oracledb 6.10.0 → 7.0.0

package/lib/thin/protocol/utils.js

@@ -28,7 +28,6 @@
 
 const { Buffer } = require('buffer');
 const constants = require('./constants');
-const crypto = require('crypto');
 
 class OutOfPacketsError extends Error { }
 
@@ -52,31 +51,7 @@ function encodeRowID(rowID) {
   }
 }
 
-// obfuscate value
-function setObfuscatedValue(value) {
-  const valueBytes = Buffer.from(value);
-  const obfuscatedBytes = crypto.randomBytes(valueBytes.length);
-  for (let i = 0; i < valueBytes.length; i++) {
-    valueBytes[i] = obfuscatedBytes[i] ^ valueBytes[i];
-  }
-  return {obfuscatedValue: obfuscatedBytes, value: valueBytes};
-}
-
-// returns the deobfuscated value, after removing the obfuscation
-// and clear memory of temporary Buffers coming from Buffer pool
-function getDeobfuscatedValue(valueBytes, obfuscatedBytes) {
-  const buf = Buffer.from(valueBytes);
-  for (let i = 0; i < valueBytes.length; i++) {
-    buf[i] = valueBytes[i] ^ obfuscatedBytes[i];
-  }
-  const retVal = buf.toString();
-  buf.fill(0);
-  return retVal;
-}
-
 module.exports = {
   encodeRowID,
-  getDeobfuscatedValue,
-  OutOfPacketsError,
-  setObfuscatedValue
+  OutOfPacketsError
 };

package/lib/thin/resultSet.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2023, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -94,26 +94,20 @@ class ThinResultSetImpl extends ResultSetImpl {
   async getRows(numRows, options) {
     options.fetchArraySize = numRows || this.options.fetchArraySize;
     options.prefetchRows = this.options.prefetchRows;
-    if (this.statement.bufferRowCount - this.statement.bufferRowIndex >= options.fetchArraySize) {
+    if (this.statement.bufferRowCount - this.statement.bufferRowIndex >= options.fetchArraySize)
       return this._processRows(options.fetchArraySize);
-    } else {
-      // We fetch for the required number of row
-      options.fetchArraySize = options.fetchArraySize - (this.statement.bufferRowCount - this.statement.bufferRowIndex);
-      const prevBufferRowCount = this.statement.bufferRowCount;
-      if (this.statement.moreRowsToFetch && options.fetchArraySize > 0) {
-        await this._fetchMoreRows(options);
-      }
-      options.fetchArraySize = numRows || this.options.fetchArraySize;
-      if (prevBufferRowCount === this.statement.bufferRowCount) {
-        const numRowsFetched = this.statement.bufferRowCount - this.statement.bufferRowIndex;
-        this.statement.bufferRowCount = 0;
-        if (numRowsFetched > 0) {
-          return this._processRows(numRowsFetched);
-        }
-        return [];
-      }
-    }
+
+    // We fetch for the required number of rows
+    options.fetchArraySize = options.fetchArraySize - (this.statement.bufferRowCount - this.statement.bufferRowIndex);
+    const prevBufferRowCount = this.statement.bufferRowCount;
+    if (this.statement.moreRowsToFetch && options.fetchArraySize > 0)
+      await this._fetchMoreRows(options);
+    options.fetchArraySize = numRows || this.options.fetchArraySize;
     const numRowsFetched = this.statement.bufferRowCount - this.statement.bufferRowIndex;
+    if (prevBufferRowCount === this.statement.bufferRowCount)
+      this.statement.bufferRowCount = 0;
+
+    // process the rows fetched
     return this._processRows(numRowsFetched);
   }
 

package/lib/thin/sqlnet/ezConnectResolver.js

@@ -294,7 +294,7 @@ class EZConnectResolver {
       if (serverDNMatch != null)
         securityInfo.push(`(SSL_SERVER_DN_MATCH=${serverDNMatch})`);
       if (serverCertDN != null)
-        securityInfo.push(`(SSL_SERVER_CERT_DN=${serverCertDN}})`);
+        securityInfo.push(`(SSL_SERVER_CERT_DN=${serverCertDN})`);
       if (walletDir != null)
         securityInfo.push(`(MY_WALLET_DIRECTORY=${walletDir})`);
     }
@@ -416,7 +416,7 @@ class EZConnectResolver {
       // if it is an URL alias then add to URL props
       this.urlProps.set(propertyName, value);
     } else {
-      this.connectionProps.set(propertyName, value);
+      this.connectionProps.set(key, value);
     }
   }
 

