mssql 9.1.2 → 9.1.4

package/lib/tedious/request.js

@@ -4,7 +4,7 @@ const tds = require('tedious')
 const debug = require('debug')('mssql:tedi')
 const BaseRequest = require('../base/request')
 const RequestError = require('../error/request-error')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, assertSafeColumnName, assertSafeTypeName, assertSafeTypeSize, assertSafeProcedureName } = require('../utils')
 const { TYPES, DECLARATIONS, declare, cast } = require('../datatypes')
 const Table = require('../table')
 const { PARSERS: UDT } = require('../udt')
@@ -219,6 +219,15 @@ class Request extends BaseRequest {
 
       try {
         table._makeBulk()
+        // Checked before a connection is borrowed, so that a rejected name cannot leave
+        // the pool short of one.
+        table.columns.forEach(col => assertSafeColumnName(col.name))
+        // tedious writes these into `insert bulk ... WITH (ORDER (<key> <direction>))`
+        // UNQUOTED — unlike a column name, which it emits as `[name]`. So the quoted-identifier
+        // rule does not apply here: what matters is that the key cannot end the clause. It is
+        // checked as an identifier, bare or quoted, which is what that position accepts. The
+        // checked keys are rebuilt into the options actually handed to the driver, so the value
+        // that was validated is the one emitted even if the caller's object changes after.
       } catch (e) {
         return callback(new RequestError(e, 'EREQUEST'))
       }
@@ -332,15 +341,38 @@ class Request extends BaseRequest {
           }
         }
 
-        const bulk = connection.newBulkLoad(table.path, options, done)
+        // A connection is held from here on, so anything that can throw has to hand the
+        // error back through `done`, which releases it. That includes newBulkLoad itself:
+        // tedious validates the bulk options there and throws for a bad `order` direction,
+        // which would otherwise strand the borrowed connection.
+        let bulk
+        let statement
+        try {
+          let bulkOptions = options
+          if (options && options.order) {
+            bulkOptions = Object.assign({}, options, {
+              order: Object.fromEntries(Object.entries(options.order)
+                .map(([key, direction]) => [assertSafeTypeName(key), direction]))
+            })
+          }
+          bulk = connection.newBulkLoad(table.path, bulkOptions, done)
+          for (const col of table.columns) {
+            // tedious emits this name as a quoted identifier of its own when it builds
+            // the `insert bulk` statement, so it is checked here as well as in
+            // Table#declare, in case the name changed since it was checked above.
+            bulk.addColumn(assertSafeColumnName(col.name), getTediousType(col.type), { nullable: col.nullable, length: assertSafeTypeSize(col.length), scale: assertSafeTypeSize(col.scale), precision: assertSafeTypeSize(col.precision) })
+          }
 
-        for (const col of table.columns) {
-          bulk.addColumn(col.name, getTediousType(col.type), { nullable: col.nullable, length: col.length, scale: col.scale, precision: col.precision })
+          if (table.create) {
+            const objectid = table.temporary ? `tempdb..[${table.name}]` : table.path
+            statement = `if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`
+          }
+        } catch (e) {
+          return done(e)
         }
 
         if (table.create) {
-          const objectid = table.temporary ? `tempdb..[${table.name}]` : table.path
-          const req = new tds.Request(`if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`, err => {
+          const req = new tds.Request(statement, err => {
             if (err) return done(err)
 
             connection.execBulkLoad(bulk, table.rows)
@@ -439,6 +471,26 @@ class Request extends BaseRequest {
         connection.on('errorMessage', errorHandlers.errorMessage = handleError.bind(null, false, connection))
         connection.on('error', errorHandlers.error = handleError.bind(null, true, connection))
 
