* Added support for SCRAM-SHA-256-PLUS i.e. channel binding
* Requested tweaks to channel binding
* Additional tweaks to channel binding
* Fixed lint complaints
* Update packages/pg/lib/crypto/sasl.js
Co-authored-by: Charmander <~@charmander.me>
* Update packages/pg/lib/crypto/sasl.js
Co-authored-by: Charmander <~@charmander.me>
* Update packages/pg/lib/client.js
Co-authored-by: Charmander <~@charmander.me>
* Tweaks to channel binding
* Now using homegrown certificate signature algorithm identification
* Update ssl.mdx with channel binding changes
* Allow for config object being undefined when assigning enableChannelBinding
* Fixed a test failing on an updated error message
* Removed - from hash names like SHA-256 for legacy crypto (Node 14 and below)
* Removed packageManager key from package.json
* Added some SASL/channel binding unit tests
* Added a unit test for continueSession to check expected SASL session data
* Modify tests: don't require channel binding (which cannot then work) if not using SSL
---------
Co-authored-by: Charmander <~@charmander.me>
* perf(utils): fast prepareValue
This PR add a performance improvements at prepare Value for non-object by skipping useless condition
* fix: lint
* fix: case of undefined
* fix: review
* Handle bad message ordering - make it catchable. Fixes 3174
* Close client in test
* Mess w/ github action settings
* update ci config
* Remove redundant tests
* Update code to use handle error event
* Add tests for commandComplete message being out of order
* Lint fix
* Fix native tests
* Fix lint again...airport computer not my friend
* Not a native issue
* refactor: tighten up cloudflare detection
The previous approach to detecting whether to use Cloudflare's sockets was to check for missing polyfills.
But as we improve the polyfills that Wrangler can provide these checks are no longer valid.
Now we just try to use the Cloudflare API first and fallback to Node.js if those are not available.
* fixup! refactor: tighten up cloudflare detection
This feature can be used as follows:
```
client.query({ text: 'SELECT 1', queryMode: 'extended' })
```
This will force the query to be sent with parse/bind/execute even when it has no parameters and disallows multiple statements being executed. This can be useful in scenarios where you want to enforce more security & help prevent sql injection attacks...particularly by library authors.
---------
Co-authored-by: alxndrsn <alxndrsn>
Co-authored-by: Brian Carlson <brian.m.carlson@gmail.com>
Previously, if you attempted to pass an array of `Uint8Array` objects to
a prepared statement, it would render each literal numeric value of that
array.
Since `Uint8Array` (and `TypedArray` types) represent views over raw
bytes, ensure these are serialized to Postgres as a byte representation.
* Add failing test for result rows with the same column names
* Fix handling of duplicate column names in results to ensure last value is populated
Fixes handling of result rows that have the same column name duplicated in the results to ensure
that the last value is the one returned to the user. This was the old behavior but unintentionally
broken when the pre-built object optimization was added.
* Add property usePrebuiltEmptyResultObjects to Query constructor which generates pre-shaped result rows
* Remove option and test for prebuiltEmptyResultObject
* Remove errorneously added newline
* Move all logic for prebuilding objects to Result
* Move prebuilding to addFields
* Use a clone as clone-base
---------
Co-authored-by: HZ111 / Dev2 <hz111@wielick.nl>
* fix stack traces of query() to include the async context (#1762)
* rename tests so they are actually run
* conditionally only run async stack trace tests on node 16+
* add stack trace to pg-native
---------
Co-authored-by: Charmander <~@charmander.me>
* Document client.escapeIdentifier and client.escapeLiteral
Per #1978 it seems that these client APIs are undocumented. Added documentation for these functions along with some examples and relevant links.
* Fix typos in new docs
* Migrate escapeIdentifier and escapeLiteral from Client to PG
These are standalone utility functions, they do not need a client instance to function.
