oracledb 6.10.0 → 7.0.1

package/lib/endUserSecurityContext.js

@@ -0,0 +1,169 @@
+// Copyright (c) 2026, Oracle and/or its affiliates.
+
+//-----------------------------------------------------------------------------
+//
+// This software is dual-licensed to you under the Universal Permissive License
+// (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl and Apache License
+// 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose
+// either license.
+//
+// If you elect to accept the software under the Apache License, Version 2.0,
+// the following applies:
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//-----------------------------------------------------------------------------
+
+'use strict';
+
+const { Buffer } = require('buffer');
+const errors = require('./errors.js');
+const oson = require('./impl/datahandlers/oson.js');
+const { ObfuscatedValue } = require('./obfuscation.js');
+const transformer = require('./transformer.js');
+
+const DEFAULT_MAX_FIELD_NAME_SIZE = 65535;
+const DEFAULT_MAX_PAYLOAD_LENGTH = 65535;
+
+function hasNonEmptyText(value) {
+  return (typeof value === 'string') && value.trim().length > 0;
+}
+
+/*
+Represents the credential set an application associates with an end user.
+
+Required properties
+- databaseAccessToken: non-empty string accepted by the database driver.
+- endUserToken or endUserName: exactly one must be supplied as a string.
+
+Optional properties
+- key: look-up identifier the database maps to stored context attributes; may be
+  supplied only with endUserName.
+- dataRoles: data roles enabled/disabled by the application logic, rather
+  than a database security policy.
+- attributes: Attributes are contained in JSON objects conforming
+  to a JSON schema of an END USER CONTEXT declared in the database.
+
+*/
+class EndUserSecurityContext {
+  constructor(options) {
+    errors.assertArgCount(arguments, 1, 1);
+    errors.assertParamValue(
+      typeof options === 'object' && options !== null && !Array.isArray(options),
+      1
+    );
+
+    const {
+      databaseAccessToken,
+      endUserToken,
+      endUserName,
+      key,
+      dataRoles,
+      attributes
+    } = options;
+    const hasEndUserToken = endUserToken !== undefined && endUserToken !== null;
+    const hasEndUserName = endUserName !== undefined && endUserName !== null;
+    const hasKey = key !== undefined && key !== null;
+
+    // The database access token is always required, and the end user must be
+    // identified either by token or by name, but not both.
+    errors.assertParamValue(hasNonEmptyText(databaseAccessToken), 1);
+    errors.assertParamValue(
+      (hasEndUserToken && !hasEndUserName && !hasKey) ||
+      (!hasEndUserToken && hasEndUserName), 1);
+
+    // When supplied, token/name/key values must contain non-whitespace text.
+    if (hasEndUserToken) {
+      errors.assertParamValue(hasNonEmptyText(endUserToken), 1);
+    }
+
+    if (hasEndUserName) {
+      errors.assertParamValue(hasNonEmptyText(endUserName), 1);
+    }
+
+    if (hasKey) {
+      errors.assertParamValue(hasEndUserName, 1);
+      errors.assertParamValue(hasNonEmptyText(key), 1);
+    }
+
+    const payload = {
+      ver: '1.0',
+      database_access_token: databaseAccessToken
+    };
+
+    if (endUserToken != null) {
+      payload.end_user_token = endUserToken;
+    }
+
+    if (endUserName != null) {
+      payload.end_user_name = endUserName;
+    }
+
+    if (key != null) {
+      payload.end_user_contextid = key;
+    }
+
+    // Data roles are optional, but must be passed as an array when present.
+    if (dataRoles != null) {
+      errors.assertParamValue(Array.isArray(dataRoles), 1);
+      payload.data_roles = Array.from(dataRoles);
+    }
+
+    // Attributes are encoded as name/value entries expected by the OSON payload.
+    if (attributes != null) {
+      errors.assertParamValue(
+        typeof attributes === 'object' && !Array.isArray(attributes),
+        1
+      );
+      payload.attributes = Object.entries(attributes).map(
+        ([name, values]) => ({ name, values }));
+    }
+
+    this._payloadStore = new ObfuscatedValue();
+    this._encodeAndStorePayload(payload);
+  }
+
+  _encodePayload(value) {
+    const encoder = new oson.OsonEncoder();
+    return encoder.encode(
+      transformer.transformJsonValue(value),
+      DEFAULT_MAX_FIELD_NAME_SIZE
+    );
+  }
+
+  _encodeAndStorePayload(payload) {
+    const encodedPayload =
+      this._encodePayload(payload);
+    this.setEncodedPayload(encodedPayload);
+  }
+
+  setEncodedPayload(encodedPayload) {
+    errors.assertParamValue(Buffer.isBuffer(encodedPayload), 1);
+    const payloadLength = encodedPayload.length;
+    if (payloadLength > DEFAULT_MAX_PAYLOAD_LENGTH) {
+      encodedPayload.fill(0);
+      errors.throwErr(
+        errors.ERR_INVALID_END_USER_SECURITY_CONTEXT_LENGTH,
+        payloadLength
+      );
+    }
+    this._payloadStore.set(encodedPayload, { returnBuffer: true });
+    encodedPayload.fill(0);
+  }
+
+  getDeobfuscatedValue() {
+    return this._payloadStore.get({ returnBuffer: true });
+  }
+}
+
+module.exports = EndUserSecurityContext;