+        // Give up before the request is sent: the listeners attached just above have to
+        // come off the connection before it goes back to the pool, or they accumulate on
+        // it and fire for whoever borrows it next.
+        const abandon = (err) => {
+          delete this._cancel
+
+          if (hasReturned) {
+            return
+          }
+
+          for (const event in errorHandlers) {
+            connection.removeListener(event, errorHandlers[event])
+          }
+
+          this.parent.release(connection)
+          hasReturned = true
+
+          return callback(err)
+        }
+
         debug('request(%d): query', IDS.get(this), command)
 
         const req = new tds.Request(command, err => {
@@ -647,20 +699,23 @@ class Request extends BaseRequest {
                 param.value = getTediousType(param.type).validate(param.value, this.parent.collation)
               } catch (e) {
                 e.message = `Validation failed for parameter '${name}'. ${e.message}`
-                const err = new RequestError(e, 'EPARAM')
-
-                this.parent.release(connection)
-                return callback(err)
+                return abandon(new RequestError(e, 'EPARAM'))
               }
             }
 
             const declarations = []
-            for (const name in this.parameters) {
-              if (!objectHasProperty(this.parameters, name)) {
-                continue
+            try {
+              for (const name in this.parameters) {
+                if (!objectHasProperty(this.parameters, name)) {
+                  continue
+                }
+                const param = this.parameters[name]
+                // a connection is held here, so a rejected declaration has to be reported
+                // through the path that releases it
+                declarations.push(`@${name} ${declare(param.type, param)}`)
               }
-              const param = this.parameters[name]
-              declarations.push(`@${name} ${declare(param.type, param)}`)
+            } catch (e) {
+              return abandon(new RequestError(e, 'EREQUEST'))
             }
 
             const assigns = []
@@ -688,16 +743,22 @@ class Request extends BaseRequest {
             req.sqlTextOrProcedure = `declare ${declarations.join(', ')};select ${assigns.join(', ')};${req.sqlTextOrProcedure};${batchHasOutput ? (`select 1 as [___return___], ${selects.join(', ')}`) : ''}`
           }
         } else {
-          for (const name in this.parameters) {
-            if (!objectHasProperty(this.parameters, name)) {
-              continue
-            }
-            const param = this.parameters[name]
-            if (param.io === 1) {
-              req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
-            } else {
-              req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+          try {
+            for (const name in this.parameters) {
+              if (!objectHasProperty(this.parameters, name)) {
+                continue
+              }
+              const param = this.parameters[name]
+              // tedious builds the sp_executesql declaration from these, so a rejected size
+              // has to be reported through the path that releases the connection
+              if (param.io === 1) {
+                req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+              } else {
+                req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+              }
             }
+          } catch (e) {
+            return abandon(new RequestError(e, 'EREQUEST'))
           }
         }
 
@@ -793,6 +854,35 @@ class Request extends BaseRequest {
         connection.on('errorMessage', errorHandlers.errorMessage = handleError.bind(null, false, connection))
         connection.on('error', errorHandlers.error = handleError.bind(null, true, connection))
 
+        // A connection is held from here on. handleError builds a fresh Error and would
+        // relabel a rejected identifier as EREQUEST, so anything that can throw here is
+        // handed back through this instead, which keeps the code and releases the connection.
+        const abandon = (err) => {
+          delete this._cancel
+
+          if (hasReturned) {
+            return
+          }
+
+          for (const event in errorHandlers) {
+            connection.removeListener(event, errorHandlers[event])
+          }
+
+          this.parent.release(connection)
+          hasReturned = true
+
+          return callback(err)
+        }
+
+        let procedureName
+        try {
+          procedureName = assertSafeProcedureName(procedure)
+        } catch (e) {
+          // wrapped like every other rejection here, so the caller sees the same error class
+          // whichever driver is in use; MSSQLError keeps the EINJECT code through the wrap
+          return abandon(new RequestError(e, 'EREQUEST'))
+        }
+
         if (debug.enabled) {
           // log stored procedure executions and provided parameters
           const params = Object.keys(this.parameters).map(k => this.parameters[k])
@@ -805,7 +895,7 @@ class Request extends BaseRequest {
           debug('request(%d): execute %s %O', IDS.get(this), procedure, logParams)
         }
 
