oracledb 7.0.0 → 26.0.0

package/lib/thin/sqlnet/ezConnectResolver.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -290,12 +290,15 @@ class EZConnectResolver {
       // by default for TCPS protocol.
       const serverDNMatch = this.urlProps.get("SSL_SERVER_DN_MATCH");
       const serverCertDN = this.urlProps.get("SSL_SERVER_CERT_DN");
+      const allowWeakDNMatch = this.urlProps.get("SSL_ALLOW_WEAK_DN_MATCH");
       const walletDir = this.urlProps.get("MY_WALLET_DIRECTORY");
       if (serverDNMatch != null)
         securityInfo.push(`(SSL_SERVER_DN_MATCH=${serverDNMatch})`);
       if (serverCertDN != null)
         securityInfo.push(`(SSL_SERVER_CERT_DN=${serverCertDN})`);
-      if (walletDir != null)
+      if (allowWeakDNMatch != null)
+        securityInfo.push(`(SSL_ALLOW_WEAK_DN_MATCH=${allowWeakDNMatch})`);
+      if (walletDir != null && walletDir.toUpperCase() !== 'SYSTEM')
         securityInfo.push(`(MY_WALLET_DIRECTORY=${walletDir})`);
     }
     if (securityInfo.length === 0)
@@ -454,6 +457,10 @@ class EZConnectResolver {
     aliasMap.set("recv_timeout", "RECV_TIMEOUT");
     aliasMap.set("ssl_server_cert_dn", "SSL_SERVER_CERT_DN");
     aliasMap.set("ssl_server_dn_match", "SSL_SERVER_DN_MATCH");
+    aliasMap.set("tls_server_cert_dn", "SSL_SERVER_CERT_DN");
+    aliasMap.set("tls_server_dn_match", "SSL_SERVER_DN_MATCH");
+    aliasMap.set("ssl_allow_weak_dn_match", "SSL_ALLOW_WEAK_DN_MATCH");
+    aliasMap.set("tls_allow_weak_dn_match", "SSL_ALLOW_WEAK_DN_MATCH");
     aliasMap.set("wallet_location", "MY_WALLET_DIRECTORY");
     aliasMap.set("pool_connection_class", "POOL_CONNECTION_CLASS");
     aliasMap.set("pool_purity", "POOL_PURITY");

package/lib/thin/sqlnet/navNodes.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -315,18 +315,20 @@ class Description {
         let tmpnv;
         for (let i = 0; i < listsize; i++) {
           tmpnv = childnv.getListElement(i);
-          if (tmpnv.name.toUpperCase() == "SSL_SERVER_CERT_DN") {
+          if (tmpnv.name.toUpperCase() == "SSL_SERVER_CERT_DN" || tmpnv.name.toUpperCase() == "TLS_SERVER_CERT_DN") {
             this.params.sslServerCertDN = tmpnv.valueToString();
-          } else if (tmpnv.name.toUpperCase() == "SSL_SERVER_DN_MATCH") {
+          } else if (tmpnv.name.toUpperCase() == "SSL_SERVER_DN_MATCH" || tmpnv.name.toUpperCase() == "TLS_SERVER_DN_MATCH") {
             this.params.sslServerDNMatch = (tmpnv.atom.toLowerCase() == "yes"
             || tmpnv.atom.toLowerCase() == "on"
             || tmpnv.atom.toLowerCase() == "true");
-          } else if (tmpnv.name.toUpperCase() == "SSL_ALLOW_WEAK_DN_MATCH") {
+          } else if (tmpnv.name.toUpperCase() == "SSL_ALLOW_WEAK_DN_MATCH" || tmpnv.name.toUpperCase() == "TLS_ALLOW_WEAK_DN_MATCH") {
             this.params.sslAllowWeakDNMatch = (tmpnv.atom.toLowerCase() == "yes"
             || tmpnv.atom.toLowerCase() == "on"
             || tmpnv.atom.toLowerCase() == "true");
           } else if ((tmpnv.name.toUpperCase() == "WALLET_LOCATION") || (tmpnv.name.toUpperCase() == "MY_WALLET_DIRECTORY")) {
-            this.params.walletLocation = tmpnv.atom;
+            if (!(typeof tmpnv.atom === 'string' && tmpnv.atom.trim().toUpperCase() === 'SYSTEM')) {
+              this.params.walletLocation = tmpnv.atom;
+            }
           }
         }
       }

