5 ms·
I feel like there should be a way to make a maliciously crafted database file execute arbitrary SQL... SQLite doesn't do stored procedures, but there's gotta be
by trevyn 6y ago
I feel like there should be a way to make a maliciously crafted database file execute arbitrary SQL... SQLite doesn't do stored procedures, but there's gotta be something in that surface area.
- moonchild 6y agoI expect the majority of the vulnerabilities were in the command parser. Which attack vector is gone from the database file.
- yc12340 6y agoAFAIK, SQLite stores database schema as text, so certain subset of parser still has to be invoked on untrusted DDL.
- gfody 6y agoif select is all you need then a view would suffice
- dathinab 6y ago> SQLite doesn't do stored procedures Link: https://www.sqlite.org/gencol.html https://www.sqlite.org/gencol.html Example: CREATE TABLE t1( a INTEGER PRIMARY KEY, b INT, c TEXT, d INT GENERATED ALWAYS AS (a*abs(b)) VIRTUAL, e TEXT GENERATED ALWAYS AS (substr(c,b,b+1)) STORED ); Note how you can call functions in the columns. Thats one feature which a hardened sqlite for less trusted documents would need to not have.