/ Check-in [b918d4b4]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Do not allow parameters or schema references inside of WITH clause of triggers and views. This fixes a bug discovered by OSSFuzz and present since common-table-expressions were first added in 2014-02-03.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: b918d4b4e546d3903ff20efc3c8ca26dd9761cc8ed9ef7d2799b66ff9ae1ae51
User & Date: drh 2018-02-15 21:00:37
Context
2018-02-17
07:38
Fix a data race causing a tsan complaint with SQLITE_ENABLE_API_ARMOR builds on unix. The race condition is not dangerous in practice, it just upsets tsan. check-in: f53b8a57 user: dan tags: trunk
2018-02-15
21:00
Do not allow parameters or schema references inside of WITH clause of triggers and views. This fixes a bug discovered by OSSFuzz and present since common-table-expressions were first added in 2014-02-03. check-in: b918d4b4 user: drh tags: trunk
03:56
Improve performance of editdist3() by keeping the costs in sorted order. Also add a new regression test to editdist3(). check-in: dc734c5b user: drh tags: trunk
Changes
Hide Diffs Side-by-Side Diffs Ignore Whitespace Patch

Changes to src/attach.c.

   500    500       }
   501    501       if( sqlite3FixExprList(pFix, pSelect->pOrderBy) ){
   502    502         return 1;
   503    503       }
   504    504       if( sqlite3FixExpr(pFix, pSelect->pLimit) ){
   505    505         return 1;
   506    506       }
          507  +#if 1
          508  +    if( pSelect->pWith ){
          509  +      int i;
          510  +      for(i=0; i<pSelect->pWith->nCte; i++){
          511  +        if( sqlite3FixSelect(pFix, pSelect->pWith->a[i].pSelect) ){
          512  +          return 1;
          513  +        }
          514  +      }
          515  +    }
          516  +#endif
   507    517       pSelect = pSelect->pPrior;
   508    518     }
   509    519     return 0;
   510    520   }
   511    521   int sqlite3FixExpr(
   512    522     DbFixer *pFix,     /* Context of the fixation */
   513    523     Expr *pExpr        /* The expression to be fixed to one database */

Added test/with4.test.

            1  +# 2018-02-15
            2  +#
            3  +# The author disclaims copyright to this source code.  In place of
            4  +# a legal notice, here is a blessing:
            5  +#
            6  +#    May you do good and not evil.
            7  +#    May you find forgiveness for yourself and forgive others.
            8  +#    May you share freely, never taking more than you give.
            9  +#
           10  +#***********************************************************************
           11  +# This file implements regression tests for SQLite library.  The
           12  +# focus of this file is testing the WITH clause in TRIGGERs and VIEWs.
           13  +#
           14  +
           15  +set testdir [file dirname $argv0]
           16  +source $testdir/tester.tcl
           17  +set ::testprefix with4
           18  +
           19  +ifcapable {!cte} {
           20  +  finish_test
           21  +  return
           22  +}
           23  +
           24  +do_execsql_test 100 {
           25  +  ATTACH ':memory:' AS aux;
           26  +  CREATE TABLE main.t1(a,b);
           27  +  CREATE TABLE aux.t2(x,y);
           28  +  INSERT INTO t1 VALUES(1,2);
           29  +  INSERT INTO t2 VALUES(3,4);
           30  +} {}
           31  +do_catchsql_test 110 {
           32  +  CREATE VIEW v1 AS SELECT * FROM t1, aux.t2;
           33  +} {1 {view v1 cannot reference objects in database aux}}
           34  +do_catchsql_test 120 {
           35  +  CREATE VIEW v2 AS WITH v(m,n) AS (SELECT x,y FROM aux.t2) SELECT * FROM t1, v;
           36  +} {1 {view v2 cannot reference objects in database aux}}
           37  +do_catchsql_test 130 {
           38  +  CREATE VIEW v2 AS WITH v(m,n) AS (SELECT 5,?2) SELECT * FROM t1, v;
           39  +} {1 {parameters are not allowed in views}}
           40  +
           41  +do_catchsql_test 200 {
           42  +  CREATE TRIGGER r1 AFTER INSERT ON t1 BEGIN
           43  +     WITH v(m,n) AS (SELECT x,y FROM aux.t2) SELECT * FROM t1, v;
           44  +  END;
           45  +} {1 {trigger r1 cannot reference objects in database aux}}
           46  +do_catchsql_test 210 {
           47  +  CREATE TRIGGER r1 AFTER INSERT ON t1 BEGIN
           48  +     WITH v(m,n) AS (SELECT 5,?2) SELECT * FROM t1, v;
           49  +  END;
           50  +} {1 {trigger cannot use variables}}
           51  +
           52  +finish_test