mirror/sqlitebrowser
1
0
Fork 0
mirror of https://github.com/sqlitebrowser/sqlitebrowser.git synced 2026-01-31 08:20:09 -06:00
Code Issues Packages Projects Releases Wiki Activity

Leaving the loading of extensions enabled might be a security risk (#1558)

Browse Source 
* Leaving the loading of extensions enabled might be a security risk

Using sqlite3_enable_load_extension not only allows loading extensions
through the C-API but also through the SQL functioon load_extension().
That might be a security risk if the user is unaware that executing an
SQL file can lead to native code execution and not only to database file
modification.

See issue #1551

* Preference for allowing loading extensions from SQL code

New setting that authorizes the execution of load_extension() from SQL
code. Default value, false, following the design decision of SQLite, that
disables this function unless by default.

Added notice about the option in the calltips of the two function
variants.
This commit is contained in:
Manuel
2018-10-10 21:26:59 +02:00
committed by Martin Kleusberg
parent 16ba6db2dc
commit 5cf00ddd8d
5 changed files with 31 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/PreferencesDialog.cpp
View File

@@ -181,6 +181,7 @@ void PreferencesDialog::loadSettings()
ui->listExtensions->addItems(Settings::getValue("extensions", "list").toStringList());
ui->checkRegexDisabled->setChecked(Settings::getValue("extensions", "disableregex").toBool());
ui->checkAllowLoadExtension->setChecked(Settings::getValue("extensions", "enable_load_extension").toBool());
fillLanguageBox();
ui->toolbarStyleComboBox->setCurrentIndex(Settings::getValue("General", "toolbarStyle").toInt());
}
@@ -240,6 +241,7 @@ void PreferencesDialog::saveSettings()
extList.append(item->text());
Settings::setValue("extensions", "list", extList);
Settings::setValue("extensions", "disableregex", ui->checkRegexDisabled->isChecked());
Settings::setValue("extensions", "enable_load_extension", ui->checkAllowLoadExtension->isChecked());
// Save remote settings
Settings::setValue("remote", "active", ui->checkUseRemotes->isChecked());