web_plsql 0.17.1 → 1.0.0

package/src/handler/plsql/procedure.js

@@ -9,13 +9,13 @@ import oracledb from 'oracledb';
 import stream from 'node:stream';
 import z from 'zod';
 
-import {streamToBuffer} from './stream.js';
 import {uploadFile} from './upload.js';
 import {getProcedureVariable} from './procedureVariable.js';
 import {getProcedureNamed} from './procedureNamed.js';
 import {parsePage} from './parsePage.js';
 import {sendResponse} from './sendResponse.js';
 import {ProcedureError} from './procedureError.js';
+import {RequestError} from './requestError.js';
 import {inspect, getBlock} from '../../util/trace.js';
 import {errorToString} from '../../util/errorToString.js';
 import {sanitizeProcName} from './procedureSanitize.js';
@@ -30,6 +30,8 @@ import {sanitizeProcName} from './procedureSanitize.js';
  * @typedef {import('../../types.js').environmentType} environmentType
  * @typedef {import('../../types.js').configPlSqlHandlerType} configPlSqlHandlerType
  * @typedef {import('../../types.js').BindParameterConfig} BindParameterConfig
+ * @typedef {import('../../util/cache.js').Cache<string>} ProcedureNameCache
+ * @typedef {import('../../util/cache.js').Cache<import('./procedureNamed.js').argsType>} ArgumentCache
  */
 
 /**
@@ -39,9 +41,11 @@ import {sanitizeProcName} from './procedureSanitize.js';
  *	@param {argObjType} argObj - The arguments to pass to the procedure
  *	@param {configPlSqlHandlerType} options - The options for the middleware
  *	@param {Connection} databaseConnection - The database connection
- *	@returns {Promise<{sql: string; bind: BindParameterConfig}>} - The SQL statement and bindings for the procedure to execute
+ *	@param {ProcedureNameCache} procedureNameCache - The procedure name cache.
+ *	@param {ArgumentCache} argumentCache - The argument cache.
+ *	@returns {Promise<{sql: string; bind: BindParameterConfig; resolvedName?: string}>} - The SQL statement and bindings for the procedure to execute
  */
-const getProcedure = async (req, procName, argObj, options, databaseConnection) => {
+const getProcedure = async (req, procName, argObj, options, databaseConnection, procedureNameCache, argumentCache) => {
 	// path alias
 	if (options.pathAlias?.toLowerCase() === procName.toLowerCase()) {
 		debug(`getProcedure: path alias "${options.pathAlias}" redirects to "${options.pathAliasProcedure}"`);
@@ -57,13 +61,20 @@ const getProcedure = async (req, procName, argObj, options, databaseConnection)
 	const useVariableArguments = procName.startsWith('!');
 
 	// sanitize procedure name
-	const sanitizedProcName = await sanitizeProcName(useVariableArguments ? procName.substring(1) : procName, databaseConnection, options);
+	const rawName = useVariableArguments ? procName.substring(1) : procName;
+	const sanitizedProcName = await sanitizeProcName(rawName, databaseConnection, options, procedureNameCache);
 
 	// run procedure
 	if (useVariableArguments) {
-		return getProcedureVariable(req, sanitizedProcName, argObj);
+		return {
+			...getProcedureVariable(req, sanitizedProcName, argObj),
+			resolvedName: sanitizedProcName,
+		};
 	} else {
-		return await getProcedureNamed(req, sanitizedProcName, argObj, databaseConnection);
+		return {
+			...(await getProcedureNamed(req, sanitizedProcName, argObj, databaseConnection, argumentCache)),
+			resolvedName: sanitizedProcName,
+		};
 	}
 };
 
