What If OpenDocument Used SQLite? (2014)

Re:What If OpenDocument Used SQLite? (2014) by trevyn on Friday December 18, 2020 @12:18AM (#25464140)

I feel like there should be a way to make a maliciously crafted database file execute arbitrary SQL... SQLite doesn't do stored procedures, but there's gotta be something in that surface area.

[ Parent | on HN ]

Re:What If OpenDocument Used SQLite? (2014) by dathinab on Friday December 18, 2020 @09:59AM (#25467689)

> SQLite doesn't do stored procedures

Link: https://www.sqlite.org/gencol.html

Example:

CREATE TABLE t1(

   a INTEGER PRIMARY KEY,

   b INT,

   c TEXT,

   d INT GENERATED ALWAYS AS (a*abs(b)) VIRTUAL,

   e TEXT GENERATED ALWAYS AS (substr(c,b,b+1)) STORED

);

Note how you can call functions in the columns. Thats one feature which a hardened sqlite for less trusted documents would need to not have.

[ Parent | on HN ]

Re:What If OpenDocument Used SQLite? (2014) by moonchild on Friday December 18, 2020 @12:52AM (#25464292)

I expect the majority of the vulnerabilities were in the command parser. Which attack vector is gone from the database file.

[ Parent | on HN ]

Re:What If OpenDocument Used SQLite? (2014) by yc12340 on Friday December 18, 2020 @03:00AM (#25464882)

AFAIK, SQLite stores database schema as text, so certain subset of parser still has to be invoked on untrusted DDL.

[ Parent | on HN ]

Re:What If OpenDocument Used SQLite? (2014) by gfody on Friday December 18, 2020 @12:41AM (#25464238)

if select is all you need then a view would suffice

[ Parent | on HN ]