sqlite: enforce permissions through a VFS shim

Signed-off-by: Matteo Collina <matteo.collina@gmail.com>

Author: mcollina

node.gyp

@@ -481,8 +481,10 @@
     ],
     'node_sqlite_sources': [
       'src/node_sqlite.cc',
+      'src/node_sqlite_vfs.cc',
       'src/node_webstorage.cc',
       'src/node_sqlite.h',
+      'src/node_sqlite_vfs.h',
       'src/node_webstorage.h',
     ],
     'node_ffi_sources': [

src/node_sqlite.cc

@@ -488,6 +488,7 @@ class BackupJob : public ThreadPoolWork {
                      std::string source_db,
                      std::string destination_name,
                      std::string dest_db,
+                     std::shared_ptr<SQLitePermissionVFS> permission_vfs,
                      int pages,
                      Local<Function> progressFunc)
       : ThreadPoolWork(env, "node_sqlite3.BackupJob"),
@@ -496,7 +497,8 @@ class BackupJob : public ThreadPoolWork {
         pages_(pages),
         source_db_(std::move(source_db)),
         destination_name_(std::move(destination_name)),
-        dest_db_(std::move(dest_db)) {
+        dest_db_(std::move(dest_db)),
+        permission_vfs_(std::move(permission_vfs)) {
     resolver_.Reset(env->isolate(), resolver);
     progressFunc_.Reset(env->isolate(), progressFunc);
   }
@@ -508,7 +510,8 @@ class BackupJob : public ThreadPoolWork {
         destination_name_.c_str(),
         &dest_,
         SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_URI,
-        nullptr);
+        permission_vfs_ == nullptr ? nullptr
+                                   : permission_vfs_->name().c_str());
     Local<Promise::Resolver> resolver =
         Local<Promise::Resolver>::New(env()->isolate(), resolver_);
     if (backup_status_ != SQLITE_OK) {
@@ -609,6 +612,8 @@ class BackupJob : public ThreadPoolWork {
       sqlite3_close_v2(dest_);
       dest_ = nullptr;
     }
+
+    permission_vfs_.reset();
   }
 
  private:
@@ -651,6 +656,7 @@ class BackupJob : public ThreadPoolWork {
   std::string source_db_;
   std::string destination_name_;
   std::string dest_db_;
+  std::shared_ptr<SQLitePermissionVFS> permission_vfs_;
 };
 
 UserDefinedFunction::UserDefinedFunction(Environment* env,
@@ -935,22 +941,58 @@ void DatabaseSync::MemoryInfo(MemoryTracker* tracker) const {
       "open_config", sizeof(open_config_), "DatabaseOpenConfiguration");
 }
 
+namespace {
+
+bool IsSQLiteMemoryLocation(std::string_view location) {
+  return location == ":memory:" ||
+         (location.starts_with("file:") &&
+          (SQLitePathForPermission(location) == ":memory:" ||
+           SQLiteUriParameterEquals(location, "mode", "memory")));
+}
+
+bool IsSQLiteReadOnlyLocation(std::string_view location, bool read_only) {
+  return read_only ||
+         (location.starts_with("file:") &&
+          SQLiteUriParameterEquals(location, "mode", "ro"));
+}
+
+}  // namespace
+
 bool DatabaseSync::Open() {
   if (IsOpen()) {
     THROW_ERR_INVALID_STATE(env(), "database is already open");
     return false;
   }
 