@@ -123,11 +134,11 @@ const procedureExecute = async (para, databaseConnection) => {
 /**
  * Get page from procedure
  *
- * @param {boolean} test - Test.
+ * @param {boolean} _test - Test.
  * @param {Connection} databaseConnection - Database connection.
  * @returns {Promise<string>} Promise resolving to the returned page content.
  */
-const procedureGetPage = async (test, databaseConnection) => {
+const procedureGetPage = async (_test, databaseConnection) => {
 	const MAX_IROWS = 100000;
 
 	/** @type {BindParameterConfig} */
@@ -154,7 +165,7 @@ const procedureGetPage = async (test, databaseConnection) => {
 
 	// Make sure that we have retrieved all the rows
 	if (irows > MAX_IROWS) {
-		/* istanbul ignore next */
+		/* v8 ignore next - defensive check for row limit */
 		throw new ProcedureError(`procedureGetPage: error when retrieving rows. irows="${irows}"`, {}, sqlStatement, bindParameter);
 	}
 
@@ -230,9 +241,11 @@ END;
  * @param {fileUploadType[]} filesToUpload - Array of files to be uploaded
  * @param {configPlSqlHandlerType} options - the options for the middleware.
  * @param {Connection} databaseConnection - Database connection.
+ * @param {ProcedureNameCache} procedureNameCache - The procedure name cache.
+ * @param {ArgumentCache} argumentCache - The argument cache.
  * @returns {Promise<void>} Promise resolving to the page content generated by the executed procedure
  */
-export const invokeProcedure = async (req, res, argObj, cgiObj, filesToUpload, options, databaseConnection) => {
+export const invokeProcedure = async (req, res, argObj, cgiObj, filesToUpload, options, databaseConnection, procedureNameCache, argumentCache) => {
 	debug('invokeProcedure: begin');
 
 	// 1) upload files
@@ -250,7 +263,12 @@ export const invokeProcedure = async (req, res, argObj, cgiObj, filesToUpload, o
 	// 2) get procedure to execute and the arguments
 
 	debug('invokeProcedure: get procedure to execute and the arguments');
-	const para = await getProcedure(req, Array.isArray(req.params.name) ? req.params.name[0] : req.params.name, argObj, options, databaseConnection);
+	// Extract the raw procedure name from params
+	const rawProcName = Array.isArray(req.params.name) ? req.params.name[0] : req.params.name;
+	if (!rawProcName) {
+		throw new RequestError('No procedure name provided');
+	}
+	const para = await getProcedure(req, rawProcName, argObj, options, databaseConnection, procedureNameCache, argumentCache);
 
 	// 3) prepare the session
 
@@ -260,7 +278,34 @@ export const invokeProcedure = async (req, res, argObj, cgiObj, filesToUpload, o
 	// 4) execute the procedure
 
 	debug('invokeProcedure: execute the session');
-	await procedureExecute(para, databaseConnection);
+	try {
+		await procedureExecute(para, databaseConnection);
+	} catch (err) {
+		// Invalidation Logic
+		if (err instanceof ProcedureError) {
+			const errorString = err.toString();
+			// Check for ORA-04068, ORA-04061, ORA-04065, ORA-06550
+			if (
+				errorString.includes('ORA-04068') ||
+				errorString.includes('ORA-04061') ||
+				errorString.includes('ORA-04065') ||
+				errorString.includes('ORA-06550')
+			) {
+				debug(`invokeProcedure: detected invalidation error (${errorString}). Clearing caches.`);
+
+				// Clear name resolution cache for the input name
+				if (rawProcName) {
+					procedureNameCache.delete(rawProcName);
+				}
+
+				// Clear argument cache for the resolved name
+				if (para.resolvedName) {
+					argumentCache.delete(para.resolvedName.toUpperCase());
+				}
+			}
+		}
+		throw err;
+	}
 
 	// 5) get the page returned from the procedure
 
@@ -274,35 +319,38 @@ export const invokeProcedure = async (req, res, argObj, cgiObj, filesToUpload, o
 
 	debug('invokeProcedure: download files');
 	const fileBlob = await databaseConnection.createLob(oracledb.BLOB);
-	const fileDownload = await procedureDownloadFiles(fileBlob, databaseConnection);
-	if (debug.enabled) {
-		debug(getBlock('fileDownload', inspect({fileType: fileDownload.fileType, fileSize: fileDownload.fileSize})));
-	}
 