package/lib/thin/sqlnet/networkSession.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -34,11 +34,27 @@ const { createNode } = require('./connStrategy.js');
 const errors = require("../../errors.js");
 const { findNVPairRecurse, createNVPair, findValue } = require("./nvStrToNvPair.js");
 const { Buffer } = require('buffer');
-const EzConnect = require("./ezConnectResolver.js");
-const { NLParamParser, tnsnamesFilePath } = require("./paramParser.js");
-const process = require('process');
 const downHostInstance = require("./connStrategy.js").SOLE_INST_DHCACHE;
 const {ANO} = require("./ANO.js");
+const { resolveConnectStr } = require('../../impl/parserHelpers.js');
+
+const MAX_REDIRECTS = 2;
+
+const REDIRECT_SECURITY_KEYS = new Set([
+  'sslServerDNMatch',
+  'sslAllowWeakDNMatch',
+  'sslServerCertDN',
+  'walletLocation',
+  'walletPassword',
+  'walletContent'
+]);
+
+function getRedirectParams(params) {
+  return Object.fromEntries(
+    Object.entries(params).filter(([key]) => !REDIRECT_SECURITY_KEYS.has(key))
+  );
+}
+
 /**
  *
  * @param {string} userConfig
@@ -68,36 +84,6 @@ async function getConnectionInfo(userConfig) {
  * @param {String} connStr Connect string
  * @returns AddressNode
  */
-const nlParamParser =  new NLParamParser;
-async function resolveConnectStr(connectString, configDir) {
-  const connStr = connectString.trim();
-  let resolvedVal = connStr;
-  if ((connStr.indexOf(')') == -1) || (connStr.indexOf('(') != 0)) {
-    if ((connStr.indexOf(':') != -1) || (connStr.indexOf('/') != -1)) {
-      const ezcnObj = new EzConnect(connStr);
-      resolvedVal = ezcnObj.getResolvedUrl();
-      return resolvedVal;
-    } else {
-      //try tns alias
-      const namesFilePath = tnsnamesFilePath(configDir);
-      const p = await nlParamParser.initializeNlpa(namesFilePath);
-      resolvedVal = p.get(connStr.toUpperCase());
-      if (!resolvedVal)
-        errors.throwErr(errors.ERR_TNS_ENTRY_NOT_FOUND, connStr, configDir ? configDir + '/tnsnames.ora' : process.env.TNS_ADMIN + '/tnsnames.ora');
-      if (resolvedVal.rhsType == 1) {
-        const rString = resolvedVal.atom;
-        if ((rString.indexOf(':') != -1) || (rString.indexOf('/') != -1)) {
-          return new EzConnect(rString).getResolvedUrl();
-        }
-      }
-      resolvedVal = resolvedVal.getListElement(0);
-    }
-
-  }
-  return resolvedVal;
-
-}
-
 async function resolveAddress(connStr, userConfig) {
   const connstr = await resolveConnectStr(connStr, userConfig.configDir);
   return createNode(connstr, userConfig);
@@ -228,6 +214,8 @@ class NetworkSession {
     let connectPkt = new Packet.ConnectPacket(this.cData, this.sAtts);
     this._sendConnect(connectPkt);
 
+    let redirectCount = 0;
+
     /* Read the response */
       while (true) {  // eslint-disable-line
       const packet = await this._recvPacket();
@@ -257,6 +245,11 @@ class NetworkSession {
         }
         this._sendConnect(connectPkt);
       } else if (packet.type === constants.NSPTRD) { /* REDIRECT */
+        if (redirectCount >= MAX_REDIRECTS) {
+          errors.throwErr(errors.ERR_TOO_MANY_REDIRECTS, MAX_REDIRECTS);
+        }
+        redirectCount++;
+
         let adrLen, adrStr, redirConnData;
 
