODataHandler;
 
 module.exports.RequestOptions = configuration.RequestOptions;
 module.exports.HandlerOptions = configuration.HandlerOptions;
-
-
-
-

package/lib/configuration.js

@@ -5,18 +5,16 @@
  */
 
 exports.modes = {
-    development: "development",
-    productive: "productive"
+    development: 'development',
+    productive: 'productive',
 };
 
-
 /**
  * Exposed in index.js and used by xsjs or other application to set options for a hole OData handler
  * @param init
  * @constructor
  */
 exports.HandlerOptions = function HandlerOptions(init) {
-
     /**
      * serviceConfiguration may be a directory containing *.xsodata files (the directory name MUST NOT end with ".xsodata")
      *    Usage: When pathPrefix is "/sub1/sub2" and serviceConfiguration is directory "./services" then the request to
@@ -61,7 +59,6 @@ exports.HandlerOptions = function HandlerOptions(init) {
     check(this);
 };
 
-
 /**
  * RequestOptions encapsulate all options witch can be set on a per request basis
  * Exposed in index.js and used by xsjs or other application when calling "processRequest"
@@ -80,7 +77,6 @@ exports.RequestOptions = function RequestOptions(init) {
      */
     this.uriPrefix = init.uriPrefix;
 
-
     this.dbClient = init.dbClient || null;
 
     /** Function to open the db connection lazy
@@ -122,7 +118,6 @@ exports.RequestOptions = function RequestOptions(init) {
      */
     this.functionExecutor = init.functionExecutor || null;
 
-
     /**
      * Function called for loading a module. The module is a bag for functions used at exit points
      * The function must support an object like {"package" : string, "file": string, "ext": string} as input parameter
@@ -142,12 +137,13 @@ exports.RequestOptions = function RequestOptions(init) {
     this.logger = init.logger;
 
     this.locale = init.locale;
-
 };
 
-
-function check (target) {
-    if ((target.mode !== exports.modes.development ) && (target.mode !== exports.modes.productive )) {
-        throw(new Error('Invalid mode. See xsodata.modes for possible values.'));
+function check(target) {
+    if (
+        target.mode !== exports.modes.development &&
+        target.mode !== exports.modes.productive
+    ) {
+        throw new Error('Invalid mode. See xsodata.modes for possible values.');
     }
 }

package/lib/db/connect.js

@@ -41,7 +41,6 @@ function execSQL(sql, context, asyncDone) {
 }
 
 function loadDbVersion(context, asyncDone) {
-
     if (!context.gModel) {
         return asyncDone(null, context);
     }
@@ -51,45 +50,59 @@ function loadDbVersion(context, asyncDone) {
         return asyncDone(null, context);
     }
 
-    return context.db.client.exec('select version from "SYS"."M_DATABASE"', function (err, rows) {
-        if (err) {
-            return asyncDone(new SqlError(context, err), context);
-        }
+    return context.db.client.exec(
+        'select version from "SYS"."M_DATABASE"',
+        function (err, rows) {
+            if (err) {
+                return asyncDone(new SqlError(context, err), context);
+            }
 
-        if (rows && rows[0] && rows[0].VERSION) {
-            const version = rows[0].VERSION;
-            context.logger.info('xsodata', 'db version: ' + version);
-            context.gModel.setDbVersion(version);
-        } else {
-            context.gModel.setDbVersion(null);  // don't try reload
-        }
+            if (rows && rows[0] && rows[0].VERSION) {
+                const version = rows[0].VERSION;
+                context.logger.info('xsodata', 'db version: ' + version);
+                context.gModel.setDbVersion(version);
+            } else {
+                context.gModel.setDbVersion(null); // don't try reload
+            }
 
-        return asyncDone(null, context);
-    });
+            return asyncDone(null, context);
+        }
+    );
 }
 
 function setHanaCloudContext(context, asyncDone) {
+    return context.db.client.exec(
+        'select version from "SYS"."M_DATABASE"',
+        function (err, rows) {
+            if (err) {
+                return asyncDone(new SqlError(context, err), context);
+            }
 
-    return context.db.client.exec('select version from "SYS"."M_DATABASE"', function (err, rows) {
-        if (err) {
-            return asyncDone(new SqlError(context, err), context);
-        }
+            if (rows && rows[0] && rows[0].VERSION) {
+                const version = rows[0].VERSION;
+                context.logger.info('xsodata', 'db version: ' + version);
+                context.db.isHanaCloudDb = isHanaCloudDb(
+                    context,
+                    rows[0].VERSION
+                );
+                context.logger.info(
+                    'xsodata',
+                    `isHanaCloud: ${context.db.isHanaCloudDb} (DB version based)`
+                );
+            } else {
+                // 06/2022:
+                // Currently all SQL from Hana Cloud work also on Hana Service, i.e. take that version as default;
+                // could be changed in the future, i.e. using the context setting of 'context.db.isHanaCloudDb'
+                context.db.isHanaCloudDb = true;
+                context.logger.info(
+                    'xsodata',
+                    `isHanaCloud: ${context.db.isHanaCloudDb} (default)`
+                );
+            }
 
