diff --git a/ChangeLog.md b/ChangeLog.md --- a/ChangeLog.md +++ b/ChangeLog.md @@ -1,5 +1,9 @@ # Changelog for persistent-sqlite +## 2.9.1 + +* Bump vendored SQLite library to [3.26.0](https://www.sqlite.org/releaselog/3_26_0.html) to address [RCE bug: `magellan`](https://blade.tencent.com/magellan/index_en.html). + ## 2.9.0 * Added support for SQL isolation levels to via SqlBackend. [#812] SQLite technically only supports Serializable. diff --git a/Database/Persist/Sqlite.hs b/Database/Persist/Sqlite.hs --- a/Database/Persist/Sqlite.hs +++ b/Database/Persist/Sqlite.hs @@ -118,6 +118,47 @@ -- | Wrap up a raw 'Sqlite.Connection' as a Persistent SQL 'Connection'. -- +-- === __Example usage__ +-- +-- > {-# LANGUAGE GADTs #-} +-- > {-# LANGUAGE ScopedTypeVariables #-} +-- > {-# LANGUAGE OverloadedStrings #-} +-- > {-# LANGUAGE MultiParamTypeClasses #-} +-- > {-# LANGUAGE TypeFamilies #-} +-- > {-# LANGUAGE TemplateHaskell #-} +-- > {-# LANGUAGE QuasiQuotes #-} +-- > {-# LANGUAGE GeneralizedNewtypeDeriving #-} +-- > +-- > import Control.Monad.IO.Class (liftIO) +-- > import Database.Persist +-- > import Database.Sqlite +-- > import Database.Persist.Sqlite +-- > import Database.Persist.TH +-- > +-- > share [mkPersist sqlSettings, mkMigrate "migrateAll"] [persistLowerCase| +-- > Person +-- > name String +-- > age Int Maybe +-- > deriving Show +-- > |] +-- > +-- > main :: IO () +-- > main = do +-- > conn <- open "/home/sibi/test.db" +-- > (backend :: SqlBackend) <- wrapConnection conn (\_ _ _ _ -> return ()) +-- > flip runSqlPersistM backend $ do +-- > runMigration migrateAll +-- > insert_ $ Person "John doe" $ Just 35 +-- > insert_ $ Person "Hema" $ Just 36 +-- > (pers :: [Entity Person]) <- selectList [] [] +-- > liftIO $ print pers +-- > close' backend +-- +-- On executing it, you get this output: +-- +-- > Migrating: CREATE TABLE "person"("id" INTEGER PRIMARY KEY,"name" VARCHAR NOT NULL,"age" INTEGER NULL) +-- > [Entity {entityKey = PersonKey {unPersonKey = SqlBackendKey {unSqlBackendKey = 1}}, entityVal = Person {personName = "John doe", personAge = Just 35}},Entity {entityKey = PersonKey {unPersonKey = SqlBackendKey {unSqlBackendKey = 2}}, entityVal = Person {personName = "Hema", personAge = Just 36}}] +-- -- @since 1.1.5 wrapConnection :: (IsSqlBackend backend) => Sqlite.Connection -> LogFunc -> IO backend wrapConnection = wrapConnectionInfo (mkSqliteConnectionInfo "") diff --git a/Database/Sqlite.hs b/Database/Sqlite.hs --- a/Database/Sqlite.hs +++ b/Database/Sqlite.hs @@ -14,6 +14,44 @@ LogFunction, SqliteStatus (..), SqliteStatusVerb (..), + -- * Basic usage guide + -- | + -- + -- Note that the example code shown here is a low level interface + -- usage. Let's create a small demo sqlite3 database which we will + -- use in our program: + -- + -- > $ sqlite3 ~/test.db + -- > sqlite> create table t1(a,b); + -- > sqlite> insert into t1(a,b) values (1,1); + -- > sqlite> insert