Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
Comment: | Do not allow parameters or schema references inside of WITH clause of triggers and views. This fixes a bug discovered by OSSFuzz and present since common-table-expressions were first added in 2014-02-03. |
---|---|
Downloads: | Tarball | ZIP archive | SQL archive |
Timelines: | family | ancestors | descendants | both | trunk |
Files: | files | file ages | folders |
SHA3-256: |
b918d4b4e546d3903ff20efc3c8ca26d |
User & Date: | drh 2018-02-15 21:00:37 |
Context
2018-02-17
| ||
07:38 | Fix a data race causing a tsan complaint with SQLITE_ENABLE_API_ARMOR builds on unix. The race condition is not dangerous in practice, it just upsets tsan. (check-in: f53b8a57 user: dan tags: trunk) | |
2018-02-15
| ||
21:00 | Do not allow parameters or schema references inside of WITH clause of triggers and views. This fixes a bug discovered by OSSFuzz and present since common-table-expressions were first added in 2014-02-03. (check-in: b918d4b4 user: drh tags: trunk) | |
03:56 | Improve performance of editdist3() by keeping the costs in sorted order. Also add a new regression test to editdist3(). (check-in: dc734c5b user: drh tags: trunk) | |
Changes
Changes to src/attach.c.
︙ | ︙ | |||
500 501 502 503 504 505 506 507 508 509 510 511 512 513 | } if( sqlite3FixExprList(pFix, pSelect->pOrderBy) ){ return 1; } if( sqlite3FixExpr(pFix, pSelect->pLimit) ){ return 1; } pSelect = pSelect->pPrior; } return 0; } int sqlite3FixExpr( DbFixer *pFix, /* Context of the fixation */ Expr *pExpr /* The expression to be fixed to one database */ | > > > > > > > > > > | 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 | } if( sqlite3FixExprList(pFix, pSelect->pOrderBy) ){ return 1; } if( sqlite3FixExpr(pFix, pSelect->pLimit) ){ return 1; } #if 1 if( pSelect->pWith ){ int i; for(i=0; i<pSelect->pWith->nCte; i++){ if( sqlite3FixSelect(pFix, pSelect->pWith->a[i].pSelect) ){ return 1; } } } #endif pSelect = pSelect->pPrior; } return 0; } int sqlite3FixExpr( DbFixer *pFix, /* Context of the fixation */ Expr *pExpr /* The expression to be fixed to one database */ |
︙ | ︙ |
Added test/with4.test.
> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 | # 2018-02-15 # # The author disclaims copyright to this source code. In place of # a legal notice, here is a blessing: # # May you do good and not evil. # May you find forgiveness for yourself and forgive others. # May you share freely, never taking more than you give. # #*********************************************************************** # This file implements regression tests for SQLite library. The # focus of this file is testing the WITH clause in TRIGGERs and VIEWs. # set testdir [file dirname $argv0] source $testdir/tester.tcl set ::testprefix with4 ifcapable {!cte} { finish_test return } do_execsql_test 100 { ATTACH ':memory:' AS aux; CREATE TABLE main.t1(a,b); CREATE TABLE aux.t2(x,y); INSERT INTO t1 VALUES(1,2); INSERT INTO t2 VALUES(3,4); } {} do_catchsql_test 110 { CREATE VIEW v1 AS SELECT * FROM t1, aux.t2; } {1 {view v1 cannot reference objects in database aux}} do_catchsql_test 120 { CREATE VIEW v2 AS WITH v(m,n) AS (SELECT x,y FROM aux.t2) SELECT * FROM t1, v; } {1 {view v2 cannot reference objects in database aux}} do_catchsql_test 130 { CREATE VIEW v2 AS WITH v(m,n) AS (SELECT 5,?2) SELECT * FROM t1, v; } {1 {parameters are not allowed in views}} do_catchsql_test 200 { CREATE TRIGGER r1 AFTER INSERT ON t1 BEGIN WITH v(m,n) AS (SELECT x,y FROM aux.t2) SELECT * FROM t1, v; END; } {1 {trigger r1 cannot reference objects in database aux}} do_catchsql_test 210 { CREATE TRIGGER r1 AFTER INSERT ON t1 BEGIN WITH v(m,n) AS (SELECT 5,?2) SELECT * FROM t1, v; END; } {1 {trigger cannot use variables}} finish_test |