oracledb 6.10.0 → 7.0.1

package/lib/thin/dbObject.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2023, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2023, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -74,6 +74,9 @@ class DbObjectPickleBuffer extends GrowableBuffer {
     obj.imageFlags = this.readUInt8();
     obj.imageVersion = this.readUInt8();
     this.readLength();
+    if (obj.imageFlags & constants.TNS_OBJ_IS_DEGENERATE) {
+      errors.throwNotImplemented('DbObject attributes stored as a locator');
+    }
     if ((obj.imageFlags & constants.TNS_OBJ_NO_PREFIX_SEG) === 0) {
       const prefixSegLength = this.readLength();
       this.skipBytes(prefixSegLength);
@@ -302,7 +305,7 @@ class ThinDbObjectImpl extends DbObjectImpl {
           }
           break;
         default:
-          errors.throwErr(errors.ERR_NOT_IMPLEMENTED, type);
+          errors.throwNotImplemented(type);
       }
     }
   }
@@ -366,6 +369,7 @@ class ThinDbObjectImpl extends DbObjectImpl {
   //---------------------------------------------------------------------------
   _unpackValue(buf, type, typeClass) {
     let isNull, obj, value, isCollection;
+    const caps = this._objType._connection._protocol.caps;
     switch (type) {
       case types.DB_TYPE_NUMBER:
         return buf.readOracleNumber();
@@ -373,9 +377,11 @@ class ThinDbObjectImpl extends DbObjectImpl {
         return buf.readBinaryInteger();
       case types.DB_TYPE_VARCHAR:
       case types.DB_TYPE_CHAR:
+        caps.checkCharsetId();
         return buf.readStr(constants.CSFRM_IMPLICIT);
       case types.DB_TYPE_NVARCHAR:
       case types.DB_TYPE_NCHAR:
+        caps.checkNCharsetId();
         return buf.readStr(constants.CSFRM_NCHAR);
       case types.DB_TYPE_RAW:
         value = buf.readBytesWithLength();
@@ -393,7 +399,7 @@ class ThinDbObjectImpl extends DbObjectImpl {
       case types.DB_TYPE_TIMESTAMP_TZ:
         return buf.readOracleDate(false);
       case types.DB_TYPE_BOOLEAN:
-        return buf.readBool();
+        return buf.readBool(true);
       case types.DB_TYPE_OBJECT:
       case types.DB_TYPE_XMLTYPE:
         obj = new ThinDbObjectImpl(typeClass);
@@ -412,7 +418,7 @@ class ThinDbObjectImpl extends DbObjectImpl {
         }
         return obj;
       default:
-        errors.throwErr(errors.ERR_NOT_IMPLEMENTED, type);
+        errors.throwNotImplemented(type);
     }
   }
 

package/lib/thin/lob.js

@@ -172,6 +172,23 @@ class ThinLobImpl extends LobImpl {
     return await this._sendMessage(options);
   }
 
+  //---------------------------------------------------------------------------
+  // trim()
+  //
+  // Internal method for trimming the LOB.
+  //---------------------------------------------------------------------------
+  async trim(newSize) {
+    this.checkConn();
+    const options = {
+      operation: constants.TNS_LOB_OP_TRIM,
+      sourceLobImpl: this,
+      sendAmount: true,
+      amount: newSize
+    };
+    await this._sendMessage(options);
+    this._length = newSize;
+  }
+
   //---------------------------------------------------------------------------
   // write()
   //
@@ -186,7 +203,9 @@ class ThinLobImpl extends LobImpl {
       data: data
     };
     await this._sendMessage(options);
-    this._length += data.length;
+    // Take the offset into account while setting the length
+    // Note that offset is 1-based
+    this._length = Math.max(this._length, (offset - 1) + data.length);
   }
 