into t1(a,b) values (2,2); + -- > sqlite> select * from t1; + -- > 1|1 + -- > 2|2 + -- + -- Now let's write code using the functions in this module to + -- fetch the rows from the table: + -- + -- > {-#LANGUAGE OverloadedStrings#-} + -- > + -- > import Database.Sqlite + -- > import Data.Text + -- > + -- > main :: IO () + -- > main = do + -- > conn <- open "/home/sibi/test.db" + -- > smt <- prepare conn "select * from t1;" + -- > row1 <- step smt >> columns smt + -- > row2 <- step smt >> columns smt + -- > print (row1, row2) + -- > finalize smt + -- > close conn + -- + -- On executing the above code: + -- + -- > $ ./demo-program + -- > $ ([PersistInt64 1,PersistInt64 1],[PersistInt64 2,PersistInt64 2]) + open, close, prepare, diff --git a/cbits/sqlite3.c b/cbits/sqlite3.c # file too large to diff: cbits/sqlite3.c diff --git a/cbits/sqlite3.h b/cbits/sqlite3.h --- a/cbits/sqlite3.h +++ b/cbits/sqlite3.h @@ -123,9 +123,9 @@ ** [sqlite3_libversion_number()], [sqlite3_sourceid()], ** [sqlite_version()] and [sqlite_source_id()]. */ -#define SQLITE_VERSION "3.25.2" -#define SQLITE_VERSION_NUMBER 3025002 -#define SQLITE_SOURCE_ID "2018-09-25 19:08:10 fb90e7189ae6d62e77ba3a308ca5d683f90bbe633cf681865365b8e92792d1c7" +#define SQLITE_VERSION "3.26.0" +#define SQLITE_VERSION_NUMBER 3026000 +#define SQLITE_SOURCE_ID "2018-12-01 12:34:55 bf8c1b2b7a5960c282e543b9c293686dccff272512d08865f4600fb58238b4f9" /* ** CAPI3REF: Run-Time Library Version Numbers @@ -2017,6 +2017,7 @@ ** is invoked. ** **
+** [[SQLITE_DBCONFIG_LOOKASIDE]] **
SQLITE_DBCONFIG_LOOKASIDE
**
^This option takes three additional arguments that determine the ** [lookaside memory allocator] configuration for the [database connection]. @@ -2039,6 +2040,7 @@ ** memory is in use leaves the configuration unchanged and returns ** [SQLITE_BUSY].)^
** +** [[SQLITE_DBCONFIG_ENABLE_FKEY]] **
SQLITE_DBCONFIG_ENABLE_FKEY
**
^This option is used to enable or disable the enforcement of ** [foreign key constraints]. There should be two additional arguments. @@ -2049,6 +2051,7 @@ ** following this call. The second parameter may be a NULL pointer, in ** which case the FK enforcement setting is not reported back.
** +** [[SQLITE_DBCONFIG_ENABLE_TRIGGER]] **
SQLITE_DBCONFIG_ENABLE_TRIGGER
**
^This option is used to enable or disable [CREATE TRIGGER | triggers]. ** There should be two additional arguments. @@ -2059,6 +2062,7 @@ ** following this call. The second parameter may be a NULL pointer, in ** which case the trigger setting is not reported back.
** +** [[SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER]] **
SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER
**
^This option is used to enable or disable the two-argument ** version of the [fts3_tokenizer()] function which is part of the @@ -2072,6 +2076,7 @@ ** following this call. The second parameter may be a NULL pointer, in ** which case the new setting is not reported back.
