mssql 9.3.2 → 9.3.3

package/README.md

@@ -2,7 +2,7 @@
 
 Microsoft SQL Server client for Node.js
 
-[![NPM Version][npm-image]][npm-url] [![NPM Downloads][downloads-image]][downloads-url] [![Appveyor CI][appveyor-image]][appveyor-url] [![Join the chat at https://gitter.im/patriksimek/node-mssql](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/patriksimek/node-mssql?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+[![NPM Version][npm-image]][npm-url] [![NPM Downloads][downloads-image]][downloads-url] [![Join the chat at https://gitter.im/patriksimek/node-mssql](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/patriksimek/node-mssql?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 
 Supported TDS drivers:
 - [Tedious][tedious-url] (pure JavaScript - Windows/macOS/Linux, default)
@@ -108,6 +108,13 @@ async () => {
 * [bulk](#bulk-table-options-callback)
 * [cancel](#cancel)
 
+### Identifier rules
+
+* [Parameter names](#parameter-names)
+* [Column names](#column-names)
+* [Type names and sizes](#type-names-and-sizes)
+* [Procedure names](#procedure-names)
+
 ### Transactions
 
 * [Transaction](#transaction)
@@ -785,6 +792,7 @@ request.execute('procedure_name', (err, result) => {
 
 __Errors__
 - EREQUEST (`RequestError`) - *Message from SQL Server*
+- EINJECT (`RequestError`) - Procedure name or parameter type is not a valid identifier. See [Identifiers](#identifiers).
 - ECANCEL (`RequestError`) - Cancelled.
 - ETIMEOUT (`RequestError`) - Request timeout.
 - ENOCONN (`RequestError`) - No connection is specified for that request.
@@ -837,7 +845,7 @@ sql.map.register(Number, sql.BigInt)
 
 __Errors__ (synchronous)
 - EARGS (`RequestError`) - Invalid number of arguments.
-- EINJECT (`RequestError`) - SQL injection warning.
+- EINJECT (`RequestError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -862,7 +870,7 @@ request.output('output_parameter', sql.VarChar(50), 'abc')
 
 __Errors__ (synchronous)
 - EARGS (`RequestError`) - Invalid number of arguments.
-- EINJECT (`RequestError`) - SQL injection warning.
+- EINJECT (`RequestError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -946,6 +954,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 ```javascript
 const request = new sql.Request()
@@ -991,6 +1000,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 You can enable multiple recordsets in queries with the `request.multiple = true` command.
 
@@ -1037,6 +1047,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Column name or parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1267,7 +1278,7 @@ ps.input('input_parameter', sql.VarChar(50))
 
 __Errors__ (synchronous)
 - EARGS (`PreparedStatementError`) - Invalid number of arguments.
-- EINJECT (`PreparedStatementError`) - SQL injection warning.
+- EINJECT (`PreparedStatementError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1289,7 +1300,7 @@ ps.output('output_parameter', sql.VarChar(50))
 
 __Errors__ (synchronous)
 - EARGS (`PreparedStatementError`) - Invalid number of arguments.
-- EINJECT (`PreparedStatementError`) - SQL injection warning.
+- EINJECT (`PreparedStatementError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1862,6 +1873,100 @@ Results in:
 ]
 ```
 
+## Identifiers
+
+Values are sent to the server as parameters and may hold anything. A few things
+are not values, and cannot be: the name of a parameter, the name of a column in a
+bulk load, the type a parameter is declared as, and the name of a stored procedure.
+Those are *identifiers*, and
+no SQL database can bind them, so this library builds them into the statement it
+sends. It checks them, and rejects anything that could end the identifier and have
+the rest of the value read as SQL.
+
+That check is not a substitute for your own. If any of these comes from somewhere
+you do not control, map it to a value you expect first:
+
+```javascript
+const columns = { name: 'name', created: 'created_at' }        // what you allow
+const column = columns[req.query.sortBy]                       // what they asked for
+if (!column) throw new Error('unknown column')
+
+request.input(column, sql.NVarChar, value)
+```
+
+### Parameter names
+
+`request.input()`, `request.output()` and the same methods on a prepared statement
+take a name without the leading `@`. It may hold letters, digits, marks and
+connector punctuation from any script, along with `@`, `#`, `$` and the two
+zero-width joiners. A name that is not a string or a number is rejected, as is one
+holding an invisible format character, because one of them is a separator the
+server treats as ending the identifier.
+
+Anything else raises `EINJECT`. Note that a name this library accepts may still be
+one the server rejects; the check is deliberately wider than the server's own rules
+so that it only refuses what could change the shape of the statement.
