Index: third_party/sqlite/patches/0011-fts2-Disable-fts2_tokenizer-for-security-reasons.patch |
diff --git a/third_party/sqlite/patches/0011-fts2-Disable-fts2_tokenizer-for-security-reasons.patch b/third_party/sqlite/patches/0011-fts2-Disable-fts2_tokenizer-for-security-reasons.patch |
new file mode 100644 |
index 0000000000000000000000000000000000000000..b30be1259278afdb6311586af0c5926380c0a555 |
--- /dev/null |
+++ b/third_party/sqlite/patches/0011-fts2-Disable-fts2_tokenizer-for-security-reasons.patch |
@@ -0,0 +1,53 @@ |
+From 971ef3e0fc917c25d7c0037de0c7a6df80068368 Mon Sep 17 00:00:00 2001 |
+From: Scott Hess <shess@chromium.org> |
+Date: Mon, 22 Dec 2014 14:06:33 -0800 |
+Subject: [PATCH 11/16] [fts2] Disable fts2_tokenizer for security reasons. |
+ |
+This was a leftover bit from merging the Gears SQLite into Chromium's version. |
+ |
+Original commit URL, which also shifted directory structure: |
+ http://src.chromium.org/viewvc/chrome?revision=7623&view=revision |
+--- |
+ third_party/sqlite/src/ext/fts2/fts2.c | 18 ++++++++++++++++++ |
+ 1 file changed, 18 insertions(+) |
+ |
+diff --git a/third_party/sqlite/src/ext/fts2/fts2.c b/third_party/sqlite/src/ext/fts2/fts2.c |
+index dd75b4a..944f324 100644 |
+--- a/third_party/sqlite/src/ext/fts2/fts2.c |
++++ b/third_party/sqlite/src/ext/fts2/fts2.c |
+@@ -37,6 +37,20 @@ |
+ ** This is an SQLite module implementing full-text search. |
+ */ |
+ |
++/* TODO(shess): To make it easier to spot changes without groveling |
++** through changelogs, I've defined GEARS_FTS2_CHANGES to call them |
++** out, and I will document them here. On imports, these changes |
++** should be reviewed to make sure they are still present, or are |
++** dropped as appropriate. |
++** |
++** SQLite core adds the custom function fts2_tokenizer() to be used |
++** for defining new tokenizers. The second parameter is a vtable |
++** pointer encoded as a blob. Obviously this cannot be exposed to |
++** Gears callers for security reasons. It could be suppressed in the |
++** authorizer, but for now I have simply commented the definition out. |
++*/ |
++#define GEARS_FTS2_CHANGES 1 |
++ |
+ /* |
+ ** The code in this file is only compiled if: |
+ ** |
+@@ -6822,7 +6836,11 @@ int sqlite3Fts2Init(sqlite3 *db){ |
+ ** module with sqlite. |
+ */ |
+ if( SQLITE_OK==rc |
++#if GEARS_FTS2_CHANGES && !SQLITE_TEST |
++ /* fts2_tokenizer() disabled for security reasons. */ |
++#else |
+ && SQLITE_OK==(rc = sqlite3Fts2InitHashTable(db, pHash, "fts2_tokenizer")) |
++#endif |
+ && SQLITE_OK==(rc = sqlite3_overload_function(db, "snippet", -1)) |
+ && SQLITE_OK==(rc = sqlite3_overload_function(db, "offsets", -1)) |
+ && SQLITE_OK==(rc = sqlite3_overload_function(db, "optimize", -1)) |
+-- |
+2.2.1 |
+ |