package/lib/errors.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 //-----------------------------------------------------------------------------
 //
 // This software is dual-licensed to you under the Universal Permissive License
@@ -180,6 +180,25 @@ const ERR_SESSIONLESS_ALREADY_ACTIVE = 171;
 const ERR_SESSIONLESS_INACTIVE = 172;
 const ERR_INVALID_SERVER_RESPONSE = 173;
 const ERR_PAYLOAD_CANNOT_BE_ENQUEUED = 174;
+const ERR_NULLS_NOT_ALLOWED = 175;
+const ERR_DPL_TOO_MUCH_DATA = 176;
+const ERR_DPL_INVALID_ROW_DATA = 177;
+const ERR_PIPELINE_OPERATION_NOT_SUPPORTED = 178;
+const ERR_PIPELINE_MISMATCHED_TOKEN = 179;
+const ERR_PIPELINE_DBOBJECTS_NOT_SUPPORTED = 180;
+const ERR_PIPELINE_LARGE_BUFFERS_NOT_SUPPORTED = 181;
+const ERR_PIPELINE_EXEC_OPTION_NOT_SUPPORTED = 182;
+const ERR_INVALID_SQL_NAME = 183;
+const ERR_APP_CONTEXT_EMPTY_NAMESPACE = 184;
+const ERR_APP_CONTEXT_INVALID_KEY_VALUE = 185;
+const ERR_APP_CONTEXT_KEY_TOO_LONG = 186;
+const ERR_APP_CONTEXT_VALUE_TOO_LONG = 187;
+const ERR_UNSUPPORTED_KEY_LENGTH = 188;
+const ERR_INVALID_END_USER_SECURITY_CONTEXT_LENGTH = 189;
+const ERR_END_USER_SECURITY_CONTEXT_REQUIRES_TCPS = 190;
+const ERR_UNSUPPORTED_DEEP_DATA_SECURITY_FEATURE = 191;
+const ERR_CHAR_CS_NOT_SUPPORTED = 192;
+const ERR_INVALID_PROPERTY_LENGTH = 193;
 
 // Oracle Net layer errors start from 500
 const ERR_CONNECTION_CLOSED = 500;
@@ -203,6 +222,7 @@ const ERR_INVALID_SERVICE_NAME = 518;
 const ERR_INVALID_SID = 519;
 const ERR_TNS_NAMES_FILE_MISSING = 520;
 const ERR_CONNECTION_EOF = 521;
+const ERR_CONNECT_DESCRIPTOR_LIMIT_EXCEEDED = 522;
 const ERR_CONFIG_PROVIDER_FAILED_TO_RETRIEVE_CONFIG = 523;
 const ERR_REGISTER_HOOKFN_CONFIGPROVIDER = 524;
 const ERR_WALLET_TYPE_NOT_SUPPORTED = 529;
@@ -212,6 +232,7 @@ const ERR_ANO_STATUS = 532;
 const ERR_ANO_NEGOTIATION = 533;
 const ERR_DATA_COMPRESSION = 534;
 const ERR_CONFIG_PROVIDER_PARAM_TYPE = 535;
+const ERR_TOO_MANY_REDIRECTS = 536;
 