+
+### Column names
+
+`table.columns.add()` names a column in a bulk load, and the name is emitted as a
+quoted identifier. A `]` ends that quoting, so a name holding one must double it,
+which is how T-SQL escapes it:
+
+```javascript
+table.columns.add('a]]b', sql.Int)   // the column named a]b
+```
+
+A single `]` raises `EINJECT`. Column names are not otherwise restricted: spaces,
+punctuation and reserved words are all fine, because the quoting handles them.
+
+The keys of `options.order` are also identifiers, but the driver writes them into the bulk
+statement's `ORDER (...)` clause *unquoted* rather than as `[name]`. They follow the type
+name rule instead: bare, or quoted with brackets or double quotes.
+
+```javascript
+request.bulk(table, { order: { created_at: 'ASC' } })
+request.bulk(table, { order: { '[Created At]': 'DESC' } })   // quote a spaced name yourself
+```
+
+### Type names and sizes
+
+`sql.TVP()` takes the name of a table type, optionally qualified with a schema and
+optionally quoted with brackets or double quotes. A size — the length, precision or
+scale of a type such as `sql.VarChar()` — must be a number, or the word `max` the
+declaration accepts in its place. Padding is trimmed.
+
+```javascript
+request.input('rows', sql.TVP('dbo.[My Type]'), table)
+request.input('name', sql.VarChar(50), value)
+request.input('note', sql.VarChar('max'), value)
+```
+
+A size is checked wherever it is built into SQL, which includes the declaration a
+bulk load sends and the parameter list a query sends, not only `sql.TVP()`.
+
+### Procedure names
+
+`request.execute()` takes the name of a stored procedure, optionally qualified with
+a server, database and schema and optionally quoted with brackets or double quotes.
+An omitted part may be left empty, as T-SQL allows. The `msnodesqlv8` driver builds
+this into the statement it sends; the `tedious` driver sends it as a bound remote
+procedure call and could not be injected through it. Both check it, so a name is
+accepted or rejected the same way whichever driver you use.
+
+```javascript
+request.execute('dbo.[My Procedure]')
+request.execute('master..sp_who')      // an omitted schema is fine
+```
+
+The first and last parts must be present, so `.proc` and `db..` are rejected.
+
+Anything else raises `EINJECT`. Numbered procedures — the deprecated
+`procedure;1` form — are rejected, because the `;` cannot be told apart from the
+end of a statement.
+
+---------------------------------------
+
 ## Errors
 
 There are 4 types of errors you can handle:
@@ -1898,10 +2003,10 @@ Name | Code | Message
 `RequestError` | ECANCEL | Cancelled.
 `RequestError` | ETIMEOUT | Request timeout.
 `RequestError` | EARGS | Invalid number of arguments.
-`RequestError` | EINJECT | SQL injection warning.
+`RequestError` | EINJECT | Parameter name, column name or type is not a valid identifier.
 `RequestError` | ENOCONN | No connection is specified for that request.
 `PreparedStatementError` | EARGS | Invalid number of arguments.
-`PreparedStatementError` | EINJECT | SQL injection warning.
+`PreparedStatementError` | EINJECT | Parameter name is not a valid identifier.
 `PreparedStatementError` | EALREADYPREPARED | Statement is already prepared.
 `PreparedStatementError` | ENOTPREPARED | Statement is not prepared.
 
@@ -2132,8 +2237,6 @@ to create new connections or not
 [downloads-url]: https://www.npmjs.com/package/mssql
 [david-image]: https://img.shields.io/david/tediousjs/node-mssql.svg?style=flat-square
 [david-url]: https://david-dm.org/tediousjs/node-mssql
-[appveyor-image]: https://ci.appveyor.com/api/projects/status/e5gq1a0ujwams9t7/branch/master?svg=true
-[appveyor-url]: https://ci.appveyor.com/project/tediousjs/node-mssql
 
 [tedious-url]: https://www.npmjs.com/package/tedious
 [msnodesqlv8-url]: https://www.npmjs.com/package/msnodesqlv8

package/lib/base/prepared-statement.js

@@ -2,7 +2,7 @@
 
 const debug = require('debug')('mssql:base')
 const { EventEmitter } = require('events')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, isValidParameterName } = require('../utils')
 const globalConnection = require('../global-connection')
 const { TransactionError, PreparedStatementError } = require('../error')
 const shared = require('../shared')
@@ -91,8 +91,8 @@ class PreparedStatement extends EventEmitter {
    */
 
   input (name, type) {
-    if ((/(--| |\/\*|\*\/|')/).test(name)) {
-      throw new PreparedStatementError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new PreparedStatementError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -144,8 +144,8 @@ class PreparedStatement extends EventEmitter {
    */
 
   output (name, type) {
-    if (/(--| |\/\*|\*\/|')/.test(name)) {
-      throw new PreparedStatementError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new PreparedStatementError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -235,17 +235,25 @@ class PreparedStatement extends EventEmitter {
       const req = new shared.driver.Request(this)
       req.stream = false
       req.output('handle', TYPES.Int)
-      req.input('params', TYPES.NVarChar, ((() => {
-        const result = []
+      let params
+      try {
+        params = []
         for (const name in this.parameters) {
           if (!objectHasProperty(this.parameters, name)) {
             continue
           }
