matze / wastebin

wastebin is a pastebin 📝
https://bin.bloerg.net
MIT License
336 stars 27 forks source link

Avoid ID clashes #75

Open cgzones opened 3 weeks ago

cgzones commented 3 weeks ago

Currently the the ID for a new paste is randomly generated in the caller of the database insert() function. Then the insert() function tries to insert a new row into the database with that passed ID. There can however already exists a paste in the database with the same ID leading to an insert failure, due to a constraint violation due to the PRIMARY KEY attribute. Checking prior the the INSERT via a SELECT query would open the window for a race condition.

A failure to push a new paste is quite severe, since the user might have spent some some to format the input.

Generate the ID in a loop inside, until the INSERT succeeds.

matze commented 3 weeks ago

An ID clash is indeed an extreme issue but perhaps we can solve it differently by constructing an INSERT query that generates a random primary key?

cgzones commented 3 weeks ago

There exists a sqlite built-in functionrandom(and randomblob), but this would not solve this issue, cause the function might still generate a result already existent in the database. Also we need the ID for the URL path generation, so this approach would require a secondary SQL query to get the ID in all cases (also non-clashing).