   //---------------------------------------------------------------------------

package/lib/thin/pool.js

@@ -28,10 +28,10 @@
 
 const PoolImpl = require('../impl/pool.js');
 const ThinConnectionImpl = require('./connection.js');
-const protocolUtil = require('./protocol/utils.js');
 const errors = require('../errors.js');
 const settings = require('../settings.js');
 const util = require('../util.js');
+const { ObfuscatedValue } = require('../obfuscation.js');
 const thinUtil = require('./util.js');
 const {getConnectionInfo} = require('./sqlnet/networkSession.js');
 const crypto = require('crypto');
@@ -41,7 +41,7 @@ class ThinPoolImpl extends PoolImpl {
 
   _init(params) {
     if (!params.homogeneous) {
-      errors.throwErr(errors.ERR_NOT_IMPLEMENTED, 'Heterogeneous Pooling');
+      errors.throwNotImplemented('Heterogeneous Pooling');
     }
     if (!params.connectString) {
       errors.throwErr(errors.ERR_EMPTY_CONNECT_STRING);
@@ -65,15 +65,11 @@ class ThinPoolImpl extends PoolImpl {
     this._userConfig = params;
     this._freeConnectionList = [];
     this._usedConnectionList = new Set();
-    this._password = params.password;
-    this._walletPassword = params.walletPassword;
-    this._walletContent = params.walletContent;
-    this._obfuscatedPassword = [];
-    this._obfuscatedWalletPassword = [];
-    this._token = params.token;
-    this._obfuscatedToken = [];
-    this._privateKey = params.privateKey;
-    this._obfuscatedPrivateKey = [];
+    this._password = new ObfuscatedValue();
+    this._walletPassword = new ObfuscatedValue();
+    this._walletContent = new ObfuscatedValue();
+    this._token = new ObfuscatedValue();
+    this._privateKey = new ObfuscatedValue();
     this._schedulerJob = null;
     this._poolCloseWaiter = null;
     this._pendingRequests = [];
@@ -82,38 +78,28 @@ class ThinPoolImpl extends PoolImpl {
     this._poolCloseCleaner = null;
 
     // password obfuscation
-    if (this._password !== undefined) {
-      const obj = protocolUtil.setObfuscatedValue(this._password);
-      this._password = obj.value;
-      this._obfuscatedPassword = obj.obfuscatedValue;
+    if (params.password !== undefined) {
+      this._password.set(params.password);
       this._userConfig.password = null;
     }
     // wallet password obfuscation
-    if (this._walletPassword !== undefined) {
-      const obj = protocolUtil.setObfuscatedValue(this._walletPassword);
-      this._walletPassword = obj.value;
-      this._obfuscatedWalletPassword = obj.obfuscatedValue;
+    if (params.walletPassword !== undefined) {
+      this._walletPassword.set(params.walletPassword);
       this._userConfig.walletPassword = null;
     }
     // wallet content obfuscation
-    if (this._walletContent !== undefined) {
-      const obj = protocolUtil.setObfuscatedValue(this._walletContent);
-      this._walletContent = obj.value;
-      this._obfuscatedWalletContent = obj.obfuscatedValue;
-      this._userConfig.walletConent = null;
+    if (params.walletContent !== undefined) {
+      this._walletContent.set(params.walletContent);
+      this._userConfig.walletContent = null;
     }
     // token obfuscation
-    if (this._token !== undefined) {
-      const obj = protocolUtil.setObfuscatedValue(this._token);
-      this._token = obj.value;
-      this._obfuscatedToken = obj.obfuscatedValue;
+    if (params.token !== undefined) {
+      this._token.set(params.token);
       this._userConfig.token = null;
     }
     // privateKey obfuscation
-    if (this._privateKey !== undefined) {
-      const obj = protocolUtil.setObfuscatedValue(this._privateKey);
-      this._privateKey = obj.value;
-      this._obfuscatedPrivateKey = obj.obfuscatedValue;
+    if (params.privateKey !== undefined) {
+      this._privateKey.set(params.privateKey);
       this._userConfig.privateKey = null;
     }
     this._accessTokenFn = params.accessTokenFn;
@@ -128,6 +114,7 @@ class ThinPoolImpl extends PoolImpl {
   //---------------------------------------------------------------------------
   async create(params) {
     this._init(params);
+    this._eventCallback = params.poolEventReg;
     this._userConfig._connInfo =
       await getConnectionInfo(params);
     this._isDRCPEnabled =
@@ -150,16 +137,12 @@ class ThinPoolImpl extends PoolImpl {
   //---------------------------------------------------------------------------
   setAccessToken(params) {
     if (params.token) {
-      this._token = params.token;
-      const objToken = protocolUtil.setObfuscatedValue(this._token);
-      this._token = objToken.value;
-      this._obfuscatedToken = objToken.obfuscatedValue;
+      this._token.set(params.token);
+      this._userConfig.token = null;
     }
     if (params.privateKey) {
-      this._privateKey = params.privateKey;
-      const objKey = protocolUtil.setObfuscatedValue(this._privateKey);
-      this._privateKey = objKey.value;
-      this._obfuscatedPrivateKey = objKey.obfuscatedValue;
+      this._privateKey.set(params.privateKey);
+      this._userConfig.privateKey = null;
     }
   }
 