           const param = this.parameters[name]
-          result.push(`@${name} ${declare(param.type, param)}${param.io === 2 ? ' output' : ''}`)
+          // a connection is held here, so a rejected declaration has to be reported
+          // through the path that releases it
+          params.push(`@${name} ${declare(param.type, param)}${param.io === 2 ? ' output' : ''}`)
         }
-        return result
-      })()).join(','))
+      } catch (e) {
+        this.parent.release(this._acquiredConnection)
+        this._acquiredConnection = null
+        this._acquiredConfig = null
+        return callback(new PreparedStatementError(e, 'EREQUEST'))
+      }
+      req.input('params', TYPES.NVarChar, params.join(','))
       req.input('stmt', TYPES.NVarChar, this.statement)
       req.execute('sp_prepare', (err, result) => {
         if (err) {

package/lib/base/request.js

@@ -3,7 +3,7 @@
 const debug = require('debug')('mssql:base')
 const { EventEmitter } = require('events')
 const { Readable } = require('stream')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, isValidParameterName } = require('../utils')
 const globalConnection = require('../global-connection')
 const { RequestError, ConnectionError } = require('../error')
 const { TYPES } = require('../datatypes')
@@ -107,8 +107,8 @@ class Request extends EventEmitter {
    */
 
   input (name, type, value) {
-    if ((/(--| |\/\*|\*\/|')/).test(name)) {
-      throw new RequestError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new RequestError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -170,8 +170,8 @@ class Request extends EventEmitter {
   output (name, type, value) {
     if (!type) { type = TYPES.NVarChar }
 
-    if ((/(--| |\/\*|\*\/|')/).test(name)) {
-      throw new RequestError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new RequestError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if ((type === TYPES.Text) || (type === TYPES.NText) || (type === TYPES.Image)) {

package/lib/datatypes.js

@@ -1,5 +1,5 @@
 'use strict'
-const objectHasProperty = require('./utils').objectHasProperty
+const { objectHasProperty, assertSafeTypeName, assertSafeTypeSize } = require('./utils')
 const inspect = Symbol.for('nodejs.util.inspect.custom')
 
 const TYPES = {
@@ -132,19 +132,33 @@ for (const key in TYPES) {
 }
 
 module.exports.declare = (type, options) => {
+  // sizes and the type name reach the generated declaration directly, so they are checked
+  // here rather than trusted from whatever built the parameter. Each is read only in the
+  // branch that emits it, so a type that takes no size still needs no options.
   switch (type) {
-    case TYPES.VarChar: case TYPES.VarBinary:
-      return `${type.declaration} (${options.length > 8000 ? 'MAX' : (options.length == null ? 'MAX' : options.length)})`
-    case TYPES.NVarChar:
-      return `${type.declaration} (${options.length > 4000 ? 'MAX' : (options.length == null ? 'MAX' : options.length)})`
-    case TYPES.Char: case TYPES.NChar: case TYPES.Binary:
-      return `${type.declaration} (${options.length == null ? 1 : options.length})`
-    case TYPES.Decimal: case TYPES.Numeric:
-      return `${type.declaration} (${options.precision == null ? 18 : options.precision}, ${options.scale == null ? 0 : options.scale})`
-    case TYPES.Time: case TYPES.DateTime2: case TYPES.DateTimeOffset:
-      return `${type.declaration} (${options.scale == null ? 7 : options.scale})`
+    case TYPES.VarChar: case TYPES.VarBinary: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length > 8000 ? 'MAX' : (length == null ? 'MAX' : length)})`
+    }
+    case TYPES.NVarChar: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length > 4000 ? 'MAX' : (length == null ? 'MAX' : length)})`
+    }
+    case TYPES.Char: case TYPES.NChar: case TYPES.Binary: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length == null ? 1 : length})`
+    }
+    case TYPES.Decimal: case TYPES.Numeric: {
+      const precision = assertSafeTypeSize(options.precision)
+      const scale = assertSafeTypeSize(options.scale)
+      return `${type.declaration} (${precision == null ? 18 : precision}, ${scale == null ? 0 : scale})`
+    }
+    case TYPES.Time: case TYPES.DateTime2: case TYPES.DateTimeOffset: {
+      const scale = assertSafeTypeSize(options.scale)
+      return `${type.declaration} (${scale == null ? 7 : scale})`
+    }
     case TYPES.TVP:
-      return `${options.tvpType} readonly`
+      return `${assertSafeTypeName(options.tvpType)} readonly`
     default:
       return type.declaration
   }

package/lib/msnodesqlv8/request.js

@@ -4,7 +4,7 @@ const msnodesql = require('msnodesqlv8')
 const debug = require('debug')('mssql:msv8')
 const BaseRequest = require('../base/request')
 const RequestError = require('../error/request-error')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, assertSafeColumnName, assertSafeTypeName, assertSafeTypeSize, assertSafeProcedureName } = require('../utils')
 const { TYPES, DECLARATIONS, declare } = require('../datatypes')
 const { PARSERS: UDT } = require('../udt')
 const Table = require('../table')
@@ -154,16 +154,32 @@ class Request extends BaseRequest {
 
       try {
         table._makeBulk()
+        // Checked before a connection is borrowed, so that a rejected name cannot leave
+        // the pool short of one.