-	// 7) parse the page
+	try {
+		const fileDownload = await procedureDownloadFiles(fileBlob, databaseConnection);
+		if (debug.enabled) {
+			debug(getBlock('fileDownload', inspect({fileType: fileDownload.fileType, fileSize: fileDownload.fileSize})));
+		}
 
-	debug('invokeProcedure: parse the page');
-	const pageComponents = parsePage(lines);
+		// 7) parse the page
 
-	// add "Server" header
-	pageComponents.head.server = cgiObj.SERVER_SOFTWARE;
+		debug('invokeProcedure: parse the page');
+		const pageComponents = parsePage(lines);
 
-	// add file download information
-	if (fileDownload.fileType !== '' && fileDownload.fileSize > 0 && fileDownload.fileBlob !== null) {
-		pageComponents.file.fileType = fileDownload.fileType;
-		pageComponents.file.fileSize = fileDownload.fileSize;
-		pageComponents.file.fileBlob = await streamToBuffer(fileDownload.fileBlob);
-	}
+		// add "Server" header
+		pageComponents.head.server = cgiObj.SERVER_SOFTWARE ?? '';
 
-	// 8) send the page to browser
+		// add file download information
+		if (fileDownload.fileType !== '' && fileDownload.fileSize > 0 && fileDownload.fileBlob !== null) {
+			pageComponents.file.fileType = fileDownload.fileType;
+			pageComponents.file.fileSize = fileDownload.fileSize;
+			pageComponents.file.fileBlob = fileDownload.fileBlob;
+		}
 
-	debug('invokeProcedure: send the page to browser');
-	sendResponse(req, res, pageComponents);
+		// 8) send the page to browser
 
-	// 9) cleanup
+		debug('invokeProcedure: send the page to browser');
+		await sendResponse(req, res, pageComponents);
+	} finally {
+		// 9) cleanup
 
-	debug('invokeProcedure: cleanup');
-	fileBlob.destroy();
+		debug('invokeProcedure: cleanup');
+		fileBlob.destroy();
+	}
 
 	debug('invokeProcedure: end');
 };

package/src/handler/plsql/procedureNamed.js

@@ -21,7 +21,7 @@ import {toTable, warningMessage} from '../../util/trace.js';
  * @typedef {import('../../types.js').BindParameterConfig} BindParameterConfig
  * @typedef {import('../../types.js').BindParameter} BindParameter
  * @typedef {Record<string, string>} argsType
- * @typedef {{hitCount: number, args: argsType}} cacheEntryType
+ * @typedef {import('../../util/cache.js').Cache<argsType>} ArgumentCache
  */
 
 const SQL_GET_ARGUMENT = [
@@ -60,11 +60,6 @@ const DATA_TYPES = Object.freeze({
 	//	REF CURSOR
 });
 
-// NOTE: Consider using a separate cache for each database pool to avoid possible conflicts.
-/** @type {Map<string, cacheEntryType>} */
-const ARGS_CACHE = new Map();
-const ARGS_CACHE_MAX_COUNT = 10000;
-
 /**
  *	Retrieve the argument types for a given procedure to be executed.
  *	This is important because if the procedure is defined to take a PL/SQL indexed table,
@@ -89,9 +84,7 @@ const loadArguments = async (procedure, databaseConnection) => {
 		result = await databaseConnection.execute(SQL_GET_ARGUMENT, bind);
 	} catch (err) {
 		debug('result', result);
-		/* istanbul ignore next */
 		const message = `Error when retrieving arguments\n${SQL_GET_ARGUMENT}\n${errorToString(err)}`;
-		/* istanbul ignore next */
 		throw new RequestError(message);
 	}
 
