oracledb 7.0.1 → 26.0.0

package/lib/transformer.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2023, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2023, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -36,6 +36,12 @@ const util = require('util');
 const types = require('./types.js');
 const nodbUtil = require('./util.js');
 
+const unsupportedJsonFieldNames = new Set([
+  '__proto__',
+  'constructor',
+  'prototype'
+]);
+
 //-----------------------------------------------------------------------------
 // checkType()
 //
@@ -78,12 +84,31 @@ function checkType(info, options) {
 //-----------------------------------------------------------------------------
 // transformJsonValue()
 //
-// Returns a normalized JSON value. Scalar values are returned unchanged.
-// Arrays are returned as a new array with transformed JSON values. Objects are
-// returned as new objects with keys "fields" and "values", both of which
-// are arrays (with the value transformed to JSON values).
+// Returns a normalized JSON value. Supported scalar values are returned
+// unchanged. Arrays are returned as a new array with transformed JSON values.
+// Objects are returned as new objects with keys "fields" and "values", both of
+// which are arrays (with the value transformed to JSON values).
+// Only enumerable own object properties are included.
+// If rejectUnsupportedTypes is set, unsupported JSON values, circular
+// references, and field names are rejected.
 //-----------------------------------------------------------------------------
-function transformJsonValue(value) {
+function transformJsonValue(value, options = {}, activeValues) {
+
+  // bigInt cannot be represented in JSON and is always rejected
+  if (typeof value === 'bigint') {
+    errors.throwErr(errors.ERR_UNSUPPORTED_JSON_VALUE_TYPE, typeof value);
+  }
+
+  // reject unsupported values when requested
+  if (options.rejectUnsupportedTypes &&
+      (typeof value === 'symbol' || typeof value === 'function')) {
+    errors.throwErr(errors.ERR_UNSUPPORTED_JSON_VALUE_TYPE, typeof value);
+  }
+
+  if (options.rejectUnsupportedTypes &&
+      typeof value === 'number' && !Number.isFinite(value)) {
+    errors.throwErr(errors.ERR_NON_FINITE_JSON_NUMBER);
+  }
 
   // handle simple scalars
   if (value === undefined || value === null ||
@@ -93,15 +118,6 @@ function transformJsonValue(value) {
     value instanceof types.IntervalYM || value instanceof types.IntervalDS)
     return value;
 
-  // arrays are transformed to a new array with processed values
-  if (Array.isArray(value)) {
-    const outValue = new Array(value.length);
-    for (let i = 0; i < value.length; i++) {
-      outValue[i] = transformJsonValue(value[i]);
-    }
-    return outValue;
-  }
-
   // database objects are treated as empty objects
   if (value instanceof BaseDbObject)
     return {fields: [], values: []};
@@ -112,14 +128,41 @@ function transformJsonValue(value) {
     return value;
   }
 
+  if (options.rejectUnsupportedTypes) {
+    if (!activeValues)
+      activeValues = new Set();
+    if (activeValues.has(value))
+      errors.throwErr(errors.ERR_INVALID_PARAMETER_VALUE, 1);
+    activeValues.add(value);
+  }
+
+  // arrays are transformed to a new array with processed values
+  if (Array.isArray(value)) {
+    const outValue = new Array(value.length);
+    for (let i = 0; i < value.length; i++) {
+      outValue[i] = transformJsonValue(value[i], options, activeValues);
+    }
+    if (activeValues)
+      activeValues.delete(value);
+    return outValue;
+  }
+
   // all other objects are transformed to an object with two arrays (fields
   // and values)
   const outValue = {};
-  outValue.fields = Object.getOwnPropertyNames(value);
+  outValue.fields = Object.keys(value);
   outValue.values = new Array(outValue.fields.length);
   for (let i = 0; i < outValue.fields.length; i++) {
-    outValue.values[i] = transformJsonValue(value[outValue.fields[i]]);
+    if (options.rejectUnsupportedTypes &&
+        unsupportedJsonFieldNames.has(outValue.fields[i])) {
+      errors.throwErr(errors.ERR_UNSUPPORTED_JSON_FIELD_NAME,
+        outValue.fields[i]);
+    }
+    outValue.values[i] = transformJsonValue(value[outValue.fields[i]], options,
+      activeValues);
   }
+  if (activeValues)
+    activeValues.delete(value);
   return outValue;
 