-        if (rows && rows[0] && rows[0].VERSION) {
-            const version = rows[0].VERSION;
-            context.logger.info('xsodata', 'db version: ' + version);
-            context.db.isHanaCloudDb = isHanaCloudDb(context, rows[0].VERSION);
-            context.logger.info('xsodata', `isHanaCloud: ${context.db.isHanaCloudDb} (DB version based)`);
-        } else {
-            // 06/2022:
-            // Currently all SQL from Hana Cloud work also on Hana Service, i.e. take that version as default;
-            // could be changed in the future, i.e. using the context setting of 'context.db.isHanaCloudDb'
-            context.db.isHanaCloudDb = true;
-            context.logger.info('xsodata', `isHanaCloud: ${context.db.isHanaCloudDb} (default)`);
+            return asyncDone(null, context);
         }
-
-        return asyncDone(null, context);
-    });
+    );
 }
 
 function isHanaCloudDb(context, version) {
@@ -97,10 +110,10 @@ function isHanaCloudDb(context, version) {
     let result = version.match(regex);
 
     if (result && result[1]) {
-        return (result[1] >= 4);
+        return result[1] >= 4;
     } else {
         context.logger.error(`DB Version parsing failed: ${version}`);
-        return true;        // default: Hana Cloud
+        return true; // default: Hana Cloud
     }
 }
 
@@ -118,31 +131,43 @@ function getDbClientType(dbClient) {
  * @param asyncDone
  */
 function prepareConnection(context, asyncDone) {
-    context.logger.debug('connect - db', 'prepare connection via ' + (getDbClientType(context.db.client) === 'hdb' ? 'hdb' : 'hana-client'));
+    context.logger.debug(
+        'connect - db',
+        'prepare connection via ' +
+            (getDbClientType(context.db.client) === 'hdb'
+                ? 'hdb'
+                : 'hana-client')
+    );
 
-    let executeList = [
-        utils.injectContext(context)
-    ];
+    let executeList = [utils.injectContext(context)];
 
     // Set the default schema
     if (context.defaultSchema) {
-        executeList.push(utils.tryAndMeasure(execSQL, 'SET SCHEMA ' + context.defaultSchema, 'execSQL (default schema)'));
+        executeList.push(
+            utils.tryAndMeasure(
+                execSQL,
+                'SET SCHEMA ' + context.defaultSchema,
+                'execSQL (default schema)'
+            )
+        );
     }
 
-
     // Set the isolation level
-    executeList.push(utils.tryAndMeasure(execSQL, 'SET TRANSACTION ISOLATION LEVEL REPEATABLE READ', 'execSQL (isolation level)'));
+    executeList.push(
+        utils.tryAndMeasure(
+            execSQL,
+            'SET TRANSACTION ISOLATION LEVEL REPEATABLE READ',
+            'execSQL (isolation level)'
+        )
+    );
     executeList.push(loadDbVersion);
     // Set Hana Cloud indicator in context
     executeList.push(setHanaCloudContext);
 
-    async.waterfall(
-        executeList,
-        function (err) {
-            context.db.client.setAutoCommit(false);
-            asyncDone(err, context);
-        }
-    );
+    async.waterfall(executeList, function (err) {
+        context.db.client.setAutoCommit(false);
+        asyncDone(err, context);
+    });
 }
 
 /**
@@ -154,17 +179,22 @@ function prepareConnection(context, asyncDone) {
  */
 exports._openConnection = function (context, asyncDone) {
     context.logger.debug('connect - db', '_openConnection');
-    context.db.opener(context.handlerConfiguration.dbConfiguration, function (err, newClient) {
-        if (err) {
-            return asyncDone(new ApplicationError('Internal error occurred', err), context);
-        }
-        context.db.client = newClient;
+    context.db.opener(
+        context.handlerConfiguration.dbConfiguration,
+        function (err, newClient) {
+            if (err) {
+                return asyncDone(
+                    new ApplicationError('Internal error occurred', err),
+                    context
+                );
+            }
+            context.db.client = newClient;
 
-        return asyncDone(null, context);
-    });
+            return asyncDone(null, context);
+        }
+    );
 };
 
