[sql] RecoverDatabase() deletes SQLITE_NOTADB databases.

sql/recovery.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sql/recovery.h"
 
 #include <stddef.h>
 
 #include "base/files/file_path.h"
 #include "base/format_macros.h"
 #include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "sql/connection.h"
 #include "sql/statement.h"
 #include "third_party/sqlite/sqlite3.h"
 #include "third_party/sqlite/src/src/recover.h"
 
 namespace sql {
 
 namespace {
 
 enum RecoveryEventType {

[jwd, 2017/03/02 18:45:29]

Can you add a comment saying this enum is used for recording histograms, and
should not be reordered.

[Scott Hess - ex-Googler, 2017/03/02 18:55:52]

Done.

   // Init() completed successfully.
   RECOVERY_SUCCESS_INIT = 0,
 
   // Failed to open temporary database to recover into.
   RECOVERY_FAILED_OPEN_TEMPORARY,
 
   // Failed to initialize recover vtable system.
   RECOVERY_FAILED_VIRTUAL_TABLE_INIT,
 
   // System SQLite doesn't support vtable.
@@ skipping 65 matching lines @@
 
   // Failed to recover an individual table.
   RECOVERY_FAILED_AUTORECOVERDB_TABLE,
 
   // Failed to recover [sqlite_sequence] table.
   RECOVERY_FAILED_AUTORECOVERDB_SEQUENCE,
 
   // Failed to recover triggers or views or virtual tables.
   RECOVERY_FAILED_AUTORECOVERDB_AUX,
 
+  // After SQLITE_NOTADB failure setting up for recovery, Delete() failed.
+  RECOVERY_FAILED_AUTORECOVERDB_NOTADB_DELETE,
+
+  // After SQLITE_NOTADB failure setting up for recovery, Delete() succeeded
+  // then Open() failed.
+  RECOVERY_FAILED_AUTORECOVERDB_NOTADB_REOPEN,
+
+  // After SQLITE_NOTADB failure setting up for recovery, Delete() and Open()
+  // succeeded, then querying the database failed.
+  RECOVERY_FAILED_AUTORECOVERDB_NOTADB_QUERY,
+
+  // After SQLITE_NOTADB failure setting up for recovery, the database was
+  // successfully deleted.
+  RECOVERY_SUCCESS_AUTORECOVERDB_NOTADB_DELETE,
+
   // Always keep this at the end.
   RECOVERY_EVENT_MAX,
 };
 
 void RecordRecoveryEvent(RecoveryEventType recovery_event) {
   UMA_HISTOGRAM_ENUMERATION("Sqlite.RecoveryEvents",
                             recovery_event, RECOVERY_EVENT_MAX);
 }
 
 }  // namespace
@@ skipping 460 matching lines @@
 // TODO(shess): This conservatively uses Rollback() rather than Unrecoverable().
 // With Rollback(), it is expected that the database will continue to generate
 // errors.  Change the failure cases to Unrecoverable() if/when histogram
 // results indicate that everything is working reasonably.
 //
 // static
 void Recovery::RecoverDatabase(Connection* db,
                                const base::FilePath& db_path) {
   std::unique_ptr<sql::Recovery> recovery = sql::Recovery::Begin(db, db_path);
   if (!recovery) {
-    // TODO(shess): If recovery can't even get started, Raze() or Delete().
-    RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_BEGIN);
+    // Close the underlying sqlite* handle.  Windows does not allow deleting
+    // open files, and all platforms block opening a second sqlite3* handle
+    // against a database when exclusive locking is set.
     db->Poison();
+
+    // Histograms from Recovery::Begin() show all current failures are in
+    // attaching the corrupt database, with 2/3 being SQLITE_NOTADB.  Don't
+    // delete the database except for that specific failure case.
+    {
+      Connection probe_db;
+      if (!probe_db.OpenInMemory() ||
+          probe_db.AttachDatabase(db_path, "corrupt") ||
+          probe_db.GetErrorCode() != SQLITE_NOTADB) {
+        RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_BEGIN);
+        return;
+      }
+    }
+
+    // The database has invalid data in the SQLite header, so it is almost
+    // certainly not recoverable without manual intervention (and likely not
+    // recoverable _with_ manual intervention).  Clear away the broken database.
+    if (!sql::Connection::Delete(db_path)) {
+      RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_NOTADB_DELETE);
+      return;
+    }
+
+    // Windows deletion is complicated by file scanners and malware - sometimes
+    // Delete() appears to succeed, even though the file remains.  The following
+    // attempts to track if this happens often enough to cause concern.
+    {
+      Connection probe_db;
+      if (!probe_db.Open(db_path)) {
+        RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_NOTADB_REOPEN);
+        return;
+      }
+      if (!probe_db.Execute("PRAGMA auto_vacuum")) {
+        RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_NOTADB_QUERY);
+        return;
+      }
+    }
+
+    // The rest of the recovery code could be run on the re-opened database, but
+    // the database is empty, so there would be no point.
+    RecordRecoveryEvent(RECOVERY_SUCCESS_AUTORECOVERDB_NOTADB_DELETE);
     return;
   }
 
 #if DCHECK_IS_ON()
   // This code silently fails to recover fts3 virtual tables.  At this time no
   // browser database contain fts3 tables.  Just to be safe, complain loudly if
   // the database contains virtual tables.
   //
   // fts3 has an [x_segdir] table containing a column [end_block INTEGER].  But
   // it actually stores either an integer or a text containing a pair of
@@ skipping 102 matching lines @@
       // - SQLITE_READONLY - permissions could be fixed.
       // - SQLITE_IOERR - rewrite using new blocks.
       // - SQLITE_FULL - recover in memory and rewrite subset of data.
 
     default:
       return false;
   }
 }
 
 }  // namespace sql