** +** [[SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION]] **
SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION
**
^This option is used to enable or disable the [sqlite3_load_extension()] ** interface independently of the [load_extension()] SQL function. @@ -2089,7 +2094,7 @@ ** be a NULL pointer, in which case the new setting is not reported back. **
** -**
SQLITE_DBCONFIG_MAINDBNAME
+** [[SQLITE_DBCONFIG_MAINDBNAME]]
SQLITE_DBCONFIG_MAINDBNAME
**
^This option is used to change the name of the "main" database ** schema. ^The sole argument is a pointer to a constant UTF8 string ** which will become the new schema name in place of "main". ^SQLite @@ -2098,6 +2103,7 @@ ** until after the database connection closes. **
** +** [[SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE]] **
SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE
**
Usually, when a database in wal mode is closed or detached from a ** database handle, SQLite checks if this will mean that there are now no @@ -2111,7 +2117,7 @@ ** have been disabled - 0 if they are not disabled, 1 if they are. **
** -**
SQLITE_DBCONFIG_ENABLE_QPSG
+** [[SQLITE_DBCONFIG_ENABLE_QPSG]]
SQLITE_DBCONFIG_ENABLE_QPSG
**
^(The SQLITE_DBCONFIG_ENABLE_QPSG option activates or deactivates ** the [query planner stability guarantee] (QPSG). When the QPSG is active, ** a single SQL query statement will always use the same algorithm regardless @@ -2127,7 +2133,7 @@ ** following this call. **
** -**
SQLITE_DBCONFIG_TRIGGER_EQP
+** [[SQLITE_DBCONFIG_TRIGGER_EQP]]
SQLITE_DBCONFIG_TRIGGER_EQP
**
By default, the output of EXPLAIN QUERY PLAN commands does not ** include output for any operations performed by trigger programs. This ** option is used to set or clear (the default) a flag that governs this @@ -2139,7 +2145,7 @@ ** it is not disabled, 1 if it is. **
** -**
SQLITE_DBCONFIG_RESET_DATABASE
+** [[SQLITE_DBCONFIG_RESET_DATABASE]]
SQLITE_DBCONFIG_RESET_DATABASE
**
Set the SQLITE_DBCONFIG_RESET_DATABASE flag and then run ** [VACUUM] in order to reset a database back to an empty database ** with no schema and no content. The following process works even for @@ -2158,6 +2164,18 @@ ** Because resetting a database is destructive and irreversible, the ** process requires the use of this obscure API and multiple steps to help ** ensure that it does not happen by accident. +** +** [[SQLITE_DBCONFIG_DEFENSIVE]]
SQLITE_DBCONFIG_DEFENSIVE
+**
The SQLITE_DBCONFIG_DEFENSIVE option activates or deactivates the +** "defensive" flag for a database connection. When the defensive +** flag is enabled, language features that allow ordinary SQL to +** deliberately corrupt the database file are disabled. The disabled +** features include but are not limited to the following: +** **
**
*/ @@ -2171,7 +2189,8 @@ #define SQLITE_DBCONFIG_ENABLE_QPSG 1007 /* int int* */ #define SQLITE_DBCONFIG_TRIGGER_EQP 1008 /* int int* */ #define SQLITE_DBCONFIG_RESET_DATABASE 1009 /* int int* */ -#define SQLITE_DBCONFIG_MAX 1009 /* Largest DBCONFIG */ +#define SQLITE_DBCONFIG_DEFENSIVE 1010 /* int int* */ +#define SQLITE_DBCONFIG_MAX 1010 /* Largest DBCONFIG */ /* ** CAPI3REF: Enable Or Disable Extended Result Codes @@ -3609,9 +3628,19 @@ ** on this hint by avoiding the use of [lookaside memory] so as not to ** deplete the limited store of lookaside memory. Future versions of ** SQLite may act on this hint differently. +** +** [[SQLITE_PREPARE_NORMALIZE]] ^(
SQLITE_PREPARE_NORMALIZE
+**