-  // Permission checks: skip for in-memory databases, enforce FS permissions
-  // for file-backed databases.
-  std::string_view db_path = open_config_.location();
-  if (db_path != ":memory:" && !db_path.empty()) {
-    if (open_config_.get_read_only()) {
+  // Permission checks: in-memory databases do not access the filesystem.
+  // SQLite URI modes are handled before the VFS is created so that the
+  // user-facing error remains Node's permission error.
+  std::string_view db_location = open_config_.location();
+  if (!IsSQLiteMemoryLocation(db_location)) {
+    const std::string db_path = SQLitePathForPermission(db_location);
+    const bool read_only =
+        IsSQLiteReadOnlyLocation(db_location, open_config_.get_read_only());
+    THROW_IF_INSUFFICIENT_PERMISSIONS(
+        env(),
+        permission::PermissionScope::kFileSystemRead,
+        db_path,
+        false);
+    if (!read_only) {
       THROW_IF_INSUFFICIENT_PERMISSIONS(
-          env(), permission::PermissionScope::kFileSystemRead, db_path, false);
-    } else {
-      THROW_IF_INSUFFICIENT_PERMISSIONS(
-          env(), permission::PermissionScope::kFileSystemWrite, db_path, false);
+          env(),
+          permission::PermissionScope::kFileSystemWrite,
+          db_path,
+          false);
+    }
+  }
+
+  if (env()->permission()->enabled()) {
+    permission_vfs_ = std::make_shared<SQLitePermissionVFS>(env());
+    if (!permission_vfs_->Register()) {
+      THROW_ERR_SQLITE_ERROR(env()->isolate(),
+                             "Unable to register the SQLite permission VFS");
+      permission_vfs_.reset();
+      return false;
     }
   }
 
@@ -972,12 +1014,19 @@ bool DatabaseSync::Open() {
   int flags = open_config_.get_read_only()
                   ? SQLITE_OPEN_READONLY
                   : SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE;
-  int r = sqlite3_open_v2(open_config_.location().c_str(),
-                          &connection_,
-                          flags | default_flags,
-                          nullptr);
+  int r = sqlite3_open_v2(
+      open_config_.location().c_str(),
+      &connection_,
+      flags | default_flags,
+      permission_vfs_ == nullptr ? nullptr : permission_vfs_->name().c_str());
   CHECK_ERROR_OR_THROW(env()->isolate(), this, r, SQLITE_OK, false);
 
+  if (permission_vfs_ != nullptr) {
+    r = sqlite3_set_authorizer(
+        connection_, DatabaseSync::AuthorizerCallback, this);
+    CHECK_ERROR_OR_THROW(env()->isolate(), this, r, SQLITE_OK, false);
+  }
+
   r = sqlite3_db_config(connection_,
                         SQLITE_DBCONFIG_DQS_DML,
                         static_cast<int>(open_config_.get_enable_dqs()),
@@ -1101,10 +1150,21 @@ std::optional<std::string> ValidateDatabasePath(Environment* env,
   constexpr auto has_null_bytes = [](std::string_view str) {
     return str.find('\0') != std::string_view::npos;
   };
+  const auto validate_uri_vfs = [&](std::string value)
+      -> std::optional<std::string> {
+    if (env->permission()->enabled() && HasSQLiteVfsUriParameter(value)) {
+      THROW_ERR_INVALID_ARG_VALUE(
+          env->isolate(),
+          "The \"%s\" argument must not specify a SQLite VFS.",
+          field_name);
+      return std::nullopt;
+    }
+    return value;
+  };
   if (path->IsString()) {
     Utf8Value location(env->isolate(), path.As<String>());
     if (!has_null_bytes(location.ToStringView())) {
-      return location.ToString();
+      return validate_uri_vfs(location.ToString());
     }
   } else if (path->IsUint8Array()) {
     Local<Uint8Array> buffer = path.As<Uint8Array>();
@@ -1113,7 +1173,8 @@ std::optional<std::string> ValidateDatabasePath(Environment* env,
     auto data =
         static_cast<const uint8_t*>(buffer->Buffer()->Data()) + byteOffset;
     if (std::find(data, data + byteLength, 0) == data + byteLength) {
-      return std::string(reinterpret_cast<const char*>(data), byteLength);
+      return validate_uri_vfs(
+          std::string(reinterpret_cast<const char*>(data), byteLength));
     }
   } else if (path->IsObject()) {  // When is URL
     auto url = path.As<Object>();
@@ -1129,7 +1190,7 @@ std::optional<std::string> ValidateDatabasePath(Environment* env,
           return std::nullopt;
         }
 