 // Oracle SUCCESS_WITH_INFO warning start from 700
 const WRN_COMPILATION_CREATE = 700;
@@ -256,6 +277,7 @@ adjustErrorXref.set("ORA-12583", ERR_CONNECTION_CLOSED);
 adjustErrorXref.set("ORA-27146", ERR_CONNECTION_CLOSED);
 adjustErrorXref.set("ORA-28511", ERR_CONNECTION_CLOSED);
 adjustErrorXref.set("ORA-56600", ERR_CONNECTION_CLOSED);
+adjustErrorXref.set("ORA-24315", ERR_APP_CONTEXT_EMPTY_NAMESPACE);
 adjustErrorXref.set("ORA-24338", ERR_INVALID_REF_CURSOR);
 adjustErrorXref.set("ORA-25708", ERR_TOKEN_HAS_EXPIRED);
 adjustErrorXref.set("ORA-24344", WRN_COMPILATION_CREATE);
@@ -389,7 +411,7 @@ messages.set(ERR_CONN_TOKEN_BASED_AUTH,                 // NJS-086
 messages.set(ERR_TOKEN_HAS_EXPIRED,                     // NJS-087
   'access token has expired');
 messages.set(ERR_NOT_IMPLEMENTED,                       // NJS-089
-  '%s is not supported by node-oracledb in Thin mode');
+  '%s is not supported by node-oracledb in %s mode');
 messages.set(ERR_INIT_ORACLE_CLIENT_ARGS,               // NJS-090
   'initOracleClient() was already called with different arguments');
 messages.set(ERR_MISSING_FILE,                          // NJS-091
@@ -546,7 +568,44 @@ messages.set(ERR_INVALID_SERVER_RESPONSE,               //NJS-173
   'Invalid server response to connection request');
 messages.set(ERR_PAYLOAD_CANNOT_BE_ENQUEUED,            // NJS-174
   "Payload cannot be enqueued since it does not match the payload type supported by the queue");
-
+messages.set(ERR_NULLS_NOT_ALLOWED,                     // NJS-175
+  'Value for column %s may not be null on row %d');
+messages.set(ERR_DPL_TOO_MUCH_DATA,                     // NJS-176
+  'The maximum size of a Direct Path load has been exceeded');
+messages.set(ERR_DPL_INVALID_ROW_DATA,                  // NJS-177
+  'The row data provided for Direct Path load is Invalid. Expected a 2D array (Array of Arrays) representing rows and columns.');
+messages.set(ERR_PIPELINE_OPERATION_NOT_SUPPORTED,      // NJS-178
+  'Unsupported pipeline operation type: %s');
+messages.set(ERR_PIPELINE_MISMATCHED_TOKEN,             // NJS-179
+  'Pipeline internal error: token number %d does not match expected token number %d');
+messages.set(ERR_PIPELINE_DBOBJECTS_NOT_SUPPORTED,      // NJS-180
+  'Oracle Database Object types are not supported in pipeline mode');
+messages.set(ERR_PIPELINE_LARGE_BUFFERS_NOT_SUPPORTED,  // NJS-181
+  'PL/SQL blocks with string/bytes object size greater than 32k are not supported in pipeline mode');
+messages.set(ERR_PIPELINE_EXEC_OPTION_NOT_SUPPORTED,    // NJS-182
+  `Execute option '%s' is not supported in pipeline mode`);
+messages.set(ERR_INVALID_SQL_NAME,                     // NJS-183
+  'invalid SQL name: embedded double quotes are not allowed');
+messages.set(ERR_APP_CONTEXT_EMPTY_NAMESPACE,           // NJS-184
+  'The namespace can not be empty for Application Context');
+messages.set(ERR_APP_CONTEXT_INVALID_KEY_VALUE,         // NJS-185
+  'Invalid Application Context entry: both key and value must be strings. Got key=%s, value=%s');
+messages.set(ERR_APP_CONTEXT_KEY_TOO_LONG,              // NJS-186
+  'Application Context key length (%d bytes) exceeds the maximum allowed (%d bytes)');
+messages.set(ERR_APP_CONTEXT_VALUE_TOO_LONG,            // NJS-187
+  'Application Context value length (%d bytes) exceeds the maximum allowed (%d bytes)');
+messages.set(ERR_UNSUPPORTED_KEY_LENGTH,               // NJS-188
+  'Unsupported encryption key length %d');
+messages.set(ERR_INVALID_END_USER_SECURITY_CONTEXT_LENGTH, // NJS-189
+  'Specified End User Context exceeds the maximum supported size %d');
+messages.set(ERR_END_USER_SECURITY_CONTEXT_REQUIRES_TCPS,  // NJS-190
+  'End User Context requires use of the tcps protocol');
+messages.set(ERR_UNSUPPORTED_DEEP_DATA_SECURITY_FEATURE,   // NJS-191
+  'database version does not support the Oracle Deep Data Security feature');
+messages.set(ERR_CHAR_CS_NOT_SUPPORTED,                 // NJS-192
+  'Character set id %d is not supported by node-oracledb in Thin mode');
+messages.set(ERR_INVALID_PROPERTY_LENGTH,               // NJS-193
+  'The length of the parameter %s exceeds the maximum allowed length of %d');
 