         /* Read and connect to Redirect address */
@@ -277,8 +270,10 @@ class NetworkSession {
         const redirAddressNode = await resolveAddress(adrStr, userConfig);
         const host = address.hostname;
         address = await redirAddressNode.execute();
-        if (address.desc)
-          this.sAtts.setFrom(address.desc.params);  /* Add on attributes from redirect connect String */
+        /* Add on attributes from redirect connect String */
+        if (address.desc?.params) {
+          this.sAtts.setFrom(getRedirectParams(address.desc.params));
+        }
         address.originHost = host;
         this.redirectPkt = null;
         this.ntAdapter.disconnect(constants.NSFIMM);
@@ -349,7 +344,7 @@ class NetworkSession {
         savedErr = err;
         try {
           address = await this.getAddress(addressNode, userConfig);
-        } catch (err) {
+        } catch {
           break;
         }
       }
@@ -370,20 +365,39 @@ class NetworkSession {
         const size = packet.buf.length;
         const dataFlags = packet.buf.readUInt16BE(constants.NSPDAFLG);
         if ((dataFlags & constants.NSPDAFCMP) != 0) { // compression enabled
+          if (!this.sAtts.networkCompressionEnabled) {
+            errors.throwErr(errors.ERR_INVALID_PACKET, "Compressed packet received without negotiation");
+          }
           const packetHeader = packet.buf.subarray(0, constants.NSPDADAT);
           const buffertoDeCompress = packet.buf.subarray(constants.NSPDADAT, size);
           let deCompressedDataBuffer;
+
+          const maxPayload = this.sAtts.largeSDU
+            ? Math.min(this.sAtts.sdu, constants.NSPABSSDULN)
+            : Math.min(this.sAtts.sdu, constants.NSPMXSDULN);
+
+          const inflateOptions = {
+            finishFlush: zlib.constants.Z_SYNC_FLUSH,
+            maxOutputLength: maxPayload
+          };
           try {
             if (this.sAtts.firstRecvCompressedPacket) {
-              deCompressedDataBuffer = zlib.inflateSync(buffertoDeCompress, {finishFlush: zlib.constants.Z_SYNC_FLUSH});
+              deCompressedDataBuffer = zlib.inflateSync(buffertoDeCompress, inflateOptions);
               this.sAtts.firstRecvCompressedPacket = 0;
             } else {
-              deCompressedDataBuffer = zlib.inflateRawSync(buffertoDeCompress, {finishFlush: zlib.constants.Z_SYNC_FLUSH});
+              deCompressedDataBuffer = zlib.inflateRawSync(buffertoDeCompress, inflateOptions);
             }
           } catch (err) {
+            if (err.code == 'ERR_BUFFER_TOO_LARGE') {
+              errors.throwErr(errors.ERR_INVALID_PACKET,
+                `: decompressed packet exceeds SDU ${maxPayload}`);
+            }
             errors.throwErr(errors.ERR_DATA_COMPRESSION, err.message);
           }
           const resultLength = deCompressedDataBuffer.length;
+          if (resultLength > maxPayload) {
+            errors.throwErr(errors.ERR_INVALID_PACKET, `Decompressed size ${resultLength} exceeds SDU ${maxPayload}`);
+          }
           //concatenate packet header with decompressed data
           packet.buf = Buffer.concat([packetHeader, deCompressedDataBuffer]);
           const length = resultLength + constants.NSPDADAT;
@@ -407,6 +421,7 @@ class NetworkSession {
         if (this.sAtts.version >= constants.TNS_VERSION_MIN_END_OF_RESPONSE
           && (packet.flags & constants.TNS_ACCEPT_FLAG_HAS_END_OF_REQUEST)) {
           this.endOfRequestSupport = true;
+          this.pipeliningSupport = true;
         }
         if (packet.flags & constants.TNS_ACCEPT_FLAG_FAST_AUTH) {
           this.supportsFastAuth = true;
@@ -430,7 +445,7 @@ class NetworkSession {
    * Control packets are consumed internally and discarded
    */
   async _recvPacket() {
-    while (true) {  // eslint-disable-line
+    while (true) {
       const packet = await this.ntAdapter.receive();
       if (!packet)
         break;
@@ -501,6 +516,9 @@ class NetworkSession {
     this.isBreak = true;
     this.markerPkt.prepare(constants.NSPMKTD1, constants.NIQIMARK);
     this.sendPacket(this.markerPkt.buf);
+    if (this.pipelineEnabled) {
+      this.isBreak = false;
+    }
   }
 
