decocms 2.375.0 → 2.375.1

package/dist/server/node_modules/pg/lib/crypto/cert-signatures.js

@@ -0,0 +1,122 @@
+function x509Error(msg, cert) {
+  return new Error('SASL channel binding: ' + msg + ' when parsing public certificate ' + cert.toString('base64'))
+}
+
+function readASN1Length(data, index) {
+  let length = data[index++]
+  if (length < 0x80) return { length, index }
+
+  const lengthBytes = length & 0x7f
+  if (lengthBytes > 4) throw x509Error('bad length', data)
+
+  length = 0
+  for (let i = 0; i < lengthBytes; i++) {
+    length = (length << 8) | data[index++]
+  }
+
+  return { length, index }
+}
+
+function readASN1OID(data, index) {
+  if (data[index++] !== 0x6) throw x509Error('non-OID data', data) // 6 = OID
+
+  const { length: OIDLength, index: indexAfterOIDLength } = readASN1Length(data, index)
+  index = indexAfterOIDLength
+  const lastIndex = index + OIDLength
+
+  const byte1 = data[index++]
+  let oid = ((byte1 / 40) >> 0) + '.' + (byte1 % 40)
+
+  while (index < lastIndex) {
+    // loop over numbers in OID
+    let value = 0
+    while (index < lastIndex) {
+      // loop over bytes in number
+      const nextByte = data[index++]
+      value = (value << 7) | (nextByte & 0x7f)
+      if (nextByte < 0x80) break
+    }
+    oid += '.' + value
+  }
+
+  return { oid, index }
+}
+
+function expectASN1Seq(data, index) {
+  if (data[index++] !== 0x30) throw x509Error('non-sequence data', data) // 30 = Sequence
+  return readASN1Length(data, index)
+}
+
+function signatureAlgorithmHashFromCertificate(data, index) {
+  // read this thread: https://www.postgresql.org/message-id/17760-b6c61e752ec07060%40postgresql.org
+  if (index === undefined) index = 0
+  index = expectASN1Seq(data, index).index
+  const { length: certInfoLength, index: indexAfterCertInfoLength } = expectASN1Seq(data, index)
+  index = indexAfterCertInfoLength + certInfoLength // skip over certificate info
+  index = expectASN1Seq(data, index).index // skip over signature length field
+  const { oid, index: indexAfterOID } = readASN1OID(data, index)
+  switch (oid) {
+    // RSA
+    case '1.2.840.113549.1.1.4':
+      return 'MD5'
+    case '1.2.840.113549.1.1.5':
+      return 'SHA-1'
+    case '1.2.840.113549.1.1.11':
+      return 'SHA-256'
+    case '1.2.840.113549.1.1.12':
+      return 'SHA-384'
+    case '1.2.840.113549.1.1.13':
+      return 'SHA-512'
+    case '1.2.840.113549.1.1.14':
+      return 'SHA-224'
+    case '1.2.840.113549.1.1.15':
+      return 'SHA512-224'
+    case '1.2.840.113549.1.1.16':
+      return 'SHA512-256'
+    // ECDSA
+    case '1.2.840.10045.4.1':
+      return 'SHA-1'
+    case '1.2.840.10045.4.3.1':
+      return 'SHA-224'
+    case '1.2.840.10045.4.3.2':
+      return 'SHA-256'
+    case '1.2.840.10045.4.3.3':
+      return 'SHA-384'
+    case '1.2.840.10045.4.3.4':
+      return 'SHA-512'
+    // RSASSA-PSS: hash is indicated separately
+    case '1.2.840.113549.1.1.10': {
+      index = indexAfterOID
+      index = expectASN1Seq(data, index).index
+      if (data[index++] !== 0xa0) throw x509Error('non-tag data', data) // a0 = constructed tag 0
+      index = readASN1Length(data, index).index // skip over tag length field
+      index = expectASN1Seq(data, index).index // skip over sequence length field
+      const { oid: hashOID } = readASN1OID(data, index)
+      switch (hashOID) {
+        // standalone hash OIDs
+        case '1.2.840.113549.2.5':
+          return 'MD5'
+        case '1.3.14.3.2.26':
+          return 'SHA-1'
+        case '2.16.840.1.101.3.4.2.1':
+          return 'SHA-256'
+        case '2.16.840.1.101.3.4.2.2':
+          return 'SHA-384'
+        case '2.16.840.1.101.3.4.2.3':
+          return 'SHA-512'
+      }
+      throw x509Error('unknown hash OID ' + hashOID, data)
+    }
+    // Ed25519 -- see https: return//github.com/openssl/openssl/issues/15477
+    case '1.3.101.110':
+    case '1.3.101.112': // ph
+      return 'SHA-512'
+    // Ed448 -- still not in pg 17.2 (if supported, digest would be SHAKE256 x 64 bytes)
+    case '1.3.101.111':
+    case '1.3.101.113': // ph
+      throw x509Error('Ed448 certificate channel binding is not currently supported by Postgres')
+  }
+  throw x509Error('unknown OID ' + oid, data)
+}
+
+module.exports = { signatureAlgorithmHashFromCertificate }