 // Oracle Net layer errors
 
@@ -592,6 +651,8 @@ messages.set(ERR_TNS_NAMES_FILE_MISSING,                // NJS-520
   'cannot connect to Oracle Database. File tnsnames.ora not found in %s');
 messages.set(ERR_CONNECTION_EOF,                        // NJS-521
   'connection to host %s port %d received end-of-file on communication channel. (CONNECTION_ID=%s)');
+messages.set(ERR_CONNECT_DESCRIPTOR_LIMIT_EXCEEDED,     // NJS-522
+  'connection string exceeds supported descriptor %s limit of %d');
 messages.set(ERR_CONFIG_PROVIDER_FAILED_TO_RETRIEVE_CONFIG,   // NJS-523
   'Failed to retrieve configuration from Centralized Configuration Provider:\n %s');
 messages.set(ERR_REGISTER_HOOKFN_CONFIGPROVIDER,         // NJS-524
@@ -610,6 +671,8 @@ messages.set(ERR_DATA_COMPRESSION, 'Error during data compression/decompression:
 // Oracle SUCCESS_WITH_INFO warning
 messages.set(ERR_CONFIG_PROVIDER_PARAM_TYPE,               // NJS-535
   'Parameter does not have a valid type: %s\n');
+messages.set(ERR_TOO_MANY_REDIRECTS,               // NJS-536
+  'Too many connect redirects (limit: %d)');
 messages.set(WRN_COMPILATION_CREATE,                    // NJS-700
   'creation succeeded with compilation errors');
 
@@ -733,6 +796,21 @@ function assertParamValue(condition, parameterNum) {
   assert(condition, ERR_INVALID_PARAMETER_VALUE, parameterNum);
 }
 
+//-----------------------------------------------------------------------------
+// assertPropLength()
+//
+// Asserts that the property value is of specified type and doesn't exceed
+// maximum specified length
+//-----------------------------------------------------------------------------
+function assertPropLength(value, propType, propMaxLength, propName) {
+  if (propType !== 'array')
+    assertPropValue(typeof value === propType, propName);
+  else
+    assertPropValue(Array.isArray(value), propName);
+  assert(value.length <= propMaxLength, ERR_INVALID_PROPERTY_LENGTH, propName,
+    propMaxLength);
+}
+
 //-----------------------------------------------------------------------------
 // assertPropValue()
 //
@@ -756,6 +834,9 @@ function getErr(errorNum) {
     errorNum = ERR_INVALID_ERR_NUM;
     baseText = messages.get(errorNum);
   }
+  if (errorNum === ERR_INVALID_PACKET && args.length > 1) {
+    baseText += '. Cause: %s';
+  }
   const errorNumStr = errorNum.toString().padStart(3, '0');
   const code = `${ERR_PREFIX}-${errorNumStr}`;
   args[0] = `${code}: ${baseText}`;
@@ -787,10 +868,11 @@ function throwErrWithORAError() {
 //-----------------------------------------------------------------------------
 // throwNotImplemented()
 //
-// Throws an error that the feature is not supported in Thin mode
+// Throws an error that the feature is not supported in Thin/Thick mode
 //-----------------------------------------------------------------------------
 function throwNotImplemented(feature) {
-  throwErr(ERR_NOT_IMPLEMENTED, feature);
+  const settings = require('./settings.js');
+  throwErr(ERR_NOT_IMPLEMENTED, feature, settings.thin ? 'Thin' : 'Thick');
 }
 