The SQLITE_PREPARE_NORMALIZE flag indicates that a normalized +** representation of the SQL statement should be calculated and then +** associated with the prepared statement, which can be obtained via +** the [sqlite3_normalized_sql()] interface.)^ The semantics used to +** normalize a SQL statement are unspecified and subject to change. +** At a minimum, literal values will be replaced with suitable +** placeholders. ** */ #define SQLITE_PREPARE_PERSISTENT 0x01 +#define SQLITE_PREPARE_NORMALIZE 0x02 /* ** CAPI3REF: Compiling An SQL Statement @@ -3769,6 +3798,11 @@ ** ^The sqlite3_expanded_sql(P) interface returns a pointer to a UTF-8 ** string containing the SQL text of prepared statement P with ** [bound parameters] expanded. +** ^The sqlite3_normalized_sql(P) interface returns a pointer to a UTF-8 +** string containing the normalized SQL text of prepared statement P. The +** semantics used to normalize a SQL statement are unspecified and subject +** to change. At a minimum, literal values will be replaced with suitable +** placeholders. ** ** ^(For example, if a prepared statement is created using the SQL ** text "SELECT $abc,:xyz" and if parameter $abc is bound to integer 2345 @@ -3784,14 +3818,16 @@ ** bound parameter expansions. ^The [SQLITE_OMIT_TRACE] compile-time ** option causes sqlite3_expanded_sql() to always return NULL. ** -** ^The string returned by sqlite3_sql(P) is managed by SQLite and is -** automatically freed when the prepared statement is finalized. +** ^The strings returned by sqlite3_sql(P) and sqlite3_normalized_sql(P) +** are managed by SQLite and are automatically freed when the prepared +** statement is finalized. ** ^The string returned by sqlite3_expanded_sql(P), on the other hand, ** is obtained from [sqlite3_malloc()] and must be free by the application ** by passing it to [sqlite3_free()]. */ SQLITE_API const char *sqlite3_sql(sqlite3_stmt *pStmt); SQLITE_API char *sqlite3_expanded_sql(sqlite3_stmt *pStmt); +SQLITE_API const char *sqlite3_normalized_sql(sqlite3_stmt *pStmt); /* ** CAPI3REF: Determine If An SQL Statement Writes The Database @@ -6281,6 +6317,9 @@ int (*xSavepoint)(sqlite3_vtab *pVTab, int); int (*xRelease)(sqlite3_vtab *pVTab, int); int (*xRollbackTo)(sqlite3_vtab *pVTab, int); + /* The methods above are in versions 1 and 2 of the sqlite_module object. + ** Those below are for version 3 and greater. */ + int (*xShadowName)(const char*); }; /* @@ -7203,6 +7242,7 @@ #define SQLITE_TESTCTRL_OPTIMIZATIONS 15 #define SQLITE_TESTCTRL_ISKEYWORD 16 /* NOT USED */ #define SQLITE_TESTCTRL_SCRATCHMALLOC 17 /* NOT USED */ +#define SQLITE_TESTCTRL_INTERNAL_FUNCTIONS 17 #define SQLITE_TESTCTRL_LOCALTIME_FAULT 18 #define SQLITE_TESTCTRL_EXPLAIN_STMT 19 /* NOT USED */ #define SQLITE_TESTCTRL_ONCE_RESET_THRESHOLD 19 @@ -8615,6 +8655,7 @@ ** can use to customize and optimize their behavior. ** **
+** [[SQLITE_VTAB_CONSTRAINT_SUPPORT]] **
SQLITE_VTAB_CONSTRAINT_SUPPORT **
Calls of the form ** [sqlite3_vtab_config](db,SQLITE_VTAB_CONSTRAINT_SUPPORT,X) are supported, @@ -9384,7 +9425,7 @@ sqlite3_int64 iRowid; /* Rowid for current entry */ sqlite3_rtree_dbl rParentScore; /* Score of parent node */ int eParentWithin; /* Visibility of parent node */ - int eWithin; /* OUT: Visiblity */ + int eWithin; /* OUT: Visibility */ sqlite3_rtree_dbl rScore; /* OUT: Write the score here */ /* The following fields are only available in 3.8.11 and later */ sqlite3_value **apSqlParam; /* Original SQL values of parameters */ @@ -9880,14 +9921,40 @@ ** consecutively. There is no chance that the iterator will visit a change ** the applies to table X, then one for table Y, and then later on visit ** another change for table X. +** +** The behavior of sqlite3changeset_start_v2() and its streaming equivalent +** may be modified by passing a combination of +** [SQLITE_CHANGESETSTART_INVERT | supported flags] as the 4th parameter. +** +** Note that the sqlite3changeset_start_v2() API is still experimental +** and therefore subject to change. */ SQLITE_API int sqlite3changeset_start( sqlite3_changeset_iter **pp, /* OUT: New changeset iterator handle */ int nChangeset, /* Size of changeset blob in bytes */ void *pChangeset /* Pointer to blob containing changeset */ ); +SQLITE_API int sqlite3changeset_start_v2( + sqlite3_changeset_iter **pp, /* OUT: New changeset iterator handle */ + int nChangeset, /* Size of changeset blob in bytes */ + void *pChangeset, /* Pointer to blob containing changeset */ + int flags /* SESSION_CHANGESETSTART_* flags */ +); +/* +** CAPI3REF: Flags for sqlite3changeset_start_v2 +** +** The following flags may passed via the 4th parameter to +** [sqlite3changeset_start_v2] and [sqlite3changeset_start_v2_strm]: +** +**