   /**
@@ -513,6 +531,10 @@ class NetworkSession {
       this.sendPacket(this.markerPkt.buf);
       this.breakPosted = false;
     }
+    if (this.pipelineEnabled) {
+      this.isBreak = this.isReset = false;
+      return;
+    }
     /* Send Reset */
     this.markerPkt.prepare(constants.NSPMKTD1, constants.NIQRMARK);
     this.sendPacket(this.markerPkt.buf);

package/lib/thin/sqlnet/ntTcp.js

@@ -389,6 +389,19 @@ class NTTCP {
     this.numPacketsSinceLastWait = 0;
   }
 
+  /**
+   * Reject invalid packet and clean up
+   * @param {string} message Error message
+   * @returns {null} to clear tempBuf
+   */
+  rejectInvalidPacket(message) {
+    this.savedErr = new Error(message);
+    this.err = true;
+    this.stream.destroy();
+    this._notifyWaiters();
+    return null;
+  }
+
   /**
    * Start Async reads
    */
@@ -414,6 +427,17 @@ class NTTCP {
           len = tempBuf.readUInt16BE();
         }
 
+        if (len < PACKET_HEADER_SIZE) {
+          tempBuf = this.rejectInvalidPacket(`Invalid packet length: ${len} (must be at least ${PACKET_HEADER_SIZE})`);
+          break;
+        }
+
+        const maxPacket = this.largeSDU ? constants.NSPABSSDULN : constants.NSPMXSDULN;
+        if (len > maxPacket) {
+          tempBuf = this.rejectInvalidPacket(`Invalid packet length: ${len} (exceeds maximum ${maxPacket})`);
+          break;
+        }
+
         // not enough for a full packet so wait for more data to arrive
         if (len > tempBuf.length)
           break;

package/lib/thin/sqlnet/nvStrToNvPair.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2023, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -28,6 +28,26 @@
 
 const errors = require("../../errors.js");
 
+// Maximum supported descriptor byte length.
+const DEFAULT_MAX_DESCRIPTOR_LENGTH = 512 * 8;
+
+// Maximum supported descriptor nesting depth before rejecting the parse.
+const DEFAULT_MAX_DESCRIPTOR_DEPTH = 64;
+
+function checkLength(nvString, maxLength) {
+  if (Buffer.byteLength(nvString, 'utf8') > maxLength) {
+    errors.throwErr(errors.ERR_CONNECT_DESCRIPTOR_LIMIT_EXCEEDED,
+      'byte length', maxLength);
+  }
+}
+
+function checkDepth(depth, maxDepth) {
+  if (depth > maxDepth) {
+    errors.throwErr(errors.ERR_CONNECT_DESCRIPTOR_LIMIT_EXCEEDED,
+      'nesting depth', maxDepth);
+  }
+}
+
 
 /**
   * Constant which implies that the VALUE has not been set to ATOM or LIST.
@@ -556,10 +576,13 @@ class NVTokens {
   * Returns an NVPair which contains the broken-down form of nvString
   * @param  nvString  the nvString to parse
   */
-function createNVPair(nvString) {
+function createNVPair(nvString, options = {}) {
+  const maxLength = options.maxLength ?? DEFAULT_MAX_DESCRIPTOR_LENGTH;
+  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DESCRIPTOR_DEPTH;
+  checkLength(nvString, maxLength);
   const nvt = new NVTokens();
   nvt.parseTokens(nvString);
-  return readTopLevelNVPair(nvt);
+  return readTopLevelNVPair(nvt, 1, maxDepth);
 }
 
 /*
@@ -567,7 +590,8 @@ function createNVPair(nvString) {
   * NVPair: (name=value)
   * value: atom | NVList
   */
-function readTopLevelNVPair(nvt) {
+function readTopLevelNVPair(nvt, depth, maxDepth) {
+  checkDepth(depth, maxDepth);
   //check for opening (
   let tk = nvt.getToken();
   nvt.eatToken();
@@ -586,17 +610,18 @@ function readTopLevelNVPair(nvt) {
     }
     nvp.name = name;
 