 }

package/lib/util.js

@@ -33,6 +33,7 @@ const util = require('util');
 const types = require('./types.js');
 const constants = require('./constants.js');
 const traceHandler = require('./traceHandler.js');
+const securityContextProvider = require('./securityContextProvider.js');
 const crypto = require("crypto");
 
 const pemHeaders = [
@@ -271,6 +272,8 @@ function wrapFn(func, serialize, preventConcurrentErrorCode) {
     let connImpl;
     const traceEnabled = traceHandler.isEnabled();
     const traceContext = {fn: func, args: arguments};
+    const hook = securityContextProvider.getInvocationHook();
+    let hookState;
 
     // if concurrent operations are to be prevented, check for that now
     if (preventConcurrentErrorCode) {
@@ -295,12 +298,29 @@ function wrapFn(func, serialize, preventConcurrentErrorCode) {
       if (traceEnabled) {
         traceEnterFn.call(this, traceContext);
       }
+      if (hook?.before) {
+        // more attributes like args, sql can be passed to
+        // provider later.
+        const invocation = {
+          target: this,
+          connection: connImpl
+        };
+        hookState = await hook.before(invocation);
+      }
       result = await traceContext.fn.apply(this, arguments);
-      return result;
     } catch (err) {
       tErr = errors.transformErr(err, wrapper);
-      throw tErr;
     } finally {
+      if (hook?.after && hookState) {
+        try {
+          await hook.after(hookState);
+        } catch (err) {
+          // Preserve the operation's error if both fail.
+          if (!tErr) {
+            tErr = errors.transformErr(err, wrapper);
+          }
+        }
+      }
       if (connImpl)
         connImpl._releaseLock();
       if (preventConcurrentErrorCode) {
@@ -311,6 +331,10 @@ function wrapFn(func, serialize, preventConcurrentErrorCode) {
       }
     }
 
+    if (tErr) {
+      throw tErr;
+    }
+    return result;
   };
   if (func.name) {
     Object.defineProperty(wrapper, 'name', { value: func.name });
@@ -563,19 +587,33 @@ function isVectorValue(value) {
       === Uint8Array.prototype) || value instanceof types.SparseVector);
 }
 
-//-----------------------------------------------------------------------------
+//---------------------------------------------------------------------------
 // makeDate()
 //
-// Returns a date from the given components.
-//
-// -----------------------------------------------------------------------------
+// Creates a Date from the supplied date/time components. When useLocal is
+// true, the components are interpreted in the Node.js process local timezone.
+// Otherwise, they are interpreted using the supplied UTC offset.
+//---------------------------------------------------------------------------
 function makeDate(useLocal, year, month, day, hour, minute,
   second, fseconds, offset) {
   if (useLocal) {
     return new Date(year, month - 1, day, hour, minute, second, fseconds);
   }
-  return new Date(Date.UTC(year, month - 1, day, hour, minute, second,
-    fseconds) - offset * 60000);
+  return new Date(makeUTCDate(year, month, day, hour, minute, second,
+    fseconds).getTime() - offset * 60000);
+}
+
+//-----------------------------------------------------------------------------
+// makeUTCDate()
+//
+// Creates a UTC date without Date.UTC()'s special handling of years 0 through
+// 99, which is important when calculating historical timezone offsets.
+// -----------------------------------------------------------------------------
+function makeUTCDate(year, month, day, hour, minute, second, fseconds = 0) {
+  const date = new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  date.setUTCHours(hour, minute, second, fseconds);
+  return date;
 }
 
 //---------------------------------------------------------------------------

package/lib/version.js

@@ -29,8 +29,8 @@
 // Leave the suffix an empty string for production releases.
 