@@ -173,29 +156,23 @@ class ThinPoolImpl extends PoolImpl {
     const clonedAttrs = Object.assign({}, this._userConfig);
     // deobfuscate password
     if (clonedAttrs.password === null) {
-      clonedAttrs.password = protocolUtil.getDeobfuscatedValue(this._password,
-        this._obfuscatedPassword);
+      clonedAttrs.password = this._password.get();
     }
 
     // deobfuscate wallet password
     if (clonedAttrs.walletPassword === null) {
-      clonedAttrs.walletPassword =
-        protocolUtil.getDeobfuscatedValue(this._walletPassword,
-          this._obfuscatedWalletPassword);
+      clonedAttrs.walletPassword = this._walletPassword.get();
     }
 
     // deobfuscate wallet content
     if (clonedAttrs.walletContent === null) {
-      clonedAttrs.walletContent =
-            protocolUtil.getDeobfuscatedValue(this._walletContent,
-              this._obfuscatedWalletContent);
+      clonedAttrs.walletContent = this._walletContent.get();
     }
 
     // deobfuscate token and private key
     // check for token expiry
     if (clonedAttrs.token === null) {
-      clonedAttrs.token =
-        protocolUtil.getDeobfuscatedValue(this._token, this._obfuscatedToken);
+      clonedAttrs.token = this._token.get();
       if (util.isTokenExpired(clonedAttrs.token)) {
         if (typeof this._accessTokenFn === 'function') {
           try {
@@ -210,9 +187,7 @@ class ThinPoolImpl extends PoolImpl {
               errors.throwErr(errors.ERR_TOKEN_HAS_EXPIRED);
             } else {
               // update pool with OAuth2 token
-              const obj = protocolUtil.setObfuscatedValue(clonedAttrs.token);
-              this._token = obj.value;
-              this._obfuscatedToken = obj.obfuscatedValue;
+              this._token.set(clonedAttrs.token);
             }
           } else if (typeof accessToken === 'object') {
             clonedAttrs.token = accessToken.token;
@@ -222,12 +197,8 @@ class ThinPoolImpl extends PoolImpl {
               errors.throwErr(errors.ERR_TOKEN_HAS_EXPIRED);
             } else {
               // update pool with IAM token and private key
-              const objToken = protocolUtil.setObfuscatedValue(clonedAttrs.token);
-              this._token = objToken.value;
-              this._obfuscatedToken = objToken.obfuscatedValue;
-              const objKey = protocolUtil.setObfuscatedValue(clonedAttrs.privateKey);
-              this._privateKey = objKey.value;
-              this._obfuscatedPrivateKey = objKey.obfuscatedValue;
+              this._token.set(clonedAttrs.token);
+              this._privateKey.set(clonedAttrs.privateKey);
             }
           }
         } else {
@@ -236,9 +207,7 @@ class ThinPoolImpl extends PoolImpl {
       }
     }
     if (clonedAttrs.privateKey === null) {
-      clonedAttrs.privateKey =
-        protocolUtil.getDeobfuscatedValue(this._privateKey,
-          this._obfuscatedPrivateKey);
+      clonedAttrs.privateKey = this._privateKey.get();
     }
     return clonedAttrs;
   }
@@ -259,8 +228,10 @@ class ThinPoolImpl extends PoolImpl {
       if (connection.nscon.ntAdapter.connected) {
         connection._dropSess = true;
         await connection.close();
+        // emit pool event when a connection is destroyed
+        this._eventCallback("onPoolShrink");
       }
-    } catch (err) {
+    } catch {
       return;
     }
   }
@@ -301,6 +272,10 @@ class ThinPoolImpl extends PoolImpl {
       if (this._bgCleaner)
         this._bgCleaner();
     });
+
+    // clear _eventCallback to break the reference cycle created by the closure
+    // capturing the user pool object.
+    this._eventCallback = null;
   }
 