-    return readRightHandSide(nvp, nvt);
+    return readRightHandSide(nvp, nvt, depth, maxDepth);
   }
 
-  return readRightHandSide(nvp, nvt);
+  return readRightHandSide(nvp, nvt, depth, maxDepth);
 }
 /*
  * function which returns the next NVPair from NVTokens.
  *   NVPair: (name=value) | (name, | ,name) | ,name,
  *   value: atom | NVList
  */
-function readNVPair(nvt) {
+function readNVPair(nvt, depth, maxDepth) {
+  checkDepth(depth, maxDepth);
   // Opening ( or , for NVPair
   const tk = nvt.getToken();
   nvt.eatToken();
@@ -607,7 +632,7 @@ function readNVPair(nvt) {
   const name = readNVLiteral(nvt);
   const nvp = new NVPair(name);
 
-  return readRightHandSide(nvp, nvt);
+  return readRightHandSide(nvp, nvt, depth, maxDepth);
 }
 
 /*
@@ -615,7 +640,7 @@ function readNVPair(nvt) {
  * NVPair: (name=value)
  * value: atom | NVList
 */
-function readRightHandSide(nvp, nvt) {
+function readRightHandSide(nvp, nvt, depth, maxDepth) {
   let tk = nvt.getToken();
   switch (tk) {
     case TKN_EQUAL:
@@ -630,7 +655,7 @@ function readRightHandSide(nvp, nvt) {
       } else {
         // NVList is responsible for adding child NVPairs to this parent
         // NVPair.
-        readNVList(nvt, nvp);
+        readNVList(nvt, nvp, depth, maxDepth);
       }
       break;
 
@@ -671,24 +696,24 @@ function readNVLiteral(nvt) {
  * function which adds a list of NVPairs to a parent NVPair.
  *   NVList:  NVPair NVList | epsilon
  */
-function readNVList(nvt, parent) {
-  // if next token is "(" or ",", then read an NVPair
-  // otherwise, assume epsilon
-  const tk = nvt.getToken();
-  if (!(tk == TKN_LPAREN || tk == TKN_COMMA)) {
-    return; // didn't read an nvpair
-  }
+function readNVList(nvt, parent, depth, maxDepth) {
+  while (true) {
+    // if next token is "(" or ",", then read an NVPair
+    // otherwise, assume epsilon
+    const tk = nvt.getToken();
+    if (!(tk == TKN_LPAREN || tk == TKN_COMMA)) {
+      return; // didn't read an nvpair
+    }
 
-  const child = readNVPair(nvt);
+    const child = readNVPair(nvt, depth + 1, maxDepth);
 
-  // read a good NVPair
-  parent.addListElement(child);
-  if ((tk == TKN_COMMA) || (child.name == child.atom)) {
-    if (parent.getListType != LIST_COMMASEP) // if not already set
-      parent.setListType = LIST_COMMASEP;    // set it
+    // read a good NVPair
+    parent.addListElement(child);
+    if ((tk == TKN_COMMA) || (child.name == child.atom)) {
+      if (parent.getListType != LIST_COMMASEP) // if not already set
+        parent.setListType = LIST_COMMASEP;    // set it
+    }
   }
-
-  readNVList(nvt, parent);  // next iteration of NVList()
 }
 
 /**

package/lib/thin/sqlnet/packet.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -353,6 +353,7 @@ function MarkerPacket(isLargeSDU) {
    */
   this.fromPacket = function(packet, nsi) {
     this.type = packet.buf.readUInt8(constants.NSPMKTYP);
+    let expectedFlag = constants.NIQRMARK;
 
     switch (this.type) {
       case constants.NSPMKTD0:
@@ -361,9 +362,11 @@ function MarkerPacket(isLargeSDU) {
       case constants.NSPMKTD1:
         this.data = packet.buf.readUInt8(constants.NSPMKDAT);
         nsi.isBreak = true;
-        if (this.data == constants.NIQRMARK) {
+        if (nsi.pipelineEnabled) {
+          expectedFlag = constants.NIQBMARK;
+        }
+        if (this.data == expectedFlag) {
           nsi.isReset = true;
-          nsi.isBreak = true;
         }
         break;
       default:
@@ -398,10 +401,16 @@ function ControlPacket() {
     let emfi;
     let err1;
     let err2;
+    if (packet.buf.length < constants.NSPCTLCMD + 2) {
+      errors.throwErr(errors.ERR_INVALID_PACKET);
+    }
 