-        const req = new tds.Request(procedure, err => {
+        const req = new tds.Request(procedureName, err => {
           // to make sure we handle no-sql errors as well
           if (err && (!errors.length || (errors.length && err.message !== errors[errors.length - 1].message))) {
             err = new RequestError(err, 'EREQUEST')
@@ -967,16 +1057,20 @@ class Request extends BaseRequest {
           output[parameterName] = value
         })
 
-        for (const name in this.parameters) {
-          if (!objectHasProperty(this.parameters, name)) {
-            continue
-          }
-          const param = this.parameters[name]
-          if (param.io === 1) {
-            req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
-          } else {
-            req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+        try {
+          for (const name in this.parameters) {
+            if (!objectHasProperty(this.parameters, name)) {
+              continue
+            }
+            const param = this.parameters[name]
+            if (param.io === 1) {
+              req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+            } else {
+              req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+            }
           }
+        } catch (e) {
+          return abandon(new RequestError(e, 'EREQUEST'))
         }
 
         connection.callProcedure(req)

package/lib/utils.js

@@ -1,3 +1,5 @@
+const MSSQLError = require('./error/mssql-error')
+
 const IDS = new WeakMap()
 const INCREMENT = {
   Connection: 1,
@@ -7,8 +9,94 @@ const INCREMENT = {
   PreparedStatement: 1
 }
 