   //---------------------------------------------------------------------------
@@ -473,6 +448,9 @@ class ThinPoolImpl extends PoolImpl {
           conn._creationTime = Date.now();
           conn._lastTimeUsed = Date.now();
           this._freeConnectionList.push(conn);
+
+          // emit pool event when new connections are created in background
+          this._eventCallback("onPoolExpand");
         } catch (err) {
           this._bgErr = err;
         }
@@ -589,6 +567,7 @@ class ThinPoolImpl extends PoolImpl {
 
       // connection has passed health checks, return it immediately
       this._usedConnectionList.add(conn);
+      this._eventCallback("onPoolConnectionHit");
       return conn;
 
     }
@@ -619,6 +598,7 @@ class ThinPoolImpl extends PoolImpl {
     }
     // return a connection from the ones that were just built
     const conn = this._freeConnectionList.pop();
+    this._eventCallback("onPoolConnectionMiss");
     this._usedConnectionList.add(conn);
     return conn;
   }

package/lib/thin/protocol/capabilities.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -42,11 +42,13 @@ class Capabilities {
     this.supports12cLogon = true;
     this.supportsOob = false;
     this.nCharsetId = constants.TNS_CHARSET_UTF16;
+    this.charsetId = constants.TNS_CHARSET_UTF8;
     this.compileCaps = Buffer.alloc(constants.TNS_CCAP_MAX);
     this.runtimeCaps = Buffer.alloc(constants.TNS_RCAP_MAX);
     this.initCompileCaps(nscon);
     this.initRuntimeCaps();
     this.maxStringSize = 0;
+    this.supportsEndUserSecurityContext = false;
   }
 
   adjustForServerCompileCaps(serverCaps, nscon) {
@@ -62,6 +64,11 @@ class Capabilities {
         ^= constants.TNS_CCAP_END_OF_REQUEST;
       nscon.endOfRequestSupport = false;
     }
+    const bpIndex = constants.TNS_CCAP_FEATURE_BACKPORT2;
+    if (bpIndex < serverCaps.length &&
+        (serverCaps[bpIndex] & constants.TNS_CCAP_END_USER_SEC_CTX_PIGGYBACK)) {
+      this.supportsEndUserSecurityContext = true;
+    }
   }
 
   adjustForServerRuntimeCaps(serverCaps) {
@@ -123,9 +130,13 @@ class Capabilities {
       constants.TNS_CCAP_CTB_OAUTH_MSG_ON_ERR;
     this.compileCaps[constants.TNS_CCAP_TTC5] =
       constants.TNS_CCAP_VECTOR_SUPPORT |
+      constants.TNS_CCAP_TOKEN_SUPPORTED |
+      constants.TNS_CCAP_PIPELINING_SUPPORT |
+      constants.TNS_CCAP_PIPELINING_BREAK |
       constants.TNS_CCAP_TTC5_SESSIONLESS_TXNS;
     this.compileCaps[constants.TNS_CCAP_VECTOR_FEATURES] =
       constants.TNS_CCAP_VECTOR_FEATURE_BINARY | constants.TNS_CCAP_VECTOR_FEATURE_SPARSE;
+    this.compileCaps[constants.TNS_CCAP_FEATURE_BACKPORT2] = constants.TNS_CCAP_END_USER_SEC_CTX_PIGGYBACK;
   }
 
