Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
| Comment: | Do not allow CREATE TABLE or CREATE VIEW of an object with a name that looks like a shadow table name. |
|---|---|
| Downloads: | Tarball | ZIP archive | SQL archive |
| Timelines: | family | ancestors | descendants | both | defensive-improvements |
| Files: | files | file ages | folders |
| SHA3-256: |
6aef58b629d89955f85f65191ba2be67 |
| User & Date: | drh 2019-11-16 14:15:19 |
|
2019-11-16
| ||
| 16:54 | More restrictions on changes to shadow tables when in defensive mode. (check-in: bae76a5c user: drh tags: trunk) | |
| 14:15 | Do not allow CREATE TABLE or CREATE VIEW of an object with a name that looks like a shadow table name. (Closed-Leaf check-in: 6aef58b6 user: drh tags: defensive-improvements) | |
| 13:51 | Break out the test for writable shadow tables into a separate subroutine. (check-in: 8ad34d36 user: drh tags: defensive-improvements) | |
Changes to src/build.c.
852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 .... 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139 .... 2143 2144 2145 2146 2147 2148 2149 2150 2151 2152 2153 2154 2155 2156 2157 2158 .... 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 |
){
if( sqlite3Config.bExtraSchemaChecks ){
sqlite3ErrorMsg(pParse, ""); /* corruptSchema() will supply the error */
return SQLITE_ERROR;
}
}
}else{
if( pParse->nested==0
&& 0==sqlite3StrNICmp(zName, "sqlite_", 7)
){
sqlite3ErrorMsg(pParse, "object name reserved for internal use: %s",
zName);
return SQLITE_ERROR;
}
}
return SQLITE_OK;
}
/*
** Return the PRIMARY KEY index of a table
*/
................................................................................
/*
** Return true if zName is a shadow table name in the current database
** connection.
**
** zName is temporarily modified while this routine is running, but is
** restored to its original value prior to this routine returning.
*/
static int isShadowTableName(sqlite3 *db, char *zName){
char *zTail; /* Pointer to the last "_" in zName */
Table *pTab; /* Table that zName is a shadow of */
Module *pMod; /* Module for the virtual table */
zTail = strrchr(zName, '_');
if( zTail==0 ) return 0;
*zTail = 0;
................................................................................
if( !IsVirtual(pTab) ) return 0;
pMod = (Module*)sqlite3HashFind(&db->aModule, pTab->azModuleArg[0]);
if( pMod==0 ) return 0;
if( pMod->pModule->iVersion<3 ) return 0;
if( pMod->pModule->xShadowName==0 ) return 0;
return pMod->pModule->xShadowName(zTail+1);
}
#else
# define isShadowTableName(x,y) 0
#endif /* ifndef SQLITE_OMIT_VIRTUALTABLE */
/*
** This routine is called to report the final ")" that terminates
** a CREATE TABLE statement.
**
** The table structure that other action routines have been building
................................................................................
if( pEnd==0 && pSelect==0 ){
return;
}
assert( !db->mallocFailed );
p = pParse->pNewTable;
if( p==0 ) return;
if( pSelect==0 && isShadowTableName(db, p->zName) ){
p->tabFlags |= TF_Shadow;
}
/* If the db->init.busy is 1 it means we are reading the SQL off the
** "sqlite_master" or "sqlite_temp_master" table on the disk.
** So do not write to the disk again. Extract the root page number
** for the table from the db->init.newTnum field. (The page number
|
| | > | < < | |
852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 .... 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139 2140 .... 2144 2145 2146 2147 2148 2149 2150 2151 2152 2153 2154 2155 2156 2157 .... 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 |
){
if( sqlite3Config.bExtraSchemaChecks ){
sqlite3ErrorMsg(pParse, ""); /* corruptSchema() will supply the error */
return SQLITE_ERROR;
}
}
}else{
if( (pParse->nested==0 && 0==sqlite3StrNICmp(zName, "sqlite_", 7))
|| (sqlite3ReadOnlyShadowTables(db) && sqlite3ShadowTableName(db, zName))
){
sqlite3ErrorMsg(pParse, "object name reserved for internal use: %s",
zName);
return SQLITE_ERROR;
}
}
return SQLITE_OK;
}
/*
** Return the PRIMARY KEY index of a table
*/
................................................................................
/*
** Return true if zName is a shadow table name in the current database
** connection.
**
** zName is temporarily modified while this routine is running, but is
** restored to its original value prior to this routine returning.
*/
int sqlite3ShadowTableName(sqlite3 *db, const char *zName){
char *zTail; /* Pointer to the last "_" in zName */
Table *pTab; /* Table that zName is a shadow of */
Module *pMod; /* Module for the virtual table */
zTail = strrchr(zName, '_');
if( zTail==0 ) return 0;
*zTail = 0;
................................................................................