@@ -106,75 +99,47 @@ const loadArguments = async (procedure, databaseConnection) => {
 			.parse(result.outBinds);
 	} catch (err) {
 		debug('result.outBinds', result.outBinds);
-		/* istanbul ignore next */
 		const message = `Error when decoding arguments\n${SQL_GET_ARGUMENT}\n${errorToString(err)}`;
-		/* istanbul ignore next */
 		throw new RequestError(message);
 	}
 
 	if (data.names.length !== data.types.length) {
-		/* istanbul ignore next */
 		throw new RequestError('Error when decoding arguments. The number of names and types does not match');
 	}
 
 	/** @type {Record<string, string>} */
 	const argTypes = {};
 	for (let i = 0; i < data.names.length; i++) {
-		argTypes[data.names[i].toLowerCase()] = data.types[i];
+		const name = data.names[i];
+		const type = data.types[i];
+		if (name && type) {
+			argTypes[name.toLowerCase()] = type;
+		}
 	}
 
 	return argTypes;
 };
 
-/**
- *	Remove the cache entries with the lowest hitCount.
- *	@param {number} count - Number of entries to remove
- *	@returns {void}
- */
-const removeLowestHitCountEntries = (count) => {
-	// Convert cache entries to an array
-	const entries = Array.from(ARGS_CACHE.entries());
-
-	// Sort entries by hitCount in ascending order
-	entries.sort((a, b) => a[1].hitCount - b[1].hitCount);
-
-	// Get the keys of the `count` entries with the lowest hitCount
-	const keysToRemove = entries.slice(0, count).map(([key]) => key);
-
-	// Remove these entries from the cache
-	for (const key of keysToRemove) {
-		ARGS_CACHE.delete(key);
-	}
-};
-
 /**
  *	Find the argument types for a given procedure to be executed.
  *	As the arguments are cached, we first look up the cache and only if not yet available we load them.
  *	@param {string} procedure - The procedure
  *	@param {Connection} databaseConnection - The database connection
+ *	@param {ArgumentCache} argumentCache - The argument cache.
  *	@returns {Promise<argsType>} - The argument types
  */
-const findArguments = async (procedure, databaseConnection) => {
+const findArguments = async (procedure, databaseConnection, argumentCache) => {
 	const key = procedure.toUpperCase();
 
 	// lookup in the cache
-	const cacheEntry = ARGS_CACHE.get(key);
-
-	// if we fount the procedure in the cache, we increase the hit cound and return
-	if (cacheEntry) {
-		cacheEntry.hitCount++;
-		if (debug.enabled) {
-			debug(`findArguments: procedure "${procedure}" found in cache with "${cacheEntry.hitCount}" hits`);
-		}
-		return cacheEntry.args;
-	}
+	const cachedArgs = argumentCache.get(key);
 
-	// if the cache is full, we remove the 1000 least used cache entries
-	if (ARGS_CACHE.size > ARGS_CACHE_MAX_COUNT) {
+	// if we found the procedure in the cache, we return it
+	if (cachedArgs) {
 		if (debug.enabled) {
-			debug(`findArguments: cache is full. size=${ARGS_CACHE.size} max=${ARGS_CACHE_MAX_COUNT}`);
+			debug(`findArguments: procedure "${procedure}" found in cache`);
 		}
-		removeLowestHitCountEntries(1000);
+		return cachedArgs;
 	}
 
 	// load from database
@@ -184,7 +149,7 @@ const findArguments = async (procedure, databaseConnection) => {
 	const args = await loadArguments(procedure, databaseConnection);
 