-        return location_value.ToString();
+        return validate_uri_vfs(location_value.ToString());
       }
     }
   }
@@ -1452,6 +1513,7 @@ void DatabaseSync::Close(const FunctionCallbackInfo<Value>& args) {
   int r = sqlite3_close_v2(db->connection_);
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
   db->connection_ = nullptr;
+  db->permission_vfs_.reset();
 }
 
 void DatabaseSync::Dispose(const v8::FunctionCallbackInfo<v8::Value>& args) {
@@ -2242,6 +2304,7 @@ void Backup(const FunctionCallbackInfo<Value>& args) {
                                  std::move(source_db),
                                  dest_path.value(),
                                  std::move(dest_db),
+                                 db->PermissionVFS(),
                                  rate,
                                  progressFunc);
   db->AddBackup(job);
@@ -2477,9 +2540,13 @@ void DatabaseSync::SetAuthorizer(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = env->isolate();
 
   if (args[0]->IsNull()) {
-    // Clear the authorizer
-    sqlite3_set_authorizer(db->connection_, nullptr, nullptr);
     db->object()->SetInternalField(kAuthorizerCallback, Null(isolate));
+    if (db->permission_vfs_ == nullptr) {
+      sqlite3_set_authorizer(db->connection_, nullptr, nullptr);
+    } else {
+      sqlite3_set_authorizer(
+          db->connection_, DatabaseSync::AuthorizerCallback, db);
+    }
     return;
   }
 
@@ -2508,16 +2575,19 @@ int DatabaseSync::AuthorizerCallback(void* user_data,
                                      const char* param3,
                                      const char* param4) {
   DatabaseSync* db = static_cast<DatabaseSync*>(user_data);
-  Environment* env = db->env();
-  Isolate* isolate = env->isolate();
-  HandleScope handle_scope(isolate);
-  Local<Context> context = env->context();
+  if (db->permission_vfs_ != nullptr && action_code == SQLITE_ATTACH &&
+      param1 != nullptr && HasSQLiteVfsUriParameter(param1)) {
+    return SQLITE_DENY;
+  }
 
   Local<Value> cb =
       db->object()->GetInternalField(kAuthorizerCallback).template As<Value>();
+  if (!cb->IsFunction()) return SQLITE_OK;
 
-  CHECK(cb->IsFunction());
-
+  Environment* env = db->env();
+  Isolate* isolate = env->isolate();
+  HandleScope handle_scope(isolate);
+  Local<Context> context = env->context();
   Local<Function> callback = cb.As<Function>();
 
   LocalVector<Value> js_argv(

src/node_sqlite.h

@@ -6,12 +6,14 @@
 #include "base_object.h"
 #include "lru_cache-inl.h"
 #include "node_mem.h"
+#include "node_sqlite_vfs.h"
 #include "sqlite3.h"
 #include "util.h"
 
 #include <array>
 #include <list>
 #include <map>
+#include <memory>
 #include <optional>
 #include <string_view>
 #include <unordered_set>
@@ -220,6 +222,9 @@ class DatabaseSync : public BaseObject {
     return open_config_.get_allow_unknown_named_params();
   }
   sqlite3* Connection();
+  std::shared_ptr<SQLitePermissionVFS> PermissionVFS() const {
+    return permission_vfs_;
+  }
 
   // In some situations, such as when using custom functions, it is possible
   // that SQLite reports an error while JavaScript already has a pending
@@ -241,6 +246,7 @@ class DatabaseSync : public BaseObject {
   bool enable_load_extension_;
   sqlite3* connection_;
   bool ignore_next_sqlite_error_;
+  std::shared_ptr<SQLitePermissionVFS> permission_vfs_;
 
   std::set<BackupJob*> backups_;
   std::set<sqlite3_session*> sessions_;