package/dist/server/node_modules/pg/lib/crypto/sasl.js

@@ -1,22 +1,34 @@
 'use strict'
 const crypto = require('./utils')
+const { signatureAlgorithmHashFromCertificate } = require('./cert-signatures')
 
-function startSession(mechanisms) {
-  if (mechanisms.indexOf('SCRAM-SHA-256') === -1) {
-    throw new Error('SASL: Only mechanism SCRAM-SHA-256 is currently supported')
+function startSession(mechanisms, stream) {
+  const candidates = ['SCRAM-SHA-256']
+  if (stream) candidates.unshift('SCRAM-SHA-256-PLUS') // higher-priority, so placed first
+
+  const mechanism = candidates.find((candidate) => mechanisms.includes(candidate))
+
+  if (!mechanism) {
+    throw new Error('SASL: Only mechanism(s) ' + candidates.join(' and ') + ' are supported')
+  }
+
+  if (mechanism === 'SCRAM-SHA-256-PLUS' && typeof stream.getPeerCertificate !== 'function') {
+    // this should never happen if we are really talking to a Postgres server
+    throw new Error('SASL: Mechanism SCRAM-SHA-256-PLUS requires a certificate')
   }
 
   const clientNonce = crypto.randomBytes(18).toString('base64')
+  const gs2Header = mechanism === 'SCRAM-SHA-256-PLUS' ? 'p=tls-server-end-point' : stream ? 'y' : 'n'
 
   return {
-    mechanism: 'SCRAM-SHA-256',
+    mechanism,
     clientNonce,
-    response: 'n,,n=*,r=' + clientNonce,
+    response: gs2Header + ',,n=*,r=' + clientNonce,
     message: 'SASLInitialResponse',
   }
 }
 
-async function continueSession(session, password, serverData) {
+async function continueSession(session, password, serverData, stream) {
   if (session.message !== 'SASLInitialResponse') {
     throw new Error('SASL: Last message was not SASLInitialResponse')
   }
@@ -38,19 +50,33 @@ async function continueSession(session, password, serverData) {
     throw new Error('SASL: SCRAM-SERVER-FIRST-MESSAGE: server nonce is too short')
   }
 