 
@@ -855,6 +937,7 @@ function throwWrapErr(err, fnOpt) {
 
 // define exports
 module.exports = {
+  ERR_TOO_MANY_REDIRECTS,
   ERR_INTEGRITY_ERROR_CODES,
   ERR_INVALID_POOL,
   ERR_INVALID_CONNECTION,
@@ -938,6 +1021,7 @@ module.exports = {
   ERR_NO_CONFIG_DIR,
   ERR_TNS_ENTRY_NOT_FOUND,
   ERR_CONNECTION_EOF,
+  ERR_CONNECT_DESCRIPTOR_LIMIT_EXCEEDED,
   ERR_CONFIG_PROVIDER_FAILED_TO_RETRIEVE_CONFIG,
   ERR_CONFIG_PROVIDER_PARAM_TYPE,
   ERR_REGISTER_HOOKFN_CONFIGPROVIDER,
@@ -1009,6 +1093,17 @@ module.exports = {
   ERR_SESSIONLESS_INACTIVE,
   ERR_INVALID_SERVER_RESPONSE,
   ERR_PAYLOAD_CANNOT_BE_ENQUEUED,
+  ERR_NULLS_NOT_ALLOWED,
+  ERR_DPL_TOO_MUCH_DATA,
+  ERR_DPL_INVALID_ROW_DATA,
+  ERR_APP_CONTEXT_INVALID_KEY_VALUE,
+  ERR_APP_CONTEXT_KEY_TOO_LONG,
+  ERR_APP_CONTEXT_VALUE_TOO_LONG,
+  ERR_UNSUPPORTED_KEY_LENGTH,
+  ERR_APP_CONTEXT_EMPTY_NAMESPACE,
+  ERR_INVALID_END_USER_SECURITY_CONTEXT_LENGTH,
+  ERR_END_USER_SECURITY_CONTEXT_REQUIRES_TCPS,
+  ERR_UNSUPPORTED_DEEP_DATA_SECURITY_FEATURE,
   ERR_CONNECTION_CLOSED_CODE: `${ERR_PREFIX}-${ERR_CONNECTION_CLOSED}`,
   ERR_OPERATION_NOT_SUPPORTED_ON_BFILE,
   ERR_OPERATION_ONLY_SUPPORTED_ON_BFILE,
@@ -1025,6 +1120,13 @@ module.exports = {
   ERR_DB_FETCH_TYPE_HANDLER_RETURN_VALUE,
   ERR_ACCESS_TOKEN,
   ERR_CALLOUT_FN,
+  ERR_PIPELINE_OPERATION_NOT_SUPPORTED,
+  ERR_PIPELINE_MISMATCHED_TOKEN,
+  ERR_PIPELINE_DBOBJECTS_NOT_SUPPORTED,
+  ERR_PIPELINE_LARGE_BUFFERS_NOT_SUPPORTED,
+  ERR_PIPELINE_EXEC_OPTION_NOT_SUPPORTED,
+  ERR_INVALID_SQL_NAME,
+  ERR_CHAR_CS_NOT_SUPPORTED,
   WRN_COMPILATION_CREATE,
   assert,
   assertArgCount,
@@ -1036,6 +1138,7 @@ module.exports = {
   assertParamPropUnsignedIntNonZero,
   assertParamPropValue,
   assertParamValue,
+  assertPropLength,
   assertPropValue,
   getErr,
   throwErr,

package/lib/impl/connection.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -84,13 +84,16 @@ class ConnectionImpl {
     }
     traceConfig.serviceName = this.getServiceName();
     traceConfig.instanceName = this.getInstanceName();
-    traceConfig.pdbName = this.getDbName();
+    traceConfig.pdbName = this.getPdbName();
+    traceConfig.dbName = this.getDbName();
+    traceConfig.domainName = this.getDbDomain();
 
     // Thick mode doesnt have these properties for now.
     if (settings.thin) {
       traceConfig.hostName = this.getHostName();
       traceConfig.port = this.getPort();
       traceConfig.protocol = this.getProtocol();
+      traceConfig.dbUniqueName = this.getDbUniqueName();
     }
     return traceConfig;
   }
@@ -253,6 +256,24 @@ class ConnectionImpl {
     errors.throwNotImplemented("getting db name");
   }
 
