[mcollina]

Enforce the permission model for node:sqlite file access.

• open() checks --allow-fs-read for read-only databases, and read plus write for read-write ones. In-memory databases are exempt.
• When permissions are enabled, connections use a VFS shim that checks every file SQLite opens: ATTACH targets, backup destinations, and journal, WAL and SHM files. A database grant also covers its own sidecar files.
• URI vfs= parameters are rejected, so a connection cannot switch to an unchecked VFS.

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg
• @nodejs/sqlite

[codecov]

Codecov Report

❌ Patch coverage is 64.71519% with 223 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.63%. Comparing base (91c4436) to head (8da255e).
⚠️ Report is 133 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_sqlite_vfs.cc	62.03%	144 Missing and 61 partials ⚠️
src/node_sqlite.cc	82.43%	5 Missing and 8 partials ⚠️
src/permission/permission.cc	57.14%	0 Missing and 3 partials ⚠️
src/permission/permission_base.h	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #62957      +/-   ##
==========================================
- Coverage   92.93%   90.63%   -2.30%     
==========================================
  Files         428      799     +371     
  Lines      195236   279515   +84279     
  Branches    30176    53770   +23594     
==========================================
+ Hits       181442   253347   +71905     
- Misses      13467    16462    +2995     
- Partials      327     9706    +9379     

Files with missing lines	Coverage Δ
src/node_sqlite.h	87.93% <100.00%> (ø)
src/node_sqlite_vfs.h	100.00% <100.00%> (ø)
src/permission/fs_permission.cc	76.63% <100.00%> (ø)
src/permission/fs_permission.h	92.55% <ø> (ø)
src/permission/permission.h	100.00% <ø> (ø)
src/permission/permission_base.h	33.33% <0.00%> (ø)
src/permission/permission.cc	74.50% <57.14%> (ø)
src/node_sqlite.cc	82.56% <82.43%> (ø)
src/node_sqlite_vfs.cc	62.03% <62.03%> (ø)

... and 506 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[RafaelGSS]

As long as it doesn't open precedence for reports targeting SQLite on permission model, I'm +1.

[louwers]

Hmm, I think this needs to take into account https://sqlite.org/uri.html

• A database can be opened read-only with mode=ro or immutable=1.
• Another way to create an in-memory database is with mode=memory.

Doing more string processing on the database path sounds a bit hacky though.

Edit: looks like we have not enabled SQLITE_USE_URI=1, but it would be good to leave a comment here that this needs to be updated when we do at the very least.

As long as it doesn't open precedence for reports targeting SQLite on permission model, I'm +1.

Passing a custom VFS to SQLite that can really prevent reads/writes might be a more comprehensive solution worth considering...

[mcollina]

Passing a custom VFS to SQLite that can really prevent reads/writes might be a more comprehensive solution worth considering...

https://sqlite.org/vfs.html sounds really cool! I will take a look.

[trivikr]

@mcollina This needs a rebase, and the first commit needs to be signed.

[araujogui]

@nodejs/sqlite I rebased branch and fixed some edge cases, could you review?

[trivikr]

@araujogui Can you rebase to edit the first commit message and body, as that will land on review.