+        table.columns.forEach(col => {
+          assertSafeColumnName(col.name)
+          // This driver hands the column definition to its table manager rather than writing
+          // it into SQL, so a size never reaches a statement here. It is checked all the same,
+          // so that a column either works on both drivers or on neither.
+          assertSafeTypeSize(col.length)
+          assertSafeTypeSize(col.precision)
+          assertSafeTypeSize(col.scale)
+        })
+        // checked here too, so an ordering key is accepted or rejected the same way on
+        // either driver even though this one does not build the statement itself
+        if (options && options.order) {
+          Object.keys(options.order).forEach(key => assertSafeTypeName(key))
+        }
       } catch (e) {
         return callback(new RequestError(e, 'EREQUEST'))
       }
 
       if (!table.name) {
-        setImmediate(callback, new RequestError('Table name must be specified for bulk insert.', 'ENAME'))
+        return setImmediate(callback, new RequestError('Table name must be specified for bulk insert.', 'ENAME'))
       }
 
       if (table.name.charAt(0) === '@') {
-        setImmediate(callback, new RequestError("You can't use table variables for bulk insert.", 'ENAME'))
+        return setImmediate(callback, new RequestError("You can't use table variables for bulk insert.", 'ENAME'))
       }
 
       this.parent.acquire(this, (err, connection) => {
@@ -189,8 +205,11 @@ class Request extends BaseRequest {
                 connection.hasError = true
               }
 
+              // a rejected identifier keeps its own code; anything else is a driver
+              // error, whose numeric code must not become the public one
+              const rejectedIdentifier = err.code === 'EINJECT'
               err = new RequestError(err)
-              err.code = 'EREQUEST'
+              err.code = rejectedIdentifier ? 'EINJECT' : 'EREQUEST'
             }
 
             this.parent.release(connection)
@@ -210,14 +229,29 @@ class Request extends BaseRequest {
               }
 
               const rows = []
-              for (const row of Array.from(table.rows)) {
-                const item = {}
-                for (let index = 0; index < table.columns.length; index++) {
-                  const col = table.columns[index]
-                  item[col.name] = row[index]
+              try {
+                for (const col of table.columns) {
+                  // re-checked here for the same reason as the name below, in case the
+                  // definition changed since it was checked above
+                  assertSafeTypeSize(col.length)
+                  assertSafeTypeSize(col.precision)
+                  assertSafeTypeSize(col.scale)
                 }
 
-                rows.push(item)
+                for (const row of Array.from(table.rows)) {
+                  const item = {}
+                  for (let index = 0; index < table.columns.length; index++) {
+                    const col = table.columns[index]
+                    // this driver hands the name to its table manager rather than writing
+                    // it into SQL, but it is checked here all the same: a name either
+                    // works on both drivers or on neither
+                    item[assertSafeColumnName(col.name)] = row[index]
+                  }
+
+                  rows.push(item)
+                }
+              } catch (e) {
+                return done(e)
               }
 
               mgr.insertRows(rows, done)
@@ -232,7 +266,16 @@ class Request extends BaseRequest {
               objectid = table.path
             }
 
-            return connection.queryRaw(`if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`, function (err) {
+            // A connection is held from here on, so a column name that changed since it
+            // was checked above must be reported through `done`, which releases it.
