jsql-neo 6.5.7 → 6.5.8

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.5.7** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.5.8** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.5.7 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.5.8 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/mongo_server.js

@@ -151,6 +151,7 @@ class MongoServer {
     this.port = options.port ?? 27017;
     this.host = options.host || '127.0.0.1';
     this.dataDir = options.dataDir || null;
+    this.maxMessageSize = options.maxMessageSize || 48 * 1024 * 1024;
     this._engine = null;
     this._server = null;
     this._sockets = new Set();
@@ -201,6 +202,10 @@ class MongoServer {
     this._sockets.add(socket);
     socket.on('close', () => this._sockets.delete(socket));
     let buf = Buffer.isBuffer(existing) ? Buffer.from(existing) : Buffer.alloc(0);
+    if (buf.length > this.maxMessageSize) {
+      socket.destroy();
+      return;
+    }
     socket.on('error', () => {});
     let processing = false;
     let again = false;
@@ -211,7 +216,10 @@ class MongoServer {
         for (;;) {
           if (buf.length < 4) break;
           const len = buf.readInt32LE(0);
-          if (len < 16 || len > 48 * 1024 * 1024) break;
+          if (len < 16 || len > this.maxMessageSize) {
+            socket.destroy();
+            return;
+          }
           if (buf.length < len) break;
           const msg = buf.slice(0, len);
           buf = buf.slice(len);
@@ -227,6 +235,10 @@ class MongoServer {
       }
     };
     socket.on('data', (chunk) => {
+      if (buf.length + chunk.length > this.maxMessageSize * 2) {
+        socket.destroy();
+        return;
+      }
       buf = Buffer.concat([buf, chunk]);
       processLoop();
     });

package/lib/mysql_server.js

@@ -1297,11 +1297,14 @@ class MysqlServer {
           );
           friendly.code = 'EADDRINUSE';
           friendly.cause = err;
-          if (cb) cb(friendly);
-          else throw friendly;
-        } else if (cb) cb(err);
+          if (typeof this.options.onError === 'function') this.options.onError(friendly);
+          else if (cb) cb(friendly);
+          else console.error('[jsql-neo] mysql server error:', friendly.message);
+        } else if (typeof this.options.onError === 'function') this.options.onError(err);
+        else if (cb) cb(err);
+        else console.error('[jsql-neo] mysql server error:', err.message);
       });
-      this._server.listen(this.port, this.host, cb || (() => {}));
+      this._server.listen(this.port, this.host, cb ? () => cb() : undefined);
     }).catch(err => {
       if (cb) cb(err);
       else throw err;

package/lib/native_target.js

@@ -0,0 +1,53 @@
+'use strict';
+
+const fs = require('fs');
+const { execFileSync } = require('child_process');
+
+const MIN_NAPI_VERSION = 6;
+
+function detectLibc(platform = process.platform) {
+  if (platform !== 'linux') return null;
+  try {
+    const report = process.report && typeof process.report.getReport === 'function'
+      ? process.report.getReport()
+      : null;
+    if (report && report.header && report.header.glibcVersionRuntime) return 'gnu';
+  } catch (_) { /* ignore */ }
+  try {
+    if (fs.existsSync('/etc/alpine-release')) return 'musl';
+  } catch (_) { /* ignore */ }
+  try {
+    const out = execFileSync('ldd', ['--version'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (/musl/i.test(out)) return 'musl';
+    if (/glibc|GNU libc/i.test(out)) return 'gnu';
+  } catch (_) { /* ignore */ }
+  return 'gnu';
+}
+
+function nativeTargetSuffix(platform = process.platform, arch = process.arch, libc = detectLibc(platform)) {
+  const p = platform === 'win32' ? 'win32' : platform === 'darwin' ? 'darwin' : 'linux';
+  const a = arch === 'x64' ? 'x64' : arch === 'arm64' ? 'arm64' : arch;
+  if (p === 'linux') return `${p}-${a}-${libc === 'musl' ? 'musl' : 'gnu'}`;
+  if (p === 'darwin') return `${p}-${a}`;
+  return `${p}-${a}-msvc`;
+}
+
+function nativeNapiVersion() {
+  const v = Number(process.versions && process.versions.napi);
+  return Number.isFinite(v) ? v : 0;
+}
+
+function supportsNativeNapi() {
+  return nativeNapiVersion() >= MIN_NAPI_VERSION;
+}
+
+module.exports = {
+  MIN_NAPI_VERSION,
+  detectLibc,
+  nativeTargetSuffix,
+  nativeNapiVersion,
+  supportsNativeNapi,
+};

package/lib/pg_server.js

@@ -845,11 +845,12 @@ class PgServer {
       this._sockets.add(socket);
       new PgConnection(socket, this);
     });
-    this._server.listen(this.port, this.host, cb || (() => {}));
     this._server.on('error', (err) => {
       if (this.options.onError) this.options.onError(err);
-      else throw err;
+      else if (cb) cb(err);
+      else console.error('[jsql-neo] pg server error:', err.message);
     });
+    this._server.listen(this.port, this.host, cb ? () => cb() : undefined);
     return this;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "6.5.7",
+  "version": "6.5.8",
   "description": "JSQL-NEO \u2014 Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",

package/postinstall.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const http = require('http');
 const https = require('https');
+const { detectLibc, nativeTargetSuffix, nativeNapiVersion, supportsNativeNapi, MIN_NAPI_VERSION } = require('./lib/native_target');
 
 const ROOT = __dirname;
 const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
@@ -69,13 +70,12 @@ const REPO = (pkg.repository && pkg.repository.url)
   ? pkg.repository.url.replace(/\.git$/, '').replace(/^.*github\.com\//i, '')
   : 'vexify-org/JSQL-neo';
 
