Nia Crawl: Ex8 PR Draft

.copyrightconfig

@@ -11,4 +11,4 @@ startyear: 2015
 #   - Dotfiles already skipped automatically
 # Enable by removing the leading '# ' from the next line and editing values.
 # filesexcluded: third_party/*, docs/generated/*.md, assets/*.png, scripts/temp_*.py, vendor/lib.js
-filesexcluded: .github/*, README.md, Jenkinsfile, test-app/*, *.md, docker-compose.yaml, test-complete-app-mlDeploy/*, *.json, *.sh
+filesexcluded: .github/*, README.md, Jenkinsfile, test-app/*, *.md, docker-compose.yaml, test-complete-app-mlDeploy/*, *.json, *.sh, CODEOWNERS

.npmrc

@@ -1 +1,6 @@
 engine-strict=true
+registry=https://pkg.harness.io/pkg/ct8onj8YTdaXtKaFsYCRLg/org-marklogic-npm/npm/
+@jsr:registry=https://pkg.harness.io/pkg/ct8onj8YTdaXtKaFsYCRLg/org-marklogic-npm/npm/
+ignore-scripts=true
+# cooldown in days (14 days)
+min-release-age=14

CODEOWNERS

@@ -2,5 +2,4 @@
 # Each line is a file pattern followed by one or more owners.
 
 # These owners will be the default owners for everything in the repo.
-* @anu3990 @billfarber @rjrudin @stevebio
-
+* @rjrudin @jonmille @ngodugu-marklogic @RitaChen609 @rjdew-progress

Jenkinsfile

@@ -55,7 +55,7 @@ def runAuditReport() {
 		cd node-client-api
 		npm ci
 		rm -rf $WORKSPACE/npm-audit-report.json || true
-		npm audit --audit-level=moderate --json > $WORKSPACE/npm-audit-report.json
+		npm audit --audit-level=moderate --json > $WORKSPACE/npm-audit-report.json || true
 	'''
 }
 
@@ -125,7 +125,7 @@ pipeline {
   agent none
 
   triggers {
-    parameterizedCron(env.BRANCH_NAME == "develop" ? "00 02 * * * % regressions=true" : "")
+    parameterizedCron(env.BRANCH_NAME == "develop" ? "00 05 * * * % regressions=true" : "")
   }
 
   parameters {
@@ -151,6 +151,7 @@ pipeline {
     stage('pull-request-tests') {
       agent { label 'nodeclientpool' }
       steps {
+        // npm audit is non-blocking; Harness Artifact Repository does not currently support it so failures are ignored.
         runAuditReport()
         runLint()
         runTypeCheck()

eslint.config.js

@@ -61,7 +61,24 @@ module.exports = [
       "no-console": "off",
 
       // Bracket notation preference
-      "dot-notation": "error"
+      "dot-notation": "error",
+
+      // Security: Prevent MD5 imports outside www-authenticate-patched/ (Issue #1109)
+      "no-restricted-modules": ["error", {
+        "paths": [{
+          "name": "./lib/www-authenticate-patched/md5",
+          "message": "⚠️  SECURITY: Do not import MD5 from www-authenticate-patched. This is ONLY for HTTP Digest Auth (RFC 2617). Use bcrypt/scrypt/Argon2id for passwords, SHA-256/SHA-3 for general hashing."
+        }, {
+          "name": "./lib/www-authenticate-patched/md5.js",
+          "message": "⚠️  SECURITY: Do not import MD5 from www-authenticate-patched. This is ONLY for HTTP Digest Auth (RFC 2617). Use bcrypt/scrypt/Argon2id for passwords, SHA-256/SHA-3 for general hashing."
+        }, {
+          "name": "lib/www-authenticate-patched/md5",
+          "message": "⚠️  SECURITY: Do not import MD5 from www-authenticate-patched. This is ONLY for HTTP Digest Auth (RFC 2617). Use bcrypt/scrypt/Argon2id for passwords, SHA-256/SHA-3 for general hashing."
+        }, {
+          "name": "lib/www-authenticate-patched/md5.js",
+          "message": "⚠️  SECURITY: Do not import MD5 from www-authenticate-patched. This is ONLY for HTTP Digest Auth (RFC 2617). Use bcrypt/scrypt/Argon2id for passwords, SHA-256/SHA-3 for general hashing."
+        }]
+      }]
     }
   },
   {

etc/test-setup-users.js

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
 var valcheck = require('core-util-is');
 