+  //---------------------------------------------------------------------------
+  // getPdbName()
+  //
+  // Returns the name of a container associated with the connection..
+  //---------------------------------------------------------------------------
+  getPdbName() {
+    errors.throwNotImplemented("getting pdb name");
+  }
+
+  //---------------------------------------------------------------------------
+  // getDbUniqueName()
+  //
+  // Returns the Oracle Database unique name associated with the connection.
+  //---------------------------------------------------------------------------
+  getDbUniqueName() {
+    errors.throwNotImplemented("getting db unique name");
+  }
+
   //---------------------------------------------------------------------------
   // getDbObjectClass()
   //
@@ -539,6 +560,24 @@ class ConnectionImpl {
     errors.throwNotImplemented("setting end-to-end attribute 'module'");
   }
 
+  //---------------------------------------------------------------------------
+  // setEndUserSecurityContext()
+  //
+  // Sets the End Security Context.
+  //---------------------------------------------------------------------------
+  setEndUserSecurityContext() {
+    errors.throwNotImplemented("setting End User Security Context");
+  }
+
+  //---------------------------------------------------------------------------
+  // clearEndUserSecurityContext()
+  //
+  // Clears the End Security Context.
+  //---------------------------------------------------------------------------
+  clearEndUserSecurityContext() {
+    errors.throwNotImplemented("clearing End User Security Context");
+  }
+
   //---------------------------------------------------------------------------
   // setTag()
   //
@@ -638,6 +677,14 @@ class ConnectionImpl {
     errors.throwNotImplemented("unsubscribing from events");
   }
 
+  // supportsPipelining()
+  //
+  // Returns true if pipelining is supported.
+  //---------------------------------------------------------------------------
+  supportsPipelining() {
+    return false;
+  }
+
   //---------------------------------------------------------------------------
   // getHostName()
   //
@@ -665,6 +712,33 @@ class ConnectionImpl {
     errors.throwNotImplemented("getting Protocol");
   }
 
+  //---------------------------------------------------------------------------
+  // directPathLoad()
+  //
+  // Performs a direct path load into the specified table.
+  //---------------------------------------------------------------------------
+  directPathLoad() {
+    errors.throwNotImplemented("direct path load");
+  }
+
+  //---------------------------------------------------------------------------
+  // appContext()
+  //
+  // Add Application Context, keyValues identified by name, namespaceName.
+  //---------------------------------------------------------------------------
+  appContext() {
+    errors.throwNotImplemented("setting app context");
+  }
+
+  //---------------------------------------------------------------------------
+  // clearAppContext()
+  //
+  // Clears the Application Context, keyValues identified by name.
+  //---------------------------------------------------------------------------
+  clearAppContext() {
+    errors.throwNotImplemented("clear app context");
+  }
+
 }
 
 // export just the class

package/lib/impl/datahandlers/buffer.js

@@ -372,12 +372,23 @@ class BaseBuffer {
   //
   // Reads a boolean value from the buffer and returns a Boolean.
   //---------------------------------------------------------------------------
-  readBool() {
+  readBool(fromDBObject) {
     const buf = this.readBytesWithLength();
     if (!buf) {
       return null;
     }
-    return (buf[buf.length - 1] === 1);
+    if (fromDBObject) {
+      // inside a database object, the boolean is represented as a
+      // big endian 32-bit integer (either 0 or 1)
+      return (buf[buf.length - 1] === 1);
+    } else {
+      // outside a database object, the boolean is represented as an
+      // encoded integer (0x00 for false and 0x0101 for true); older
+      // versions like 12.1 also return 0x8101 (-1) for null values
+      // but this can safely be ignored as the null indicator is sent
+      // as a separate field afterwards.
+      return (buf[0] === 1);
+    }
   }
 
   //---------------------------------------------------------------------------
@@ -920,7 +931,7 @@ class BaseBuffer {
   //
   // Writes the number (in string form) in Oracle Number format to the buffer.
   //---------------------------------------------------------------------------
-  writeOracleNumber(value) {
+  writeOracleNumber(value, writeLength = true) {
 
