Repository navigation
fix: rebuild on the SQLite 3.54.1 engines with scoped native exports; release 0.3.2 - #5
Conversation
… release 0.3.2 Sync the viewer from the extension's desktop-dev-port branch at e597c1d. That branch merges extension dev, which holds the 1.8.2 release and the extension's unreleased runtime and NUL-text fixes, into the desktop port: - Both engines move from SQLite 3.51.2 (native) and 3.49.1 (WebAssembly) to 3.54.1, fixing CVE-2025-7709, CVE-2026-11822, CVE-2026-11824 and CVE-2025-6965 as described in the extension's 1.8.2 notes. - The native runtime (zknpr/txiki.js 9875455) refuses SQL-level ATTACH, DETACH and VACUUM INTO in C. Desktop exports now go through the runtime's statement-scoped vacuumInto; with the old shim, exports fail with "authorization denied" (live_export_route_end_to_end fails on the port's merge commit and passes on the pinned commit). - TEXT containing NUL is read and written whole by both engines; the grid keeps showing it as bytes. Third-party inventory and notices: txiki.js 62b02dc -> 9875455 and sql.js 424163d -> 7245c26. Their LICENSE, AUTHORS and embedded notice texts are unchanged except the sqlite3.c amalgamation header (version and check-in line), whose notice and hash are updated. viewerSource and the README pin follow e597c1d.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3745cf12c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| { | ||
| "name": "sqlite-explorer-desktop", | ||
| "version": "0.3.1", | ||
| "version": "0.3.2", |
There was a problem hiding this comment.
When this 0.3.2 release is published, the README still identifies 0.3.1 and extension 1.8.1 as current, while the package now pins the 1.8.3 desktop port. Users checking the project overview will see outdated release information; update it alongside the version bump.
Useful? React with 👍 / 👎.
Codex on c3745cf: the README still called 0.3.1 and extension 1.8.1 current.
9155464 to
be339fa
Compare
Review of the extension changes behind this release found that sql.js 7245c26 bound TEXT containing an unpaired surrogate with the wrong byte length: 'x\uD800' was stored with a NUL appended, and some values also lost their end. Desktop 0.3.2 would have shipped that in its WebAssembly engine. Sync from desktop-dev-port at b4a3341, which merges the extension fix: sql.js 35ac205 stores those values as the native engine does. The same merge gives WITHOUT ROWID rows whose key contains NUL a read-only reason that names the NUL instead of a size limit. viewer-dist: worker.js, sql-wasm.js and native/native-worker-desktop.js change; sql-wasm.wasm, viewer.html and the native runtime are identical. Inventory and notices: sql.js 7245c26 -> 35ac205 (LICENSE and AUTHORS unchanged between them), viewerSource -> b4a3341. README pin follows.
Problem
Desktop 0.3.1 bundles the SQLite Explorer 1.8.1 engines byte for byte: native SQLite 3.51.2 (txiki.js
62b02dc) and WebAssembly SQLite 3.49.1 (sql.js424163d). Both carry the SQLite CVEs fixed in the extension's 1.8.2 release: CVE-2025-7709 (FTS5, WebAssembly), CVE-2026-11822 and CVE-2026-11824 (FTS5 heap overflow with defensive mode off, both engines) and CVE-2025-6965 (WebAssembly).The new native runtime cannot simply be dropped in. It refuses SQL-level ATTACH, DETACH and VACUUM INTO in C, and the desktop shim exported with
VACUUM INTO ?, so every native export would fail with "authorization denied".Solution
viewer-dist/from the extension'sdesktop-dev-portbranch atb4a3341. That branch merges extensiondev, which holds the 1.8.2 release and the extension's unreleased runtime and text-handling fixes, into the desktop port and changes one shim function.vacuumIntonow callsbacking.vacuumInto(target), the runtime's one exception to its ATTACH refusal. It runs a fixedVACUUM main INTO ?and accepts the destination only for that statement, on the thread running it.Architecture
vacuumInto(core/native/sqljs-shim.js):exportToPath(shell route, OS save dialog) andexportAsync(sidecar temp file). The Rust shell issues no SQL. The export destination stays chosen by the shell or the sidecar, never by the webview.sync-viewerconfirms the 38 audited methods matchKNOWN_METHODSatb4a3341, sonative.rsneeds no change.Per-file changes