 	// add to the cache
-	ARGS_CACHE.set(key, {hitCount: 0, args});
+	argumentCache.set(key, args);
 
 	return args;
 };
@@ -243,7 +208,7 @@ export const getBinding = (argName, argValue, argType) => {
  */
 const inspectBindings = (argObj, argTypes) => {
 	const rows = Object.entries(argObj).map(([key, value]) => {
-		return [key, value.toString(), typeof value, argTypes[key.toLowerCase()]];
+		return [key, value.toString(), typeof value, argTypes[key.toLowerCase()] ?? 'unknown'];
 	});
 
 	const {text} = toTable(['id', 'value', 'value type', 'argument type'], rows);
@@ -257,13 +222,14 @@ const inspectBindings = (argObj, argTypes) => {
  *	@param {string} procName - The procedure to execute
  *	@param {argObjType} argObj - The arguments to pass to the procedure
  *	@param {Connection} databaseConnection - The database connection
+ *	@param {ArgumentCache} argumentCache - The argument cache.
  *	@returns {Promise<{sql: string; bind: BindParameterConfig}>} - The SQL statement and bindings for the procedure to execute
  */
-export const getProcedureNamed = async (req, procName, argObj, databaseConnection) => {
+export const getProcedureNamed = async (req, procName, argObj, databaseConnection, argumentCache) => {
 	debug(`getProcedureNamed: ${procName} arguments=`, argObj);
 
 	// get the types of the arguments
-	const argTypes = await findArguments(procName, databaseConnection);
+	const argTypes = await findArguments(procName, databaseConnection, argumentCache);
 
 	/** @type {string[]} */
 	const sqlParameter = [];

package/src/handler/plsql/procedureSanitize.js

@@ -16,17 +16,90 @@ import {errorToString} from '../../util/errorToString.js';
  * @typedef {import('../../types.js').environmentType} environmentType
  * @typedef {import('../../types.js').configPlSqlHandlerType} configPlSqlHandlerType
  * @typedef {import('../../types.js').BindParameterConfig} BindParameterConfig
+ * @typedef {import('../../util/cache.js').Cache<string>} ProcedureNameCache
  */
 
 const DEFAULT_EXCLUSION_LIST = ['sys.', 'dbms_', 'utl_', 'owa_', 'htp.', 'htf.', 'wpg_docload.', 'ctxsys.', 'mdsys.'];
 
-// NOTE: Consider using a separate cache for each database pool to avoid possible conflicts.
+import {Cache} from '../../util/cache.js';
+/** @type {Cache<{valid: boolean}>} */
+const validationFunctionCache = new Cache();
+
 /**
- * @typedef {{hitCount: number, valid: boolean}} cacheEntryType
+ * Resolve the procedure name using dbms_utility.name_resolve.
+ *
+ * @param {string} procName - The procedure name to resolve.
+ * @param {Connection} databaseConnection - The database connection.
+ * @param {ProcedureNameCache} procedureNameCache - The procedure name cache.
+ * @returns {Promise<string>} - The resolved canonical procedure name (SCHEMA.NAME).
  */
-/** @type {Map<string, cacheEntryType>} */
-const REQUEST_VALIDATION_FUNCTION_CACHE = new Map();
-const REQUEST_VALIDATION_FUNCTION_CACHE_MAX_COUNT = 10000;
+const resolveProcedureName = async (procName, databaseConnection, procedureNameCache) => {
+	// Check cache
+	const cachedName = procedureNameCache.get(procName);
+	if (cachedName) {
+		debug(`resolveProcedureName: Cache hit for "${procName}" -> "${cachedName}"`);
+		return cachedName;
+	}
+
+	debug(`resolveProcedureName: Cache miss for "${procName}". Resolving in DB...`);
+
+	const sql = `
+		DECLARE
+			l_schema VARCHAR2(128);
+			l_part1  VARCHAR2(128);
+			l_part2  VARCHAR2(128);
+			l_dblink VARCHAR2(128);
+			l_part1_type NUMBER;
+			l_object_number NUMBER;
+		BEGIN
+			dbms_utility.name_resolve(
+				name => :name,
+				context => 1,
+				schema => l_schema,
+				part1 => l_part1,
+				part2 => l_part2,
+				dblink => l_dblink,
+				part1_type => l_part1_type,
+				object_number => l_object_number
+			);
+			
+			-- Reconstruct the canonical name
+			-- If it's a package procedure: schema.package.procedure
+			-- If it's a standalone procedure: schema.procedure
+			
+			IF l_part1 IS NOT NULL THEN
+				:resolved := l_schema || '.' || l_part1 || '.' || l_part2;
+			ELSE
+				:resolved := l_schema || '.' || l_part2;
+			END IF;
+		END;
+	`;
+
+	const bind = {
+		name: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: procName},
+		resolved: {dir: oracledb.BIND_OUT, type: oracledb.STRING, maxSize: 400},
+	};
+
+	try {
+		const result = await databaseConnection.execute(sql, bind);
+		const {resolved} = z.object({resolved: z.string()}).parse(result.outBinds);
+
+		if (!resolved) {
+			throw new RequestError(`Could not resolve procedure name "${procName}"`);
+		}
+
+		debug(`resolveProcedureName: Resolved "${procName}" -> "${resolved}"`);
+
+		// Update cache
+		procedureNameCache.set(procName, resolved);
+
+		return resolved;
+	} catch (err) {
+		debug(`resolveProcedureName: Error resolving "${procName}"`, err);
+		// Rethrow as RequestError to indicate 404/403
+		throw new RequestError(`Procedure "${procName}" not found or not accessible.\n${errorToString(err)}`);
+	}
+};
 