+// Parameter names are emitted into generated T-SQL as `@<name>`. The `@` occupies the
+// identifier's first position, so every character of the name sits in a subsequent
+// position, where T-SQL also permits digits and `$`. The set is deliberately wider than
+// the names the server will accept: it excludes the characters that could end the
+// identifier and let the rest of the name be read as SQL, and nothing else, so a name
+// the server dislikes still fails there rather than becoming an error here. The
+// exception is the invisible format characters, which are rejected outright.
+// Only the two zero-width joiners are taken from the format characters; the rest of that
+// category includes ZERO WIDTH SPACE, which the server does treat as a separator.
+const PARAM_NAME = /^(?:[\p{L}\p{N}\p{M}\p{Pc}@#$・･]|\u200C|\u200D)*$/u
+// A table-valued parameter's type name is emitted into the parameter declaration, and a
+// stored procedure's name is emitted into an `exec`, so both are checked the way the server
+// reads a qualified name: one or more parts separated by `.`, each either bare, holding only
+// the characters an identifier is made of, or quoted in brackets or double quotes, where
+// anything goes until the closing mark. Nothing that gets through can end the statement it
+// sits in and have the rest read as SQL.
+const QUALIFIED_NAME_PART = '(?:\\[(?:[^\\]]|\\]\\])*\\]|"(?:[^"]|"")*"|[\\p{L}\\p{N}\\p{M}\\p{Pc}@#$]+)'
+// An intermediate part may be omitted — `db..proc` and `server.db..proc` are ordinary
+// T-SQL — but the first and last parts must be present, so a bare `.`, a leading `.proc`
+// and a trailing `db..` are still refused. An empty part cannot end the identifier.
+const QUALIFIED_NAME = new RegExp(`^(?:${QUALIFIED_NAME_PART}(?:\\.${QUALIFIED_NAME_PART}?)*\\.)?${QUALIFIED_NAME_PART}$`, 'u')
+
+// A length, precision or scale is emitted into the same declaration. `max` is the only
+// word the declaration takes there; everything else the server wants is a number.
+const TYPE_SIZE = /^\w*$/
+
+// A column name is emitted as a quoted identifier, `[name]`, by this module and again by
+// the driver's own bulk load. Only `]` can terminate that quoting early, and doubling it
+// is the documented way to include one literally.
+const escapesQuotedIdentifier = (name) => String(name).replace(/]]/g, '').includes(']')
+
 module.exports = {
   objectHasProperty: (object, property) => Object.prototype.hasOwnProperty.call(object, property),
+  isValidParameterName: (name) => {
+    // Only primitives are accepted: an object could return a different value from a second
+    // toString() call, passing validation here and emitting something else into the SQL.
+    const type = typeof name
+    return (type === 'string' || type === 'number') && PARAM_NAME.test(String(name))
+  },
+  assertSafeTypeName: (name) => {
+    // A type name is optional: the tedious driver takes it from the Table passed as the
+    // value, and only uses this one when it is given.
+    if (name == null) {
+      return name
+    }
+    // Read once, and return what was read. Whatever is emitted is what was checked, so a
+    // value that reports a different name the second time cannot reach the SQL.
+    const type = String(name).trim()
+    if (!QUALIFIED_NAME.test(type)) {
+      throw new MSSQLError(`Invalid type name '${type}'. Type names may only contain identifier characters.`, 'EINJECT')
+    }
+    return type
+  },
+  assertSafeProcedureName: (name) => {
+    // The msnodesqlv8 driver builds `exec @___return___ = <name>` as SQL text, so the name is
+    // checked before it is emitted. The tedious driver sends it as a bound RPC and cannot be
+    // injected through it, but it is checked there too so that a name is accepted or rejected
+    // the same way whichever driver is in use.
+    // Read once, and return what was read, for the same reason as the type name.
+    const procedure = String(name).trim()
+    if (!QUALIFIED_NAME.test(procedure)) {
+      throw new MSSQLError(`Invalid procedure name '${procedure}'. Procedure names may only contain identifier characters.`, 'EINJECT')
+    }
+    return procedure
+  },
+  assertSafeTypeSize: (value) => {
+    if (value == null || typeof value === 'number') {
+      return value
+    }
+    // Read once and return what was read, for the same reason as the type name. Padding is
+    // trimmed rather than refused, and a word the server will reject still reaches it.
+    const size = String(value).trim()
+    if (!TYPE_SIZE.test(size)) {
+      throw new MSSQLError(`Invalid type size '${size}'. A length, precision or scale must be a number.`, 'EINJECT')
+    }
+    return size
+  },
+  assertSafeColumnName: (name) => {
+    const type = typeof name
+    if (type !== 'string' && type !== 'number') {
+      throw new MSSQLError(`Invalid column name '${String(name)}'. Column names must be a string or a number.`, 'EINJECT')
+    }
+    const column = String(name)
+    if (escapesQuotedIdentifier(column)) {
+      throw new MSSQLError(`Invalid column name '${column}'. A ']' in a column name must be written as ']]'.`, 'EINJECT')
+    }
+    return column
+  },
   INCREMENT,
   IDS: {
     get: IDS.get.bind(IDS),

package/package.json

@@ -21,7 +21,7 @@
     "azure",
     "node-mssql"
   ],
-  "version": "9.1.2",
+  "version": "9.1.4",
   "main": "index.js",
   "repository": "github:tediousjs/node-mssql",
   "license": "MIT",
@@ -36,12 +36,12 @@
   "devDependencies": {
     "@commitlint/cli": "^17.6.6",
     "@commitlint/config-conventional": "^17.6.6",
-    "@semantic-release/commit-analyzer": "^10.0.1",
-    "@semantic-release/github": "^9.0.3",
-    "@semantic-release/npm": "^10.0.4",
-    "@semantic-release/release-notes-generator": "^11.0.4",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/github": "^12.0.6",
+    "@semantic-release/npm": "^13.1.5",
+    "@semantic-release/release-notes-generator": "^14.1.0",
     "mocha": "^10.0.0",
-    "semantic-release": "^21.0.7",
+    "semantic-release": "^25.0.3",
     "standard": "^17.0.0"
   },
   "engines": {