+            let statement
+            try {
+              statement = `if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`
+            } catch (e) {
+              return done(e)
+            }
+
+            return connection.queryRaw(statement, function (err) {
               if (err) { return done(err) }
               go()
             })
@@ -314,12 +357,18 @@ class Request extends BaseRequest {
 
       if (!this._nested) {
         const input = []
-        for (const name in this.parameters) {
-          if (!objectHasProperty(this.parameters, name)) {
-            continue
+        try {
+          for (const name in this.parameters) {
+            if (!objectHasProperty(this.parameters, name)) {
+              continue
+            }
+            const param = this.parameters[name]
+            // this callback is dispatched on its own tick, so a rejected declaration has
+            // to be handed back rather than thrown
+            input.push(`@${param.name} ${declare(param.type, param)}`)
           }
-          const param = this.parameters[name]
-          input.push(`@${param.name} ${declare(param.type, param)}`)
+        } catch (e) {
+          return callback(new RequestError(e, 'EREQUEST'))
         }
 
         const sets = []
@@ -634,14 +683,32 @@ class Request extends BaseRequest {
       if (err) return callback(err)
 
       const params = []
-      for (const name in this.parameters) {
-        if (!objectHasProperty(this.parameters, name)) {
-          continue
-        }
-        const param = this.parameters[name]
-        if (param.io === 2) {
-          params.push(`@${param.name} ${declare(param.type, param)}`)
+      let procedureName
+      try {
+        // this is built into `exec @___return___ = <name>` below and run as SQL text, so it is
+        // checked before it is emitted
+        procedureName = assertSafeProcedureName(procedure)
+        for (const name in this.parameters) {
+          if (!objectHasProperty(this.parameters, name)) {
+            continue
+          }
+          const param = this.parameters[name]
+          if (param.io === 2) {
+            // this callback is dispatched on its own tick, so a rejected declaration has
+            // to be handed back rather than thrown
+            params.push(`@${param.name} ${declare(param.type, param)}`)
+          } else {
+            // An input parameter is bound rather than written into the command, so only an
+            // output parameter's size is declared here and nothing would otherwise check an
+            // input's. It is checked so that a size is accepted or rejected the same way
+            // whichever driver is in use.
+            assertSafeTypeSize(param.length)
+            assertSafeTypeSize(param.precision)
+            assertSafeTypeSize(param.scale)
+          }
         }
+      } catch (e) {
+        return callback(new RequestError(e, 'EREQUEST'))
       }
 
       // set output params w/ values
@@ -657,7 +724,7 @@ class Request extends BaseRequest {
       }
 
       let cmd = `declare ${['@___return___ int'].concat(params).join(', ')};${sets.join(';')};`
-      cmd += `exec @___return___ = ${procedure} `
+      cmd += `exec @___return___ = ${procedureName} `
 
       const spp = []
       for (const name in this.parameters) {

package/lib/table.js

@@ -2,7 +2,7 @@
 
 const TYPES = require('./datatypes').TYPES
 const declareType = require('./datatypes').declare
-const objectHasProperty = require('./utils').objectHasProperty
+const { objectHasProperty, assertSafeColumnName } = require('./utils')
 
 const MAX = 65535 // (1 << 16) - 1
 const JSON_COLUMN_ID = 'JSON_F52E2B61-18A1-11d1-B105-00805F49916B'
@@ -99,9 +99,9 @@ Table.prototype._makeBulk = function _makeBulk () {
 }
 
 Table.prototype.declare = function declare () {
-  const pkey = this.columns.filter(col => col.primary === true).map(col => `[${col.name}]`)
+  const pkey = this.columns.filter(col => col.primary === true).map(col => `[${assertSafeColumnName(col.name)}]`)
   const cols = this.columns.map(col => {
-    const def = [`[${col.name}] ${declareType(col.type, col)}`]
+    const def = [`[${assertSafeColumnName(col.name)}] ${declareType(col.type, col)}`]
 
     if (col.nullable === true) {
       def.push('null')

package/lib/tedious/request.js

@@ -4,7 +4,7 @@ const tds = require('tedious')
 const debug = require('debug')('mssql:tedi')
 const BaseRequest = require('../base/request')
 const RequestError = require('../error/request-error')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, assertSafeColumnName, assertSafeTypeName, assertSafeTypeSize, assertSafeProcedureName } = require('../utils')
 const { TYPES, DECLARATIONS, declare, cast } = require('../datatypes')
 const Table = require('../table')
 const { PARSERS: UDT } = require('../udt')
@@ -219,6 +219,15 @@ class Request extends BaseRequest {
 
       try {
         table._makeBulk()
+        // Checked before a connection is borrowed, so that a rejected name cannot leave
+        // the pool short of one.
+        table.columns.forEach(col => assertSafeColumnName(col.name))
+        // tedious writes these into `insert bulk ... WITH (ORDER (<key> <direction>))`
+        // UNQUOTED — unlike a column name, which it emits as `[name]`. So the quoted-identifier
+        // rule does not apply here: what matters is that the key cannot end the clause. It is
+        // checked as an identifier, bare or quoted, which is what that position accepts. The
+        // checked keys are rebuilt into the options actually handed to the driver, so the value
+        // that was validated is the one emitted even if the caller's object changes after.
