From 9e3fd3f6d8ae1693076906f6e462ad6e1f8113a3 Mon Sep 17 00:00:00 2001 From: Brandon Payton Date: Mon, 13 Jul 2026 15:16:39 -0400 Subject: [PATCH] SQLite: cap trigger recursion for WebAssembly stacks --- docs/porting-guide.md | 10 +++++---- packages/registry/sqlite/build-sqlite.sh | 2 ++ packages/registry/sqlite/build-testfixture.sh | 2 ++ packages/registry/sqlite/build.toml | 2 +- ...-keep-sql-length-filler-comment-only.patch | 22 +++++++++++++++++++ 5 files changed, 33 insertions(+), 5 deletions(-) create mode 100644 packages/registry/sqlite/patches/0005-sqllimits1-keep-sql-length-filler-comment-only.patch diff --git a/docs/porting-guide.md b/docs/porting-guide.md index 1107ea2a05..83633f8e2f 100644 --- a/docs/porting-guide.md +++ b/docs/porting-guide.md @@ -785,10 +785,12 @@ bash packages/registry/sqlite/build-testfixture.sh ``` Kandelo builds both the shipped SQLite library and the official testfixture -with compound-select, expression, and JSON recursion limits that fit current -browser and Node WebAssembly host stacks. The testfixture patch set reads those -compiled limits and omits only upstream stress cases that deliberately exceed -them; it does not turn platform failures into successful SQLite results. +with compound-select, expression, JSON, and trigger recursion limits that fit +current browser and Node WebAssembly host stacks. The testfixture patch set +reads those compiled limits and omits only upstream stress cases that +deliberately exceed them; it does not turn platform failures into successful +SQLite results. The `sqllimits1.test` SQL-length filler stays comment-only so +the length-limit check does not hit the lower expression-depth limit first. Then run the harness: diff --git a/packages/registry/sqlite/build-sqlite.sh b/packages/registry/sqlite/build-sqlite.sh index f27891087a..cb3fdb7635 100755 --- a/packages/registry/sqlite/build-sqlite.sh +++ b/packages/registry/sqlite/build-sqlite.sh @@ -25,6 +25,7 @@ SOURCE_SHA256="${WASM_POSIX_DEP_SOURCE_SHA256:-}" SQLITE_MAX_COMPOUND_SELECT="${SQLITE_MAX_COMPOUND_SELECT:-50}" SQLITE_MAX_EXPR_DEPTH="${SQLITE_MAX_EXPR_DEPTH:-100}" SQLITE_JSON_MAX_DEPTH="${SQLITE_JSON_MAX_DEPTH:-100}" +SQLITE_MAX_TRIGGER_DEPTH="${SQLITE_MAX_TRIGGER_DEPTH:-50}" # CLI is a consumer artifact, not a library. Skip it when invoked via # the resolver — it would waste cache space and the consumer-side @@ -68,6 +69,7 @@ SQLITE_CFLAGS="-O2 \ -DSQLITE_MAX_COMPOUND_SELECT=$SQLITE_MAX_COMPOUND_SELECT \ -DSQLITE_MAX_EXPR_DEPTH=$SQLITE_MAX_EXPR_DEPTH \ -DSQLITE_JSON_MAX_DEPTH=$SQLITE_JSON_MAX_DEPTH \ + -DSQLITE_MAX_TRIGGER_DEPTH=$SQLITE_MAX_TRIGGER_DEPTH \ -DHAVE_PREAD=1 \ -DHAVE_PWRITE=1 \ -DSQLITE_ENABLE_FTS5 \ diff --git a/packages/registry/sqlite/build-testfixture.sh b/packages/registry/sqlite/build-testfixture.sh index 4b943c4136..3b2fe3e4ee 100755 --- a/packages/registry/sqlite/build-testfixture.sh +++ b/packages/registry/sqlite/build-testfixture.sh @@ -24,6 +24,7 @@ SQLITE_VERSION="${SQLITE_VERSION:-3.49.1}" SQLITE_MAX_COMPOUND_SELECT="${SQLITE_MAX_COMPOUND_SELECT:-50}" SQLITE_MAX_EXPR_DEPTH="${SQLITE_MAX_EXPR_DEPTH:-100}" SQLITE_JSON_MAX_DEPTH="${SQLITE_JSON_MAX_DEPTH:-100}" +SQLITE_MAX_TRIGGER_DEPTH="${SQLITE_MAX_TRIGGER_DEPTH:-50}" sqlite_packed_version() { local major minor patch @@ -120,6 +121,7 @@ CFLAGS=( -DSQLITE_MAX_COMPOUND_SELECT="$SQLITE_MAX_COMPOUND_SELECT" -DSQLITE_MAX_EXPR_DEPTH="$SQLITE_MAX_EXPR_DEPTH" -DSQLITE_JSON_MAX_DEPTH="$SQLITE_JSON_MAX_DEPTH" + -DSQLITE_MAX_TRIGGER_DEPTH="$SQLITE_MAX_TRIGGER_DEPTH" -DHAVE_PREAD=1 -DHAVE_PWRITE=1 -DSQLITE_OMIT_LOAD_EXTENSION diff --git a/packages/registry/sqlite/build.toml b/packages/registry/sqlite/build.toml index 39bd0eb50a..a072372d5c 100644 --- a/packages/registry/sqlite/build.toml +++ b/packages/registry/sqlite/build.toml @@ -1,7 +1,7 @@ script_path = "packages/registry/sqlite/build-sqlite.sh" repo_url = "https://github.com/brandonpayton/kandelo.git" commit = "8c53383229fab78f97b098c3207a655159c03041" -revision = 3 +revision = 4 [binary] index_url = "https://github.com/Automattic/kandelo/releases/download/binaries-abi-v{abi}/index.toml" diff --git a/packages/registry/sqlite/patches/0005-sqllimits1-keep-sql-length-filler-comment-only.patch b/packages/registry/sqlite/patches/0005-sqllimits1-keep-sql-length-filler-comment-only.patch new file mode 100644 index 0000000000..407ebd21a5 --- /dev/null +++ b/packages/registry/sqlite/patches/0005-sqllimits1-keep-sql-length-filler-comment-only.patch @@ -0,0 +1,22 @@ +--- test/sqllimits1.test ++++ test/sqllimits1.test +@@ -429,8 +429,7 @@ do_test sqllimits1-6.1 { + sqlite3_limit db SQLITE_LIMIT_SQL_LENGTH 50000 + set sql "SELECT 1 WHERE 1==1" + set tail " /* A comment to take up space in order to make the string\ +- longer without increasing the expression depth */\ +- AND 1 == 1" ++ longer without increasing the expression depth */ " + set N [expr {(50000 / [string length $tail])+1}] + append sql [string repeat $tail $N] + catchsql $sql +@@ -439,8 +438,7 @@ do_test sqllimits1-6.3 { + sqlite3_limit db SQLITE_LIMIT_SQL_LENGTH 50000 + set sql "SELECT 1 WHERE 1==1" + set tail " /* A comment to take up space in order to make the string\ +- longer without increasing the expression depth */\ +- AND 1 == 1" ++ longer without increasing the expression depth */ " + set N [expr {(50000 / [string length $tail])+1}] + append sql [string repeat $tail $N] + set nbytes [string length $sql]