Package: sqlite3-pcre2 Version: 0.1.1~git20220105-e3e02a4a-3 Severity: minor Tags: upstream patch X-Debbugs-Cc: [email protected]
SQLITE_DETERMINISTIC lets sqlite better optimize queries that use REGEXP and is required to use it in partial indexes. SQLITE_INNOCUOUS would be nice to have but only matters when TRUSTED_SCHEMA is turned off. https://sqlite.org/c3ref/c_deterministic.html#sqlitedeterministic SQLITE_DETERMINISTIC The SQLITE_DETERMINISTIC flag means that the new function always gives the same output when the input parameters are the same. The abs() function is deterministic, for example, but randomblob() is not. Functions must be deterministic in order to be used in certain contexts such as with the WHERE clause of partial indexes or in generated columns. SQLite might also optimize deterministic functions by factoring them out of inner loops. https://sqlite.org/c3ref/c_deterministic.html#sqliteinnocuous SQLITE_INNOCUOUS The SQLITE_INNOCUOUS flag means that the function is unlikely to cause problems even if misused. An innocuous function should have no side effects and should not depend on any values other than its input parameters. The abs() function is an example of an innocuous function. The load_extension() SQL function is not innocuous because of its side effects. SQLITE_INNOCUOUS is similar to SQLITE_DETERMINISTIC, but is not exactly the same. The random() function is an example of a function that is innocuous but not deterministic. Some heightened security settings (SQLITE_DBCONFIG_TRUSTED_SCHEMA and PRAGMA trusted_schema=OFF) disable the use of SQL functions inside views and triggers and in schema structures such as CHECK constraints, DEFAULT clauses, expression indexes, partial indexes, and generated columns unless the function is tagged with SQLITE_INNOCUOUS. Most built-in functions are innocuous. Developers are advised to avoid using the SQLITE_INNOCUOUS flag for application-defined functions unless the function has been carefully audited and found to be free of potentially security-adverse side-effects and information-leaks. change pcre2.c line 157 from ```sqlite3_create_function(db, "REGEXP", 2, SQLITE_UTF8, cache, regexp, NULL, NULL);``` to ```sqlite3_create_function(db, "REGEXP", 2, SQLITE_UTF8|SQLITE_DETERMINISTIC|SQLITE_INNOCUOUS, cache, regexp, NULL, NULL);``` -- System Information: Debian Release: forky/sid APT prefers testing APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 7.2.9+deb14-amd64 (SMP w/16 CPU threads; PREEMPT) Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8), LANGUAGE=en_CA:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages sqlite3-pcre2 depends on: ii libc6 2.43-7 ii libpcre2-8-0 10.48-3.1 sqlite3-pcre2 recommends no packages. sqlite3-pcre2 suggests no packages. -- no debconf information
