Leaving the loading of extensions enabled might be a security risk (#… · GyPapi/sqlitebrowser@5cf00dd · GitHub
Skip to content

Commit 5cf00dd

Browse files
mgrojoMKleusberg
mgrojo
authored and
MKleusberg
committed
Leaving the loading of extensions enabled might be a security risk (sqlitebrowser#1558)
* Leaving the loading of extensions enabled might be a security risk Using sqlite3_enable_load_extension not only allows loading extensions through the C-API but also through the SQL functioon load_extension(). That might be a security risk if the user is unaware that executing an SQL file can lead to native code execution and not only to database file modification. See issue sqlitebrowser#1551 * Preference for allowing loading extensions from SQL code New setting that authorizes the execution of load_extension() from SQL code. Default value, false, following the design decision of SQLite, that disables this function unless by default. Added notice about the option in the calltips of the two function variants.
1 parent 16ba6db commit 5cf00dd

5 files changed

Lines changed: 31 additions & 9 deletions

File tree

‎src/PreferencesDialog.cpp‎

Lines changed: 2 additions & 0 deletions

‎src/PreferencesDialog.ui‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1268,6 +1268,16 @@ Can be set to 0 for disabling completion.</string>
12681268
</property>
12691269
</widget>
12701270
</item>
1271+
<item>
1272+
<widget class="QCheckBox" name="checkAllowLoadExtension">
1273+
<property name="toolTip">
1274+
<string>&lt;html&gt;&lt;head/&gt;&lt;body&gt;&lt;p&gt;SQLite provides an SQL function for loading extensions from a shared library file. Activate this if you want to use the &lt;span style=&quot; font-style:italic;&quot;&gt;load_extension()&lt;/span&gt; function from SQL code.&lt;/p&gt;&lt;p&gt;For security reasons, extension loading is turned off by default and must be enabled through this setting. You can always load extensions through the GUI, even though this option is disabled.&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;</string>
1275+
</property>
1276+
<property name="text">
1277+
<string>Allow loading extensions from SQL code</string>
1278+
</property>
1279+
</widget>
1280+
</item>
12711281
</layout>
12721282
</widget>
12731283
<widget class="QWidget" name="tabRemote">

‎src/Settings.cpp‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,10 @@ QVariant Settings::getDefaultValue(const QString& group, const QString& name)
326326
if(group == "extension" && name == "disableregex")
327327
return false;
328328

329+
// extensions/enable_load_extension?
330+
if(group == "extension" && name == "enable_load_extension")
331+
return false;
332+
329333
// PlotDock/lineType or pointShape?
330334
if(group == "PlotDock")
331335
{

‎src/SqlUiLexer.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,8 @@ void SqlUiLexer::setupAutoCompletion()
7676
<< "length" + tr("(X) For a string value X, the length(X) function returns the number of characters (not bytes) in X prior to the first NUL character.")
7777
<< "like" + tr("(X,Y) The like() function is used to implement the \"Y LIKE X\" expression.")
7878
<< "like" + tr("(X,Y,Z) The like() function is used to implement the \"Y LIKE X ESCAPE Z\" expression.")
79-
<< "load_extension" + tr("(X) The load_extension(X) function loads SQLite extensions out of the shared library file named X.")
80-
<< "load_extension" + tr("(X,Y) The load_extension(X) function loads SQLite extensions out of the shared library file named X using the entry point Y.")
79+
<< "load_extension" + tr("(X) The load_extension(X) function loads SQLite extensions out of the shared library file named X.\nUse of this function must be authorized from Preferences.")
80+
<< "load_extension" + tr("(X,Y) The load_extension(X) function loads SQLite extensions out of the shared library file named X using the entry point Y.\nUse of this function must be authorized from Preferences.")
8181
<< "lower" + tr("(X) The lower(X) function returns a copy of string X with all ASCII characters converted to lower case.")
8282
<< "ltrim" + tr("(X) ltrim(X) removes spaces from the left side of X.")
8383
<< "ltrim" + tr("(X,Y) The ltrim(X,Y) function returns a string formed by removing any and all characters that appear in Y from the left side of X.")

‎src/sqlitedb.cpp‎

Lines changed: 13 additions & 7 deletions

0 commit comments

Comments
 (0)