if( !IsVirtual(pTab) ) return 0;
pMod = (Module*)sqlite3HashFind(&db->aModule, pTab->azModuleArg[0]);
if( pMod==0 ) return 0;
if( pMod->pModule->iVersion<3 ) return 0;
if( pMod->pModule->xShadowName==0 ) return 0;
return pMod->pModule->xShadowName(zTail+1);
}
#endif /* ifndef SQLITE_OMIT_VIRTUALTABLE */
/*
** This routine is called to report the final ")" that terminates
** a CREATE TABLE statement.
**
** The table structure that other action routines have been building
................................................................................
if( pEnd==0 && pSelect==0 ){
return;
}
assert( !db->mallocFailed );
p = pParse->pNewTable;
if( p==0 ) return;
if( pSelect==0 && sqlite3ShadowTableName(db, p->zName) ){
p->tabFlags |= TF_Shadow;
}
/* If the db->init.busy is 1 it means we are reading the SQL off the
** "sqlite_master" or "sqlite_temp_master" table on the disk.
** So do not write to the disk again. Extract the root page number
** for the table from the db->init.newTnum field. (The page number
|
Changes to src/sqliteInt.h.
4544 4545 4546 4547 4548 4549 4550 4551 4552 4553 4554 4555 4556 4557 |
const sqlite3_module*,
void*,
void(*)(void*)
);
# define sqlite3VtabInSync(db) ((db)->nVTrans>0 && (db)->aVTrans==0)
#endif
int sqlite3ReadOnlyShadowTables(sqlite3 *db);
int sqlite3VtabEponymousTableInit(Parse*,Module*);
void sqlite3VtabEponymousTableClear(sqlite3*,Module*);
void sqlite3VtabMakeWritable(Parse*,Table*);
void sqlite3VtabBeginParse(Parse*, Token*, Token*, Token*, int);
void sqlite3VtabFinishParse(Parse*, Token*);
void sqlite3VtabArgInit(Parse*);
void sqlite3VtabArgExtend(Parse*, Token*);
|
> > > > > |
4544 4545 4546 4547 4548 4549 4550 4551 4552 4553 4554 4555 4556 4557 4558 4559 4560 4561 4562 |
const sqlite3_module*,
void*,
void(*)(void*)
);
# define sqlite3VtabInSync(db) ((db)->nVTrans>0 && (db)->aVTrans==0)
#endif
int sqlite3ReadOnlyShadowTables(sqlite3 *db);
#ifndef SQLITE_OMIT_VIRTUALTABLE
int sqlite3ShadowTableName(sqlite3 *db, const char *zName);
#else
# define sqlite3ShadowTableName(A,B) 0
#endif
int sqlite3VtabEponymousTableInit(Parse*,Module*);
void sqlite3VtabEponymousTableClear(sqlite3*,Module*);
void sqlite3VtabMakeWritable(Parse*,Table*);
void sqlite3VtabBeginParse(Parse*, Token*, Token*, Token*, int);
void sqlite3VtabFinishParse(Parse*, Token*);
void sqlite3VtabArgInit(Parse*);
void sqlite3VtabArgExtend(Parse*, Token*);
|
Changes to test/altertab.test.
542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 |
CREATE VIRTUAL TABLE y1 USING fts3;
}
do_catchsql_test 16.10 {
INSERT INTO y1_segments VALUES(1, X'1234567890');
} {1 {table y1_segments may not be modified}}
do_catchsql_test 16.20 {
ALTER TABLE y1_segments RENAME TO abc;
} {1 {table y1_segments may not be altered}}
do_catchsql_test 16.21 {
DROP TABLE y1_segments;
} {1 {table y1_segments may not be dropped}}
do_execsql_test 16.30 {
ALTER TABLE y1 RENAME TO z1;
}
do_execsql_test 16.40 {
SELECT * FROM z1_segments;
|
| | | | | > > > > > > > > > > > > > > > > |
542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 |
CREATE VIRTUAL TABLE y1 USING fts3;
}
do_catchsql_test 16.10 {
INSERT INTO y1_segments VALUES(1, X'1234567890');
} {1 {table y1_segments may not be modified}}
do_catchsql_test 16.20 {
DROP TABLE y1_segments;
} {1 {table y1_segments may not be dropped}}
do_catchsql_test 16.20 {
ALTER TABLE y1_segments RENAME TO abc;
} {1 {table y1_segments may not be altered}}
sqlite3_db_config db DEFENSIVE 0
do_catchsql_test 16.22 {
ALTER TABLE y1_segments RENAME TO abc;
} {0 {}}
sqlite3_db_config db DEFENSIVE 1
do_catchsql_test 16.23 {
CREATE TABLE y1_segments AS SELECT * FROM abc;
} {1 {object name reserved for internal use: y1_segments}}
do_catchsql_test 16.24 {
CREATE VIEW y1_segments AS SELECT * FROM abc;
} {1 {object name reserved for internal use: y1_segments}}
sqlite3_db_config db DEFENSIVE 0
do_catchsql_test 16.25 {
ALTER TABLE abc RENAME TO y1_segments;
} {0 {}}
sqlite3_db_config db DEFENSIVE 1
do_execsql_test 16.30 {
ALTER TABLE y1 RENAME TO z1;
}
do_execsql_test 16.40 {
SELECT * FROM z1_segments;
|