   initRuntimeCaps() {
@@ -135,9 +146,13 @@ class Capabilities {
   }
 
   checkNCharsetId() {
-    if (this.nCharsetId !== constants.TNS_CHARSET_UTF16) {
+    if (this.nCharsetId !== constants.TNS_CHARSET_UTF16)
       errors.throwErr(errors.ERR_NCHAR_CS_NOT_SUPPORTED, this.nCharsetId);
-    }
+  }
+
+  checkCharsetId() {
+    if (this.charsetId !== constants.TNS_CHARSET_UTF8)
+      errors.throwErr(errors.ERR_CHAR_CS_NOT_SUPPORTED, this.charsetId);
   }
 
 }

package/lib/thin/protocol/constants.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -407,7 +407,12 @@ module.exports = {
   TNS_DATA_TYPE_OAC: 646,
   TNS_DATA_TYPE_SESSSIGN: 647,
   TNS_DATA_TYPE_OER: 652,
+  TNS_DATA_TYPE_PLEND: 660,
+  TNS_DATA_TYPE_PLBGN: 661,
   TNS_DATA_TYPE_UDS: 663,
+  TNS_DATA_TYPE_PLOP: 665,
+  TNS_DATA_TYPE_KVE: 669,
+  TNS_DATA_TYPE_EUSC: 670,
 
   // data type representations
   TNS_TYPE_REP_NATIVE: 0,
@@ -435,12 +440,15 @@ module.exports = {
   TNS_MSG_TYPE_IMPLICIT_RESULTSET: 27,
   TNS_MSG_TYPE_RENEGOTIATE: 28,
   TNS_MSG_TYPE_END_OF_REQUEST: 29,
+  TNS_MSG_TYPE_TOKEN: 33,
   TNS_MSG_TYPE_FAST_AUTH: 34,
 
   // parameter keyword numbers,
   TNS_KEYWORD_NUM_CURRENT_SCHEMA: 168,
   TNS_KEYWORD_NUM_EDITION: 172,
   TNS_KEYWORD_NUM_TRANSACTION_ID: 201,
+  TNS_KEYWORD_PDBNAME: 197, // Container Name
+  TNS_KEYWORD_DBNAME: 179, // Global DB Name
 
   // bind flags
   TNS_BIND_USE_INDICATORS: 0x0001,
@@ -541,13 +549,20 @@ module.exports = {
   // TTC functions
   TNS_FUNC_AUTH_PHASE_ONE: 118,
   TNS_FUNC_AUTH_PHASE_TWO: 115,
+  TNS_FUNC_APP_CONTEXT: 154,
   TNS_FUNC_CLOSE_CURSORS: 105,
   TNS_FUNC_COMMIT: 14,
+  TNS_FUNC_DIRECT_PATH_LOAD_STREAM: 129,
+  TNS_FUNC_DIRECT_PATH_OP: 130,
+  TNS_FUNC_DIRECT_PATH_PREPARE: 128,
+  TNS_FUNC_END_USER_SECURITY_CTX: 205,
   TNS_FUNC_EXECUTE: 94,
   TNS_FUNC_FETCH: 5,
   TNS_FUNC_LOB_OP: 96,
   TNS_FUNC_LOGOFF: 9,
   TNS_FUNC_PING: 147,
+  TNS_FUNC_PIPELINE_BEGIN: 199,
+  TNS_FUNC_PIPELINE_END: 200,
   TNS_FUNC_ROLLBACK: 15,
   TNS_FUNC_SET_END_TO_END_ATTR: 135,
   TNS_FUNC_REEXECUTE: 4,
@@ -595,6 +610,7 @@ module.exports = {
   TNS_CCAP_TTC4: 40,
   TNS_CCAP_LOB2: 42,
   TNS_CCAP_TTC5: 44,
+  TNS_CCAP_FEATURE_BACKPORT2: 45,
   TNS_CCAP_VECTOR_FEATURES: 52,
   TNS_CCAP_MAX: 53,
 