     this.cmd = packet.buf.readUInt16BE(constants.NSPCTLCMD);
     switch (this.cmd) {
       case constants.NSPCTL_SERR:
+        if (packet.buf.length < constants.NSPCTLDAT + 12) {
+          errors.throwErr(errors.ERR_INVALID_PACKET);
+        }
         emfi = packet.buf.readUInt32BE(constants.NSPCTLDAT);
         err1 = packet.buf.readUInt32BE(constants.NSPCTLDAT + 4);
         err2 = packet.buf.readUInt32BE(constants.NSPCTLDAT + 8);
@@ -411,8 +420,20 @@ function ControlPacket() {
         } else if (err1 == NSESENDMESG) {
           this.errno = err1;
           this.notifLen = err2;
+          const copyStart = constants.NSPCTLDAT + 12;
+          const payloadAvailable = packet.buf.length - copyStart;
+          const maxNotifBytes = this.sAtts && this.sAtts.largeSDU
+            ? constants.NSPABSSDULN
+            : constants.NSPMXSDULN;
+          // Ensure notification length fits in the packet body and negotiated SDU to avoid over-allocation.
+          if (err2 < 0 || err2 > payloadAvailable || err2 > maxNotifBytes) {
+            errors.throwErr(
+              errors.ERR_INVALID_PACKET,
+              `Invalid notification length ${err2}`
+            );
+          }
           this.notif = Buffer.allocUnsafe(err2 + 1).fill(0);
-          this.buf.copy(this.notif, 0, constants.NSPCTLDAT + 12, constants.NSPCTLDAT + 12 + err2);
+          packet.buf.copy(this.notif, 0, copyStart, copyStart + err2);
         } else {
           this.errno = err1;
           if (emfi == ORA_ERROR_EMFI_NUMBER) {

package/lib/thin/sqlnet/paramParser.js

@@ -99,8 +99,16 @@ class NLParamParser {
       return tnsFileStruct.aliasht;
     }
     tnsFileStruct.readInProgress = true;
-    await this.start(file_path, 0, tnsFileStruct); //start with 0 depth (tnsnames.ora)
-    this.tnsnamesHT.set(file_path, tnsFileStruct);
+    try {
+      await this.start(file_path, 0, tnsFileStruct); // start with 0 depth (tnsnames.ora)
+      this.tnsnamesHT.set(file_path, tnsFileStruct);
+    } finally {
+      tnsFileStruct.readInProgress = false;
+      let waiter;
+      while ((waiter = tnsFileStruct.waiters.pop())) {
+        waiter();
+      }
+    }
     return tnsFileStruct.aliasht;
   }
 
@@ -156,11 +164,6 @@ class NLParamParser {
       await this.addNLPListElement(nvElem, depth, tnsFileStruct);
       nvElem = "";      // clear nvElem buffer after added
     }
-    tnsFileStruct.readInProgress = false;
-    let waiter;
-    while ((waiter = tnsFileStruct.waiters.pop())) {
-      waiter();
-    }
   }
   /**
    * Given a string, this method looks if the '#' character is present.

package/lib/thin/statementCache.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2024, Oracle and/or its affiliates.
+// Copyright (c) 2024, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -105,7 +105,7 @@ class StatementCache {
   }
 
   //---------------------------------------------------------------------------
-  // get_statement()
+  // getStatement()
   // Get a statement from the statement cache, or prepare a new statement
   // for use. If a statement is already in use or the statement is not
   // supposed to be cached, a copy will be made (and not returned to the
@@ -126,14 +126,12 @@ class StatementCache {
         this._cachedStatements.set(sql, stmt);
         this._adjustCache();
       }
-      this._openCursors.add(stmt);
     } else if (forceNew || stmt.inUse) {
       if (!cacheStatement) {
         this._addCursorToClose(stmt);
         this._cachedStatements.delete(sql);
       }
       stmt = stmt._copy();
-      this._openCursors.add(stmt);
     } else if (!cacheStatement) {
       this._cachedStatements.delete(sql);
       stmt.returnToCache = false;