@@ -68,6 +68,16 @@ function setupUsers(manager, done) {
             'privilege-name': 'xdmp-get-session-field',
             action: 'http://marklogic.com/xdmp/privileges/xdmp-get-session-field',
             kind: 'execute'
+          },
+          {
+            'privilege-name': 'xdmp-lock-acquire',
+            action: 'http://marklogic.com/xdmp/privileges/xdmp-lock-acquire',
+            kind: 'execute'
+          },
+          {
+            'privilege-name': 'xdmp-lock-release',
+            action: 'http://marklogic.com/xdmp/privileges/xdmp-lock-release',
+            kind: 'execute'
           }
         ]
       }

lib/extlibs.js

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
 'use strict';
 const requester = require('./requester.js');
@@ -33,6 +33,49 @@ function emptyOutputTransform(/*headers, data*/) {
   };
 }
 
+/**
+ * Safely encodes a caller-supplied extension library path for use in a REST
+ * request URL. Each path segment is encoded individually with
+ * encodeURIComponent(), preventing path-separator injection (CWE-22) and
+ * query-parameter injection (CWE-20). Any leading /v1/ext/, /ext/, or bare /
+ * prefix is stripped before splitting so that all three accepted input forms
+ * (bare name, /path/name, /ext/path/name) produce the same canonical output.
+ *
+ * @param {string}  rawPath       - caller-supplied path or directory
+ * @param {boolean} trailingSlash - when true, appends a trailing '/' (used by list())
+ * @returns {string} the encoded path beginning with /v1/ext/
+ * @throws  {Error}  if any segment equals '..' or '.'
+ * @ignore
+ */
+function encodeExtPath(rawPath, trailingSlash) {
+  if (typeof rawPath !== 'string' && !(rawPath instanceof String)) {
+    throw new Error('extension library path must be a string');
+  }
+
+  // Require a leading '/' before stripping any prefix so that undocumented
+  // bare forms like 'ext/module.xqy' are treated as literal path segments
+  // rather than silently having their 'ext/' prefix removed.
+  const stripped = rawPath
+    .replace(/^\/(?:(?:v1\/)?ext\/)?/, '')
+    .replace(/\/$/, '');
+
+  const segments = stripped.length === 0 ? [] : stripped.split('/');
+
+  for (const seg of segments) {
+    if (seg === '..' || seg === '.') {
+      throw new Error(
+        'extension library path must not contain relative path components (".", ".."): ' + rawPath
+      );
+    }
+  }
+
+  // Build the result using a conditional join so that an empty segment list
+  // does not produce a double slash (e.g. '/v1/ext//' for list('/ext/')).
+  const encodedSegments = segments.map(s => encodeURIComponent(s));
+  const base = '/v1/ext' + (encodedSegments.length > 0 ? '/' + encodedSegments.join('/') : '');
+  return base + (trailingSlash ? '/' : '');
+}
+
 /** @ignore */
 function ExtLibs(client) {
   if (!(this instanceof ExtLibs)) {
@@ -56,11 +99,7 @@ ExtLibs.prototype.read = function readExtensionLibrary(path) {
 
   const requestOptions = mlutil.copyProperties(this.client.getConnectionParams());
   requestOptions.method = 'GET';
-  requestOptions.path = encodeURI(
-      (path.substr(0,5) === '/ext/') ? ('/v1'+path)     :
-      (path.substr(0,1) === '/')     ? ('/v1/ext'+path) :
-      ('/v1/ext/'+path)
-      );
+  requestOptions.path = encodeExtPath(path);
 
   const operation = new Operation(
       'read extension library', this.client, requestOptions, 'empty', 'single'
@@ -127,15 +166,13 @@ ExtLibs.prototype.write = function writeExtensionLibrary() {
     throw new Error('must specify the path, content type, and source when writing a extension library');
   }
 
