4 ms·

WebSQL literally just had a remote code execution bug showing exactly why it was right that browsers decided against WebSQL https://blade.tencent.com/magellan/

• Klathmon 8y ago
  Specifically SQLite had a remote code execution bug, and since all browsers that shipped WebSQL used SQLite as the backing engine, they all inherited the vulnerability and exposed it to all web-pages out there.
  • detaro 8y ago
    And WebSQL was more or less specified to be backed by SQLite, given its "specification" for the SQL used was "whatever SQLite x.y.z implements" (which was one of the reasons it was rejected)
• tzs 8y ago
  Uhm...all major browsers have a long history of remote code execution bugs, and almost certainly still have remote code execution bugs that aren't publicly known yet. Heck, even if we just consider databases, the IndexedDB implementations in both Firefox and Chrome have had remote memory corruption bugs of the type that are often exploitable for remote code execution, although I don't know if anyone ever actually built such an exploit.
  • daleharvey 8y ago
    They all have different remote code execution bugs so those bugs can and should be fixed. The reason to not standardise on a specific single implementation is to make sure those bugs do not become part of the web platform