SQLITE_CHANGESETAPPLY_INVERT
+** Invert the changeset while iterating through it. This is equivalent to +** inverting a changeset using sqlite3changeset_invert() before applying it. +** It is an error to specify this flag with a patchset. +*/ +#define SQLITE_CHANGESETSTART_INVERT 0x0002 + /* ** CAPI3REF: Advance A Changeset Iterator ** METHOD: sqlite3_changeset_iter @@ -10540,7 +10607,7 @@ ), void *pCtx, /* First argument passed to xConflict */ void **ppRebase, int *pnRebase, /* OUT: Rebase data */ - int flags /* Combination of SESSION_APPLY_* flags */ + int flags /* SESSION_CHANGESETAPPLY_* flags */ ); /* @@ -10558,8 +10625,14 @@ ** causes the sessions module to omit this savepoint. In this case, if the ** caller has an open transaction or savepoint when apply_v2() is called, ** it may revert the partially applied changeset by rolling it back. +** +**
SQLITE_CHANGESETAPPLY_INVERT
+** Invert the changeset before applying it. This is equivalent to inverting +** a changeset using sqlite3changeset_invert() before applying it. It is +** an error to specify this flag with a patchset. */ #define SQLITE_CHANGESETAPPLY_NOSAVEPOINT 0x0001 +#define SQLITE_CHANGESETAPPLY_INVERT 0x0002 /* ** CAPI3REF: Constants Passed To The Conflict Handler @@ -10953,6 +11026,12 @@ int (*xInput)(void *pIn, void *pData, int *pnData), void *pIn ); +SQLITE_API int sqlite3changeset_start_v2_strm( + sqlite3_changeset_iter **pp, + int (*xInput)(void *pIn, void *pData, int *pnData), + void *pIn, + int flags +); SQLITE_API int sqlite3session_changeset_strm( sqlite3_session *pSession, int (*xOutput)(void *pOut, const void *pData, int nData), @@ -10979,6 +11058,45 @@ void *pOut ); +/* +** CAPI3REF: Configure global parameters +** +** The sqlite3session_config() interface is used to make global configuration +** changes to the sessions module in order to tune it to the specific needs +** of the application. +** +** The sqlite3session_config() interface is not threadsafe. If it is invoked +** while any other thread is inside any other sessions method then the +** results are undefined. Furthermore, if it is invoked after any sessions +** related objects have been created, the results are also undefined. +** +** The first argument to the sqlite3session_config() function must be one +** of the SQLITE_SESSION_CONFIG_XXX constants defined below. The +** interpretation of the (void*) value passed as the second parameter and +** the effect of calling this function depends on the value of the first +** parameter. +** +**
+**
SQLITE_SESSION_CONFIG_STRMSIZE
+** By default, the sessions module streaming interfaces attempt to input +** and output data in approximately 1 KiB chunks. This operand may be used +** to set and query the value of this configuration setting. The pointer +** passed as the second argument must point to a value of type (int). +** If this value is greater than 0, it is used as the new streaming data +** chunk size for both input and output. Before returning, the (int) value +** pointed to by pArg is set to the final value of the streaming interface +** chunk size. +**
+** +** This function returns SQLITE_OK if successful, or an SQLite error code +** otherwise. +*/ +SQLITE_API int sqlite3session_config(int op, void *pArg); + +/* +** CAPI3REF: Values for sqlite3session_config(). +*/ +#define SQLITE_SESSION_CONFIG_STRMSIZE 1 /* ** Make sure we can call this stuff from C++. diff --git a/persistent-sqlite.cabal b/persistent-sqlite.cabal --- a/persistent-sqlite.cabal +++ b/persistent-sqlite.cabal @@ -1,5 +1,5 @@ name: persistent-sqlite -version: 2.9.0 +version: 2.9.1 license: MIT license-file: LICENSE author: Michael Snoyman