-  let endpoint =
-      (path.substr(0,5) === '/ext/') ? ('/v1'+path)     :
-      (path.substr(0,1) === '/')     ? ('/v1/ext'+path) :
-      ('/v1/ext/'+path);
+  const encodedPath = encodeExtPath(path);
 
+  let queryString = '';
   if (Array.isArray(permissions)) {
     let role = null;
     let capabilities = null;
-    let j=null;
+    let j = null;
     for (i=0; i < permissions.length; i++) {
       arg = permissions[i];
       role = arg['role-name'];
@@ -144,7 +181,8 @@ ExtLibs.prototype.write = function writeExtensionLibrary() {
         throw new Error('cannot set permissions from '+JSON.stringify(arg));
       }
       for (j=0; j < capabilities.length; j++) {
-        endpoint += ((i === 0 && j=== 0) ? '?' : '&') + 'perm:'+role+'='+capabilities[j];
+        queryString += ((queryString.length === 0) ? '?' : '&') +
+          'perm:' + encodeURIComponent(role) + '=' + encodeURIComponent(capabilities[j]);
       }
     }
   }
@@ -154,7 +192,7 @@ ExtLibs.prototype.write = function writeExtensionLibrary() {
   requestOptions.headers = {
       'Content-Type': contentType
   };
-  requestOptions.path = encodeURI(endpoint);
+  requestOptions.path = encodedPath + queryString;
 
   const operation = new Operation(
       'write extension library', this.client, requestOptions, 'single', 'empty'
@@ -180,11 +218,7 @@ ExtLibs.prototype.remove = function removeExtensionLibrary(path) {
 
   const requestOptions = mlutil.copyProperties(this.client.getConnectionParams());
   requestOptions.method = 'DELETE';
-  requestOptions.path = encodeURI(
-    (path.substr(0,5) === '/ext/') ? ('/v1'+path)     :
-    (path.substr(0,1) === '/')     ? ('/v1/ext'+path) :
-    ('/v1/ext/'+path)
-    );
+  requestOptions.path = encodeExtPath(path);
 
   const operation = new Operation(
       'remove extension library', this.client, requestOptions, 'empty', 'empty'
@@ -215,24 +249,8 @@ ExtLibs.prototype.list = function listExtensionLibraries(directory) {
 
   if (typeof directory !== 'string' && !(directory instanceof String)) {
     requestOptions.path = '/v1/ext';
-  } else if (directory.substr(0,5) === '/ext/') {
-    if (directory.substr(-1,1) === '/') {
-      requestOptions.path = encodeURI(directory);
-    } else {
-      requestOptions.path = encodeURI(directory+'/');
-    }
   } else {
-    const hasInitialSlash  = (directory.substr(0,1)  === '/');
-    const hasTrailingSlash = (directory.substr(-1,1) === '/');
-    if (hasInitialSlash && hasTrailingSlash) {
-      requestOptions.path = encodeURI('/v1/ext'  + directory);
-    } else if (hasTrailingSlash) {
-      requestOptions.path = encodeURI('/v1/ext/' + directory);
-    } else if (hasInitialSlash) {
-      requestOptions.path = encodeURI('/v1/ext'  + directory+'/');
-    } else {
-      requestOptions.path = encodeURI('/v1/ext/' + directory+'/');
-    }
+    requestOptions.path = encodeExtPath(directory, true);
   }
 
   const operation = new Operation(

lib/marklogic.js

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
 'use strict';
 const http                 = require('http');
@@ -716,6 +716,7 @@ function initClient(client, inputParams) {
   if(inputParams.authType && inputParams.authType.toString().toLowerCase() === 'cloud' && !isSSL){
     isSSL = true;
   }
+
   const keys = ['host', 'port', 'database', 'user', 'password', 'authType', 'token', 'basePath','apiKey','accessTokenDuration',
   'enableGzippedResponses', 'oauthToken'];
   if(isSSL) {
@@ -738,6 +739,9 @@ function initClient(client, inputParams) {
   connectionParams.lookup = prefLookup;
 