-// 与 .github/workflows/build-native.yml 中发布的资产命名保持一致
-function nativeTargetSuffix(platform = process.platform, arch = process.arch) {
-  const p = platform === 'win32' ? 'win32' : platform === 'darwin' ? 'darwin' : 'linux';
-  const a = arch === 'x64' ? 'x64' : arch === 'arm64' ? 'arm64' : arch;
-  if (p === 'linux') return `${p}-${a}-gnu`;
-  if (p === 'darwin') return `${p}-${a}`;
-  return `${p}-${a}-msvc`;
+function sameOrigin(a, b) {
+  try { return new URL(a).origin === new URL(b).origin; } catch (_) { return false; }
+}
+
+function safeRedirect(next) {
+  return /^https?:/i.test(String(next || ''));
 }
 
 function download(url, dest, headers, redirects = 0) {
@@ -89,7 +89,11 @@ function download(url, dest, headers, redirects = 0) {
       if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
         res.resume();
         const next = new URL(res.headers.location, url).toString();
-        download(next, dest, headers, redirects + 1).then(resolve, reject);
+        if (!safeRedirect(next)) {
+          reject(new Error(`invalid redirect target for ${url}`));
+          return;
+        }
+        download(next, dest, sameOrigin(next, url) ? headers : undefined, redirects + 1).then(resolve, reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -145,7 +149,11 @@ function fetchText(url, headers, redirects = 0) {
       if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
         res.resume();
         const next = new URL(res.headers.location, url).toString();
-        fetchText(next, headers, redirects + 1).then(resolve, reject);
+        if (!safeRedirect(next)) {
+          reject(new Error(`invalid redirect target for ${url}`));
+          return;
+        }
+        fetchText(next, sameOrigin(next, url) ? headers : undefined, redirects + 1).then(resolve, reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -262,7 +270,15 @@ function tryLoadNative() {
 }
 
 async function downloadAndVerify() {
-  const asset = `jsql-neo-native.${nativeTargetSuffix()}.node`;
+  if (!supportsNativeNapi()) {
+    console.warn(
+      `[jsql-neo] Node ${process.versions.node} provides N-API ${nativeNapiVersion() || 'unknown'}, ` +
+      `but the native module requires N-API >= ${MIN_NAPI_VERSION}; skipping native download.`
+    );
+    return false;
+  }
+  const libc = detectLibc();
+  const asset = process.env.JSQL_NATIVE_ASSET || `jsql-neo-native.${nativeTargetSuffix(process.platform, process.arch, libc)}.node`;
   const raw = `https://github.com/${REPO}/releases/download/${TAG}/${asset}`;
 
   let expected = null;
@@ -274,11 +290,18 @@ async function downloadAndVerify() {
 
   const allowUnverified = process.env.JSQL_ALLOW_UNVERIFIED_NATIVE === '1';
   if (!expected && !allowUnverified) {
-    // fail closed：拿不到 SHA256SUMS 就不下载，绝不 require 未经校验的二进制
-    console.warn(
-      '[jsql-neo] no SHA256SUMS available for this release; refusing to download an unverified native module.\n' +
-      '[jsql-neo] set JSQL_NATIVE_SHA256=<64-hex> to pin a checksum, or JSQL_ALLOW_UNVERIFIED_NATIVE=1 to override (unsafe).'
-    );
+    if (libc === 'musl') {
+      console.warn(
+        `[jsql-neo] musl libc detected but this release has no native asset for ${asset}; ` +
+        'falling back to the WASM/JS engine. Set JSQL_NATIVE_ASSET to a compatible musl build if available.'
+      );
+    } else {
+      // fail closed：拿不到 SHA256SUMS 就不下载，绝不 require 未经校验的二进制
+      console.warn(
+        '[jsql-neo] no SHA256SUMS available for this release; refusing to download an unverified native module.\n' +
+        '[jsql-neo] set JSQL_NATIVE_SHA256=<64-hex> to pin a checksum, or JSQL_ALLOW_UNVERIFIED_NATIVE=1 to override (unsafe).'
+      );
+    }
     return false;
   }
   if (!expected) {
@@ -323,6 +346,13 @@ async function ensureNativeNode() {
     console.log('[jsql-neo] native module ready: native/jsql-neo-native.node');
     return;
   }
+  if (!supportsNativeNapi()) {
+    console.warn(
+      `[jsql-neo] Node ${process.versions.node} provides N-API ${nativeNapiVersion() || 'unknown'}, ` +
+      `but the native module requires N-API >= ${MIN_NAPI_VERSION}; using the WASM/JS engine.`
+    );
+    return;
+  }
   if (await downloadAndVerify()) return;
   buildNativeFromSource();
 }