Changes made:
- Refactored escapeIdentifer and escapeLiteral from client class to functions in utils
- Update PG to export escapeIdentifier and escapeLiteral
- Migrated tests for Client.escapeIdentifier and Client.escapeLiteral to tests for utils
- Updated documentation, added a "utilities" page where these helpers are discussed
**note** this is a breaking change. Users who used these functions (previously undocumented) on instances of Client, or via Client.prototype.
* Export escapeIdentifier and escapeLiteral from PG
These are standalone utility functions, they should not depend on a client instance.
Changes made:
- Refactored escapeIdentifer and escapeLiteral from client class to functions in utils
- Re-exported functions on client for backwards compatibility
- Update PG to export escapeIdentifier and escapeLiteral
- Updated tests to validate the newly exported functions from both entry points
- Updated documentation, added a "utilities" page where these helpers are discussed
* Ensure escape functions work via Client.prototype
Updated changes such that escapeIdentifier and escapeLiteral are usable via the client prototype
Updated tests to check for both entry points in client
* fix: double client.end() hang
fixes https://github.com/brianc/node-postgres/issues/2716
`client.end()` will resolve early if the connection is already dead,
rather than waiting for an "end" event that will never arrive.
* fix: client.end() resolves when socket is fully closed
* Enable SASL tests in GitHub actions CI
* Add SASL test to ensure that client password is a string
* Fix SASL error handling to emit and bubble up errors
* Add informative error when SASL password is empty string
This changeset enables declaring the `stream` config value as a factory
method. Providing a much more flexible control of the socket connection.
Defining a custom `stream` config value allows the postgres driver to
support a larger variety of environments/setups such as proxy servers
and secure socket connections that are used by cloud providers such as
GCP.
Currently, usage of the `stream` config value is only viable for single
connections given that it's only possible to define a single socket
stream instance per new Client/Pool instance. By adding support to a
factory function, it becomes possible to enable usage of custom socket
streams for connection pools.
For reference, see the `mysql2` driver for MySQL (linked below) for
prior art example of this pattern.
Refs: ba15fe2570/lib/connection.js (L63-L65)
Refs: https://cloud.google.com/sql/docs/postgres/connect-overview
Signed-off-by: Ruy Adorno <ruyadorno@google.com>
Signed-off-by: Ruy Adorno <ruyadorno@google.com>
Based on the suggestion from #2078. This adds ref/unref methods to the
Connection and Client classes and then uses them to allow the process to
exit if all of the connections in the pool are idle. This behavior is
controlled by the allowExitOnIdle flag to the Pool constructor; it defaults
to the old behavior.
* pg: Re-export DatabaseError from 'pg-protocol'
Before, users would have to import DatabaseError from 'pg-protocol'. If
there are multiple versions of 'pg-protocol', you might end up using the
wrong one.
Closes#2378
* Update error-handling-tests.js
* Update query-error-handling-tests.js
Co-authored-by: Brian C <brian.m.carlson@gmail.com>
* Add sha256 SASL helper
* Rename internal createHMAC(...) to hmacSha256(...)
* Add parseAttributePairs(...) helper for SASL
* Tighten arg checks in SASL xorBuffers(...)
* Add SASL nonce check for printable chars
* Add SASL server salt and server signature base64 validation
* Add check for non-empty SASL server nonce
* Rename SASL helper to parseServerFirstMessage(...)
* Add parameter validation to SASL continueSession(...)
* Split out SASL final message parsing into parseServerFinalMessage(...)
* Fix SCRAM tests
Removes custom assert.throws(...) so that the real one from the assert package is used and
fixes the SCRAM tests to reflect the updated error messages and actual checking of errors.
Previously the custom assert.throws(...) was ignoring the error signature validation.
Move from 3 loops (prepareValue, check for buffers, write param types, write param values) to a single loop. This speeds up the insert benchmark by around 100 queries per second. Performance improvement depends on number of parameters being bound.