   const authType = connectionParams.authType.toUpperCase();
+  if (authType === 'BASIC' && !isSSL) {
+    console.warn('Authentication type is BASIC and SSL is not enabled. This may expose credentials.');
+  }
   if ((authType === 'DIGEST' || authType === 'BASIC') &&
        ((connectionParams.user == null) || (connectionParams.password == null))) {
     throw new Error('cannot create client without user or password for '+
@@ -761,6 +765,10 @@ function initClient(client, inputParams) {
     if(!connectionParams.apiKey) {
       throw new Error('apiKey needed for MarkLogic cloud authentication.');
     }
+    if (connectionParams.accessTokenDuration !== undefined &&
+        (!Number.isInteger(connectionParams.accessTokenDuration) || connectionParams.accessTokenDuration <= 0)) {
+      throw new Error('accessTokenDuration must be a positive integer.');
+    }
     connectionParams.port = 443;
   } else if(authType === 'OAUTH' && !connectionParams.oauthToken){
     throw new Error('oauthToken required for OAuth authentication. ');

lib/plan-builder-base.js

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
 'use strict';
 
@@ -58,8 +58,18 @@ function castArg(arg, funcName, paramName, argPos, paramTypes) {
     } else if (arg instanceof Number || arg instanceof Boolean || arg instanceof String) {
       arg = arg.valueOf();
     } else if (arg instanceof types.ServerType) {
+      // We added new VecVector ServerType which is not a sub-type of Item. This makes it a one-off type
+      // as paramTypes will not include VecVector in any other type checks.
+      // And if we get here the arg must be and only be a VecVector (arg._ns === 'vec') or we throw an Error      
       if(arg._ns === 'vec'){
-        return arg._args;
+        return arg;
+      }
+      // cts.param() is a valid placeholder wherever a cts.query is accepted (e.g. as a direct
+      // sub-query argument to cts.orQuery, cts.andQuery, cts.notQuery, etc.).
+      // Serialisation already works: exportObject converts _ns/_fn/_args -> ns/fn/args.
+      if (arg._ns === 'cts' && arg._fn === 'param' &&
+          paramTypes.includes(types.CtsQuery)) {
+        return arg;
       }
       throw new Error(
         `${argLabel(funcName, paramName, argPos)} must have type ${typeLabel(paramTypes)}`
@@ -133,6 +143,13 @@ function castArg(arg, funcName, paramName, argPos, paramTypes) {
             throw new Error(
                 'bm25LengthWeight must be a number'
             );
+          case 'fragment':
+            if (['document', 'properties', 'locks', 'any'].includes(value)) {
+              return true;
+            }
+            throw new Error(
+                `${argLabel(funcName, paramName, argPos)} fragment can only be 'document', 'properties', 'locks', or 'any'`
+            );
           default:
             return false;
         }});
@@ -401,6 +418,26 @@ function castArg(arg, funcName, paramName, argPos, paramTypes) {
             });
           }
           return true;
+        case 'PlanTransitiveClosureOptions':
+          const planTransitiveClosureOptionsSet = new Set(['minLength', 'min-length', 'maxLength', 'max-length']);
+          if(Object.getPrototypeOf(arg) === Map.prototype){
+            arg.forEach((value, key) => {
+              if(!planTransitiveClosureOptionsSet.has(key)) {
+                throw new Error(
+                    `${argLabel(funcName, paramName, argPos)} has invalid key- ${key}`
+                );
+              }
+            });
+          } else if (typeof arg === 'object') {
+            Object.keys(arg).forEach(key => {
+              if(!planTransitiveClosureOptionsSet.has(key)) {
+                throw new Error(
+                    `${argLabel(funcName, paramName, argPos)} has invalid key- ${key}`
+                );
+              }
+            });
+          }
+          return true;
       default:
         return false;
       }