-  var clientFirstMessageBare = 'n=*,r=' + session.clientNonce
-  var serverFirstMessage = 'r=' + sv.nonce + ',s=' + sv.salt + ',i=' + sv.iteration
-  var clientFinalMessageWithoutProof = 'c=biws,r=' + sv.nonce
-  var authMessage = clientFirstMessageBare + ',' + serverFirstMessage + ',' + clientFinalMessageWithoutProof
+  const clientFirstMessageBare = 'n=*,r=' + session.clientNonce
+  const serverFirstMessage = 'r=' + sv.nonce + ',s=' + sv.salt + ',i=' + sv.iteration
+
+  // without channel binding:
+  let channelBinding = stream ? 'eSws' : 'biws' // 'y,,' or 'n,,', base64-encoded
+
+  // override if channel binding is in use:
+  if (session.mechanism === 'SCRAM-SHA-256-PLUS') {
+    const peerCert = stream.getPeerCertificate().raw
+    let hashName = signatureAlgorithmHashFromCertificate(peerCert)
+    if (hashName === 'MD5' || hashName === 'SHA-1') hashName = 'SHA-256'
+    const certHash = await crypto.hashByName(hashName, peerCert)
+    const bindingData = Buffer.concat([Buffer.from('p=tls-server-end-point,,'), Buffer.from(certHash)])
+    channelBinding = bindingData.toString('base64')
+  }
+
+  const clientFinalMessageWithoutProof = 'c=' + channelBinding + ',r=' + sv.nonce
+  const authMessage = clientFirstMessageBare + ',' + serverFirstMessage + ',' + clientFinalMessageWithoutProof
 
-  var saltBytes = Buffer.from(sv.salt, 'base64')
-  var saltedPassword = await crypto.deriveKey(password, saltBytes, sv.iteration)
-  var clientKey = await crypto.hmacSha256(saltedPassword, 'Client Key')
-  var storedKey = await crypto.sha256(clientKey)
-  var clientSignature = await crypto.hmacSha256(storedKey, authMessage)
-  var clientProof = xorBuffers(Buffer.from(clientKey), Buffer.from(clientSignature)).toString('base64')
-  var serverKey = await crypto.hmacSha256(saltedPassword, 'Server Key')
-  var serverSignatureBytes = await crypto.hmacSha256(serverKey, authMessage)
+  const saltBytes = Buffer.from(sv.salt, 'base64')
+  const saltedPassword = await crypto.deriveKey(password, saltBytes, sv.iteration)
+  const clientKey = await crypto.hmacSha256(saltedPassword, 'Client Key')
+  const storedKey = await crypto.sha256(clientKey)
+  const clientSignature = await crypto.hmacSha256(storedKey, authMessage)
+  const clientProof = xorBuffers(Buffer.from(clientKey), Buffer.from(clientSignature)).toString('base64')
+  const serverKey = await crypto.hmacSha256(saltedPassword, 'Server Key')
+  const serverSignatureBytes = await crypto.hmacSha256(serverKey, authMessage)
 
   session.message = 'SASLResponse'
   session.serverSignature = Buffer.from(serverSignatureBytes).toString('base64')

package/dist/server/node_modules/pg/lib/crypto/utils-legacy.js

@@ -10,8 +10,8 @@ function md5(string) {
 
 // See AuthenticationMD5Password at https://www.postgresql.org/docs/current/static/protocol-flow.html
 function postgresMd5PasswordHash(user, password, salt) {
-  var inner = md5(password + user)
-  var outer = md5(Buffer.concat([Buffer.from(inner), salt]))
+  const inner = md5(password + user)
+  const outer = md5(Buffer.concat([Buffer.from(inner), salt]))
   return 'md5' + outer
 }
 
@@ -19,6 +19,11 @@ function sha256(text) {
   return nodeCrypto.createHash('sha256').update(text).digest()
 }
 
+function hashByName(hashName, text) {
+  hashName = hashName.replace(/(\D)-/, '$1') // e.g. SHA-256 -> SHA256
+  return nodeCrypto.createHash(hashName).update(text).digest()
+}
+
 function hmacSha256(key, msg) {
   return nodeCrypto.createHmac('sha256', key).update(msg).digest()
 }
@@ -32,6 +37,7 @@ module.exports = {
   randomBytes: nodeCrypto.randomBytes,
   deriveKey,
   sha256,
+  hashByName,
   hmacSha256,
   md5,
 }

package/dist/server/node_modules/pg/lib/crypto/utils-webcrypto.js

@@ -5,6 +5,7 @@ module.exports = {
   randomBytes,
   deriveKey,
   sha256,
+  hashByName,
   hmacSha256,
   md5,
 }
@@ -13,6 +14,7 @@ module.exports = {
  * The Web Crypto API - grabbed from the Node.js library or the global
  * @type Crypto
  */
+// eslint-disable-next-line no-undef
 const webCrypto = nodeCrypto.webcrypto || globalThis.crypto
 /**
  * The SubtleCrypto API for low level crypto operations.
@@ -47,8 +49,8 @@ async function md5(string) {
 