       } catch (e) {
         return callback(new RequestError(e, 'EREQUEST'))
       }
@@ -332,15 +341,38 @@ class Request extends BaseRequest {
           }
         }
 
-        const bulk = connection.newBulkLoad(table.path, options, done)
+        // A connection is held from here on, so anything that can throw has to hand the
+        // error back through `done`, which releases it. That includes newBulkLoad itself:
+        // tedious validates the bulk options there and throws for a bad `order` direction,
+        // which would otherwise strand the borrowed connection.
+        let bulk
+        let statement
+        try {
+          let bulkOptions = options
+          if (options && options.order) {
+            bulkOptions = Object.assign({}, options, {
+              order: Object.fromEntries(Object.entries(options.order)
+                .map(([key, direction]) => [assertSafeTypeName(key), direction]))
+            })
+          }
+          bulk = connection.newBulkLoad(table.path, bulkOptions, done)
+          for (const col of table.columns) {
+            // tedious emits this name as a quoted identifier of its own when it builds
+            // the `insert bulk` statement, so it is checked here as well as in
+            // Table#declare, in case the name changed since it was checked above.
+            bulk.addColumn(assertSafeColumnName(col.name), getTediousType(col.type), { nullable: col.nullable, length: assertSafeTypeSize(col.length), scale: assertSafeTypeSize(col.scale), precision: assertSafeTypeSize(col.precision) })
+          }
 
-        for (const col of table.columns) {
-          bulk.addColumn(col.name, getTediousType(col.type), { nullable: col.nullable, length: col.length, scale: col.scale, precision: col.precision })
+          if (table.create) {
+            const objectid = table.temporary ? `tempdb..[${table.name}]` : table.path
+            statement = `if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`
+          }
+        } catch (e) {
+          return done(e)
         }
 
         if (table.create) {
-          const objectid = table.temporary ? `tempdb..[${table.name}]` : table.path
-          const req = new tds.Request(`if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`, err => {
+          const req = new tds.Request(statement, err => {
             if (err) return done(err)
 
             connection.execBulkLoad(bulk, table.rows)
@@ -439,6 +471,26 @@ class Request extends BaseRequest {
         connection.on('errorMessage', errorHandlers.errorMessage = handleError.bind(null, false, connection))
         connection.on('error', errorHandlers.error = handleError.bind(null, true, connection))
 
+        // Give up before the request is sent: the listeners attached just above have to
+        // come off the connection before it goes back to the pool, or they accumulate on
+        // it and fire for whoever borrows it next.
+        const abandon = (err) => {
+          delete this._cancel
+
+          if (hasReturned) {
+            return
+          }
+
+          for (const event in errorHandlers) {
+            connection.removeListener(event, errorHandlers[event])
+          }
+
+          this.parent.release(connection)
+          hasReturned = true
+
+          return callback(err)
+        }
+
         debug('request(%d): query', IDS.get(this), command)
 
         const req = new tds.Request(command, err => {
@@ -647,20 +699,23 @@ class Request extends BaseRequest {
                 param.value = getTediousType(param.type).validate(param.value, this.parent.collation)
               } catch (e) {
                 e.message = `Validation failed for parameter '${name}'. ${e.message}`
-                const err = new RequestError(e, 'EPARAM')
-
-                this.parent.release(connection)
-                return callback(err)
+                return abandon(new RequestError(e, 'EPARAM'))
               }
             }
 
             const declarations = []
-            for (const name in this.parameters) {
-              if (!objectHasProperty(this.parameters, name)) {
-                continue
+            try {
+              for (const name in this.parameters) {
+                if (!objectHasProperty(this.parameters, name)) {
+                  continue
+                }
+                const param = this.parameters[name]
+                // a connection is held here, so a rejected declaration has to be reported
+                // through the path that releases it
+                declarations.push(`@${name} ${declare(param.type, param)}`)
               }
-              const param = this.parameters[name]
-              declarations.push(`@${name} ${declare(param.type, param)}`)
+            } catch (e) {
+              return abandon(new RequestError(e, 'EREQUEST'))
             }
 
             const assigns = []
@@ -688,16 +743,22 @@ class Request extends BaseRequest {
             req.sqlTextOrProcedure = `declare ${declarations.join(', ')};select ${assigns.join(', ')};${req.sqlTextOrProcedure};${batchHasOutput ? (`select 1 as [___return___], ${selects.join(', ')}`) : ''}`
           }
         } else {
-          for (const name in this.parameters) {
-            if (!objectHasProperty(this.parameters, name)) {
-              continue
-            }
-            const param = this.parameters[name]
-            if (param.io === 1) {
-              req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
-            } else {
-              req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+          try {
+            for (const name in this.parameters) {
+              if (!objectHasProperty(this.parameters, name)) {
+                continue
+              }
+              const param = this.parameters[name]
+              // tedious builds the sp_executesql declaration from these, so a rejected size
+              // has to be reported through the path that releases the connection
+              if (param.io === 1) {
+                req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+              } else {
+                req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+              }
             }
+          } catch (e) {
+            return abandon(new RequestError(e, 'EREQUEST'))
           }
         }
 
@@ -793,6 +854,35 @@ class Request extends BaseRequest {
         connection.on('errorMessage', errorHandlers.errorMessage = handleError.bind(null, false, connection))
         connection.on('error', errorHandlers.error = handleError.bind(null, true, connection))
 
+        // A connection is held from here on. handleError builds a fresh Error and would
+        // relabel a rejected identifier as EREQUEST, so anything that can throw here is
+        // handed back through this instead, which keeps the code and releases the connection.