-
 /**
  * Connects to a database, there are 3 way to define which database
  * 1. By providing a hdbClient via requestOptions.dbClient
@@ -199,7 +229,6 @@ function _connectInternal(context, asyncDone) {
         }
     }
 
-
     try {
         let db_module = null;
 
@@ -217,17 +246,25 @@ function _connectInternal(context, asyncDone) {
             context.logger.silly('connect - db', 'use hana-client');
         }
 
-
-        client = Measurement.measureSync(db_module.createClient, context.handlerConfiguration.dbConfiguration, 'hdb.createClient');
-
+        client = Measurement.measureSync(
+            db_module.createClient,
+            context.handlerConfiguration.dbConfiguration,
+            'hdb.createClient'
+        );
     } catch (exception) {
-        context.logger.error('connect - db', 'createClient failed: ' + JSON.stringify(exception));
+        context.logger.error(
+            'connect - db',
+            'createClient failed: ' + JSON.stringify(exception)
+        );
         return asyncDone(exception, context);
     }
 
     if (getDbClientType(client) === 'hdb') {
         client.on('error', function (err) {
-            context.logger.error('connect - db', 'client error event: ' + JSON.stringify(err));
+            context.logger.error(
+                'connect - db',
+                'client error event: ' + JSON.stringify(err)
+            );
             return asyncDone(new InternalError(err, context), context);
         });
     }
@@ -249,7 +286,10 @@ function _connectInternal(context, asyncDone) {
         }
 
         if (err) {
-            context.logger.error('connect - db', 'connect failed: ' + JSON.stringify(err));
+            context.logger.error(
+                'connect - db',
+                'connect failed: ' + JSON.stringify(err)
+            );
             client.end();
             return asyncDone(new InternalError(err, context), context);
         }
@@ -257,10 +297,8 @@ function _connectInternal(context, asyncDone) {
         context.db.client = client;
         context.db.openedConnection = true;
 
-
         context.logger.info('connect - db', 'connection opened');
 
-
         return prepareConnection(context, asyncDone);
     });
 }
@@ -274,7 +312,7 @@ function _connectInternal(context, asyncDone) {
  */
 exports.connect = function (context, asyncDone) {
     context.db = context.db || {};
-    if (context.db.client && (context.db.connectionInitialized === true)) {
+    if (context.db.client && context.db.connectionInitialized === true) {
         context.logger.info('connect - db', 'connect already done');
         return asyncDone(null, context);
     }
@@ -282,18 +320,24 @@ exports.connect = function (context, asyncDone) {
 
     return _connectInternal(context, function (err) {
         if (err) {
-            context.logger.debug('connect - db', 'connect error ' + err.toString ? err.toString() : JSON.stringify(err));
+            context.logger.debug(
+                'connect - db',
+                'connect error ' + err.toString
+                    ? err.toString()
+                    : JSON.stringify(err)
+            );
             return asyncDone(err, context);
         }
         context.logger.debug('connect - db', 'connection is usable');
         context.db.connectionInitialized = true;
-        context.logger.debug('connect - context setting - Is Hana Cloud used?', `${context.db.isHanaCloudDb}`);
+        context.logger.debug(
+            'connect - context setting - Is Hana Cloud used?',
+            `${context.db.isHanaCloudDb}`
+        );
         return asyncDone(null, context);
-
     });
 };
 
-
 /**
  * Ends the db connection
  *
@@ -308,9 +352,15 @@ exports.disconnect = function (context, cb) {
         if (context.db.client) {
             context.db.client.end((err) => {
                 if (err) {
-                    context.logger.error('connect - db', `disconnect failed (callback): ${err}`);
+                    context.logger.error(
+                        'connect - db',
+                        `disconnect failed (callback): ${err}`
+                    );
                 }
-                context.logger.info('connect - db', 'disconnect done (callback)');
+                context.logger.info(
+                    'connect - db',
+                    'disconnect done (callback)'
+                );
             });
         }
         context.db.openedConnection = false;
@@ -325,7 +375,6 @@ exports.disconnect = function (context, cb) {
     return cb();
 };
 
-
 exports.dbRollback = (context, dbClient, cb) => {
     context.logger.info('connect - db', 'dbRollback');
     return dbClient.rollback(function (errDB) {
@@ -335,7 +384,10 @@ exports.dbRollback = (context, dbClient, cb) => {
         }
 
         if (dbVersionChecks.shouldNotCleanTmpTables(context)) {
-            context.logger.info('connect - db', 'no tmp table delete due to rollback');
+            context.logger.info(
+                'connect - db',
+                'no tmp table delete due to rollback'
+            );
             tableCleanup.emptyLists(context);
         }