 /**
  * Sanitize the procedure name.
@@ -34,15 +107,16 @@ const REQUEST_VALIDATION_FUNCTION_CACHE_MAX_COUNT = 10000;
  * @param {string} procName - The procedure name.
  * @param {Connection} databaseConnection - The database connection
  * @param {configPlSqlHandlerType} options - the options for the middleware.
+ * @param {ProcedureNameCache} procedureNameCache - The procedure name cache.
  * @returns {Promise<string>} Promise resolving to final procedure name.
  */
-export const sanitizeProcName = async (procName, databaseConnection, options) => {
+export const sanitizeProcName = async (procName, databaseConnection, options, procedureNameCache) => {
 	debug('sanitizeProcName', procName);
 
 	// make lowercase and trim
 	let finalProcName = procName.toLowerCase().trim();
 
-	// remove special characters
+	// remove special characters (basic sanity check before DB call)
 	finalProcName = removeSpecialCharacters(finalProcName);
 
 	// check for default exclusions
@@ -67,6 +141,10 @@ export const sanitizeProcName = async (procName, databaseConnection, options) =>
 
 	// Check request validation function
 	if (options.requestValidationFunction && options.requestValidationFunction.length > 0) {
+		// Note: We might want to scope this cache too, but for now let's focus on the procedure name cache.
+		// The original code used a global cache for this.
+		// For strict correctness, we should probably verify the *resolved* name,
+		// but legacy behavior checks the input name.
 		const valid = await requestValidationFunction(finalProcName, options.requestValidationFunction, databaseConnection);
 		if (!valid) {
 			const error = `Procedure name "${procName}" is not valid according to the request validation function "${options.requestValidationFunction}"`;
@@ -75,7 +153,11 @@ export const sanitizeProcName = async (procName, databaseConnection, options) =>
 		}
 	}
 
-	return finalProcName;
+	// NEW: Resolve the procedure name against the database
+	// This prevents SQL injection and ensures the procedure exists
+	const resolvedName = await resolveProcedureName(finalProcName, databaseConnection, procedureNameCache);
+
+	return resolvedName;
 };
 
 /**
@@ -128,9 +210,7 @@ const loadRequestValid = async (procName, requestValidationFunction, databaseCon
 		result = await databaseConnection.execute(SQL, bind);
 	} catch (err) {
 		debug('result', result);
-		/* istanbul ignore next */
 		const message = `Error when validating procedure name "${procName}"\n${SQL}\n${errorToString(err)}`;
-		/* istanbul ignore next */
 		throw new RequestError(message);
 	}
 