+        const abandon = (err) => {
+          delete this._cancel
+
+          if (hasReturned) {
+            return
+          }
+
+          for (const event in errorHandlers) {
+            connection.removeListener(event, errorHandlers[event])
+          }
+
+          this.parent.release(connection)
+          hasReturned = true
+
+          return callback(err)
+        }
+
+        let procedureName
+        try {
+          procedureName = assertSafeProcedureName(procedure)
+        } catch (e) {
+          // wrapped like every other rejection here, so the caller sees the same error class
+          // whichever driver is in use; MSSQLError keeps the EINJECT code through the wrap
+          return abandon(new RequestError(e, 'EREQUEST'))
+        }
+
         if (debug.enabled) {
           // log stored procedure executions and provided parameters
           const params = Object.keys(this.parameters).map(k => this.parameters[k])
@@ -805,7 +895,7 @@ class Request extends BaseRequest {
           debug('request(%d): execute %s %O', IDS.get(this), procedure, logParams)
         }
 
-        const req = new tds.Request(procedure, err => {
+        const req = new tds.Request(procedureName, err => {
           // to make sure we handle no-sql errors as well
           if (err && (!errors.length || (errors.length && err.message !== errors[errors.length - 1].message))) {
             err = new RequestError(err, 'EREQUEST')
@@ -967,16 +1057,20 @@ class Request extends BaseRequest {
           output[parameterName] = value
         })
 
-        for (const name in this.parameters) {
-          if (!objectHasProperty(this.parameters, name)) {
-            continue
-          }
-          const param = this.parameters[name]
-          if (param.io === 1) {
-            req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
-          } else {
-            req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+        try {
+          for (const name in this.parameters) {
+            if (!objectHasProperty(this.parameters, name)) {
+              continue
+            }
+            const param = this.parameters[name]
+            if (param.io === 1) {
+              req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+            } else {
+              req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+            }
           }
+        } catch (e) {
+          return abandon(new RequestError(e, 'EREQUEST'))
         }
 
         connection.callProcedure(req)

package/lib/utils.js

@@ -1,3 +1,5 @@
+const MSSQLError = require('./error/mssql-error')
+
 const IDS = new WeakMap()
 const INCREMENT = {
   Connection: 1,
@@ -7,8 +9,94 @@ const INCREMENT = {
   PreparedStatement: 1
 }
 
+// Parameter names are emitted into generated T-SQL as `@<name>`. The `@` occupies the
+// identifier's first position, so every character of the name sits in a subsequent
+// position, where T-SQL also permits digits and `$`. The set is deliberately wider than
+// the names the server will accept: it excludes the characters that could end the
+// identifier and let the rest of the name be read as SQL, and nothing else, so a name
+// the server dislikes still fails there rather than becoming an error here. The
+// exception is the invisible format characters, which are rejected outright.
+// Only the two zero-width joiners are taken from the format characters; the rest of that
+// category includes ZERO WIDTH SPACE, which the server does treat as a separator.
+const PARAM_NAME = /^(?:[\p{L}\p{N}\p{M}\p{Pc}@#$・･]|\u200C|\u200D)*$/u
+// A table-valued parameter's type name is emitted into the parameter declaration, and a
+// stored procedure's name is emitted into an `exec`, so both are checked the way the server
+// reads a qualified name: one or more parts separated by `.`, each either bare, holding only
+// the characters an identifier is made of, or quoted in brackets or double quotes, where
+// anything goes until the closing mark. Nothing that gets through can end the statement it
+// sits in and have the rest read as SQL.
+const QUALIFIED_NAME_PART = '(?:\\[(?:[^\\]]|\\]\\])*\\]|"(?:[^"]|"")*"|[\\p{L}\\p{N}\\p{M}\\p{Pc}@#$]+)'
+// An intermediate part may be omitted — `db..proc` and `server.db..proc` are ordinary
+// T-SQL — but the first and last parts must be present, so a bare `.`, a leading `.proc`
+// and a trailing `db..` are still refused. An empty part cannot end the identifier.