@@ -654,10 +670,14 @@ module.exports = {
   TNS_CCAP_CTB_IMPLICIT_POOL: 0x08,
   TNS_CCAP_CTB_OAUTH_MSG_ON_ERR: 0x10,
   TNS_CCAP_VECTOR_SUPPORT: 0x08,
+  TNS_CCAP_TOKEN_SUPPORTED: 0x02,
+  TNS_CCAP_PIPELINING_SUPPORT: 0x04,
+  TNS_CCAP_PIPELINING_BREAK: 0x10,
   TNS_CCAP_VECTOR_FEATURE_BINARY: 0x01,
   TNS_CCAP_VECTOR_FEATURE_SPARSE: 0x02,
   TNS_CCAP_TTC5_SESSIONLESS_TXNS: 0x20,
   TNS_CCAP_OCI3_OCSSYNC: 0x20,
+  TNS_CCAP_END_USER_SEC_CTX_PIGGYBACK: 0x02,
 
   // runtime capability indices
   TNS_RCAP_COMPAT: 0,
@@ -776,6 +796,58 @@ module.exports = {
   TNS_AQ_EXT_KEYWORD_AGENT_PROTOCOL: 66,
   TNS_AQ_EXT_KEYWORD_ORIGINAL_MSGID: 69,
 
+  // direct path constants
+  TNS_DP_INTERFACE_VERSION: 400,
+  TNS_DP_STREAM_VERSION: 400,
+
+  // direct path op codes
+  TNS_DPP_OP_CODE_LOAD: 1,
+  TNS_DPP_OP_CODE_UNLOAD: 2,
+  TNS_DPP_OP_CODE_CONVERT: 3,
+
+  // direct path prepare input indexes
+  TNS_DPP_IN_INDEX_INTERFACE_VERSION: 0,
+  TNS_DPP_IN_INDEX_STREAM_VERSION: 1,
+  TNS_DPP_IN_INDEX_LOCK_WAIT: 14,
+  TNS_DPP_IN_MAX_PARAMS: 36,
+
+  // direct path prepare keyword indexes
+  TNS_DPP_KW_INDEX_OBJECT_NAME: 1,
+  TNS_DPP_KW_INDEX_SUBOBJECT_NAME: 2,
+  TNS_DPP_KW_INDEX_SCHEMA_NAME: 3,
+  TNS_DPP_KW_INDEX_COLUMN_NAME: 4,
+  TNS_DPP_KW_INDEX_VARRAY_TABLE: 15,
+  TNS_DPP_KW_INDEX_NFOBJ_OID_POS: 11,
+  TNS_DPP_KW_INDEX_NFOBJ_SID_POS: 16,
+  TNS_DPP_KW_INDEX_NFOBJ_VARRAY_INDEX: 17,
+
+  // direct path prepare output indexes
+  TNS_DPP_OUT_INDEX_CURSOR: 3,
+  TNS_DPP_OUT_MAX_PARAMS: 14,
+
+  // direct path row header flags
+  TNS_DPLS_ROW_HEADER_FAST_PIECE: 0x10,
+  TNS_DPLS_ROW_HEADER_FAST_ROW: 0x20,
+  TNS_DPLS_ROW_HEADER_FIRST: 0x08,
+  TNS_DPLS_ROW_HEADER_LAST: 0x04,
+  TNS_DPLS_ROW_HEADER_SPLIT_WITH_PREV: 0x02,
+  TNS_DPLS_ROW_HEADER_SPLIT_WITH_NEXT: 0x01,
+
+  // other direct path load stream constants
+  TNS_DPLS_MAX_BUFFER_SIZE_FACTOR: 22,
+  TNS_DPLS_MAX_SHORT_LENGTH: 0xfa,
+  TNS_DPLS_MAX_MESSAGE_SIZE: 1073728895,
+  TNS_DPLS_MAX_PIECE_SIZE: 0xfff0,
+  TNS_DPLS_FAST_HEADER_SIZE: 4,
+  TNS_DPLS_SLOW_HEADER_SIZE: 2,
+
+  // direct path operation codes
+  TNS_DP_OP_ABORT: 1,
+  TNS_DP_OP_FINISH: 2,
+
+  // Security Context constants
+  TNS_OSON_SEC_CTX_MAX_FNAME_SIZE: 255,
+  TNS_SECURITY_CONTEXT_ATTACH_FLAG: 0x01,
 