package/lib/thin/sqlnet/networkSession.js

@@ -157,14 +157,23 @@ class NetworkSession {
    * Make the transport level connection
    */
   async transportConnect(address) {
-    if (address.protocol.toUpperCase() == 'TCP' && address.httpsProxy) {
-      errors.throwErr(errors.ERR_INVALID_CONNECT_STRING_PARAMETERS, 'https proxy requires protocol as', 'tcps ');
+    const protocol = address?.protocol ? address.protocol.toUpperCase() : undefined;
+    const effectiveHttpsProxy = address?.httpsProxy || this.sAtts?.nt?.httpsProxy;
+
+    // Enforce TCPS whenever an HTTPS proxy would be used (either at the address
+    // level or via the session-global proxy fallback in NTTCP).
+    if (protocol === 'TCP' && effectiveHttpsProxy) {
+      errors.throwErr(errors.ERR_INVALID_CONNECT_STRING_PARAMETERS,
+        'https proxy requires protocol as', 'tcps ');
     }
-    if (address.protocol && (address.protocol.toUpperCase() == 'TCP' || address.protocol.toUpperCase() == 'TCPS')) {
+
+    if (protocol === 'TCP' || protocol === 'TCPS') {
       this.ntAdapter = new NTTCP(this.sAtts.nt);
     } else {
-      errors.throwErr(errors.ERR_INVALID_CONNECT_STRING_PARAMETERS, address.protocol + " protocol not supported");
+      errors.throwErr(errors.ERR_INVALID_CONNECT_STRING_PARAMETERS,
+        address.protocol + " protocol not supported");
     }
+
     await this.ntAdapter.connect(address);
     this.ntAdapter.startRead();
     this.sAtts.ntCha = this.ntAdapter.cha;
@@ -390,7 +399,7 @@ class NetworkSession {
           } catch (err) {
             if (err.code == 'ERR_BUFFER_TOO_LARGE') {
               errors.throwErr(errors.ERR_INVALID_PACKET,
-                `: decompressed packet exceeds SDU ${maxPayload}`);
+                `Decompressed packet exceeds SDU ${maxPayload}`);
             }
             errors.throwErr(errors.ERR_DATA_COMPRESSION, err.message);
           }
@@ -580,7 +589,7 @@ class NetworkSession {
     if (this.isBreak) {
       return;
     }
-    let bytesCopied = 0;
+    let bytesCopied;
 
     this.sndDatapkt.dataLen = this.sndDatapkt.offset;
     if (this.sndDatapkt.dataLen < this.sndDatapkt.bufLen || !this.sndDatapkt.bufLen) {
@@ -724,10 +733,8 @@ class NetworkSession {
    * returns 0 if healthy connection
    */
   recvInbandNotif() {
-    let error = 0;
     if (this.controlPkt.errno) {     /* Control pkt already read */
-      error = this.controlPkt.errno;
-      return (error);
+      return this.controlPkt.errno;
     } else if (!this.getOption(constants.HEALTHCHECK)) {
       return errors.ERR_CONNECTION_CLOSED;
     } else {
@@ -736,8 +743,7 @@ class NetworkSession {
 
         if (packet.type == constants.NSPTCNL) {
           this.controlPkt.fromPacket(packet);
-          error = this.controlPkt.errno;
-          return (error);
+          return this.controlPkt.errno;
         } else {
           this.ntAdapter.packets.unshift(packet); /* Push packet back */
           return (0);

package/lib/thin/sqlnet/ntTcp.js

@@ -74,6 +74,7 @@ class NTTCP {
     this.largeSDU = false;
     this.streamNum = streamNum++;
     this.packetNum = 1;
+    this.proxyReq = null; // track in-flight proxy CONNECT request for abort on timeout
     this.doDNMatch = true;
   }
 
@@ -157,7 +158,7 @@ class NTTCP {
       address.port = DEFAULT_PORT;
     }
 
-    let connectErrCause, proxyConnectErrCause, req;
+    let connectErrCause, proxyConnectErrCause;
     const httpsProxy = address.httpsProxy || this.atts.httpsProxy;
     let httpsProxyPort = address.httpsProxyPort || this.atts.httpsProxyPort;
 