+const QUALIFIED_NAME = new RegExp(`^(?:${QUALIFIED_NAME_PART}(?:\\.${QUALIFIED_NAME_PART}?)*\\.)?${QUALIFIED_NAME_PART}$`, 'u')
+
+// A length, precision or scale is emitted into the same declaration. `max` is the only
+// word the declaration takes there; everything else the server wants is a number.
+const TYPE_SIZE = /^\w*$/
+
+// A column name is emitted as a quoted identifier, `[name]`, by this module and again by
+// the driver's own bulk load. Only `]` can terminate that quoting early, and doubling it
+// is the documented way to include one literally.
+const escapesQuotedIdentifier = (name) => String(name).replace(/]]/g, '').includes(']')
+
 module.exports = {
   objectHasProperty: (object, property) => Object.prototype.hasOwnProperty.call(object, property),
+  isValidParameterName: (name) => {
+    // Only primitives are accepted: an object could return a different value from a second
+    // toString() call, passing validation here and emitting something else into the SQL.
+    const type = typeof name
+    return (type === 'string' || type === 'number') && PARAM_NAME.test(String(name))
+  },
+  assertSafeTypeName: (name) => {
+    // A type name is optional: the tedious driver takes it from the Table passed as the
+    // value, and only uses this one when it is given.
+    if (name == null) {
+      return name
+    }
+    // Read once, and return what was read. Whatever is emitted is what was checked, so a
+    // value that reports a different name the second time cannot reach the SQL.
+    const type = String(name).trim()
+    if (!QUALIFIED_NAME.test(type)) {
+      throw new MSSQLError(`Invalid type name '${type}'. Type names may only contain identifier characters.`, 'EINJECT')
+    }
+    return type
+  },
+  assertSafeProcedureName: (name) => {
+    // The msnodesqlv8 driver builds `exec @___return___ = <name>` as SQL text, so the name is
+    // checked before it is emitted. The tedious driver sends it as a bound RPC and cannot be
+    // injected through it, but it is checked there too so that a name is accepted or rejected
+    // the same way whichever driver is in use.
+    // Read once, and return what was read, for the same reason as the type name.
+    const procedure = String(name).trim()
+    if (!QUALIFIED_NAME.test(procedure)) {
+      throw new MSSQLError(`Invalid procedure name '${procedure}'. Procedure names may only contain identifier characters.`, 'EINJECT')
+    }
+    return procedure
+  },
+  assertSafeTypeSize: (value) => {
+    if (value == null || typeof value === 'number') {
+      return value
+    }
+    // Read once and return what was read, for the same reason as the type name. Padding is
+    // trimmed rather than refused, and a word the server will reject still reaches it.
+    const size = String(value).trim()
+    if (!TYPE_SIZE.test(size)) {
+      throw new MSSQLError(`Invalid type size '${size}'. A length, precision or scale must be a number.`, 'EINJECT')
+    }
+    return size
+  },
+  assertSafeColumnName: (name) => {
+    const type = typeof name
+    if (type !== 'string' && type !== 'number') {
+      throw new MSSQLError(`Invalid column name '${String(name)}'. Column names must be a string or a number.`, 'EINJECT')
+    }
+    const column = String(name)
+    if (escapesQuotedIdentifier(column)) {
+      throw new MSSQLError(`Invalid column name '${column}'. A ']' in a column name must be written as ']]'.`, 'EINJECT')
+    }
+    return column
+  },
   INCREMENT,
   IDS: {
     get: IDS.get.bind(IDS),

package/package.json

@@ -21,7 +21,7 @@
     "azure",
     "node-mssql"
   ],
-  "version": "9.3.2",
+  "version": "9.3.3",
   "main": "index.js",
   "repository": "github:tediousjs/node-mssql",
   "license": "MIT",
@@ -36,12 +36,12 @@
   "devDependencies": {
     "@commitlint/cli": "^17.6.6",
     "@commitlint/config-conventional": "^17.6.6",
-    "@semantic-release/commit-analyzer": "^10.0.1",
-    "@semantic-release/github": "^9.0.3",
-    "@semantic-release/npm": "^10.0.4",
-    "@semantic-release/release-notes-generator": "^11.0.4",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/github": "^12.0.6",
+    "@semantic-release/npm": "^13.1.5",
+    "@semantic-release/release-notes-generator": "^14.1.0",
     "mocha": "^10.0.0",
-    "semantic-release": "^21.0.7",
+    "semantic-release": "^25.0.3",
     "standard": "^17.0.0"
   },
   "engines": {