viewer-dist/native/tjs9875455(SQLite 3.54.1, C authorizer,vacuumInto, NUL-preserving reads), from Actions run 40021160289 and sha-pinned by the extension'srefresh-natives.mjs.viewer-dist/sql-wasm.js,viewer-dist/sql-wasm.wasm35ac205on SQLite 3.54.1: upstream #634 (TEXT read and bound by length) plus the fork's fix for the byte length #634 bound for unpaired surrogates.viewer-dist/native/native-worker-desktop.js,viewer-dist/worker.jsviewer-dist/manifest.jsonb4a3341, new per-file sha256.viewer.html, codicons andquery-plan.dylibare byte-identical to 0.3.1.third-party/inventory.json,THIRD_PARTY_NOTICES.txt62b02dc→9875455, sql.js424163d→35ac205, viewerSource →b4a3341. Every LICENSE, AUTHORS and embedded notice text is byte-identical at the new pins except thesqlite3.camalgamation header (version and Fossil check-in line). Its notice text and hash (raw header through*/, the same convention as the old entry) are updated.README.mddesktop-dev-portatb4a3341; the version paragraph names 0.3.2 and the extension's 1.8.2 release plus its unreleased fixes.package.json,package-lock.json,src-tauri/Cargo.toml,src-tauri/Cargo.lock,src-tauri/tauri.conf.jsonnpm install --package-lock-only.Not changed on purpose:
docs/extension-1.8.1-port.md,docs/linux-windows-release-qa.mdanddocs/release-readiness.mdrecord checks run againstd503473. Rewriting their pins would claim checks that have not been re-run forb4a3341.Security
ERR_NATIVE_SQL_ATTACH_BLOCKED/ERR_NATIVE_SQL_VACUUM_INTO_BLOCKED). An authorizer refusal surfaces as plain "authorization denied", becausecore/native/sqlite-errors.jshas no code for it. That is cosmetic and left for a follow-up.initializeDatabaseand exports.Review findings
package.json:3): README still calls 0.3.1 and extension 1.8.1 currentREADME.md:8,:109)desktop-v1.8.3-port, but extension 1.8.3 does not exist yetREADME.md:104,:109; c3745cf message; the port's merge commit message)desktop-dev-port. Its two commits were recreated with identical trees: the mergea0be535→13802cfwith a corrected message, and638b4ed→e597c1dwith its message unchanged on the new parent. This PR's commits were rewritten to the new name and pin: c3745cf → f7e7555, 9155464 → be339fa.7245c26binds TEXT with an unpaired surrogate usinglengthBytesUTF8, which miscounts it:'x\uD800'is stored as78EDA08000,'\uD83D中文'loses its last character and gains a NULsrc/api.js:598,:1353; reproduced against 1.8.2's glue as the control)35ac205counts the bytes the waystringToUTF8writes them and throws on a mismatch; extensiond733e63.raw_text_transport.test.tsfails on7245c26's glue and passes on35ac205's; the expected bytes are the native runtime's, measured with the bundledtjs. Synced here in ce76506.src/core/cell-containment.ts:1189,:1088)c6f49f8: the key checks use the same NUL rule as cells; the reason names the NUL and a NUL-key insert rolls back. Fails before and passes after inwithout_rowid_identity.test.ts(WASM) andnative_real_smoke.test.ts(real binary).WasmDatabaseEngine.ts:4454)tableExportStreaming.ts:291already decoded raw bytes)c6f49f8.native_real_smoke.test.tsnow covers bound NUL and lone-surrogate writes, NUL cells on a grid page and the NUL-key reason.0353db57..98754556This PR's own head branch is still
chore/viewer-1.8.3. GitHub closes a pull request whose head branch is renamed, and the squash merge does not keep the branch name.Test plan
Run on macOS aarch64 unless noted.
This PR (re-run on ce76506)
npm test: 27/27.node scripts/release/notices.mjs: inventory and notices match the release dependency graph and viewer pin.node scripts/sync-viewer.mjs --verify: 10 files verified atb4a3341.node scripts/release/version.mjs: 0.3.2 in all three manifests.cargo test --lib --locked: 138 passed, 4 ignored.cargo test --lib --locked -- --ignored: 4/4 live tests, includinglive_export_route_end_to_endandlive_sidecar_end_to_endagainst the bundledtjs.live_export_route_end_to_endfails withERR_NATIVE_EXPORT_FAILED: the sidecar export failed: Error: authorization denied. That run useda0be535, which has the same tree as13802cf; it was not repeated after the rename. Atb4a3341it passes.Extension port (
desktop-dev-portatb4a3341)npm run native-laneagainst the real binary: 78 shared fixtures, 4 errno checks, 15 fork-only checks, 20 transport checks, 108 sidecar checks and 122 method-sweep checks passed. On the first merge commit,native/export-async-roundtripfailed with "authorization denied".npm test3237/3237,npm run test:native-smoke112/112,tsc --noEmitandbuild-query-plan.mjs --checkclean.desktop/sql-wasm.jsis byte-identical to the extension'svendor/sql.js/sql-wasm.js.Extension
dev12f2572:npm test2585/2585,npm run test:native-smoke112/112,tsc --noEmitandbuild-query-plan.mjs --checkclean.e13819bon all five targets (Linux x64 and arm64, Windows x64, macOS Intel and Apple Silicon): 40,000 statements, 39,990 distinct, 0 traces on each. The seed is fixed, so this is one corpus run on five binaries.Not run
scripts/qa/) andnpm run test:gui.release.ymlbuilds the release packages.test_issue482since before these changes, which stops the run before the WASM variants. The WASM evidence above is the extension's tests on the glue this app ships.