third_party/sqlite/patches/0011-fts2-Disable-fts2_tokenizer-for-security-reasons.patch

   1 From 971ef3e0fc917c25d7c0037de0c7a6df80068368 Mon Sep 17 00:00:00 2001
   2 From: Scott Hess <shess@chromium.org>
   3 Date: Mon, 22 Dec 2014 14:06:33 -0800
   4 Subject: [PATCH 11/16] [fts2] Disable fts2_tokenizer for security reasons.
   5
   6 This was a leftover bit from merging the Gears SQLite into Chromium's version.
   7
   8 Original commit URL, which also shifted directory structure:
   9     http://src.chromium.org/viewvc/chrome?revision=7623&view=revision
  10 ---
  11  third_party/sqlite/src/ext/fts2/fts2.c | 18 ++++++++++++++++++
  12  1 file changed, 18 insertions(+)
  13
  14 diff --git a/third_party/sqlite/src/ext/fts2/fts2.c b/third_party/sqlite/src/ext/fts2/fts2.c
  15 index dd75b4a..944f324 100644
  16 --- a/third_party/sqlite/src/ext/fts2/fts2.c
  17 +++ b/third_party/sqlite/src/ext/fts2/fts2.c
  18 @@ -37,6 +37,20 @@
  19  ** This is an SQLite module implementing full-text search.
  20  */
  21
  22 +/* TODO(shess): To make it easier to spot changes without groveling
  23 +** through changelogs, I've defined GEARS_FTS2_CHANGES to call them
  24 +** out, and I will document them here.  On imports, these changes
  25 +** should be reviewed to make sure they are still present, or are
  26 +** dropped as appropriate.
  27 +**
  28 +** SQLite core adds the custom function fts2_tokenizer() to be used
  29 +** for defining new tokenizers.  The second parameter is a vtable
  30 +** pointer encoded as a blob.  Obviously this cannot be exposed to
  31 +** Gears callers for security reasons.  It could be suppressed in the
  32 +** authorizer, but for now I have simply commented the definition out.
  33 +*/
  34 +#define GEARS_FTS2_CHANGES 1
  35 +
  36  /*
  37  ** The code in this file is only compiled if:
  38  **
  39 @@ -6822,7 +6836,11 @@ int sqlite3Fts2Init(sqlite3 *db){
  40    ** module with sqlite.
  41    */
  42    if( SQLITE_OK==rc
  43 +#if GEARS_FTS2_CHANGES && !SQLITE_TEST
  44 +      /* fts2_tokenizer() disabled for security reasons. */
  45 +#else
  46     && SQLITE_OK==(rc = sqlite3Fts2InitHashTable(db, pHash, "fts2_tokenizer"))
  47 +#endif
  48     && SQLITE_OK==(rc = sqlite3_overload_function(db, "snippet", -1))
  49     && SQLITE_OK==(rc = sqlite3_overload_function(db, "offsets", -1))
  50     && SQLITE_OK==(rc = sqlite3_overload_function(db, "optimize", -1))
  51 --
  52 2.2.1
  53