@@ -166,13 +167,13 @@ class NTTCP {
         if (!httpsProxyPort) {
           httpsProxyPort = DEFAULT_HTTPS_PROXY_PORT;
         }
-        req = http.request({
+        this.proxyReq = http.request({
           host: httpsProxy,
           port: httpsProxyPort,
           method: 'CONNECT',
           path: address.host + ':' + address.port,
         });
-        req.once('connect', (res, socket) => {
+        this.proxyReq.once('connect', (res, socket) => {
           if (res.statusCode == 200) {
             this.connected = true;
             this.stream = socket;
@@ -181,11 +182,11 @@ class NTTCP {
           }
           resolve();
         });
-        req.once('error', (err) => {
+        this.proxyReq.once('error', (err) => {
           proxyConnectErrCause = err.message;
           resolve();
         });
-        req.end();
+        this.proxyReq.end();
       } else {
         this.stream = net.connect(address.port, address.host, () => {
           this.connected = true;
@@ -197,8 +198,10 @@ class NTTCP {
         });
       }
     });
-    if (req)
-      req.removeAllListeners();
+    if (this.proxyReq) {
+      this.proxyReq.removeAllListeners();
+      this.proxyReq = null;
+    }
     if (!this.connected) {
       if (proxyConnectErrCause) {
         errors.throwErr(errors.ERR_PROXY_CONNECTION_FAILURE, httpsProxy, httpsProxyPort, this.atts.connectionId, proxyConnectErrCause);
@@ -260,14 +263,27 @@ class NTTCP {
    * @returns Promise
    */
   disconnect(type) {   /* Disconnect function for TCP sockets */
-    if (this.connected && !this.err) {
+    // Always tear down the socket if present, even if not yet connected
+    if (this.stream) {
       if (type == constants.NSFIMM)
         this.stream.destroy();
       else
         this.stream.end();
     }
+
+    // Tear down any in-flight proxy CONNECT request after its socket. Keep an
+    // error listener for a socket error already pending when it is destroyed.
+    if (this.proxyReq) {
+      this.proxyReq.removeAllListeners();
+      this.proxyReq.once('error', () => {});
+      this.proxyReq.destroy();
+      this.proxyReq = null;
+    }
+
     this.stream = null;
     this.connected = false;
+    this.err = this.err || (type == constants.NSFIMM);
+    this._notifyWaiters();
     this.drainWaiter = null;
     this.readWaiter = null;
   }

package/lib/thin/sqlnet/packet.js

@@ -32,6 +32,20 @@ const errors = require("../../errors.js");
 const MAX_CDATA_LEN = 230;
 const NSPCNL = 74;
 
+
+function validateAcceptDataUnits(sdu, tdu, largeSDU) {
+  const maxSdu = largeSDU ? constants.NSPABSSDULN : constants.NSPMXSDULN;
+  if (sdu < constants.NSPMNSDULN || sdu > maxSdu) {
+    const reason = `Negotiated SDU ${sdu} is outside the valid range ` +
+      `${constants.NSPMNSDULN} to ${maxSdu}`;
+    errors.throwErr(errors.ERR_INVALID_PACKET, reason);
+  }
+  if (tdu < constants.NSPMNTDULN || tdu > constants.NSPMXTDULN) {
+    const reason = `Negotiated TDU ${tdu} is outside the valid range ` +
+      `${constants.NSPMNTDULN} to ${constants.NSPMXTDULN}`;
+    errors.throwErr(errors.ERR_INVALID_PACKET, reason);
+  }
+}
 /**
  * Connect Packet (NSPTCN)
  * @param {Buffer} connectData Outgoing Connect Data
@@ -246,13 +260,16 @@ function AcceptPacket(packet, sAtts) {
   /* Set negotiated values */
   sAtts.version = packet.buf.readUInt16BE(constants.NSPACVSN);
   sAtts.options = packet.buf.readUInt16BE(constants.NSPACOPT);
-  sAtts.sdu = packet.buf.readUInt16BE(constants.NSPACSDU);
-  sAtts.tdu = packet.buf.readUInt16BE(constants.NSPACTDU);
+
+  let negotiatedSDU = packet.buf.readUInt16BE(constants.NSPACSDU);
+  let negotiatedTDU = packet.buf.readUInt16BE(constants.NSPACTDU);
+
+  sAtts.largeSDU = false;
 
   if (sAtts.version >= 315) {
     /* Large SDU Support */
-    sAtts.sdu = packet.buf.readUInt32BE(constants.NSPACLSD);
-    sAtts.tdu = packet.buf.readUInt32BE(constants.NSPACLTD);
+    negotiatedSDU = packet.buf.readUInt32BE(constants.NSPACLSD);
+    negotiatedTDU = packet.buf.readUInt32BE(constants.NSPACLTD);
     sAtts.largeSDU = true;
     this.cflag = packet.buf.readUInt8(constants.NSPACCFL); // 00001000
     if ((this.cflag & constants.NSPACCFON) != 0) { // compression ON
@@ -264,6 +281,9 @@ function AcceptPacket(packet, sAtts) {
       sAtts.networkCompressionEnabled = false;
     }
   }
+  validateAcceptDataUnits(negotiatedSDU, negotiatedTDU, sAtts.largeSDU);
+  sAtts.sdu = negotiatedSDU;
+  sAtts.tdu = negotiatedTDU;
 