 // See AuthenticationMD5Password at https://www.postgresql.org/docs/current/static/protocol-flow.html
 async function postgresMd5PasswordHash(user, password, salt) {
-  var inner = await md5(password + user)
-  var outer = await md5(Buffer.concat([Buffer.from(inner), salt]))
+  const inner = await md5(password + user)
+  const outer = await md5(Buffer.concat([Buffer.from(inner), salt]))
   return 'md5' + outer
 }
 
@@ -60,6 +62,10 @@ async function sha256(text) {
   return await subtleCrypto.digest('SHA-256', text)
 }
 
+async function hashByName(hashName, text) {
+  return await subtleCrypto.digest(hashName, text)
+}
+
 /**
  * Sign the message with the given key
  * @param {ArrayBuffer} keyBuffer

package/dist/server/node_modules/pg/lib/crypto/utils.js

@@ -5,5 +5,5 @@ if (useLegacyCrypto) {
   // We are on an old version of Node.js that requires legacy crypto utilities.
   module.exports = require('./utils-legacy')
 } else {
-  module.exports = require('./utils-webcrypto');
+  module.exports = require('./utils-webcrypto')
 }

package/dist/server/node_modules/pg/lib/defaults.js

@@ -1,11 +1,18 @@
 'use strict'
 
+let user
+try {
+  user = process.platform === 'win32' ? process.env.USERNAME : process.env.USER
+} catch {
+  // ignore, e.g., Deno without --allow-env
+}
+
 module.exports = {
   // database host. defaults to localhost
   host: 'localhost',
 
   // database user's name
-  user: process.platform === 'win32' ? process.env.USERNAME : process.env.USER,
+  user,
 
   // name of database to connect
   database: undefined,
@@ -72,10 +79,10 @@ module.exports = {
   keepalives_idle: 0,
 }
 
-var pgTypes = require('pg-types')
+const pgTypes = require('pg-types')
 // save default parsers
-var parseBigInteger = pgTypes.getTypeParser(20, 'text')
-var parseBigIntegerArray = pgTypes.getTypeParser(1016, 'text')
+const parseBigInteger = pgTypes.getTypeParser(20, 'text')
+const parseBigIntegerArray = pgTypes.getTypeParser(1016, 'text')
 
 // parse int8 so you can get your count values as actual numbers
 module.exports.__defineSetter__('parseInt8', function (val) {

package/dist/server/node_modules/pg/lib/index.js

@@ -1,9 +1,12 @@
 'use strict'
 
-var Client = require('./client')
-var defaults = require('./defaults')
-var Connection = require('./connection')
-var Pool = require('pg-pool')
+const Client = require('./client')
+const defaults = require('./defaults')
+const Connection = require('./connection')
+const Result = require('./result')
+const utils = require('./utils')
+const Pool = require('pg-pool')
+const TypeOverrides = require('./type-overrides')
 const { DatabaseError } = require('pg-protocol')
 const { escapeIdentifier, escapeLiteral } = require('./utils')
 
@@ -15,7 +18,7 @@ const poolFactory = (Client) => {
   }
 }
 
-var PG = function (clientConstructor) {
+const PG = function (clientConstructor) {
   this.defaults = defaults
   this.Client = clientConstructor
   this.Query = this.Client.Query
@@ -24,35 +27,47 @@ var PG = function (clientConstructor) {
   this.Connection = Connection
   this.types = require('pg-types')
   this.DatabaseError = DatabaseError
+  this.TypeOverrides = TypeOverrides
   this.escapeIdentifier = escapeIdentifier
   this.escapeLiteral = escapeLiteral
+  this.Result = Result
+  this.utils = utils
 }
 