   // other constants
   TNS_ESCAPE_CHAR: 253,
@@ -865,8 +937,16 @@ module.exports = {
   CHUNKED_BYTES_CHUNK_SIZE: 65536,
 
   // Network Header flags for Data packet
-  TNS_DATA_FLAGS_END_OF_REQUEST: 0x2000,
+  TNS_DATA_FLAGS_BEGIN_PIPELINE: 0x1000,
+  TNS_DATA_FLAGS_END_OF_REQUEST: 0x800,
+  TNS_DATA_FLAGS_END_OF_RESPONSE: 0x2000,
+  TNS_DATA_FLAGS_OFFSET: 0x8,
 
+  // pipeline modes
+  TNS_PIPELINE_MODE_CONTINUE_ON_ERROR: 1,
+  TNS_PIPELINE_MODE_ABORT_ON_ERROR: 2,
+
+  // base 64 encoding alphabet
   TNS_BASE64_ALPHABET_ARRAY: Buffer.from('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'),
   TNS_EXTENT_OID: Buffer.from('00000000000000000000000000010001', 'hex')
 };

package/lib/thin/protocol/encryptDecrypt.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2023, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -28,8 +28,43 @@
 
 const { Buffer } = require('buffer');
 const crypto = require('crypto');
+const errors = require('../../errors.js');
+
+const MAX_PBKDF2_ITERATIONS = 100_000;
+
+function getPBKDF2Iterations(sessionData, key) {
+  const iterations = Number(sessionData[key]);
+  if (!Number.isInteger(iterations) || iterations < 1 ||
+      iterations > MAX_PBKDF2_ITERATIONS) {
+    errors.throwErr(errors.ERR_INVALID_SERVER_RESPONSE);
+  }
+  return iterations;
+}
+
+function resolveCipherKey(key) {
+  if (!Buffer.isBuffer(key)) {
+    errors.throwErr(errors.ERR_INTERNAL,
+      'Encryption key must be a Buffer');
+  }
+
+  let cipherAlg;
+  switch (key.length) {
+    case 16:
+      cipherAlg = 'aes-128-cbc';
+      break;
+    case 24:
+      cipherAlg = 'aes-192-cbc';
+      break;
+    case 32:
+      cipherAlg = 'aes-256-cbc';
+      break;
+    default:
+      errors.throwErr(errors.ERR_UNSUPPORTED_KEY_LENGTH, key.length);
+  }
+
+  return cipherAlg;
+}
 
-let algorithm = 'aes-256-cbc';
 const _appendBuffer = Buffer.from([0x00, 0x01]);
 