 module.exports = {
-  VERSION_MAJOR: 7,
+  VERSION_MAJOR: 26,
   VERSION_MINOR: 0,
-  VERSION_PATCH: 1,
+  VERSION_PATCH: 0,
   VERSION_SUFFIX: ''
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oracledb",
-  "version": "7.0.1",
+  "version": "26.0.0",
   "description": "A Node.js module for Oracle Database access from JavaScript and TypeScript",
   "license": "(Apache-2.0 OR UPL-1.0)",
   "homepage": "http://oracle.github.io/node-oracledb/",

package/plugins/configProviders/gcpstorage/index.js

@@ -0,0 +1,121 @@
+// Copyright (c) 2026, Oracle and/or its affiliates.
+//-----------------------------------------------------------------------------
+//
+// This software is dual-licensed to you under the Universal Permissive License
+// (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl and Apache License
+// 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose
+// either license.
+//
+// If you elect to accept the software under the Apache License, Version 2.0,
+// the following applies:
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//-----------------------------------------------------------------------------
+
+"use strict";
+
+const util = require("node:util");
+const { base } = require("../base.js");
+const oracledb = require("oracledb");
+
+let Storage;
+
+class GCPStorageProvider extends base {
+  constructor(provider_arg, urlExtendedPart) {
+    super(urlExtendedPart);
+    this.parseProviderArg(provider_arg);
+  }
+
+  init() {
+    ({ Storage } = require("@google-cloud/storage"));
+  }
+
+  parseProviderArg(providerArg) {
+    for (const entry of providerArg.split(";")) {
+      const [key, ...valueParts] = entry.split("=");
+      const value = valueParts.join("=");
+
+      if (!key || !value) {
+        throw new Error(
+          "GCP Storage Config Provider argument must use bucket=<bucket>;object=<object>;project=<project> is optional."
+        );
+      }
+
+      this._addParam(key.trim(), decodeURIComponent(value.trim()));
+    }
+
+    for (const key of ["bucket", "object"]) {
+      if (!this.paramMap.get(key)) {
+        throw new Error(
+          `GCP Storage Config Provider missing required ${key} value.`
+        );
+      }
+    }
+  }
+
+  async returnConfig() {
+    const bucket = this.paramMap.get("bucket");
+    const object = this.paramMap.get("object");
+
+    const storageOptions = {};
+    const projectId = this.paramMap.get("project");
+    if (projectId) {
+      storageOptions.projectId = projectId;
+    }
+
+    // The Storage client manages the lifecycle of its underlying connections,
+    // no explicit close is required after downloading the configuration.
+    const storage = new Storage(storageOptions);
+
+    try {
+      const [contents] = await storage
+        .bucket(bucket)
+        .file(object)
+        .download();
+      return JSON.parse(contents.toString("utf-8"));
+    } catch (e) {
+      const errmsg = util.format(
+        "Failed to retrieve or parse config from GCP Storage: %s\n%s",
+        e.message,
+        e.stack
+      );
+      throw new Error(errmsg);
+    }
+  }
+}
+
+module.exports = GCPStorageProvider;
+
+async function hookFn(args) {
+  const configProvider = new GCPStorageProvider(
+    args.provider_arg,
+    args.urlExtendedPart
+  );
+
+  try {
+    configProvider.init();
+  } catch (err) {
+    const errmsg = util.format(
+      "GCP Storage Config Provider failed to load required modules: %s\n%s",
+      err.message,
+      err.stack
+    );
+    throw new Error(errmsg);
+  }
+
+  const cfg = await configProvider.returnConfig();
+  return [cfg, null];
+}
+
+oracledb.registerConfigurationProviderHook("gcpstorage", hookFn);

package/plugins/configProviders/ociobject/index.js

@@ -87,7 +87,7 @@ class OCIProvider extends base {
       if (auth == 'OCI_INSTANCE_PRINCIPAL') {
         provider = await oci.common.InstancePrincipalsAuthenticationDetailsProviderBuilder().build();
       } else if (auth == 'OCI_RESOURCE_PRINCIPAL') {
-        provider = await new oci.common.ResourcePrincipalAuthenticationDetailsProvider.builder();
+        provider = oci.common.ResourcePrincipalAuthenticationDetailsProvider.builder();
       } else {
         const errmsg = util.format('OCI authentication failed: The authentication parameter value %s may be incorrect', auth);
         throw new Error(errmsg);