-if (typeof process.env.NODE_PG_FORCE_NATIVE !== 'undefined') {
-  module.exports = new PG(require('./native'))
-} else {
-  module.exports = new PG(Client)
-
-  // lazy require native module...the native module may not have installed
-  Object.defineProperty(module.exports, 'native', {
-    configurable: true,
-    enumerable: false,
-    get() {
-      var native = null
-      try {
-        native = new PG(require('./native'))
-      } catch (err) {
-        if (err.code !== 'MODULE_NOT_FOUND') {
-          throw err
-        }
-      }
+let clientConstructor = Client
 
-      // overwrite module.exports.native so that getter is never called again
-      Object.defineProperty(module.exports, 'native', {
-        value: native,
-      })
+let forceNative = false
+try {
+  forceNative = !!process.env.NODE_PG_FORCE_NATIVE
+} catch {
+  // ignore, e.g., Deno without --allow-env
+}
 
-      return native
-    },
-  })
+if (forceNative) {
+  clientConstructor = require('./native')
 }
+
+module.exports = new PG(clientConstructor)
+
+// lazy require native module...the native module may not have installed
+Object.defineProperty(module.exports, 'native', {
+  configurable: true,
+  enumerable: false,
+  get() {
+    let native = null
+    try {
+      native = new PG(require('./native'))
+    } catch (err) {
+      if (err.code !== 'MODULE_NOT_FOUND') {
+        throw err
+      }
+    }
+
+    // overwrite module.exports.native so that getter is never called again
+    Object.defineProperty(module.exports, 'native', {
+      value: native,
+    })
+
+    return native
+  },
+})

package/dist/server/node_modules/pg/lib/native/client.js

@@ -1,21 +1,26 @@
-'use strict'
-
+const nodeUtils = require('util')
 // eslint-disable-next-line
 var Native
+// eslint-disable-next-line no-useless-catch
 try {
   // Wrap this `require()` in a try-catch to avoid upstream bundlers from complaining that this might not be available since it is an optional import
   Native = require('pg-native')
 } catch (e) {
   throw e
 }
-var TypeOverrides = require('../type-overrides')
-var EventEmitter = require('events').EventEmitter
-var util = require('util')
-var ConnectionParameters = require('../connection-parameters')
+const TypeOverrides = require('../type-overrides')
+const EventEmitter = require('events').EventEmitter
+const util = require('util')
+const ConnectionParameters = require('../connection-parameters')
+
+const NativeQuery = require('./query')
 
-var NativeQuery = require('./query')
+const queryQueueLengthDeprecationNotice = nodeUtils.deprecate(
+  () => {},
+  'Calling client.query() when the client is already executing a query is deprecated and will be removed in pg@9.0. Use async/await or an external async flow control mechanism instead.'
+)
 
-var Client = (module.exports = function (config) {
+const Client = (module.exports = function (config) {
   EventEmitter.call(this)
   config = config || {}
 
@@ -34,7 +39,7 @@ var Client = (module.exports = function (config) {
 
   // keep these on the object for legacy reasons
   // for the time being. TODO: deprecate all this jazz
-  var cp = (this.connectionParameters = new ConnectionParameters(config))
+  const cp = (this.connectionParameters = new ConnectionParameters(config))
   if (config.nativeConnectionString) cp.nativeConnectionString = config.nativeConnectionString
   this.user = cp.user
 
@@ -79,7 +84,7 @@ Client.prototype._errorAllQueries = function (err) {
 // pass an optional callback to be called once connected
 // or with an error if there was a connection error
 Client.prototype._connect = function (cb) {
-  var self = this
+  const self = this
 
   if (this._connecting) {
     process.nextTick(() => cb(new Error('Client has already been connected. You cannot reuse a client.')))
@@ -118,7 +123,7 @@ Client.prototype._connect = function (cb) {
       self.emit('connect')
       self._pulseQueryQueue(true)
 