@@ -139,34 +219,11 @@ const loadRequestValid = async (procName, requestValidationFunction, databaseCon
 		return data.valid === 1;
 	} catch (err) {
 		debug('result', result.outBinds);
-		/* istanbul ignore next */
 		const message = `Internal error when parsing ${result.outBinds}\n${errorToString(err)}`;
-		/* istanbul ignore next */
 		throw new Error(message);
 	}
 };
 
-/**
- *	Remove the cache entries with the lowest hitCount.
- *	@param {number} count - Number of entries to remove
- *	@returns {void}
- */
-const removeLowestHitCountEntries = (count) => {
-	// Convert cache entries to an array
-	const entries = Array.from(REQUEST_VALIDATION_FUNCTION_CACHE.entries());
-
-	// Sort entries by hitCount in ascending order
-	entries.sort((a, b) => a[1].hitCount - b[1].hitCount);
-
-	// Get the keys of the `count` entries with the lowest hitCount
-	const keysToRemove = entries.slice(0, count).map(([key]) => key);
-
-	// Remove these entries from the cache
-	for (const key of keysToRemove) {
-		REQUEST_VALIDATION_FUNCTION_CACHE.delete(key);
-	}
-};
-
 /**
  * Request validation function.
  *
@@ -179,37 +236,27 @@ const requestValidationFunction = async (procName, requestValidationFunction, da
 	debug('requestValidationFunction', procName, requestValidationFunction);
 
 	// calculate the key
-	//const key = `${databaseConnection.connectString}_${databaseConnection.user}_${procName.toLowerCase()}`;
 	const key = procName.toLowerCase();
 
 	// lookup in the cache
-	const cacheEntry = REQUEST_VALIDATION_FUNCTION_CACHE.get(key);
+	const cacheEntry = validationFunctionCache.get(key);
 
-	// if we fount the procedure in the cache, we increase the hit cound and return
-	if (cacheEntry) {
-		cacheEntry.hitCount++;
+	// if we found the procedure in the cache, we return it (hitCount already incremented by get)
+	if (cacheEntry !== undefined) {
 		if (debug.enabled) {
-			debug(`findArguments: procedure "${procName}" found in cache with "${cacheEntry.hitCount}" hits`);
+			debug(`requestValidationFunction: procedure "${procName}" found in cache`);
 		}
 		return cacheEntry.valid;
 	}
 
-	// if the cache is full, we remove the 1000 least used cache entries
-	if (REQUEST_VALIDATION_FUNCTION_CACHE.size > REQUEST_VALIDATION_FUNCTION_CACHE_MAX_COUNT) {
-		if (debug.enabled) {
-			debug(`findArguments: cache is full. size=${REQUEST_VALIDATION_FUNCTION_CACHE.size} max=${REQUEST_VALIDATION_FUNCTION_CACHE_MAX_COUNT}`);
-		}
-		removeLowestHitCountEntries(1000);
-	}
-
 	// load from database
 	if (debug.enabled) {
-		debug(`findArguments: procedure "${procName}" not found in cache and must be loaded`);
+		debug(`requestValidationFunction: procedure "${procName}" not found in cache and must be loaded`);
 	}
 	const valid = await loadRequestValid(procName, requestValidationFunction, databaseConnection);
 
 	// add to the cache
-	REQUEST_VALIDATION_FUNCTION_CACHE.set(key, {hitCount: 0, valid});
+	validationFunctionCache.set(key, {valid});
 
 	return valid;
 };

package/src/handler/plsql/procedureVariable.js

@@ -18,12 +18,12 @@ import oracledb from 'oracledb';
 