 /**
@@ -42,7 +77,8 @@ class EncryptDecrypt {
   // 24 bytes (192 bits).
   decrypt(key, val) {
     const iv = Buffer.alloc(16, 0); // Initialization vector, same is used in server
-    const decipher = crypto.createDecipheriv(algorithm, key, iv);
+    const cipherAlg = resolveCipherKey(key);
+    const decipher = crypto.createDecipheriv(cipherAlg, key, iv);
     decipher.setAutoPadding(false);
     let decrypted = decipher.update(val);
     decrypted = Buffer.concat([decrypted, decipher.final()]);
@@ -61,7 +97,8 @@ class EncryptDecrypt {
         val = Buffer.concat([val, nv]);
       }
     }
-    const cipher = crypto.createCipheriv(algorithm, key, iv);
+    const cipherAlg = resolveCipherKey(key);
+    const cipher = crypto.createCipheriv(cipherAlg, key, iv);
     let encrypted = cipher.update(val);
     encrypted = Buffer.concat([encrypted, cipher.final()]);
     if (!padding) {
@@ -108,13 +145,11 @@ class EncryptDecrypt {
 
     const verifierData = Buffer.from(sessionData['AUTH_VFR_DATA'], 'hex');
     const encodedServerKey = Buffer.from(sessionData['AUTH_SESSKEY'], 'hex');
-    let iterations = Number(sessionData['AUTH_PBKDF2_VGEN_COUNT']);
     const passwordBytes = Buffer.from(password, 'utf8');
     let passwordHash;
     let passwordKey;
 
     if (verifier11G) {
-      algorithm = 'aes-192-cbc';
       keyLen = 24;
       hashAlg = 'sha1';
       const h = crypto.createHash(hashAlg);
@@ -124,9 +159,9 @@ class EncryptDecrypt {
       passwordHash = Buffer.alloc(ph.length + 4);
       ph.copy(passwordHash, 0, 0, ph.length);
     } else {
-      algorithm = 'aes-256-cbc';
       const temp = Buffer.from('AUTH_PBKDF2_SPEEDY_KEY', 'utf8');
       const salt = Buffer.concat([verifierData, temp]);
+      const iterations = getPBKDF2Iterations(sessionData, 'AUTH_PBKDF2_VGEN_COUNT');
       passwordKey = crypto.pbkdf2Sync(passwordBytes, salt, iterations, 64, 'sha512');
       const h = crypto.createHash(hashAlg);
       h.update(passwordKey);
@@ -155,7 +190,7 @@ class EncryptDecrypt {
     } else {
       authObj.sessionKey = encodedClientKey.slice().toString('hex').toUpperCase().slice(0, 64);
       const mixingSalt = Buffer.from(sessionData['AUTH_PBKDF2_CSK_SALT'], 'hex');
-      iterations = Number(sessionData['AUTH_PBKDF2_SDER_COUNT']);
+      const iterations = getPBKDF2Iterations(sessionData, 'AUTH_PBKDF2_SDER_COUNT');
       const partABKey = Buffer.concat([sessionKeyPartb.slice(0, keyLen), sessionKeyParta.slice(0, keyLen)]);
       const partABKeyStr = partABKey.toString('hex').toUpperCase();
       const partABKeyBuffer = Buffer.from(partABKeyStr, 'utf8');

package/lib/thin/protocol/messages/aqArray.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2025, Oracle and/or its affiliates.
+// Copyright (c) 2025, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -78,7 +78,7 @@ class AqArrayMessage extends AqBaseMessage {
       }
       temp16 = buf.readUB2();               // extensions len
       if (temp16 > 0) {
-        errors.throwErr(errors.ERR_NOT_IMPLEMENTED);
+        errors.throwNotImplemented('AQ extensions');
       }
       buf.skipUB2();                        // output ack
     }

package/lib/thin/protocol/messages/aqBase.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2025, Oracle and/or its affiliates.
+// Copyright (c) 2025, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -134,7 +134,7 @@ class AqBaseMessage extends BaseMessage {
     this._processExtensions(buf, propsImpl);
     const temp32 = buf.readUB4();           // user properties
     if (temp32 > 0) {
-      errors.throwErr(errors.ERR_NOT_IMPLEMENTED);
+      errors.throwNotImplemented('AQ User Properties');
     }
     buf.skipUB4();                          // csn
     buf.skipUB4();                          // dsn