package/plugins/token/cache.js

@@ -0,0 +1,154 @@
+// Copyright (c) 2026, Oracle and/or its affiliates.
+
+//-----------------------------------------------------------------------------
+//
+// This software is dual-licensed to you under the Universal Permissive License
+// (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl and Apache License
+// 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose
+// either license.
+//
+// If you elect to accept the software under the Apache License, Version 2.0,
+// the following applies:
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Shared process-wide token-cache support for built-in token extensions.
+//-----------------------------------------------------------------------------
+'use strict';
+
+const crypto = require('crypto');
+const { ObfuscatedValue } = require('../../lib/obfuscation.js');
+
+//---------------------------------------------------------------------------
+// hashValue()
+//
+// Hash a secret before it becomes part of a process-wide cache key. A changed
+// secret gets a distinct entry without retaining plaintext credentials in a
+// Map key.
+//---------------------------------------------------------------------------
+function hashValue(value) {
+  return crypto.createHash('sha256').update(String(value)).digest('hex');
+}
+
+//---------------------------------------------------------------------------
+// TokenCache
+//
+// A process-wide bounded LRU cache with expiry-aware lookup and single-flight
+// acquisition. Cached token values are obfuscated, including object values
+// such as OCI token/private-key pairs. acquire() may be synchronous or async
+// and returns { value, validUntil }. Entries without a future validUntil are
+// returned but intentionally not cached.
+//---------------------------------------------------------------------------
+class TokenCache {
+  constructor(maxEntries) {
+    this._maxEntries = maxEntries;
+    this._entries = new Map();
+    this._inFlight = new Map();
+  }
+
+  async get(key, acquire, { enabled = true } = {}) {
+    if (enabled) {
+      const cached = this._entries.get(key);
+      if (cached?.validUntil > Date.now()) {
+        // Moving the hit to the end maintains insertion-order LRU semantics.
+        this._entries.delete(key);
+        this._entries.set(key, cached);
+        return {
+          value: restoreValue(cached.value),
+          validUntil: cached.validUntil,
+          isCacheHit: true,
+        };
+      }
+      if (cached) {
+        clearValue(cached.value);
+        this._entries.delete(key);
+      }
+    }
+
+    let request = this._inFlight.get(key);
+    if (!request) {
+      request = Promise.resolve().then(acquire).then((result) => {
+        if (enabled && result?.validUntil > Date.now()) {
+          this._evictLeastRecentlyUsed();
+          this._entries.set(key, {
+            value: protectValue(result.value),
+            validUntil: result.validUntil,
+          });
+        }
+        return result;
+      });
+      this._inFlight.set(key, request);
+    }
+    try {
+      const result = await request;
+      return {
+        value: result.value,
+        validUntil: result.validUntil,
+        isCacheHit: false,
+      };
+    } finally {
+      if (this._inFlight.get(key) === request) {
+        this._inFlight.delete(key);
+      }
+    }
+  }
+
+  _evictLeastRecentlyUsed() {
+    while (this._entries.size >= this._maxEntries) {
+      const oldestKey = this._entries.keys().next().value;
+      const oldestEntry = this._entries.get(oldestKey);
+      clearValue(oldestEntry.value);
+      this._entries.delete(oldestKey);
+    }
+  }
+}
+
+function protectValue(value) {
+  if (typeof value === 'string') {
+    return new ObfuscatedValue(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map(protectValue);
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) =>
+      [key, protectValue(entry)]));
+  }
+  return value;
+}
+
+function restoreValue(value) {
+  if (value instanceof ObfuscatedValue) {
+    return value.get();
+  }
+  if (Array.isArray(value)) {
+    return value.map(restoreValue);
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) =>
+      [key, restoreValue(entry)]));
+  }
+  return value;
+}
+
+function clearValue(value) {
+  if (value instanceof ObfuscatedValue) {
+    value.clear();
+  } else if (Array.isArray(value)) {
+    value.forEach(clearValue);
+  } else if (value && typeof value === 'object') {
+    Object.values(value).forEach(clearValue);
+  }
+}
+
+module.exports = { TokenCache, hashValue };