     // determine if number is negative
     let isNegative = false;
@@ -984,8 +995,11 @@ class BaseBuffer {
     } else if (value.length === 0 && exponent === 0) {
       exponentOnWire = 128;
     }
-    let pos = this.reserveBytes(numPairs + 2 + appendSentinel);
-    this.buf[pos++] = numPairs + 1 + appendSentinel;
+    let pos = this.reserveBytes(numPairs + 1 + writeLength + appendSentinel);
+
+    if (writeLength) {
+      this.buf[pos++] = numPairs + 1 + appendSentinel;
+    }
     this.buf[pos++] = exponentOnWire;
     for (let i = 0; i < value.length; i += 2) {
       const base100Digit = Number(value.substring(i, i + 2));

package/lib/impl/datahandlers/vector.js

@@ -37,6 +37,21 @@ const types = require("../../types.js");
  */
 class VectorDecoder extends BaseBuffer {
 
+  //---------------------------------------------------------------------------
+  // _verifyVectorDataSize()
+  //
+  // Verifies that the VECTOR image contains enough bytes for the declared
+  // element count before allocating a typed array.
+  //---------------------------------------------------------------------------
+  _verifyVectorDataSize(numElements, elementSize) {
+    const numBytes = numElements * elementSize;
+    const numBytesLeft = this.numBytesLeft();
+    if (numBytes > numBytesLeft) {
+      errors.throwErr(errors.ERR_UNEXPECTED_END_OF_DATA, numBytes,
+        numBytesLeft);
+    }
+  }
+
   //---------------------------------------------------------------------------
   // decode()
   //
@@ -56,7 +71,7 @@ class VectorDecoder extends BaseBuffer {
     const flags = this.readUInt16BE();
     const vectorFormat = this.readUInt8();
     let numElements = this.readUInt32BE();
-    let elementSize, value, sparseValue;
+    let arrayType, elementSize, sparseValue;
 
     // For binary vector, NORM will never be present but space for NORM is reserved to keep
     // same header lengh across the different vector formats.
@@ -69,6 +84,7 @@ class VectorDecoder extends BaseBuffer {
       sparseValue = {};
       sparseValue.numDimensions = numElements; // vector dimensions.
       numElements = this.readUInt16BE(); // actual elements.
+      this._verifyVectorDataSize(numElements, 4);
       sparseValue.indices = new Uint32Array(numElements);
       for (let i = 0; i < numElements; i++) {
         sparseValue.indices[i] = this.readUInt32BE();
@@ -76,22 +92,26 @@ class VectorDecoder extends BaseBuffer {
     }
 
     if (vectorFormat === constants.VECTOR_FORMAT_FLOAT32) {
+      arrayType = Float32Array;
       elementSize = 4;
-      value = new Float32Array(numElements);
     } else if (vectorFormat === constants.VECTOR_FORMAT_FLOAT64) {
+      arrayType = Float64Array;
       elementSize = 8;
-      value = new Float64Array(numElements);
     } else if (vectorFormat === constants.VECTOR_FORMAT_INT8) {
+      arrayType = Int8Array;
       elementSize = 1;
-      value = new Int8Array(numElements);
     } else if (vectorFormat === constants.VECTOR_FORMAT_BINARY) {
+      arrayType = Uint8Array;
       elementSize = 1;
       // The number of dimensions are assumed to be multiple of 8.
+      if (numElements % 8 !== 0)
+        errors.throwErr(errors.ERR_UNEXPECTED_DATA, numElements);
       numElements = numElements / 8;
-      value = new Uint8Array(numElements);
     } else {
       errors.throwErr(errors.ERR_VECTOR_FORMAT_NOT_SUPPORTED, vectorFormat);
     }
+    this._verifyVectorDataSize(numElements, elementSize);
+    const value = new arrayType(numElements);
 
     if (sparseFormat) {
       sparseValue.values = value;

package/lib/impl/lob.js

@@ -81,6 +81,15 @@ class LobImpl extends BaseImpl {
     errors.throwNotImplemented("getting directory and filename of LOB(BFILE)");
   }
 
+  //---------------------------------------------------------------------------
+  // trim()
+  //
+  // trims non-BFILE LOBs to a smaller size.
+  //----------------------------------------------------------------------------
+  trim() {
+    errors.throwNotImplemented("trimming LOBs");
+  }
+
   //---------------------------------------------------------------------------
   // read()
   //