   /* Accept flags */
   this.flag0 = packet.buf.readUInt8(constants.NSPACFL0);

package/lib/thin/sqlnet/sessionAtts.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -88,7 +88,7 @@ class SessionAtts {
         this.networkCompressionThreshold = parseInt(params.networkCompressionThreshold);
       }
 
-      if (typeof params.walletLocation === 'string') {
+      if (typeof params.walletLocation === 'string' && params.walletLocation.trim().toUpperCase() !== 'SYSTEM') {
         this.nt.walletFile = path.join(params.walletLocation, constants.PEM_WALLET_FILE_NAME);
       }
       if (typeof params.walletPassword === 'string') {

package/lib/thin/statement.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2024, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -363,6 +363,9 @@ class Statement {
     this.bufferRowCount = 0;
     this.pendingClear = false;
     this.statementType = constants.STMT_TYPE_UNKNOWN;
+
+    // CQN registration id attached during query registration execute.
+    this._registrationId = 0n;
   }
 
   //---------------------------------------------------------------------------
@@ -394,6 +397,7 @@ class Statement {
       }
     }
     copiedStatement.returnToCache = false;
+    copiedStatement._registrationId = this._registrationId;
     return copiedStatement;
   }
 
@@ -555,6 +559,7 @@ class Statement {
     this.numQueryVars = 0;
     this.bufferRowCount = 0;
     this.bufferRowIndex = 0;
+    this._registrationId = 0n;
   }
 
   //---------------------------------------------------------------------------

package/lib/thin/statementCache.js

@@ -32,10 +32,34 @@ class StatementCache {
   constructor(maxSize) {
     this._cachedStatements = new Map();
     this._maxSize = maxSize;
+    this._cursorsToCancel = new Set();
     this._cursorsToClose = new Set();
     this._openCursors = new Set();
   }
 
+  //---------------------------------------------------------------------------
+  // _addCursorToCancel()
+  //
+  // Add the statement's cursor to the list of cursors that need to be
+  // cancelled.
+  //---------------------------------------------------------------------------
+  _addCursorToCancel(statement) {
+    const cursorId = statement.cursorId;
+
+    if (cursorId <= 0 || !statement.isQuery || !statement.moreRowsToFetch) {
+      return;
+    }
+
+    if (this._cursorsToClose.has(cursorId)) {
+      return;
+    }
+
+    this._cursorsToCancel.add(cursorId);
+    // Keep the cached statement tracked in _openCursors so its cursor state can
+    // be invalidated if the underlying DRCP session changes.
+    statement.moreRowsToFetch = false;
+  }
+
   //---------------------------------------------------------------------------
   // _addCursorToClose()
   //
@@ -49,6 +73,8 @@ class StatementCache {
     if (statement.cursorId != 0) {
       this._cursorsToClose.add(statement.cursorId);
     }
+    // Closing the cursor supersedes a pending cancellation.
+    this._cursorsToCancel.delete(statement.cursorId);
     this._openCursors.delete(statement);
   }
 
@@ -86,6 +112,7 @@ class StatementCache {
       stmt._clearState();
     }
     this._openCursors = newOpenCursors;
+    this._cursorsToCancel.clear();
     this._cursorsToClose.clear();
   }
 
@@ -169,6 +196,7 @@ class StatementCache {
       });
     }
     if (statement.returnToCache) {
+      this._addCursorToCancel(statement);
       statement.inUse = false;
     } else {
       this._addCursorToClose(statement);
@@ -178,15 +206,15 @@ class StatementCache {
   }
 
   //---------------------------------------------------------------------------
-  // writeCursorsToClose()
-  // Write the list of cursors to close to the buffer.
+  // writeCursors()
+  // Write the specified list of cursors to the buffer and clear the list.
   //---------------------------------------------------------------------------
-  writeCursorsToClose(buf) {
-    buf.writeUB4(this._cursorsToClose.size);
-    for (const cursorNum of this._cursorsToClose.keys()) {
+  writeCursors(buf, cursors) {
+    buf.writeUB4(cursors.size);
+    for (const cursorNum of cursors) {
       buf.writeUB4(cursorNum);
     }
-    this._cursorsToClose.clear();
+    cursors.clear();
   }
 }