-      cb()
+      cb(null, this)
     })
   })
 }
@@ -134,7 +139,7 @@ Client.prototype.connect = function (callback) {
       if (error) {
         reject(error)
       } else {
-        resolve()
+        resolve(this)
       }
     })
   })
@@ -151,11 +156,11 @@ Client.prototype.connect = function (callback) {
 //    optional string rowMode = 'array' for an array of results
 //  }
 Client.prototype.query = function (config, values, callback) {
-  var query
-  var result
-  var readTimeout
-  var readTimeoutTimer
-  var queryCallback
+  let query
+  let result
+  let readTimeout
+  let readTimeoutTimer
+  let queryCallback
 
   if (config === null || config === undefined) {
     throw new TypeError('Client was passed a null or undefined query')
@@ -167,26 +172,26 @@ Client.prototype.query = function (config, values, callback) {
       config.callback = values
     }
   } else {
-    readTimeout = this.connectionParameters.query_timeout
+    readTimeout = config.query_timeout || this.connectionParameters.query_timeout
     query = new NativeQuery(config, values, callback)
     if (!query.callback) {
       let resolveOut, rejectOut
       result = new this._Promise((resolve, reject) => {
         resolveOut = resolve
         rejectOut = reject
-      }).catch(err => {
-        Error.captureStackTrace(err);
-        throw err;
+      }).catch((err) => {
+        Error.captureStackTrace(err)
+        throw err
       })
       query.callback = (err, res) => (err ? rejectOut(err) : resolveOut(res))
     }
   }
 
   if (readTimeout) {
-    queryCallback = query.callback
+    queryCallback = query.callback || (() => {})
 
     readTimeoutTimer = setTimeout(() => {
-      var error = new Error('Query read timeout')
+      const error = new Error('Query read timeout')
 
       process.nextTick(() => {
         query.handleError(error, this.connection)
@@ -199,7 +204,7 @@ Client.prototype.query = function (config, values, callback) {
       query.callback = () => {}
 
       // Remove from queue
-      var index = this._queryQueue.indexOf(query)
+      const index = this._queryQueue.indexOf(query)
       if (index > -1) {
         this._queryQueue.splice(index, 1)
       }
@@ -229,6 +234,10 @@ Client.prototype.query = function (config, values, callback) {
     return result
   }
 
+  if (this._queryQueue.length > 0) {
+    queryQueueLengthDeprecationNotice()
+  }
+
   this._queryQueue.push(query)
   this._pulseQueryQueue()
   return result
@@ -236,20 +245,23 @@ Client.prototype.query = function (config, values, callback) {
 
 // disconnect from the backend server
 Client.prototype.end = function (cb) {
-  var self = this
+  const self = this
 
   this._ending = true
 
   if (!this._connected) {
     this.once('connect', this.end.bind(this, cb))
   }
-  var result
+  let result
   if (!cb) {
     result = new this._Promise(function (resolve, reject) {
       cb = (err) => (err ? reject(err) : resolve())
     })
   }
+
   this.native.end(function () {
+    self._connected = false
+
     self._errorAllQueries(new Error('Connection terminated'))
 
     process.nextTick(() => {
@@ -271,7 +283,7 @@ Client.prototype._pulseQueryQueue = function (initialConnection) {
   if (this._hasActiveQuery()) {
     return
   }
-  var query = this._queryQueue.shift()
+  const query = this._queryQueue.shift()
   if (!query) {
     if (!initialConnection) {
       this.emit('drain')
@@ -280,7 +292,7 @@ Client.prototype._pulseQueryQueue = function (initialConnection) {
   }
   this._activeQuery = query
   query.submit(this)
-  var self = this
+  const self = this
   query.once('_done', function () {
     self._pulseQueryQueue()
   })
@@ -305,3 +317,7 @@ Client.prototype.setTypeParser = function (oid, format, parseFn) {
 Client.prototype.getTypeParser = function (oid, format) {
   return this._types.getTypeParser(oid, format)
 }
+
+Client.prototype.isConnected = function () {
+  return this._connected
+}