Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Do not allow parameters or schema references inside of WITH clause of triggers and views. This fixes a bug discovered by OSSFuzz and present since common-table-expressions were first added in 2014-02-03. |
|---|---|
| Downloads: | Tarball | ZIP archive | SQL archive |
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA3-256: |
b918d4b4e546d3903ff20efc3c8ca26d |
| User & Date: | drh 2018-02-15 21:00:37 |
Context
|
2018-02-17
| ||
| 07:38 | Fix a data race causing a tsan complaint with SQLITE_ENABLE_API_ARMOR builds on unix. The race condition is not dangerous in practice, it just upsets tsan. (check-in: f53b8a57 user: dan tags: trunk) | |
|
2018-02-15
| ||
| 21:00 | Do not allow parameters or schema references inside of WITH clause of triggers and views. This fixes a bug discovered by OSSFuzz and present since common-table-expressions were first added in 2014-02-03. (check-in: b918d4b4 user: drh tags: trunk) | |
| 03:56 | Improve performance of editdist3() by keeping the costs in sorted order. Also add a new regression test to editdist3(). (check-in: dc734c5b user: drh tags: trunk) | |
Changes
Changes to src/attach.c.
| ︙ | ︙ | |||
500 501 502 503 504 505 506 507 508 509 510 511 512 513 |
}
if( sqlite3FixExprList(pFix, pSelect->pOrderBy) ){
return 1;
}
if( sqlite3FixExpr(pFix, pSelect->pLimit) ){
return 1;
}
pSelect = pSelect->pPrior;
}
return 0;
}
int sqlite3FixExpr(
DbFixer *pFix, /* Context of the fixation */
Expr *pExpr /* The expression to be fixed to one database */
| > > > > > > > > > > | 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 |
}
if( sqlite3FixExprList(pFix, pSelect->pOrderBy) ){
return 1;
}
if( sqlite3FixExpr(pFix, pSelect->pLimit) ){
return 1;
}
#if 1
if( pSelect->pWith ){
int i;
for(i=0; i<pSelect->pWith->nCte; i++){
if( sqlite3FixSelect(pFix, pSelect->pWith->a[i].pSelect) ){
return 1;
}
}
}
#endif
pSelect = pSelect->pPrior;
}
return 0;
}
int sqlite3FixExpr(
DbFixer *pFix, /* Context of the fixation */
Expr *pExpr /* The expression to be fixed to one database */
|
| ︙ | ︙ |
Added test/with4.test.
> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 |
# 2018-02-15
#
# The author disclaims copyright to this source code. In place of
# a legal notice, here is a blessing:
#
# May you do good and not evil.
# May you find forgiveness for yourself and forgive others.
# May you share freely, never taking more than you give.
#
#***********************************************************************
# This file implements regression tests for SQLite library. The
# focus of this file is testing the WITH clause in TRIGGERs and VIEWs.
#
set testdir [file dirname $argv0]
source $testdir/tester.tcl
set ::testprefix with4
ifcapable {!cte} {
finish_test
return
}
do_execsql_test 100 {
ATTACH ':memory:' AS aux;
CREATE TABLE main.t1(a,b);
CREATE TABLE aux.t2(x,y);
INSERT INTO t1 VALUES(1,2);
INSERT INTO t2 VALUES(3,4);
} {}
do_catchsql_test 110 {
CREATE VIEW v1 AS SELECT * FROM t1, aux.t2;
} {1 {view v1 cannot reference objects in database aux}}
do_catchsql_test 120 {
CREATE VIEW v2 AS WITH v(m,n) AS (SELECT x,y FROM aux.t2) SELECT * FROM t1, v;
} {1 {view v2 cannot reference objects in database aux}}
do_catchsql_test 130 {
CREATE VIEW v2 AS WITH v(m,n) AS (SELECT 5,?2) SELECT * FROM t1, v;
} {1 {parameters are not allowed in views}}
do_catchsql_test 200 {
CREATE TRIGGER r1 AFTER INSERT ON t1 BEGIN
WITH v(m,n) AS (SELECT x,y FROM aux.t2) SELECT * FROM t1, v;
END;
} {1 {trigger r1 cannot reference objects in database aux}}
do_catchsql_test 210 {
CREATE TRIGGER r1 AFTER INSERT ON t1 BEGIN
WITH v(m,n) AS (SELECT 5,?2) SELECT * FROM t1, v;
END;
} {1 {trigger cannot use variables}}
finish_test
|