 /**
  *	Get the sql statement and bindings for the procedure to execute for a variable number of arguments
- *	@param {Request} req - The req object represents the HTTP request. (only used for debugging)
+ *	@param {Request} _req - The req object represents the HTTP request. (only used for debugging)
  *	@param {string} procName - The procedure to execute
  *	@param {argObjType} argObj - The arguments to pass to the procedure
  *	@returns {{sql: string; bind: BindParameterConfig}} - The SQL statement and bindings for the procedure to execute
  */
-export const getProcedureVariable = (req, procName, argObj) => {
+export const getProcedureVariable = (_req, procName, argObj) => {
 	if (debug.enabled) {
 		debug(`getProcedureVariable: ${procName} arguments=`, argObj);
 	}

package/src/handler/plsql/request.js

@@ -19,6 +19,8 @@ import {isStringOrArrayOfString} from '../../util/type.js';
  * @typedef {import('oracledb').Connection} Connection
  * @typedef {import('../../types.js').argObjType} argObjType
  * @typedef {import('../../types.js').configPlSqlHandlerType} configPlSqlHandlerType
+ * @typedef {import('../../util/cache.js').Cache<string>} ProcedureNameCache
+ * @typedef {import('../../util/cache.js').Cache<import('./procedureNamed.js').argsType>} ArgumentCache
  */
 
 /**
@@ -28,9 +30,11 @@ import {isStringOrArrayOfString} from '../../util/type.js';
  * @param {Response} res - The res object represents the HTTP response that an Express app sends when it gets an HTTP request.
  * @param {configPlSqlHandlerType} options - the options for the middleware.
  * @param {Pool} connectionPool - The connection pool.
+ * @param {ProcedureNameCache} procedureNameCache - The procedure name cache.
+ * @param {ArgumentCache} argumentCache - The argument cache.
  * @returns {Promise<void>} - Promise resolving to th page
  */
-export const processRequest = async (req, res, options, connectionPool) => {
+export const processRequest = async (req, res, options, connectionPool, procedureNameCache, argumentCache) => {
 	debug('processRequest: ENTER');
 
 	//
@@ -65,7 +69,7 @@ export const processRequest = async (req, res, options, connectionPool) => {
 	debug('processRequest: argObj=', argObj);
 
 	// invoke the Oracle procedure and get the page contenst
-	await invokeProcedure(req, res, argObj, cgiObj, filesToUpload, options, connection);
+	await invokeProcedure(req, res, argObj, cgiObj, filesToUpload, options, connection, procedureNameCache, argumentCache);
 
 	// transaction mode
 	if (options.transactionMode === 'rollback') {
@@ -73,7 +77,8 @@ export const processRequest = async (req, res, options, connectionPool) => {
 		await connection.rollback();
 	} else if (typeof options.transactionMode === 'function') {
 		debug('transactionMode: callback');
-		const result = options.transactionMode(connection, Array.isArray(req.params.name) ? req.params.name[0] : req.params.name);
+		const procName = Array.isArray(req.params.name) ? req.params.name[0] : req.params.name;
+		const result = options.transactionMode(connection, procName ?? '');
 		debug('transactionMode: callback restult', result);
 		if (result && typeof result.then === 'function') {
 			await result;
@@ -98,16 +103,16 @@ const normalizeBody = (req) => {
 	/** @type {Record<string, string | string[]>} */
 	const args = {};
 
-	/* istanbul ignore else */
+	/* v8 ignore else - body validation */
 	if (typeof req.body === 'object' && req.body !== null) {
 		for (const key in req.body) {
 			// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
 			const value = req.body[key];
-			/* istanbul ignore else */
+			/* v8 ignore else - type validation */
 			if (isStringOrArrayOfString(value)) {
 				args[key] = value;
 			} else {
-				/* istanbul ignore next */
+				/* v8 ignore next - invalid body type */
 				throw new RequestError(
 					`The element "${key}" in the body is not a string or an array of strings!\n${util.inspect(req.body, {showHidden: false, depth: null, colors: false})}`,
 				);