mysql2 3.21.1 → 3.21.2-canary.884bec56

package/lib/commands/auth_switch.js

@@ -72,6 +72,28 @@ function authSwitchRequest(packet, connection, command) {
     return;
   }
 
+  if (pluginName === 'mysql_clear_password') {
+    const hasCustomPlugin =
+      connection.config.authPlugins &&
+      Object.prototype.hasOwnProperty.call(
+        connection.config.authPlugins,
+        'mysql_clear_password'
+      );
+    if (!hasCustomPlugin && !connection.config.enableCleartextPlugin) {
+      const err = new Error(
+        'Server requested authentication using mysql_clear_password, ' +
+          'which sends the password in plaintext over the network and is ' +
+          'disabled by default. To enable it, set the `enableCleartextPlugin` ' +
+          'option to `true` in your connection configuration, or provide a ' +
+          'custom `mysql_clear_password` auth plugin via the `authPlugins` ' +
+          'option. Only use this over a secure connection (TLS/SSL).'
+      );
+      err.code = 'MYSQL_CLEAR_PASSWORD_NOT_ENABLED';
+      err.fatal = true;
+      throw err;
+    }
+  }
+
   const authPlugin = getAuthPlugin(pluginName, connection);
   if (!authPlugin) {
     throw new Error(

package/lib/commands/client_handshake.js

@@ -105,7 +105,9 @@ class ClientHandshake extends Command {
     const canUseDirectAuth =
       !hasCustomAuthPlugin &&
       !hasLegacyAuthSwitchHandler &&
-      this.canUseAuthMethodDirectly(serverAuthMethod, isSecureConnection);
+      this.canUseAuthMethodDirectly(serverAuthMethod, isSecureConnection) &&
+      (serverAuthMethod !== 'mysql_clear_password' ||
+        connection.config.enableCleartextPlugin);
 
     const clientAuthMethod = canUseDirectAuth
       ? serverAuthMethod
@@ -339,8 +341,9 @@ class ClientHandshake extends Command {
         }
         return ClientHandshake.prototype.handshakeResult;
       } catch (err) {
-        // Authentication errors are fatal
-        err.code = 'AUTH_SWITCH_PLUGIN_ERROR';
+        if (!err.code) {
+          err.code = 'AUTH_SWITCH_PLUGIN_ERROR';
+        }
         err.fatal = true;
 
         if (this.onResult) {

package/lib/connection_config.js

@@ -60,6 +60,7 @@ const validOptions = {
   uri: 1,
   user: 1,
   disableEval: 1,
+  enableCleartextPlugin: 1,
   // These options are used for Pool
   connectionLimit: 1,
   maxIdle: 1,
@@ -152,6 +153,7 @@ class ConnectionConfig {
       options.nestTables === undefined ? undefined : options.nestTables;
     this.typeCast = options.typeCast === undefined ? true : options.typeCast;
     this.disableEval = Boolean(options.disableEval);
+    this.enableCleartextPlugin = Boolean(options.enableCleartextPlugin);
     if (this.timezone[0] === ' ') {
       // "+" is a url encoded char for space so it
       // gets translated to space when giving a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mysql2",
-  "version": "3.21.1",
+  "version": "3.21.2-canary.884bec56",
   "description": "fast mysql driver. Implements core protocol, prepared statements, ssl and compression in native JS",
   "main": "index.js",
   "typings": "typings/mysql/index",

package/typings/mysql/lib/Connection.d.ts

@@ -326,6 +326,18 @@ export interface ConnectionOptions {
 
   disableEval?: boolean;
 
+  /**
+   * Enable the `mysql_clear_password` authentication plugin, which sends the
+   * password in plaintext. Disabled by default for security — only enable
+   * over secure connections (TLS/SSL).
+   *
+   * Providing a custom `mysql_clear_password` function via `authPlugins`
+   * implicitly enables cleartext authentication without this flag.
+   *
+   * (Default: false)
+   */
+  enableCleartextPlugin?: boolean;
+
   authPlugins?: {
     [key: string]: AuthPlugin;
   };