3 ms·

Untrusted database file is not the same as untrusted SQL input. There are parts of the SQL engine that are exposed to malicious file manipulation (the schema i

Untrusted database file is not the same as untrusted SQL input. There are parts of the SQL engine that are exposed to malicious file manipulation (the schema is stored as SQL DDL text) but that's not arbitrary SQL input. If you want to highlight an inconsistency, this is way more worrying: > “All historical vulnerabilities reported against SQLite require at least one of these preconditions: (…) 2. The attacker can submit a maliciously crafted database file to the application that the application will then open and query. Few real-world applications meet either of these preconditions…” However, most of the rest of the page is speaking of arbitrary SQL input, not purposely broken database files.

agwa 1y ago
> There are parts of the SQL engine that are exposed to malicious file manipulation (the schema is stored as SQL DDL text) but that's not arbitrary SQL input. View and triggers can contain arbitrary SQL and can be defined by a malicious database file, though these can be disabled as described on the "Defense Against The Dark Arts" page. That leaves default column values and indexes on expressions, which can execute a limited subset of SQL. I'd be worried about certain arbitrary SQL input vulnerabilities being reachable this way.